CCNA Practice Test 16 — 15 Questions

Question 1

You are connected to a multilayer switch MLS1. The network has two other switches: SW2 and SW3. The interface GigabitEthernet0/1 already has PortFast and BPDU Guard enabled. Configure MLS1 as the root bridge for VLAN 10 and VLAN 20 using the root primary command. After configuration, verify that the interface is not in err-disabled state and that the root bridge role is correctly assigned.

Accepted Answer

Configure 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary' on MLS1. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.. The interface Gi0/1 already has PortFast and BPDU Guard configured, so no additional configuration is needed for that step. Using 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary' sets the priority to 24576, ensuring MLS1 becomes root for both VLANs. Verify with 'show spanning-tree vlan 10' to see the priority changed and 'show interfaces gigabitEthernet0/1 status' to confirm the port is not err-disabled.

Answer

Configure 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root secondary' on MLS1. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

Answer

Configure 'spanning-tree vlan 10 priority 4096' and 'spanning-tree vlan 20 priority 4096' on MLS1. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

Answer

Configure 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary' on MLS1. Then configure 'spanning-tree portfast default' and 'spanning-tree bpduguard default' globally. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

Question 2

You are connected to the console of a Catalyst 2960+ switch named SW2. Configure the switch so that the IP phone connected to interface FastEthernet0/5 receives power via PoE and uses VLAN 150 for voice traffic, while the PC connected through the phone uses VLAN 50 for data. Additionally, the access point connected to interface FastEthernet0/10 must receive PoE and be placed in VLAN 100. Assume the interfaces are already correctly configured as access ports in VLAN 50 and VLAN 100, respectively. Verify your configuration using the appropriate show commands.

Accepted Answer

On interface FastEthernet0/5: switchport voice vlan 150, power inline auto. On interface FastEthernet0/10: power inline auto. Verify with show interfaces switchport and show power inline.. The switch had no voice VLAN or PoE configured on the ports. On FastEthernet0/5, you need to add 'switchport voice vlan 150' to separate voice traffic from data, and 'power inline auto' to enable PoE for the IP phone. On FastEthernet0/10, you only need to enable PoE with 'power inline auto' because the AP already has its access VLAN set. After configuration, 'show interfaces switchport' will confirm the voice VLAN, and 'show power inline' will verify PoE status.

Answer

On interface FastEthernet0/5: switchport voice vlan 150, power inline auto. On interface FastEthernet0/10: switchport access vlan 100, power inline auto. Verify with show interfaces switchport and show power inline.

Answer

On interface FastEthernet0/5: switchport voice vlan 150, power inline auto. On interface FastEthernet0/10: power inline auto. Verify with show vlan and show power inline.

Answer

On interface FastEthernet0/5: switchport voice vlan 150, power inline auto. On interface FastEthernet0/10: power inline auto. Verify with show interfaces trunk and show power inline.

Question 3

Which TWO statements correctly describe the operation of the ip helper-address command in a DHCP relay agent configuration?

Accepted Answer

It forwards DHCPDISCOVER broadcasts from a client to a DHCP server on a different subnet.. The `ip helper-address` command is configured on the router interface facing the client, and it converts the client's DHCPDISCOVER broadcast into a unicast directed to the specified DHCP server, allowing the client to obtain an IP address from a server on a different subnet. Option D is also correct because the relay agent sets the giaddr (gateway IP address) field in the DHCP packet to its own interface IP address. This is how the DHCP server knows which subnet the client is on and can assign an appropriate IP address and return the reply. Option B is incorrect because the command is configured on the interface facing the DHCP clients, not on the server-facing interface. Option C is incorrect because `ip helper-address` does not forward all UDP broadcasts; it only forwards broadcasts for specific UDP ports (DHCP, DNS, TFTP, etc.) by default, and this list can be modified. Option E is incorrect because the command does not perform any MAC address validation or spoofing protection; it simply relays DHCP messages.

Answer

It is configured on the DHCP server interface to allow replies to reach clients on remote subnets.

Answer

It automatically forwards all UDP broadcasts by default.

Answer

It prevents DHCP spoofing by validating the source MAC address of DHCP packets.

Question 4

A host address is 10.10.10.14/29. Which address is the broadcast address for its subnet?

Accepted Answer

10.10.10.15. A /29 subnet has a block size of 8. In practical terms, the fourth-octet ranges are 0–7, 8–15, 16–23, and so on. Since 14 falls in the 8–15 block, the broadcast address is the last address in that block, which is 10.10.10.15.

This is a classic subnetting question that checks whether you can find the block first and then identify the final address in that block.

Answer

10.10.10.7

Answer

10.10.10.8

Answer

10.10.10.16

Question 5

Based on the exhibit, why is the ACL blocking more traffic than intended?

Accepted Answer

Because the ACL denies all TCP traffic to the server instead of only Telnet.. The ACL is blocking more traffic than intended because it uses a broad deny against all TCP traffic to the server instead of only the one service that should be denied. In practical terms, the requirement is narrow, but the configured entry is much wider. As a result, multiple TCP-based applications to that server are blocked, not just the intended one.

This is a classic precision problem in ACL design. It tests whether you can compare what the business requirement says against what the ACL actually matches.

Answer

Because Telnet uses UDP, not TCP.

Answer

Because the ACL should be a standard ACL, not an extended ACL.

Answer

Because the host keyword can never be used with TCP statements.

Question 6

Which two statements accurately describe DNS in everyday network use?

Accepted Answer

DNS helps resolve hostnames into IP-related information.. DNS translates human-friendly hostnames into IP-related information, making network services more accessible by name rather than numeric addresses. Option A is correct because DNS resolves names to IP addresses. Option B is correct because using names improves usability and allows underlying IP changes without user disruption. Option C is incorrect because IP address assignment is a DHCP function, not DNS. Option D is incorrect because subnet masks are part of IP addressing and routing, unrelated to DNS name resolution. Option E is incorrect because STP (Spanning Tree Protocol) elects a root bridge for loop-free topology, which is unrelated to DNS.

Answer

DNS automatically assigns IP addresses to hosts.

Answer

DNS replaces the need for subnet masks.

Answer

DNS elects the STP root bridge.

Question 7

Drag and drop the following steps into the correct order to describe the router's routing table lookup process for a destination IP address, including the best-path selection logic (longest prefix match, then administrative distance, then metric) and the final forwarding decision.

Accepted Answer

1. Perform longest prefix match on destination IP address
2. If multiple routes match, compare administrative distance
3. If AD is equal, compare metric
4. Forward packet using the best route. The router applies longest prefix match first, then administrative distance, then metric, in that order, to select the best path and forward the packet.

Answer

1. Compare administrative distance of all routes
2. Compare metric of routes with lowest AD
3. Perform longest prefix match on remaining routes
4. Forward packet using the best route

Answer

1. Compare metric of all routes
2. Compare administrative distance of routes with lowest metric
3. Perform longest prefix match on remaining routes
4. Forward packet using the best route

Answer

1. Perform longest prefix match on destination IP address
2. If multiple routes match, compare metric
3. If metric is equal, compare administrative distance
4. Forward packet using the best route

Question 8

You are connected to the console of R1. The network has a point-to-point serial link between R1 and R2. The link is down and the line protocol is down. The cable is a DCE/DTE crossover, and R1 is the DCE. The initial configuration shows the interface with an IP address but no clock rate set.

Accepted Answer

Configure the clock rate on R1's serial interface.. On a serial DCE cable, the DCE end must configure a clock rate to provide timing. Without it, the line protocol stays down. Setting 'clock rate 128000' on R1 resolved the issue.

Answer

Configure the clock rate on R2's serial interface.

Answer

Replace the serial cable with a straight-through cable.

Answer

Set the encapsulation on both ends to PPP.

Question 9

Which two statements accurately describe CAPWAP in a controller-based WLAN context?

Accepted Answer

It is associated with communication between lightweight APs and the wireless LAN controller.. CAPWAP (Control and Provisioning of Wireless Access Points) is the protocol used between lightweight access points (LAPs) and the wireless LAN controller (WLC) in controller-based WLAN architectures. Options C, D, and E are incorrect: CAPWAP is not an SSID; it is a control and data tunneling protocol, not a security standard like WPA2/WPA3; and it supports both IPv4 and IPv6, not just IPv4 ACL filtering.

Answer

It is the same thing as a client SSID.

Answer

It is a replacement for WPA2 and WPA3.

Answer

It is used only for IPv4 ACL filtering.

Question 10

Which of the following sequences correctly orders the steps to plan, configure, and apply an extended ACL that permits HTTP traffic from the 192.168.1.0/24 subnet to the server at 10.0.0.1, and deny all other IP traffic, applied inbound on interface GigabitEthernet0/1?

Accepted Answer

Enter global configuration mode, create ACL with permit statement for HTTP from 192.168.1.0/24 to 10.0.0.1, add deny ip any any, enter interface configuration mode for GigabitEthernet0/1, apply ACL inbound.. First enter global config, then create ACL with permit statement, then deny all, then enter interface, then apply ACL inbound.

Answer

Enter interface configuration mode, apply ACL inbound, then create ACL with permit statement, add deny ip any any, exit to global config.

Answer

Enter global configuration mode, create ACL with deny ip any any first, then permit statement for HTTP, enter interface, apply ACL inbound.

Answer

Enter global configuration mode, create ACL with permit statement for HTTP, add deny ip any any, apply ACL outbound on interface GigabitEthernet0/1.

Question 11

Which OSPF component is used to identify routers uniquely inside an OSPF domain?

Accepted Answer

Router ID. The router ID is the unique identifier OSPF uses for each router. It is not the same thing as the process ID, which is locally significant only.

Answer

Area ID

Answer

Hello timer

Answer

Wildcard mask

Question 12

Which TWO statements correctly describe the encapsulation process at the OSI model Transport layer?

Accepted Answer

It breaks data into smaller units called segments (for TCP) or datagrams (for UDP).. At the Transport layer (Layer 4), TCP segments data into segments and UDP segments data into datagrams. This segmentation allows efficient transmission and reassembly at the destination. The Transport layer header includes source and destination port numbers to identify the communicating applications, not IP or MAC addresses.

Answer

It adds source and destination IP addresses to the data.

Answer

It adds a header that includes source and destination MAC addresses.

Answer

It converts data into bits for transmission over the physical medium.

Question 13

Drag and drop the following steps into the correct order to create VLANs, assign access ports, configure 802.1Q trunks, set the native VLAN, and verify with 'show vlan brief' and 'show interfaces trunk'.

Accepted Answer

Create VLANs, assign access ports, configure 802.1Q trunks, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'. VLANs must be created before assigning ports; trunking is configured after access ports; verification is the final step.

Answer

Assign access ports, create VLANs, configure 802.1Q trunks, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'

Answer

Create VLANs, assign access ports, set native VLAN, configure 802.1Q trunks, verify with 'show vlan brief' and 'show interfaces trunk'

Answer

Assign access ports, configure 802.1Q trunks, create VLANs, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'

Question 14

A client receives an IP address but cannot reach remote networks. Which DHCP option is most likely missing or incorrect?

Accepted Answer

Default gateway option. The client can obtain an IP address but cannot reach remote networks, which indicates that the DHCP server is not providing the default gateway (option 3). Without a default gateway, the client has no route to destinations outside its local subnet, so traffic to remote networks is dropped. The DHCP server must be configured to supply the router's IP address as the default gateway for clients to forward inter-network traffic.

Answer

DNS server option

Answer

Lease time option

Answer

TFTP server option

Question 15

Which statement correctly describes a feature of WPA3 security in wireless LANs?

Accepted Answer

WPA3 introduces Simultaneous Authentication of Equals (SAE) to resist offline dictionary attacks.. WPA3 introduces Simultaneous Authentication of Equals (SAE), which uses a Dragonfly key exchange to resist offline dictionary attacks and provide forward secrecy. Option A is wrong because WPA3 does not use or support TKIP encryption; it mandates AES. Option C is wrong because WPA3-Personal uses SAE, not 802.1X/EAP. Option D is wrong because GCMP-256 is only mandatory in the optional WPA3-Enterprise 192-bit security mode, not across all WPA3 deployments; standard WPA3-Personal uses AES-GCMP with 128-bit keys. Option E is wrong because WPA3 requires Protected Management Frames (PMF) by default, unlike WPA2.

Answer

WPA3 uses TKIP encryption for backward compatibility with legacy devices.

Answer

WPA3 relies solely on 802.1X/EAP authentication for both personal and enterprise modes.

Answer

WPA3 mandates the use of GCMP-256 encryption for enhanced security.

Answer

WPA3 makes Protected Management Frames (PMF) optional to support older clients.

CCNA Practice Test 16 — 15 Questions

Exhibit

CCNA Practice Test 16 — 15 Questions

Exhibit