CCNA Practice Test 17 — 15 Questions

Question 1

You are connected to R1 via the console. R1 connects two networks: GigabitEthernet0/0 (192.168.1.1/24) and GigabitEthernet0/1 (192.168.2.1/24). Create an extended ACL named BLOCK_HTTP that denies HTTP traffic (tcp port 80) from the 192.168.1.0/24 network to the 192.168.2.0/24 network, but permits all other IP traffic. Apply this ACL inbound on GigabitEthernet0/0.

Accepted Answer

ip access-list extended BLOCK_HTTP
deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit ip any any
interface GigabitEthernet0/0
ip access-group BLOCK_HTTP in. The correct answer applies the ACL inbound on GigabitEthernet0/0, which is the interface connected to the source network 192.168.1.0/24. The ACL denies HTTP traffic from 192.168.1.0/24 to 192.168.2.0/24 and permits all other IP traffic. Applying it inbound on the source interface ensures that traffic is filtered before it enters the router.

Answer

ip access-list extended BLOCK_HTTP
deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit ip any any
interface GigabitEthernet0/1
ip access-group BLOCK_HTTP in

Answer

ip access-list extended BLOCK_HTTP
deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit ip any any
interface GigabitEthernet0/0
ip access-group BLOCK_HTTP out

Answer

ip access-list extended BLOCK_HTTP
deny tcp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 eq 80
permit ip any any
interface GigabitEthernet0/0
ip access-group BLOCK_HTTP in
interface GigabitEthernet0/1
ip access-group BLOCK_HTTP in

Question 2

Which of the following sequences correctly orders the steps to plan, configure, and apply an extended ACL that permits HTTP traffic from the 192.168.1.0/24 subnet to the server at 10.0.0.1, and deny all other IP traffic, applied inbound on interface GigabitEthernet0/1?

Accepted Answer

Enter global configuration mode, create ACL with permit statement for HTTP from 192.168.1.0/24 to 10.0.0.1, add deny ip any any, enter interface configuration mode for GigabitEthernet0/1, apply ACL inbound.. First enter global config, then create ACL with permit statement, then deny all, then enter interface, then apply ACL inbound.

Answer

Enter interface configuration mode, apply ACL inbound, then create ACL with permit statement, add deny ip any any, exit to global config.

Answer

Enter global configuration mode, create ACL with deny ip any any first, then permit statement for HTTP, enter interface, apply ACL inbound.

Answer

Enter global configuration mode, create ACL with permit statement for HTTP, add deny ip any any, apply ACL outbound on interface GigabitEthernet0/1.

Question 3

Which OSPF component is used to identify routers uniquely inside an OSPF domain?

Accepted Answer

Router ID. The router ID is the unique identifier OSPF uses for each router. It is not the same thing as the process ID, which is locally significant only.

Answer

Area ID

Answer

Hello timer

Answer

Wildcard mask

Question 4

Which TWO statements correctly describe the encapsulation process at the OSI model Transport layer?

Accepted Answer

It breaks data into smaller units called segments (for TCP) or datagrams (for UDP).. At the Transport layer (Layer 4), TCP segments data into segments and UDP segments data into datagrams. This segmentation allows efficient transmission and reassembly at the destination. The Transport layer header includes source and destination port numbers to identify the communicating applications, not IP or MAC addresses.

Answer

It adds source and destination IP addresses to the data.

Answer

It adds a header that includes source and destination MAC addresses.

Answer

It converts data into bits for transmission over the physical medium.

Question 5

Drag and drop the following steps into the correct order to create VLANs, assign access ports, configure 802.1Q trunks, set the native VLAN, and verify with 'show vlan brief' and 'show interfaces trunk'.

Accepted Answer

Create VLANs, assign access ports, configure 802.1Q trunks, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'. VLANs must be created before assigning ports; trunking is configured after access ports; verification is the final step.

Answer

Assign access ports, create VLANs, configure 802.1Q trunks, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'

Answer

Create VLANs, assign access ports, set native VLAN, configure 802.1Q trunks, verify with 'show vlan brief' and 'show interfaces trunk'

Answer

Assign access ports, configure 802.1Q trunks, create VLANs, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'

Question 6

A client receives an IP address but cannot reach remote networks. Which DHCP option is most likely missing or incorrect?

Accepted Answer

Default gateway option. The client can obtain an IP address but cannot reach remote networks, which indicates that the DHCP server is not providing the default gateway (option 3). Without a default gateway, the client has no route to destinations outside its local subnet, so traffic to remote networks is dropped. The DHCP server must be configured to supply the router's IP address as the default gateway for clients to forward inter-network traffic.

Answer

DNS server option

Answer

Lease time option

Answer

TFTP server option

Question 7

Which statement correctly describes a feature of WPA3 security in wireless LANs?

Accepted Answer

WPA3 introduces Simultaneous Authentication of Equals (SAE) to resist offline dictionary attacks.. WPA3 introduces Simultaneous Authentication of Equals (SAE), which uses a Dragonfly key exchange to resist offline dictionary attacks and provide forward secrecy. Option A is wrong because WPA3 does not use or support TKIP encryption; it mandates AES. Option C is wrong because WPA3-Personal uses SAE, not 802.1X/EAP. Option D is wrong because GCMP-256 is only mandatory in the optional WPA3-Enterprise 192-bit security mode, not across all WPA3 deployments; standard WPA3-Personal uses AES-GCMP with 128-bit keys. Option E is wrong because WPA3 requires Protected Management Frames (PMF) by default, unlike WPA2.

Answer

WPA3 uses TKIP encryption for backward compatibility with legacy devices.

Answer

WPA3 relies solely on 802.1X/EAP authentication for both personal and enterprise modes.

Answer

WPA3 mandates the use of GCMP-256 encryption for enhanced security.

Answer

WPA3 makes Protected Management Frames (PMF) optional to support older clients.

Question 8

Which data format is most commonly used in REST APIs because it is lightweight and easy for applications to parse?

Accepted Answer

JSON. JSON is widely used with REST because it is compact, human-readable, and easy for software to parse. It is common in controller APIs and automation workflows.

Answer

YANG

Answer

STP

Answer

TFTP

Question 9

A switchport is configured as an access port for VLAN 20, but users connected to it cannot reach the default gateway. The switch shows the interface as up/up. Which switch misconfiguration is the most likely cause?

Accepted Answer

VLAN 20 has not been created on the switch. If the access port is assigned to VLAN 20 but VLAN 20 does not exist in the VLAN database, traffic is not placed into a usable VLAN and hosts lose connectivity. The port can still appear physically up while forwarding fails at Layer 2.

Answer

The access port is missing a speed command

Answer

The switch has not enabled VTP transparent mode

Answer

The port should use DTP desirable mode

Question 10

R1 and R2 are directly connected via Ethernet on interface G0/0. Both interfaces are in the same subnet and configured for OSPF area 0. After enabling OSPF, R1's G0/0 is stuck in the INIT state in the OSPF neighbor table. What is the most likely cause?

Accepted Answer

Hello and dead timer mismatch. Being stuck in the INIT state means R1 has received Hello packets from R2 but has not transitioned to the 2-WAY state. This most often occurs when critical OSPF parameters like the hello and dead timers do not match. An MTU mismatch, while problematic, would cause the adjacency to fail during database exchange (Exstart/Exchange), not during initial neighbor formation. Missing router IDs are not a real issue because routers auto-generate them, and a duplicate static route to the connected subnet would not affect OSPF neighbor discovery.

Answer

MTU mismatch

Answer

Missing router ID on both routers

Answer

A duplicate static route to 10.1.12.0/30

Question 11

An OSPF-enabled router R1 fails to advertise the 192.168.50.0/24 network to neighbor R2, even though the neighbor relationship is up. Which misconfiguration on R1 would cause this?

Accepted Answer

The wildcard network statement does not match 192.168.50.0/24. If the network statement on R1 does not match the interface connected to 192.168.50.0/24, OSPF will not enable on that interface and the subnet will not be advertised. The route stays absent from neighbors despite OSPF running elsewhere.

Answer

The OSPF process must be process ID 50 to advertise 192.168.50.0/24

Answer

OSPF cannot advertise a directly connected LAN

Answer

R2 needs a default route before learning intra-area routes

Question 12

Exhibit: Users on SW2 in VLAN 30 can reach local devices but not hosts in VLAN 30 on SW1. What is the most likely reason?

Accepted Answer

VLAN 30 is not allowed on the trunk. The trunk is allowing only VLANs 10 and 20. Even though both switches have VLAN 30 defined locally, VLAN 30 traffic cannot cross the trunk unless that VLAN is allowed on the link. Option A is incorrect because the native VLAN (default 1) does not affect tagged VLAN 30 traffic, and native VLAN mismatch causes different issues. Option C is incorrect because VTP is used for VLAN database synchronization, not for forwarding traffic over a trunk; switches do not need to be VTP servers to pass VLAN traffic. Option D is incorrect because spanning tree only blocks redundant paths to prevent loops, not all user VLANs by default.

Answer

The trunk native VLAN is 1 on both sides

Answer

SW2 must run VTP server mode

Answer

Spanning tree blocks all user VLANs by default

Question 13

Exhibit: R1 has the static route 'ip route 0.0.0.0 0.0.0.0 192.0.2.2 200' and also learns a default route from OSPF. Which default route will be installed while the OSPF route is present?

Accepted Answer

The OSPF default route. The OSPF external default route wins because its administrative distance is 110, which is lower than the floating static route's distance of 200. The static route is intentionally given a higher AD so it is used only as a backup.

Answer

The static default route

Answer

Both default routes with per-packet load balancing

Answer

Neither route because floating statics suppress dynamic defaults

Question 14

You are troubleshooting a network connectivity issue on R1. The network 192.168.10.0/24 behind R2 must be reachable from R1 via the primary path through R2 (192.0.2.2). A backup path via R3 (198.51.100.2) should automatically take over if the primary fails. Currently, traffic to 192.168.10.0/24 is incorrectly using the backup path even though the primary path is operational. Analyze the routing table and configuration, then fix the issue so that the primary path is preferred when available.

Accepted Answer

Remove the static route to 192.168.10.0/24 via 198.51.100.2 and add a floating static route via 198.51.100.2 with AD 200. Ensure the primary route via 192.0.2.2 uses default AD 1.. The routing table shows a static route to 192.168.10.0/24 via 198.51.100.2 with Administrative Distance (AD) 1, which is the default for static routes. The intended primary path via 192.0.2.2 was configured with AD 200 (floating static), but because the default AD (1) is lower than 200, the backup route is preferred. The fix is to reconfigure the primary path with the default AD (1) and the backup path with a higher AD (e.g., 200). This ensures the primary path is used when available and the backup takes over only if the primary fails.

Answer

Change the AD of the static route via 192.0.2.2 to 200 and the AD of the route via 198.51.100.2 to 1.

Answer

Add a static route to 192.168.10.0/24 via 192.0.2.2 with AD 1 and remove the existing route via 198.51.100.2.

Answer

Configure a policy-based route to prefer the next-hop 192.0.2.2 for traffic to 192.168.10.0/24.

Question 15

Which TWO statements correctly describe OSPFv2 router-id selection and verification in a single-area configuration?

Accepted Answer

When no 'router-id' is configured, a loopback interface with the highest IP address is preferred over a physical interface for the router-id.. OSPFv2 selects the router-ID based on the highest IP address of any loopback interface when no explicit 'router-id' is configured, making D correct. The 'show ip ospf' command displays the current router-ID, verifying choice E. Option A is incorrect because the router-ID is derived from IP addresses, not MAC addresses. Option B fails because changing the router-ID requires a reload or clearing the OSPF process to take effect. Option C is wrong because each router must have a unique router-ID; they do not need to match across the area.

Answer

The OSPF router-id is automatically derived from the MAC address of the first Ethernet interface.

Answer

If the router-id is changed using the 'router-id' command, the change takes effect immediately without any additional action.

Answer

The router-id must be the same on all routers in a single OSPF area.