CCNA Practice Test 18 — 15 Questions

Question 1

Drag and drop the following steps into the correct order to configure an IPv4 static address on a Windows host, generate an IPv6 EUI-64 address on a Cisco router, verify the router's IPv6 EUI-64 address, and confirm connectivity from the Windows host.

Accepted Answer

Set static IPv4 address on Windows host. The correct order is: first configure the router's IPv6 EUI-64 address to set up the network infrastructure, then assign the Windows host a static IPv4 address. Next, verify the router's IPv6 EUI-64 address to confirm proper generation. Finally, perform a connectivity test from the Windows host to validate end-to-end communication. This sequence ensures that configuration is completed before verification and that the final step confirms both configurations are operational.

Question 2

After a hub was connected to interface Gi0/10, the interface immediately entered errdisable state. The following syslog message was generated: '%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred on interface Gi0/10.' What is the strongest explanation for why Gi0/10 shut down?

Accepted Answer

Port security detected more MAC addresses than allowed on the interface.. The strongest explanation is a port-security violation caused by the switch seeing more secure MAC addresses than the interface allows. In practical terms, a hub or unmanaged device can cause multiple end hosts to appear behind one access port. If the interface is configured with a maximum of one secure MAC address, additional learned MACs trigger the violation action.

This is a realistic access-layer security scenario because the port does not fail randomly. It fails because the observed behavior violates the configured policy.

Answer

The interface received a superior BPDU and became the root port.

Answer

The hub forced the interface to become a routed port.

Answer

DHCP snooping always shuts a port when a hub is attached.

Question 3

An administrator configures a GRE tunnel interface on a router with the following: interface Tunnel0, tunnel source GigabitEthernet0/0, tunnel destination 192.168.2.2. What is the main purpose of this configured tunnel?

Accepted Answer

It creates a logical tunnel across another network.. GRE is a tunneling mechanism used to carry one type of traffic over another network path by encapsulating packets. In practical terms, the configuration creates a logical tunnel between endpoints so traffic can cross an underlying IP network as if a virtual path existed between them. The key point is that GRE is about tunneling, not encryption by itself.

This distinction matters because people often assume tunnels automatically imply encryption. GRE by itself does not provide that.

Answer

It enables PPP authentication on a serial interface.

Answer

It configures WPA3 security for a wireless bridge.

Answer

It enables BGP between autonomous systems automatically.

Question 4

Exhibit: Users on SW2 in VLAN 30 can reach local devices but not hosts in VLAN 30 on SW1. What is the most likely reason?

Accepted Answer

VLAN 30 is not allowed on the trunk. The trunk is allowing only VLANs 10 and 20. Even though both switches have VLAN 30 defined locally, VLAN 30 traffic cannot cross the trunk unless that VLAN is allowed on the link. Option A is incorrect because the native VLAN (default 1) does not affect tagged VLAN 30 traffic, and native VLAN mismatch causes different issues. Option C is incorrect because VTP is used for VLAN database synchronization, not for forwarding traffic over a trunk; switches do not need to be VTP servers to pass VLAN traffic. Option D is incorrect because spanning tree only blocks redundant paths to prevent loops, not all user VLANs by default.

Answer

The trunk native VLAN is 1 on both sides

Answer

SW2 must run VTP server mode

Answer

Spanning tree blocks all user VLANs by default

Question 5

A PC connected to SW1 cannot reach the default gateway. The access port is assigned to VLAN 20, and the switch output shows that VLAN 20 is inactive. What is the most likely cause?

Accepted Answer

VLAN 20 does not exist or is not active on the switch. The port is operationally up, but VLAN 20 is listed as inactive because that VLAN does not exist in the VLAN database. An access port assigned to a missing VLAN will not carry normal user traffic for that VLAN.

Answer

Port security has shut down the interface

Answer

The port must be converted to a trunk

Answer

The default gateway must be configured on the physical switch port

Question 6

Why is BPDU Guard commonly enabled on PortFast-enabled access ports?

Accepted Answer

To err-disable a port if it receives unexpected BPDUs. PortFast ports are meant for end devices, not for switches. BPDU Guard protects the LAN by shutting down a PortFast port that unexpectedly starts receiving BPDUs, which usually means an unauthorized switch was connected.

Answer

To make STP root election happen faster

Answer

To disable STP permanently on access ports

Answer

To allow only one MAC address on the access port

Question 7

Exhibit: SW1 is configured for EtherChannel with LACP, but the bundle does not form. What is the most likely cause?

Accepted Answer

One side is using LACP and the other side is using a static EtherChannel mode. For an LACP EtherChannel to form, both sides must negotiate with LACP using active or passive mode. One side here is set to channel-group mode on, which creates a static channel and does not speak LACP. That mismatch prevents the bundle from forming.

Answer

The interfaces should use PAgP instead of LACP on both ends

Answer

The links must be routed ports before EtherChannel can form

Answer

EtherChannel requires three or more member links

Question 8

Which VLAN is used by default for most switch ports on a new Cisco switch?

Accepted Answer

VLAN 1. On a default Cisco switch, access ports belong to VLAN 1 until changed. Best practice is usually to move user ports away from VLAN 1, but the default is still VLAN 1.

Answer

VLAN 99

Answer

VLAN 1002

Answer

No VLAN until the port is manually assigned

Question 9

Which wireless design objective is achieved by using nonoverlapping channels in adjacent cells?

Accepted Answer

It reduces interference between nearby APs. The correct answer is B because using nonoverlapping channels minimizes interference between adjacent APs, improving wireless performance in dense environments. Option A is wrong because nonoverlapping channels have no effect on PoE budget, which is determined by the switch and cable specifications. Option C is wrong because authentication mechanisms operate independently of channel assignment and are still required. Option D is wrong because nonoverlapping channels are used in both the 2.4 GHz and 5 GHz bands, and they do not mandate client use of a specific frequency.

Answer

It increases PoE budget for the access points

Answer

It removes the need for authentication

Answer

It forces all clients to use 5 GHz only

Question 10

Which TWO statements correctly describe OSPFv2 DR/BDR election behavior in a multi-access network?

Accepted Answer

The router with the highest OSPF interface priority is elected as the DR.. Options A and C are correct: OSPFv2 DR election first compares interface priority (highest wins), and if equal, the highest Router ID (RID) wins. Option B is incorrect because a priority of 0 prevents a router from ever becoming DR or BDR. Option D is incorrect because the election is non‑preemptive; a router with higher priority won't take over until the current DR/BDR fails. Option E is incorrect because DR and BDR form full adjacencies with all routers on the segment, not just with each other.

Answer

A router with OSPF priority 0 can become the BDR if no other router has a higher priority.

Answer

The DR election is preemptive; a new router with a higher priority will immediately take over as DR.

Answer

All routers on a multi-access network form full adjacencies with the DR and BDR only.

Question 11

Two switches are connected via an IEEE 802.1Q trunk. Hosts in VLAN 30 on opposite sides cannot communicate, yet hosts in VLAN 10 communicate normally. Both switches have VLAN 30 in their VLAN database, and the trunk link is operational. What is the most likely cause?

Accepted Answer

VLAN 30 is pruned or not allowed on one side of the trunk. If a VLAN is not allowed on one side of the trunk, frames for that VLAN are dropped even though other VLANs continue to work. Option A correctly identifies that VLAN 30 is either pruned or missing from the allowed list on one end. Option B is wrong because the native VLAN only affects untagged frames and would not cause the filtering of a tagged VLAN like VLAN 30. Option C is incorrect because STP can block individual VLANs per port, but it does not block all VLANs on a trunk due to a single VLAN’s issue—only the affected VLAN would be blocked. Option D is invalid because converting the trunk to access mode would break all VLAN trunking, including the working VLAN 10.

Answer

The native VLAN must be set to 30

Answer

STP blocks all VLANs on the trunk when one VLAN fails

Answer

The trunk must be changed to access mode for VLAN 30

Question 12

A network administrator notices that hosts in VLAN 10 cannot ping the default gateway (192.168.10.1). The switch's SVI for VLAN 10 is configured and the output of the show ip interface brief command shows its status as up/up. An embedded packet capture is configured. The exhibit shows ARP requests from a host to 192.168.10.1 but no ARP reply. Based on the exhibit, what is the most likely cause of the connectivity issue?

Accepted Answer

The switchport connecting the host is not assigned to VLAN 10.. The correct answer is B because the packet capture shows ARP requests from the host but no reply, indicating the switch's VLAN 10 SVI is not receiving the ARP frames. Since the SVI is confirmed up/up, the most likely cause is that the switchport connecting the host is not assigned to VLAN 10, causing the frames to be on a different VLAN. Option A is incorrect because the host's default gateway is correctly set to 192.168.10.1 (the SVI's IP); ARP requests are being sent but not answered. Option C is wrong because an ACL on the SVI would not block ARP (ARP is a Layer 2 protocol not filtered by IP ACLs), and the capture would show a reply if the SVI received the request. Option D is incorrect because the exhibit shows the SVI is up/up, ruling out an administratively down condition.

Answer

The default gateway is configured incorrectly on the host.

Answer

An ACL is applied to the SVI blocking ICMP.

Answer

The SVI is administratively down.

Question 13

An engineer wants rapid transition to forwarding on end-user switchports while still protecting the topology from accidental switch connections. Which two STP-related features fit that design?

Accepted Answer

PortFast on user-facing access ports. PortFast improves the user experience on edge ports, and BPDU Guard keeps those ports from becoming unintended switch uplinks.

Answer

Root Guard on every user-facing port instead of PortFast

Answer

Loop Guard on hosts to accelerate DHCP

Question 14

A trunk link between two switches is up, but hosts in VLAN 30 on opposite switches cannot communicate. VLAN 10 works across the same trunk. Which two causes are the most likely?

Accepted Answer

VLAN 30 is not allowed on the trunk on one side. When one VLAN fails but others work across the same trunk, the problem is likely VLAN-specific. VLAN 30 may not exist on one switch or may not be allowed on the trunk. Option C is incorrect because the native VLAN does not need to be 30; a native VLAN mismatch would typically cause connectivity issues on all VLANs, not just VLAN 30. Option D is incorrect because PortFast only affects the speed at which an access port enters the forwarding state and does not impact communication across an already-up trunk.

Answer

The trunk native VLAN should always be 30

Answer

PortFast must be disabled on the access ports in VLAN 30

Question 15

A network administrator has configured a switch port to support a VoIP phone and a desktop PC. Users report that the desktop PC cannot obtain an IP address via DHCP, while the VoIP phone registers successfully. The switch port is up/up, and the desktop is connected to the phone's PC port. What is the most likely cause of the issue?

Accepted Answer

The switchport access vlan should be changed to the data VLAN to match the subnet expected by the desktop.. The desktop PC obtains its IP address from the data VLAN, but the switch port's access VLAN is likely misconfigured to the voice VLAN. Changing the access VLAN to the correct data VLAN places the PC in the proper subnet and allows DHCP to function. Option A is unnecessary because a voice-access port does not need to be a trunk. Option C would break the VoIP phone without fixing the PC's VLAN assignment. Option D is irrelevant; PortFast speeds up STP convergence and does not block DHCP.

Answer

The switchport mode access should be changed to switchport mode trunk to allow both vlans.

Answer

The switchport voice vlan should be removed because the desktop cannot use it.

Answer

The spanning-tree portfast should be disabled to prevent DHCP delays.