CCNA Practice Test 19 — 15 Questions

Question 1

Drag and drop the following steps into the correct order to configure gRPC streaming telemetry subscription on a Cisco IOS-XE device, from initial setup to data collection.

Accepted Answer

Enter global configuration mode, enable telemetry, define subscription with encoding and filter, specify receiver, verify data collection.. The correct order starts with entering global config, then enabling telemetry, defining subscription details (encoding and filter), specifying the receiver, and finally verifying data collection.

Answer

Enable telemetry, define subscription, specify receiver, enter global config, verify data collection.

Answer

Define subscription with encoding and filter, enable telemetry, specify receiver, enter global config, verify data collection.

Answer

Specify receiver, define subscription, enable telemetry, enter global config, verify data collection.

Question 2

Drag and drop the following troubleshooting steps into the correct order to diagnose a client connectivity issue using the OSI bottom-up method.

Accepted Answer

Check physical connectivity, then data link, then network, then transport, then application. The OSI bottom-up method starts at physical layer and moves up. This ensures that lower-layer issues are resolved before higher-layer troubleshooting, preventing wasted effort on symptoms caused by underlying problems.

Answer

Check application, then transport, then network, then data link, then physical

Answer

Check network, then data link, then physical, then transport, then application

Answer

Check physical, then network, then data link, then transport, then application

Question 3

Which three statements about Power over Ethernet (PoE) and PoE+ standards are correct? (Choose three.)

Accepted Answer

PoE+ (IEEE 802.3at) can deliver up to 30 watts of power per port.. Option 1 is correct because the IEEE 802.3af PoE standard specifies a maximum power delivery of 15.4 watts per port at the PSE (Power Sourcing Equipment), with a minimum of 12.95 watts guaranteed at the PD (Powered Device) after cable losses. Option 2 is correct because the IEEE 802.3at PoE+ standard increases the maximum power per port to 30 watts at the PSE, with 25.5 watts available at the PD. Option 4 is correct because PDs can negotiate power requirements using LLDP with the IEEE 802.1AB LLDP-MED (Media Endpoint Discovery) extensions, which include PoE TLV (Type-Length-Value) fields for power negotiation beyond the simple classification method. Option 3 (both PoE and PoE+ use the same four pairs) is incorrect because both standards deliver power over only two pairs (spare or data pairs depending on mode); four-pair power delivery is introduced in IEEE 802.3bt (PoE++). Option 5 (PoE+ requires Category 3 cabling) is incorrect because PoE+ requires at least Category 5e cabling to support the higher power levels without excessive heat or signal degradation. Option 6 (PoE automatically disables power if a non-PoE device is detected) is incorrect because the PSE first performs a detection phase to identify a valid PoE signature; if none is found, power is never applied—so it is not disabled after being enabled.

Answer

PoE automatically disables power if a non-PoE device is detected.

Answer

PoE+ requires Category 3 cabling or better.

Answer

Both PoE and PoE+ use the same four pairs of a twisted-pair cable for power delivery.

Question 4

Drag and drop the route types on the left to the correct administrative distance and use case descriptions on the right.

Accepted Answer

Connected routes: AD 0, directly connected networks. All the given pairings are correct. Connected routes use AD 0 because they are directly connected. Static routes use AD 1 as they are manually configured. EIGRP internal routes have AD 90, and OSPF routes have AD 110; both are IGPs used for routing within the same autonomous system.

Question 5

After configuring a trunk port to allow VLAN 40, a technician finds that VLAN 40 is not listed among the VLANs in spanning tree forwarding state in the show interfaces trunk output. What is the most likely cause?

Accepted Answer

VLAN 40 has not been created in the VLAN database on the switch.. VLAN 40 must exist in the local VLAN database before it can participate in spanning tree on a trunk port. Even if the trunk is configured to allow VLAN 40, if the VLAN has not been created on the switch, the spanning tree protocol will not place it in a forwarding state. The 'show interfaces trunk' output will list only VLANs that are both allowed and existent, so the absence of VLAN 40 in the forwarding state indicates it was never created.

Answer

The trunk port is using ISL encapsulation, which does not support VLAN 40.

Answer

The technician omitted the 'add' keyword when adding VLAN 40 to the allowed list, so the trunk no longer permits VLAN 40.

Answer

VTP pruning is enabled, and VLAN 40 is not needed by any downstream neighbor, so it is pruned from this trunk.

Question 6

A technician is troubleshooting a dual-stack network where an IPv6-only host cannot reach an IPv4 resource. The technician issues the show ipv6 interface brief command on the local router and notices the interface facing the host has a link-local address but no global unicast address. The technician then checks the running configuration and finds that the command ipv6 unicast-routing is missing. What is the most likely cause?

Accepted Answer

IPv6 unicast routing has not been enabled on the router.. The missing `ipv6 unicast-routing` command means the router is not acting as an IPv6 router, so it does not send Router Advertisement (RA) messages. Without RAs, the host cannot autoconfigure a global unicast address or learn a default gateway, breaking IPv6 connectivity to any IPv4 resource even if NAT64 is present.

Answer

An IPv6 access list on the router is blocking Router Advertisement messages.

Answer

The IPv4 resource is not configured for NAT64 translation.

Answer

The host has an incorrect default gateway for IPv6.

Question 7

Drag and drop the protocols/technologies on the left to the descriptions on the right.

Accepted Answer

SSH: Provides secure remote access to network devices using encryption, typically on TCP port 22.. SSH (Secure Shell) provides encrypted remote access to network devices, typically using TCP port 22. It is the secure alternative to Telnet. Telnet (port 23) is unencrypted and insecure. HTTP (port 80) is used for web traffic, not remote access. FTP (port 21) is for file transfers and is not designed for remote shell access. Therefore, only SSH matches the description of secure remote access.

Answer

Telnet: Provides secure remote access to network devices using encryption, typically on TCP port 23.

Answer

HTTP: Provides secure remote access to network devices using encryption, typically on TCP port 80.

Answer

FTP: Provides secure remote access to network devices using encryption, typically on TCP port 21.

Question 8

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a client VLAN and then enable a DHCP relay agent on a different interface to forward client requests to a remote server.

Accepted Answer

Enter global configuration mode, exclude addresses, create the DHCP pool, configure the network and default gateway, enable DHCP relay on the required interface, and verify.. The correct order for configuring a Cisco IOS-XE router as a DHCP server and relay agent is: first exclude addresses to prevent the DHCP server from leasing reserved IPs, then create and configure the DHCP pool (network, default gateway), next enable DHCP relay on the required interface, and finally verify. Only Option D follows this sequence exactly. Options A, B, and C are incorrect because they either place exclusion after pool creation (A) or enable relay before the pool is fully configured (B and C), which can lead to address conflicts or forwarding issues.

Answer

Enter global configuration mode, create the DHCP pool, configure the network and default gateway, exclude addresses, enable DHCP relay on the required interface, and verify.

Answer

Enter global configuration mode, enable DHCP relay on the required interface, create the DHCP pool, configure the network and default gateway, exclude addresses, and verify.

Answer

Enter global configuration mode, create the DHCP pool, enable DHCP relay on the required interface, configure the network and default gateway, exclude addresses, and verify.

Question 9

Drag and drop the following steps into the correct order to configure and recover from a BPDU guard violation on a PortFast-enabled access port.

Accepted Answer

Configure PortFast and BPDU guard on the interface.. The correct order is: first configure PortFast and BPDU guard on the interface (A). Then connect a switch to trigger a BPDU guard violation (B). Next, perform a shutdown followed by no shutdown to recover from the errdisable state (C). Finally, verify that the port is forwarding traffic (D). This sequence ensures the violation occurs before recovery, which is the realistic scenario.

Question 10

A junior network engineer is configuring a new Windows 10 workstation to connect to the corporate network. The network uses a /24 subnet mask and has a default gateway of 192.168.1.1. The workstation obtains its IP address automatically from a DHCP server, but the engineer needs to manually set a static IPv4 address of 192.168.1.50 and ensure the workstation can reach the internet. Which configuration step must the engineer take to satisfy these requirements?

Accepted Answer

Set the subnet mask to 255.255.255.0 and the default gateway to 192.168.1.1. A /24 subnet mask (255.255.255.0) matches the network prefix of the default gateway 192.168.1.1, ensuring the workstation can route traffic to the internet via that gateway. Option A fails because a /16 mask (255.255.0.0) does not match the corporate /24 network, causing incorrect network identification and potential routing issues. Option C fails because leaving the default gateway blank means the host cannot reach any network beyond its local subnet, so internet access is impossible. Option D fails because using the host's own IP (192.168.1.50) as the default gateway would cause the host to attempt to route traffic to itself, never reaching the actual gateway.

Answer

Set the subnet mask to 255.255.0.0 and the default gateway to 192.168.1.1

Answer

Set the subnet mask to 255.255.255.0 and leave the default gateway blank

Answer

Set the subnet mask to 255.255.255.0 and the default gateway to 192.168.1.50

Question 11

Drag and drop the following steps into the correct order to send a RESTCONF GET request to retrieve interface configuration from a Cisco IOS-XE device and apply a configuration change based on the response.

Accepted Answer

Send GET request to retrieve current interface configuration. The correct order for a RESTCONF GET request workflow is: first, send a GET request to retrieve the current interface configuration. Second, analyze the JSON/XML response to identify required changes. Third, create the updated configuration payload in JSON or XML format. Finally, apply the configuration change using a PUT or PATCH request. This sequence ensures you read the existing state before modifying it.

Question 12

Drag and drop the items on the left to match the descriptions on the right.

Accepted Answer

switchport mode trunk: Configures a trunk port. VLANs segment a switch into multiple broadcast domains. 802.1Q trunking encapsulates frames with a VLAN tag, while the native VLAN carries untagged traffic. 'switchport mode trunk' configures a trunk port, 'show vlan brief' lists VLAN assignments, and inter-VLAN routing enables communication between VLANs typically using a router or Layer 3 switch.

Answer

VLAN: Encapsulates frames with a VLAN tag

Answer

802.1Q trunking: Carries untagged traffic on a trunk

Answer

Native VLAN: Segments a switch into multiple broadcast domains

Question 13

An EtherChannel between SW1 and SW2 is not forming. The technician runs the show etherchannel summary command on both switches and sees that all configured interfaces are in the 'I' (stand-alone) state. Both switches have their interfaces configured with channel-group 1 mode active. What should the technician check next?

Accepted Answer

Check for a VLAN mismatch on the member interfaces (e.g., mismatched native VLAN or allowed VLAN list).. When both switches are configured with channel-group 1 mode active, they are using LACP (active/active). The 'I' (stand-alone) state indicates the ports are not forming an EtherChannel despite LACP being enabled. A VLAN mismatch—such as differing native VLANs or allowed VLAN lists—can prevent LACP from successfully negotiating the bundle, as the control plane sees a Layer 2 inconsistency and keeps the ports in stand-alone mode.

Answer

Verify that both switches are using the same EtherChannel protocol (LACP or PAgP).

Answer

Check that the speed and duplex settings match on all member interfaces.

Answer

Determine whether Spanning Tree Protocol is blocking one of the ports.

Question 14

Which four of the following are true statements regarding the operation of DHCP snooping on a Cisco switch? (Choose all that apply. There are four correct answers.)

Accepted Answer

DHCP snooping builds and maintains a DHCP snooping binding database (also called a binding table).. The four correct statements are true because DHCP snooping is a security feature that operates by classifying switch ports as trusted or untrusted. By default, all ports are untrusted, meaning they cannot send DHCP server messages (OFFER, ACK, NAK) unless explicitly configured as trusted. Rate-limiting DHCP messages on untrusted ports mitigates DHCP starvation attacks, and the binding database (MAC-to-IP mapping) is built from DHCP ACK messages to prevent IP spoofing. The incorrect statement "DHCP snooping requires an external DHCP server to be configured on the switch" is false because DHCP snooping itself does not require the switch to act as a DHCP server; it simply relies on DHCP messages from a legitimate server reachable through a trusted port.

Answer

DHCP snooping requires an external DHCP server to be configured on the switch.

Answer

DHCP snooping prevents rogue DHCP servers by allowing only authorized servers on any port.

Question 15

Which three of the following are correct statements about VLAN configuration and verification on a Cisco switch? (Choose three.)

Accepted Answer

By default, all ports on a Cisco switch are in VLAN 1.. The correct statements are: (1) The 'switchport mode access' command places the interface into a non-trunking mode; (2) By default, all ports on a Cisco switch are in VLAN 1; (3) The 'show vlan brief' command displays VLANs that are active on the switch. The remaining statements are false because: VLANs 1002–1005 are reserved for legacy FDDI/Token Ring VLANs, not for user-created VLANs; a VLAN does not need to be manually created before its name can be assigned (assigning a port to a new VLAN can automatically create it, after which you can set its name); and the 'switchport trunk native vlan' command does not restrict the native VLAN to only tagged frames—native VLAN traffic is sent untagged.

Answer

The 'switchport trunk native vlan' command restricts the native VLAN to only tagged frames.

Answer

A VLAN must be manually created before its name can be assigned.

Answer

VLANs 1002–1005 are reserved for user-created VLANs.