CCNA Practice Test 19 — 15 Questions

Question 1

You are connected to R1, a Cisco IOS-XE router. Configure SNMP v2c with read-only community 'NetOpsRO' and SNMP v3 with user 'AdminUser' using SHA authentication (password: AuthPass1) and AES-128 encryption (password: PrivPass2). Also enable SNMP traps to the NMS at 192.0.2.10 with community 'TrapComm'. Additionally, configure NetFlow export to 192.0.2.20 using version 9, and ensure the flow exporter is applied to GigabitEthernet0/0. Verify your configuration using 'show snmp' and 'show ip cache flow'.

Accepted Answer

snmp-server community NetOpsRO ro
snmp-server group AdminGroup v3 priv
snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2
snmp-server enable traps
snmp-server host 192.0.2.10 TrapComm
flow exporter EXPORTER
destination 192.0.2.20
version 9
!
flow monitor FLOW-MONITOR
exporter EXPORTER
record netflow ipv4 original-input
!
interface GigabitEthernet0/0
ip flow monitor FLOW-MONITOR input. Option A is the only complete configuration. It defines the SNMPv3 group and user, enables traps, sets up the flow exporter, and crucially defines a flow monitor globally before applying it to the interface. Without the global `flow monitor` definition, the `ip flow monitor ... input` command on the interface would be rejected. Option B omits the SNMP group and uses the deprecated `ip flow export` instead of the modern flow monitor method. Option C is missing the flow monitor definition, and its `snmp-server host` version syntax is unnecessary but not harmful; the real flaw is the absent monitor. Option D attempts to add the flow monitor but incorrectly places the global definition commands inside the interface configuration, which would cause a syntax error.

Answer

snmp-server community NetOpsRO ro
snmp-server user AdminUser v3 auth sha AuthPass1 priv aes 128 PrivPass2
snmp-server enable traps
snmp-server host 192.0.2.10 TrapComm
flow exporter EXPORTER
destination 192.0.2.20
version 9
!
interface GigabitEthernet0/0
ip flow export EXPORTER

Answer

snmp-server community NetOpsRO ro
snmp-server group AdminGroup v3 priv
snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2
snmp-server enable traps
snmp-server host 192.0.2.10 version 2c TrapComm
flow exporter EXPORTER
destination 192.0.2.20
version 9
!
interface GigabitEthernet0/0
ip flow monitor FLOW-MONITOR input

Answer

snmp-server community NetOpsRO ro
snmp-server group AdminGroup v3 priv
snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2
snmp-server enable traps
snmp-server host 192.0.2.10 TrapComm
flow exporter EXPORTER
destination 192.0.2.20
version 9
!
interface GigabitEthernet0/0
ip flow monitor FLOW-MONITOR input
flow monitor FLOW-MONITOR
exporter EXPORTER

Question 2

When spanning tree elects a root bridge, which value is considered first?

Accepted Answer

Lowest bridge ID, which begins with priority. The root bridge is the switch with the lowest bridge ID. The bridge ID is made up of priority and MAC address, so priority is considered first, then MAC address if priorities tie.

Answer

Lowest MAC address only

Answer

Lowest bridge priority only

Answer

Highest interface bandwidth

Question 3

A switch displays this output:

Port      Name               Status    Vlan
Fa0/1                        connected 10
Fa0/2                        connected 10
Fa0/24                       connected trunk

Which port should be checked first if a user in VLAN 20 cannot reach the distribution switch over the uplink?

Accepted Answer

Fa0/24. If users in VLAN 20 must cross the uplink, the trunk port is the first place to verify allowed VLANs and tagging.

Answer

Fa0/1

Answer

Fa0/2

Answer

Any access port in VLAN 1

Question 4

Which two conditions must match for a Layer 2 EtherChannel bundle to form correctly? (Choose two.)

Accepted Answer

The member interfaces must use the same speed and duplex settings.. Member interfaces must have consistent Layer 2 parameters such as speed/duplex and trunk/access characteristics.

Answer

Each member interface must be assigned a different native VLAN.

Answer

One side must use LACP and the other must use PAgP.

Question 5

R3 has the static route 'ip route 172.20.8.0 255.255.255.0 192.168.1.1'. Packets destined for 172.20.8.0/24 are being dropped. What is the most likely cause?

Accepted Answer

The next-hop address is not reachable from R3. A static route can only work if the next-hop address is reachable. If the next hop is down or missing from the routing table, the route cannot forward traffic successfully.

Answer

The destination network mask should be /16 instead of /24

Answer

Static routes require an outbound access list

Answer

The route must use administrative distance 255

Question 6

Drag and drop the following steps into the correct order to configure and recover from a BPDU guard violation on a PortFast-enabled access port in RSTP.

Accepted Answer

Configure PortFast and BPDU guard on the interface.. Configure PortFast and BPDU guard on the access port. Then trigger a violation by connecting an unauthorized switch, which causes the port to error-disable. Diagnose by checking the error-disabled status. To recover, first remove the offending device, then cycle the port with shutdown and no shutdown; otherwise the port will immediately go error-disabled again.

Question 7

Drag and drop the following troubleshooting steps into the correct order to diagnose a client connectivity issue using the OSI bottom-up method.

Accepted Answer

Check the physical cable connections and link lights. The OSI bottom-up troubleshooting method starts at Layer 1: first check physical cable connections and link lights (A). Next, at Layer 2, verify the switch's MAC address table (D) to ensure local segment communication is intact. Moving to Layer 3, confirm the IP address configuration and subnet mask (B) are correct. Finally, ping the default gateway (C) to validate end-to-end Layer 3 connectivity. The correct sequence is A → D → B → C, because each lower layer must function before higher-layer tests can succeed.

Question 8

A network engineer enters the following configuration on R1 and R2, but R1 cannot form an OSPF adjacency with R2 on interface GigabitEthernet0/0.

R1# show running-config interface GigabitEthernet0/0
interface GigabitEthernet0/0
 ip address 10.0.0.1 255.255.255.0
 ip ospf hello-interval 10
 ip ospf dead-interval 40
 ip ospf 1 area 0
!
R2# show running-config interface GigabitEthernet0/0
interface GigabitEthernet0/0
 ip address 10.0.0.2 255.255.255.0
 ip ospf hello-interval 5
 ip ospf dead-interval 20
 ip ospf 1 area 0

What is the most likely cause of the failure?

Accepted Answer

The OSPF timers on the interface do not match.. The routers must agree on hello and dead timers to establish an OSPF adjacency. R1 uses hello=10 and dead=40, while R2 uses hello=5 and dead=20; this mismatch prevents the neighbor relationship. Although both routers share the same area (0) and subnet mask, and OSPF process IDs are locally significant (no match required), the timer difference is the root cause.

Answer

The routers are in different OSPF areas.

Answer

The subnet mask prevents multicast OSPF packets from being exchanged.

Answer

The OSPF process IDs do not match on the two routers.

Question 9

Which two statements accurately describe CAPWAP in a controller-based WLAN context?

Accepted Answer

It is associated with communication between lightweight APs and the wireless LAN controller.. CAPWAP (Control and Provisioning of Wireless Access Points) is the protocol used between lightweight access points (LAPs) and the wireless LAN controller (WLC) in controller-based WLAN architectures. Options C, D, and E are incorrect: CAPWAP is not an SSID; it is a control and data tunneling protocol, not a security standard like WPA2/WPA3; and it supports both IPv4 and IPv6, not just IPv4 ACL filtering.

Answer

It is the same thing as a client SSID.

Answer

It is a replacement for WPA2 and WPA3.

Answer

It is used only for IPv4 ACL filtering.

Question 10

A router has a static route configured: ip route 10.200.0.0 255.255.0.0 GigabitEthernet0/1. The output of show ip interface brief shows that interface GigabitEthernet0/1 is administratively down. Why is the route to 10.200.0.0/16 present in the running configuration but absent from the routing table?

Accepted Answer

Because the route points to an interface that is administratively down.. The static route is absent because the outgoing interface is down. In practical terms, when a static route depends on an interface that is not operational, the router cannot use that path, so the route is not installed as usable forwarding state. The configuration line alone is not enough; the forwarding path also has to be viable.

This is a realistic static-route troubleshooting pattern because it distinguishes between configured intent and operational state.

Answer

Because static routes cannot reference exit interfaces.

Answer

Because the destination must be a /24, not a /16.

Answer

Because static routes require NTP before installation.

Question 11

A switch receives BPDUs on a user-facing port configured as an edge port, but instead of just blocking the port role it fully error-disables it. Which protection feature most likely explains that behavior?

Accepted Answer

BPDU Guard. BPDU Guard most likely explains that behavior. In practical terms, BPDU Guard is used to protect ports that are expected to face ordinary endpoints, not other switches. If BPDUs appear on such a port, the device treats that as a serious topology-policy violation and shuts the port down.

This is different from features that merely influence spanning-tree role choice without fully error-disabling the interface.

Answer

Root guard

Answer

Port security

Answer

DHCP snooping

Question 12

Which TWO statements about interpreting routing table output are true? (Choose two.)

Accepted Answer

A route with a longer prefix length is always preferred over a route with a shorter prefix length, regardless of administrative distance.. Longest-prefix match always wins regardless of AD or route source (A correct), and directly connected routes have AD 0 (B correct). C is incorrect because among equal prefix lengths, lower AD wins. D is wrong because metric only compares same-protocol routes, while AD compares across protocols. E fails because a higher AD (200) is less preferred than OSPF's 110.

Answer

If two routes have the same prefix length, the route with the higher administrative distance is preferred.

Answer

The metric is used to compare routes from different routing protocols.

Answer

A static route configured with an administrative distance of 200 will be preferred over an OSPF route with AD 110 for the same network.

Question 13

R1 and R2 are directly connected via Ethernet on interface G0/0. Both interfaces are in the same subnet and configured for OSPF area 0. After enabling OSPF, R1's G0/0 is stuck in the INIT state in the OSPF neighbor table. What is the most likely cause?

Accepted Answer

Hello and dead timer mismatch. Being stuck in the INIT state means R1 has received Hello packets from R2 but has not transitioned to the 2-WAY state. This most often occurs when critical OSPF parameters like the hello and dead timers do not match. An MTU mismatch, while problematic, would cause the adjacency to fail during database exchange (Exstart/Exchange), not during initial neighbor formation. Missing router IDs are not a real issue because routers auto-generate them, and a duplicate static route to the connected subnet would not affect OSPF neighbor discovery.

Answer

MTU mismatch

Answer

Missing router ID on both routers

Answer

A duplicate static route to 10.1.12.0/30

Question 14

A switchport should allow only one learned MAC address and shut down if a different device is connected later. Which port security violation mode and limit combination best fits that goal?

Accepted Answer

maximum 1 with violation shutdown. The usual setup is maximum 1 MAC address with violation mode shutdown. That way the port is disabled when an unauthorized device appears.

Answer

maximum 10 with violation protect

Answer

maximum 1 with violation restrict and no logging

Answer

maximum unlimited with violation shutdown

Question 15

Exhibit: SW2 receives superior BPDUs on both uplinks. One uplink becomes the root port and the other becomes alternate. Which factor is considered first when SW2 chooses the root port?

Accepted Answer

Lowest root path cost. STP chooses the best path to the root bridge based first on the lowest root path cost. If the cost ties, it then checks the sender bridge ID and sender port ID as tie-breakers.

Answer

Lowest local interface MAC address

Answer

Highest duplex setting

Answer

Lowest configured VLAN number