CCNA Practice Test 2 — 10 Questions

Question 1

Drag and drop the AAA terms on the left to their correct definitions on the right.

Accepted Answer

Authentication: Verifies the identity of a user or device before granting access to the network.. AAA components: Authentication verifies identity, Authorization controls access, Accounting logs activities. RADIUS is an open standard that combines authentication and authorization, while TACACS+ is a Cisco proprietary protocol that separates all three functions.

Answer

Authorization: Determines what actions or resources an authenticated user is permitted to access.

Answer

Accounting: Logs and tracks user activities, such as login times, commands executed, and data usage.

Answer

RADIUS: A protocol that provides centralized authentication, authorization, and accounting for network access.

Question 2

Which three of the following statements about VLAN Trunking Protocol (VTP) are correct? (Choose three.)

Accepted Answer

VTP transparent mode switches forward VTP advertisements but do not synchronize their VLAN database from the server.. All three selected statements are correct: VTP pruning reduces unnecessary broadcast traffic by pruning inactive VLANs from trunk links; a VTP server can create/modify/delete VLANs and propagates changes; transparent mode forwards advertisements but does not synchronize. The three distractors are incorrect. D: VTP version 3 is not backward compatible with version 1 and 2; it requires compatible versions. E: A VTP client cannot create local VLANs; it only synchronizes from the server. F: VTP uses multicast MAC address 0100.0CCC.CCCC for advertisements, not 0180.c200.0000 which is used by other protocols like STP.

Answer

VTP advertisements are sent as multicast frames using the destination MAC address 0180.c200.0000.

Answer

A switch in VTP client mode can create local VLANs that are not advertised to the rest of the domain.

Answer

VTP version 3 supports extended VLANs (1006-4094) and is backward compatible with VTP version 1 and 2.

Question 3

A switch shows a clock that is several minutes off from other devices even though an NTP server has been configured. Which issue is the most likely cause?

Accepted Answer

The NTP server is unsynchronized or unreachable. NTP requires IP reachability to the time source. If the NTP server is unreachable due to routing or ACL issues, the switch falls back to its local clock, causing drift. Option A is correct. Option B is wrong because Syslog has no effect on NTP synchronization. Option C is incorrect because NTP does not require a trunk port; it can operate over any VLAN with IP connectivity. Option D is false because DNS is only needed if the NTP server is specified by hostname; the server can be reached by IP address without DNS.

Answer

The device must run Syslog before NTP can sync

Answer

NTP requires a trunk port on the management VLAN

Answer

The clock can sync only if DNS is configured

Question 4

Which three statements about Power over Ethernet (PoE) and PoE+ standards are correct? (Choose three.)

Accepted Answer

Powered devices (PDs) can negotiate power requirements using Link Layer Discovery Protocol (LLDP) with PoE extensions.. Option 1 is correct because the IEEE 802.3af PoE standard specifies a maximum power delivery of 15.4 watts per port at the PSE (Power Sourcing Equipment), with a minimum of 12.95 watts guaranteed at the PD (Powered Device) after cable losses. Option 2 is correct because the IEEE 802.3at PoE+ standard increases the maximum power per port to 30 watts at the PSE, with 25.5 watts available at the PD. Option 4 is correct because PDs can negotiate power requirements using LLDP with the IEEE 802.1AB LLDP-MED (Media Endpoint Discovery) extensions, which include PoE TLV (Type-Length-Value) fields for power negotiation beyond the simple classification method. Option 3 (both PoE and PoE+ use the same four pairs) is incorrect because both standards deliver power over only two pairs (spare or data pairs depending on mode); four-pair power delivery is introduced in IEEE 802.3bt (PoE++). Option 5 (PoE+ requires Category 3 cabling) is incorrect because PoE+ requires at least Category 5e cabling to support the higher power levels without excessive heat or signal degradation. Option 6 (PoE automatically disables power if a non-PoE device is detected) is incorrect because the PSE first performs a detection phase to identify a valid PoE signature; if none is found, power is never applied—so it is not disabled after being enabled.

Answer

PoE automatically disables power if a non-PoE device is detected.

Answer

PoE+ requires Category 3 cabling or better.

Answer

Both PoE and PoE+ use the same four pairs of a twisted-pair cable for power delivery.

Question 5

Which three of the following are valid considerations when configuring EtherChannel? (Choose three.)

Accepted Answer

All physical interfaces in an EtherChannel must have the same speed and duplex settings.. All three correct statements (A, B, C) are valid considerations when configuring EtherChannel. Option D is incorrect because load balancing can be based on source/destination IP, MAC, or Layer 4 port, not just MAC addresses. Option E is false because although up to 16 interfaces can be in a port channel, only 8 can be active simultaneously (the remaining are in standby). Option F is false because STP operates on the port-channel interface as a whole, not on individual links within the bundle.

Answer

On a Cisco switch, you can bundle up to 16 interfaces into a single EtherChannel, all of which can be active simultaneously.

Answer

EtherChannel provides loop prevention by using Spanning Tree Protocol on each individual link within the bundle.

Answer

EtherChannel load balancing is always based on source and destination MAC addresses only.

Question 6

Drag and drop the following steps into the correct order to configure HSRP on an interface and verify the active/standby election process, including failover and verification.

Accepted Answer

Enter interface configuration mode, set HSRP version, configure virtual IP, set priority (if needed), enable preempt, then verify with 'show standby'.. The correct order for HSRP configuration is step A: first enter interface configuration mode, set HSRP version, configure the virtual IP, optionally set priority to influence active router selection, enable preempt to allow the higher-priority router to reclaim active role, and verify with 'show standby' to see real-time roles and states. Step B is incorrect because HSRP is configured per interface, not via global configuration and VLAN creation; the virtual IP is set on the interface, not on a VLAN. Step C is wrong because priority should be set after entering interface configuration mode, not before, and verification should use 'show standby' not 'show running-config'. Step D is invalid because there is no global 'router hsrp' command; HSRP configuration is done directly on the interface, and 'debug standby' is not a reliable verification command. 'show standby' is the standard command to verify active/standby status.

Question 7

Why is idempotency valuable in network automation?

Accepted Answer

It ensures repeated runs converge on the same desired state safely.. Idempotent operations can be applied repeatedly without causing unintended changes once the desired state is already present.

Answer

It guarantees every API call will use TCP instead of UDP.

Answer

It encrypts device credentials stored in scripts.

Answer

It forces the controller to use only one management protocol.

Question 8

Which three of the following are correct steps in the process of CDP (Cisco Discovery Protocol) neighbor discovery? (Choose three.)

Accepted Answer

CDP operates at Layer 2 and sends advertisements to the multicast address 01:00:0C:CC:CC:CC.. CDP is a Cisco proprietary Layer 2 protocol that uses multicast MAC address 01:00:0C:CC:CC:CC to send advertisements to directly connected neighbors. Advertisements include device identifier, platform, and capabilities. CDP is enabled by default on Cisco devices and runs over interfaces supporting SNAP headers. Incorrect options: CDP advertisements are sent every 60 seconds by default (not 30); CDP discovers only directly connected neighbors (not devices more than one L2 hop away); CDP does not require both devices to be in the same IP subnet because it operates at Layer 2.

Answer

CDP advertisements are sent every 30 seconds by default.

Answer

CDP can discover devices that are more than one Layer 2 hop away.

Answer

CDP requires that both devices be in the same IP subnet.

Question 9

A network engineer is troubleshooting OSPFv3 adjacency between two directly connected Cisco routers, R1 and R2, both running IOS-XE. The engineer configures OSPFv3 on both routers but notices that the adjacency does not form. The engineer runs 'show ospfv3 neighbor' on R1 and sees no neighbors. What is the most likely cause of this issue?

Accepted Answer

The interface GigabitEthernet0/0 is missing the 'ospfv3 1 ipv6 area 0' command.. Option B is correct because OSPFv3 requires explicit interface-level configuration to enable the protocol on a specific interface. The correct command is 'ospfv3 1 ipv6 area 0' (or 'ipv6 ospf 1 area 0' for the traditional OSPFv3 configuration). Without this command, the interface does not participate in OSPFv3, so no Hello packets are sent or received, preventing adjacency formation.

Answer

The OSPFv3 process ID must match on both routers.

Answer

The link-local addresses are not in the same subnet.

Answer

The router ID 1.1.1.1 is duplicated on R2.

Question 10

Exhibit: Users report no internet access after PAT was configured. The inside and outside interfaces are marked correctly. Which missing configuration is the most likely cause?

Accepted Answer

No ACL and nat overload statement identifying inside source addresses. PAT needs both the inside and outside interface roles and a NAT statement referencing an ACL that identifies the inside local addresses. Without the ACL match and NAT overload rule, translation does not occur for user traffic.

Answer

No DHCP pool on the outside interface

Answer

No CDP enabled on the router

Answer

No syslog server configured