CCNA Practice Exam 2 — 20 Questions

Question 1

Which TWO statements correctly describe the behavior of standard ACLs and their placement on interfaces?

Accepted Answer

Standard ACLs filter traffic based on source IP address only.. Standard ACLs filter traffic based solely on the source IP address, using numbers 1–99 or 1300–1999 in classic Cisco IOS. They do not consider destination IP, protocol, or port numbers. Because they lack granularity, placing them close to the destination (option D) prevents them from inadvertently blocking traffic that should be permitted, as they cannot distinguish between traffic destined for different services on the same destination host.

Answer

Standard ACLs should be placed as close to the source as possible.

Answer

Standard ACLs can filter traffic based on destination IP address.

Answer

Standard ACLs can filter traffic based on TCP or UDP port numbers.

Question 2

A switch trunk must carry VLANs 10, 20, and 30, but traffic for VLAN 20 is failing. The trunk allowed list on one side is `10,30`. What is the most likely cause?

Accepted Answer

VLAN 20 is missing from the allowed VLAN list on one side of the trunk.. The most likely cause is that VLAN 20 is not in the allowed VLAN list on one side of the trunk. Option B is incorrect because converting the trunk to an access port would block all other VLANs, not just fix VLAN 20. Option C is incorrect because there is no requirement that VLAN 20 must be the native VLAN; native VLAN is unrelated to allowed list filtration. Option D is incorrect because ISL vs 802.1Q does not affect per-VLAN filtering; the allowed list is a separate configuration independent of the encapsulation type.

Answer

The trunk must be converted to an access port for VLAN 20 to work.

Answer

VLAN 20 must always be the native VLAN.

Answer

The switches must both use ISL instead of 802.1Q.

Question 3

A router has both an OSPF route and a static route to the same destination. The static route has an administrative distance of 200. What is the expected behavior while the OSPF route remains available?

Accepted Answer

The static route remains a backup and is used only if the OSPF route is lost.. The static route with an administrative distance of 200 behaves as a floating backup. In plain language, the router keeps it in reserve and prefers the OSPF route while OSPF is healthy, because OSPF’s default administrative distance of 110 is lower and therefore more trusted. The static route does not disappear from the configuration, but it stays out of the active routing table unless the better route is lost.

This is a very common CCNA concept because it shows how routing preference works between different route sources. The higher-distance static route is not useless; it is intentionally configured so that it becomes active only during a failure. That design provides backup routing without interfering with the normal dynamic path. The correct answer is the one describing the static route as a standby or floating route rather than as the preferred path.

Answer

The static route overrides OSPF immediately because static routes always win.

Answer

Both routes must be installed simultaneously because they point to the same destination.

Answer

The router removes the OSPF route because the static route has a manually configured distance.

Question 4

A branch router is running single-area OSPF. An engineer wants an interface to advertise its connected network into OSPF but must prevent hello packets from being sent on that LAN segment. Which two actions achieve that goal?

Accepted Answer

Enable OSPF on the interface or matching network statement. In OSPF, a passive interface still advertises the connected network but does not send or process hello packets. So the interface must participate in OSPF, and then it must be made passive.

Answer

Set the interface network type to point-to-point

Answer

Apply distribute-list out on the interface

Question 5

A subnet must support at least 62 usable IPv4 host addresses. Which prefix is the most restrictive that meets the requirement?

Accepted Answer

/26. A /26 is the smallest valid answer. In practical terms, a /26 provides 64 total addresses and 62 usable host addresses after subtracting the network and broadcast addresses. A /27 would be too small because it provides only 30 usable hosts.

This is a standard minimum-prefix question because it checks whether you can work backward from the host requirement and choose the smallest subnet that fits.

Answer

/27

Answer

/25

Answer

/24

Question 6

Which THREE statements accurately describe the characteristics of NETCONF and RESTCONF for programmatic network configuration?

Accepted Answer

NETCONF uses XML-encoded RPCs over a secure transport such as SSH or TLS.. NETCONF uses XML-encoded Remote Procedure Calls (RPCs) over a secure transport such as SSH or TLS, making option B correct. RESTCONF supports both XML and JSON encoding and uses standard HTTP methods (GET, POST, PUT, PATCH, DELETE), so option C is correct. Both NETCONF and RESTCONF rely on YANG data models to define the structure of configuration and operational data, confirming option D. Option A is incorrect because NETCONF does not use HTTP methods; that is a characteristic of RESTCONF. Option E is wrong because RESTCONF does not use a separate commit operation; changes are applied immediately with each HTTP request, unlike NETCONF's candidate config and commit model.

Answer

NETCONF uses HTTP methods such as GET, POST, PUT, and DELETE to manipulate configuration data.

Answer

NETCONF uses a separate commit operation to apply changes, while RESTCONF uses a similar commit mechanism.

Question 7

A router has learned route 172.16.50.0/24 from OSPF with cost 20 and also has a static route to the same prefix with administrative distance 5. Which two statements are correct about route selection?

Accepted Answer

The static route is installed because it has the lower administrative distance. When the same prefix is learned from different routing sources, the router first compares administrative distance (AD). The static route with AD 5 wins over OSPF with AD 110, so option A is correct. Option C is correct because if the static route is removed, the OSPF route becomes the next best candidate and is installed. Option B is wrong since AD is compared before metrics like OSPF cost; a lower cost does not override a lower AD. Option D is wrong because only one route is installed per destination based on AD, not both.

Answer

The OSPF route is installed because cost 20 is lower than metric 0

Answer

Both routes are installed as equal-cost paths automatically

Question 8

A trunk link between two switches is operational, but one side shows a native VLAN mismatch warning. What is the main concern with that condition?

Accepted Answer

Untagged traffic may be associated with different VLANs on each end of the trunk. A native VLAN mismatch can cause untagged traffic to be interpreted as belonging to different VLANs on each end of the trunk. In plain language, the two switches disagree about where untagged frames belong. That can lead to confusing traffic behavior, reachability problems for certain flows, and operational warnings. It is not always a total outage, but it is a design inconsistency that should be corrected.

This matters because trunks carry multiple VLANs, and the native VLAN defines how untagged traffic is handled. If both ends do not agree, the logical treatment of those frames becomes inconsistent. The correct answer is the one that focuses on misclassification of untagged traffic, not on unrelated routing behavior.

Answer

All tagged VLAN traffic is automatically converted to routed traffic

Answer

The mismatch forces OSPF adjacency reset on all routers

Answer

The trunk can carry only one VLAN until the mismatch is cleared

Question 9

After a hub was connected to interface Gi0/10, the interface immediately entered errdisable state. The following syslog message was generated: '%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred on interface Gi0/10.' What is the strongest explanation for why Gi0/10 shut down?

Accepted Answer

Port security detected more MAC addresses than allowed on the interface.. The strongest explanation is a port-security violation caused by the switch seeing more secure MAC addresses than the interface allows. In practical terms, a hub or unmanaged device can cause multiple end hosts to appear behind one access port. If the interface is configured with a maximum of one secure MAC address, additional learned MACs trigger the violation action.

This is a realistic access-layer security scenario because the port does not fail randomly. It fails because the observed behavior violates the configured policy.

Answer

The interface received a superior BPDU and became the root port.

Answer

The hub forced the interface to become a routed port.

Answer

DHCP snooping always shuts a port when a hub is attached.

Question 10

A network administrator notices that a workstation connected to a Cisco switch port cannot communicate with other devices on the same VLAN. The switch port is up/up, but the workstation reports slow performance and intermittent connectivity. What is the most likely cause of this issue?

Accepted Answer

A duplex mismatch between the switch port and the workstation.. A duplex mismatch occurs when one end of the link is set to full-duplex and the other to half-duplex. The half-duplex end detects collisions and the full-duplex end does not, causing late collisions, CRC errors, and retransmissions. This results in slow performance and intermittent connectivity even though the port is operationally up.

Answer

Replace the faulty Ethernet cable between the switch and the workstation.

Answer

Assign the switch port to the correct VLAN.

Answer

Disable spanning-tree on the port to prevent frequent topology changes.

Question 11

A switch trunk is carrying several VLANs, but VLAN 99 traffic is failing. The trunk allowed list includes VLAN 99 on both sides. Which statement best explains why a VLAN can still fail even when it is allowed?

Accepted Answer

Because the VLAN may still be absent, inactive, or otherwise not operational locally even if it is allowed on the trunk. A VLAN can still fail across a trunk even when it is allowed because the allowed list is only one part of the overall design. In plain language, a switch may permit the VLAN on the link, but if the VLAN does not actually exist locally, is not active, or if some other trunk characteristic is inconsistent, traffic can still fail. This is an important CCNA troubleshooting principle: one correct line of configuration does not guarantee the full end-to-end condition is correct.

Candidates often stop at the allowed VLAN list because it is visible in common show commands. However, VLAN presence, local status, and other trunk parameters still matter. The best answer is the one recognizing that permission on the trunk does not automatically prove the entire VLAN path is healthy.

Answer

Because allowing a VLAN on a trunk automatically disables it

Answer

Because VLANs can cross trunks only when PAT is enabled

Answer

Because VLAN 99 must always be the native VLAN

Question 12

A route to 10.10.10.0/24 is learned through two OSPF paths. Both have the same prefix length and the same administrative distance, but one path has a lower OSPF metric. Which path is preferred?

Accepted Answer

The path with the lower OSPF metric. The path with the lower OSPF metric is preferred. In practical terms, when the prefix and route source are the same, the router uses the routing protocol’s internal path-selection logic. For OSPF, the lower metric is the more attractive path.

This is a clean example of metric-based selection within one routing protocol. Administrative distance is not the deciding factor here because the source protocol is the same on both paths.

Answer

The path with the higher OSPF metric

Answer

Both paths equally, because the administrative distance is the same

Answer

Neither path, because two OSPF routes to the same prefix are invalid

Question 13

An IPv6 host successfully reaches neighbors on its local segment, but it cannot reach remote IPv6 destinations. The host has a global unicast address and a correct prefix length. Which missing item is the strongest suspect?

Accepted Answer

A usable default router or next-hop route for off-link IPv6 traffic. The strongest suspect is the absence of a usable default router learned through IPv6 router advertisements or equivalent configuration. While local connectivity works because the host can communicate on its own link, remote IPv6 destinations require a next hop off the local segment. Option B is wrong because IPv6-to-IPv4 NAT is unnecessary for native IPv6 communication and would not be the primary cause of off-link failure. Option C is wrong because a VLAN trunk on the host NIC is for carrying multiple VLANs, not for enabling off-link routing. Option D is wrong because a second global unicast address does not provide a default route; it only adds another local address.

Answer

A NAT rule translating IPv6 to IPv4

Answer

A VLAN trunk on the host NIC

Answer

A second global unicast address on the same interface

Question 14

Which TWO commands can a network technician use on a modern Linux host to verify the IP address configuration and test reachability to a remote server?

Accepted Answer

ip addr. The `ip addr` command (option A) is the modern Linux utility for displaying IP address configuration, replacing the deprecated `ifconfig`. The `ping` command (option D) uses ICMP Echo Request/Reply messages to test Layer 3 reachability to a remote server. `ifconfig` (option B) is deprecated and not expected for current certification exams; `tracert` (option C) is a Windows command; `nslookup` (option E) performs DNS lookups but does not verify IP configuration or connectivity.

Answer

ifconfig

Answer

tracert

Answer

nslookup

Question 15

Which TWO interface errors are most likely caused by a mismatch in duplex settings between two connected switches?

Accepted Answer

Runts. A duplex mismatch occurs when one switch operates at full duplex while the other operates at half duplex. On the half-duplex side, frames arriving while the interface is transmitting are considered collisions, causing the frame to be truncated into fragments (runts). On the full-duplex side, the switch does not detect collisions but may receive incomplete frames, which are counted as runts if they are less than 64 bytes. CRC errors also spike because the truncated or corrupted frames fail the Frame Check Sequence (FCS) validation.

Answer

Giants

Answer

Input errors

Answer

Output errors

Answer

Flaps

Question 16

A wireless client joins the correct SSID and gets an address in the correct employee subnet, but cannot reach only one internal application while everything else works. Which troubleshooting area is the strongest first target?

Accepted Answer

The path or policy specific to that application, since general employee connectivity already works.. The strongest first target is the application path or policy specific to that application because the client already has general connectivity: it joined the correct SSID, authenticated, and obtained an IP address in the employee subnet. A failure limited to one internal application indicates that basic WLAN join, DHCP, and overall routing are working; therefore, ACLs, firewall rules, DNS resolution for that service, or application-specific policies are the likely cause. Option B (SSID broadcast setting) is irrelevant because the client successfully joined the SSID and has connectivity. Option C (voice VLAN on the wired access port) is not a first target because the symptom involves a single data application, not voice, and the client is on the employee subnet, not a voice VLAN. Option D (OSPF router ID on the client) is invalid because client devices do not typically run OSPF; OSPF runs on routers, not wireless clients.

Answer

The SSID broadcast setting, because the client must not be joined correctly.

Answer

The voice VLAN on the wired access port connected to the AP uplink.

Answer

The OSPF router ID on the client device.

Question 17

A router learns the same destination prefix from OSPF and from a static route configured with administrative distance 90. Which route is preferred by default?

Accepted Answer

The static route with distance 90. The static route is preferred because its administrative distance of 90 is lower than OSPF’s default administrative distance of 110. In practical terms, when the prefix length is the same, the router compares route-source trust next. The lower administrative distance wins.

This question is important because many learners remember that static routes are often strong choices but forget that administrative distance can be tuned. Here, that tuning explicitly makes the static route more preferred than OSPF.

Answer

The OSPF route, because dynamic routes always beat static routes

Answer

Both routes equally, because the prefix is identical

Answer

Neither route, because duplicate information is dropped

Question 18

A small office uses PAT for user Internet access. What mechanism does PAT use to allow many users to share one public address while keeping their sessions distinct?

Accepted Answer

Use transport-layer port values to distinguish multiple inside sessions behind one outside address.. PAT (Port Address Translation) distinguishes multiple inside sessions by rewriting the source port number for each connection while using the same public IP address. This transport-layer port translation allows many internal hosts to share one outside address without conflict. The correct answer identifies the use of port numbers, which is the core mechanism. Increasing the NAT pool or using static NAT would not enable sharing of a single public address. Changing private IPs to be identical or disabling routes are irrelevant to PAT's operation.

Answer

Convert all inside hosts to the same private IP address.

Answer

Increase the size of the NAT pool to include multiple public addresses.

Answer

Configure static NAT mappings for each inside host.

Question 19

Based on the exhibit, why is traffic to 192.168.40.200 using the default route instead of the intended static route?

Accepted Answer

The static route next hop is unreachable or invalid for forwarding.. The intended static route is not being used because the next hop for that static route is not reachable from the current routing table. In practical terms, a route can be configured, but the router still needs a way to resolve and forward to the next-hop address. If that next hop is unreachable, the route may not be installed or usable, so traffic falls back to the default route instead.

This is a realistic troubleshooting pattern because the configuration line alone can look correct until you compare it with actual reachability.

Answer

Default routes always override static routes.

Answer

The destination must be configured as a /16, not a /24.

Answer

Static routes can be used only if OSPF is disabled.

Question 20

A host is configured as 192.168.50.130/25. Which address is the broadcast address for its subnet?

Accepted Answer

192.168.50.255. A /25 divides the /24 into two blocks: 0–127 and 128–255. In plain language, because the host ends in 130, it belongs to the upper half, which starts at 128 and ends at 255. The last address in that block is the broadcast address, so the broadcast is 192.168.50.255.

This is a classic subnetting pattern because it tests whether you can identify not just the subnet, but also the reserved last address in that subnet.

Answer

192.168.50.127

Answer

192.168.50.128

Answer

192.168.50.254