CCNA Practice Exam 3 — 20 Questions

Question 1

Why is HTTPS usually preferred over HTTP when accessing a controller API?

Accepted Answer

Because HTTPS provides encrypted transport for API traffic.. HTTPS is preferred because it protects the communication with encryption while it crosses the network. In practical terms, controller APIs often carry tokens, credentials, device state, or configuration information that should not be exposed in clear text. HTTPS helps protect those requests and responses in transit.

This does not make HTTPS the same thing as JSON, nor does it remove the need for authentication. It is simply the more secure transport choice for sensitive API communication.

Answer

Because HTTPS automatically replaces authentication.

Answer

Because HTTPS is the only format that can carry JSON.

Answer

Because HTTP cannot carry controller data at all.

Question 2

Which WAN technology is most closely associated with establishing a direct point-to-point data-link connection between two routers over a serial link?

Accepted Answer

PPP. PPP is the WAN technology most closely associated with point-to-point serial connections between routers. In practical terms, it is a Layer 2 WAN encapsulation method commonly discussed in traditional serial WAN contexts. It supports features such as authentication and link negotiation that make it more flexible than older basic encapsulations.

This is one of the classic CCNA WAN topics.

Answer

CAPWAP

Answer

SNMP

Answer

STP

Question 3

A user reports that a laptop can connect to the correct SSID but repeatedly fails authentication when joining the WLAN. Which category of issue is most strongly indicated?

Accepted Answer

A security or authentication mismatch related to WLAN access. The strongest indication is a wireless security or authentication mismatch rather than a pure RF coverage problem. In practical terms, the laptop can already see and attempt to join the correct SSID, which means discovery is working. Repeated authentication failure points more directly to credentials, security settings, or authentication-policy alignment than to channel or signal absence.

This question is about recognizing the stage of failure. The client is finding the WLAN, but it is not being accepted onto it.

Answer

A missing OSPF router ID on the access point

Answer

A routed-port mismatch on the switch uplink

Answer

A DHCP relay problem on the client

Question 4

A network administrator is troubleshooting connectivity loss in a switched network. All switches run Rapid PVST+. A host connected to an access port on SwitchC can no longer reach the default gateway. The access port is configured with PortFast and BPDU Guard. The administrator checks the interface status and finds it in an err-disabled state. What is the most likely cause of this issue?

Accepted Answer

BPDU Guard detected a BPDU on a PortFast-enabled port and disabled it.. B is correct because BPDU Guard is designed to protect the spanning-tree topology by disabling a PortFast-enabled port if it receives a BPDU, placing the port in err-disabled state. Option A is incorrect: a root bridge election failure would not cause a port to err-disable; loops do not directly trigger this state without BPDU Guard. Option C is incorrect because PortFast and BPDU Guard work with all spanning-tree variants including Rapid PVST+. Option D is incorrect: a trunk misconfiguration alone would not cause err-disable unless BPDU Guard detects a BPDU on a PortFast port.

Answer

The root bridge election failed, causing a loop.

Answer

Rapid PVST+ is not compatible with PortFast.

Answer

The port is configured as a trunk but should be an access port.

Question 5

Which IPv6 address type is automatically created on an interface and used for communication on the local link only?

Accepted Answer

Link-local. Every IPv6-enabled interface generates a link-local address, typically in the FE80::/10 range. It is used for neighbor discovery, local communication, and next-hop resolution on the same link.

Answer

Global unicast

Answer

Unique local

Answer

Multicast

Question 6

A standard ACL and an extended ACL are both available for a design. Which requirement most strongly indicates that an extended ACL is needed?

Accepted Answer

The policy must distinguish traffic by destination, protocol, or port.. An extended ACL is most strongly indicated when the policy must match not just on source address, but also on destination, protocol, or port information. In practical terms, if the requirement is something like “block HTTP but allow SSH” or “deny traffic to one server but not another,” a standard ACL is too limited because it mainly matches only the source. Option B (matching only one source subnet) can be done with a standard ACL, so it does not demand an extended ACL. Option C (placement near destination) is a guideline for standard ACLs, not a reason to choose an extended ACL. Option D (IPv6) is irrelevant because the scenario explicitly states both ACL types are available and standard ACLs do not exist for IPv6—this question is about IPv4 ACLs.

Answer

The policy needs to match only one source subnet.

Answer

The ACL must be placed near the destination.

Answer

The network uses IPv6 instead of IPv4.

Question 7

Exhibit: R1 shows an OSPF neighbor stuck in EXSTART with R2 on a serial link. What is the most likely cause?

Accepted Answer

An interface MTU mismatch between the routers. When two OSPF routers stay in EXSTART, the first thing to suspect is an MTU mismatch. They can discover each other, but database exchange does not complete because the DBD packets do not agree on interface MTU.

Answer

An OSPF area mismatch

Answer

A duplicate router ID on R1 and R2

Answer

A missing default route on R2

Question 8

A branch office uses PAT for user Internet access. The administrator notices that inside users can browse out, but an internal server still cannot be reached consistently from outside. Which change is most appropriate?

Accepted Answer

Add a static NAT mapping for the server while leaving PAT in place for user traffic.. The most appropriate change is to add a static NAT mapping for the internal server while keeping PAT for ordinary user traffic. In practical terms, PAT solves the many-users-outbound problem by allowing shared use of a public address. But an inbound-published server needs a stable, predictable public identity. That requirement is different from the requirement for user browsing.

This is a common NAT design distinction. PAT and static NAT can coexist because they solve different problems. The best answer is the one that preserves PAT for users while giving the server a fixed public translation.

Answer

Replace PAT with DHCP relay.

Answer

Disable NAT entirely because PAT is preventing inbound routing.

Answer

Put the server in the native VLAN.

Question 9

A network administrator wants to secure remote CLI access to a Cisco router, moving beyond simple username/password authentication. Which approach best achieves this goal?

Accepted Answer

Use stronger or additional authentication controls to improve remote administrative access security. The goal is to strengthen authentication beyond a simple password. Cisco AAA (Authentication, Authorization, and Accounting) using TACACS+ or RADIUS provides stronger, centralized authentication. Secure Shell (SSH) with key-based or two-factor authentication also enhances security. Option A correctly describes this concept, while the other options either weaken security (B, D) or address access control via ACLs, which does not improve the authentication factor itself (C).

Answer

Replace SSH with Telnet to simplify troubleshooting

Answer

Configure an extended ACL to limit remote access to specific source IP addresses

Answer

Disable password authentication and rely solely on device location in the network

Question 10

A company wants to reduce the chance that unused switch ports can be exploited. Which action best aligns with that goal?

Accepted Answer

Administratively shut down unused switch ports. The best action is to administratively disable unused ports and apply hardening where appropriate. In plain language, an unused port is still a possible entry point if it remains active and unmonitored. Shutting it down reduces exposure and aligns with the broader principle of minimizing unnecessary attack surface. This is a simple but effective part of switch hardening.

Leaving unused ports active may feel convenient, but it creates opportunities for unauthorized connections. The correct answer is the one focused on disabling resources that are not needed rather than on unrelated technologies.

Answer

Convert all unused ports into trunk ports

Answer

Enable Telnet on all unused ports

Answer

Advertise every unused port into OSPF

Question 11

A company wants a server on the inside network to be reachable consistently from outside using one known public IP address. Which NAT approach best fits that goal?

Accepted Answer

Static NAT. Static NAT best fits that goal because it creates a fixed, predictable one-to-one mapping between the internal server and a public address. In plain language, outside systems always know which public IP represents that server. This predictability is exactly what is needed when a service must be reachable consistently from the outside.

PAT is better suited for many outbound clients sharing one address, not for presenting one inside server with a permanent public identity. Dynamic NAT from a pool can also vary depending on design. The correct answer is the one that provides the most stable and direct one-to-one mapping.

Answer

PAT overload only

Answer

No NAT at all, because private IPv4 addresses are Internet-routable

Answer

DHCP relay

Question 12

An internal server must always be reachable from outside using the same public IP address. Which translation approach is most appropriate?

Accepted Answer

Static NAT. A static NAT mapping is the most appropriate approach. In plain language, the outside world needs a stable public address that always represents the same internal server. Static NAT provides that fixed one-to-one relationship, which makes the service reachable predictably.

PAT is better suited for many outbound users sharing one public address, not for presenting one inside server with a consistent external identity. The correct answer is the one that provides a permanent mapping.

Answer

PAT overload

Answer

No NAT

Answer

DHCP relay

Question 13

In a controller-based design, which statement best describes a northbound API?

Accepted Answer

An application-facing API used by external software to communicate with the controller. A northbound API is the interface exposed by the controller to external applications, orchestration systems, dashboards, or automation tools. In plain language, it is the way software above the controller communicates with the controller so that it can request data, apply policy, or trigger changes. This is different from the southbound side, where the controller interacts with the underlying infrastructure devices.

This concept appears often in automation topics because it helps define where the controller sits in the larger architecture. A northbound API is not a physical cable, and it does not replace security controls. It is an application-facing software interface, which is exactly what the correct answer should capture.

Answer

A cable type used between controller clusters

Answer

The link-state protocol the controller uses to reach switches

Answer

A mechanism that removes the need for authentication

Question 14

Two directly connected routers running OSPFv3 do not form an adjacency. Both interfaces have valid IPv6 addresses and can ping each other using link-local addresses. What is the most likely cause?

Accepted Answer

The interfaces are assigned to different OSPFv3 areas.. The most likely cause is an OSPFv3 area mismatch on the interface. In practical terms, OSPFv3 still requires neighbors on the same link to agree on the area assignment, just as OSPF for IPv4 does. Link-local reachability alone is not enough to form an adjacency. The protocol parameters still have to match.

This is an important IPv6 routing point because people sometimes assume that successful IPv6 ping means the routing protocol should automatically work. It does not. Adjacency depends on protocol alignment, not just basic connectivity.

Answer

The routers need global unicast addresses before OSPFv3 can run.

Answer

The router IDs must be identical before adjacency can form.

Answer

The link-local addresses must be learned from DHCPv6.

Question 15

A host with address 172.16.5.10/23 wants to determine whether 172.16.6.20 is on the same local network. What is the correct conclusion?

Accepted Answer

It is on a different network, so the host should use the default gateway. A /23 prefix covers two consecutive /24 ranges. In plain language, that means the network boundaries move in blocks of 2 in the third octet. The address 172.16.5.10/23 belongs to the 172.16.4.0/23 network, which covers 172.16.4.x and 172.16.5.x. The destination 172.16.6.20 belongs to a different /23 block, so it is not on the same local network.

This question checks whether you can think beyond default /24 boundaries and understand how a broader prefix changes the local network range. The host would therefore need to use its default gateway to reach 172.16.6.20, because that destination is off-subnet relative to the /23 in use.

Answer

It is on the same local network because both addresses begin with 172.16.

Answer

It is on the same local network because /23 covers all addresses in 172.16.5.x and 172.16.6.x

Answer

It is on a different network, so ARP will resolve it across the router automatically

Question 16

Based on the exhibit, what is the most likely reason PAT is not working correctly?

Accepted Answer

The inside and outside NAT interface roles are reversed.. PAT is not working correctly because the inside and outside NAT roles are reversed on the interfaces. In practical terms, the private LAN-facing interface should be marked as inside, and the public-facing WAN interface should be marked as outside. In the exhibit, the router has those roles backwards, so translation logic is applied in the wrong direction.

This is a very realistic NAT troubleshooting item because the configuration is close to correct and the failure comes from one directional mistake.

Answer

PAT requires OSPF to be enabled on the WAN link.

Answer

The ACL must be numbered 100 instead of 1.

Answer

The router must use GRE before PAT can overload.

Question 17

Match each switching feature to its most accurate purpose.

Accepted Answer

STP prevents loops, VTP manages VLANs, EtherChannel aggregates links, Port Security restricts MAC addresses, DTP negotiates trunks, and Rapid PVST+ provides fast per-VLAN convergence.. Which accurately pairs each switching feature with its purpose: Spanning Tree Protocol (STP) prevents loops in a switched network by blocking redundant paths; VLAN Trunking Protocol (VTP) manages the addition, deletion, and renaming of VLANs across the network; EtherChannel aggregates multiple physical links into a single logical link for increased bandwidth and redundancy; Port Security limits the number of MAC addresses allowed on a switch port to prevent unauthorized access; Dynamic Trunking Protocol (DTP) automatically negotiates trunking between switches; and Rapid PVST+ provides fast convergence for each VLAN using multiple spanning tree instances. The other options contain incorrect pairings, such as mixing up STP with VLAN management or EtherChannel with loop prevention.

Answer

STP manages VLANs, VTP prevents loops, EtherChannel restricts MAC addresses, Port Security aggregates links, DTP provides fast per-VLAN convergence, and Rapid PVST+ negotiates trunks.

Answer

STP aggregates links, VTP prevents loops, EtherChannel manages VLANs, Port Security negotiates trunks, DTP restricts MAC addresses, and Rapid PVST+ provides fast per-VLAN convergence.

Answer

STP provides fast per-VLAN convergence, VTP aggregates links, EtherChannel prevents loops, Port Security manages VLANs, DTP restricts MAC addresses, and Rapid PVST+ negotiates trunks.

Question 18

A subnet has the network address 192.168.30.0/26. What is the broadcast address?

Accepted Answer

192.168.30.63. A /26 subnet contains 64 addresses. In plain language, the block that starts at 192.168.30.0 runs through 192.168.30.63. The first address is the network address and the last address is the broadcast address, so the broadcast for this subnet is 192.168.30.63.

This is a standard subnet-boundary calculation. Once the block size is identified, the broadcast address is simply the final address in that block.

Answer

192.168.30.64

Answer

192.168.30.255

Answer

192.168.30.31

Question 19

A switchport is configured as an access port in VLAN 10, but a user plugs in a small unmanaged switch and connects multiple devices behind it. Which security feature most directly limits that behavior at the switchport?

Accepted Answer

Port security. Port security most directly limits that behavior because it can restrict how many MAC addresses are learned on the switchport. In practical terms, if the interface is supposed to support one endpoint but suddenly begins presenting multiple MAC addresses from a downstream mini-switch, port security can detect and react to that change.

This is a classic access-layer control question. VLAN assignment alone does not limit how many devices appear behind the port.

Answer

OSPF authentication

Answer

NetFlow

Answer

NTP

Question 20

An EtherChannel should form using LACP between two switches. One side is configured for LACP active, and the other side is configured for LACP active. What is the expected result if the other link settings also match?

Accepted Answer

The EtherChannel should form if the other interface settings are compatible.. The EtherChannel should form successfully if the underlying link settings are compatible. LACP active/active is a valid combination, as both switches actively negotiate the bundle. However, the channel does not automatically become a routed interface (option C is incorrect because EtherChannel can operate as Layer 2 or Layer 3 depending on configuration, not automatically due to LACP mode). Additionally, VLAN tags are not removed by default from the bundle (option D is incorrect; VLAN tagging is preserved based on the switchport mode and allowed VLAN settings). The key troubleshooting point is to ensure that other interface parameters such as speed, duplex, and VLAN settings match across the member ports.

Answer

The channel fails because both sides must be passive.

Answer

The channel becomes a routed interface automatically.

Answer

All VLAN tags are removed from the bundle by default.