CCNA Practice Exam 4 — 20 Questions

Question 1

PCs in VLAN 30 on SwitchA cannot reach PCs in VLAN 30 on SwitchB. VLAN 30 exists on both switches and all other VLANs work across the same link. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 30 is not allowed on the trunk from SwitchA.. The trunk is up, but VLAN 30 is missing from the allowed list on SwitchA. In plain language, the hallway between the switches is open, but one side is refusing to carry that specific VLAN through the hallway. Since the other VLANs are working, the failure is selective rather than total. That strongly points to an allowed-VLAN problem rather than a broader trunk outage.

This is a classic CCNA switching scenario because it tests whether you can separate trunk health from per-VLAN forwarding. A trunk can be operational and still block one VLAN if that VLAN is not permitted on one side. The native VLAN and encapsulation are not the issue shown here — the mismatch in the allowed list is.

Answer

The native VLAN is mismatched.

Answer

The trunk must use ISL instead of 802.1Q.

Answer

VLAN 30 must be configured as the native VLAN.

Question 2

Match each HTTP method to the action it most commonly represents in a REST-style API.

Question 3

Why is administratively shutting down unused switch ports considered a useful hardening practice?

Accepted Answer

Because it reduces attack surface by removing unused active connection points.. Unused active ports create unnecessary exposure. In practical terms, if a port is not needed, leaving it active gives someone an opportunity to connect a device where no legitimate business need exists. Shutting the port down removes that access point and reduces attack surface.

This is a simple but effective hardening measure. It does not replace other controls, but it removes a risk that does not need to exist in the first place.

Answer

Because it forces all users to manage devices with SSH.

Answer

Because it converts remaining ports into trunks.

Answer

Because it replaces VLAN segmentation.

Question 4

Match each API or programmability term to its most accurate meaning.

Question 5

A router has a default route and a specific route to 203.0.113.0/24. Which route is used for traffic to 203.0.113.25?

Accepted Answer

The specific route to 203.0.113.0/24. The specific route to 203.0.113.0/24 is used because it is a more specific match than the default route. In plain language, even though the default route could technically match almost anything, the router always prefers a route that more precisely describes the destination network. Since 203.0.113.25 is inside 203.0.113.0/24, that route wins under longest-prefix match.

This is one of the most basic routing-table interpretation rules. The default route remains important as a fallback, but it is not chosen when a more specific valid route exists.

Answer

The default route

Answer

Both routes are always load-balanced

Answer

Neither route because defaults cannot coexist with specific routes

Question 6

Why is HTTPS usually preferred over HTTP when accessing a controller API?

Accepted Answer

Because HTTPS provides encrypted transport for API traffic.. HTTPS is preferred because it protects the communication with encryption while it crosses the network. In practical terms, controller APIs often carry tokens, credentials, device state, or configuration information that should not be exposed in clear text. HTTPS helps protect those requests and responses in transit.

This does not make HTTPS the same thing as JSON, nor does it remove the need for authentication. It is simply the more secure transport choice for sensitive API communication.

Answer

Because HTTPS automatically replaces authentication.

Answer

Because HTTPS is the only format that can carry JSON.

Answer

Because HTTP cannot carry controller data at all.

Question 7

A network operations team wants centralized logging from routers and switches and also wants meaningful severity filtering. Which two statements about syslog are correct?

Accepted Answer

Devices can send log messages to a remote syslog server for central storage. Syslog gives you centralized event reporting, and severity levels help decide what should be forwarded, stored, or alerted on.

Answer

Syslog is used to assign IP addresses dynamically to endpoints

Answer

Syslog entries replace SNMP counters for interface statistics

Question 8

Why is shutting down unused switch ports considered a useful hardening measure?

Accepted Answer

Because it removes unused active connection points and reduces attack surface.. Shutting down unused switch ports reduces attack surface. In practical terms, an enabled port that no legitimate device needs is an unnecessary entry point into the network. Disabling that port removes the opportunity entirely instead of trying to manage a risk that should not exist.

This is a simple control, but it is effective precisely because it removes exposure rather than just monitoring it.

Answer

Because it converts all other ports into trunks.

Answer

Because it replaces VLAN segmentation.

Answer

Because it forces devices to use SSH.

Question 9

A switchport on one side of a link is configured as a trunk, but the peer side is configured as an access port. The physical link is up, but VLAN traffic behaves unexpectedly. What is the most likely cause?

Accepted Answer

The two ends disagree on whether the link is a trunk or an access port.. The most likely cause is a switchport mode mismatch. In practical terms, one side expects the link to carry multiple VLANs with tagging behavior, while the other side treats it as a normal one-VLAN endpoint-style access connection. The physical interface can still come up, but the two ends do not agree on how the traffic should be handled.

This is a classic Layer 2 troubleshooting pattern. The link may not be fully down, but the configuration disagreement causes logical forwarding problems.

Answer

The switches must both use the same hostname.

Answer

The native VLAN must be set to 1 on both sides first.

Answer

The ports need OSPF enabled.

Question 10

Which two statements accurately describe WPA2 and WPA3 in wireless security?

Accepted Answer

Both are wireless security standards used to help protect WLAN access and traffic.. WPA2 and WPA3 are wireless security standards used to protect WLAN access and traffic. In practical terms, both are associated with securing wireless communication, but WPA3 is generally positioned as the newer standard with security improvements over WPA2. The key idea at CCNA level is recognizing them as WLAN security standards rather than confusing them with SSIDs, controllers, or radio bands.

You do not need deep protocol internals here. You need the role and relative positioning right.

Answer

Both are names for specific 802.11 radio frequencies.

Answer

WPA2 and WPA3 are types of trunk ports.

Answer

WPA3 eliminates the need for SSIDs.

Question 11

What is the primary purpose of a DHCP default gateway option provided to a host?

Accepted Answer

To identify the next-hop router or Layer 3 device for off-subnet traffic. The default gateway option tells the host where to send traffic destined for other IP networks. In plain language, the host needs to know which local router or Layer 3 interface can forward packets off the subnet. Without that gateway information, the host may still communicate with local devices on its own subnet, but it will struggle to reach remote networks unless the gateway is configured manually.

This is one of the key reasons DHCP is so useful: it can deliver not just an IP address, but also the supporting information a host needs to function normally in a routed environment.

Answer

To replace the host MAC address permanently

Answer

To choose the STP root bridge

Answer

To define the NAT pool for the edge router

Question 12

A switch has a root port and an alternate port for the same VLAN. Which statement best explains the operational role of the alternate port?

Accepted Answer

It is a backup path toward the root bridge and normally does not forward while the active root path is healthy.. The alternate port acts as a backup path toward the root bridge and stays in a non-forwarding state under normal conditions. In practical terms, STP keeps it ready in case the active path fails, but it does not allow it to forward frames while the primary root path is healthy. That is how STP preserves redundancy without creating loops.

This question is useful because many learners understand root ports and designated ports but do not clearly understand what the alternate role represents.

Answer

It always forwards traffic at the same time as the root port for load balancing.

Answer

It is the port that elects the root bridge for the VLAN.

Answer

It is a special routed port used for inter-VLAN communication.

Question 13

What is the main reason route administrative distance exists in Cisco routing logic?

Accepted Answer

To rank the trustworthiness of different route sources. Administrative distance exists so the router can rank the trustworthiness of different route sources. In plain language, if the router learns the same destination from multiple sources such as static routing and OSPF, it needs a way to decide which source to trust more before installing the route.

This is different from a metric, which usually compares paths inside one routing protocol. Administrative distance is a cross-source preference tool.

Answer

To identify the MAC address of the next hop

Answer

To determine trunk native VLAN behavior

Answer

To encrypt routing updates between routers

Question 14

Why is a northbound API especially useful in a controller-based network architecture?

Accepted Answer

It allows external software to interact programmatically with the controller.. A northbound API is especially useful because it gives external applications and automation tools a defined way to communicate with the controller. In plain language, it allows software above the controller to request information, apply policies, or trigger changes without manual per-device interaction. That is one of the main reasons controller-based networking fits well with orchestration and automation.

The controller is the centralized system, and the northbound API is the software-facing interface that exposes it. The correct answer is the one centered on application integration rather than on physical connectivity or device forwarding.

Answer

It is the cable standard used to connect access points.

Answer

It replaces all need for authentication and authorization.

Answer

It makes VLAN tagging unnecessary.

Question 15

A user-facing switchport should carry traffic for only one VLAN and should not attempt DTP trunk negotiation. Which two-command approach best fits that design?

Accepted Answer

`switchport mode access` and `switchport access vlan 20`. The best fit is to set the interface to access mode and assign the access VLAN. In plain language, a user-facing endpoint such as a PC should not behave like a trunk. By explicitly configuring access mode, the switch stops relying on negotiation and treats the interface as a one-VLAN host port. The access VLAN command then tells the switch which VLAN that port belongs to.

This is the standard edge-port design in most enterprise networks. The correct answer is the one that combines an explicit access role with a specific VLAN assignment.

Answer

`switchport mode trunk` and `switchport trunk native vlan 20`

Answer

`switchport mode dynamic desirable` and `switchport trunk allowed vlan 20`

Answer

`no switchport` and `ip address 20.20.20.1 255.255.255.0`

Question 16

Why is administratively shutting down unused switch ports considered a useful hardening measure?

Accepted Answer

It reduces the attack surface by removing unnecessary network entry points.. Unused active ports create unnecessary opportunity for unauthorized connection. In practical terms, if a port has no business purpose, leaving it enabled adds risk without adding value. Disabling it reduces attack surface and makes opportunistic access much harder.

This is a simple but effective hardening control. It does not replace other protections, but it removes exposure that should not exist in the first place.

Answer

It increases available bandwidth on the switch backplane.

Answer

It enables 802.1Q trunking on all remaining ports.

Answer

It forces port security to activate automatically.

Question 17

Match each security concept to its most accurate meaning.

Question 18

Which two statements accurately describe floating static routes?

Accepted Answer

They are static routes configured with higher administrative distance so they act as backups.. Floating static routes are backup static routes intentionally configured with higher administrative distance than the preferred route source. In practical terms, they stay in reserve while the better route remains present, and they activate only when that preferred route disappears. They are a simple and common failover tool.

The key idea is that the route is present in configuration but intentionally not the first choice during normal operation.

Answer

They always override dynamic routes immediately.

Answer

They are identical to equal-cost load balancing.

Answer

They remove the need for routing tables.

Question 19

Match each REST-style method to the action it most commonly represents.

Question 20

Which statement best explains why JSON is often easier for software tools to process than free-form text?

Accepted Answer

Because JSON provides structured data with predictable fields that software can parse consistently.. JSON is easier for software tools to process because it has predictable structure. In practical terms, the tool can look for keys, values, objects, and arrays instead of trying to infer meaning from loose human-oriented wording. That makes parsing more reliable and repeatable.

This is one of the reasons JSON is so common in APIs. It is about machine readability, not about encryption or routing.

Answer

Because JSON automatically authenticates the API client.

Answer

Because free-form text cannot be read by humans.

Answer

Because JSON replaces HTTPS.