CCNA Practice Test 21 — 15 Questions

Question 1

Drag and drop the following steps into the correct order to configure and verify HSRP with priority and preemption on an interface.

Accepted Answer

Enter interface configuration mode for the target interface (e.g., interface GigabitEthernet0/0).. First, enter interface configuration mode to start configuring the specific interface. Next, assign an IP address because HSRP requires a real IP on the interface for communication between HSRP routers. After that, define the HSRP group and virtual IP, which clients use as their default gateway. Then set a higher priority to influence the active router election; priority must be configured before enabling preemption, as preemption relies on priority to determine when to take over. Finally, exit configuration mode and verify with show standby to confirm the HSRP state.

Question 2

Drag and drop the following steps into the correct order to configure and verify HSRP with priority and preemption on an interface.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

6Step 6

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Define the network automation goal and the type of configuration changes required.. The correct order follows a systematic approach: First, define the specific network automation goal to understand the scope and constraints. Next, evaluate whether a persistent, agent-based configuration enforcement approach (Puppet/Chef) or an agentless, orchestration-driven approach (Ansible) is required. Then consider the flexibility of a scripting language like Python for custom or one-off tasks. After selecting the tool, write the automation logic (playbook, manifest, or script). Test it in a controlled environment to avoid production issues, and finally deploy and verify the automation to ensure it meets the intended outcome.

Question 3

Drag and drop the following steps into the correct order to configure a Layer 3 switch to perform DHCP relay agent and DHCP snooping for a remote DHCP server.

Accepted Answer

On the DHCP server, create a DHCP pool for the client subnet with the correct network, default gateway, and lease parameters.. Correct order: 1) Create DHCP pool on the server to have valid lease parameters; 2) Assign IP address to the SVI so it can act as the gateway and relay agent for the subnet; 3) Globally enable DHCP snooping to activate the feature; 4) Enable snooping on the client VLAN so that only that VLAN’s DHCP traffic is filtered; 5) Set the interface facing the server as trusted to allow DHCP replies; 6) Configure ip helper-address on the SVI to forward client DHCP broadcasts to the server. Each step depends on the previous: the server must be ready; the SVI needs an IP before the helper can be applied; snooping must be globally on before per-VLAN settings; trusted port must be defined before relayed replies are accepted; finally, the helper address enables the actual relay.

Question 4

A network engineer is troubleshooting a connectivity issue between two hosts on different VLANs. The engineer captures traffic on an IOS-XE router's GigabitEthernet0/1 interface using embedded packet capture (EPC). The output shows ARP requests from Host A (192.168.1.10) but no ARP replies from Host B (192.168.2.20). What is the most likely cause of this issue?

Accepted Answer

The router's interface does not have an IP address configured in the VLAN 2 subnet.. The router's GigabitEthernet0/1 interface must have an IP address in the same subnet as Host B (192.168.2.20) to act as the default gateway for VLAN 2. Without an IP address in the VLAN 2 subnet, the router cannot respond to ARP requests for that subnet, so Host A's ARP requests for Host B go unanswered. This is the most likely cause because the router performs inter-VLAN routing only when it has an interface (or subinterface) with an IP address in the destination VLAN's subnet.

Answer

The router's interface is configured as an access port instead of a trunk.

Answer

Host A is in a different VLAN than the router's interface.

Answer

The router's interface has a duplex mismatch with the switch.

Question 5

Drag and drop the following steps into the correct order to determine the best route to a destination using a routing table.

Accepted Answer

Extract the destination IP address from the packet.. The correct order follows Cisco's route selection logic: 1. Extract the destination IP (the lookup key). 2. Find all matching routes in the routing table. 3. Apply longest prefix match – the most specific route (longest subnet mask) is always preferred, regardless of administrative distance. 4. If multiple routes share that longest prefix length, compare administrative distances. 5. The route with the lowest administrative distance wins. 6. If AD values are equal (same routing protocol is typical), compare metrics. 7. The route with the lowest metric becomes the best route. This hierarchy – longest match > AD > metric – is fundamental to Cisco router behavior.

Question 6

A switch port connected to a user PC should be placed in VLAN 20 and must not negotiate trunking. Which configuration is the most appropriate?

Accepted Answer

switchport mode access
switchport access vlan 20. The most appropriate configuration is to force the interface into access mode and assign it to VLAN 20. In practical terms, a normal user-facing switch port is supposed to carry one VLAN only. There is no reason to rely on dynamic trunk negotiation for a desktop or laptop connection. Explicit access-port configuration is cleaner, more predictable, and safer.

This is a common switching best-practice question. The wrong answers usually leave room for unwanted trunking behavior or move the interface into a completely different role. The right answer combines the correct port role with the correct VLAN membership.

Answer

switchport mode trunk
switchport trunk native vlan 20

Answer

switchport mode dynamic desirable
switchport trunk allowed vlan 20

Answer

no switchport
ip address 192.168.20.1 255.255.255.0

Question 7

A network engineer is configuring HSRP on a pair of Cisco routers to provide first-hop redundancy for a subnet. The goal is to ensure that the router with the highest IPv4 address always becomes the active router, and that it automatically reclaims the active role after a failure. The engineer configures priority 100 on both routers. Which additional configuration is required to meet these objectives?

Accepted Answer

Configure the preempt command on both routers.. HSRP uses priority to determine the active router, but without the preempt command, a router with a higher priority will not take over the active role if it comes online after a failure. Since both routers have the same priority (100), the router with the highest IPv4 address will become active initially, but to ensure it automatically reclaims the active role after a failure, preempt must be enabled on both routers. This allows the router with the higher IP address (and equal priority) to preempt the current active router when it recovers.

Answer

Configure priority 150 on one router and priority 50 on the other.

Answer

Configure the standby 1 priority 100 command on both routers.

Answer

Configure the standby 1 priority 100 on one router and standby 1 priority 50 on the other.

Question 8

After configuring DHCP snooping on VLAN 10 to prevent rogue DHCP servers, all clients in the VLAN stop receiving DHCP offers from the legitimate DHCP server that is connected to port Gi0/1. The administrator verifies the DHCP server is operational and reachable. What should the technician do next?

Accepted Answer

Configure interface Gi0/1 as a DHCP snooping trusted port.. DHCP snooping, by default, treats all ports as untrusted and drops DHCP server messages (OFFER, ACK) received on untrusted ports. Since the legitimate DHCP server is connected to Gi0/1, that port must be explicitly configured as a DHCP snooping trusted port using the 'ip dhcp snooping trust' interface command to allow DHCP server responses to reach clients.

Answer

Enable Dynamic ARP Inspection on VLAN 10.

Answer

Add an ip helper-address on the VLAN 10 SVI pointing to the DHCP server.

Answer

Reconfigure the DHCP server scope to include DHCP Option 82.

Question 9

An engineer wants users to get fast link-up on access ports but also wants the switch to disable a port if another switch is connected and sends BPDUs.

Which combination of features best meets that requirement?

Accepted Answer

PortFast and BPDU Guard. PortFast and BPDU Guard are the classic edge-port combination for this requirement. PortFast helps a user-facing interface begin forwarding quickly so a PC or phone does not wait through the normal spanning-tree transition delay. BPDU Guard adds protection by monitoring that same port for BPDUs. If a switch is accidentally or intentionally connected and starts participating in spanning tree, BPDU Guard reacts by disabling the port to protect the Layer 2 topology. In plain language, users get quick connectivity when the port is used correctly, but the network still protects itself against someone plugging in a switch where only an endpoint should exist. That is exactly what the requirement asks for.

Answer

DHCP snooping and DAI

Answer

Root Guard and VTP pruning

Answer

Port security and CDP

Question 10

Refer to the exhibit. A network engineer is troubleshooting a connectivity issue on SW3. A host connected to the same segment as SW3's GigabitEthernet0/0 interface cannot reach any network resources. The engineer issues the show spanning-tree vlan 10 command and receives the output shown. Based on the output, what is the most likely cause?

Accepted Answer

The interface GigabitEthernet0/0 is in the Blocking state because it received a superior BPDU, making it an alternate port to the root bridge.. The output shows that GigabitEthernet0/0 is in the Blocking state for VLAN 10. In Rapid PVST+ or classic STP, a port enters the Blocking state when it receives a superior BPDU (i.e., a BPDU with a lower bridge ID or lower path cost to the root), causing it to become an alternate (or backup) port rather than a designated or root port. This prevents the host from reaching network resources because the port does not forward traffic.

Answer

GigabitEthernet0/0 is administratively down, which prevents the host from communicating.

Answer

The port is in the Blocking state because the switch detected a loop and moved the port to error-disabled state.

Answer

The port is blocked because SW3 has a lower bridge priority than the root bridge and should be the designated port for that segment.

Question 11

A network administrator is troubleshooting a Windows 10 client that cannot access a web server at 192.168.1.100. The client has an IP address of 192.168.1.50/24 and can ping its default gateway (192.168.1.1) successfully, but ping to 192.168.1.100 fails. Which command should the administrator run next to verify the client's current network connections and identify potential issues with active sessions?

Accepted Answer

netstat -a. The `netstat -a` command displays all active TCP/UDP connections and listening ports, which is the most direct way to verify current network sessions and identify issues such as blocked ports, half-open connections, or failed connection attempts. While ping failure could result from network-layer filtering (e.g., ACLs blocking ICMP), `netstat -a` reveals whether the client has initiated a TCP connection to 192.168.1.100 and its current state (e.g., SYN_SENT, ESTABLISHED, TIME_WAIT), helping to isolate transport-layer or application-layer problems.

Answer

ipconfig /all

Answer

tracert 192.168.1.100

Answer

ping -t 192.168.1.100

Question 12

An administrator notices that hosts in VLAN 30 on SW1 cannot communicate with hosts in VLAN 30 on SW2, even though both switches are connected via an 802.1Q trunk. Traffic for VLANs 10 and 20 passes without issues across the same trunk. The trunk is configured to allow all VLANs, and the allowed VLAN list explicitly includes VLAN 30. What is the most likely cause of the problem?

Accepted Answer

The native VLAN is mismatched between SW1 and SW2, and VLAN 30 is the native VLAN on one side.. The most likely cause is a native VLAN mismatch. When the native VLAN is mismatched on an 802.1Q trunk, traffic for the native VLAN is not tagged, so frames from VLAN 30 on one switch are received as untagged frames on the other switch and placed into the switch's configured native VLAN. If the native VLAN on one side is VLAN 30 and on the other side is a different VLAN (e.g., VLAN 1), the hosts in VLAN 30 cannot communicate because the frames are interpreted as belonging to different VLANs. Traffic for VLANs 10 and 20 passes because they are not the native VLAN and are properly tagged.

Answer

The trunk encapsulation is set to ISL on one switch and 802.1Q on the other.

Answer

Spanning Tree Protocol has placed VLAN 30 in a blocking state on the trunk link.

Answer

The switched virtual interface (SVI) for VLAN 30 on SW1 is administratively down.

Question 13

A router has routes to 172.20.0.0/16, 172.20.10.0/24, and 172.20.10.64/26. Which route is used for traffic to 172.20.10.70?

Accepted Answer

172.20.10.64/26. The /26 route is used because it is the most specific matching prefix. In practical terms, 172.20.10.70 falls inside the 172.20.10.64/26 range, so that route narrows the destination more precisely than the broader /24 and /16 routes. Longest-prefix match therefore selects the /26 entry.

This question is designed to reinforce that specificity comes first in route lookup. Broader routes remain useful, but they lose when a more exact route matches.

Answer

172.20.0.0/16

Answer

172.20.10.0/24

Answer

The default route

Question 14

Refer to the exhibit. A network engineer is verifying OSPF routing on R1. All routers in the topology are expected to reside in OSPF area 0, and the network 172.16.0.0/16 should be advertised from R2 within the same area. The engineer issues the show ip route 172.16.0.0 command on R1 and sees the output in the exhibit. The engineer expected to see an intra-area route (O) instead of an inter-area route (O IA). What is the most likely cause of this discrepancy?

Accepted Answer

The destination network 172.16.0.0/16 is located in a different OSPF area.. The route 172.16.0.0/16 appears as O IA (inter-area) on R1, which means R1 learned it via a Type 3 LSA from an ABR. For the route to be intra-area (O), the destination network must reside in the same OSPF area (area 0) as R1. Since R2 is advertising this network, if it were truly in area 0, R1 would see an O route. The O IA designation indicates that the network is in a different area, likely because R2's interface connected to 172.16.0.0/16 is configured in a different OSPF area, or R2 is acting as an ABR.

Answer

R1 has a mismatched OSPF process ID compared to the ABR.

Answer

The network type on GigabitEthernet0/0 is configured as non-broadcast, preventing full adjacency.

Answer

The metric for the route is too high, causing OSPF to treat it as an inter-area route.

Question 15

Refer to the exhibit. A network administrator notices that newly connected devices on the 192.168.1.0/24 subnet are failing to obtain IP addresses via DHCP and are instead assigning themselves APIPA addresses. The administrator issues the show ip dhcp pool command on the router and receives the output shown. What is the most likely cause of this issue?

Accepted Answer

The lease time is set to 7 days, causing old devices to hold IP addresses long after disconnecting.. A 7-day lease time means that IP addresses assigned to devices are held for a full week, even after those devices disconnect from the network. If the subnet is small (e.g., 192.168.1.0/24 provides 254 usable addresses) and many devices have come and gone, the DHCP pool can become exhausted, leaving no available addresses for new devices. When DHCP fails, clients fall back to APIPA (169.254.x.x) addresses per RFC 3927.

Answer

DHCP snooping is blocking DHCP Offer messages on the VLAN.

Answer

The DHCP pool has an address conflict, causing all addresses to be marked as ineligible.

Answer

The pool's subnet mask is incorrectly configured as /24 instead of /25, limiting available addresses.