CCNA Practice Test 21 — 15 Questions

Question 1

A network engineer is troubleshooting a connectivity issue between two hosts on different VLANs. The engineer captures traffic on an IOS-XE router's GigabitEthernet0/1 interface using embedded packet capture (EPC). The output shows ARP requests from Host A (192.168.1.10) but no ARP replies from Host B (192.168.2.20). What is the most likely cause of this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The router's interface does not have an IP address configured in the VLAN 2 subnet.. The router's GigabitEthernet0/1 interface must have an IP address in the same subnet as Host B (192.168.2.20) to act as the default gateway for VLAN 2. Without an IP address in the VLAN 2 subnet, the router cannot respond to ARP requests for that subnet, so Host A's ARP requests for Host B go unanswered. This is the most likely cause because the router performs inter-VLAN routing only when it has an interface (or subinterface) with an IP address in the destination VLAN's subnet.

Answer

The router's interface is configured as an access port instead of a trunk.

Answer

Host A is in a different VLAN than the router's interface.

Answer

The router's interface has a duplex mismatch with the switch.

Question 2

Drag and drop the following steps into the correct order to determine the best route to a destination using a routing table.

Accepted Answer

Extract the destination IP address from the packet.. The correct order follows Cisco's route selection logic: 1. Extract the destination IP (the lookup key). 2. Find all matching routes in the routing table. 3. Apply longest prefix match – the most specific route (longest subnet mask) is always preferred, regardless of administrative distance. 4. If multiple routes share that longest prefix length, compare administrative distances. 5. The route with the lowest administrative distance wins. 6. If AD values are equal (same routing protocol is typical), compare metrics. 7. The route with the lowest metric becomes the best route. This hierarchy – longest match > AD > metric – is fundamental to Cisco router behavior.

Question 3

A switch port connected to a user PC should be placed in VLAN 20 and must not negotiate trunking. Which configuration is the most appropriate?

Accepted Answer

switchport mode access
switchport access vlan 20. The most appropriate configuration is to force the interface into access mode and assign it to VLAN 20. In practical terms, a normal user-facing switch port is supposed to carry one VLAN only. There is no reason to rely on dynamic trunk negotiation for a desktop or laptop connection. Explicit access-port configuration is cleaner, more predictable, and safer.

This is a common switching best-practice question. The wrong answers usually leave room for unwanted trunking behavior or move the interface into a completely different role. The right answer combines the correct port role with the correct VLAN membership.

Answer

switchport mode trunk
switchport trunk native vlan 20

Answer

switchport mode dynamic desirable
switchport trunk allowed vlan 20

Answer

no switchport
ip address 192.168.20.1 255.255.255.0

Question 4

A network engineer is configuring HSRP on a pair of Cisco routers to provide first-hop redundancy for a subnet. The goal is to ensure that the router with the highest IPv4 address always becomes the active router, and that it automatically reclaims the active role after a failure. The engineer configures priority 100 on both routers. Which additional configuration is required to meet these objectives?

Accepted Answer

Configure the preempt command on both routers.. HSRP uses priority to determine the active router, but without the preempt command, a router with a higher priority will not take over the active role if it comes online after a failure. Since both routers have the same priority (100), the router with the highest IPv4 address will become active initially, but to ensure it automatically reclaims the active role after a failure, preempt must be enabled on both routers. This allows the router with the higher IP address (and equal priority) to preempt the current active router when it recovers.

Answer

Configure priority 150 on one router and priority 50 on the other.

Answer

Configure the standby 1 priority 100 command on both routers.

Answer

Configure the standby 1 priority 100 on one router and standby 1 priority 50 on the other.

Question 5

After configuring DHCP snooping on VLAN 10 to prevent rogue DHCP servers, all clients in the VLAN stop receiving DHCP offers from the legitimate DHCP server that is connected to port Gi0/1. The administrator verifies the DHCP server is operational and reachable. What should the technician do next?

Accepted Answer

Configure interface Gi0/1 as a DHCP snooping trusted port.. DHCP snooping, by default, treats all ports as untrusted and drops DHCP server messages (OFFER, ACK) received on untrusted ports. Since the legitimate DHCP server is connected to Gi0/1, that port must be explicitly configured as a DHCP snooping trusted port using the 'ip dhcp snooping trust' interface command to allow DHCP server responses to reach clients.

Answer

Enable Dynamic ARP Inspection on VLAN 10.

Answer

Add an ip helper-address on the VLAN 10 SVI pointing to the DHCP server.

Answer

Reconfigure the DHCP server scope to include DHCP Option 82.

Question 6

An engineer wants users to get fast link-up on access ports but also wants the switch to disable a port if another switch is connected and sends BPDUs.

Which combination of features best meets that requirement?

Accepted Answer

PortFast and BPDU Guard. PortFast and BPDU Guard are the classic edge-port combination for this requirement. PortFast helps a user-facing interface begin forwarding quickly so a PC or phone does not wait through the normal spanning-tree transition delay. BPDU Guard adds protection by monitoring that same port for BPDUs. If a switch is accidentally or intentionally connected and starts participating in spanning tree, BPDU Guard reacts by disabling the port to protect the Layer 2 topology. In plain language, users get quick connectivity when the port is used correctly, but the network still protects itself against someone plugging in a switch where only an endpoint should exist. That is exactly what the requirement asks for.

Answer

DHCP snooping and DAI

Answer

Root Guard and VTP pruning

Answer

Port security and CDP

Question 7

Refer to the exhibit. A network engineer is troubleshooting a connectivity issue on SW3. A host connected to the same segment as SW3's GigabitEthernet0/0 interface cannot reach any network resources. The engineer issues the show spanning-tree vlan 10 command and receives the output shown. Based on the output, what is the most likely cause?

Accepted Answer

The interface GigabitEthernet0/0 is in the Blocking state because it received a superior BPDU, making it an alternate port to the root bridge.. The output shows that GigabitEthernet0/0 is in the Blocking state for VLAN 10. In Rapid PVST+ or classic STP, a port enters the Blocking state when it receives a superior BPDU (i.e., a BPDU with a lower bridge ID or lower path cost to the root), causing it to become an alternate (or backup) port rather than a designated or root port. This prevents the host from reaching network resources because the port does not forward traffic.

Answer

GigabitEthernet0/0 is administratively down, which prevents the host from communicating.

Answer

The port is in the Blocking state because the switch detected a loop and moved the port to error-disabled state.

Answer

The port is blocked because SW3 has a lower bridge priority than the root bridge and should be the designated port for that segment.

Question 8

A network administrator is troubleshooting a Windows 10 client that cannot access a web server at 192.168.1.100. The client has an IP address of 192.168.1.50/24 and can ping its default gateway (192.168.1.1) successfully, but ping to 192.168.1.100 fails. Which command should the administrator run next to verify the client's current network connections and identify potential issues with active sessions?

Accepted Answer

netstat -a. The `netstat -a` command displays all active TCP/UDP connections and listening ports, which is the most direct way to verify current network sessions and identify issues such as blocked ports, half-open connections, or failed connection attempts. While ping failure could result from network-layer filtering (e.g., ACLs blocking ICMP), `netstat -a` reveals whether the client has initiated a TCP connection to 192.168.1.100 and its current state (e.g., SYN_SENT, ESTABLISHED, TIME_WAIT), helping to isolate transport-layer or application-layer problems.

Answer

ipconfig /all

Answer

tracert 192.168.1.100

Answer

ping -t 192.168.1.100

Question 9

An administrator notices that hosts in VLAN 30 on SW1 cannot communicate with hosts in VLAN 30 on SW2, even though both switches are connected via an 802.1Q trunk. Traffic for VLANs 10 and 20 passes without issues across the same trunk. The trunk is configured to allow all VLANs, and the allowed VLAN list explicitly includes VLAN 30. What is the most likely cause of the problem?

Accepted Answer

The native VLAN is mismatched between SW1 and SW2, and VLAN 30 is the native VLAN on one side.. The most likely cause is a native VLAN mismatch. When the native VLAN is mismatched on an 802.1Q trunk, traffic for the native VLAN is not tagged, so frames from VLAN 30 on one switch are received as untagged frames on the other switch and placed into the switch's configured native VLAN. If the native VLAN on one side is VLAN 30 and on the other side is a different VLAN (e.g., VLAN 1), the hosts in VLAN 30 cannot communicate because the frames are interpreted as belonging to different VLANs. Traffic for VLANs 10 and 20 passes because they are not the native VLAN and are properly tagged.

Answer

The trunk encapsulation is set to ISL on one switch and 802.1Q on the other.

Answer

Spanning Tree Protocol has placed VLAN 30 in a blocking state on the trunk link.

Answer

The switched virtual interface (SVI) for VLAN 30 on SW1 is administratively down.

Question 10

Refer to the exhibit. A network engineer is verifying OSPF routing on R1. All routers in the topology are expected to reside in OSPF area 0, and the network 172.16.0.0/16 should be advertised from R2 within the same area. The engineer issues the show ip route 172.16.0.0 command on R1 and sees the output in the exhibit. The engineer expected to see an intra-area route (O) instead of an inter-area route (O IA). What is the most likely cause of this discrepancy?

Accepted Answer

The destination network 172.16.0.0/16 is located in a different OSPF area.. The route 172.16.0.0/16 appears as O IA (inter-area) on R1, which means R1 learned it via a Type 3 LSA from an ABR. For the route to be intra-area (O), the destination network must reside in the same OSPF area (area 0) as R1. Since R2 is advertising this network, if it were truly in area 0, R1 would see an O route. The O IA designation indicates that the network is in a different area, likely because R2's interface connected to 172.16.0.0/16 is configured in a different OSPF area, or R2 is acting as an ABR.

Answer

R1 has a mismatched OSPF process ID compared to the ABR.

Answer

The network type on GigabitEthernet0/0 is configured as non-broadcast, preventing full adjacency.

Answer

The metric for the route is too high, causing OSPF to treat it as an inter-area route.

Question 11

Refer to the exhibit. A network administrator notices that newly connected devices on the 192.168.1.0/24 subnet are failing to obtain IP addresses via DHCP and are instead assigning themselves APIPA addresses. The administrator issues the show ip dhcp pool command on the router and receives the output shown. What is the most likely cause of this issue?

Accepted Answer

The lease time is set to 7 days, causing old devices to hold IP addresses long after disconnecting.. A 7-day lease time means that IP addresses assigned to devices are held for a full week, even after those devices disconnect from the network. If the subnet is small (e.g., 192.168.1.0/24 provides 254 usable addresses) and many devices have come and gone, the DHCP pool can become exhausted, leaving no available addresses for new devices. When DHCP fails, clients fall back to APIPA (169.254.x.x) addresses per RFC 3927.

Answer

DHCP snooping is blocking DHCP Offer messages on the VLAN.

Answer

The DHCP pool has an address conflict, causing all addresses to be marked as ineligible.

Answer

The pool's subnet mask is incorrectly configured as /24 instead of /25, limiting available addresses.

Question 12

A network administrator receives a report that a user on a Windows laptop cannot connect to the internet, although other devices on the same subnet are working. The administrator runs `ipconfig` on the laptop and sees an IP address of 169.254.15.22 with a subnet mask of 255.255.0.0 and no default gateway. Based on this output, what is the most likely cause of the connectivity issue?

Accepted Answer

The DHCP server is unreachable or not responding to the laptop's DHCP request.. The IP address 169.254.15.22 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP client fails to obtain a lease from a DHCP server. The absence of a default gateway confirms that the laptop cannot reach any DHCP server, as APIPA addresses are not routable and are only used for link-local communication. Therefore, the most likely cause is that the DHCP server is unreachable or not responding to the laptop's DHCP request.

Answer

The laptop's DNS server settings are incorrect.

Answer

The laptop has a static IP address configured that conflicts with another device.

Answer

The Ethernet cable is faulty or disconnected.

Question 13

A user reports that they cannot access a remote server at IP address 10.10.20.50. The user's PC has IP address 192.168.1.25/24, and the default gateway is 192.168.1.1. The user can successfully ping the default gateway and other hosts on the local subnet. However, pings to 10.10.20.50 fail, and a traceroute shows only the first hop (192.168.1.1) followed by timeouts. Which of the following is the most likely cause?

Accepted Answer

The default gateway lacks a route to the 10.10.20.0/24 network.. The user can reach local hosts and the default gateway, confirming that the PC's IP configuration and local switching are functional. The traceroute stopping at 192.168.1.1 with subsequent timeouts indicates that the default gateway receives the packets but does not know how to forward them to the 10.10.20.0/24 network. Therefore, the most likely cause is that the default gateway lacks a route to that remote subnet.

Answer

The user's PC has an incorrect subnet mask.

Answer

The remote server at 10.10.20.50 is powered off.

Answer

The user's DNS server is unreachable.

Question 14

Refer to the exhibit. A network engineer notices that on a four-link EtherChannel bundle between two switches, all traffic from a particular VLAN is being forwarded over only one physical link, while the other three links remain idle. The engineer suspects a load-balancing issue and issues the show etherchannel load-balance command, the output of which is shown. What is the most likely cause of the uneven traffic distribution?

Accepted Answer

The switch is using source‑MAC‑address load balancing, and multiple end hosts are appearing with the same source MAC address.. The output of 'show etherchannel load-balance' indicates the switch is using source-MAC-address load balancing. With this method, all frames from a given source MAC address are hashed to the same physical link. If multiple end hosts in the VLAN are actually behind a single upstream router or firewall that uses the same source MAC address for all traffic (e.g., due to proxy ARP or NAT), then all traffic from that VLAN will be pinned to one link, leaving the other three idle.

Answer

The EtherChannel is misconfigured with an LACP active/passive mode mismatch, forcing only one link to bundle.

Answer

VLAN pruning on the trunk has removed the VLAN from three of the four member interfaces.

Answer

Spanning Tree Protocol has blocked three of the four links in the EtherChannel because they form a loop.

Question 15

A router is configured as follows:

interface g0/1
 ip address 172.16.1.1 255.255.255.0
 ip helper-address 10.20.20.10

Hosts on 172.16.1.0/24 are not receiving addresses from the DHCP server at 10.20.20.10. The server is reachable by ping from the router.

What is the purpose of the ip helper-address command in this scenario?

Accepted Answer

It forwards certain UDP broadcasts, including DHCP requests, to a remote server. The ip helper-address command exists to solve a broadcast-boundary problem. DHCP clients begin by sending broadcast traffic because they do not yet have a valid IP configuration. Routers normally do not forward broadcasts between subnets, so if the DHCP server lives on a different network, the client request would stop at the router. The helper-address function listens for that local broadcast and relays it as unicast traffic to the remote DHCP server. In plain language, it lets a client on one VLAN ask a DHCP server on another VLAN for an address. The command is not a routing statement and it is not a DNS feature. It is a relay mechanism for broadcast-based UDP services such as DHCP.

Answer

It converts DHCP unicast replies into broadcasts on the client segment

Answer

It provides DNS resolution for DHCP clients before they receive an address

Answer

It creates a static route to the DHCP server