CCNA Practice Test 23 — 15 Questions

Question 1

A router has routes to 10.50.0.0/16, 10.50.10.0/24, and 10.50.10.128/25. Which route is used for traffic to 10.50.10.140?

Accepted Answer

10.50.10.128/25. The /25 route is used because it is the most specific matching prefix. In practical terms, 10.50.10.140 belongs to the upper half of the 10.50.10.0/24 space, which is exactly what 10.50.10.128/25 describes. Even though the /24 and /16 also match, longest-prefix match prefers the narrowest route.

This is a direct route-selection question. It reinforces that the router chooses the route that describes the destination most precisely.

Answer

10.50.0.0/16

Answer

10.50.10.0/24

Answer

The default route

Question 2

Refer to the exhibit. A network engineer is troubleshooting an ACL that is not filtering traffic as expected. The engineer runs the show access-lists 110 command and notices that all access control entries (ACEs) show zero matches, even though traffic that should match the permit or deny statements is traversing the network. The engineer then checks the interface configuration. What is the most likely cause?

Accepted Answer

The ACL 110 is not applied to any interface.. If an ACL is not applied to any interface, it will never process traffic, and the 'show access-lists' command will show zero matches for all ACEs. The engineer confirmed that traffic matching the ACL entries is traversing the network, but the ACL counters remain at zero, which directly indicates that the ACL is not being invoked by any interface configuration. Applying an ACL to an interface with the 'ip access-group' command is required for it to filter traffic.

Answer

The ACL is applied to the interface in the wrong direction (inbound instead of outbound).

Answer

The access-list 110 syntax has incorrect subnet masks causing no matches.

Answer

The interface GigabitEthernet0/0 is administratively down, preventing ACL processing.

Question 3

Which TWO statements about IPv4 and IPv6 static routing are correct?

Accepted Answer

A floating static route is configured with a higher administrative distance than the primary route.. A floating static route is configured with a higher administrative distance to serve as a backup when the primary route fails. Option D is correct because an IPv6 default static route uses the prefix ::/0 to match all destinations. Option A is incorrect because a default static route can be used independently of whether dynamic routing protocols are configured; it is simply a route with destination 0.0.0.0/0. Option C is incorrect because a floating static route must have a higher AD, not lower, than the primary route. Option E is incorrect because an IPv6 static route cannot specify an IPv4 address as the next-hop; it must use an IPv6 address or an outgoing interface.

Answer

A default static route is used when no dynamic routing protocols are configured.

Answer

A floating static route must have a lower administrative distance than the primary route.

Answer

An IPv6 static route can specify an IPv4 address as the next-hop.

Question 4

Refer to the exhibit. An administrator is trying to access a web server in the DMZ at 192.168.1.10 using HTTPS, but the connection times out. The web server is confirmed to be running and listening on both port 80 and port 443. The administrator examines the access list configuration on the perimeter router. Based on the output of the show access-lists command, what is the most likely cause of the failure?

Accepted Answer

The access list does not include a permit statement for TCP port 443.. The access list shown in the exhibit permits TCP port 80 (HTTP) but does not include a permit statement for TCP port 443 (HTTPS). Since the administrator is trying to access the web server using HTTPS, which uses port 443, the traffic is implicitly denied by the final 'deny ip any any log' statement. This causes the connection to time out because the packets are dropped before reaching the server.

Answer

The access list is applied in the wrong direction on the interface.

Answer

The web server is not actually listening on TCP port 443, despite the configuration.

Answer

The 'deny ip any any log' statement at the end of the access list is blocking the HTTPS traffic, so it must be removed.

Question 5

Which two statements accurately describe basic WLAN security at the CCNA level?

Accepted Answer

WPA2 is generally considered stronger than WEP for wireless security.. Option A is correct because WPA2 uses AES-CCMP encryption, which is cryptographically far stronger than WEP's flawed RC4-based implementation with its weak IVs and easily cracked keys. Option C is correct because an open WLAN transmits frames without any encryption or authentication, so any nearby client can capture and read the traffic, unlike a WLAN protected by WPA2/WPA3. Option B is wrong because open wireless access provides no encryption at all, only association without credentials. Option D is wrong because SSID length is just a network name and has no cryptographic role; WEP's weakness lies in its RC4/IV design, not the SSID. Option E is wrong because WPA2 mandates AES-CCMP, while TKIP is associated with the older WPA (and WPA2's optional TKIP compatibility mode), not WPA2's standard encryption.

Answer

Open wireless access provides meaningful default encryption.

Answer

A longer SSID makes WEP cryptographically strong.

Answer

WPA2 relies on TKIP encryption

Question 6

When spanning tree elects a root bridge, which value is considered first?

Accepted Answer

Lowest bridge ID, which begins with priority. The root bridge is the switch with the lowest bridge ID. The bridge ID is made up of priority and MAC address, so priority is considered first, then MAC address if priorities tie.

Answer

Lowest MAC address only

Answer

Lowest bridge priority only

Answer

Highest interface bandwidth

Question 7

Refer to the exhibit. A network engineer notices that a user connected to GigabitEthernet0/5 cannot access the network. The engineer issues the show port-security interface GigabitEthernet0/5 command. Based on the output, what is the most likely cause of the issue?

Accepted Answer

An unauthorized device with a different MAC address was connected, triggering a port-security violation and placing the port in an error-disabled state.. The output of 'show port-security interface GigabitEthernet0/5' would show a port status of 'err-disabled' and a security violation count greater than zero. This occurs because an unauthorized device with a different MAC address connected to the port, triggering a port-security violation (typically a security violation action of 'shutdown'), which places the interface in an error-disabled state. This matches the scenario where the user cannot access the network.

Answer

The interface is administratively shut down.

Answer

The sticky MAC address feature is disabled, allowing any MAC address to cause a violation.

Answer

The maximum number of secure MAC addresses has been exceeded, causing the port to err-disable.

Question 8

Why is BPDU Guard commonly enabled on PortFast-enabled access ports?

Accepted Answer

To err-disable a port if it receives unexpected BPDUs. PortFast ports are meant for end devices, not for switches. BPDU Guard protects the LAN by shutting down a PortFast port that unexpectedly starts receiving BPDUs, which usually means an unauthorized switch was connected.

Answer

To make STP root election happen faster

Answer

To disable STP permanently on access ports

Answer

To allow only one MAC address on the access port

Question 9

A network engineer is troubleshooting a wireless performance issue in a dense office environment. Clients on the 5 GHz band are experiencing low throughput even though they are close to the AP. The AP is a Cisco 9130AXI running IOS-XE 17.9. What is the most likely cause of the poor performance?

Accepted Answer

The AP is operating in 802.11ac mode instead of 802.11ax, and the 80 MHz channel bonding is causing high interference in the dense environment.. In a dense office environment, using 80 MHz channel bonding with 802.11ac (Wave 2) increases the likelihood of co-channel interference and overlapping basic service sets (OBSS), which degrades throughput despite strong signal. The Cisco 9130AXI supports 802.11ax (Wi-Fi 6), which includes OFDMA and better spatial reuse, but if the AP is configured for 802.11ac mode, it loses these efficiency gains and suffers from the wide channel's interference penalty.

Answer

The AP is using an incorrect channel width of 80 MHz, which is not supported by 802.11ac.

Answer

The AP has DFS non-compliance, which prevents it from using channel 36 and causes the radio to operate at reduced power.

Answer

The AP is using WPA2-PSK instead of WPA3, which causes lower throughput due to weaker encryption.

Question 10

Refer to the exhibit. A network engineer is troubleshooting an EtherChannel on R1 that is not passing traffic. The output of the show etherchannel summary command is displayed. What is the most likely cause?

Accepted Answer

One side is configured with LACP active and the other side is configured with mode 'on' (static).. The 'show etherchannel summary' output shows the port-channel is down (flags indicate 'D' for down), and the most common cause when one side is configured with LACP active and the other with mode 'on' (static) is a protocol mismatch. LACP active expects to negotiate with another LACP-enabled port, but static mode 'on' forces the link up without negotiation, causing the EtherChannel to fail to form. This mismatch prevents the exchange of LACP frames, leaving the bundle in an error-disabled or non-functional state.

Answer

The local switch is configured with LACP passive while the remote switch is set to LACP active.

Answer

The remote switch is configured with PAgP desirable while the local switch uses LACP.

Answer

The port-channel member interfaces are configured as access ports, preventing LACP from negotiating.

Question 11

After enabling DHCP snooping on VLAN 10, a technician finds that clients in that VLAN are no longer receiving IP addresses from the DHCP server. The server is connected to port Gi0/24. What is the most likely cause?

Accepted Answer

The port Gi0/24 has not been configured as a trusted port for DHCP snooping.. When DHCP snooping is enabled, all ports are untrusted by default. Untrusted ports will drop DHCP server messages (OFFER, ACK, etc.) unless the port is explicitly configured as trusted. Since the DHCP server is connected to Gi0/24 and the technician did not configure it as a trusted port, the switch discards the server's responses, preventing clients from obtaining IP addresses.

Answer

The DHCP server is on a different subnet, and the VLAN 10 SVI does not have an ip helper-address configured.

Answer

The DHCP snooping database location was not configured, causing the switch to discard all DHCP server messages.

Answer

The DHCP snooping binding table does not contain an entry for the DHCP server’s MAC address, so offers are being discarded.

Question 12

Which three features are used to mitigate Layer 2 security threats on a Cisco switch? (Choose three.)

Accepted Answer

Dynamic ARP Inspection (DAI) to prevent ARP spoofing.. Dynamic ARP Inspection (DAI) is correct because it validates ARP packets against the DHCP snooping binding table, dropping ARP spoofing/poisoning attempts that enable man-in-the-middle attacks at Layer 2. DHCP snooping is correct because it builds and maintains the trusted binding database of IP-to-MAC-to-port-to-VLAN mappings that DAI relies on, and it also rate-limits and filters rogue DHCP server messages. BPDU guard is correct because it err-disables access ports that receive BPDUs, preventing an attacker from injecting a rogue switch or manipulating STP topology. PortFast is not a mitigation feature — it only speeds up STP convergence on edge ports and actually increases risk unless paired with BPDU guard. EtherChannel load balancing is a bandwidth/availability feature, not a Layer 2 threat mitigation. Using VLAN 1 as the native VLAN on trunks is a poor practice that can enable VLAN hopping, so it does not mitigate threats.

Answer

EtherChannel load balancing to increase bandwidth.

Answer

VLAN 1 as the native VLAN on trunk ports for management.

Answer

PortFast on all access ports to prevent STP convergence delays.

Question 13

Match each networking concept to its most accurate role.

Accepted Answer

Unicast: one-to-one communication. Unicast communication involves one-to-one transmission between a single sender and a single receiver. Broadcast is one-to-all communication, where a packet is sent to every device on the local subnet. Multicast is one-to-many communication, where a single sender transmits to a specific group of interested receivers. Anycast is one-to-one-of-many, where a packet is delivered to the nearest node among a group of potential receivers, typically used for services like DNS. The other options are incorrectly defined: Broadcast is not one-to-closest (that is anycast), Multicast is not one-to-all (that is broadcast), and Anycast is not one-to-group (that is multicast). Therefore, only option A is correctly matched.

Answer

Broadcast: one-to-closest communication

Answer

Multicast: one-to-all communication

Answer

Anycast: one-to-group communication

Question 14

In AAA, which function determines what an authenticated user is allowed to do after login?

Accepted Answer

Authorization. Authentication verifies identity. Authorization determines permitted actions. Accounting records activity.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 15

Which TWO switch port configurations are required when connecting a Cisco IP phone and a desktop PC to a single access port?

Accepted Answer

Use the 'switchport voice vlan' command to assign a dedicated voice VLAN.. The 'switchport voice vlan' command assigns a dedicated VLAN for voice traffic, allowing the IP phone to tag its packets with the voice VLAN ID while the PC remains in the native (data) VLAN. Option D is correct because 'mls qos trust cos' preserves the Layer 2 Class of Service (CoS) markings from the IP phone, ensuring voice packets receive appropriate QoS treatment across the network. Option A is incorrect because a trunk port is not required—the access port with the voice VLAN command handles both VLANs without trunking. Option C is incorrect because disabling Spanning Tree Protocol (STP) is not a recommended practice and does not prevent voice delays; STP is essential for loop prevention and can be tuned with PortFast instead. Option E is incorrect because the port must remain a Layer 2 access port, not a routed port, to support both the PC and IP phone.

Answer

Configure the port as a trunk and allow both VLANs.

Answer

Disable spanning tree on the port to prevent voice delays.

Answer

Configure the port as a routed port with an IP address for management.