CCNA Practice Test 23 — 15 Questions

Question 1

A network engineer is troubleshooting a wireless performance issue in a dense office environment. Clients on the 5 GHz band are experiencing low throughput even though they are close to the AP. The AP is a Cisco 9130AXI running IOS-XE 17.9. What is the most likely cause of the poor performance?

Accepted Answer

The AP is operating in 802.11ac mode instead of 802.11ax, and the 80 MHz channel bonding is causing high interference in the dense environment.. In a dense office environment, using 80 MHz channel bonding with 802.11ac (Wave 2) increases the likelihood of co-channel interference and overlapping basic service sets (OBSS), which degrades throughput despite strong signal. The Cisco 9130AXI supports 802.11ax (Wi-Fi 6), which includes OFDMA and better spatial reuse, but if the AP is configured for 802.11ac mode, it loses these efficiency gains and suffers from the wide channel's interference penalty.

Answer

The AP is using an incorrect channel width of 80 MHz, which is not supported by 802.11ac.

Answer

The AP has DFS non-compliance, which prevents it from using channel 36 and causes the radio to operate at reduced power.

Answer

The AP is using WPA2-PSK instead of WPA3, which causes lower throughput due to weaker encryption.

Question 2

Refer to the exhibit. A network engineer is troubleshooting an EtherChannel on R1 that is not passing traffic. The output of the show etherchannel summary command is displayed. What is the most likely cause?

Accepted Answer

One side is configured with LACP active and the other side is configured with mode 'on' (static).. The 'show etherchannel summary' output shows the port-channel is down (flags indicate 'D' for down), and the most common cause when one side is configured with LACP active and the other with mode 'on' (static) is a protocol mismatch. LACP active expects to negotiate with another LACP-enabled port, but static mode 'on' forces the link up without negotiation, causing the EtherChannel to fail to form. This mismatch prevents the exchange of LACP frames, leaving the bundle in an error-disabled or non-functional state.

Answer

The local switch is configured with LACP passive while the remote switch is set to LACP active.

Answer

The remote switch is configured with PAgP desirable while the local switch uses LACP.

Answer

The port-channel member interfaces are configured as access ports, preventing LACP from negotiating.

Question 3

After enabling DHCP snooping on VLAN 10, a technician finds that clients in that VLAN are no longer receiving IP addresses from the DHCP server. The server is connected to port Gi0/24. What is the most likely cause?

Accepted Answer

The port Gi0/24 has not been configured as a trusted port for DHCP snooping.. When DHCP snooping is enabled, all ports are untrusted by default. Untrusted ports will drop DHCP server messages (OFFER, ACK, etc.) unless the port is explicitly configured as trusted. Since the DHCP server is connected to Gi0/24 and the technician did not configure it as a trusted port, the switch discards the server's responses, preventing clients from obtaining IP addresses.

Answer

The DHCP server is on a different subnet, and the VLAN 10 SVI does not have an ip helper-address configured.

Answer

The DHCP snooping database location was not configured, causing the switch to discard all DHCP server messages.

Answer

The DHCP snooping binding table does not contain an entry for the DHCP server’s MAC address, so offers are being discarded.

Question 4

Match each networking concept to its most accurate role.

Accepted Answer

Unicast: one-to-one communication. Unicast communication involves one-to-one transmission between a single sender and a single receiver. Broadcast is one-to-all communication, where a packet is sent to every device on the local subnet. Multicast is one-to-many communication, where a single sender transmits to a specific group of interested receivers. Anycast is one-to-one-of-many, where a packet is delivered to the nearest node among a group of potential receivers, typically used for services like DNS. The other options are incorrectly defined: Broadcast is not one-to-closest (that is anycast), Multicast is not one-to-all (that is broadcast), and Anycast is not one-to-group (that is multicast). Therefore, only option A is correctly matched.

Answer

Broadcast: one-to-closest communication

Answer

Multicast: one-to-all communication

Answer

Anycast: one-to-group communication

Question 5

In AAA, which function determines what an authenticated user is allowed to do after login?

Accepted Answer

Authorization. Authentication verifies identity. Authorization determines permitted actions. Accounting records activity.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 6

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to ISP router, and GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The internal network uses 192.168.1.0/24 and needs to access the internet. Configure NAT overload on R1 so that internal hosts are translated to the IP address of GigabitEthernet0/0 when accessing the internet.

Accepted Answer

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside. NAT overload (PAT) allows multiple internal hosts to share a single public IP by using different source ports. The ACL identifies the internal network, and the interfaces are marked as inside/outside. The 'overload' keyword enables port address translation. Option B fails because it translates to the wrong interface (GigabitEthernet0/1) instead of the public-facing interface (GigabitEthernet0/0). Option C is missing the required 'overload' keyword, so it performs dynamic NAT without PAT, which is insufficient for multiple hosts. Option D uses an overly broad ACL ('permit any') that does not match only the internal network (192.168.1.0/24) as required by the stem.

Answer

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/1 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside

Answer

R1(config)# access-list 1 permit 192.168.1.0 0.0.0.255
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside

Answer

R1(config)# access-list 1 permit any
R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0 overload
R1(config)# interface GigabitEthernet0/0
R1(config-if)# ip nat outside
R1(config-if)# interface GigabitEthernet0/1
R1(config-if)# ip nat inside

Question 7

Which TWO switch port configurations are required when connecting a Cisco IP phone and a desktop PC to a single access port?

Accepted Answer

Use the 'switchport voice vlan' command to assign a dedicated voice VLAN.. The 'switchport voice vlan' command assigns a dedicated VLAN for voice traffic, allowing the IP phone to tag its packets with the voice VLAN ID while the PC remains in the native (data) VLAN. Option D is correct because 'mls qos trust cos' preserves the Layer 2 Class of Service (CoS) markings from the IP phone, ensuring voice packets receive appropriate QoS treatment across the network. Option A is incorrect because a trunk port is not required—the access port with the voice VLAN command handles both VLANs without trunking. Option C is incorrect because disabling Spanning Tree Protocol (STP) is not a recommended practice and does not prevent voice delays; STP is essential for loop prevention and can be tuned with PortFast instead. Option E is incorrect because the port must remain a Layer 2 access port, not a routed port, to support both the PC and IP phone.

Answer

Configure the port as a trunk and allow both VLANs.

Answer

Disable spanning tree on the port to prevent voice delays.

Answer

Configure the port as a routed port with an IP address for management.

Question 8

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two redundant links to SW2 (G0/1 and G0/2). The network administrator wants to use both links for load balancing and redundancy by configuring EtherChannel. You need to configure a Layer 2 EtherChannel using LACP on both switches. The port-channel should be in VLAN 1.

Accepted Answer

interface port-channel 1
switchport mode access
switchport access vlan 1
interface range GigabitEthernet0/1-2
channel-group 1 mode active. EtherChannel bundles multiple physical links into a single logical link for load balancing and redundancy. LACP (mode active) negotiates the bundle automatically. The port-channel interface must be configured with the desired switchport settings.

Answer

interface port-channel 1
switchport mode trunk
switchport trunk allowed vlan 1
interface range g0/1-2
channel-group 1 mode desirable

Answer

interface port-channel 1
switchport mode access
switchport access vlan 1
interface range g0/1-2
channel-group 1 mode passive

Answer

interface port-channel 1
switchport mode access
switchport access vlan 1
interface g0/1
channel-group 1 mode active
interface g0/2
channel-group 2 mode active

Question 9

After enabling Dynamic ARP Inspection on VLAN 20, a network engineer notices that some hosts lose connectivity. The affected hosts have correct IP addresses and MAC addresses, but they cannot ping the default gateway. All other hosts on the same VLAN work fine. Further investigation reveals that the non-functioning hosts are using static IP configurations, while the working hosts are DHCP clients. What is the most likely cause?

Accepted Answer

DAI is dropping ARP packets from the static hosts because they do not have a corresponding entry in the DHCP snooping binding table.. Dynamic ARP Inspection (DAI) relies on the DHCP snooping binding table to validate ARP packets. When a host uses a static IP address, it does not have an entry in that table, so DAI treats its ARP packets as invalid and drops them. This prevents the static host from resolving the default gateway's MAC address, breaking connectivity even though the IP and MAC are correct.

Answer

The DHCP snooping binding table is exhausted and cannot accept new bindings for the static hosts.

Answer

IP Source Guard is also enabled on VLAN 20 and is blocking traffic from hosts that have no DHCP snooping binding.

Answer

The switch is detecting ARP spoofing from the static hosts and has shut down their switchport interfaces for security.

Question 10

You are connected to R1 via the console. An extended ACL named BLOCK_SMTP has been applied inbound on interface GigabitEthernet0/1, but users on the 192.168.10.0/24 network cannot send email to the SMTP server at 203.0.113.10. Additionally, the ACL is blocking all other traffic that should be permitted. Examine the running configuration and fix the ACL so that SMTP traffic (TCP port 25) from the 192.168.10.0/24 network to the SMTP server is permitted, and all other IP traffic is allowed.

Accepted Answer

permit tcp 192.168.10.0 0.0.0.255 host 203.0.113.10 eq 25
deny tcp any any eq 25
permit ip any any. It permits SMTP from 192.168.10.0/24 to the SMTP server, then denies all other SMTP traffic, and finally permits all other IP traffic. Option B is wrong because it places a general permit for any SMTP before the specific deny, meaning all SMTP is permitted regardless of source/destination. Option C is wrong because it denies all SMTP first, so the subsequent specific permit for the user network is never reached. Option D is wrong because the order permits the specific SMTP, then permits all IP traffic (including other SMTP), then denies SMTP—the permit ip any any before the deny makes the deny unreachable for all traffic, allowing all SMTP.

Answer

permit tcp any any eq 25
deny tcp 192.168.10.0 0.0.0.255 host 203.0.113.10 eq 25
permit ip any any

Answer

deny tcp any any eq 25
permit tcp 192.168.10.0 0.0.0.255 host 203.0.113.10 eq 25
permit ip any any

Answer

permit tcp 192.168.10.0 0.0.0.255 host 203.0.113.10 eq 25
permit ip any any
deny tcp any any eq 25

Question 11

A router shows the following routing table entries for the same destination:

O    10.10.50.0/24 [110/20] via 192.168.12.2, GigabitEthernet0/0
D    10.10.50.0/24 [90/30720] via 192.168.13.2, GigabitEthernet0/1

Which route will become the active route in the routing table?

Accepted Answer

The EIGRP route, because its administrative distance is lower. The EIGRP route becomes active because the router compares administrative distance first when the same destination is learned from different routing protocols. This is one of the most common Cisco exam traps: candidates compare the OSPF metric value of 20 to the EIGRP metric value and assume the smaller number must win. That is not how route selection works across different protocols. OSPF metrics and EIGRP metrics are calculated differently, so the router does not compare them directly. Instead it checks administrative distance. EIGRP internal routes default to 90, while OSPF routes default to 110. Since 90 is lower than 110, the EIGRP route is trusted more and is installed as the active path.

Answer

The OSPF route, because its metric is lower

Answer

Both routes, because the prefixes are identical

Answer

Neither route, because the metrics use different scales

Question 12

A network technician notices CDP native VLAN mismatch warnings between switches SW1 and SW2 on their trunk link. The technician runs 'show interfaces trunk' on SW1 and sees native VLAN 1, then on SW2 and sees native VLAN 99. Data traffic is currently passing, but the mismatch can cause broadcast loops. What should the technician do next?

Accepted Answer

Configure the native VLAN to match on both ends of the trunk.. The correct action is to configure the native VLAN to match on both ends of the trunk. CDP reports a native VLAN mismatch when the native VLANs differ on the two sides of a trunk link. Although data traffic may still pass because 802.1Q does not tag frames on the native VLAN, the mismatch can cause broadcast loops and security risks, as frames from one native VLAN may be misinterpreted on the other side. Setting both sides to the same native VLAN (e.g., VLAN 1 or VLAN 99) resolves the mismatch and ensures proper Layer 2 behavior.

Answer

Add VLAN 99 to the allowed VLAN list on the trunk interface of SW1.

Answer

Remove the trunk configuration and set both interfaces as access ports in VLAN 1.

Answer

Enable spanning‑tree PortFast on the trunk ports.

Question 13

A network administrator has configured dynamic NAT on a Cisco router to allow internal hosts to access the Internet. Internal hosts can ping external servers, but external hosts cannot initiate connections to any internal host. The administrator checks the NAT translations. What is the most likely cause of this behavior?

Accepted Answer

The router is configured for dynamic NAT without overload (PAT), so it assigns one public IP per inside host and does not allow inbound connections without a static mapping.. Dynamic NAT without overload maps each inside host to a unique public IP from the pool, but it does not allow external hosts to initiate connections because there is no static mapping or port forwarding to direct inbound traffic. The described behavior—internal hosts reaching the Internet while external hosts cannot initiate connections—is typical of dynamic NAT without PAT. With PAT (overload), many internal hosts share a single public IP and inbound connections would still require explicit port forwarding; without overload, the router simply does not know how to translate incoming requests back to the correct inside host.

Answer

The NAT pool is exhausted because it contains only 21 addresses, and more than 21 internal hosts are trying to access the Internet simultaneously.

Answer

The inside local addresses are not in the same subnet as the inside interface, causing asymmetric routing.

Answer

The outside global addresses are not routable on the Internet, so external hosts cannot send return traffic.

Question 14

A technician is troubleshooting a connection between two routers, R1 and R2, connected back-to-back using Ethernet cables. Both routers have their interfaces configured and are in an 'up/up' state. R1's interface uses 192.168.1.1/24, and R2's interface uses 192.168.2.1/24. When the technician attempts to ping R2 from R1, the ping fails. What is the most likely cause?

Accepted Answer

The IP addresses assigned to the interfaces belong to different subnets, preventing direct Layer 3 communication.. The ping fails because R1's interface is configured with IP address 192.168.1.1/24, which places it in the 192.168.1.0/24 subnet, while R2's interface uses 192.168.2.1/24, placing it in the 192.168.2.0/24 subnet. For two devices to communicate directly at Layer 3 over a single Ethernet link, their IP addresses must belong to the same subnet. Since these addresses are in different subnets, R1 will see the destination as unreachable and will not even attempt to send an ARP request for R2's MAC address, resulting in a failed ping.

Answer

The Ethernet cable is faulty, causing intermittent physical layer failures.

Answer

A duplex mismatch exists between R1 and R2, causing one-way communication.

Answer

A routing protocol is not configured to allow the routers to learn about each other's directly connected networks.

Question 15

After configuring the area 0 range 10.0.0.0 255.255.0.0 command on an OSPF ABR, a technician finds that a host at 10.0.5.100 in Area 1 cannot reach hosts in Area 0. The ABR’s OSPF database shows only the summary 10.0.0.0/16 in Area 0, and no individual /24 routes. What is the most likely cause?

Accepted Answer

The area range command causes the ABR to advertise only the summary LSA and suppress the more-specific Type-3 LSAs for the range.. The `area 0 range 10.0.0.0 255.255.0.0` command on an OSPF ABR creates a single Type-3 summary LSA (10.0.0.0/16) for Area 0 and suppresses the advertisement of more-specific Type-3 LSAs (e.g., /24 routes) that fall within that range. This is the intended behavior of the `range` command: it summarizes routes at the ABR and prevents the individual component routes from being advertised into the backbone area. Since the host at 10.0.5.100 in Area 1 relies on those specific /24 routes to reach destinations in Area 0, the suppression breaks connectivity.

Answer

The ABR is filtering the specific /24 routes using a distribute-list under the OSPF process.

Answer

The routers in Area 1 are no longer advertising their /24 routes to the ABR because the ABR is in a different area.

Answer

The ABR has automatically created a discard route to null0 for the summary, which is dropping all traffic destined to the summarized networks.

CCNA Practice Test 23 — 15 Questions

Exhibit

CCNA Practice Test 23 — 15 Questions

Exhibit