CCNA Practice Test 25 — 15 Questions

Question 1

Which TWO statements correctly describe the encapsulation and de-encapsulation process at the transport layer of the OSI model?

Accepted Answer

During encapsulation, the transport layer adds a header containing source and destination port numbers.. During encapsulation at the transport layer, the TCP or UDP header is added, which includes source and destination port numbers. These port numbers identify the specific application-layer processes on the sending and receiving hosts, enabling proper demultiplexing of data. Option D is correct because during de-encapsulation, the transport layer removes its own header (e.g., TCP or UDP header) and passes the remaining payload up to the session layer (or directly to the application layer in a simplified model).

Answer

During encapsulation, the transport layer adds a header to form a packet.

Answer

During de-encapsulation, the transport layer removes the IP header to extract the segment.

Answer

During encapsulation, the transport layer adds a trailer for error detection.

Question 2

Match each REST-style method to the action it most commonly represents.

Accepted Answer

GET - Retrieve, POST - Create, PUT - Replace, PATCH - Partial Modify, DELETE - Remove, HEAD - Headers only. REST methods are standardized: GET retrieves, POST creates, PUT replaces, PATCH partially modifies, DELETE removes, and HEAD retrieves only headers.

Answer

GET - Retrieve, POST - Update, PUT - Create, PATCH - Delete, DELETE - Replace, HEAD - Headers only

Answer

GET - Retrieve, POST - Create, PUT - Update, PATCH - Replace, DELETE - Remove, HEAD - Headers only

Answer

GET - Retrieve, POST - Create, PUT - Replace, PATCH - Update, DELETE - Remove, HEAD - Headers only

Question 3

Drag each automation or API concept from the left to its corresponding description on the right. Not all descriptions are used.

Concepts:
- Northbound API
- Southbound API
- JSON
- HTTPS

Accepted Answer

Application-facing interface to the controller. Northbound API: the application-facing interface of an SDN controller, allowing apps to request services. Southbound API: the interface that enables the controller to configure managed devices, such as OpenFlow. JSON: a structured data format using key/value pairs and arrays, lightweight and machine‑friendly. HTTPS: secure, encrypted transport for API communications, protecting data in transit. Distractors: 'Human-readable serialization format' describes YAML, not JSON or APIs. 'Protocol for network device configuration' might refer to NETCONF or CLI, not HTTPS or the APIs listed.

Question 4

Refer to the exhibit. A network engineer is troubleshooting a connectivity issue on R1. The serial link to R2 on interface Serial0/1 is using HDLC encapsulation, and the physical cable has been verified as good. The engineer has confirmed that the encapsulation type matches on both routers and that the clock rate is correctly configured on the DCE end. Based on the output, what is the most likely cause of the line protocol down state on Serial0/1?

Accepted Answer

The keepalive packets are not being received, causing the protocol to stay down.. The output shows that the line protocol is down while the physical layer (Serial0/1 is up). With HDLC encapsulation and clock rate confirmed correct, the most likely cause is that keepalive packets are not being exchanged between R1 and R2. HDLC uses keepalives to maintain the data link layer; if they are not received (e.g., due to a misconfiguration like 'no keepalive' on one side or a faulty cable), the protocol state will remain down even though the physical layer is operational.

Answer

The encapsulation type is mismatched between R1 and R2.

Answer

The clock rate has not been configured on the DCE end of the serial link.

Answer

The IP address configured on Serial0/1 conflicts with another interface.

Question 5

A network administrator has configured a switch port to support a VoIP phone and a desktop PC. Users report that the desktop PC cannot obtain an IP address via DHCP, while the VoIP phone registers successfully. The switch port is up/up, and the desktop is connected to the phone's PC port. What is the most likely cause of the issue?

Accepted Answer

The switchport access vlan should be changed to the data VLAN to match the subnet expected by the desktop.. The desktop PC obtains its IP address from the data VLAN, but the switch port's access VLAN is likely misconfigured to the voice VLAN. Changing the access VLAN to the correct data VLAN places the PC in the proper subnet and allows DHCP to function. Option A is unnecessary because a voice-access port does not need to be a trunk. Option C would break the VoIP phone without fixing the PC's VLAN assignment. Option D is irrelevant; PortFast speeds up STP convergence and does not block DHCP.

Answer

The switchport mode access should be changed to switchport mode trunk to allow both vlans.

Answer

The switchport voice vlan should be removed because the desktop cannot use it.

Answer

The spanning-tree portfast should be disabled to prevent DHCP delays.

Question 6

A network engineer has enabled DHCP snooping on a Catalyst switch to prevent rogue DHCP servers. All access ports in VLAN 10 are untrusted. A router attached to a trunk port on the switch acts as the default gateway for VLAN 10 and is configured with the ip helper-address 10.1.2.5, which points to a remote DHCP server. After enabling DHCP snooping, hosts in VLAN 10 cannot obtain IP addresses; packet captures show DHCPDISCOVER messages are sent, but no DHCPOFFER is received. What is the most likely cause?

Accepted Answer

The switch port connecting to the router is not configured as a trusted port for DHCP snooping.. DHCP snooping treats all ports as untrusted by default. When a router acting as a DHCP relay is connected to an untrusted trunk port, the switch drops DHCPOFFER messages received from the router because they originate from an untrusted interface. Configuring the trunk port as trusted allows DHCP server responses (OFFER, ACK) to pass through to clients.

Answer

The router's ip helper-address command is pointing to an incorrect DHCP server IP address.

Answer

The DHCP server is on a different subnet, so the switch needs a switched virtual interface (SVI) in VLAN 10 with an IP address for Layer 3 connectivity.

Answer

DHCP snooping is dropping DHCPDISCOVER messages because the client access ports are untrusted.

Question 7

Select the options that correctly pair the security principle or control with its meaning.

Accepted Answer

Confidentiality ensures that data is accessible only to authorized users.. Confidentiality ensures data is accessible only to authorized users; integrity ensures data accuracy and trustworthiness (not availability); non-repudiation ensures accountability by preventing denial of actions; authorization grants permissions (not identity verification, which is authentication). Option B is wrong because integrity is about data correctness, not availability. Option D is wrong because authorization determines permissions, while authentication verifies identity.

Answer

Integrity ensures that data is always available when needed.

Answer

Authorization verifies the identity of a user or device.

Question 8

Why is a northbound API generally more useful to orchestration software than a human-readable CLI screen?

Accepted Answer

Because the API provides a structured interface intended for software interaction.. A northbound API is more useful because it is designed for structured software interaction. In practical terms, orchestration systems need predictable data and predictable request methods. Human-readable CLI output is optimized for people, not for stable machine parsing. APIs provide the cleaner contract between the controller and the automation platform.

This is a core programmability idea. Human-readable output is useful for operators, but structured APIs are better for software systems.

Answer

Because CLI output cannot be read by humans.

Answer

Because APIs remove the need for authentication.

Answer

Because orchestration software cannot use HTTPS.

Question 9

PCs in VLAN 30 on SwitchA cannot reach servers in VLAN 30 on SwitchB. All other VLANs work across the trunk. What is the most likely cause?

Accepted Answer

VLAN 30 is not allowed on the trunk from SwitchA.. The trunk is up and carrying multiple VLANs, but VLAN 30 is missing from the allowed list on one side. Since SwitchA and SwitchB both need to permit VLAN 30 on the trunk, if SwitchA's allowed VLAN list does not include VLAN 30, traffic for that VLAN cannot cross. Native VLAN mismatch or ISL vs 802.1Q issues would affect all VLANs, not just VLAN 30. Thus, the most likely cause is that VLAN 30 is not allowed on the trunk from SwitchA.

Answer

The native VLAN is mismatched between the switches.

Answer

VLAN 30 should be configured as the native VLAN on both ends.

Answer

SwitchB must use ISL instead of 802.1Q.

Question 10

Drag and drop the following steps into the correct order to configure and verify OSPFv3 neighbor adjacency using link-local addresses in area 0.

Accepted Answer

Enable IPv6 unicast routing with the 'ipv6 unicast-routing' global command.. The correct order enables IPv6 unicast routing globally, creates the OSPFv3 process, enters interface configuration, assigns the interface to the OSPFv3 process in area 0 (which activates OSPFv3 on the link), and finally verifies the neighbor relationship. IPv6 unicast routing must be enabled first because OSPFv3 requires IPv6 packet forwarding. The router process must exist before an interface can be associated with it. Assigning the interface to area 0 triggers Hello packet exchange over link-local addresses. The show command confirms the adjacency formed.

Question 11

An engineer is deploying a new Cisco Catalyst 9300 switch in a campus wiring closet. The uplink to the distribution switch uses a 1000BASE-LX SFP module. After connecting the fiber, the interface shows 'up/up' but the engineer notices that the 'input errors' counter is incrementing rapidly, with many CRC errors, runts, and giants being reported. What is the most likely cause of these input errors?

Accepted Answer

Check the fiber distance and ensure it is within the 5 km limit for 1000BASE-LX; if over, use a single-mode fiber extender.. The 1000BASE-LX standard uses long-wavelength laser optics (1300 nm) over single-mode fiber with a maximum distance of 5 km. Exceeding this limit causes signal attenuation and dispersion, generating bit errors that corrupt the frame check sequence (FCS). Cisco IOS counts these as CRC errors. Runts (frames shorter than 64 bytes) and giants (frames longer than 1518 bytes) also appear because the damaged frames are misinterpreted. Option B correctly identifies the distance limit as the root cause and recommends verifying it or using a fiber extender. Options A and D propose incorrect media, and option C would break the link since 1000BASE-LX operates at fixed 1000/full speed.

Answer

Replace the SFP with a 1000BASE-SX module.

Answer

Configure the interface with 'speed 100' and 'duplex full' to match the SFP capabilities.

Answer

Replace the fiber patch cable with a CAT6a copper cable and use a 1000BASE-T SFP.

Question 12

Match each access-control term to its most accurate meaning.

Accepted Answer

Authentication: The process of verifying the identity of a user or device.. AAA is a framework for controlling access. Authentication verifies identity, authorization grants permissions, and accounting logs activities. Identification is the initial claim, and auditing is the review of logs.

Answer

Authorization: The process of verifying the identity of a user or device.

Answer

Accounting: The process of granting or denying access to network resources.

Answer

Identification: The process of logging and monitoring user activities.

Question 13

Why is RIP rarely chosen for large modern enterprise networks?

Accepted Answer

It scales poorly due to slow convergence and hop-count limitations. RIP is simple but has important scalability limits, including a maximum metric of 15 and relatively slow convergence compared with more modern protocols such as OSPF and EIGRP.

Answer

It does not support IPv4

Answer

It cannot run on routers and only works on switches

Answer

It requires link-state advertisements

Question 14

A network administrator recently configured BPDU Guard on all access ports of a switch to protect against rogue switches. After the change, users in VLAN 10 report intermittent connectivity issues and frequent link flaps. The administrator checks the switch and notices that several ports are in an err-disabled state. What is the most likely cause of the problem?

Accepted Answer

BPDU Guard is enabled on access ports that are receiving BPDUs, causing the ports to go into err-disabled state.. BPDU Guard is configured to protect against rogue switches by placing a port into an err-disabled state upon receiving a BPDU. In this scenario, BPDU Guard is enabled on access ports that are receiving BPDUs (possibly from a rogue switch or misconfiguration), causing the ports to err-disable and flap. PortFast is not required for BPDU Guard to function; the issue is that BPDUs are being received on ports that are not expected to receive them. The intermittent connectivity occurs as ports cycle into err-disabled and are re-enabled.

Answer

Root Guard is preventing the port from becoming a root port.

Answer

Loop Guard has detected a unidirectional link and placed the port into err-disabled state.

Answer

BPDU Guard is globally enabled but not configured on the interface, so the port is err-disabled due to a BPDU received.

Question 15

A network administrator has recently upgraded the corporate wireless LAN to support 802.11ax (Wi-Fi 6) and is using WPA3-Enterprise with a central WLC. Several users with new 802.11ax laptops report that they can connect to the SSID, but after a few minutes their connections drop and then re-establish, while legacy 802.11ac clients work without issues. Which action will resolve this problem?

Accepted Answer

Enable Protected Management Frames (PMF) as Required on the WLAN.. WPA3-Enterprise requires Protected Management Frames (PMF) to be set to 'Required' on the WLC. When PMF is not enabled or set to 'Optional', 802.11ax clients using WPA3 may experience intermittent disconnects because management frame protection is mandatory for WPA3 operation. Legacy 802.11ac clients using WPA2 do not require PMF, so they remain unaffected.

Answer

Downgrade the WLAN security to WPA2-Enterprise for backward compatibility.

Answer

Disable OFDMA and MU-MIMO on the WLC for the affected APs.

Answer

Adjust the 5 GHz channel width from 80 MHz to 40 MHz to avoid interference.