CCNA Practice Test 25 — 15 Questions

Question 1

A network administrator is troubleshooting an issue where hosts on VLAN 10 cannot ping the default gateway at 192.168.10.1. The router (R1) has an SVI for VLAN 10 with IP 192.168.10.1/24. The administrator captures traffic on the router's G0/0/0 interface (trunk to the switch) and reviews the embedded packet capture output. What is the root cause of the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The switch port connecting the host is configured in the wrong VLAN (e.g., VLAN 20 instead of VLAN 10).. The captured traffic on the trunk shows that the router is not receiving any frames tagged with VLAN 10 from the host. If the switch port connecting the host is configured in VLAN 20 instead of VLAN 10, the host's frames will be tagged with VLAN 20 (or remain untagged in the access VLAN 20) and will not reach the router's SVI for VLAN 10, causing the ping to fail. This is the most direct cause given the symptom that the host cannot ping the default gateway.

Answer

The router's SVI for VLAN 10 is administratively down.

Answer

An inbound ACL on the router's SVI is blocking ICMP echo requests from the host.

Answer

The router has ICMP redirects enabled, causing it to ignore the pings.

Question 2

Match each operations or assurance technology to its most accurate purpose.

Accepted Answer

NetFlow - Flow analysis; SNMP - Device management; Syslog - Logging; IP SLA - Performance measurement; SPAN - Local traffic mirroring; RSPAN - Remote traffic mirroring. Each technology serves a specific assurance purpose: Syslog provides centralized event and message reporting, SNMP enables monitoring and management information exchange, NetFlow offers visibility into traffic flows and conversations, and NTP ensures clock synchronization for consistent timing across network devices.

Answer

NetFlow - Device management; SNMP - Flow analysis; Syslog - Performance measurement; IP SLA - Logging; SPAN - Remote traffic mirroring; RSPAN - Local traffic mirroring

Answer

NetFlow - Logging; SNMP - Performance measurement; Syslog - Flow analysis; IP SLA - Device management; SPAN - Remote traffic mirroring; RSPAN - Local traffic mirroring

Answer

NetFlow - Performance measurement; SNMP - Logging; Syslog - Device management; IP SLA - Flow analysis; SPAN - Local traffic mirroring; RSPAN - Remote traffic mirroring

Question 3

A network engineer configures an EtherChannel between two Cisco switches SW1 and SW2 using LACP. After configuration, hosts connected to SW1 report intermittent connectivity to hosts on SW2. The engineer checks the EtherChannel status and sees that the trunk is up but only allows VLAN 1, while the hosts communicate across VLANs 10 and 20. Which command should the engineer apply to both switches to resolve the issue?

Accepted Answer

switchport trunk allowed vlan 1,10,20. The output shows the EtherChannel is up but only VLAN 1 is allowed on the trunk, while the hosts on SW1 and SW2 communicate across VLANs 10 and 20. Applying 'switchport trunk allowed vlan 1,10,20' on both switches ensures all necessary VLANs are permitted over the EtherChannel, resolving the intermittent connectivity caused by dropped traffic for VLANs 10 and 20.

Answer

channel-group 1 mode active

Answer

lacp rate fast

Answer

switchport mode trunk

Question 4

Refer to the exhibit. An administrator is troubleshooting connectivity from a branch router R1 to the internet. A ping to 8.8.8.8 from R1 fails. The output of the show ip route command is shown. What is the most likely cause?

Accepted Answer

The next-hop IP address for the default route is not reachable.. The ping to 8.8.8.8 fails because the default route (0.0.0.0/0) points to a next-hop IP address that is not reachable. The routing table shows the default route is present, but if the next-hop address is not in the routing table via a connected or static route, the router cannot resolve the Layer 2 adjacency and will not forward packets. This is confirmed by the fact that the default route exists but the ping fails, indicating a reachability issue with the next hop.

Answer

The default route is missing from the routing table.

Answer

The static route has an incorrect administrative distance.

Answer

The ip routing process has not been enabled.

Question 5

A network engineer notices that traffic from the router to server 192.168.10.5 is being sent over a slow backup link, even though the primary high-speed link is up. The routing table has an OSPF route for 192.168.10.0/24 via the primary link and a static host route to 192.168.10.5/32 via the backup link. Why is the backup link used for traffic to the server?

Accepted Answer

The static /32 route is a more specific match than the OSPF /24 route, so it is selected regardless of administrative distance.. The router uses the most specific matching route in the routing table to forward traffic. The static host route to 192.168.10.5/32 has a longer prefix length (32 bits) than the OSPF route for 192.168.10.0/24 (24 bits), making it a more specific match. Even though OSPF has a higher administrative distance, the longest prefix match rule takes precedence over administrative distance when both routes are present in the routing table.

Answer

The static route has an administrative distance of 1, which is lower than OSPF's 110, so it is always preferred.

Answer

The router is load-balancing between the two routes, and traffic is being hashed to the backup link for this particular flow.

Answer

The OSPF route is not installed in the routing table because the static route has a better AD.

Question 6

A switchport is configured for 802.1X authentication. What is the usual role of the RADIUS server in that design?

Accepted Answer

It validates authentication credentials for the supplicant.. The switch acts as the authenticator and forwards authentication requests to the RADIUS server, which validates the user or device credentials.

Answer

It provides Layer 2 trunk negotiation for the supplicant.

Answer

It replaces the need for DHCP on the access layer.

Answer

It generates ARP replies on behalf of the default gateway.

Question 7

A network engineer notices that an NMS at 10.1.1.200 cannot poll a router that has SNMPv2c configured with community string 'public'. What is causing this issue?

Accepted Answer

The SNMP community 'public' has an access list that only permits host 10.1.1.100.. SNMPv2c community strings can be restricted by an access control list (ACL) that specifies which source IP addresses are allowed to poll the router. If the ACL only permits host 10.1.1.100, then the NMS at 10.1.1.200 will be denied access even though the community string 'public' is correct. This is a common configuration for security, but it prevents polling from unauthorized hosts.

Answer

SNMPv2c is not enabled on the router.

Answer

The NMS is using the wrong community string.

Answer

The router's SNMP agent is not listening on the interface facing 10.1.1.200.

Question 8

Two routers are directly connected over IPv6 and should form an OSPFv3 adjacency, but they do not. Link-local addressing is present on both interfaces. Which issue is most likely to prevent the adjacency?

Accepted Answer

The interfaces are assigned to different OSPFv3 areas.. An area mismatch is a strong and direct explanation. In plain language, even though the routers can have valid IPv6 addressing and proper link-local communication on the interface, OSPFv3 still requires the two ends of the shared segment to agree on the area context for the adjacency. If one side places the interface in one area and the other side places it in another, the routers will not treat each other as valid neighbors.

This is very similar in principle to OSPF for IPv4. Link-local addressing matters in OSPFv3, but the protocol still enforces key neighbor-formation checks. The correct answer is the one that focuses on a required protocol match rather than on a vague issue like hostname or cable color.

Answer

The routers need matching hostnames before OSPFv3 can start.

Answer

IPv6 requires a /64 only for routing protocols to function.

Answer

OSPFv3 cannot run on directly connected interfaces.

Question 9

Which TWO statements about fiber optic cable types and SFP transceivers are correct?

Accepted Answer

Multimode fiber is commonly used in campus and data center environments for distances up to several hundred meters.. Multimode fiber (MMF) has a larger core (typically 50/125 µm or 62.5/125 µm) and is used for short-reach, cost-effective connections up to a few hundred meters, making option B correct. Single-mode fiber (SMF) uses a much smaller core (~9 µm) and laser-based optics to achieve distances of 10 km or more, so option D is correct. Option A is wrong because it reverses the core size characteristic: SMF has a smaller core, and the given dimensions (62.5/125 µm) refer to multimode. Option C is wrong because SFP+ is a 10 Gbps form factor and is not inherently backward compatible with 1 Gbps SFP modules unless the switch port explicitly supports dual-rate operation. Option E is incorrect because fiber optic cables are inherently immune to electromagnetic interference (EMI) and therefore never require EMI shielding in any environment; the false statement claims they need shielding.

Answer

Single-mode fiber uses a larger core (typically 62.5/125 µm) and supports longer distances than multimode fiber.

Answer

SFP+ transceivers support data rates up to 1 Gbps and are backward compatible with standard SFP modules.

Answer

Fiber optic cables must be run with EMI shielding when deployed in environments with high electromagnetic interference.

Question 10

Which TWO statements correctly describe the encapsulation and de-encapsulation process at the transport layer of the OSI model?

Accepted Answer

During encapsulation, the transport layer adds a header containing source and destination port numbers.. During encapsulation at the transport layer, the TCP or UDP header is added, which includes source and destination port numbers. These port numbers identify the specific application-layer processes on the sending and receiving hosts, enabling proper demultiplexing of data. Option D is correct because during de-encapsulation, the transport layer removes its own header (e.g., TCP or UDP header) and passes the remaining payload up to the session layer (or directly to the application layer in a simplified model).

Answer

During encapsulation, the transport layer adds a header to form a packet.

Answer

During de-encapsulation, the transport layer removes the IP header to extract the segment.

Answer

During encapsulation, the transport layer adds a trailer for error detection.

Question 11

Match each REST-style method to the action it most commonly represents.

Accepted Answer

GET - Retrieve, POST - Create, PUT - Replace, PATCH - Partial Modify, DELETE - Remove, HEAD - Headers only. REST methods are standardized: GET retrieves, POST creates, PUT replaces, PATCH partially modifies, DELETE removes, and HEAD retrieves only headers.

Answer

GET - Retrieve, POST - Update, PUT - Create, PATCH - Delete, DELETE - Replace, HEAD - Headers only

Answer

GET - Retrieve, POST - Create, PUT - Update, PATCH - Replace, DELETE - Remove, HEAD - Headers only

Answer

GET - Retrieve, POST - Create, PUT - Replace, PATCH - Update, DELETE - Remove, HEAD - Headers only

Question 12

Drag each automation or API concept from the left to its corresponding description on the right. Not all descriptions are used.

Concepts:
- Northbound API
- Southbound API
- JSON
- HTTPS

Accepted Answer

Application-facing interface to the controller. Northbound API: the application-facing interface of an SDN controller, allowing apps to request services. Southbound API: the interface that enables the controller to configure managed devices, such as OpenFlow. JSON: a structured data format using key/value pairs and arrays, lightweight and machine‑friendly. HTTPS: secure, encrypted transport for API communications, protecting data in transit. Distractors: 'Human-readable serialization format' describes YAML, not JSON or APIs. 'Protocol for network device configuration' might refer to NETCONF or CLI, not HTTPS or the APIs listed.

Question 13

Refer to the exhibit. A network engineer is troubleshooting a connectivity issue on R1. The serial link to R2 on interface Serial0/1 is using HDLC encapsulation, and the physical cable has been verified as good. The engineer has confirmed that the encapsulation type matches on both routers and that the clock rate is correctly configured on the DCE end. Based on the output, what is the most likely cause of the line protocol down state on Serial0/1?

Accepted Answer

The keepalive packets are not being received, causing the protocol to stay down.. The output shows that the line protocol is down while the physical layer (Serial0/1 is up). With HDLC encapsulation and clock rate confirmed correct, the most likely cause is that keepalive packets are not being exchanged between R1 and R2. HDLC uses keepalives to maintain the data link layer; if they are not received (e.g., due to a misconfiguration like 'no keepalive' on one side or a faulty cable), the protocol state will remain down even though the physical layer is operational.

Answer

The encapsulation type is mismatched between R1 and R2.

Answer

The clock rate has not been configured on the DCE end of the serial link.

Answer

The IP address configured on Serial0/1 conflicts with another interface.

Question 14

A network administrator has configured a switch port to support a VoIP phone and a desktop PC. Users report that the desktop PC cannot obtain an IP address via DHCP, while the VoIP phone registers successfully. The switch port is up/up, and the desktop is connected to the phone's PC port. What is the most likely cause of the issue?

Accepted Answer

The switchport access vlan should be changed to the data VLAN to match the subnet expected by the desktop.. The desktop PC obtains its IP address from the data VLAN, but the switch port's access VLAN is likely misconfigured to the voice VLAN. Changing the access VLAN to the correct data VLAN places the PC in the proper subnet and allows DHCP to function. Option A is unnecessary because a voice-access port does not need to be a trunk. Option C would break the VoIP phone without fixing the PC's VLAN assignment. Option D is irrelevant; PortFast speeds up STP convergence and does not block DHCP.

Answer

The switchport mode access should be changed to switchport mode trunk to allow both vlans.

Answer

The switchport voice vlan should be removed because the desktop cannot use it.

Answer

The spanning-tree portfast should be disabled to prevent DHCP delays.

Question 15

A network engineer has enabled DHCP snooping on a Catalyst switch to prevent rogue DHCP servers. All access ports in VLAN 10 are untrusted. A router attached to a trunk port on the switch acts as the default gateway for VLAN 10 and is configured with the ip helper-address 10.1.2.5, which points to a remote DHCP server. After enabling DHCP snooping, hosts in VLAN 10 cannot obtain IP addresses; packet captures show DHCPDISCOVER messages are sent, but no DHCPOFFER is received. What is the most likely cause?

Accepted Answer

The switch port connecting to the router is not configured as a trusted port for DHCP snooping.. DHCP snooping treats all ports as untrusted by default. When a router acting as a DHCP relay is connected to an untrusted trunk port, the switch drops DHCPOFFER messages received from the router because they originate from an untrusted interface. Configuring the trunk port as trusted allows DHCP server responses (OFFER, ACK) to pass through to clients.

Answer

The router's ip helper-address command is pointing to an incorrect DHCP server IP address.

Answer

The DHCP server is on a different subnet, so the switch needs a switched virtual interface (SVI) in VLAN 10 with an IP address for Layer 3 connectivity.

Answer

DHCP snooping is dropping DHCPDISCOVER messages because the client access ports are untrusted.