CCNA Practice Test 2 — 25 Questions

Question 1

You are connected to R1 in a small office network. Configure PAT (NAT overload) so that hosts on the 192.168.1.0/24 LAN can access the Internet via the public IP 203.0.113.1 (the IP assigned to interface G0/0). Also configure a static NAT for the internal web server at 192.168.1.10 to the public IP 203.0.113.6. The current configuration has errors: the inside/outside interface assignments are swapped, the ACL for PAT does not match the inside subnet, and the PAT rule points to the wrong ACL. Fix all issues so that both PAT and static NAT work correctly.

Accepted Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 1 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6. The main issues: (1) Interfaces were swapped — G0/0 (public) was inside and G0/1 (private) was outside. They should be reversed: G0/0 outside, G0/1 inside. (2) ACL 1 (used in the PAT command) permitted 192.168.2.0/24 instead of 192.168.1.0/24. (3) The PAT command for G0/0 used ACL 2, which was correct for the subnet but the interface was wrong. After fixing interface assignments and correcting ACL 1 to permit the inside subnet, the PAT command must use ACL 1 and the correct outside interface. The static NAT was correctly configured but needed the correct inside interface. The PAT translation uses the IP address of the outside interface (interface overload), so after fixing the configuration, inside hosts will be translated to 203.0.113.1, the primary IP of G0/0, not 203.0.113.5.

Answer

Configure G0/0 as inside, G0/1 as outside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 1 interface G0/1 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.2.0 0.0.0.255; apply ip nat inside source list 1 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 2 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Question 2

A router has routes for 10.10.0.0/16, 10.10.20.0/24, and a default route. Which route is used for destination 10.10.20.55?

Accepted Answer

The 10.10.20.0/24 route. The destination matches multiple routes, but the /24 is the most specific match and wins by longest prefix match.

Answer

The 10.10.0.0/16 route

Answer

The default route

Answer

The router load-balances across all matching routes

Question 3

Why is NTP especially useful when devices send logs to a centralized Syslog server?

Accepted Answer

It helps align device clocks so centralized log timestamps can be correlated more accurately.. NTP is especially useful because synchronized clocks make the log timestamps more meaningful and easier to correlate. In plain language, if each device thinks the current time is different, the sequence of events in the centralized log becomes confusing. NTP helps align time across devices so the logs tell a more accurate story.

This is an operational best practice. Syslog collects the messages, and NTP makes their timing consistent. The correct answer is the one focused on timestamp correlation.

Answer

It assigns the Syslog server an IP address.

Answer

It replaces the need for a Syslog server.

Answer

It encrypts every Syslog message automatically.

Question 4

Two routers are directly connected over IPv6 and should form an OSPFv3 adjacency, but they do not. Link-local addressing is present on both interfaces. Which issue is most likely to prevent the adjacency?

Accepted Answer

The interfaces are assigned to different OSPFv3 areas.. An area mismatch is a strong and direct explanation. In plain language, even though the routers can have valid IPv6 addressing and proper link-local communication on the interface, OSPFv3 still requires the two ends of the shared segment to agree on the area context for the adjacency. If one side places the interface in one area and the other side places it in another, the routers will not treat each other as valid neighbors.

This is very similar in principle to OSPF for IPv4. Link-local addressing matters in OSPFv3, but the protocol still enforces key neighbor-formation checks. The correct answer is the one that focuses on a required protocol match rather than on a vague issue like hostname or cable color.

Answer

The routers need matching hostnames before OSPFv3 can start.

Answer

IPv6 requires a /64 only for routing protocols to function.

Answer

OSPFv3 cannot run on directly connected interfaces.

Question 5

A network administrator has configured dynamic NAT on a Cisco router to allow internal hosts to access the Internet. Internal hosts can ping external servers, but external hosts cannot initiate connections to any internal host. The administrator checks the NAT translations. What is the most likely cause of this behavior?

Accepted Answer

The router is configured for dynamic NAT without overload (PAT), so it assigns one public IP per inside host and does not allow inbound connections without a static mapping.. Option B is correct because dynamic NAT without overload maps each inside host to a unique public IP from the pool, but it does not allow external hosts to initiate connections because there is no static mapping or port forwarding to direct inbound traffic. The described behavior—internal hosts reaching the Internet while external hosts cannot initiate connections—is typical of dynamic NAT without PAT. With PAT (overload), many internal hosts share a single public IP and inbound connections would still require explicit port forwarding; without overload, the router simply does not know how to translate incoming requests back to the correct inside host.

Answer

The NAT pool is exhausted because it contains only 21 addresses, and more than 21 internal hosts are trying to access the Internet simultaneously.

Answer

The inside local addresses are not in the same subnet as the inside interface, causing asymmetric routing.

Answer

The outside global addresses are not routable on the Internet, so external hosts cannot send return traffic.

Question 6

A network administrator receives a call from a user who cannot access any external websites from their wired workstation. The user can ping the default gateway successfully, but fails to ping 8.8.8.8. The administrator runs ipconfig /all on the workstation and sees an IP address of 192.168.1.50, subnet mask 255.255.255.0, and default gateway 192.168.1.1. What is the most likely cause of this issue?

Accepted Answer

The workstation has an incorrect default gateway configured.. The user can successfully ping 192.168.1.1, proving local IP connectivity to that device. However, the device at 192.168.1.1 may not be the correct default gateway for reaching external networks; the actual gateway router might be at a different IP (e.g., 192.168.1.254). This misconfiguration explains why pings to 8.8.8.8 fail even though the local gateway responds, as the workstation sends external traffic to the wrong next-hop address.

Answer

The workstation has a duplicate IP address on the network.

Answer

The workstation is connected to the wrong VLAN.

Answer

The workstation has a DNS misconfiguration.

Question 7

Which four of the following are best practices for securing network services and devices? (Choose four.)

Accepted Answer

Implement role-based access control (RBAC) to limit user privileges.. Disabling unused ports, implementing role-based access control (RBAC), enabling logging, and keeping firmware updated are all critical security best practices: they reduce the attack surface, limit user permissions, detect threats, and patch known vulnerabilities. Using Telnet is insecure because it transmits data in cleartext, unlike SSH. Placing all devices on the same VLAN undermines network segmentation and allows lateral movement by attackers.

Answer

Place all network devices on the same VLAN to simplify security policy enforcement.

Answer

Use Telnet for remote management because it is simpler to configure than SSH.

Question 8

Which TWO statements accurately describe the encapsulation process in the TCP/IP model as data moves from the application layer to the network access layer?

Accepted Answer

At the transport layer, the PDU is called a segment (for TCP) and includes source and destination port numbers.. At the transport layer, TCP creates segments that include source and destination port numbers (B correct). At the network layer, the PDU is a packet containing source and destination IP addresses (D correct). Option A is wrong because the application layer generates data, not segments, and transport headers are added later. Option C mislabels the network layer PDU; it is a packet, not a frame, and MAC addresses belong to frames. Option E is wrong because the data link layer PDU is a frame, not a packet, and it uses MAC addresses, not IP addresses.

Answer

At the application layer, the PDU is called a segment and includes a transport layer header.

Answer

At the network layer, the PDU is called a frame and includes source and destination MAC addresses.

Answer

At the data link layer, the PDU is called a packet and includes source and destination IP addresses.

Question 9

A network engineer configures an EtherChannel between two Cisco switches SW1 and SW2 using LACP. After configuration, hosts connected to SW1 report intermittent connectivity to hosts on SW2. The engineer checks the EtherChannel status and sees that the trunk is up but only allows VLAN 1, while the hosts communicate across VLANs 10 and 20. Which command should the engineer apply to both switches to resolve the issue?

Accepted Answer

switchport trunk allowed vlan 1,10,20. The output shows the EtherChannel is up but only VLAN 1 is allowed on the trunk, while the hosts on SW1 and SW2 communicate across VLANs 10 and 20. Applying 'switchport trunk allowed vlan 1,10,20' on both switches ensures all necessary VLANs are permitted over the EtherChannel, resolving the intermittent connectivity caused by dropped traffic for VLANs 10 and 20.

Answer

channel-group 1 mode active

Answer

lacp rate fast

Answer

switchport mode trunk

Question 10

A router has a default route and a specific route to 203.0.113.0/24. Which route is used for traffic to 203.0.113.25?

Accepted Answer

The specific route to 203.0.113.0/24. The specific route to 203.0.113.0/24 is used because it is a more specific match than the default route. In plain language, even though the default route could technically match almost anything, the router always prefers a route that more precisely describes the destination network. Since 203.0.113.25 is inside 203.0.113.0/24, that route wins under longest-prefix match.

This is one of the most basic routing-table interpretation rules. The default route remains important as a fallback, but it is not chosen when a more specific valid route exists.

Answer

The default route

Answer

Both routes are always load-balanced

Answer

Neither route because defaults cannot coexist with specific routes

Question 11

A network administrator configured dynamic NAT on a Cisco router to allow internal hosts to access the internet. After the configuration, users report that they can access some websites but not others. The administrator checks the router and discovers that the NAT translation table is full, and new connection attempts are being dropped. What is the most likely cause of this issue?

Accepted Answer

The NAT pool is exhausted; configure PAT to allow multiple hosts to share a single public IP.. When the NAT pool is exhausted, no new translations can be created, so only hosts that already have established translations can continue to communicate, causing intermittent connectivity. A full NAT table means the pool of public IP addresses is completely allocated, preventing new sessions. Implementing PAT allows multiple inside hosts to share a single public IP by multiplexing port numbers, resolving the pool exhaustion.

Answer

The inside local addresses are not properly defined in the access list.

Answer

The outside interface is not configured with the ip nat outside command.

Answer

The inside interface is not configured with the ip nat inside command.

Question 12

R1 and R2 are directly connected. Both are configured in OSPF area 0, and they can successfully ping each other. However, OSPF neighbor adjacency fails. R1's interface is configured with `ip ospf authentication message-digest` and a valid key, while R2's interface has no OSPF authentication configured. What is the most likely cause?

Accepted Answer

The OSPF authentication settings do not match.. The most likely cause is an OSPF authentication mismatch. Although the routers have IP connectivity and are in the same OSPF area, OSPF adjacency requires matching security parameters. R1 uses message-digest authentication whereas R2 has none configured, preventing neighbor formation. The other options are incorrect: the stem confirms they are in the same area (A), OSPF does not require identical hostnames (C), and successful pings prove the subnet mask does not block multicast traffic (D).

Answer

The routers are in different OSPF areas.

Answer

The routers need identical hostnames before adjacency can form.

Answer

The subnet mask prevents OSPF multicast traffic.

Question 13

Drag and drop the following steps into the correct order to capture and analyze traffic on IOS-XE using the embedded packet capture feature, and in Wireshark to isolate a Layer 2 or Layer 3 fault.

Accepted Answer

Enter privileged EXEC mode, enable capture on the interface, define buffer and filter, start capture, then export for Wireshark analysis.. The correct order for Cisco IOS-XE Embedded Packet Capture (EPC) is: 1. Enter privileged EXEC mode. 2. Enable the capture on the interface (create capture point) using commands like 'monitor capture point ip cef both'. 3. Define the buffer size and optional filter with commands like 'monitor capture buffer size ' and 'monitor capture buffer filter '. 4. Associate the capture point with the buffer (if separate) or start using 'monitor capture point start '. 5. Export the capture to a file. Options B, C, and D all deviate from this correct sequence: B defines buffer before enabling capture; C starts before enabling and defining; D starts before enabling. Only option A follows the proper order.

Question 14

R1 learns the route 192.0.2.0/24 via OSPF, RIP, and a static route configured with an administrative distance of 130. Based on this information, which two statements are correct?

Accepted Answer

The OSPF route is installed because its administrative distance is lower than RIP and the floating static route.. The router installs the OSPF route because it has the lowest administrative distance among the routes shown. The static route with AD 130 is intentionally floating, and the RIP route has a higher AD than OSPF. Route selection first prefers longest match, then lower AD among routes to the same prefix length.

Answer

The static route will be preferred because static routes always beat dynamic routes.

Answer

RIP wins because its metric is lower than OSPF cost.

Answer

All three routes should load-balance because the prefix length is the same.

Question 15

Drag and drop the steps into the recommended configuration order for setting up VLANs, assigning access ports, configuring 802.1Q trunking with a non-default native VLAN, and verifying the setup on a Cisco IOS-XE switch.

Accepted Answer

1. Create VLANs, 2. Configure trunking with non-default native VLAN, 3. Assign access ports to VLANs, 4. Verify configuration. After creating VLANs, the recommended order is to configure trunking with a non-default native VLAN before assigning access ports. This ensures the trunk is ready with the correct native VLAN, preventing mismatches and allowing the switch to carry traffic for the new VLANs. Options B and D fail because VLANs must exist first. Option A places trunking last, which is not the best practice.

Answer

1. Create VLANs, 2. Assign access ports to VLANs, 3. Configure trunking with non-default native VLAN, 4. Verify configuration

Answer

1. Assign access ports to VLANs, 2. Create VLANs, 3. Configure trunking with non-default native VLAN, 4. Verify configuration

Answer

1. Configure trunking with non-default native VLAN, 2. Create VLANs, 3. Assign access ports to VLANs, 4. Verify configuration

Question 16

A network administrator is troubleshooting a connectivity issue between two remote sites connected via a WAN link. Hosts on VLAN 10 at Site A (192.168.10.0/24) cannot ping the server at Site B (10.10.20.100). The router at Site A has a default route configured with the next-hop IP address 10.10.10.2. The administrator checks the routing table on Router A and notices that the default route is not installed. What is the most likely cause of the problem?

Accepted Answer

The next-hop router 10.10.10.2 is unreachable.. Option D is correct because the default route uses a next-hop IP (10.10.10.2) and will only be installed in the routing table if that next-hop is reachable. Since the router’s routing table shows no default route, the most likely cause is that the next-hop 10.10.10.2 is unreachable, preventing the static route from being used. This explains why traffic fails despite the configuration.

Answer

The static route for 10.10.20.0/24 is missing from the routing table.

Answer

The GigabitEthernet0/0 interface is administratively down.

Answer

The default route is not configured; the gateway of last resort is missing.

Question 17

A junior network engineer configured a floating static route on Router R1 to provide backup connectivity to a remote network 10.10.10.0/24. The primary connection uses OSPF. However, after the primary link fails, hosts on R1 cannot reach the remote network. The OSPF adjacency is down, and the floating static route is not appearing in the routing table. Based on the exhibit, what is the most likely cause of the issue?

Accepted Answer

The static route's next-hop becomes unreachable after the primary OSPF link fails.. Option B is correct because the floating static route's next-hop becomes unreachable after the primary OSPF link fails. In the exhibit, the next-hop IP is likely configured to an address that is only reachable via OSPF; when that adjacency drops, the router has no route to the next-hop, so it cannot recursively resolve the static route. As a result, the route does not appear in the routing table. Option A is wrong because the route is present in the configuration (as a floating static route). Option C is wrong because the administrative distance of the floating static route is intentionally higher than OSPF's so that it only installs when OSPF fails; this is correct behavior. Option D is wrong because a default route would not override a more specific static route to 10.10.10.0/24.

Answer

The floating static route is missing from the configuration.

Answer

The administrative distance of the static route is too high.

Answer

The default route is overriding the static route to 10.10.10.0/24.

Question 18

Which three statements about the routing table and route selection are correct? (Choose three.)

Accepted Answer

The route with the longest prefix match is always preferred when multiple routes match the destination IP.. The route with the longest prefix match is always preferred because it is the most specific route to the destination IP. A directly connected route has an administrative distance of 0 by default, making it the most trusted route source. If two routes have the same prefix length, administrative distance, and metric, equal-cost load balancing can occur, distributing traffic over multiple paths.

Answer

An OSPF inter-area route has a lower administrative distance than an OSPF intra-area route.

Answer

The administrative distance of a static route is always 1.

Answer

A default route (0.0.0.0/0) is always preferred over any more specific route.

Question 19

A switch port is configured with `switchport voice vlan 150` and `switchport access vlan 20`. Which statement best explains the design purpose?

Accepted Answer

It separates voice and data traffic on the same edge port by assigning them to different VLANs.. The design purpose is to let the switch support a phone and an attached workstation on the same physical access port while placing their traffic into different VLANs. In practical terms, the phone can use the voice VLAN while the user's data traffic uses the access VLAN. This is a common enterprise edge design for IP telephony.

The key idea is role separation on one port, not trunking the port as a normal inter-switch link.

Answer

It turns the port into a routed WAN interface.

Answer

It forces the phone to use CAPWAP before receiving power.

Answer

It makes VLAN 150 the native VLAN on all trunks automatically.

Question 20

A switch is configured with DHCP snooping and Dynamic ARP Inspection. Hosts suddenly lose connectivity after changing IP settings manually. Which explanation is strongest?

Accepted Answer

DAI is rejecting ARP traffic because the manual IP change does not match trusted snooping bindings.. The correct answer is A because DAI uses DHCP snooping binding to validate ARP messages; a manual IP change creates a mismatch, causing DAI to block ARP. Option B is incorrect because STP prevents loops and does not block based on MAC address changes. Option C is incorrect because OSPF authentication is a routing protocol feature irrelevant on an access port. Option D is incorrect because PPP authentication applies to serial links, not Ethernet ARP.

Answer

STP is blocking the host because its MAC address changed.

Answer

OSPF authentication failed on the access port.

Answer

The switch requires PPP authentication before allowing ARP traffic.

CCNA Practice Test 2 — 25 Questions

Exhibit

CCNA Practice Test 2 — 25 Questions

Exhibit