CCNA Practice Test 2 — 25 Questions

Question 1

Which THREE statements accurately describe the characteristics of NETCONF and RESTCONF for programmatic network configuration?

Accepted Answer

NETCONF uses XML-encoded RPCs over a secure transport such as SSH or TLS.. NETCONF uses XML-encoded Remote Procedure Calls (RPCs) over a secure transport such as SSH or TLS, making option B correct. RESTCONF supports both XML and JSON encoding and uses standard HTTP methods (GET, POST, PUT, PATCH, DELETE), so option C is correct. Both NETCONF and RESTCONF rely on YANG data models to define the structure of configuration and operational data, confirming option D. Option A is incorrect because NETCONF does not use HTTP methods; that is a characteristic of RESTCONF. Option E is wrong because RESTCONF does not use a separate commit operation; changes are applied immediately with each HTTP request, unlike NETCONF's candidate config and commit model.

Answer

NETCONF uses HTTP methods such as GET, POST, PUT, and DELETE to manipulate configuration data.

Answer

NETCONF uses a separate commit operation to apply changes, while RESTCONF uses a similar commit mechanism.

Question 2

A router has learned route 172.16.50.0/24 from OSPF with cost 20 and also has a static route to the same prefix with administrative distance 5. Which two statements are correct about route selection?

Accepted Answer

The static route is installed because it has the lower administrative distance. When the same prefix is learned from different routing sources, the router first compares administrative distance (AD). The static route with AD 5 wins over OSPF with AD 110, so option A is correct. Option C is correct because if the static route is removed, the OSPF route becomes the next best candidate and is installed. Option B is wrong since AD is compared before metrics like OSPF cost; a lower cost does not override a lower AD. Option D is wrong because only one route is installed per destination based on AD, not both.

Answer

The OSPF route is installed because cost 20 is lower than metric 0

Answer

Both routes are installed as equal-cost paths automatically

Question 3

A trunk link between two switches is operational, but one side shows a native VLAN mismatch warning. What is the main concern with that condition?

Accepted Answer

Untagged traffic may be associated with different VLANs on each end of the trunk. A native VLAN mismatch can cause untagged traffic to be interpreted as belonging to different VLANs on each end of the trunk. In plain language, the two switches disagree about where untagged frames belong. That can lead to confusing traffic behavior, reachability problems for certain flows, and operational warnings. It is not always a total outage, but it is a design inconsistency that should be corrected.

This matters because trunks carry multiple VLANs, and the native VLAN defines how untagged traffic is handled. If both ends do not agree, the logical treatment of those frames becomes inconsistent. The correct answer is the one that focuses on misclassification of untagged traffic, not on unrelated routing behavior.

Answer

All tagged VLAN traffic is automatically converted to routed traffic

Answer

The mismatch forces OSPF adjacency reset on all routers

Answer

The trunk can carry only one VLAN until the mismatch is cleared

Question 4

After a hub was connected to interface Gi0/10, the interface immediately entered errdisable state. The following syslog message was generated: '%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred on interface Gi0/10.' What is the strongest explanation for why Gi0/10 shut down?

Accepted Answer

Port security detected more MAC addresses than allowed on the interface.. The strongest explanation is a port-security violation caused by the switch seeing more secure MAC addresses than the interface allows. In practical terms, a hub or unmanaged device can cause multiple end hosts to appear behind one access port. If the interface is configured with a maximum of one secure MAC address, additional learned MACs trigger the violation action.

This is a realistic access-layer security scenario because the port does not fail randomly. It fails because the observed behavior violates the configured policy.

Answer

The interface received a superior BPDU and became the root port.

Answer

The hub forced the interface to become a routed port.

Answer

DHCP snooping always shuts a port when a hub is attached.

Question 5

A network administrator notices that a workstation connected to a Cisco switch port cannot communicate with other devices on the same VLAN. The switch port is up/up, but the workstation reports slow performance and intermittent connectivity. What is the most likely cause of this issue?

Accepted Answer

A duplex mismatch between the switch port and the workstation.. A duplex mismatch occurs when one end of the link is set to full-duplex and the other to half-duplex. The half-duplex end detects collisions and the full-duplex end does not, causing late collisions, CRC errors, and retransmissions. This results in slow performance and intermittent connectivity even though the port is operationally up.

Answer

Replace the faulty Ethernet cable between the switch and the workstation.

Answer

Assign the switch port to the correct VLAN.

Answer

Disable spanning-tree on the port to prevent frequent topology changes.

Question 6

A switch trunk is carrying several VLANs, but VLAN 99 traffic is failing. The trunk allowed list includes VLAN 99 on both sides. Which statement best explains why a VLAN can still fail even when it is allowed?

Accepted Answer

Because the VLAN may still be absent, inactive, or otherwise not operational locally even if it is allowed on the trunk. A VLAN can still fail across a trunk even when it is allowed because the allowed list is only one part of the overall design. In plain language, a switch may permit the VLAN on the link, but if the VLAN does not actually exist locally, is not active, or if some other trunk characteristic is inconsistent, traffic can still fail. This is an important CCNA troubleshooting principle: one correct line of configuration does not guarantee the full end-to-end condition is correct.

Candidates often stop at the allowed VLAN list because it is visible in common show commands. However, VLAN presence, local status, and other trunk parameters still matter. The best answer is the one recognizing that permission on the trunk does not automatically prove the entire VLAN path is healthy.

Answer

Because allowing a VLAN on a trunk automatically disables it

Answer

Because VLANs can cross trunks only when PAT is enabled

Answer

Because VLAN 99 must always be the native VLAN

Question 7

A route to 10.10.10.0/24 is learned through two OSPF paths. Both have the same prefix length and the same administrative distance, but one path has a lower OSPF metric. Which path is preferred?

Accepted Answer

The path with the lower OSPF metric. The path with the lower OSPF metric is preferred. In practical terms, when the prefix and route source are the same, the router uses the routing protocol’s internal path-selection logic. For OSPF, the lower metric is the more attractive path.

This is a clean example of metric-based selection within one routing protocol. Administrative distance is not the deciding factor here because the source protocol is the same on both paths.

Answer

The path with the higher OSPF metric

Answer

Both paths equally, because the administrative distance is the same

Answer

Neither path, because two OSPF routes to the same prefix are invalid

Question 8

An IPv6 host successfully reaches neighbors on its local segment, but it cannot reach remote IPv6 destinations. The host has a global unicast address and a correct prefix length. Which missing item is the strongest suspect?

Accepted Answer

A usable default router or next-hop route for off-link IPv6 traffic. The strongest suspect is the absence of a usable default router learned through IPv6 router advertisements or equivalent configuration. While local connectivity works because the host can communicate on its own link, remote IPv6 destinations require a next hop off the local segment. Option B is wrong because IPv6-to-IPv4 NAT is unnecessary for native IPv6 communication and would not be the primary cause of off-link failure. Option C is wrong because a VLAN trunk on the host NIC is for carrying multiple VLANs, not for enabling off-link routing. Option D is wrong because a second global unicast address does not provide a default route; it only adds another local address.

Answer

A NAT rule translating IPv6 to IPv4

Answer

A VLAN trunk on the host NIC

Answer

A second global unicast address on the same interface

Question 9

Which TWO commands can a network technician use on a modern Linux host to verify the IP address configuration and test reachability to a remote server?

Accepted Answer

ip addr. The `ip addr` command (option A) is the modern Linux utility for displaying IP address configuration, replacing the deprecated `ifconfig`. The `ping` command (option D) uses ICMP Echo Request/Reply messages to test Layer 3 reachability to a remote server. `ifconfig` (option B) is deprecated and not expected for current certification exams; `tracert` (option C) is a Windows command; `nslookup` (option E) performs DNS lookups but does not verify IP configuration or connectivity.

Answer

ifconfig

Answer

tracert

Answer

nslookup

Question 10

Which TWO interface errors are most likely caused by a mismatch in duplex settings between two connected switches?

Accepted Answer

Runts. A duplex mismatch occurs when one switch operates at full duplex while the other operates at half duplex. On the half-duplex side, frames arriving while the interface is transmitting are considered collisions, causing the frame to be truncated into fragments (runts). On the full-duplex side, the switch does not detect collisions but may receive incomplete frames, which are counted as runts if they are less than 64 bytes. CRC errors also spike because the truncated or corrupted frames fail the Frame Check Sequence (FCS) validation.

Answer

Giants

Answer

Input errors

Answer

Output errors

Answer

Flaps

Question 11

A wireless client joins the correct SSID and gets an address in the correct employee subnet, but cannot reach only one internal application while everything else works. Which troubleshooting area is the strongest first target?

Accepted Answer

The path or policy specific to that application, since general employee connectivity already works.. The strongest first target is the application path or policy specific to that application because the client already has general connectivity: it joined the correct SSID, authenticated, and obtained an IP address in the employee subnet. A failure limited to one internal application indicates that basic WLAN join, DHCP, and overall routing are working; therefore, ACLs, firewall rules, DNS resolution for that service, or application-specific policies are the likely cause. Option B (SSID broadcast setting) is irrelevant because the client successfully joined the SSID and has connectivity. Option C (voice VLAN on the wired access port) is not a first target because the symptom involves a single data application, not voice, and the client is on the employee subnet, not a voice VLAN. Option D (OSPF router ID on the client) is invalid because client devices do not typically run OSPF; OSPF runs on routers, not wireless clients.

Answer

The SSID broadcast setting, because the client must not be joined correctly.

Answer

The voice VLAN on the wired access port connected to the AP uplink.

Answer

The OSPF router ID on the client device.

Question 12

A router learns the same destination prefix from OSPF and from a static route configured with administrative distance 90. Which route is preferred by default?

Accepted Answer

The static route with distance 90. The static route is preferred because its administrative distance of 90 is lower than OSPF’s default administrative distance of 110. In practical terms, when the prefix length is the same, the router compares route-source trust next. The lower administrative distance wins.

This question is important because many learners remember that static routes are often strong choices but forget that administrative distance can be tuned. Here, that tuning explicitly makes the static route more preferred than OSPF.

Answer

The OSPF route, because dynamic routes always beat static routes

Answer

Both routes equally, because the prefix is identical

Answer

Neither route, because duplicate information is dropped

Question 13

A small office uses PAT for user Internet access. What mechanism does PAT use to allow many users to share one public address while keeping their sessions distinct?

Accepted Answer

Use transport-layer port values to distinguish multiple inside sessions behind one outside address.. PAT (Port Address Translation) distinguishes multiple inside sessions by rewriting the source port number for each connection while using the same public IP address. This transport-layer port translation allows many internal hosts to share one outside address without conflict. The correct answer identifies the use of port numbers, which is the core mechanism. Increasing the NAT pool or using static NAT would not enable sharing of a single public address. Changing private IPs to be identical or disabling routes are irrelevant to PAT's operation.

Answer

Convert all inside hosts to the same private IP address.

Answer

Increase the size of the NAT pool to include multiple public addresses.

Answer

Configure static NAT mappings for each inside host.

Question 14

Based on the exhibit, why is traffic to 192.168.40.200 using the default route instead of the intended static route?

Accepted Answer

The static route next hop is unreachable or invalid for forwarding.. The intended static route is not being used because the next hop for that static route is not reachable from the current routing table. In practical terms, a route can be configured, but the router still needs a way to resolve and forward to the next-hop address. If that next hop is unreachable, the route may not be installed or usable, so traffic falls back to the default route instead.

This is a realistic troubleshooting pattern because the configuration line alone can look correct until you compare it with actual reachability.

Answer

Default routes always override static routes.

Answer

The destination must be configured as a /16, not a /24.

Answer

Static routes can be used only if OSPF is disabled.

Question 15

A host is configured as 192.168.50.130/25. Which address is the broadcast address for its subnet?

Accepted Answer

192.168.50.255. A /25 divides the /24 into two blocks: 0–127 and 128–255. In plain language, because the host ends in 130, it belongs to the upper half, which starts at 128 and ends at 255. The last address in that block is the broadcast address, so the broadcast is 192.168.50.255.

This is a classic subnetting pattern because it tests whether you can identify not just the subnet, but also the reserved last address in that subnet.

Answer

192.168.50.127

Answer

192.168.50.128

Answer

192.168.50.254

Question 16

Why is HTTPS usually preferred over HTTP when accessing a controller API?

Accepted Answer

Because HTTPS provides encrypted transport for API traffic.. HTTPS is preferred because it protects the communication with encryption while it crosses the network. In practical terms, controller APIs often carry tokens, credentials, device state, or configuration information that should not be exposed in clear text. HTTPS helps protect those requests and responses in transit.

This does not make HTTPS the same thing as JSON, nor does it remove the need for authentication. It is simply the more secure transport choice for sensitive API communication.

Answer

Because HTTPS automatically replaces authentication.

Answer

Because HTTPS is the only format that can carry JSON.

Answer

Because HTTP cannot carry controller data at all.

Question 17

Which WAN technology is most closely associated with establishing a direct point-to-point data-link connection between two routers over a serial link?

Accepted Answer

PPP. PPP is the WAN technology most closely associated with point-to-point serial connections between routers. In practical terms, it is a Layer 2 WAN encapsulation method commonly discussed in traditional serial WAN contexts. It supports features such as authentication and link negotiation that make it more flexible than older basic encapsulations.

This is one of the classic CCNA WAN topics.

Answer

CAPWAP

Answer

SNMP

Answer

STP

Question 18

A user reports that a laptop can connect to the correct SSID but repeatedly fails authentication when joining the WLAN. Which category of issue is most strongly indicated?

Accepted Answer

A security or authentication mismatch related to WLAN access. The strongest indication is a wireless security or authentication mismatch rather than a pure RF coverage problem. In practical terms, the laptop can already see and attempt to join the correct SSID, which means discovery is working. Repeated authentication failure points more directly to credentials, security settings, or authentication-policy alignment than to channel or signal absence.

This question is about recognizing the stage of failure. The client is finding the WLAN, but it is not being accepted onto it.

Answer

A missing OSPF router ID on the access point

Answer

A routed-port mismatch on the switch uplink

Answer

A DHCP relay problem on the client

Question 19

A network administrator is troubleshooting connectivity loss in a switched network. All switches run Rapid PVST+. A host connected to an access port on SwitchC can no longer reach the default gateway. The access port is configured with PortFast and BPDU Guard. The administrator checks the interface status and finds it in an err-disabled state. What is the most likely cause of this issue?

Accepted Answer

BPDU Guard detected a BPDU on a PortFast-enabled port and disabled it.. B is correct because BPDU Guard is designed to protect the spanning-tree topology by disabling a PortFast-enabled port if it receives a BPDU, placing the port in err-disabled state. Option A is incorrect: a root bridge election failure would not cause a port to err-disable; loops do not directly trigger this state without BPDU Guard. Option C is incorrect because PortFast and BPDU Guard work with all spanning-tree variants including Rapid PVST+. Option D is incorrect: a trunk misconfiguration alone would not cause err-disable unless BPDU Guard detects a BPDU on a PortFast port.

Answer

The root bridge election failed, causing a loop.

Answer

Rapid PVST+ is not compatible with PortFast.

Answer

The port is configured as a trunk but should be an access port.

Question 20

Which IPv6 address type is automatically created on an interface and used for communication on the local link only?

Accepted Answer

Link-local. Every IPv6-enabled interface generates a link-local address, typically in the FE80::/10 range. It is used for neighbor discovery, local communication, and next-hop resolution on the same link.

Answer

Global unicast

Answer

Unique local

Answer

Multicast