CCNA Practice Test 3 — 25 Questions

Question 1

A company wants a server on the inside network to be reachable consistently from outside using one known public IP address. Which NAT approach best fits that goal?

Accepted Answer

Static NAT. Static NAT best fits that goal because it creates a fixed, predictable one-to-one mapping between the internal server and a public address. In plain language, outside systems always know which public IP represents that server. This predictability is exactly what is needed when a service must be reachable consistently from the outside.

PAT is better suited for many outbound clients sharing one address, not for presenting one inside server with a permanent public identity. Dynamic NAT from a pool can also vary depending on design. The correct answer is the one that provides the most stable and direct one-to-one mapping.

Answer

PAT overload only

Answer

No NAT at all, because private IPv4 addresses are Internet-routable

Answer

DHCP relay

Question 2

An internal server must always be reachable from outside using the same public IP address. Which translation approach is most appropriate?

Accepted Answer

Static NAT. A static NAT mapping is the most appropriate approach. In plain language, the outside world needs a stable public address that always represents the same internal server. Static NAT provides that fixed one-to-one relationship, which makes the service reachable predictably.

PAT is better suited for many outbound users sharing one public address, not for presenting one inside server with a consistent external identity. The correct answer is the one that provides a permanent mapping.

Answer

PAT overload

Answer

No NAT

Answer

DHCP relay

Question 3

In a controller-based design, which statement best describes a northbound API?

Accepted Answer

An application-facing API used by external software to communicate with the controller. A northbound API is the interface exposed by the controller to external applications, orchestration systems, dashboards, or automation tools. In plain language, it is the way software above the controller communicates with the controller so that it can request data, apply policy, or trigger changes. This is different from the southbound side, where the controller interacts with the underlying infrastructure devices.

This concept appears often in automation topics because it helps define where the controller sits in the larger architecture. A northbound API is not a physical cable, and it does not replace security controls. It is an application-facing software interface, which is exactly what the correct answer should capture.

Answer

A cable type used between controller clusters

Answer

The link-state protocol the controller uses to reach switches

Answer

A mechanism that removes the need for authentication

Question 4

Two directly connected routers running OSPFv3 do not form an adjacency. Both interfaces have valid IPv6 addresses and can ping each other using link-local addresses. What is the most likely cause?

Accepted Answer

The interfaces are assigned to different OSPFv3 areas.. The most likely cause is an OSPFv3 area mismatch on the interface. In practical terms, OSPFv3 still requires neighbors on the same link to agree on the area assignment, just as OSPF for IPv4 does. Link-local reachability alone is not enough to form an adjacency. The protocol parameters still have to match.

This is an important IPv6 routing point because people sometimes assume that successful IPv6 ping means the routing protocol should automatically work. It does not. Adjacency depends on protocol alignment, not just basic connectivity.

Answer

The routers need global unicast addresses before OSPFv3 can run.

Answer

The router IDs must be identical before adjacency can form.

Answer

The link-local addresses must be learned from DHCPv6.

Question 5

A host with address 172.16.5.10/23 wants to determine whether 172.16.6.20 is on the same local network. What is the correct conclusion?

Accepted Answer

It is on a different network, so the host should use the default gateway. A /23 prefix covers two consecutive /24 ranges. In plain language, that means the network boundaries move in blocks of 2 in the third octet. The address 172.16.5.10/23 belongs to the 172.16.4.0/23 network, which covers 172.16.4.x and 172.16.5.x. The destination 172.16.6.20 belongs to a different /23 block, so it is not on the same local network.

This question checks whether you can think beyond default /24 boundaries and understand how a broader prefix changes the local network range. The host would therefore need to use its default gateway to reach 172.16.6.20, because that destination is off-subnet relative to the /23 in use.

Answer

It is on the same local network because both addresses begin with 172.16.

Answer

It is on the same local network because /23 covers all addresses in 172.16.5.x and 172.16.6.x

Answer

It is on a different network, so ARP will resolve it across the router automatically

Question 6

Based on the exhibit, what is the most likely reason PAT is not working correctly?

Accepted Answer

The inside and outside NAT interface roles are reversed.. PAT is not working correctly because the inside and outside NAT roles are reversed on the interfaces. In practical terms, the private LAN-facing interface should be marked as inside, and the public-facing WAN interface should be marked as outside. In the exhibit, the router has those roles backwards, so translation logic is applied in the wrong direction.

This is a very realistic NAT troubleshooting item because the configuration is close to correct and the failure comes from one directional mistake.

Answer

PAT requires OSPF to be enabled on the WAN link.

Answer

The ACL must be numbered 100 instead of 1.

Answer

The router must use GRE before PAT can overload.

Question 7

Match each switching feature to its most accurate purpose.

Accepted Answer

STP prevents loops, VTP manages VLANs, EtherChannel aggregates links, Port Security restricts MAC addresses, DTP negotiates trunks, and Rapid PVST+ provides fast per-VLAN convergence.. Which accurately pairs each switching feature with its purpose: Spanning Tree Protocol (STP) prevents loops in a switched network by blocking redundant paths; VLAN Trunking Protocol (VTP) manages the addition, deletion, and renaming of VLANs across the network; EtherChannel aggregates multiple physical links into a single logical link for increased bandwidth and redundancy; Port Security limits the number of MAC addresses allowed on a switch port to prevent unauthorized access; Dynamic Trunking Protocol (DTP) automatically negotiates trunking between switches; and Rapid PVST+ provides fast convergence for each VLAN using multiple spanning tree instances. The other options contain incorrect pairings, such as mixing up STP with VLAN management or EtherChannel with loop prevention.

Answer

STP manages VLANs, VTP prevents loops, EtherChannel restricts MAC addresses, Port Security aggregates links, DTP provides fast per-VLAN convergence, and Rapid PVST+ negotiates trunks.

Answer

STP aggregates links, VTP prevents loops, EtherChannel manages VLANs, Port Security negotiates trunks, DTP restricts MAC addresses, and Rapid PVST+ provides fast per-VLAN convergence.

Answer

STP provides fast per-VLAN convergence, VTP aggregates links, EtherChannel prevents loops, Port Security manages VLANs, DTP restricts MAC addresses, and Rapid PVST+ negotiates trunks.

Question 8

A subnet has the network address 192.168.30.0/26. What is the broadcast address?

Accepted Answer

192.168.30.63. A /26 subnet contains 64 addresses. In plain language, the block that starts at 192.168.30.0 runs through 192.168.30.63. The first address is the network address and the last address is the broadcast address, so the broadcast for this subnet is 192.168.30.63.

This is a standard subnet-boundary calculation. Once the block size is identified, the broadcast address is simply the final address in that block.

Answer

192.168.30.64

Answer

192.168.30.255

Answer

192.168.30.31

Question 9

A switchport is configured as an access port in VLAN 10, but a user plugs in a small unmanaged switch and connects multiple devices behind it. Which security feature most directly limits that behavior at the switchport?

Accepted Answer

Port security. Port security most directly limits that behavior because it can restrict how many MAC addresses are learned on the switchport. In practical terms, if the interface is supposed to support one endpoint but suddenly begins presenting multiple MAC addresses from a downstream mini-switch, port security can detect and react to that change.

This is a classic access-layer control question. VLAN assignment alone does not limit how many devices appear behind the port.

Answer

OSPF authentication

Answer

NetFlow

Answer

NTP

Question 10

An EtherChannel should form using LACP between two switches. One side is configured for LACP active, and the other side is configured for LACP active. What is the expected result if the other link settings also match?

Accepted Answer

The EtherChannel should form if the other interface settings are compatible.. The EtherChannel should form successfully if the underlying link settings are compatible. LACP active/active is a valid combination, as both switches actively negotiate the bundle. However, the channel does not automatically become a routed interface (option C is incorrect because EtherChannel can operate as Layer 2 or Layer 3 depending on configuration, not automatically due to LACP mode). Additionally, VLAN tags are not removed by default from the bundle (option D is incorrect; VLAN tagging is preserved based on the switchport mode and allowed VLAN settings). The key troubleshooting point is to ensure that other interface parameters such as speed, duplex, and VLAN settings match across the member ports.

Answer

The channel fails because both sides must be passive.

Answer

The channel becomes a routed interface automatically.

Answer

All VLAN tags are removed from the bundle by default.

Question 11

A host is configured with 10.1.1.34/30. Which address is the broadcast address for its subnet?

Accepted Answer

10.1.1.35. A /30 subnet has a block size of 4. In practical terms, the last-octet blocks are 0–3, 4–7, 8–11, and so on. Because 34 falls within the 32–35 block, the broadcast address is the last address in that block: 10.1.1.35.

This question tests whether you can identify the correct subnet block before choosing the broadcast address.

Answer

10.1.1.31

Answer

10.1.1.32

Answer

10.1.1.36

Question 12

Which two statements accurately describe the relationship between a network address and a broadcast address in IPv4 subnetting?

Accepted Answer

The network address is the first address in the subnet block.. The network address identifies the beginning of the subnet block, and the broadcast address identifies the final address in that block. In practical terms, both are reserved and are not assigned to ordinary hosts. The usable host range falls between them.

This is a very basic subnetting truth, but it is foundational for every other addressing calculation.

Answer

Both addresses are normal host addresses that can be assigned to users.

Answer

The broadcast address always becomes the default gateway.

Answer

These concepts exist only in IPv6 and not IPv4.

Question 13

Which static route on R1 sends all unknown IPv4 destinations to next-hop address 192.0.2.1?

Accepted Answer

ip route 0.0.0.0 0.0.0.0 192.0.2.1. A quad-zero route is the IPv4 default route. It matches destinations that do not have a more specific entry in the routing table.

Answer

ip route 0.0.0.0 255.255.255.255 192.0.2.1

Answer

ip route 255.255.255.255 0.0.0.0 192.0.2.1

Answer

ip default-gateway 192.0.2.1

Question 14

An API client sends a valid GET request and receives an HTTP 200 response. What does that indicate?

Accepted Answer

The request was successful. HTTP 200 indicates a successful request. For a GET operation, it generally means the server successfully returned the requested resource representation.

Answer

The resource was deleted successfully

Answer

Authentication permanently failed

Answer

The server requires a reboot

Question 15

Based on the exhibit, what is the most likely reason the PPP link is down?

Accepted Answer

The serial interfaces use different encapsulations.. The PPP link is down because the two ends are configured for different encapsulations. In practical terms, one side is using PPP and the other is using HDLC, so the devices are not speaking the same data-link protocol on the serial link. Until those encapsulations match, the link cannot come up correctly at the data-link layer.

This is a classic WAN troubleshooting pattern that fits well into simulation-style exam coverage.

Answer

PPP requires CAPWAP on both routers.

Answer

The routers must run BGP before PPP can establish.

Answer

Serial links can use only OSPF, not PPP.

Question 16

What is the main purpose of this configuration?

ipv6 route 2001:db8:100::/64 GigabitEthernet0/0

Accepted Answer

It creates a specific IPv6 static route to 2001:db8:100::/64 out GigabitEthernet0/0.. This configuration creates an IPv6 static route to a specific destination prefix through the named outgoing interface. In practical terms, the router is being told exactly how to reach that remote IPv6 network. This is not a default route and not a dynamic-routing statement. It is a manually defined path to one destination prefix.

The key concept is recognizing the difference between a specific static route and a default route.

Answer

It enables OSPFv3 on GigabitEthernet0/0.

Answer

It creates an IPv6 default route.

Answer

It converts the interface into a tunnel.

Question 17

A host is configured with 192.168.10.129/25. Which subnet contains that host?

Accepted Answer

192.168.10.128/25. A /25 divides the /24 into two blocks: 0–127 and 128–255. In practical terms, 192.168.10.129 belongs to the upper half, so the containing subnet is 192.168.10.128/25.

This is a simple subnet-boundary question, but it is designed to confirm that you can identify the correct half of the /24 quickly and confidently.

Answer

192.168.10.0/25

Answer

192.168.10.64/25

Answer

192.168.10.192/25

Question 18

A security team wants device administrators to log in with individual named accounts instead of sharing one generic admin account. Which security objective does that most directly improve?

Accepted Answer

Accountability for administrative actions. It most directly improves accountability. In practical terms, when each administrator has an individual account, the organization can tie actions to specific people rather than to one shared identity. That makes investigation, auditing, and operational review much more meaningful.

This also supports better access-control hygiene overall, but the clearest direct benefit is being able to identify who actually performed an administrative action.

Answer

Automatic VLAN assignment for management traffic

Answer

Route summarization efficiency

Answer

Wireless roaming performance

Question 19

An engineer is allowed to log in to a router but cannot enter configuration mode. Which AAA function most directly explains that outcome?

Accepted Answer

Authorization. Authorization most directly explains the outcome. In practical terms, the user has already passed authentication because login succeeded, but the permissions assigned to that identity do not allow configuration-level actions. This is exactly the sort of role separation authorization is meant to enforce.

This is a good example of why authentication and authorization are not the same thing.

Answer

Authentication

Answer

Accounting

Answer

DNS

Question 20

A host is configured as 10.20.30.95/27. Which address is the network address of its subnet?

Accepted Answer

10.20.30.64. A /27 uses blocks of 32 addresses. In plain language, the ranges in the last octet are 0–31, 32–63, 64–95, 96–127, and so on. Since the host address ends in 95, it belongs to the 64–95 block. The first address in that block is the network address, which is 10.20.30.64.

This is a classic subnet-boundary question because it tests whether you can identify the containing block and then choose the first address in that block as the network address.

Answer

10.20.30.32

Answer

10.20.30.95

Answer

10.20.30.96