CCNA Practice Test 4 — 25 Questions

Question 1

Exhibit: An access switch shows Gi1/0/10 as err-disabled shortly after an IP phone and a workstation are connected through the same wall jack. What is the most likely cause?

Accepted Answer

The port security maximum is too low for the connected devices. With a phone and a PC on the same access port, the switch may legitimately see two MAC addresses. Port security set to a maximum of 1 causes a violation and can place the interface into err-disabled state.

Answer

The native VLAN is missing

Answer

BPDU Guard blocked the port because a workstation was attached

Answer

DHCP snooping denied the voice VLAN

Question 2

A host is configured with IP address 192.168.70.18/30. Which addresses belong to the same subnet block?

Accepted Answer

192.168.70.16 through 192.168.70.19. A /30 subnet has a block size of 4. In practical terms, the relevant blocks in the last octet are 0–3, 4–7, 8–11, 12–15, 16–19, and so on. Because 18 falls inside the 16–19 block, the subnet includes network address .16, usable hosts .17 and .18, and broadcast .19.

This question checks whether you can identify the correct /30 block and understand all addresses that fall inside it.

Answer

192.168.70.18 through 192.168.70.21

Answer

192.168.70.12 through 192.168.70.15

Answer

192.168.70.20 through 192.168.70.23

Question 3

A REST API call uses the GET method against a device inventory endpoint. What is the most likely intent of the call?

Accepted Answer

To retrieve information from the endpoint.. The most likely intent is to retrieve information, not to create or delete it. In practical terms, GET is commonly used when a client wants to read state or inventory data from an API endpoint. This is one of the most basic REST-style concepts in network automation.

The key is to associate method semantics with likely operational intent.

Answer

To delete the endpoint from the controller.

Answer

To replace the endpoint with a new resource.

Answer

To force the device into PPP mode.

Question 4

Exhibit: A host on VLAN 10 can ping the local SVI but not a server in VLAN 20. The Layer 3 switch has both VLAN interfaces up. What is the next item to verify first?

Accepted Answer

Whether the server in VLAN 20 has the correct default gateway. If the source host can reach its own default gateway, the local VLAN and access port are probably fine. The next practical check is whether the server in VLAN 20 has the correct IP address, mask, and default gateway configured.

Answer

Whether the switch should disable IP routing

Answer

Whether VLAN 10 should be the native VLAN

Answer

Whether the host should use a /8 mask instead of /24

Question 5

Why is route summarization useful at a distribution layer or area boundary?

Accepted Answer

It reduces the number of specific prefixes that must be carried or advertised.. Route summarization is useful because it reduces the number of individual routes that have to be advertised and stored. In practical terms, one summary can represent many more specific internal prefixes, which helps keep routing tables smaller and updates simpler. That improves scalability and reduces control-plane clutter.

Summarization does not eliminate the need for detail everywhere, but it helps present the network more efficiently at aggregation points.

Answer

It forces all traffic to use a default route only.

Answer

It automatically encrypts routing updates.

Answer

It removes the need for subnetting.

Question 6

Which OSI layer is responsible for end-to-end segmentation, port numbers, and reliability functions such as acknowledgments?

Accepted Answer

Transport. The Transport layer (Layer 4) is responsible for end-to-end segmentation, port numbers for identifying applications, and reliability functions like acknowledgments and retransmission. The Network layer (Layer 3) handles logical addressing and routing between networks. The Data Link layer (Layer 2) manages local frame delivery and error detection. The Session layer (Layer 5) controls dialog management and synchronization, not segmentation or ports.

Answer

Network

Answer

Data Link

Answer

Session

Question 7

In a router-on-a-stick design, what is configured on the physical router interface connected to the switch?

Accepted Answer

Subinterfaces with 802.1Q encapsulation for each routed VLAN. Router-on-a-stick uses one physical router interface with multiple logical subinterfaces. Each subinterface is associated with a VLAN using 802.1Q encapsulation and gets an IP address for that VLAN. Option A is wrong because IP addresses are configured on subinterfaces, not directly on the physical interface for all VLANs. Option B is wrong because inter-VLAN routing requires a router; the switch alone does not perform inter-VLAN routing in this design. Option D is wrong because serial encapsulation is used for WAN connections, not for VLAN tagging on Ethernet interfaces.

Answer

One IP address for every VLAN on the physical interface itself only

Answer

No subinterfaces; the switch handles all inter-VLAN routing internally

Answer

A serial encapsulation setting for each VLAN

Question 8

Which field is modified by each router hop in an IPv4 packet to prevent endless forwarding loops?

Accepted Answer

TTL. The Time to Live field is decremented at each hop.

Answer

Source port

Answer

Sequence number

Answer

CRC in the Ethernet trailer

Question 9

Which TWO statements accurately describe how AI and ML concepts are applied to network operations?

Accepted Answer

Intent-based networking translates business intent into network policies and continuously validates that the network meets those intentions.. Intent-based networking (IBN) captures business intent in a declarative model, translates it into network policies (e.g., via Cisco DNA Center), and continuously validates that the network state matches the intended outcome using assurance and closed-loop analytics. Option B is correct because anomaly detection leverages ML models to establish a baseline of normal traffic and then flags deviations, which can indicate security threats or performance issues. Option C is incorrect because predictive analytics forecasts future network conditions but does not automatically reconfigure devices; that requires closed-loop automation. Option D is false because ML models in network operations are not trained exclusively on labeled data; unsupervised learning can detect unknown patterns without labeled datasets. Option E is false because rule-based systems cannot adapt to new, unknown patterns without manual updates, whereas ML models are better suited for anomaly detection due to their ability to learn and generalize from data.

Answer

Predictive analytics uses historical data to forecast future network conditions and automatically reconfigures network devices to prevent issues.

Answer

ML models in network operations are trained exclusively on labeled datasets to detect known attack signatures.

Answer

Rule-based systems are preferred over ML for anomaly detection because they can adapt to new, unknown patterns without manual updates.

Question 10

A Layer 2 switch port connected to an end host should move to forwarding quickly but also shut down if a BPDU is received. Which pair of features best supports that design?

Accepted Answer

PortFast and BPDU Guard. PortFast and BPDU Guard are the right pair. In plain language, PortFast makes an edge port usable quickly for a real end device, while BPDU Guard protects that same port by shutting it down if spanning-tree control traffic appears unexpectedly.

This is a classic access-layer design. PortFast improves usability, and BPDU Guard improves safety. The best answer combines both functions.

Answer

Root Guard and UDLD

Answer

Loop Guard and native VLAN

Answer

Port security and EtherChannel

Question 11

An API response returns a list of interface objects in JSON. Which structure most likely represents that list?

Accepted Answer

An array containing multiple interface objects. In JSON, a list is most naturally represented as an array. In plain language, when an API needs to return several interfaces, routes, VLANs, or similar repeated items, it usually places them inside square brackets as an ordered collection. Each item inside that array might itself be an object containing keys such as name, status, or IP address.

CCNA automation questions usually test whether you recognize that square brackets signal a list. If the response contains many similar interface records, the best structure is the one that looks like a JSON array of interface objects rather than a single scalar value.

Answer

A single integer with the value 1

Answer

A native VLAN field

Answer

An STP root bridge ID

Question 12

Why is the combination of strong authentication and centralized logging better than either control by itself?

Accepted Answer

Authentication improves prevention, while centralized logging improves visibility and investigation.. The combination is better because strong authentication helps prevent unauthorized access, while centralized logging helps detect, review, and investigate what happened across the environment. In practical terms, one control is stronger on prevention, and the other is stronger on visibility and accountability. Together they provide broader protection than either one alone.

This reflects a real security principle: mature security depends on layers of control, not one mechanism trying to do every job.

Answer

They are redundant because both perform exactly the same task.

Answer

Centralized logging makes authentication unnecessary.

Answer

Strong authentication removes the need for any event records.

Question 13

Exhibit: A script sends an HTTP GET request to a controller API endpoint. What is the usual purpose of the GET method?

Accepted Answer

Retrieve information from the resource. In REST-style APIs, GET is normally used to retrieve data from a resource. It is not the standard method for creating or replacing resources.

Answer

Create a brand-new resource

Answer

Replace the entire resource configuration

Answer

Delete the resource

Question 14

A support engineer is explaining why a host uses ARP before sending a frame on an Ethernet LAN. Which two statements are correct?

Accepted Answer

ARP resolves an IPv4 address to a MAC address. On Ethernet, the sender needs a destination MAC address. For remote destinations, that usually means ARPing for the default gateway's MAC.

Answer

ARP is used to discover the remote router's OSPF router ID

Answer

ARP replaces DNS for hostname resolution

Question 15

A network troubleshooter is using Cisco IOS-XE's embedded packet capture feature to capture traffic on an interface and then analyze it in Wireshark to isolate a Layer 2 or Layer 3 fault. Which of the following sequences represents the correct order of steps?

Accepted Answer

Define the capture point with interface and optional filter, start the capture, stop the capture, export the capture file, then analyze in Wireshark.. The correct workflow is to first define the capture point (interface and any filters), then start the capture, stop it when sufficient data is collected, export the captured packets to a file, and finally open that file in Wireshark for analysis. Starting the capture before defining the point, exporting before stopping, or defining the point after stopping all result in an invalid or incomplete capture process.

Answer

Start the capture, define the capture point with interface and filter, stop the capture, export the capture file, then analyze in Wireshark.

Answer

Define the capture point, start the capture, export the capture file, stop the capture, then analyze in Wireshark.

Answer

Start the capture, stop the capture, define the capture point, export the capture file, then analyze in Wireshark.

Question 16

A host uses address 192.168.5.126/25. Which address is the broadcast address for its subnet?

Accepted Answer

192.168.5.127. A /25 divides the /24 into two halves: 0–127 and 128–255. In plain language, the host address 192.168.5.126 is in the lower half, which runs from .0 through .127. The last address in that block is the broadcast address, so the broadcast is 192.168.5.127.

This is a classic subnetting question because it checks whether you can identify the correct block and then select the last address in that block as the broadcast address.

Answer

192.168.5.63

Answer

192.168.5.128

Answer

192.168.5.255

Question 17

You are connected to R1. The network administrator has partially configured IPv4 and IPv6 on the interfaces. However, PC1 (connected to R1's G0/1) cannot reach PC2 (connected to R2's G0/1). Configure R1 and R2 so that PC1 can ping PC2. Fix any addressing errors. Use IPv4 subnet 192.0.2.0/30 for the link between R1 and R2, and 198.51.100.0/24 for the PC LANs. For IPv6, use 2001:db8:1::/64 on R1's G0/1 and 2001:db8:2::/64 on R2's G0/1, with R1's G0/1 using EUI-64 and R2's G0/1 using a static address 2001:db8:2::1/64.

Accepted Answer

On R1, change the subnet mask on G0/0 from /24 to /30. On R1 G0/1, issue 'ipv6 address 2001:db8:1::/64 eui-64' and 'no shutdown'. Enable 'ipv6 unicast-routing' globally on both routers.. The issue is a subnet mask mismatch on the link between R1 and R2: R1 uses /24 (255.255.255.0) while R2 uses /30 (255.255.255.252). This prevents R1 from having a route to R2's LAN. Fix R1's G0/0 mask to /30. Additionally, R1's G0/1 IPv6 EUI-64 command is missing the interface identifier; the correct command is 'ipv6 address 2001:db8:1::/64 eui-64' but the interface must be enabled with 'no shutdown'. Also ensure IPv6 unicast-routing is enabled. The PCs have correct gateways.

Answer

On R1, change the subnet mask on G0/0 from /24 to /30. On R1 G0/1, issue 'ipv6 address 2001:db8:1::/64 eui-64' and 'no shutdown'. No need to enable IPv6 unicast-routing because it is on by default.

Answer

On R1, change the subnet mask on G0/0 from /24 to /30. On R1 G0/1, issue 'ipv6 address 2001:db8:1::/64' (without eui-64) and 'no shutdown'. Enable 'ipv6 unicast-routing' globally on both routers.

Answer

On R1, change the subnet mask on G0/0 from /24 to /30. On R1 G0/1, issue 'ipv6 address 2001:db8:1::/64 eui-64' and 'no shutdown'. Enable 'ipv6 unicast-routing' globally on both routers. Also, change the default gateway on PC1 to 2001:db8:1::1.

Question 18

You are troubleshooting a PC (PC-A) connected to switch SW1, which is connected to router R1. PC-A has an APIPA address (169.254.23.45) and cannot reach the internet (203.0.113.1). You confirm that R1 has a correctly configured DHCP pool for the 192.168.10.0/24 subnet, but the DHCP service is not enabled. The network uses VLAN 10 with subnet 192.168.10.0/24. Verify and correct the configuration on PC-A, SW1, and R1 to restore full connectivity.

Accepted Answer

Enable the DHCP service on R1 with the 'service dhcp' command.. The APIPA address (169.254.x.x) indicates that PC-A failed to obtain a DHCP lease. The correct solution is to enable the DHCP service on R1 with 'service dhcp', which is not running despite the configured pool. Option B is incorrect because setting a default gateway on PC-A with a static IP would still require a valid address in the subnet; the APIPA address cannot communicate with 192.168.10.1. Option C is wrong because the PC-A interface on SW1 is correctly assigned to VLAN 10. Option D is unnecessary since R1 is directly connected to the same subnet, so 'ip helper-address' is only used to forward DHCP broadcasts across router boundaries.

Answer

Configure a default gateway on PC-A with the IP address 192.168.10.1.

Answer

Change the VLAN on SW1's interface connected to PC-A from VLAN 10 to VLAN 1.

Answer

Add the 'ip helper-address' command on R1's interface connected to SW1.

Question 19

Which two features commonly strengthen access-switch security for user-facing ports? (Choose two.)

Accepted Answer

Port security. Port security can limit learned MAC addresses, and BPDU Guard can shut down an edge port that unexpectedly receives BPDUs.

Answer

Administrative distance

Answer

Route summarization

Question 20

You are connected to a multilayer switch MLS1 via the console. Configure MLS1 so that IP phones connected to interface GigabitEthernet0/1 receive power via PoE, use VLAN 10 for data traffic, and use VLAN 20 for voice traffic, while the access port for an AP on GigabitEthernet0/2 should be placed in VLAN 30 and have PoE disabled. Verify your configuration using appropriate show commands.

Accepted Answer

interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 power inline auto
!
interface GigabitEthernet0/2
 switchport mode access
 switchport access vlan 30
 power inline never. For the IP phone port (G0/1), you need to enable PoE (power inline auto) and configure the voice VLAN (switchport voice vlan 20) so that the phone uses VLAN 20 for voice and the access VLAN 10 for data. For the AP port (G0/2), you must change the access VLAN to 30 and disable PoE (power inline never) to prevent powering the AP through the switch. Verify with 'show interfaces switchport' to confirm voice VLAN and access VLAN settings, and 'show power inline' to check PoE status.

Answer

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 power inline auto
!
interface GigabitEthernet0/2
 switchport mode access
 switchport access vlan 30
 power inline never

Answer

interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 20
 switchport voice vlan 10
 power inline auto
!
interface GigabitEthernet0/2
 switchport mode access
 switchport access vlan 30
 power inline never

Answer

interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 power inline never
!
interface GigabitEthernet0/2
 switchport mode access
 switchport access vlan 30
 power inline auto