CCNA Practice Test 26 — 15 Questions

Question 1

You are managing a Cisco WLC (192.168.1.10) via its web UI. The wireless network 'CorpSecure' has been configured but clients cannot associate. Some report 'wrong password' errors; others see the SSID but fail to connect. Additionally, management access to the WLC web UI is intermittent. Identify and resolve the issues so that wireless clients can successfully associate with 'CorpSecure' using WPA3-Personal and the WLC web UI is reliably accessible from the management VLAN (VLAN 10).

Accepted Answer

Configure the SSID with WPA3-Personal; verify management interface is on VLAN 10 with correct gateway.. The primary issue is a security mismatch: the SSID is set to WPA2-PSK while clients expect WPA3, causing 'wrong password' errors. Since clients can see the SSID, broadcast is already enabled; the secondary connection failures may be due to incompatible devices, but the correct fix is to change the security to WPA3-Personal (AES). Additionally, verify that the management interface is on VLAN 10 with the correct gateway to ensure reliable WLC web UI access.

Answer

Change the SSID security to WPA2-PSK and disable SSID broadcast; reset the WLC to factory defaults.

Answer

Update the WLC firmware to the latest version and change the management VLAN to VLAN 1.

Answer

Reconfigure the SSID with WPA3-Enterprise and enable SSID broadcast; set the management interface to use DHCP.

Question 2

A user types www.example.com into a browser. Which service is used first to resolve that name into an IP address?

Accepted Answer

DNS. DNS maps hostnames to IP addresses, which is the first step when a user enters a URL. DHCP assigns IP addresses, NTP synchronizes time, and Syslog handles logging—none of these services resolve domain names to IP addresses. The web session itself uses HTTP or HTTPS later, but name resolution happens first.

Answer

DHCP

Answer

NTP

Answer

Syslog

Question 3

Exhibit: An administrator wants inside hosts in 192.168.10.0/24 to reach the internet using one public IP address on the edge router. Which feature is being used?

Accepted Answer

PAT overload. When many inside private addresses share one public address and are differentiated by Layer 4 port numbers, the router is using PAT. Cisco documentation often calls this NAT overload.

Answer

Static NAT

Answer

Policy-based routing

Answer

Port security

Question 4

You are connected to R1. The network administrator has partially configured IPv4 and IPv6 on the interfaces. However, PC1 (connected to R1's G0/1) cannot reach PC2 (connected to R2's G0/1). Configure R1 and R2 so that PC1 can ping PC2. Fix any addressing errors. Use IPv4 subnet 192.0.2.0/30 for the link between R1 and R2, and 198.51.100.0/24 for the PC LANs. For IPv6, use 2001:db8:1::/64 on R1's G0/1 and 2001:db8:2::/64 on R2's G0/1, with R1's G0/1 using EUI-64 and R2's G0/1 using a static address 2001:db8:2::1/64.

Accepted Answer

On R1, change the subnet mask on G0/0 from /24 to /30. On R1 G0/1, issue 'ipv6 address 2001:db8:1::/64 eui-64' and 'no shutdown'. Enable 'ipv6 unicast-routing' globally on both routers.. The issue is a subnet mask mismatch on the link between R1 and R2: R1 uses /24 (255.255.255.0) while R2 uses /30 (255.255.255.252). This prevents R1 from having a route to R2's LAN. Fix R1's G0/0 mask to /30. Additionally, R1's G0/1 IPv6 EUI-64 command is missing the interface identifier; the correct command is 'ipv6 address 2001:db8:1::/64 eui-64' but the interface must be enabled with 'no shutdown'. Also ensure IPv6 unicast-routing is enabled. The PCs have correct gateways.

Answer

On R1, change the subnet mask on G0/0 from /24 to /30. On R1 G0/1, issue 'ipv6 address 2001:db8:1::/64 eui-64' and 'no shutdown'. No need to enable IPv6 unicast-routing because it is on by default.

Answer

On R1, change the subnet mask on G0/0 from /24 to /30. On R1 G0/1, issue 'ipv6 address 2001:db8:1::/64' (without eui-64) and 'no shutdown'. Enable 'ipv6 unicast-routing' globally on both routers.

Answer

On R1, change the subnet mask on G0/0 from /24 to /30. On R1 G0/1, issue 'ipv6 address 2001:db8:1::/64 eui-64' and 'no shutdown'. Enable 'ipv6 unicast-routing' globally on both routers. Also, change the default gateway on PC1 to 2001:db8:1::1.

Question 5

An automation script needs to send a bearer token when calling a controller REST API over HTTPS. Where is that token most commonly included?

Accepted Answer

In the HTTP Authorization header. Bearer tokens are typically sent in the HTTP Authorization header. Query parameters or request bodies may carry credentials in some custom APIs, but the normal REST pattern is an Authorization header such as 'Authorization: Bearer <token>'.

Answer

In the Ethernet trailer

Answer

In the DNS response section

Answer

In the TCP checksum field

Question 6

Which TWO statements accurately describe the use of ipconfig, ping, and tracert when troubleshooting a client that cannot reach a remote server?

Accepted Answer

A successful ping to 127.0.0.1 confirms that the TCP/IP stack on the local host is functional.. Option A is correct because pinging the loopback address 127.0.0.1 tests the local TCP/IP stack without sending any frames onto the network. A successful reply confirms that the IP protocol, routing table, and network interface driver are functioning correctly on the local host. This is a foundational step in troubleshooting, as it isolates the problem to the local machine if the ping fails.

Answer

If ping to the default gateway fails, the issue is certainly caused by a faulty Ethernet cable.

Answer

A tracert that shows 'Request timed out' for the very first hop proves the local default gateway router is down or unreachable.

Answer

Running ipconfig /release followed by ipconfig /renew will always restore connectivity if the Ethernet cable is unplugged and re-plugged.

Question 7

You are connected to R1. The link between R1 and R2 is experiencing intermittent connectivity and poor performance. Review the provided show interface output to identify the root cause(s) of the issue, then apply the necessary configuration changes to resolve the problem and restore full connectivity.

Output from R1:
```
GigabitEthernet0/0 is up, line protocol is up (connected)
  Hardware is Gigabit Ethernet, address is aaaa.bbbb.cccc (bia aaaa.bbbb.cccc)
  Internet address is 192.168.1.1/30
  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Half-duplex, 100Mb/s, link type is auto, media type is RJ45
  output flow-control is unsupported, input flow-control is unsupported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input 00:00:01, output 00:00:01, output hang never
  Last clearing of "show interface" counters 00:01:23
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     150 packets input, 1500 bytes, 0 no buffer
     Received 0 broadcasts (0 multicasts)
     0 runts, 0 giants, 0 throttles
     150 input errors, 150 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 0 multicast, 0 pause input
     0 input packets with dribble condition detected
     200 packets output, 2000 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier
     0 output buffer failures, 0 output buffers swapped out
```

Accepted Answer

Configure the interface with 'speed 1000' and 'duplex full' to match R2's settings, then clear counters.. The show interface output reveals that R1's GigabitEthernet0/0 is operating at half-duplex, 100 Mb/s, yet it is accumulating a high number of CRC errors (150 in 1 minute 23 seconds). This indicates a speed/duplex mismatch with R2, which is likely set to full-duplex at 1000 Mb/s. To resolve, you must manually configure R1 to match R2's proper settings by issuing the 'speed 1000' and 'duplex full' commands, then clearing the counters to start fresh monitoring. The other options are incorrect because they do not address the mismatch: replacing the cable would not fix a configuration issue; disabling autonegotiation alone may not fix the mismatch if the hard-coded values are still wrong; and increasing the MTU does not affect CRC errors caused by duplex mismatch.

Answer

Replace the faulty cable between R1 and R2 to eliminate CRC errors caused by physical layer issues.

Answer

Disable autonegotiation on the interface with 'no negotiation auto' to force the link to use the configured speed and duplex.

Answer

Increase the interface MTU to reduce fragmentation and improve performance on the link.

Question 8

Drag and drop the following steps into the correct order to select and implement a network automation solution using the appropriate tool based on the use cases and differences between Puppet, Chef, Ansible, and Python.

Accepted Answer

Define the network automation goal and the type of configuration changes required.. The correct order follows a systematic approach: First, define the specific network automation goal to understand the scope and constraints. Next, evaluate whether a persistent, agent-based configuration enforcement approach (Puppet/Chef) or an agentless, orchestration-driven approach (Ansible) is required. Then consider the flexibility of a scripting language like Python for custom or one-off tasks. After selecting the tool, write the automation logic (playbook, manifest, or script). Test it in a controlled environment to avoid production issues, and finally deploy and verify the automation to ensure it meets the intended outcome.

Question 9

Which TWO statements about SFP transceivers and interface diagnostics are true?

Accepted Answer

SFP modules are hot-swappable, meaning they can be inserted or removed without powering off the switch.. Option A is correct because SFP (Small Form-factor Pluggable) modules are designed to be hot-swappable, allowing insertion or removal without powering down the switch. This capability is essential for maintaining network uptime during maintenance or upgrades, as the switch can dynamically detect and configure the module without a reboot.

Answer

Copper 1000BASE-T SFP modules can transmit data up to 10 km over Category 5e cabling.

Answer

Multi-mode fiber uses a smaller core diameter, about 9 microns, compared to single-mode fiber.

Answer

Any SFP transceiver, regardless of vendor, will operate in a Cisco switch by default.

Question 10

In a REST-style API, which method is most commonly associated with retrieving information?

Accepted Answer

GET. GET is the method most commonly associated with retrieving information. In practical terms, when a client wants to read state, inventory, or configuration details from an API endpoint without modifying the resource, GET is the expected choice.

This is a core automation vocabulary question and works well as an easier confidence-building item.

Answer

DELETE

Answer

POST

Answer

PUT

Question 11

You are troubleshooting a wired client connectivity issue. A user on VLAN 10 (subnet 192.168.10.0/24) reports that they cannot reach the internet. The client PC is connected to switch SW1, which is connected to router R1. You have console access to the client PC and R1. Identify and fix the misconfiguration so that the client can ping the internet host 203.0.113.1.

Accepted Answer

Configure R1 as a DHCP server for VLAN 10, excluding the router's IP, and add a default route to 203.0.113.1.. The client PC has an APIPA address (169.254.x.x) because it failed to obtain an IP via DHCP. The DHCP server is likely the router R1, but the router is not configured as a DHCP server. To fix this, configure R1 as a DHCP server for VLAN 10, excluding the router's own IP from the pool, and set the default gateway and DNS. Then the client can renew its IP and reach the internet. Additionally, the router lacks a default route to the internet; add a static default route pointing to the next-hop (203.0.113.1).

Answer

Change the client's IP address to a static IP in the 192.168.10.0/24 subnet and set the default gateway to 203.0.113.1.

Answer

Enable DHCP snooping on SW1 and configure the client port as trusted.

Answer

Configure a static route on the client PC to 203.0.113.1 via the router's IP.

Question 12

Exhibit: A script sends an HTTP GET request to a controller API endpoint. What is the usual purpose of the GET method?

Accepted Answer

Retrieve information from the resource. In REST-style APIs, GET is normally used to retrieve data from a resource. It is not the standard method for creating or replacing resources.

Answer

Create a brand-new resource

Answer

Replace the entire resource configuration

Answer

Delete the resource

Question 13

After a switch replacement, users in VLAN 30 cannot reach devices in other VLANs. The replacement switch has a trunk link to the distribution switch that shows as up/up. What is the most likely cause?

Accepted Answer

VLAN 30 is not permitted on the trunk link. The trunk is up, but VLAN 30 is not allowed on it. Traffic from that VLAN never crosses the uplink, so inter-VLAN reachability fails for users in VLAN 30 even though the local access ports may still look fine.

Answer

The native VLAN must be changed to 30

Answer

The uplink should be configured as an access port

Answer

STP must be disabled on VLAN 30

Question 14

You are troubleshooting connectivity from R1 to the 203.0.113.0/24 network. R1 is a multilayer switch running routed ports. Currently, R1 has two paths to reach that network: one via R2 (192.0.2.2) and one via R3 (198.51.100.2). The path via R2 is preferred, but after a link failure between R1 and R2, traffic should automatically fail over to the R3 path. However, after the failure, traffic is still being sent to R2. Examine the routing table and configuration, then fix the issue so that the floating static route takes over correctly when the primary route is lost.

Accepted Answer

Replace the primary static route with one that uses an exit interface: ip route 203.0.113.0 255.255.255.0 GigabitEthernet1/0/1 192.0.2.2. The issue is that the primary static route to 203.0.113.0/24 via 192.0.2.2 has an administrative distance of 1 (default), and the backup floating static route via 198.51.100.2 has an AD of 200. When the next-hop interface (Gi1/0/1) goes down, the route via 192.0.2.2 should be removed from the routing table because its next-hop is unreachable. However, the show output indicates that the route remains, which suggests that the static route is configured with the 'permanent' keyword or that the next-hop is still considered reachable via some other mechanism (e.g., a recursive lookup to a still-active route). In this case, the most common fix is to add the 'track' option or to remove the static route and re-add it without the 'permanent' keyword, or to ensure that the static route uses an interface instead of just an IP address. The correct solution is to replace the primary static route with one that uses an exit interface, so that the route is automatically removed when the interface goes down. For example: 'ip route 203.0.113.0 255.255.255.0 GigabitEthernet1/0/1 192.0.2.2'. This causes the route to be directly dependent on the interface state.

Answer

Increase the administrative distance of the floating static route to 255

Answer

Add the permanent keyword to the floating static route

Answer

Change the administrative distance of the primary static route to 200 and the floating static route to 1

Question 15

Drag and drop the following steps into the correct order to retrieve network device information using a REST API call that requires authentication and returns JSON data.

Accepted Answer

Determine the REST API endpoint and the appropriate HTTP method (e.g., GET for reading data).. The correct sequence follows the standard REST API client workflow. First, you must identify the API endpoint and the HTTP method corresponding to the desired CRUD operation (READ → GET). Then, you must provide valid authentication credentials to gain access. Next, setting the Accept header ensures the response is in the required data format (JSON). Only after preparing the request can you send it. Once the response is received, you verify the status code to confirm success before parsing the data. Skipping any step or reordering them would break the logic (e.g., you cannot parse data before verifying the response was successful).