CCNA Practice Test 26 — 15 Questions

Question 1

Select the options that correctly pair the security principle or control with its meaning.

Accepted Answer

Confidentiality ensures that data is accessible only to authorized users.. Confidentiality ensures data is accessible only to authorized users; integrity ensures data accuracy and trustworthiness (not availability); non-repudiation ensures accountability by preventing denial of actions; authorization grants permissions (not identity verification, which is authentication). Option B is wrong because integrity is about data correctness, not availability. Option D is wrong because authorization determines permissions, while authentication verifies identity.

Answer

Integrity ensures that data is always available when needed.

Answer

Authorization verifies the identity of a user or device.

Question 2

Why is a northbound API generally more useful to orchestration software than a human-readable CLI screen?

Accepted Answer

Because the API provides a structured interface intended for software interaction.. A northbound API is more useful because it is designed for structured software interaction. In practical terms, orchestration systems need predictable data and predictable request methods. Human-readable CLI output is optimized for people, not for stable machine parsing. APIs provide the cleaner contract between the controller and the automation platform.

This is a core programmability idea. Human-readable output is useful for operators, but structured APIs are better for software systems.

Answer

Because CLI output cannot be read by humans.

Answer

Because APIs remove the need for authentication.

Answer

Because orchestration software cannot use HTTPS.

Question 3

PCs in VLAN 30 on SwitchA cannot reach servers in VLAN 30 on SwitchB. All other VLANs work across the trunk. What is the most likely cause?

Accepted Answer

VLAN 30 is not allowed on the trunk from SwitchA.. The trunk is up and carrying multiple VLANs, but VLAN 30 is missing from the allowed list on one side. Since SwitchA and SwitchB both need to permit VLAN 30 on the trunk, if SwitchA's allowed VLAN list does not include VLAN 30, traffic for that VLAN cannot cross. Native VLAN mismatch or ISL vs 802.1Q issues would affect all VLANs, not just VLAN 30. Thus, the most likely cause is that VLAN 30 is not allowed on the trunk from SwitchA.

Answer

The native VLAN is mismatched between the switches.

Answer

VLAN 30 should be configured as the native VLAN on both ends.

Answer

SwitchB must use ISL instead of 802.1Q.

Question 4

Drag and drop the following steps into the correct order to configure and verify OSPFv3 neighbor adjacency using link-local addresses in area 0.

Accepted Answer

Enable IPv6 unicast routing with the 'ipv6 unicast-routing' global command.. The correct order enables IPv6 unicast routing globally, creates the OSPFv3 process, enters interface configuration, assigns the interface to the OSPFv3 process in area 0 (which activates OSPFv3 on the link), and finally verifies the neighbor relationship. IPv6 unicast routing must be enabled first because OSPFv3 requires IPv6 packet forwarding. The router process must exist before an interface can be associated with it. Assigning the interface to area 0 triggers Hello packet exchange over link-local addresses. The show command confirms the adjacency formed.

Question 5

An engineer is deploying a new Cisco Catalyst 9300 switch in a campus wiring closet. The uplink to the distribution switch uses a 1000BASE-LX SFP module. After connecting the fiber, the interface shows 'up/up' but the engineer notices that the 'input errors' counter is incrementing rapidly, with many CRC errors, runts, and giants being reported. What is the most likely cause of these input errors?

Accepted Answer

Check the fiber distance and ensure it is within the 5 km limit for 1000BASE-LX; if over, use a single-mode fiber extender.. The 1000BASE-LX standard uses long-wavelength laser optics (1300 nm) over single-mode fiber with a maximum distance of 5 km. Exceeding this limit causes signal attenuation and dispersion, generating bit errors that corrupt the frame check sequence (FCS). Cisco IOS counts these as CRC errors. Runts (frames shorter than 64 bytes) and giants (frames longer than 1518 bytes) also appear because the damaged frames are misinterpreted. Option B correctly identifies the distance limit as the root cause and recommends verifying it or using a fiber extender. Options A and D propose incorrect media, and option C would break the link since 1000BASE-LX operates at fixed 1000/full speed.

Answer

Replace the SFP with a 1000BASE-SX module.

Answer

Configure the interface with 'speed 100' and 'duplex full' to match the SFP capabilities.

Answer

Replace the fiber patch cable with a CAT6a copper cable and use a 1000BASE-T SFP.

Question 6

Match each access-control term to its most accurate meaning.

Accepted Answer

Authentication: The process of verifying the identity of a user or device.. AAA is a framework for controlling access. Authentication verifies identity, authorization grants permissions, and accounting logs activities. Identification is the initial claim, and auditing is the review of logs.

Answer

Authorization: The process of verifying the identity of a user or device.

Answer

Accounting: The process of granting or denying access to network resources.

Answer

Identification: The process of logging and monitoring user activities.

Question 7

Why is RIP rarely chosen for large modern enterprise networks?

Accepted Answer

It scales poorly due to slow convergence and hop-count limitations. RIP is simple but has important scalability limits, including a maximum metric of 15 and relatively slow convergence compared with more modern protocols such as OSPF and EIGRP.

Answer

It does not support IPv4

Answer

It cannot run on routers and only works on switches

Answer

It requires link-state advertisements

Question 8

R1 has routes to 172.16.10.0/24 from multiple sources. Which route will be installed?

Accepted Answer

The EIGRP internal route. Routers compare route source trust first using administrative distance. EIGRP internal routes have an AD of 90, which is lower than OSPF (110), RIP (120), and a static route with AD 95. Therefore, the EIGRP internal route is installed, regardless of metrics.

Answer

The OSPF route with metric 20

Answer

The RIP route because hop count is lowest

Answer

The static route with administrative distance 95

Question 9

A network administrator recently configured BPDU Guard on all access ports of a switch to protect against rogue switches. After the change, users in VLAN 10 report intermittent connectivity issues and frequent link flaps. The administrator checks the switch and notices that several ports are in an err-disabled state. What is the most likely cause of the problem?

Accepted Answer

BPDU Guard is enabled on access ports that are receiving BPDUs, causing the ports to go into err-disabled state.. BPDU Guard is configured to protect against rogue switches by placing a port into an err-disabled state upon receiving a BPDU. In this scenario, BPDU Guard is enabled on access ports that are receiving BPDUs (possibly from a rogue switch or misconfiguration), causing the ports to err-disable and flap. PortFast is not required for BPDU Guard to function; the issue is that BPDUs are being received on ports that are not expected to receive them. The intermittent connectivity occurs as ports cycle into err-disabled and are re-enabled.

Answer

Root Guard is preventing the port from becoming a root port.

Answer

Loop Guard has detected a unidirectional link and placed the port into err-disabled state.

Answer

BPDU Guard is globally enabled but not configured on the interface, so the port is err-disabled due to a BPDU received.

Question 10

A network administrator has recently upgraded the corporate wireless LAN to support 802.11ax (Wi-Fi 6) and is using WPA3-Enterprise with a central WLC. Several users with new 802.11ax laptops report that they can connect to the SSID, but after a few minutes their connections drop and then re-establish, while legacy 802.11ac clients work without issues. Which action will resolve this problem?

Accepted Answer

Enable Protected Management Frames (PMF) as Required on the WLAN.. WPA3-Enterprise requires Protected Management Frames (PMF) to be set to 'Required' on the WLC. When PMF is not enabled or set to 'Optional', 802.11ax clients using WPA3 may experience intermittent disconnects because management frame protection is mandatory for WPA3 operation. Legacy 802.11ac clients using WPA2 do not require PMF, so they remain unaffected.

Answer

Downgrade the WLAN security to WPA2-Enterprise for backward compatibility.

Answer

Disable OFDMA and MU-MIMO on the WLC for the affected APs.

Answer

Adjust the 5 GHz channel width from 80 MHz to 40 MHz to avoid interference.

Question 11

A network technician is troubleshooting connectivity between two directly connected Cisco switches. Hosts on VLAN 10 connected to SwitchA cannot ping the default gateway on SwitchB. The interface on SwitchB shows up/up, but the interface on SwitchA shows up/down. The technician examines the interface configuration and status on SwitchA. What is the most likely cause of this issue?

Accepted Answer

Configure both interfaces with the same duplex and speed settings, either both auto or both manually set to full-duplex and 1000 Mbps.. The interface on SwitchA shows up/down, meaning Layer 1 is active but the line protocol is down. This is commonly caused by a speed mismatch between the two ends. A duplex mismatch, in contrast, typically results in both interfaces showing up/up with CRC errors. Therefore, the most likely cause is that the speed settings differ—for example, one interface is set to auto-negotiate while the other is hard-coded to a specific speed. Configuring both interfaces with identical speed and duplex settings, either both auto or both manually configured, resolves the issue.

Answer

Replace the Ethernet cable because it is faulty.

Answer

Issue the 'shutdown' and 'no shutdown' commands on the interface to recover from err-disabled state.

Answer

Check the VLAN configuration on SwitchA because the interface is administratively down.

Question 12

A network technician is troubleshooting a connectivity issue for a PC connected to switch port Gi1/0/12. The PC can ping its default gateway (192.168.10.1) but cannot ping a server at 192.168.20.10. The switch is configured with VLAN 10 for the access port and is connected to a router-on-a-stick. The technician runs 'show vlan brief' and 'show interfaces trunk' on the switch. What is the most likely cause of the problem?

Accepted Answer

The router is missing a subinterface for VLAN 20.. The PC can ping its default gateway (192.168.10.1) but not the server at 192.168.20.10, indicating Layer 3 routing is failing between VLANs. Since the switch is configured with VLAN 10 for the access port and uses a router-on-a-stick, the router must have a subinterface for VLAN 20 to route traffic to the server's subnet. The absence of a subinterface for VLAN 20 prevents the router from forwarding packets from VLAN 10 to VLAN 20, making option B correct.

Answer

The trunk port Gi1/0/24 is not in trunking mode.

Answer

The switch port Gi1/0/12 is not assigned to VLAN 10.

Answer

The PC has a duplicate IP address with the server.

Question 13

A network administrator notices that the NTP server on Router R1 is not synchronizing with the upstream NTP server at 192.0.2.1. The router is configured as an NTP client, but show ntp status indicates the clock is unsynchronized and the stratum is 16. There is no firewall between R1 and 192.0.2.1. What is the most likely cause of this issue?

Accepted Answer

Router R1 does not have a route to reach 192.0.2.1.. The most likely cause is that Router R1 lacks a route to the upstream NTP server at 192.0.2.1. Without a valid IP route, NTP packets cannot reach the server, so the client remains unsynchronized with stratum 16. The other options are incorrect: A is not required for client operation, C is irrelevant because NTP version negotiation works across versions, and D is ruled out by the absence of a firewall.

Answer

The NTP server at 192.0.2.1 is not configured as a peer on R1.

Answer

The NTP server at 192.0.2.1 is not using NTP version 4.

Answer

The NTP server at 192.0.2.1 has a firewall blocking NTP traffic.

Question 14

R1 and R2 are directly connected. Both are configured in OSPF area 0, and they can successfully ping each other. However, OSPF neighbor adjacency fails. R1's interface is configured with `ip ospf authentication message-digest` and a valid key, while R2's interface has no OSPF authentication configured. What is the most likely cause?

Accepted Answer

The OSPF authentication settings do not match.. The most likely cause is an OSPF authentication mismatch. Although the routers have IP connectivity and are in the same OSPF area, OSPF adjacency requires matching security parameters. R1 uses message-digest authentication whereas R2 has none configured, preventing neighbor formation. The other options are incorrect: the stem confirms they are in the same area (A), OSPF does not require identical hostnames (C), and successful pings prove the subnet mask does not block multicast traffic (D).

Answer

The routers are in different OSPF areas.

Answer

The routers need identical hostnames before adjacency can form.

Answer

The subnet mask prevents OSPF multicast traffic.

Question 15

Which THREE statements accurately describe the role of AI agents in closed-loop remediation workflows for network automation?

Accepted Answer

AI agents can autonomously analyze network telemetry and decide on remediation actions.. B is correct because AI agents in closed-loop remediation workflows autonomously analyze network telemetry (e.g., gRPC, NETCONF) and decide on remediation actions without manual intervention, enabling rapid response. D is correct because tool-calling allows the AI agent to invoke external automation tools like Ansible or Python scripts to execute the chosen remediation steps. E is correct because a key part of the closed-loop is that the AI agent monitors the network after action to confirm the issue is resolved and adjusts if needed, ensuring the loop is closed. A is wrong because closed-loop automation implies autonomous execution based on predefined policies, not requiring manual approval for every action. C is wrong because AI agents use dynamic telemetry and learned patterns, not just static baseline configurations, to detect anomalies. F is wrong because AI agents augment, not eliminate, human oversight; human intervention remains for policy exceptions and oversight.

Answer

AI agents require manual approval before executing any remediation action in a closed-loop workflow.

Answer

AI agents rely solely on static baseline configurations to detect anomalies.

Answer

AI agents eliminate the need for human oversight in network operations.