CCNA Practice Test 27 — 15 Questions

Question 1

Match each Layer 2 protection feature to its most accurate purpose.

Accepted Answer

Storm Control: Limits excessive broadcast, multicast, or unicast traffic to prevent network storms.. Storm Control limits excessive traffic. Port Security limits MAC addresses. DHCP Snooping blocks unauthorized DHCP servers. DAI validates ARP packets. IP Source Guard filters IP traffic based on DHCP snooping. 802.1X authenticates devices before granting access.

Answer

Storm Control: Authenticates devices before granting network access.

Answer

Storm Control: Validates ARP packets to prevent ARP spoofing attacks.

Answer

Storm Control: Filters IP traffic based on DHCP snooping bindings.

Question 2

Which TWO statements accurately describe the encapsulation process and PDU naming across the OSI and TCP/IP models?

Accepted Answer

In the OSI model, the Network layer encapsulates data into packets, while in the TCP/IP model the Internet layer performs the same function.. The OSI Network layer and the TCP/IP Internet layer both encapsulate transport layer segments or datagrams into packets by adding a Layer 3 header (e.g., IP header). This is the fundamental encapsulation step where logical addressing is applied, and the resulting PDU is called a packet in both models. The function is identical despite the different layer names.

Answer

At the Transport layer, the TCP/IP model uses segments, while the OSI model uses packets.

Answer

Encapsulation adds headers and trailers at each layer, so the PDU size decreases as data moves down the stack.

Answer

The OSI model's Session layer is responsible for end-to-end flow control using TCP segments, while the TCP/IP model combines this into the Application layer.

Question 3

A user connects a small unmanaged switch to an access port, and the port immediately transitions to err-disabled. Which feature most likely caused this behavior?

Accepted Answer

BPDU Guard. BPDU Guard is the correct answer because it is specifically designed to protect access ports configured with PortFast. When an unauthorized switch is connected to such a port, BPDU Guard detects the incoming BPDU and immediately places the port into err-disabled state, preventing potential loops or topology changes. UDLD aggressive detects unidirectional links but does not cause err-disabled due to BPDU reception. Root guard blocks ports that attempt to become the root bridge by placing them in root-inconsistent state (not err-disabled). Loop guard prevents alternate/root ports from becoming designated in the absence of BPDUs, putting the port into loop-inconsistent state, again not err-disabled.

Answer

UDLD aggressive

Answer

Root guard

Answer

Loop guard

Question 4

Why is route summarization often useful at distribution or area boundaries in larger networks?

Accepted Answer

It reduces the number of route advertisements by combining multiple specific prefixes. Route summarization is useful there because it reduces the number of specific prefixes that must be advertised upstream or across boundaries. In plain language, instead of sending many small route entries, the network can often advertise one broader summary that represents them collectively. This helps control routing-table growth and can make the design more scalable and easier to manage.

Summarization does not eliminate the need for routing detail inside the local area, but it can simplify what needs to be shared outward. That is why it is especially valuable at aggregation points such as distribution layers or area boundaries.

Answer

It forces all users into the same VLAN

Answer

It automatically encrypts routing protocols

Answer

It removes the need for IP addressing

Question 5

Match each IPv6 concept to its most accurate description.

Accepted Answer

IPv6 address: 128-bit identifier for network interfaces. These pairings accurately define key IPv6 concepts.

Question 6

A subnet uses the prefix /22. How many usable host addresses are available?

Accepted Answer

1022. A /22 leaves 10 host bits available. In plain language, that means each subnet contains 2^10, or 1024, total addresses. Two of those are reserved for the network and broadcast addresses in normal IPv4 subnetting, leaving 1022 usable host addresses.

This is a common subnet-capacity calculation. The safest method is to calculate the total address count from the number of host bits and then subtract the two reserved addresses. That leads directly to the correct usable-host value.

Answer

254

Answer

510

Answer

2046

Question 7

Match each HTTP method to the most accurate action it commonly represents in REST-style APIs.

Accepted Answer

GET: Retrieve data from a resource. HTTP methods correspond to CRUD operations in REST: GET for read, POST for create, PUT for full update, PATCH for partial update, DELETE for delete, and HEAD for headers only.

Answer

GET: Create a new resource

Answer

GET: Update an existing resource

Answer

GET: Delete a resource

Question 8

Why is disabling unused services on network devices considered a sound security practice?

Accepted Answer

Because it reduces unnecessary attack surface and exposure on the device.. It is considered sound because every enabled service is a potential attack surface or management exposure point. In practical terms, if a service is not needed, leaving it enabled creates unnecessary risk without business value. Reducing what is listening or available on a device helps limit opportunities for misuse or exploitation. Option B is incorrect because disabling unused services does not affect routing protocol convergence; that is a routing protocol function. Option C is wrong because no single security practice can guarantee the device cannot be misconfigured; misconfiguration remains possible through other means. Option D is nonsensical because disabling services does not turn the device into a controller.

Answer

Because it automatically improves routing convergence.

Answer

Because it guarantees the device cannot be misconfigured.

Answer

Because it converts the device into a controller.

Question 9

Which TWO statements correctly describe aspects of interpreting packet capture output for Layer 2/3 troubleshooting using Wireshark or embedded packet capture on IOS-XE?

Accepted Answer

A large number of ARP requests for the same IP address in a packet capture suggests a possible Layer 3 connectivity issue, such as a missing default gateway.. A large number of ARP requests for the same IP address indicates that the device is repeatedly trying to resolve the Layer 3 address to a Layer 2 MAC address, but no device is responding. This often happens when the target IP (e.g., the default gateway) is unreachable or misconfigured, pointing to a Layer 3 connectivity issue. Option D is correct because IOS-XE embedded packet capture supports both ingress and egress capture directions, allowing you to verify whether a router is dropping or modifying packets as they transit. Option A is incorrect: DHCP Discover is broadcast, not unicast, because the client does not yet know the server’s MAC address. Option C is incorrect: a SYN-ACK is part of a successful three-way handshake (SYN, SYN-ACK, ACK) and indicates the server is reachable; if the handshake failed, you would see only SYN packets or RST packets. Option E is incorrect: the TTL value in a captured packet shows the current TTL after decrementing by each hop; the original TTL is not preserved in the packet.

Answer

A DHCP Discover packet in a Wireshark capture shows a unicast destination MAC address to the DHCP server.

Answer

A TCP SYN-ACK packet in a capture indicates that the three-way handshake failed and the destination is unreachable.

Answer

The TTL value in a captured IP packet always shows the original TTL set by the source host.

Question 10

A network administrator is troubleshooting connectivity from a PC (192.168.1.10/24) to a server at 10.0.0.5/24. The PC's default gateway is 192.168.1.1. Router R1 has a directly connected route to 10.0.0.0/24 via interface GigabitEthernet0/1, which is connected to another VLAN. The server is actually located on the 10.0.0.0/16 network, reachable via a static route through 192.168.1.2. What is the most likely cause of the connectivity issue?

Accepted Answer

The directly connected route to 10.0.0.0/24 is the most specific match but is incorrect for the destination.. The router's routing table contains a directly connected route to 10.0.0.0/24, which is the most specific match (longest prefix) for the destination 10.0.0.5. However, if that directly connected subnet is not actually the network where the server resides (e.g., it points to a different interface or VLAN), traffic will be forwarded incorrectly. The router always prefers the most specific prefix, even if another route (like a summary) is administratively preferred or has a lower metric.

Answer

The route to 10.0.0.0/16 has a lower administrative distance than the directly connected route.

Answer

The route to 10.0.0.0/8 has a higher metric, so it is not used.

Answer

The router does not have a default route, so traffic to 10.0.0.5 is dropped.

Question 11

Which TWO statements are true about OSPFv2 neighbor adjacency, network statements, and passive interfaces?

Accepted Answer

Configuring an interface as passive stops OSPF from sending Hello packets out of that interface, but OSPF will still advertise the connected network in its LSAs.. Configuring an interface as passive in OSPFv2 prevents the router from sending Hello packets out of that interface, which stops neighbor discovery and adjacency formation. However, OSPF still includes the connected network of that passive interface in its Type 1 Router LSAs, allowing the network to be advertised to other OSPF routers.

Answer

The network command with a wildcard mask of 0.0.0.0 will enable OSPF on the exact matching interface, but it will also prevent OSPF from forming adjacencies on that interface.

Answer

Using the passive-interface default command makes all OSPF interfaces passive, which means OSPF will not advertise any connected networks.

Answer

The network command with a wildcard mask of 0.0.0.255 area 0 will match any interface whose IP address falls within that /24 subnet, but OSPF will only attempt to form adjacencies on the interface with the highest IP address in that range.

Question 12

A network engineer notices that a new switch, SW3, was connected to port GigabitEthernet0/1 on SW1, but the port immediately went into an err-disabled state. The network uses Rapid PVST+ with BPDU Guard enabled globally on all access ports. The engineer checks the logs and sees 'bpduguard error detected' messages. What is the most likely cause of the err-disabled state?

Accepted Answer

A BPDU was received on port GigabitEthernet0/1, triggering BPDU Guard.. The err-disabled state is caused by BPDU Guard triggering when a BPDU is received on an access port. Option A is incorrect because BPDU Guard is intentionally enabled on access ports to prevent unauthorized switches from joining the network. Option C is wrong because Root Guard prevents a port from becoming the root, not from receiving BPDUs. Option D is wrong because Loop Guard prevents loops on blocked ports in case of unidirectional links, not relevant to BPDU reception.

Answer

The port is configured as an access port, but BPDU Guard should be disabled on all access ports.

Answer

Configure Root Guard on the interface to prevent the err-disabled state.

Answer

Enable Loop Guard on the interface to prevent the err-disabled state.

Question 13

You are troubleshooting connectivity from R1 to the 172.16.20.0/24 network. The network engineer configured a floating static route on R1 as a backup for the OSPF-learned route, but after the primary OSPF route fails, the backup does not take over. Examine the current routing table and partial configuration on R1, then fix the issue so that when the OSPF neighbor goes down, R1 can still reach 172.16.20.0/24 via R3.

Accepted Answer

Change the static route to use an exit interface: ip route 172.16.20.0 255.255.255.0 GigabitEthernet0/1 203.0.113.2. The floating static route was configured with an administrative distance of 130, intended to be higher than OSPF's default AD of 110 so it would only be used as a backup. However, the static route's AD is set as 130 (the command uses the distance option), which is correct. The problem is that OSPF's AD is 110, which is lower, so the static route is not installed while OSPF is up. But when OSPF fails, the static route should appear. The issue is that the static route is pointing to a next-hop (203.0.113.2) that is not directly connected; R1 has no route to 203.0.113.2, causing the static route to be inactive. To fix, you must either change the next-hop to a directly connected interface (e.g., GigabitEthernet0/1) or add a route to reach 203.0.113.2. The simplest solution is to configure the static route with an exit interface: 'ip route 172.16.20.0 255.255.255.0 GigabitEthernet0/1 203.0.113.2'. This ensures the route is valid when the OSPF route disappears.

Answer

Change the administrative distance of the static route to 110

Answer

Remove the OSPF process from R1

Answer

Add a static route to 203.0.113.0/24 via R1's directly connected interface

Question 14

An administrator deploys a new WLAN on a Cisco 9800 WLC using WPA3-Personal (SAE) with AES encryption. A single 802.11ax laptop running Windows 10 fails to connect, displaying an authentication timeout despite entering the correct passphrase. Other clients, including legacy 802.11ac devices, connect without issue.

Accepted Answer

The laptop’s wireless adapter does not support Protected Management Frames, which are mandatory for WPA3-Personal.. WPA3-Personal (SAE) mandates the use of Protected Management Frames (PMF) as defined in IEEE 802.11w. If the laptop's wireless adapter or driver does not support PMF, it cannot complete the SAE handshake, resulting in an authentication timeout. Legacy 802.11ac clients can connect because they are using WPA2, which does not require PMF.

Answer

The WLC’s WLAN is misconfigured for WPA3-Enterprise, and the laptop lacks a supplicant for 802.1X authentication.

Answer

The WLC has disabled 802.11ax OFDMA on the 5 GHz band, preventing the 802.11ax laptop from associating.

Answer

The laptop’s driver is configured for 160 MHz channel width, which is incompatible with the WLC’s channel plan, causing authentication to fail.

Question 15

Drag and drop the following steps into the correct order to configure IPv4 and IPv6 static routes, a default route, and a floating static route with a higher administrative distance, then verify with show ip route and show ipv6 route.

Accepted Answer

1. Enter global configuration mode. 2. Configure IPv4 static routes. 3. Configure IPv6 static routes. 4. Configure default route and floating static route with higher AD. 5. Verify with show ip route and show ipv6 route.. The correct order for configuring static routes as described is: first enter global configuration mode, then configure IPv4 static routes, then IPv6 static routes, then the default route and floating static route with higher AD, and finally verify with show commands. This sequence ensures that specific routes are configured before the default route and that IPv4 routes precede IPv6 routes as implied by the stem. Only option A follows this order; options B, C, and D deviate by placing the default/floating route before specific routes or configuring IPv6 before IPv4.

Answer

1. Enter global configuration mode. 2. Configure default route and floating static route with higher AD. 3. Configure IPv4 static routes. 4. Configure IPv6 static routes. 5. Verify with show ip route and show ipv6 route.

Answer

1. Enter global configuration mode. 2. Configure IPv6 static routes. 3. Configure IPv4 static routes. 4. Configure default route and floating static route with higher AD. 5. Verify with show ip route and show ipv6 route.

Answer

1. Enter global configuration mode. 2. Configure default route and floating static route with higher AD. 3. Configure IPv6 static routes. 4. Configure IPv4 static routes. 5. Verify with show ip route and show ipv6 route.