CCNA Practice Test 28 — 15 Questions

Question 1

Which TWO statements about 802.1Q trunking, native VLANs, and inter-VLAN routing are correct? (Choose two.)

Accepted Answer

By default, frames belonging to the native VLAN are sent untagged across an 802.1Q trunk.. By default, 802.1Q trunking treats the native VLAN (typically VLAN 1) as untagged. Frames in the native VLAN are sent without an 802.1Q tag, allowing interoperability with devices that do not understand trunking. This behavior is defined in IEEE 802.1Q and is essential for backward compatibility.

Answer

802.1Q trunking is a Cisco-proprietary protocol that uses a 4-byte tag to identify VLAN membership.

Answer

Inter-VLAN routing can be accomplished using a Layer 2 switch configured with VLAN access maps.

Answer

Switches strip the 802.1Q tag from all frames before forwarding them out of a trunk port.

Question 2

An administrator configured a floating static default route on R1 as a backup to reach 10.10.10.0/24. The primary path is learned via OSPF, and the floating static route uses an administrative distance of 130. After the primary OSPF neighbor fails, traffic to 10.10.10.0/24 is dropped. According to the exhibit, why is the backup default route not being used?

Accepted Answer

The static route specifies an outgoing interface that is down; the next‑hop must be reachable for the route to be used.. The floating static default route is not used because the outgoing interface specified in the static route is down. For a static route with an outgoing interface to be considered valid and installed in the routing table, the interface must be in an up/up state. When the primary OSPF neighbor fails, the backup static route cannot be used because its next-hop is unreachable due to the interface being down, causing traffic to be dropped.

Answer

The administrative distance of 130 is still less than the OSPF default of 110, so it will never be installed.

Answer

The static route is missing the permanent keyword, which is required for backup routes.

Answer

The metric of the static route is too high; it should be reduced to 0.

Question 3

A router learns the same destination from EIGRP and OSPF. The EIGRP route has a metric of 1000, and the OSPF route has a metric of 10. Which route is installed by default?

Accepted Answer

The EIGRP route, because its source has a lower default administrative distance. The EIGRP route is installed by default because route selection between different routing protocols is based on administrative distance before the protocol-specific metric is compared across sources. In plain language, the router does not compare an OSPF metric of 10 directly against an EIGRP metric of 1000 because those metrics come from different systems and are not numerically comparable in a meaningful cross-protocol way. Instead, the router first looks at the trustworthiness of the source.

By default, internal EIGRP routes have a lower administrative distance than OSPF routes, so EIGRP wins even though the OSPF metric value appears lower. This is a classic CCNA trap designed to catch people who compare metrics across different protocols without considering administrative distance first.

Answer

The OSPF route, because 10 is lower than 1000

Answer

Both routes automatically install for load balancing

Answer

Neither route installs until the administrator chooses manually

Question 4

A host uses the subnet mask 255.255.255.192. How many usable host addresses exist in each subnet?

Accepted Answer

62. The mask 255.255.255.192 corresponds to /26. That leaves 6 host bits, which means each subnet contains 64 total addresses. After excluding the network and broadcast addresses, 62 usable host addresses remain.

This is a standard host-capacity question. The safest approach is to convert the mask to the prefix, determine the total addresses from the number of host bits, and then subtract the two reserved addresses.

Answer

30

Answer

126

Answer

254

Question 5

Hosts on the inside network can reach the internet, but return traffic is failing after a new router was installed. The router's configuration shows that the LAN-facing interface has been configured with 'ip nat outside' and the WAN-facing interface with 'ip nat inside'. What configuration mistake is the most likely cause?

Accepted Answer

The NAT inside and outside interface roles are reversed.. NAT overload requires the LAN-facing interface to be marked as ip nat inside and the WAN-facing interface as ip nat outside. The exhibit shows those roles reversed, so translations will not occur correctly. The ACL itself is fine for matching the inside subnet.

Answer

The ACL must deny RFC1918 traffic before NAT can work.

Answer

PAT cannot use an interface address for overload.

Answer

The inside subnet must be configured as /24 on both interfaces.

Question 6

Refer to the exhibit. A network administrator connects an IP phone to interface GigabitEthernet1/0/1 on a Cisco Catalyst switch. The PC connected through the phone works normally on the data VLAN, but the phone cannot obtain an IP address and fails to register with the call server. Which action will resolve the problem?

Accepted Answer

Add 'switchport voice vlan 20' on interface GigabitEthernet1/0/1.. The PC works on the data VLAN, but the phone cannot obtain an IP address, indicating the phone is not receiving the correct VLAN assignment. The phone should be placed in the voice VLAN (VLAN 20) using the 'switchport voice vlan 20' command, which allows the switch to tag the phone's traffic with VLAN 20 via CDP/LLDP, enabling it to get an IP from the voice VLAN DHCP server.

Answer

Configure 'switchport trunk allowed vlan 10,20' on interface Gi1/0/1 and change the switchport mode to trunk.

Answer

Issue 'switchport access vlan 20' and 'switchport voice vlan 10' on interface Gi1/0/1.

Answer

Enable 'switchport port-security mac-address sticky' on the interface and manually add the phone’s MAC address to the access VLAN.

Question 7

An engineer wants a static route to be used only if the OSPF route to the same network disappears. What should be configured?

Accepted Answer

A static route with higher administrative distance than OSPF. A floating static route is given a higher administrative distance than the preferred dynamic route so it stays out of the routing table unless the dynamic route is lost.

Answer

A static route with lower administrative distance than OSPF

Answer

A second OSPF route with a lower metric

Answer

A default route with no next hop

Question 8

Which TWO statements correctly describe the configuration and verification of EtherChannel with LACP?

Accepted Answer

LACP uses the 'active' and 'passive' modes to negotiate an EtherChannel.. LACP (IEEE 802.3ad) uses 'active' and 'passive' modes to negotiate an EtherChannel. Option B is correct because the 'show etherchannel summary' command displays the channel group number, port-channel interface, member ports, and their status flags (e.g., P for in port-channel, S for suspended). Option C is incorrect because 'auto' and 'desirable' are PAgP modes, not LACP modes. Option D is incorrect because 'show etherchannel summary' does not show LACP system priority; that is displayed with 'show lacp sys-id' or 'show etherchannel detail'. Option E is incorrect because an EtherChannel can be formed with mismatched LACP modes as long as at least one side is 'active'; for example, 'active' + 'passive' works.

Answer

LACP uses the 'auto' and 'desirable' modes to negotiate an EtherChannel.

Answer

The 'show etherchannel summary' command shows the LACP system priority for each channel.

Answer

An EtherChannel can be formed only if all member ports use the same LACP mode.

Question 9

A host is configured with IP address 172.16.100.222/27. Which address is the broadcast address for its subnet?

Accepted Answer

172.16.100.223. A /27 uses address blocks of 32. In practical terms, the fourth-octet ranges are 0–31, 32–63, 64–95, 96–127, 128–159, 160–191, 192–223, and 224–255. Since 222 falls inside the 192–223 block, the broadcast address is the last address in that block, which is 172.16.100.223.

This is a classic subnet-boundary question because it tests whether you can place a host in the correct block and then identify the final address in that block as the broadcast.

Answer

172.16.100.191

Answer

172.16.100.224

Answer

172.16.100.255

Question 10

A user connects a Cisco IP Phone with a PC attached to the phone's PC port to switch interface GigabitEthernet0/5. The PC obtains an IP address and can reach the network, but the phone displays "Configuring IP" and never registers. Based on the exhibit outputs, what is the most likely cause?

Accepted Answer

VLAN 20 has not been created in the switch's VLAN database.. The PC obtains an IP address and can reach the network, indicating that the access VLAN (likely VLAN 1 or the native VLAN) is functioning. However, the phone displays 'Configuring IP' and never registers, which means it cannot obtain an IP address on its voice VLAN. The most likely cause is that VLAN 20, which is configured as the voice VLAN on the switchport, has not been created in the switch's VLAN database. Without the VLAN existing, the switch cannot forward traffic or DHCP requests for that VLAN, leaving the phone stuck in the IP configuration phase.

Answer

The switchport must be configured as a trunk to support voice VLANs.

Answer

The native VLAN on the trunk ports between the switch and the DHCP server is incorrectly set to VLAN 10.

Answer

The phone is manually configured to use VLAN 10 for voice traffic instead of VLAN 20.

Question 11

A host is configured with IP address 10.10.40.78/28. Which subnet contains that host?

Accepted Answer

10.10.40.64/28. A /28 subnet has a block size of 16. In simple terms, the fourth-octet ranges are 0–15, 16–31, 32–47, 48–63, 64–79, 80–95, and so on. Because 78 falls inside the 64–79 block, the network address for this host’s subnet is 10.10.40.64/28.

This style of subnetting question checks whether you can move from prefix length to block size and then place the host into the correct range. The common mistake is choosing the nearest familiar-looking number instead of the actual block boundary.

Answer

10.10.40.48/28

Answer

10.10.40.72/28

Answer

10.10.40.80/28

Question 12

Which TWO statements correctly describe how a router selects the best path for a destination network when multiple routing table entries exist?

Accepted Answer

Routes with the longest prefix length (most specific) are preferred over routes with a shorter prefix.. Routers select the best path by first applying the longest prefix match rule (most specific subnet mask), so option A is correct. If two routes have the same prefix length, the router then compares administrative distance (AD) and prefers the lower AD; option B is incorrect because it says higher AD is selected. When AD is equal, the router uses metric and chooses the lowest metric, making option C correct. Option D is false because directly connected routes have an AD of 0, not 1, and they are indeed more trustworthy than dynamic routes but not due to AD 1. Option E is wrong because directly connected routes are always preferred over dynamic routes regardless of adaptability.

Answer

If two routes have the same prefix length, the route with the higher administrative distance is selected.

Answer

A directly connected route has an administrative distance of 1, making it more trustworthy than any dynamic route.

Answer

Dynamic routes are always preferred over directly connected routes because they can adapt to network changes.

Question 13

A switchport connected to a user workstation is placed in VLAN 30. The administrator also wants to prevent that port from learning more than one MAC address. Which feature should be configured?

Accepted Answer

Port security. The correct feature is port security. In practical terms, port security lets the administrator control how many MAC addresses can be learned on a switchport and what happens if that limit is exceeded. That makes it a very natural fit for a user-facing access port where one endpoint is expected and unmanaged extra devices are not.

This is a common access-layer hardening technique. VLAN assignment controls where the traffic belongs, but it does not limit who or what can appear on the port. Port security adds that second layer of control.

Answer

EtherChannel

Answer

OSPF passive-interface

Answer

Native VLAN

Question 14

Which medium is the most common choice for a 10G uplink between wiring closets on different floors of the same building?

Accepted Answer

Fiber optic cable. Fiber is commonly used for building uplinks because it supports higher bandwidth and longer distances than typical copper for this use case.

Answer

Rollover cable

Answer

Coaxial cable

Answer

Console cable

Question 15

A switch port should allow an IP phone and attached PC to operate correctly. The phone should place voice traffic in VLAN 200 while the PC remains in VLAN 20. Which configuration approach best supports that design?

Accepted Answer

Configure the port with an access VLAN for data and a voice VLAN for the phone. The best approach is to configure the access VLAN for user data and the voice VLAN separately. In plain language, the PC should remain a normal untagged data endpoint in VLAN 20, while the phone can tag its own voice traffic for VLAN 200. Cisco access-port designs support this exact use case and allow the switch to keep voice and user traffic logically separated without requiring two physical ports.

This is a classic CCNA edge-port design. It is not a general trunking problem, and it does not require EtherChannel or router subinterfaces. The important idea is that one switchport can support an access VLAN and a voice VLAN together in a way designed specifically for IP phones with downstream PCs.

Answer

Configure the port as a routed port with no switchport

Answer

Configure the port as an EtherChannel member

Answer

Use a native VLAN only and disable all tagging