CCNA Practice Test 29 — 15 Questions

Question 1

A controller-based WLAN is deployed across multiple floors. Users can associate to the SSID on both floors, but their experience improves when moving between APs compared with a poorly designed standalone deployment. Which wireless concept is most closely related to that client movement experience?

Accepted Answer

Roaming between access points. The concept most closely related is roaming between access points. In practical terms, client mobility experience depends on how smoothly a device can move from one AP coverage area to another while staying on the WLAN. Controller-based designs often help manage this more consistently than fragmented independent configurations.

The key point is that the question is about movement between APs while remaining on the wireless network, not about VLAN trunks or routing protocol neighbors.

Answer

NetFlow export

Answer

DHCP snooping

Answer

Route summarization

Question 2

You are connected to R1, a multilayer switch acting as the STP root bridge. Configure Root Guard on the designated port toward R2 (G0/1), Loop Guard on the uplink port G0/2, and BPDU Guard on PortFast-enabled access port G0/3. After configuration, a superior BPDU is received on G0/1, causing it to be blocked by Root Guard; later, an unauthorized BPDU on G0/3 triggers err-disable. Troubleshoot and verify the expected port states.

Accepted Answer

G0/1 is in blocking state (Root Guard), G0/2 is in forwarding state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).. The root guard on G0/1 correctly blocked the port when a superior BPDU was received, preventing an unauthorized root bridge. Loop Guard was applied specifically to the uplink port G0/2 to prevent forwarding loops in case of uni-directional link failure. BPDU Guard on G0/3 placed the port into err-disable state upon receiving an unexpected BPDU, which protects the PortFast edge port. To restore G0/3, you must manually shut/no shut the interface after removing the offending device.

Answer

G0/1 is in forwarding state (Root Guard), G0/2 is in blocking state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).

Answer

G0/1 is in err-disable state (Root Guard), G0/2 is in forwarding state (Loop Guard), G0/3 is in blocking state (BPDU Guard).

Answer

G0/1 is in blocking state (Root Guard), G0/2 is in loop-inconsistent state (Loop Guard), G0/3 is in err-disable state (BPDU Guard).

Question 3

You are connected to the console of R1. The network uses IPv6 with EUI-64. R1's GigabitEthernet0/0 interface has MAC address 001e.4a7b.9c0d. You need to configure an IPv6 address on this interface using EUI-64, with the subnet 2001:db8:abcd:1::/64.

Accepted Answer

ipv6 address 2001:db8:abcd:1::/64 eui-64. The 'ipv6 address 2001:db8:abcd:1::/64 eui-64' command configures the IPv6 address using EUI-64, which generates the interface ID from the MAC address. This command alone enables IPv6 on the interface and assigns the global address; the 'ipv6 enable' command is not strictly necessary and is only required if a link-local address is needed without a global address. Option B would configure a static interface ID, not EUI-64. Option C incorrectly uses the 'link-local' keyword, which is not valid in this context. Option D only enables IPv6 for link-local addressing without assigning a global unicast address.

Answer

ipv6 address 2001:db8:abcd:1::/64

Answer

ipv6 address 2001:db8:abcd:1::/64 link-local

Answer

ipv6 enable

Question 4

Which two statements accurately describe why APIs and human-oriented CLIs are both still useful in network operations?

Accepted Answer

APIs are useful for structured, repeatable software-driven interaction.. APIs and CLIs are both useful because they serve different operational strengths. In practical terms, APIs are better for repeatable software interaction and structured automation, while CLIs remain valuable for direct human troubleshooting and ad hoc inspection. Mature environments often use both depending on the task.

This is not an either-or question. It is about fit for purpose.

Answer

APIs make all CLIs obsolete in every situation.

Answer

CLIs are only useful for configuring initial device settings and cannot be used for monitoring.

Answer

Neither interface should ever return structured data.

Question 5

Which two statements accurately describe why logs and accounting records both matter in secure operations?

Accepted Answer

They improve visibility into events and activity after access occurs.. Logs and accounting records both matter because security is not only about preventing access, but also about understanding what happened. In practical terms, logs can provide event visibility and system context, while accounting records can add traceability for user activity and access sessions. Together they improve incident review and operational accountability.

This is a visibility-and-traceability question, not a pure prevention question.

Answer

They replace the need for authentication entirely.

Answer

They are useful only on wireless guest networks.

Answer

They automatically create access policies for administrators.

Question 6

You are connected to R1. Configure AAA with RADIUS authentication so that SSH users are authenticated first against the RADIUS server (198.51.100.10) and fall back to the local user database if the server is unreachable. Additionally, troubleshoot why an 802.1X-enabled interface (GigabitEthernet0/1) remains in the unauthorized state. The RADIUS server shares a key of 'cisco123' and uses UDP port 1812. The local user 'admin' with secret 'adminpass' must be available as a fallback.

Accepted Answer

[CORRECT] The RADIUS server is unreachable, but the 802.1X port remains unauthorized because the AAA authentication list for dot1x is configured to use only RADIUS without local fallback. The fix is to modify the dot1x authentication list to include 'local' as a fallback method.. The RADIUS server is unreachable (not reachable), but the 802.1X port remains unauthorized because the AAA authentication list for dot1x is configured to use only RADIUS without local fallback. When the server cannot be reached (e.g., timeout), no fallback exists, so the port stays unauthorized. The fix is to modify the dot1x authentication list to include 'local' as a fallback method. Adding local fallback allows the switch to authenticate the supplicant using the local database when the RADIUS server is unreachable.

Answer

The RADIUS server is unreachable because the shared key 'cisco123' is incorrect, causing the port to stay unauthorized.

Answer

The 802.1X port remains unauthorized because the RADIUS server uses UDP port 1812, but the switch expects port 1645.

Answer

The SSH authentication fails because the local user 'admin' is not configured with the correct privilege level, so fallback does not work.

Question 7

Drag and drop the following steps into the correct order to configure a secure Cisco switch, from enabling secure management access to implementing advanced dynamic ARP inspection.

Accepted Answer

Configure the switch hostname and IP domain name.. 1. Hostname and IP domain name: required to generate RSA keys for SSH in the next step. 2. RSA key generation: SSH cannot function without cryptographic keys. 3. SSH v2 enabled and Telnet disabled: ensures secure remote access before any authentication method is applied. 4. AAA authentication with RADIUS/TACACS+ on vty lines: controls who can access the switch after SSH transport is established. 5. Port security on access ports: protects the data plane by restricting MAC addresses once management plane is secured. 6. DHCP snooping: builds a binding database used to validate traffic; must be active before DAI can work. 7. Dynamic ARP Inspection: relies on the DHCP snooping database to filter ARP packets and prevent man-in-the-middle attacks, so it must be configured last.

Question 8

Drag and drop the following steps into the correct order to configure a Layer 3 switch to perform DHCP relay agent and DHCP snooping for a remote DHCP server.

Accepted Answer

On the DHCP server, create a DHCP pool for the client subnet with the correct network, default gateway, and lease parameters.. Correct order: 1) Create DHCP pool on the server to have valid lease parameters; 2) Assign IP address to the SVI so it can act as the gateway and relay agent for the subnet; 3) Globally enable DHCP snooping to activate the feature; 4) Enable snooping on the client VLAN so that only that VLAN’s DHCP traffic is filtered; 5) Set the interface facing the server as trusted to allow DHCP replies; 6) Configure ip helper-address on the SVI to forward client DHCP broadcasts to the server. Each step depends on the previous: the server must be ready; the SVI needs an IP before the helper can be applied; snooping must be globally on before per-VLAN settings; trusted port must be defined before relayed replies are accepted; finally, the helper address enables the actual relay.

Question 9

You are connected to R1. The inside network 192.168.1.0/24 must be able to reach the internet via PAT (overload) using the public IP 203.0.113.1 on interface GigabitEthernet0/1. Additionally, a web server at 192.168.1.10 must be reachable from the internet via static NAT to 203.0.113.10. The current configuration is not working. Identify and fix all issues.

Accepted Answer

Change ACL 100 to permit 192.168.1.0 0.0.0.255, add 'overload' to the ip nat inside source list command, and verify with 'show ip nat translations'.. The configuration has two issues: (1) ACL 100 permits 192.168.2.0/24 instead of 192.168.1.0/24, so the inside traffic is not matched for PAT. (2) The 'ip nat inside source list' command lacks the 'overload' keyword, preventing port address translation. The static NAT entry for the web server is correctly configured and does not depend on the ACL; it will work once the ACL is fixed. To resolve: change ACL 100 to permit 192.168.1.0 0.0.0.255, add 'overload' to the ip nat inside source list command, and verify with 'show ip nat translations'.

Answer

Change ACL 100 to permit 192.168.1.0 0.0.0.255 and add the 'overload' keyword to the ip nat inside source list command.

Answer

Add the 'overload' keyword to the ip nat inside source list command and verify with 'show ip nat translations'.

Answer

Change ACL 100 to permit 192.168.1.0 0.0.0.255 and verify with 'show ip nat translations'.

Question 10

You are connected to R1 via the console. Configure single-area OSPFv2 on R1 and R2 so that they form a full adjacency. The link between R1 and R2 uses 203.0.113.0/30. R1 has G0/0 203.0.113.1/30 and R2 has G0/0 203.0.113.2/30. R1's router-id must be 1.1.1.1, and R2's router-id must be 2.2.2.2. R1's GigabitEthernet0/0 interface is configured as a passive interface under OSPF, preventing OSPF hello messages from being sent out of that interface. Ensure that R1 does not send OSPF hellos out of its loopback0 interface (203.0.113.129/32). After configuration, verify the adjacency is established and OSPF routes are exchanged.

Accepted Answer

The adjacency fails because R1's GigabitEthernet0/0 interface is configured as passive-interface. Remove the passive-interface command for G0/0.. The adjacency fails because R1's GigabitEthernet0/0 interface is configured as passive-interface (the 'No Hellos' line in show ip ospf interface). This prevents R1 from sending OSPF hellos to R2. To fix, remove the passive-interface command for G0/0. The loopback0 interface should remain passive. After removal, verify with 'show ip ospf neighbor' to see the neighbor state change to FULL and 'show ip route ospf' to see routes.

Answer

The adjacency fails because the router-id 1.1.1.1 is not reachable from R2. Configure a static route for 1.1.1.1/32 on R2.

Answer

The adjacency fails because the subnet mask on the link is /30 but OSPF expects a /24. Change the mask to /24 on both interfaces.

Answer

The adjacency fails because OSPF is not enabled on R2's GigabitEthernet0/0 interface. Configure 'ip ospf 1 area 0' on R2's G0/0.

Question 11

Drag and drop the items on the left to the correct descriptions on the right.

Question 12

Drag and drop the following steps into the correct order to enable a third-party SFP transceiver and verify its diagnostics on a Cisco switch.

Accepted Answer

Enter global configuration mode: configure terminal. Cisco switches by default only support Cisco-branded SFP transceivers. To use a third-party transceiver, the command `service unsupported-transceiver` must be enabled in global configuration mode. After configuring the interface, the `show interfaces transceiver` command displays diagnostic information including temperature, voltage, and optical power, which helps verify proper operation.

Question 13

Drag and drop the following steps into the correct order to describe the encapsulation of data as it passes down the TCP/IP stack for transmission.

Accepted Answer

Application data is generated by the user application.. The encapsulation process starts with the application layer generating data. The transport layer packages data into segments (TCP) or datagrams (UDP). The network layer adds an IP header, creating a packet. The data link layer adds a frame header and trailer (frame). Finally, the physical layer converts the frame into bits for transmission.

Question 14

Drag and drop the items on the left to match the descriptions on the right.

Question 15

Drag and drop the items on the left to match the descriptions on the right.