CCNA Practice Test 29 — 15 Questions

Question 1

An administrator wants to permit SSH management access but block Telnet access to a device. Which statement best reflects that design goal?

Accepted Answer

SSH is preferred because it provides encrypted remote administration, unlike Telnet. Permitting SSH while blocking Telnet is a hardening decision because SSH encrypts management traffic and Telnet does not. The administrator wants remote access to remain available with credentials and session data protected. Option A is correct: SSH provides encrypted remote administration. Option B is wrong: Telnet offers no confidentiality. Option C is wrong: SSH works on routers and Layer 3 switches, not only Layer 2 switches. Option D is wrong: blocking Telnet does not disable AAA; AAA can still function over SSH or local authentication.

Answer

Telnet is preferred because it provides stronger confidentiality than SSH

Answer

SSH can be used only on Layer 2 switches and not routers

Answer

Blocking Telnet automatically disables all AAA functions

Question 2

Refer to the exhibit. A network administrator connects an IP phone to interface GigabitEthernet1/0/1 on a Cisco Catalyst switch. The PC connected through the phone works normally on the data VLAN, but the phone cannot obtain an IP address and fails to register with the call server. Which action will resolve the problem?

Accepted Answer

Add 'switchport voice vlan 20' on interface GigabitEthernet1/0/1.. The PC works on the data VLAN, but the phone cannot obtain an IP address, indicating the phone is not receiving the correct VLAN assignment. The phone should be placed in the voice VLAN (VLAN 20) using the 'switchport voice vlan 20' command, which allows the switch to tag the phone's traffic with VLAN 20 via CDP/LLDP, enabling it to get an IP from the voice VLAN DHCP server.

Answer

Configure 'switchport trunk allowed vlan 10,20' on interface Gi1/0/1 and change the switchport mode to trunk.

Answer

Issue 'switchport access vlan 20' and 'switchport voice vlan 10' on interface Gi1/0/1.

Answer

Enable 'switchport port-security mac-address sticky' on the interface and manually add the phone’s MAC address to the access VLAN.

Question 3

An engineer wants a static route to be used only if the OSPF route to the same network disappears. What should be configured?

Accepted Answer

A static route with higher administrative distance than OSPF. A floating static route is given a higher administrative distance than the preferred dynamic route so it stays out of the routing table unless the dynamic route is lost.

Answer

A static route with lower administrative distance than OSPF

Answer

A second OSPF route with a lower metric

Answer

A default route with no next hop

Question 4

Which TWO statements correctly describe the configuration and verification of EtherChannel with LACP?

Accepted Answer

LACP uses the 'active' and 'passive' modes to negotiate an EtherChannel.. LACP (IEEE 802.3ad) uses 'active' and 'passive' modes to negotiate an EtherChannel. Option B is correct because the 'show etherchannel summary' command displays the channel group number, port-channel interface, member ports, and their status flags (e.g., P for in port-channel, S for suspended). Option C is incorrect because 'auto' and 'desirable' are PAgP modes, not LACP modes. Option D is incorrect because 'show etherchannel summary' does not show LACP system priority; that is displayed with 'show lacp sys-id' or 'show etherchannel detail'. Option E is incorrect because an EtherChannel can be formed with mismatched LACP modes as long as at least one side is 'active'; for example, 'active' + 'passive' works.

Answer

LACP uses the 'auto' and 'desirable' modes to negotiate an EtherChannel.

Answer

The 'show etherchannel summary' command shows the LACP system priority for each channel.

Answer

An EtherChannel can be formed only if all member ports use the same LACP mode.

Question 5

A host is configured with IP address 172.16.100.222/27. Which address is the broadcast address for its subnet?

Accepted Answer

172.16.100.223. A /27 uses address blocks of 32. In practical terms, the fourth-octet ranges are 0–31, 32–63, 64–95, 96–127, 128–159, 160–191, 192–223, and 224–255. Since 222 falls inside the 192–223 block, the broadcast address is the last address in that block, which is 172.16.100.223.

This is a classic subnet-boundary question because it tests whether you can place a host in the correct block and then identify the final address in that block as the broadcast.

Answer

172.16.100.191

Answer

172.16.100.224

Answer

172.16.100.255

Question 6

A user connects a Cisco IP Phone with a PC attached to the phone's PC port to switch interface GigabitEthernet0/5. The PC obtains an IP address and can reach the network, but the phone displays "Configuring IP" and never registers. Based on the exhibit outputs, what is the most likely cause?

Accepted Answer

VLAN 20 has not been created in the switch's VLAN database.. The PC obtains an IP address and can reach the network, indicating that the access VLAN (likely VLAN 1 or the native VLAN) is functioning. However, the phone displays 'Configuring IP' and never registers, which means it cannot obtain an IP address on its voice VLAN. The most likely cause is that VLAN 20, which is configured as the voice VLAN on the switchport, has not been created in the switch's VLAN database. Without the VLAN existing, the switch cannot forward traffic or DHCP requests for that VLAN, leaving the phone stuck in the IP configuration phase.

Answer

The switchport must be configured as a trunk to support voice VLANs.

Answer

The native VLAN on the trunk ports between the switch and the DHCP server is incorrectly set to VLAN 10.

Answer

The phone is manually configured to use VLAN 10 for voice traffic instead of VLAN 20.

Question 7

A host is configured with IP address 10.10.40.78/28. Which subnet contains that host?

Accepted Answer

10.10.40.64/28. A /28 subnet has a block size of 16. In simple terms, the fourth-octet ranges are 0–15, 16–31, 32–47, 48–63, 64–79, 80–95, and so on. Because 78 falls inside the 64–79 block, the network address for this host’s subnet is 10.10.40.64/28.

This style of subnetting question checks whether you can move from prefix length to block size and then place the host into the correct range. The common mistake is choosing the nearest familiar-looking number instead of the actual block boundary.

Answer

10.10.40.48/28

Answer

10.10.40.72/28

Answer

10.10.40.80/28

Question 8

Which TWO statements correctly describe how a router selects the best path for a destination network when multiple routing table entries exist?

Accepted Answer

Routes with the longest prefix length (most specific) are preferred over routes with a shorter prefix.. Routers select the best path by first applying the longest prefix match rule (most specific subnet mask), so option A is correct. If two routes have the same prefix length, the router then compares administrative distance (AD) and prefers the lower AD; option B is incorrect because it says higher AD is selected. When AD is equal, the router uses metric and chooses the lowest metric, making option C correct. Option D is false because directly connected routes have an AD of 0, not 1, and they are indeed more trustworthy than dynamic routes but not due to AD 1. Option E is wrong because directly connected routes are always preferred over dynamic routes regardless of adaptability.

Answer

If two routes have the same prefix length, the route with the higher administrative distance is selected.

Answer

A directly connected route has an administrative distance of 1, making it more trustworthy than any dynamic route.

Answer

Dynamic routes are always preferred over directly connected routes because they can adapt to network changes.

Question 9

A switchport connected to a user workstation is placed in VLAN 30. The administrator also wants to prevent that port from learning more than one MAC address. Which feature should be configured?

Accepted Answer

Port security. The correct feature is port security. In practical terms, port security lets the administrator control how many MAC addresses can be learned on a switchport and what happens if that limit is exceeded. That makes it a very natural fit for a user-facing access port where one endpoint is expected and unmanaged extra devices are not.

This is a common access-layer hardening technique. VLAN assignment controls where the traffic belongs, but it does not limit who or what can appear on the port. Port security adds that second layer of control.

Answer

EtherChannel

Answer

OSPF passive-interface

Answer

Native VLAN

Question 10

Which medium is the most common choice for a 10G uplink between wiring closets on different floors of the same building?

Accepted Answer

Fiber optic cable. Fiber is commonly used for building uplinks because it supports higher bandwidth and longer distances than typical copper for this use case.

Answer

Rollover cable

Answer

Coaxial cable

Answer

Console cable

Question 11

A switch port should allow an IP phone and attached PC to operate correctly. The phone should place voice traffic in VLAN 200 while the PC remains in VLAN 20. Which configuration approach best supports that design?

Accepted Answer

Configure the port with an access VLAN for data and a voice VLAN for the phone. The best approach is to configure the access VLAN for user data and the voice VLAN separately. In plain language, the PC should remain a normal untagged data endpoint in VLAN 20, while the phone can tag its own voice traffic for VLAN 200. Cisco access-port designs support this exact use case and allow the switch to keep voice and user traffic logically separated without requiring two physical ports.

This is a classic CCNA edge-port design. It is not a general trunking problem, and it does not require EtherChannel or router subinterfaces. The important idea is that one switchport can support an access VLAN and a voice VLAN together in a way designed specifically for IP phones with downstream PCs.

Answer

Configure the port as a routed port with no switchport

Answer

Configure the port as an EtherChannel member

Answer

Use a native VLAN only and disable all tagging

Question 12

Which TWO statements correctly describe the behavior of PAT (Port Address Translation) as configured on a Cisco router?

Accepted Answer

PAT translates multiple internal addresses to a single public IP address by using unique source port numbers.. PAT (Port Address Translation) translates multiple internal private IP addresses to a single public IP address by assigning unique source port numbers to each session, allowing many internal hosts to share one public IP. This is correctly described in option A. Option D is also correct because PAT uniquely identifies each translation by both the IP address and the port number, enabling the router to demultiplex return traffic. Option B is wrong because PAT uses many-to-one mapping, not 1:1; a 1:1 mapping is characteristic of static NAT. Option C is incorrect because PAT can operate with a single public IP address (often the outside interface address) rather than requiring a pool. Option E is false because PAT translations are dynamically created and time out after a period of inactivity; they are not static.

Answer

PAT requires a 1:1 mapping of internal to external IP addresses.

Answer

PAT can only be configured with a pool of public IP addresses.

Answer

PAT translations are always static and never time out.

Question 13

A switch receives a unicast frame for a destination MAC address that is not yet in its MAC address table. What does the switch do?

Accepted Answer

Floods the frame out all ports in the same VLAN except the incoming port. An unknown unicast frame is flooded within the VLAN because the switch does not yet know which port leads to the destination MAC. The frame is not sent back out the receiving port.

Answer

Drops the frame immediately

Answer

Sends the frame to the default gateway first

Answer

Converts the frame to a broadcast packet

Question 14

Which two statements accurately describe IPv6 link-local addresses?

Accepted Answer

They are used for communication on the local segment only.. IPv6 link-local addresses are designed for communication on the local segment only. In plain language, they allow devices to talk to nearby neighbors without needing globally routable addresses. They play an important role in IPv6 functions such as Neighbor Discovery and are commonly used when hosts communicate with the default gateway on the same link. These addresses are normal and expected in IPv6 environments.

They are not globally Internet-routable, and they are not just emergency fallbacks for DHCPv6 failure. The two correct answers are the ones that preserve their local-link purpose and their importance in standard IPv6 behavior rather than treating them as optional or globally reachable.

Answer

They are globally routable across the Internet.

Answer

They exist only when DHCPv6 fails.

Answer

They replace the need for any default gateway logic.

Question 15

Which TWO statements correctly describe the configuration and verification of OSPFv3 for IPv6?

Accepted Answer

OSPFv3 uses link-local IPv6 addresses to form neighbor adjacencies.. OSPFv3 for IPv6 uses link-local IPv6 addresses (FE80::/10) to form neighbor adjacencies, not global unicast addresses (so B is incorrect). OSPFv3 does not automatically enable on all IPv6 interfaces; each interface must be explicitly configured under the OSPFv3 process using the 'ipv6 ospf' command (so C is incorrect). The 'show ospfv3 neighbor' command displays the neighbor's Router ID (a 32-bit value), not the IPv6 address of the neighbor's interface (so E is incorrect). Correct options A and D accurately describe OSPFv3 neighbor formation using link-local addresses and the information shown by the 'show ospfv3 neighbor' command, which includes neighbor state, neighbor ID, and interface.

Answer

OSPFv3 uses global unicast IPv6 addresses to form neighbor adjacencies.

Answer

OSPFv3 is automatically enabled on all IPv6-enabled interfaces when the routing process is configured.

Answer

The 'show ospfv3 neighbor' command displays the IPv6 address of the neighbor's interface as the neighbor ID.