CCNA Practice Test 30 — 15 Questions

Question 1

You are connected to SW1. A LACP EtherChannel between SW1 and SW2 has already been configured using interfaces GigabitEthernet0/1 and GigabitEthernet0/2 with channel-group 1 mode active on both sides and assigned to VLAN 100. However, the channel is not forming because of a speed/duplex mismatch. The correct interface settings for this network are speed 1000 and duplex full. Interface GigabitEthernet0/1 is already configured with these settings. Only interface GigabitEthernet0/2 needs to be corrected. Identify the configuration change needed to resolve the mismatch and verify the EtherChannel is up with 'show etherchannel summary'.

Accepted Answer

Configure interface GigabitEthernet0/2 with 'speed 1000' and 'duplex full', then verify the EtherChannel is up.. The EtherChannel is not forming because GigabitEthernet0/2 is configured with speed 100 and duplex half, while GigabitEthernet0/1 is speed 1000 and duplex full. LACP requires all member ports to have identical speed and duplex settings. To fix this, configure GigabitEthernet0/2 with speed 1000 and duplex full, matching GigabitEthernet0/1. After correction, the ports should bundle in Port-channel1 and show as bundled (P) in 'show etherchannel summary'.

Answer

Configure interface GigabitEthernet0/1 with 'speed 100' and 'duplex half', then verify the EtherChannel is up.

Answer

Configure interface GigabitEthernet0/2 with 'speed auto' and 'duplex auto', then verify the EtherChannel is up.

Answer

Configure interface GigabitEthernet0/2 with 'channel-group 1 mode active' and 'switchport access vlan 100', then verify the EtherChannel is up.

Question 2

A technician is troubleshooting a connectivity issue where a workstation connected to a Cisco switch port cannot ping other hosts that are in the same VLAN 10 segment. The technician runs the show mac address-table command and notices that the workstation's MAC address is listed on VLAN 1, not VLAN 10. What is the most likely cause?

Accepted Answer

The switch port is not configured with the switchport access vlan 10 command.. The workstation's MAC address appears in VLAN 1 instead of VLAN 10 because the switch port is operating in the default VLAN (VLAN 1). The most likely cause is that the port has not been explicitly assigned to VLAN 10 using the `switchport access vlan 10` command. Without this command, the port remains in its default access VLAN (VLAN 1), so all frames from the workstation are associated with VLAN 1, preventing communication with hosts in VLAN 10.

Answer

The switch port is configured as a trunk with native VLAN 1.

Answer

The MAC address table contains a stale entry that must be cleared.

Answer

Spanning Tree Protocol has placed the port in a blocking state.

Question 3

A network engineer notices that hosts in the 192.168.2.0/24 network connected to router R1's GigabitEthernet0/1 interface cannot reach the Internet. R1 has a standard ACL 10 configured as 'access-list 10 permit 192.168.1.0 0.0.0.255' and applied inbound on interface GigabitEthernet0/0, which connects to the 192.168.1.0/24 LAN. What is the most likely cause?

Accepted Answer

The ACL is filtering return traffic from the Internet that enters G0/0, because it is applied inbound on that interface instead of outbound.. ACL 10 is applied inbound on GigabitEthernet0/0, which connects to the 192.168.1.0/24 LAN. When traffic from the Internet returns to hosts in the 192.168.2.0/24 network, it enters G0/0 inbound and is evaluated against ACL 10, which only permits source addresses from 192.168.1.0/24. The implicit deny at the end of the ACL then blocks all return traffic destined for 192.168.2.0/24, preventing those hosts from reaching the Internet.

Answer

The implicit deny at the end of ACL 10 is blocking all outbound traffic from the 192.168.2.0/24 network.

Answer

The router is not performing inter-VLAN routing between the 192.168.1.0 and 192.168.2.0 networks.

Answer

The ACL is missing a permit statement for the 192.168.2.0/24 network to allow traffic from that subnet.

Question 4

Two switches are configured for LACP EtherChannel. One side is set to passive and the other side is also set to passive. What is the most likely outcome?

Accepted Answer

The EtherChannel will not form because neither side initiates LACP negotiation.. The EtherChannel will not form because LACP passive mode only listens for negotiation; it does not initiate it. When both sides are set to passive, neither side sends LACP packets, so the bundle cannot be established. This is a deterministic outcome, not merely unlikely.

Answer

The EtherChannel always forms because passive mode is preferred.

Answer

The links automatically become a routed interface.

Answer

The switches delete the bundle configuration automatically.

Question 5

A multilayer switch has SVIs for VLAN 10 and VLAN 20, but hosts in those VLANs still cannot reach each other. The SVIs are up/up. Which additional condition is most likely required?

Accepted Answer

IP routing must be enabled on the multilayer switch. If the SVIs are up but inter-VLAN traffic still fails, the most likely missing condition is that IP routing is not enabled on the multilayer switch. In plain language, the switch has the VLAN gateway interfaces present, but it has not been told to behave as a Layer 3 router between them. Without IP routing enabled, the SVIs can exist and still not actually route traffic between VLANs.

This is a classic multilayer-switch design issue because many learners assume the presence of SVIs alone automatically creates routing. In reality, routed forwarding between VLANs still requires the switch to operate as a Layer 3 device. That is why enabling routing is the best answer.

Answer

Every access port must be converted to a trunk

Answer

DHCP snooping must be disabled globally

Answer

The switch must remove all VLAN assignments

Question 6

You are connected to R1 via console. The network has a primary link to the ISP via R2 and a backup link via R3. Configure IPv4 and IPv6 floating static default routes on R1 so that the primary path goes through R2 (AD 1) and the backup through R3 (AD 10). Additionally, configure a static route on R1 for the internal LAN 192.168.10.0/24 via R2 (AD 1). The current configuration includes a static default route ip route 0.0.0.0 0.0.0.0 10.0.0.3, which causes a recursive routing failure because 10.0.0.3 is not a valid next-hop address. Identify and fix the issue, then apply the floating static routes.

Accepted Answer

Remove the existing incorrect IPv4 static default route and reconfigure the primary IPv4 default route with the correct next-hop address (10.0.0.2) and AD 1. Add the backup IPv4 default route via 10.0.0.6 with AD 10. Then add IPv6 static default routes: ipv6 route ::/0 2001:DB8:1:1::2 1 and ipv6 route ::/0 2001:DB8:2:1::2 10. Also add the static route for 192.168.10.0/24 via 10.0.0.2 with AD 1.. The IPv4 default route currently uses next-hop 10.0.0.3, which is not a valid address on any directly connected interface, causing a recursive lookup failure. Option A fixes this by removing the incorrect route and correctly adding the primary (10.0.0.2 with AD 1) and backup (10.0.0.6 with AD 10) default routes, fulfilling the floating static requirement. It also adds both IPv6 floating default routes and the LAN static route. Option B is wrong because adding a route to 10.0.0.0/30 via R3 does not fix the next-hop 10.0.0.3 failure for the default route. Option C incorrectly reverses the administrative distances, making the backup path the primary. Option D erroneously uses an exit interface instead of the correct next-hop IP, which is not suitable for multi-access or point-to-point networks without additional configuration and does not resolve the original misconfigured next-hop.

Answer

Add a static route to 10.0.0.0/30 via the backup link to R3, then the default route to 10.0.0.2 will work. Then configure IPv6 default routes with AD 1 and 10 as described.

Answer

Change the administrative distance of the IPv4 default route to 10 and the backup to 1, so the backup becomes primary. Then configure IPv6 default routes with AD 10 and 1 respectively.

Answer

Remove the existing IPv4 static default route and configure it with the next-hop as the exit interface (e.g., GigabitEthernet0/0) instead of the IP address. Then add IPv6 default routes using the exit interface as well.

Question 7

Which TWO statements are true regarding switch port configuration for access, voice, and trunk ports?

Accepted Answer

A switch port configured as a trunk port can simultaneously carry untagged traffic for the native VLAN and tagged traffic for multiple other VLANs.. Option A is correct because an 802.1Q trunk port transmits frames for the native VLAN untagged while tagging frames for all other allowed VLANs, allowing one link to carry both native and multiple tagged VLANs simultaneously. Option D is correct because when a voice VLAN is configured on an access port, the switch uses CDP (or LLDP-MED) to advertise the voice VLAN ID to the attached IP phone, which then tags its voice traffic with that VLAN. Option B is wrong because a port with both an access VLAN and a voice VLAN is configured as an access port with the 'switchport voice vlan' command, not as a trunk. Option C is wrong because 'switchport mode dynamic auto' only passively waits for the neighbor to initiate trunking; it is 'dynamic desirable' that actively attempts to form a trunk. Option E is wrong because the native VLAN is not automatically added to the allowed VLAN list by 'switchport trunk allowed vlan'; it must be explicitly included if it is to be permitted on the trunk.

Answer

When a port is configured with both an access VLAN and a voice VLAN, the switchport must be set to trunk mode.

Answer

The switchport mode dynamic auto command sets the port to actively attempt to form a trunk if the neighbor initiates negotiation.

Answer

Issuing the switchport trunk allowed vlan command automatically includes the native VLAN in the allowed list, so it never needs to be explicitly added.

Question 8

Why is R1 not installing the floating static default route into the routing table?

Accepted Answer

Because the OSPF default route has a lower administrative distance than the floating static route.. The floating static default route is not installed because the primary default route is already present and has a lower administrative distance. In practical terms, a floating static route is meant to sit in reserve and appear only when the preferred route is unavailable. Since the OSPF default route is active and has a better administrative distance, the backup route is not used yet.

This is a classic route-preference question. The key idea is not just that a static route exists, but that a higher-distance static route is intentionally designed to lose until the primary path disappears.

Answer

Because static default routes can never be used when OSPF is enabled.

Answer

Because the static default route must use a /24 mask instead of 0.0.0.0.

Answer

Because the next hop of a floating route must be a loopback address.

Question 9

A network engineer needs to automate the configuration of multiple Cisco IOS XE routers in a data center. The team requires a standard, vendor-neutral data modeling language to define the configuration parameters, and they need a protocol that uses XML-based remote procedure calls over SSH for secure, reliable configuration transactions. Which combination of technologies best meets these requirements?

Accepted Answer

Use YANG data models combined with NETCONF over SSH.. YANG is a standard, vendor-neutral data modeling language (RFC 6020) for defining configuration parameters, and NETCONF (RFC 6241) uses XML-based remote procedure calls (RPCs) over SSH for secure, reliable configuration transactions. This combination directly satisfies the requirement for a standard data model and XML-based RPCs over SSH, unlike RESTCONF which uses HTTPS and JSON/XML but not SSH.

Answer

Use YANG data models combined with RESTCONF over HTTPS.

Answer

Use CLI commands combined with NETCONF over SSH.

Answer

Use CLI commands combined with RESTCONF over HTTPS.

Question 10

A trunk is up between two switches, but traffic for VLAN 40 fails while other VLANs work. Which output item should be checked first?

Accepted Answer

Whether VLAN 40 is included in the allowed VLAN list on the trunk. The first thing to check is whether VLAN 40 appears in the trunk’s allowed VLAN list. In practical terms, this is a selective failure, not a total trunk failure. Since other VLANs are crossing successfully, the link is operational. That strongly suggests one VLAN is being excluded rather than the trunk being generally broken.

This is one of the most common VLAN troubleshooting patterns in switching.

Answer

Whether the router ID matches on both switches

Answer

Whether NetFlow is enabled on the VLAN

Answer

Whether NTP is synchronized on the switches

Question 11

Why is traffic to 10.10.10.200 using the EIGRP route instead of the OSPF route, given that both routes have the same prefix length?

Accepted Answer

Because EIGRP has a lower administrative distance than OSPF for the same prefix length.. When two routes have the same prefix length, the router uses administrative distance to choose the route with the lowest value. EIGRP has a default administrative distance of 90, while OSPF uses 110. Therefore, the EIGRP route is preferred.

Answer

Because OSPF routes are never installed when EIGRP is present.

Answer

Because OSPF can be used only for IPv6 routes.

Answer

Because EIGRP routes always have a smaller subnet mask than OSPF routes.

Question 12

Which TWO statements are true regarding the configuration and placement of standard and extended ACLs on a router?

Accepted Answer

Extended ACLs are typically placed closest to the source of the traffic.. Extended ACLs evaluate multiple criteria (source/destination IP, port, protocol), so placing them closest to the source prevents unwanted traffic from consuming bandwidth across the network. Option C is correct because a wildcard mask of 0.0.0.0 means all 32 bits must match, matching a single host. Option A is incorrect—standard ACLs are placed closest to the destination, not the source. Option D is incorrect—a wildcard mask of 255.255.255.255 matches any address (ignores all bits), not all bits. Option E is incorrect—extended ACLs placed near the destination would not conserve bandwidth; they should be near the source.

Answer

Standard ACLs are typically placed closest to the source of the traffic.

Answer

A wildcard mask of 255.255.255.255 in an ACL matches all bits of the IP address.

Answer

Extended ACLs should be placed on the interface closest to the destination to filter traffic before it reaches the final segment.

Question 13

Which TWO DHCP snooping trust states are valid on a Cisco switch? (Choose two.)

Accepted Answer

Trusted. DHCP snooping is a security feature that filters untrusted DHCP messages on a switch. The only two valid trust states are 'trusted' and 'untrusted'. A trusted port is typically an uplink to a legitimate DHCP server, while an untrusted port is a downstream port where DHCP client messages are expected and server-originated messages are blocked.

Answer

Secure

Answer

Authorized

Answer

Relay

Question 14

Which security concept is most closely associated with ensuring data has not been altered in an unauthorized way?

Accepted Answer

Integrity. The concept is integrity. In plain language, integrity is about making sure data remains accurate and trustworthy and that unauthorized changes can be detected or prevented. If confidentiality is about stopping the wrong people from seeing data, integrity is about stopping the wrong people from changing it. Availability, meanwhile, focuses on access to systems and services when needed.

This distinction matters because CCNA questions often group security vocabulary together and rely on candidates to separate them cleanly. Integrity is not the same as authentication or accounting, and it is not simply about whether a service is online. It specifically focuses on the correctness and trustworthiness of data or system state. That is why integrity is the correct answer here.

Answer

Availability

Answer

Accounting

Answer

Confidentiality

Question 15

A router pair is directly connected, but they do not become OSPF neighbors. IP addressing and area assignment are correct. What is the most likely cause?

Accepted Answer

OSPF network type mismatch on the connected interfaces. OSPF network type mismatch is a frequent reason for adjacency failure when basic IP and area settings are correct. If one side is configured as broadcast and the other as point-to-point, the hello timers, neighbor discovery behavior, and designated router election rules diverge, preventing neighbor formation. Unlike process IDs (which are locally significant), a mismatch in network type directly affects how OSPF hellos are processed. This is a well-known L2/L3 misconfiguration that must be checked alongside router‑ID and authentication parameters.

Answer

Duplicate default routes on both routers

Answer

Missing VLAN trunking on the link

Answer

The OSPF process IDs are required to match