CCNA Practice Test 30 — 15 Questions

Question 1

Which TWO statements are true regarding the configuration and placement of standard and extended ACLs on a router?

Accepted Answer

Extended ACLs are typically placed closest to the source of the traffic.. Extended ACLs evaluate multiple criteria (source/destination IP, port, protocol), so placing them closest to the source prevents unwanted traffic from consuming bandwidth across the network. Option C is correct because a wildcard mask of 0.0.0.0 means all 32 bits must match, matching a single host. Option A is incorrect—standard ACLs are placed closest to the destination, not the source. Option D is incorrect—a wildcard mask of 255.255.255.255 matches any address (ignores all bits), not all bits. Option E is incorrect—extended ACLs placed near the destination would not conserve bandwidth; they should be near the source.

Answer

Standard ACLs are typically placed closest to the source of the traffic.

Answer

A wildcard mask of 255.255.255.255 in an ACL matches all bits of the IP address.

Answer

Extended ACLs should be placed on the interface closest to the destination to filter traffic before it reaches the final segment.

Question 2

Which TWO DHCP snooping trust states are valid on a Cisco switch? (Choose two.)

Accepted Answer

Trusted. DHCP snooping is a security feature that filters untrusted DHCP messages on a switch. The only two valid trust states are 'trusted' and 'untrusted'. A trusted port is typically an uplink to a legitimate DHCP server, while an untrusted port is a downstream port where DHCP client messages are expected and server-originated messages are blocked.

Answer

Secure

Answer

Authorized

Answer

Relay

Question 3

Which security concept is most closely associated with ensuring data has not been altered in an unauthorized way?

Accepted Answer

Integrity. The concept is integrity. In plain language, integrity is about making sure data remains accurate and trustworthy and that unauthorized changes can be detected or prevented. If confidentiality is about stopping the wrong people from seeing data, integrity is about stopping the wrong people from changing it. Availability, meanwhile, focuses on access to systems and services when needed.

This distinction matters because CCNA questions often group security vocabulary together and rely on candidates to separate them cleanly. Integrity is not the same as authentication or accounting, and it is not simply about whether a service is online. It specifically focuses on the correctness and trustworthiness of data or system state. That is why integrity is the correct answer here.

Answer

Availability

Answer

Accounting

Answer

Confidentiality

Question 4

A router pair is directly connected, but they do not become OSPF neighbors. IP addressing and area assignment are correct. What is the most likely cause?

Accepted Answer

OSPF network type mismatch on the connected interfaces. OSPF network type mismatch is a frequent reason for adjacency failure when basic IP and area settings are correct. If one side is configured as broadcast and the other as point-to-point, the hello timers, neighbor discovery behavior, and designated router election rules diverge, preventing neighbor formation. Unlike process IDs (which are locally significant), a mismatch in network type directly affects how OSPF hellos are processed. This is a well-known L2/L3 misconfiguration that must be checked alongside router‑ID and authentication parameters.

Answer

Duplicate default routes on both routers

Answer

Missing VLAN trunking on the link

Answer

The OSPF process IDs are required to match

Question 5

Which two practices most improve safety when automating network changes? (Choose two.)

Accepted Answer

Testing changes in a lab or staging environment first. Testing and validation reduce risk before wide deployment, and version control with review/rollback supports controlled operations.

Answer

Running scripts directly in production without validation

Answer

Disabling backups so changes apply faster

Question 6

An engineer is troubleshooting an OSPF adjacency issue between two Cisco routers, R1 and R2, connected via GigabitEthernet0/0 on both sides. Hosts on R1's LAN cannot ping hosts on R2's LAN. The engineer checks the OSPF neighbor state on R1 and sees the adjacency is stuck in EXSTART/EXCHANGE. The router IDs are 1.1.1.1 on R1 and 2.2.2.2 on R2, and both routers have a network statement for their directly connected subnet. What is the most likely cause of this problem?

Accepted Answer

There is an MTU mismatch between R1 and R2 on the GigabitEthernet0/0 interfaces.. The EXSTART/EXCHANGE state indicates that OSPF neighbors have progressed past the 2-Way state and are attempting to exchange Database Description (DBD) packets. An MTU mismatch on the directly connected GigabitEthernet0/0 interfaces prevents successful DBD exchange because the interface with the smaller MTU drops the larger DBD packet, causing the adjacency to remain stuck in EXSTART/EXCHANGE. Options A and C are incorrect because passive-interface default and area mismatches prevent the adjacency from reaching EXSTART/EXCHANGE (they block Hello exchange), and option D is incorrect because conflicting router IDs would prevent adjacency formation entirely, not result in a stuck EXSTART/EXCHANGE state.

Answer

The passive-interface default command is blocking OSPF Hellos on GigabitEthernet0/0.

Answer

The OSPF area configured on the interface does not match between R1 and R2.

Answer

The router IDs 1.1.1.1 and 2.2.2.2 are conflicting with each other.

Question 7

A trunk link between two switches is up, but voice phones connected through one access switch no longer receive the correct voice VLAN treatment. Data users still pass traffic. Which area should be checked first?

Accepted Answer

Whether the voice VLAN is being carried and handled correctly across the switching path.. The first area to check is the end-to-end handling of the voice VLAN across the switching path. In practical terms, the data VLAN can still work while the voice VLAN experiences a forwarding, configuration, or policy problem. Because the phones depend on the correct voice VLAN behavior, that VLAN path should be examined first rather than assuming the whole trunk is broken.

This is a selective-services troubleshooting question. One class of traffic can fail even when ordinary user data still works.

Answer

Whether OSPFv3 neighbors are fully adjacent on the phone switch ports.

Answer

Whether the wireless controller has the correct guest SSID.

Answer

Whether BGP uses a lower metric than the static route.

Question 8

A switch displays the following output:

Interface        Status         VLAN
Gi1/0/5          connected      20
Gi1/0/6          notconnect     1
Gi1/0/24         trunk          trunk

Which interface is operating as an access port in VLAN 20?

Accepted Answer

Gi1/0/5. The output explicitly shows Gi1/0/5 in VLAN 20 and not operating as a trunk.

Answer

Gi1/0/6

Answer

Gi1/0/24

Answer

None of the interfaces

Question 9

A switch port connected to an IP phone and a PC should separate voice traffic from data traffic while still using one physical edge connection. Which feature best supports that design?

Accepted Answer

Voice VLAN. A voice VLAN best supports that design. In practical terms, a Cisco-style voice VLAN allows the switch to carry voice traffic separately from user data even though the phone and PC share the same physical access connection. This is a common enterprise edge design because it lets the phone use one VLAN while the downstream PC uses another.

The key point is separation of traffic types over one edge port, not trunking between switches or link aggregation.

Answer

EtherChannel

Answer

Native VLAN

Answer

Loop guard

Question 10

A company wants internal users to share one public IPv4 address for outbound Internet access, while keeping sessions separate. Which NAT approach best meets that requirement?

Accepted Answer

PAT overload. PAT is the correct approach because it allows many internal sessions to share one outside IPv4 address while distinguishing them by port numbers. In plain language, PAT gives the office an efficient many-to-one translation model that works well for ordinary user Internet access when public addresses are limited.

This is different from static NAT, which gives a fixed one-to-one mapping, and from dynamic NAT pools that usually rely on multiple public addresses. The correct answer is the translation method designed specifically for shared public-address use across many sessions.

Answer

Static NAT only

Answer

No NAT, because private IPv4 addresses are Internet-routable

Answer

DHCP relay

Question 11

Why does traffic to 172.31.80.10 use the RIP route (172.31.80.0/24) instead of the static route (172.31.0.0/16)?

Accepted Answer

Because the RIP /24 route is more specific than the static /16 route.. Traffic uses the RIP route because the static route is less specific than the RIP route. In practical terms, longest-prefix match is always evaluated first. Even though the static route is manually configured, the more specific RIP prefix wins because it describes the destination more precisely.

This is a strong route-selection item because it tests whether you can prioritize specificity ahead of route source preference.

Answer

Because RIP always overrides static routing.

Answer

Because static routes cannot be used for private IPv4 space.

Answer

Because the static route is automatically removed whenever RIP is enabled.

Question 12

A network technician is troubleshooting a connectivity issue between two hosts. Host A sends a web request to Host B. The technician captures packets on the link between the two hosts and sees the data as '01010101...'. At which layer of the OSI model is this data being transmitted, and what is the correct PDU name for this layer?

Accepted Answer

Physical layer; bits. The data shown as '01010101...' represents raw binary bits being transmitted over the physical medium. At the Physical layer (Layer 1), data is encoded as electrical signals, light pulses, or radio waves, and the PDU is called bits. This matches the description of the captured data.

Answer

Data Link layer; frames

Answer

Network layer; packets

Answer

Transport layer; segments

Question 13

A router has this command configured: `ip nat inside source static 192.168.1.50 203.0.113.50`. What is the main effect of this configuration?

Accepted Answer

It creates a permanent one-to-one translation between the inside host and a public address. This command creates a static NAT mapping between one inside local address and one inside global address. In plain language, the internal device at 192.168.1.50 will always appear as 203.0.113.50 to the outside world. That fixed relationship is useful when a particular internal host or service must be reachable consistently from outside networks.

This is different from PAT, which shares one public address across many sessions using ports. Static NAT is one-to-one and predictable. It does not dynamically pull from a pool in this syntax. The key idea is permanence: the same inside device is always mapped to the same outside address.

Answer

It enables PAT overload for all internal users

Answer

It blocks inbound access to the inside host permanently

Answer

It changes the host subnet mask to a public prefix

Question 14

A router learns the same prefix from both OSPF and EIGRP. Which route is installed by default?

Accepted Answer

The EIGRP route because it has the lower administrative distance. When identical prefixes are learned from different routing protocols, the router compares administrative distance first. EIGRP internal routes use AD 90, while OSPF uses AD 110.

Answer

The OSPF route because OSPF is link-state

Answer

The route with the lower metric value regardless of protocol

Answer

Both routes are always installed

Question 15

A switch port connected to a workstation is configured with sticky MAC learning and a maximum secure MAC count of 1. What is the main operational benefit of sticky learning in this case?

Accepted Answer

It dynamically learns a secure MAC address and can preserve it if the configuration is saved.. Sticky learning gives the convenience of dynamic discovery while still treating the learned address as a secure port-security entry. In practical terms, the switch can observe the first legitimate MAC address on the port and record it as a secure address without the administrator having to type that address manually. If the running configuration is later saved, that sticky entry can persist after a reload.

This is useful because it balances ease of deployment with access control. The maximum secure MAC count still matters, and port security is still active. Sticky learning does not replace port security; it works within it.

Answer

It disables the maximum secure MAC limit on the interface.

Answer

It automatically saves the running configuration to the startup configuration after learning the MAC address.

Answer

It prevents the port from ever generating a security violation.