CCNA Practice Test 2 — 30 Questions

Question 1

A switch trunk is carrying several VLANs, but VLAN 99 traffic is failing. The trunk allowed list includes VLAN 99 on both sides. Which statement best explains why a VLAN can still fail even when it is allowed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Because the VLAN may still be absent, inactive, or otherwise not operational locally even if it is allowed on the trunk. A VLAN can still fail across a trunk even when it is allowed because the allowed list is only one part of the overall design. In plain language, a switch may permit the VLAN on the link, but if the VLAN does not actually exist locally, is not active, or if some other trunk characteristic is inconsistent, traffic can still fail. This is an important CCNA troubleshooting principle: one correct line of configuration does not guarantee the full end-to-end condition is correct.

Candidates often stop at the allowed VLAN list because it is visible in common show commands. However, VLAN presence, local status, and other trunk parameters still matter. The best answer is the one recognizing that permission on the trunk does not automatically prove the entire VLAN path is healthy.

Answer

Because allowing a VLAN on a trunk automatically disables it

Answer

Because VLANs can cross trunks only when PAT is enabled

Answer

Because VLAN 99 must always be the native VLAN

Question 2

A route to 10.10.10.0/24 is learned through two OSPF paths. Both have the same prefix length and the same administrative distance, but one path has a lower OSPF metric. Which path is preferred?

Accepted Answer

The path with the lower OSPF metric. The path with the lower OSPF metric is preferred. In practical terms, when the prefix and route source are the same, the router uses the routing protocol’s internal path-selection logic. For OSPF, the lower metric is the more attractive path.

This is a clean example of metric-based selection within one routing protocol. Administrative distance is not the deciding factor here because the source protocol is the same on both paths.

Answer

The path with the higher OSPF metric

Answer

Both paths equally, because the administrative distance is the same

Answer

Neither path, because two OSPF routes to the same prefix are invalid

Question 3

An IPv6 host successfully reaches neighbors on its local segment, but it cannot reach remote IPv6 destinations. The host has a global unicast address and a correct prefix length. Which missing item is the strongest suspect?

Accepted Answer

A usable default router or next-hop route for off-link IPv6 traffic. The strongest suspect is the absence of a usable default router learned through IPv6 router advertisements or equivalent configuration. While local connectivity works because the host can communicate on its own link, remote IPv6 destinations require a next hop off the local segment. Option B is wrong because IPv6-to-IPv4 NAT is unnecessary for native IPv6 communication and would not be the primary cause of off-link failure. Option C is wrong because a VLAN trunk on the host NIC is for carrying multiple VLANs, not for enabling off-link routing. Option D is wrong because a second global unicast address does not provide a default route; it only adds another local address.

Answer

A NAT rule translating IPv6 to IPv4

Answer

A VLAN trunk on the host NIC

Answer

A second global unicast address on the same interface

Question 4

Which TWO commands can a network technician use on a modern Linux host to verify the IP address configuration and test reachability to a remote server?

Accepted Answer

ip addr. The `ip addr` command (option A) is the modern Linux utility for displaying IP address configuration, replacing the deprecated `ifconfig`. The `ping` command (option D) uses ICMP Echo Request/Reply messages to test Layer 3 reachability to a remote server. `ifconfig` (option B) is deprecated and not expected for current certification exams; `tracert` (option C) is a Windows command; `nslookup` (option E) performs DNS lookups but does not verify IP configuration or connectivity.

Answer

ifconfig

Answer

tracert

Answer

nslookup

Question 5

Which TWO interface errors are most likely caused by a mismatch in duplex settings between two connected switches?

Accepted Answer

Runts. A duplex mismatch occurs when one switch operates at full duplex while the other operates at half duplex. On the half-duplex side, frames arriving while the interface is transmitting are considered collisions, causing the frame to be truncated into fragments (runts). On the full-duplex side, the switch does not detect collisions but may receive incomplete frames, which are counted as runts if they are less than 64 bytes. CRC errors also spike because the truncated or corrupted frames fail the Frame Check Sequence (FCS) validation.

Answer

Giants

Answer

Input errors

Answer

Output errors

Answer

Flaps

Question 6

A wireless client joins the correct SSID and gets an address in the correct employee subnet, but cannot reach only one internal application while everything else works. Which troubleshooting area is the strongest first target?

Accepted Answer

The path or policy specific to that application, since general employee connectivity already works.. The strongest first target is the application path or policy specific to that application because the client already has general connectivity: it joined the correct SSID, authenticated, and obtained an IP address in the employee subnet. A failure limited to one internal application indicates that basic WLAN join, DHCP, and overall routing are working; therefore, ACLs, firewall rules, DNS resolution for that service, or application-specific policies are the likely cause. Option B (SSID broadcast setting) is irrelevant because the client successfully joined the SSID and has connectivity. Option C (voice VLAN on the wired access port) is not a first target because the symptom involves a single data application, not voice, and the client is on the employee subnet, not a voice VLAN. Option D (OSPF router ID on the client) is invalid because client devices do not typically run OSPF; OSPF runs on routers, not wireless clients.

Answer

The SSID broadcast setting, because the client must not be joined correctly.

Answer

The voice VLAN on the wired access port connected to the AP uplink.

Answer

The OSPF router ID on the client device.

Question 7

A router learns the same destination prefix from OSPF and from a static route configured with administrative distance 90. Which route is preferred by default?

Accepted Answer

The static route with distance 90. The static route is preferred because its administrative distance of 90 is lower than OSPF’s default administrative distance of 110. In practical terms, when the prefix length is the same, the router compares route-source trust next. The lower administrative distance wins.

This question is important because many learners remember that static routes are often strong choices but forget that administrative distance can be tuned. Here, that tuning explicitly makes the static route more preferred than OSPF.

Answer

The OSPF route, because dynamic routes always beat static routes

Answer

Both routes equally, because the prefix is identical

Answer

Neither route, because duplicate information is dropped

Question 8

A small office uses PAT for user Internet access. What mechanism does PAT use to allow many users to share one public address while keeping their sessions distinct?

Accepted Answer

Use transport-layer port values to distinguish multiple inside sessions behind one outside address.. PAT (Port Address Translation) distinguishes multiple inside sessions by rewriting the source port number for each connection while using the same public IP address. This transport-layer port translation allows many internal hosts to share one outside address without conflict. The correct answer identifies the use of port numbers, which is the core mechanism. Increasing the NAT pool or using static NAT would not enable sharing of a single public address. Changing private IPs to be identical or disabling routes are irrelevant to PAT's operation.

Answer

Convert all inside hosts to the same private IP address.

Answer

Increase the size of the NAT pool to include multiple public addresses.

Answer

Configure static NAT mappings for each inside host.

Question 9

Based on the exhibit, why is traffic to 192.168.40.200 using the default route instead of the intended static route?

Accepted Answer

The static route next hop is unreachable or invalid for forwarding.. The intended static route is not being used because the next hop for that static route is not reachable from the current routing table. In practical terms, a route can be configured, but the router still needs a way to resolve and forward to the next-hop address. If that next hop is unreachable, the route may not be installed or usable, so traffic falls back to the default route instead.

This is a realistic troubleshooting pattern because the configuration line alone can look correct until you compare it with actual reachability.

Answer

Default routes always override static routes.

Answer

The destination must be configured as a /16, not a /24.

Answer

Static routes can be used only if OSPF is disabled.

Question 10

A host is configured as 192.168.50.130/25. Which address is the broadcast address for its subnet?

Accepted Answer

192.168.50.255. A /25 divides the /24 into two blocks: 0–127 and 128–255. In plain language, because the host ends in 130, it belongs to the upper half, which starts at 128 and ends at 255. The last address in that block is the broadcast address, so the broadcast is 192.168.50.255.

This is a classic subnetting pattern because it tests whether you can identify not just the subnet, but also the reserved last address in that subnet.

Answer

192.168.50.127

Answer

192.168.50.128

Answer

192.168.50.254

Question 11

Why is HTTPS usually preferred over HTTP when accessing a controller API?

Accepted Answer

Because HTTPS provides encrypted transport for API traffic.. HTTPS is preferred because it protects the communication with encryption while it crosses the network. In practical terms, controller APIs often carry tokens, credentials, device state, or configuration information that should not be exposed in clear text. HTTPS helps protect those requests and responses in transit.

This does not make HTTPS the same thing as JSON, nor does it remove the need for authentication. It is simply the more secure transport choice for sensitive API communication.

Answer

Because HTTPS automatically replaces authentication.

Answer

Because HTTPS is the only format that can carry JSON.

Answer

Because HTTP cannot carry controller data at all.

Question 12

Which WAN technology is most closely associated with establishing a direct point-to-point data-link connection between two routers over a serial link?

Accepted Answer

PPP. PPP is the WAN technology most closely associated with point-to-point serial connections between routers. In practical terms, it is a Layer 2 WAN encapsulation method commonly discussed in traditional serial WAN contexts. It supports features such as authentication and link negotiation that make it more flexible than older basic encapsulations.

This is one of the classic CCNA WAN topics.

Answer

CAPWAP

Answer

SNMP

Answer

STP

Question 13

A user reports that a laptop can connect to the correct SSID but repeatedly fails authentication when joining the WLAN. Which category of issue is most strongly indicated?

Accepted Answer

A security or authentication mismatch related to WLAN access. The strongest indication is a wireless security or authentication mismatch rather than a pure RF coverage problem. In practical terms, the laptop can already see and attempt to join the correct SSID, which means discovery is working. Repeated authentication failure points more directly to credentials, security settings, or authentication-policy alignment than to channel or signal absence.

This question is about recognizing the stage of failure. The client is finding the WLAN, but it is not being accepted onto it.

Answer

A missing OSPF router ID on the access point

Answer

A routed-port mismatch on the switch uplink

Answer

A DHCP relay problem on the client

Question 14

A network administrator is troubleshooting connectivity loss in a switched network. All switches run Rapid PVST+. A host connected to an access port on SwitchC can no longer reach the default gateway. The access port is configured with PortFast and BPDU Guard. The administrator checks the interface status and finds it in an err-disabled state. What is the most likely cause of this issue?

Accepted Answer

BPDU Guard detected a BPDU on a PortFast-enabled port and disabled it.. B is correct because BPDU Guard is designed to protect the spanning-tree topology by disabling a PortFast-enabled port if it receives a BPDU, placing the port in err-disabled state. Option A is incorrect: a root bridge election failure would not cause a port to err-disable; loops do not directly trigger this state without BPDU Guard. Option C is incorrect because PortFast and BPDU Guard work with all spanning-tree variants including Rapid PVST+. Option D is incorrect: a trunk misconfiguration alone would not cause err-disable unless BPDU Guard detects a BPDU on a PortFast port.

Answer

The root bridge election failed, causing a loop.

Answer

Rapid PVST+ is not compatible with PortFast.

Answer

The port is configured as a trunk but should be an access port.

Question 15

Which IPv6 address type is automatically created on an interface and used for communication on the local link only?

Accepted Answer

Link-local. Every IPv6-enabled interface generates a link-local address, typically in the FE80::/10 range. It is used for neighbor discovery, local communication, and next-hop resolution on the same link.

Answer

Global unicast

Answer

Unique local

Answer

Multicast

Question 16

A standard ACL and an extended ACL are both available for a design. Which requirement most strongly indicates that an extended ACL is needed?

Accepted Answer

The policy must distinguish traffic by destination, protocol, or port.. An extended ACL is most strongly indicated when the policy must match not just on source address, but also on destination, protocol, or port information. In practical terms, if the requirement is something like “block HTTP but allow SSH” or “deny traffic to one server but not another,” a standard ACL is too limited because it mainly matches only the source. Option B (matching only one source subnet) can be done with a standard ACL, so it does not demand an extended ACL. Option C (placement near destination) is a guideline for standard ACLs, not a reason to choose an extended ACL. Option D (IPv6) is irrelevant because the scenario explicitly states both ACL types are available and standard ACLs do not exist for IPv6—this question is about IPv4 ACLs.

Answer

The policy needs to match only one source subnet.

Answer

The ACL must be placed near the destination.

Answer

The network uses IPv6 instead of IPv4.

Question 17

Exhibit: R1 shows an OSPF neighbor stuck in EXSTART with R2 on a serial link. What is the most likely cause?

Accepted Answer

An interface MTU mismatch between the routers. When two OSPF routers stay in EXSTART, the first thing to suspect is an MTU mismatch. They can discover each other, but database exchange does not complete because the DBD packets do not agree on interface MTU.

Answer

An OSPF area mismatch

Answer

A duplicate router ID on R1 and R2

Answer

A missing default route on R2

Question 18

A branch office uses PAT for user Internet access. The administrator notices that inside users can browse out, but an internal server still cannot be reached consistently from outside. Which change is most appropriate?

Accepted Answer

Add a static NAT mapping for the server while leaving PAT in place for user traffic.. The most appropriate change is to add a static NAT mapping for the internal server while keeping PAT for ordinary user traffic. In practical terms, PAT solves the many-users-outbound problem by allowing shared use of a public address. But an inbound-published server needs a stable, predictable public identity. That requirement is different from the requirement for user browsing.

This is a common NAT design distinction. PAT and static NAT can coexist because they solve different problems. The best answer is the one that preserves PAT for users while giving the server a fixed public translation.

Answer

Replace PAT with DHCP relay.

Answer

Disable NAT entirely because PAT is preventing inbound routing.

Answer

Put the server in the native VLAN.

Question 19

A network administrator wants to secure remote CLI access to a Cisco router, moving beyond simple username/password authentication. Which approach best achieves this goal?

Accepted Answer

Use stronger or additional authentication controls to improve remote administrative access security. The goal is to strengthen authentication beyond a simple password. Cisco AAA (Authentication, Authorization, and Accounting) using TACACS+ or RADIUS provides stronger, centralized authentication. Secure Shell (SSH) with key-based or two-factor authentication also enhances security. Option A correctly describes this concept, while the other options either weaken security (B, D) or address access control via ACLs, which does not improve the authentication factor itself (C).

Answer

Replace SSH with Telnet to simplify troubleshooting

Answer

Configure an extended ACL to limit remote access to specific source IP addresses

Answer

Disable password authentication and rely solely on device location in the network

Question 20

A company wants to reduce the chance that unused switch ports can be exploited. Which action best aligns with that goal?

Accepted Answer

Administratively shut down unused switch ports. The best action is to administratively disable unused ports and apply hardening where appropriate. In plain language, an unused port is still a possible entry point if it remains active and unmonitored. Shutting it down reduces exposure and aligns with the broader principle of minimizing unnecessary attack surface. This is a simple but effective part of switch hardening.

Leaving unused ports active may feel convenient, but it creates opportunities for unauthorized connections. The correct answer is the one focused on disabling resources that are not needed rather than on unrelated technologies.

Answer

Convert all unused ports into trunk ports

Answer

Enable Telnet on all unused ports

Answer

Advertise every unused port into OSPF