CCNA Practice Test 3 — 30 Questions

Question 1

A host is configured with 10.1.1.34/30. Which address is the broadcast address for its subnet?

Accepted Answer

10.1.1.35. A /30 subnet has a block size of 4. In practical terms, the last-octet blocks are 0–3, 4–7, 8–11, and so on. Because 34 falls within the 32–35 block, the broadcast address is the last address in that block: 10.1.1.35.

This question tests whether you can identify the correct subnet block before choosing the broadcast address.

Answer

10.1.1.31

Answer

10.1.1.32

Answer

10.1.1.36

Question 2

Which two statements accurately describe the relationship between a network address and a broadcast address in IPv4 subnetting?

Accepted Answer

The network address is the first address in the subnet block.. The network address identifies the beginning of the subnet block, and the broadcast address identifies the final address in that block. In practical terms, both are reserved and are not assigned to ordinary hosts. The usable host range falls between them.

This is a very basic subnetting truth, but it is foundational for every other addressing calculation.

Answer

Both addresses are normal host addresses that can be assigned to users.

Answer

The broadcast address always becomes the default gateway.

Answer

These concepts exist only in IPv6 and not IPv4.

Question 3

Which static route on R1 sends all unknown IPv4 destinations to next-hop address 192.0.2.1?

Accepted Answer

ip route 0.0.0.0 0.0.0.0 192.0.2.1. A quad-zero route is the IPv4 default route. It matches destinations that do not have a more specific entry in the routing table.

Answer

ip route 0.0.0.0 255.255.255.255 192.0.2.1

Answer

ip route 255.255.255.255 0.0.0.0 192.0.2.1

Answer

ip default-gateway 192.0.2.1

Question 4

An API client sends a valid GET request and receives an HTTP 200 response. What does that indicate?

Accepted Answer

The request was successful. HTTP 200 indicates a successful request. For a GET operation, it generally means the server successfully returned the requested resource representation.

Answer

The resource was deleted successfully

Answer

Authentication permanently failed

Answer

The server requires a reboot

Question 5

Based on the exhibit, what is the most likely reason the PPP link is down?

Accepted Answer

The serial interfaces use different encapsulations.. The PPP link is down because the two ends are configured for different encapsulations. In practical terms, one side is using PPP and the other is using HDLC, so the devices are not speaking the same data-link protocol on the serial link. Until those encapsulations match, the link cannot come up correctly at the data-link layer.

This is a classic WAN troubleshooting pattern that fits well into simulation-style exam coverage.

Answer

PPP requires CAPWAP on both routers.

Answer

The routers must run BGP before PPP can establish.

Answer

Serial links can use only OSPF, not PPP.

Question 6

What is the main purpose of this configuration?

ipv6 route 2001:db8:100::/64 GigabitEthernet0/0

Accepted Answer

It creates a specific IPv6 static route to 2001:db8:100::/64 out GigabitEthernet0/0.. This configuration creates an IPv6 static route to a specific destination prefix through the named outgoing interface. In practical terms, the router is being told exactly how to reach that remote IPv6 network. This is not a default route and not a dynamic-routing statement. It is a manually defined path to one destination prefix.

The key concept is recognizing the difference between a specific static route and a default route.

Answer

It enables OSPFv3 on GigabitEthernet0/0.

Answer

It creates an IPv6 default route.

Answer

It converts the interface into a tunnel.

Question 7

A host is configured with 192.168.10.129/25. Which subnet contains that host?

Accepted Answer

192.168.10.128/25. A /25 divides the /24 into two blocks: 0–127 and 128–255. In practical terms, 192.168.10.129 belongs to the upper half, so the containing subnet is 192.168.10.128/25.

This is a simple subnet-boundary question, but it is designed to confirm that you can identify the correct half of the /24 quickly and confidently.

Answer

192.168.10.0/25

Answer

192.168.10.64/25

Answer

192.168.10.192/25

Question 8

A security team wants device administrators to log in with individual named accounts instead of sharing one generic admin account. Which security objective does that most directly improve?

Accepted Answer

Accountability for administrative actions. It most directly improves accountability. In practical terms, when each administrator has an individual account, the organization can tie actions to specific people rather than to one shared identity. That makes investigation, auditing, and operational review much more meaningful.

This also supports better access-control hygiene overall, but the clearest direct benefit is being able to identify who actually performed an administrative action.

Answer

Automatic VLAN assignment for management traffic

Answer

Route summarization efficiency

Answer

Wireless roaming performance

Question 9

An engineer is allowed to log in to a router but cannot enter configuration mode. Which AAA function most directly explains that outcome?

Accepted Answer

Authorization. Authorization most directly explains the outcome. In practical terms, the user has already passed authentication because login succeeded, but the permissions assigned to that identity do not allow configuration-level actions. This is exactly the sort of role separation authorization is meant to enforce.

This is a good example of why authentication and authorization are not the same thing.

Answer

Authentication

Answer

Accounting

Answer

DNS

Question 10

A host is configured as 10.20.30.95/27. Which address is the network address of its subnet?

Accepted Answer

10.20.30.64. A /27 uses blocks of 32 addresses. In plain language, the ranges in the last octet are 0–31, 32–63, 64–95, 96–127, and so on. Since the host address ends in 95, it belongs to the 64–95 block. The first address in that block is the network address, which is 10.20.30.64.

This is a classic subnet-boundary question because it tests whether you can identify the containing block and then choose the first address in that block as the network address.

Answer

10.20.30.32

Answer

10.20.30.95

Answer

10.20.30.96

Question 11

A multilayer switch must route traffic between VLAN 10 and VLAN 20. Which condition is required for that to happen?

Accepted Answer

SVIs for the VLANs plus Layer 3 routing enabled on the switch. Inter-VLAN routing on a multilayer switch depends on having functional Layer 3 gateway interfaces for the VLANs and routing enabled on the switch. In plain language, the switch needs a routed brain for each VLAN, usually in the form of SVIs, and it must actually be operating as a Layer 3 device rather than only as a pure Layer 2 switch. Without those conditions, traffic may switch inside a VLAN but cannot be routed between different VLANs.

This is a core CCNA design idea because people often assume creating VLANs alone automatically gives them inter-VLAN communication. In reality, VLANs create separation, and routing is what reconnects them under controlled conditions. A trunk between switches can carry VLAN traffic, but it does not itself perform Layer 3 routing between the VLANs. The correct answer is the requirement that makes the switch act as the gateway between VLANs.

Answer

All ports in both VLANs configured as trunks

Answer

A separate OSPF process on every access port

Answer

Port security disabled on every edge port

Question 12

Two switches are connected via an IEEE 802.1Q trunk. Hosts in VLAN 30 on opposite sides cannot communicate, yet hosts in VLAN 10 communicate normally. Both switches have VLAN 30 in their VLAN database, and the trunk link is operational. What is the most likely cause?

Accepted Answer

VLAN 30 is pruned or not allowed on one side of the trunk. If a VLAN is not allowed on one side of the trunk, frames for that VLAN are dropped even though other VLANs continue to work. Option A correctly identifies that VLAN 30 is either pruned or missing from the allowed list on one end. Option B is wrong because the native VLAN only affects untagged frames and would not cause the filtering of a tagged VLAN like VLAN 30. Option C is incorrect because STP can block individual VLANs per port, but it does not block all VLANs on a trunk due to a single VLAN’s issue—only the affected VLAN would be blocked. Option D is invalid because converting the trunk to access mode would break all VLAN trunking, including the working VLAN 10.

Answer

The native VLAN must be set to 30

Answer

STP blocks all VLANs on the trunk when one VLAN fails

Answer

The trunk must be changed to access mode for VLAN 30

Question 13

Based on the exhibit, what is the most likely reason the PPP link is failing to authenticate?

Accepted Answer

The PPP authentication credentials do not match between the two sides.. The most likely reason is a credentials mismatch between the two sides of the PPP authentication setup. In practical terms, PPP authentication requires the peers to agree on the relevant identity and secret information. If those values do not align, the link may come up physically but authentication fails and the logical connection does not establish properly.

This is a very exam-relevant WAN troubleshooting scenario because it focuses on a realistic failure after the transport is already present.

Answer

The interfaces must use HDLC instead of PPP before authentication can work.

Answer

CHAP requires the routers to be in different IPv4 subnets.

Answer

PPP authentication works only over GRE tunnels.

Question 14

Drag and drop the following steps into the correct order to describe how data is encapsulated as it travels down the OSI model layers.

Accepted Answer

Application data is generated by the upper layers.. Data originates at the application layer as user data. The transport layer then encapsulates this data by adding a header (e.g., TCP or UDP) to create a segment. The network layer further adds an IP header to the segment, forming a packet. Next, the data link layer appends a frame header and trailer to the packet, resulting in a frame. Finally, the physical layer converts the entire frame into bits for electrical, optical, or radio transmission. This sequence follows the standard top-down encapsulation process in network communication.

Question 15

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a VLAN 10 subnet and enable DHCP relay for a remote client on VLAN 20.

Accepted Answer

1. Exclude addresses from the pool. 2. Configure the DHCP pool for VLAN 10 with network, default-router, and DNS. 3. Enable DHCP relay on the VLAN 20 interface. 4. Verify DHCP operations.. The correct sequence is to globally exclude IP addresses first, preventing the DHCP server from assigning reserved addresses. Then define the DHCP pool for VLAN 10 with network parameters, enable DHCP relay on the VLAN 20 interface so it forwards requests to the server, and finally verify the service is functioning. Options that place relay before pool or exclusions after pool misorder these essential configuration steps and deviate from recommended practice.

Answer

1. Enable DHCP relay on the VLAN 20 interface. 2. Configure the DHCP pool for VLAN 10. 3. Exclude addresses from the pool. 4. Verify DHCP operations.

Answer

1. Exclude addresses from the pool. 2. Enable DHCP relay on the VLAN 20 interface. 3. Configure the DHCP pool for VLAN 10. 4. Verify DHCP operations.

Answer

1. Configure the DHCP pool for VLAN 10. 2. Enable DHCP relay on the VLAN 20 interface. 3. Exclude addresses from the pool. 4. Verify DHCP operations.

Question 16

Which THREE statements correctly describe the configuration and verification of NAT, PAT, and static NAT?

Accepted Answer

To configure static NAT, use the command 'ip nat inside source static

'.. The 'ip nat inside source static' command creates a one-to-one permanent NAT mapping. Option B is correct because PAT is configured by adding the 'overload' keyword to a dynamic NAT statement that references an ACL and an interface, allowing many private addresses to share a single public IP with different port numbers. Option D is correct: dynamic NAT requires a NAT pool defined with 'ip nat pool' and an access list to identify the inside traffic to be translated. Option C is incorrect because 'show ip nat statistics' only displays counters and summary information, not the active translation entries; those are shown with 'show ip nat translations'. Option E is incorrect because 'show ip interface brief' does not show NAT translation mappings; verification of static NAT requires 'show ip nat translations'.

Answer

The command 'show ip nat statistics' displays the current active translations including inside and outside addresses.

Answer

To verify that static NAT is working, you should check the output of 'show ip interface brief' and look for the translated IP.

Question 17

Exhibit: An access switch shows Gi1/0/10 as err-disabled shortly after an IP phone and a workstation are connected through the same wall jack. What is the most likely cause?

Accepted Answer

The port security maximum is too low for the connected devices. With a phone and a PC on the same access port, the switch may legitimately see two MAC addresses. Port security set to a maximum of 1 causes a violation and can place the interface into err-disabled state.

Answer

The native VLAN is missing

Answer

BPDU Guard blocked the port because a workstation was attached

Answer

DHCP snooping denied the voice VLAN

Question 18

A host is configured with IP address 192.168.70.18/30. Which addresses belong to the same subnet block?

Accepted Answer

192.168.70.16 through 192.168.70.19. A /30 subnet has a block size of 4. In practical terms, the relevant blocks in the last octet are 0–3, 4–7, 8–11, 12–15, 16–19, and so on. Because 18 falls inside the 16–19 block, the subnet includes network address .16, usable hosts .17 and .18, and broadcast .19.

This question checks whether you can identify the correct /30 block and understand all addresses that fall inside it.

Answer

192.168.70.18 through 192.168.70.21

Answer

192.168.70.12 through 192.168.70.15

Answer

192.168.70.20 through 192.168.70.23

Question 19

A REST API call uses the GET method against a device inventory endpoint. What is the most likely intent of the call?

Accepted Answer

To retrieve information from the endpoint.. The most likely intent is to retrieve information, not to create or delete it. In practical terms, GET is commonly used when a client wants to read state or inventory data from an API endpoint. This is one of the most basic REST-style concepts in network automation.

The key is to associate method semantics with likely operational intent.

Answer

To delete the endpoint from the controller.

Answer

To replace the endpoint with a new resource.

Answer

To force the device into PPP mode.

Question 20

Exhibit: A host on VLAN 10 can ping the local SVI but not a server in VLAN 20. The Layer 3 switch has both VLAN interfaces up. What is the next item to verify first?

Accepted Answer

Whether the server in VLAN 20 has the correct default gateway. If the source host can reach its own default gateway, the local VLAN and access port are probably fine. The next practical check is whether the server in VLAN 20 has the correct IP address, mask, and default gateway configured.

Answer

Whether the switch should disable IP routing

Answer

Whether VLAN 10 should be the native VLAN

Answer

Whether the host should use a /8 mask instead of /24