CCNA Practice Test 31 — 15 Questions

Question 1

Which two practices most improve safety when automating network changes? (Choose two.)

Accepted Answer

Testing changes in a lab or staging environment first. Testing and validation reduce risk before wide deployment, and version control with review/rollback supports controlled operations.

Answer

Running scripts directly in production without validation

Answer

Disabling backups so changes apply faster

Question 2

An engineer is troubleshooting an OSPF adjacency issue between two Cisco routers, R1 and R2, connected via GigabitEthernet0/0 on both sides. Hosts on R1's LAN cannot ping hosts on R2's LAN. The engineer checks the OSPF neighbor state on R1 and sees the adjacency is stuck in EXSTART/EXCHANGE. The router IDs are 1.1.1.1 on R1 and 2.2.2.2 on R2, and both routers have a network statement for their directly connected subnet. What is the most likely cause of this problem?

Accepted Answer

There is an MTU mismatch between R1 and R2 on the GigabitEthernet0/0 interfaces.. The EXSTART/EXCHANGE state indicates that OSPF neighbors have progressed past the 2-Way state and are attempting to exchange Database Description (DBD) packets. An MTU mismatch on the directly connected GigabitEthernet0/0 interfaces prevents successful DBD exchange because the interface with the smaller MTU drops the larger DBD packet, causing the adjacency to remain stuck in EXSTART/EXCHANGE. Options A and C are incorrect because passive-interface default and area mismatches prevent the adjacency from reaching EXSTART/EXCHANGE (they block Hello exchange), and option D is incorrect because conflicting router IDs would prevent adjacency formation entirely, not result in a stuck EXSTART/EXCHANGE state.

Answer

The passive-interface default command is blocking OSPF Hellos on GigabitEthernet0/0.

Answer

The OSPF area configured on the interface does not match between R1 and R2.

Answer

The router IDs 1.1.1.1 and 2.2.2.2 are conflicting with each other.

Question 3

A trunk link between two switches is up, but voice phones connected through one access switch no longer receive the correct voice VLAN treatment. Data users still pass traffic. Which area should be checked first?

Accepted Answer

Whether the voice VLAN is being carried and handled correctly across the switching path.. The first area to check is the end-to-end handling of the voice VLAN across the switching path. In practical terms, the data VLAN can still work while the voice VLAN experiences a forwarding, configuration, or policy problem. Because the phones depend on the correct voice VLAN behavior, that VLAN path should be examined first rather than assuming the whole trunk is broken.

This is a selective-services troubleshooting question. One class of traffic can fail even when ordinary user data still works.

Answer

Whether OSPFv3 neighbors are fully adjacent on the phone switch ports.

Answer

Whether the wireless controller has the correct guest SSID.

Answer

Whether BGP uses a lower metric than the static route.

Question 4

A switch displays the following output:

Interface        Status         VLAN
Gi1/0/5          connected      20
Gi1/0/6          notconnect     1
Gi1/0/24         trunk          trunk

Which interface is operating as an access port in VLAN 20?

Accepted Answer

Gi1/0/5. The output explicitly shows Gi1/0/5 in VLAN 20 and not operating as a trunk.

Answer

Gi1/0/6

Answer

Gi1/0/24

Answer

None of the interfaces

Question 5

A switch port connected to an IP phone and a PC should separate voice traffic from data traffic while still using one physical edge connection. Which feature best supports that design?

Accepted Answer

Voice VLAN. A voice VLAN best supports that design. In practical terms, a Cisco-style voice VLAN allows the switch to carry voice traffic separately from user data even though the phone and PC share the same physical access connection. This is a common enterprise edge design because it lets the phone use one VLAN while the downstream PC uses another.

The key point is separation of traffic types over one edge port, not trunking between switches or link aggregation.

Answer

EtherChannel

Answer

Native VLAN

Answer

Loop guard

Question 6

A company wants internal users to share one public IPv4 address for outbound Internet access, while keeping sessions separate. Which NAT approach best meets that requirement?

Accepted Answer

PAT overload. PAT is the correct approach because it allows many internal sessions to share one outside IPv4 address while distinguishing them by port numbers. In plain language, PAT gives the office an efficient many-to-one translation model that works well for ordinary user Internet access when public addresses are limited.

This is different from static NAT, which gives a fixed one-to-one mapping, and from dynamic NAT pools that usually rely on multiple public addresses. The correct answer is the translation method designed specifically for shared public-address use across many sessions.

Answer

Static NAT only

Answer

No NAT, because private IPv4 addresses are Internet-routable

Answer

DHCP relay

Question 7

Why does traffic to 172.31.80.10 use the RIP route (172.31.80.0/24) instead of the static route (172.31.0.0/16)?

Accepted Answer

Because the RIP /24 route is more specific than the static /16 route.. Traffic uses the RIP route because the static route is less specific than the RIP route. In practical terms, longest-prefix match is always evaluated first. Even though the static route is manually configured, the more specific RIP prefix wins because it describes the destination more precisely.

This is a strong route-selection item because it tests whether you can prioritize specificity ahead of route source preference.

Answer

Because RIP always overrides static routing.

Answer

Because static routes cannot be used for private IPv4 space.

Answer

Because the static route is automatically removed whenever RIP is enabled.

Question 8

A network technician is troubleshooting a connectivity issue between two hosts. Host A sends a web request to Host B. The technician captures packets on the link between the two hosts and sees the data as '01010101...'. At which layer of the OSI model is this data being transmitted, and what is the correct PDU name for this layer?

Accepted Answer

Physical layer; bits. The data shown as '01010101...' represents raw binary bits being transmitted over the physical medium. At the Physical layer (Layer 1), data is encoded as electrical signals, light pulses, or radio waves, and the PDU is called bits. This matches the description of the captured data.

Answer

Data Link layer; frames

Answer

Network layer; packets

Answer

Transport layer; segments

Question 9

A router has this command configured: `ip nat inside source static 192.168.1.50 203.0.113.50`. What is the main effect of this configuration?

Accepted Answer

It creates a permanent one-to-one translation between the inside host and a public address. This command creates a static NAT mapping between one inside local address and one inside global address. In plain language, the internal device at 192.168.1.50 will always appear as 203.0.113.50 to the outside world. That fixed relationship is useful when a particular internal host or service must be reachable consistently from outside networks.

This is different from PAT, which shares one public address across many sessions using ports. Static NAT is one-to-one and predictable. It does not dynamically pull from a pool in this syntax. The key idea is permanence: the same inside device is always mapped to the same outside address.

Answer

It enables PAT overload for all internal users

Answer

It blocks inbound access to the inside host permanently

Answer

It changes the host subnet mask to a public prefix

Question 10

A router learns the same prefix from both OSPF and EIGRP. Which route is installed by default?

Accepted Answer

The EIGRP route because it has the lower administrative distance. When identical prefixes are learned from different routing protocols, the router compares administrative distance first. EIGRP internal routes use AD 90, while OSPF uses AD 110.

Answer

The OSPF route because OSPF is link-state

Answer

The route with the lower metric value regardless of protocol

Answer

Both routes are always installed

Question 11

A switch port connected to a workstation is configured with sticky MAC learning and a maximum secure MAC count of 1. What is the main operational benefit of sticky learning in this case?

Accepted Answer

It dynamically learns a secure MAC address and can preserve it if the configuration is saved.. Sticky learning gives the convenience of dynamic discovery while still treating the learned address as a secure port-security entry. In practical terms, the switch can observe the first legitimate MAC address on the port and record it as a secure address without the administrator having to type that address manually. If the running configuration is later saved, that sticky entry can persist after a reload.

This is useful because it balances ease of deployment with access control. The maximum secure MAC count still matters, and port security is still active. Sticky learning does not replace port security; it works within it.

Answer

It disables the maximum secure MAC limit on the interface.

Answer

It automatically saves the running configuration to the startup configuration after learning the MAC address.

Answer

It prevents the port from ever generating a security violation.

Question 12

Which single OSI model layer is responsible for both end‑to‑end reliable data delivery and segmenting data into smaller units?

Accepted Answer

Transport layer (Layer 4). The Transport layer (Layer 4) is the only OSI layer responsible for both end‑to‑end reliable data delivery (via protocols like TCP) and segmenting data into smaller units (segments). The Network layer (Layer 3) handles routing and packetizing but does not provide reliability. Therefore, only the Transport layer fulfills both requirements.

Answer

Data Link layer (Layer 2)

Answer

Network layer (Layer 3)

Answer

Session layer (Layer 5)

Answer

Transport layer (Layer 4) and Network layer (Layer 3)

Question 13

A network engineer is evaluating monitoring technologies for a large enterprise network that requires high-frequency, low-latency traffic data collection with support for custom fields. The solution must also support encryption and authentication to prevent tampering. Which technology best meets these requirements?

Accepted Answer

Implement streaming telemetry using gRPC with TLS and YANG data models.. Streaming telemetry using gRPC with TLS and YANG data models is correct because it provides high-frequency, low-latency push-based data collection, supports custom fields via YANG models, and ensures encryption and authentication through TLS. This meets all the requirements, unlike polling-based or unencrypted alternatives.

Answer

Configure SNMPv2c with community strings and polling every 30 seconds.

Answer

Deploy NetFlow v9 with custom flow records and SNMPv3 for encryption.

Answer

Use IPFIX with UDP export and add authentication via MD5 hashing.

Question 14

Why is HTTPS usually preferred over HTTP when accessing controller APIs?

Accepted Answer

Because HTTPS provides encrypted transport for sensitive API communication.. HTTPS is preferred because it protects the API traffic in transit with encryption. In plain language, controller APIs may carry credentials, tokens, device state, or configuration data, and sending that information in clear text over plain HTTP would expose it to interception. HTTPS helps protect that communication channel.

This does not make HTTPS a data format or an access policy by itself, but it is a major transport-security improvement. The correct answer is the one focused on secure transport for sensitive API traffic.

Answer

Because HTTPS provides better throughput for API responses

Answer

Because HTTPS replaces the need for authentication.

Answer

Because HTTPS is the only protocol that can carry JSON.

Question 15

A host address is 192.168.14.222/28. Which address is the broadcast address of its subnet?

Accepted Answer

192.168.14.223. A /28 subnet has a block size of 16. In practical terms, the fourth-octet blocks are 0-15, 16-31, and so on. Because 222 falls within the 208-223 block, the broadcast address is the last address in that block: 192.168.14.223.

This is a subnet-boundary question that depends on identifying the correct /28 block before choosing the broadcast address.

Answer

192.168.14.207

Answer

192.168.14.208

Answer

192.168.14.224