CCNA Practice Test 34 — 15 Questions

Question 1

In a network running STP, SW2 became the root bridge for VLAN 10. Both SW1 and SW2 have the same bridge priority. Why did SW2 become the root?

Accepted Answer

Because SW2 has the lower bridge ID due to the lower MAC address.. SW2 became the root bridge because its bridge ID is lower. In practical terms, spanning tree elects the root bridge by comparing bridge IDs, which are based on priority plus MAC address. The device with the lowest bridge ID wins. In the exhibit, both switches use the same priority, so the tie is broken by the lower MAC address.

This is a classic STP interpretation question. Many learners focus only on priority, but if priorities match, the MAC address becomes decisive.

Answer

Because SW2 has the higher VLAN number configured.

Answer

Because SW2 has more trunk ports than SW1.

Answer

Because SW2 has the highest bridge priority.

Question 2

Two directly connected routers, R1 and R2, are configured with single-area OSPF in Area 0. The administrator notices that they are not forming a full OSPF neighbor adjacency. The exhibit displays relevant portions of the running configurations. What is the most likely cause of the problem?

Accepted Answer

R1's passive-interface default prevents OSPF hello packets from being sent on GigabitEthernet0/0.. The passive-interface default command on R1 sets all interfaces to passive by default, which prevents OSPF hello packets from being sent out GigabitEthernet0/0. Without hello packets, R1 cannot discover R2 or form a neighbor adjacency, even though the network command is correctly configured. This is the most likely cause because the exhibit shows R1's configuration includes passive-interface default without a corresponding no passive-interface GigabitEthernet0/0 statement.

Answer

The network command on R1 does not include the correct subnet mask.

Answer

The GigabitEthernet0/0 interface on R2 is administratively down.

Answer

The routers are configured with different OSPF area IDs.

Question 3

Which TWO commands would a network administrator use to verify that a client has received a valid IP address from a DHCP server and can resolve domain names to IP addresses?

Accepted Answer

ipconfig /all. (ipconfig /all) is correct because it displays the full TCP/IP configuration for all network adapters, including whether DHCP is enabled, the assigned IP address, subnet mask, default gateway, and the DHCP server address. This allows the administrator to confirm that the client received a valid IP address from the DHCP server. Option D (nslookup www.courseiva.com) is correct because it queries the configured DNS server to resolve the domain name to an IP address, verifying that name resolution is working. Option B (ping 127.0.0.1) only tests the local TCP/IP stack and does not verify DHCP assignment or DNS resolution. Option C (tracert 8.8.8.8) uses an IP address directly and does not test domain-name resolution. Option E (arp -a) displays the ARP cache, which is unrelated to DHCP or DNS.

Answer

ping 127.0.0.1

Answer

tracert 8.8.8.8

Answer

arp -a

Question 4

A switchport connected to another switch should carry multiple VLANs, but it was manually configured as an access port. What is the most likely operational result?

Accepted Answer

The link will not carry multiple VLANs as intended because an access port handles one VLAN only.. An access port is designed to carry only a single VLAN. If the link is intended to carry multiple VLANs, it must be configured as a trunk. The switch will not automatically convert the port to a trunk (B). The port remains a Layer 2 access port, not a routed Layer 3 interface (C). VLANs are not automatically summarized into a single prefix (D). The most likely result is that the link will not carry multiple VLANs as intended.

Answer

The switch automatically converts the access port into a proper trunk.

Answer

The port becomes a routed Layer 3 interface.

Answer

The VLANs are summarized into one prefix automatically.

Question 5

A PC in VLAN 30 must obtain an address from a DHCP server in VLAN 99. Which feature is required on the Layer 3 interface for VLAN 30?

Accepted Answer

DHCP relay. DHCP Discover messages are broadcasts and do not cross Layer 3 boundaries on their own. DHCP relay, commonly configured with ip helper-address, forwards the requests to a server on another subnet.

Answer

Port security

Answer

DHCP snooping

Answer

Dynamic ARP inspection

Question 6

Which service would a client most directly rely on to convert `server.example.com` into an IP address?

Accepted Answer

DNS. The client relies on DNS for name resolution. In plain language, DNS is the service that lets devices and users use readable names instead of memorizing numeric IP addresses. When the client needs to reach `server.example.com`, DNS helps translate that hostname into the IP-related information needed for actual communication.

This is different from DHCP, which supplies address configuration, and from NTP, which synchronizes time. It is also different from ARP, which resolves local IPv4 addresses to MAC addresses. The correct answer is the one associated specifically with hostname resolution.

Answer

ARP

Answer

NTP

Answer

CDP

Question 7

You are connected to R1, a Cisco ISR 4321 running IOS-XE. Configure SNMPv2c with a read-only community string 'public' and SNMPv3 with user 'admin' using SHA authentication and AES encryption. Ensure SNMP traps are sent to the management server at 203.0.113.10. Additionally, configure NetFlow export to destination 203.0.113.20 on UDP port 2055 using version 9. Verify your configuration with appropriate show commands. The current running-config is incomplete; you must add the missing commands.

Accepted Answer

snmp-server community public ro
snmp-server user admin snmp-group v3 auth sha cisco priv aes 128 cisco
snmp-server host 203.0.113.10 traps version 2c public
ip flow-export destination 203.0.113.20 2055
ip flow-export version 9. The initial config has only a basic SNMPv2c community string. To meet requirements: enable SNMPv3 with a user 'admin' using SHA authentication and AES 128-bit encryption. The correct command requires a group name and the 'v3' keyword, e.g., 'snmp-server user admin snmp-group v3 auth sha cisco priv aes 128 cisco'. Configure SNMP trap destination with 'snmp-server host 203.0.113.10 traps version 2c public'. For NetFlow, use 'ip flow-export destination 203.0.113.20 2055' and 'ip flow-export version 9'. Verify with 'show snmp' and 'show ip cache flow'. Option B incorrectly uses version 3 traps with a community string; version 3 requires a security name. Option C uses insecure MD5/DES56 instead of SHA/AES. Option D uses NetFlow version 5 instead of version 9.

Answer

snmp-server community public ro
snmp-server user admin snmp-group v3 auth sha cisco priv aes 128 cisco
snmp-server host 203.0.113.10 traps version 3 auth public
ip flow-export destination 203.0.113.20 2055
ip flow-export version 9

Answer

snmp-server community public ro
snmp-server user admin snmp-group v3 auth md5 cisco priv des56 cisco
snmp-server host 203.0.113.10 traps version 2c public
ip flow-export destination 203.0.113.20 2055
ip flow-export version 9

Answer

snmp-server community public ro
snmp-server user admin snmp-group v3 auth sha cisco priv aes 128 cisco
snmp-server host 203.0.113.10 traps version 2c public
ip flow-export destination 203.0.113.20 2055
ip flow-export version 5

Question 8

A switch port connected to an end host should forward traffic for one VLAN only and should not negotiate trunking. Which configuration approach best fits that requirement?

Accepted Answer

Configure the interface with `switchport mode access`. The best approach is to configure the interface as an access port. In plain language, this tells the switch that the interface is for a normal endpoint and should belong to one VLAN rather than carry multiple VLANs like a trunk. It also avoids reliance on dynamic trunk negotiation, which is usually unnecessary and potentially confusing for a user-facing connection.

This is a standard access-layer design principle. End hosts such as PCs and printers usually connect to access ports, not trunks. That is why the correct answer is the one centered on explicit access-port behavior.

Answer

Configure the interface with `switchport mode trunk`

Answer

Configure the interface with `switchport mode dynamic desirable`

Answer

Configure the interface with `no switchport`

Question 9

Why is a default route useful on a small branch router connected to a single upstream provider?

Accepted Answer

It provides a simple next hop for unknown destinations toward the upstream connection.. A default route is useful because it gives the branch a simple fallback next hop for destinations the router does not know specifically. In practical terms, the branch router does not need a full table of every external destination if all unknown traffic should go upstream. That keeps the design simple and efficient.

This is one of the most practical default-route use cases in small or edge networks.

Answer

It makes every route more specific.

Answer

It replaces the need for any interface addressing.

Answer

It forces all users into one VLAN.

Question 10

Two switches should form an LACP EtherChannel. One side is configured passive, and the other side is also passive. What is the most likely result?

Accepted Answer

The EtherChannel is unlikely to form because neither side initiates LACP negotiation.. If both sides are passive, the EtherChannel is unlikely to form because passive mode waits for the other side to initiate LACP negotiation. In plain language, both switches are listening, but neither is actively starting the conversation. Because neither side takes the active role, the bundle normally stays down or unformed unless one side is changed to active.

This is a classic LACP negotiation question. It reinforces the difference between valid pairings such as active/active or active/passive and the passive/passive pairing that usually fails to initiate negotiation.

Answer

The EtherChannel always forms because passive mode is stronger than active mode.

Answer

The link becomes a routed port automatically.

Answer

Both switches delete the port-channel configuration.

Question 11

A switchport is configured with sticky MAC learning and a maximum secure MAC value of 2. What is the main benefit of sticky learning in this situation?

Accepted Answer

It allows secure MAC addresses to be learned dynamically and used by port security.. Sticky MAC learning allows the switch to learn secure MAC addresses dynamically and treat them as port-security entries without the administrator typing them manually. In plain language, it combines some of the convenience of automatic learning with the control of port security. If the configuration is later saved, those learned entries can become persistent.

This is a common CCNA port-security concept because it shows how sticky learning works with, not instead of, port security. The correct answer is the one focused on dynamic secure learning and convenience, not on disabling the maximum limit or turning the port into a trunk.

Answer

It removes the maximum secure MAC limit automatically.

Answer

It converts the port into a trunk after two MAC addresses are learned.

Answer

It disables port security after the first reboot.

Question 12

A client can join a corporate SSID and authenticate successfully, but it consistently loses connectivity when moving between floors. Which area is most strongly suggested for deeper investigation?

Accepted Answer

Roaming and RF behavior between AP coverage areas. The strongest area for deeper investigation is wireless mobility and RF behavior between the AP coverage areas involved. In practical terms, the client can already authenticate and use the WLAN initially, so the issue is more likely tied to movement, signal transition, channel behavior, or roaming-related operation rather than basic SSID existence or initial authentication alone.

This is a mobility-troubleshooting question, not a simple association problem.

Answer

Whether the SSID is visible at all

Answer

Whether the host has a BGP autonomous system number

Answer

Whether the switch uses a smaller wildcard mask

Question 13

A user on a wireless guest network can associate successfully, obtains an IP address, but cannot reach the Internet. Which troubleshooting area should be examined first if the WLAN itself is working?

Accepted Answer

The post-association forwarding or policy path, such as guest routing or Internet access policy. If association and addressing are already successful, the first area to examine is the forwarding or policy path beyond simple WLAN join behavior. In practical terms, the client has passed the discovery, authentication, and addressing stages. The problem is now more likely to involve routing, gateway reachability, NAT, firewall policy, or guest-access restrictions rather than the SSID itself.

This question is about understanding which stage of the workflow has already succeeded.

Answer

The SSID broadcast name, because it must be wrong

Answer

The AP radio antenna type only

Answer

OSPFv3 area configuration on the laptop

Question 14

An EtherChannel uses LACP. One side is configured correctly, but the peer side has a different switchport mode on one of the member links. What is the most likely result?

Accepted Answer

The bundle may fail to form correctly because the member-link settings are inconsistent.. The most likely result is that the bundle will not form cleanly because EtherChannel requires member links to agree on important operational settings. In practical terms, LACP negotiation alone is not enough. The links also need compatible characteristics such as switchport mode, VLAN handling, speed, and duplex where relevant.

This is a common troubleshooting pattern. It tests whether you know that bundle membership depends on configuration consistency, not just on enabling LACP.

Answer

The switch automatically rewrites the peer configuration to match.

Answer

LACP converts the mismatched link into a routed interface automatically.

Answer

The mismatched link is placed in a spanning-tree blocking state.

Question 15

A monitoring system already collects Syslog and SNMP data. The network team now wants visibility into which applications or host conversations are driving link utilization. What is the strongest addition?

Accepted Answer

NetFlow. The strongest addition is NetFlow because it provides traffic-flow visibility. In practical terms, Syslog and SNMP are useful, but they do not directly answer detailed conversation-level questions such as which hosts, protocols, or flows are consuming the most bandwidth. NetFlow is designed to answer exactly that kind of question.

This is about choosing the right operational tool for the visibility gap.

Answer

Another SSID

Answer

PortFast

Answer

A larger wildcard mask

CCNA Practice Test 34 — 15 Questions

Exhibit

CCNA Practice Test 34 — 15 Questions

Exhibit