CCNA Practice Test 35 — 15 Questions

Question 1

A host uses subnet mask 255.255.255.224. How many total addresses exist in each subnet block?

Accepted Answer

32. The subnet mask 255.255.255.224 (/27) has 5 host bits, so each subnet has 2^5 = 32 total addresses. Option A (16) results from confusing /27 with /28 (4 host bits = 16). Option D (64) results from confusing /27 with /26 (6 host bits = 64). Option C (30) is the number of usable host addresses (32 - 2 = 30), not the total addresses asked for in the question.

Answer

16

Answer

30

Answer

64

Question 2

A host has the address 10.10.10.94/27. Which subnet contains that host?

Accepted Answer

10.10.10.64/27. A /27 mask creates subnets in blocks of 32 addresses. In plain language, that means the fourth-octet ranges are 0–31, 32–63, 64–95, 96–127, and so on. Since the host address ends in 94, it falls inside the 64–95 block. That means the subnet is 10.10.10.64/27.

This is a classic subnetting task because it checks whether you can move from prefix length to block size and then locate the host inside the correct range. The key skill is recognizing the increment boundary and not guessing based only on the nearest familiar address.

Answer

10.10.10.32/27

Answer

10.10.10.96/27

Answer

10.10.10.0/27

Question 3

Which term in the CIA triad refers to ensuring systems and data remain accessible when needed?

Accepted Answer

Availability. The term is availability. In plain language, availability means that authorized users should be able to reach systems, services, and data when they actually need them. If a service is down, overwhelmed, or otherwise unreachable, availability has been affected. This is different from confidentiality, which focuses on preventing unauthorized disclosure, and integrity, which focuses on preventing unauthorized change.

This distinction matters because the CIA triad appears often in security foundations and exam questions. Availability is not about whether data is secret or whether it has been altered; it is about whether the service is usable. That is why availability is the best answer here.

Answer

Integrity

Answer

Accounting

Answer

Confidentiality

Question 4

Why is a northbound API valuable to orchestration systems in a controller-based architecture?

Accepted Answer

It provides a defined software interface through which orchestration tools can interact with the controller.. A northbound API is valuable because it provides a defined software interface for orchestration systems to interact with the controller programmatically. Option B is incorrect because northbound APIs do not enable direct device-to-device communication; that is a function of the data plane. Option C is incorrect because northbound APIs are logical software interfaces, not physical cables or ports. Option D is also incorrect as it mischaracterizes the API as a hardware standard.

Answer

It allows network devices to communicate directly with each other without the controller.

Answer

It is a physical interface used to connect the controller to the orchestration system.

Answer

It is a physical cable standard for controller uplinks.

Question 5

A company wants unauthorized devices plugged into unused wall ports to have as little chance of gaining access as possible. Which action most directly supports that goal?

Accepted Answer

Administratively disable unused switch ports.. Administratively shutting down unused switch ports most directly supports the goal because it eliminates the access point entirely. Option B, converting unused ports into trunks, would actually increase risk by potentially allowing VLAN hopping and unauthorized traffic. Option D, removing VLAN assignments from active user ports, does not address unused ports and could disrupt legitimate users by forcing them into the default VLAN. Disabling unused ports is a simple and effective hardening measure that reduces attack surface.

Answer

Convert every unused port into a trunk.

Answer

Enable Telnet on unused ports for monitoring.

Answer

Remove all VLAN assignments from active user ports.

Question 6

A host address is 192.168.88.66/27. Which address is the network address of the subnet?

Accepted Answer

192.168.88.64. A /27 subnet has a block size of 32. In practical terms, the fourth-octet ranges are 0-31, 32-63, 64-95, and so on. Because 66 falls within the 64-95 block, the network address is 192.168.88.64.

This is a classic subnet-boundary calculation. The key step is identifying the correct block first.

Answer

192.168.88.32

Answer

192.168.88.95

Answer

192.168.88.96

Question 7

In a controller-based WLAN, what is the main job of the access point?

Accepted Answer

To provide the radio connection between wireless clients and the network. The main job of the access point is to provide the actual radio connection between wireless clients and the network. In practical terms, the controller may centralize policy and management, but the AP is still the device that transmits and receives the wireless frames in the local area.

This distinction matters because CCNA wireless questions often separate the controller’s management role from the AP’s RF and client-connectivity role.

Answer

To replace the wireless LAN controller entirely

Answer

To act as the default gateway for every wired VLAN

Answer

To perform OSPF route summarization for wireless users

Question 8

Which two statements accurately compare IPv4 private addresses and public addresses?

Accepted Answer

Private IPv4 addresses are not directly Internet-routable.. Private IPv4 addresses are intended for internal use and are not directly routable on the public Internet. In plain language, they are designed for use inside organizations, homes, and other local environments without consuming globally unique public space. Public addresses, by contrast, are intended to be unique and routable across the Internet. This is one of the main reasons NAT became so common in IPv4 environments.

CCNA questions often test this distinction because learners sometimes confuse “valid inside a LAN” with “routable everywhere.” Private addressing is extremely useful, but it does not eliminate the need for translation or public addressing when reaching the Internet. The two correct statements are the ones that preserve that basic separation between internal-use ranges and globally routable address space.

Answer

Private IPv4 addresses always require OSPF to function inside a LAN.

Answer

Public IPv4 addresses cannot exist on Internet-facing devices.

Answer

Private and public IPv4 addresses are both automatically translated by ARP.

Question 9

A host with address 10.0.0.130/25 needs to identify its subnet. Which subnet is correct?

Accepted Answer

10.0.0.128/25. A /25 uses blocks of 128 addresses. In plain language, that means the fourth-octet ranges are 0–127 and 128–255. Since the host address ends in 130, it belongs to the upper block, which means the subnet is 10.0.0.128/25.

This kind of question is a staple of subnetting because it tests whether you can identify the correct subnet boundary from the prefix and host address. Once you recognize the /25 split, the answer becomes straightforward.

Answer

10.0.0.0/25

Answer

10.0.0.64/25

Answer

10.0.0.192/25

Question 10

Why is NTP especially valuable when a network uses centralized Syslog servers?

Accepted Answer

Because synchronized clocks make log timestamps easier to correlate across devices. NTP is especially valuable because centralized logs are much easier to interpret when device clocks are synchronized. In plain language, if multiple routers and switches send messages to one logging server but each device believes a different time, the event sequence becomes confusing. NTP helps align those clocks so the timestamps in the logs are consistent and the team can reconstruct incidents more accurately.

This is a practical operations concept rather than a syntax question. Syslog solves the collection problem, and NTP solves the time-correlation problem. Together they make logs more useful than either one alone. That is why the best answer focuses on timestamp consistency rather than on routing, VLAN, or NAT behavior.

Answer

Because NTP converts Syslog into a routing protocol

Answer

Because NTP automatically creates DHCP pools

Answer

Because NTP eliminates the need for a Syslog server

Question 11

What is a common requirement for interfaces to successfully bundle into an EtherChannel?

Accepted Answer

All member interfaces must use matching speed, duplex, and trunk/access settings. EtherChannel members must have compatible operational and administrative settings, including speed, duplex, and switchport mode.

Answer

Each interface must belong to a different VLAN

Answer

Only odd-numbered switch ports can be bundled

Answer

Each interface must have a different STP path cost

Question 12

A user on VLAN 10 reports that they cannot ping the default gateway at 192.168.10.1 from their PC with IP 192.168.10.50/24. The switch interface connecting to the PC is up/up, and the PC shows a valid IP configuration. What is the most likely cause of this connectivity failure?

Accepted Answer

Configure an SVI for VLAN 10 with an IP address in the 192.168.10.0/24 subnet.. The PC and default gateway are on the same subnet (192.168.10.0/24), but the switch lacks a Layer 3 interface for VLAN 10. Without an SVI (Switch Virtual Interface) configured with an IP address in that subnet, the switch cannot route traffic to the gateway or respond to ARP requests from the PC, breaking connectivity even though the access port is up/up.

Answer

Change the switchport mode to trunk to allow VLAN 10 traffic.

Answer

Change the PC's IP address to a different subnet, such as 192.168.20.0/24.

Answer

Recreate VLAN 10 and reassign the port to it.

Question 13

An EtherChannel between two switches is configured for LACP. One switch shows the member interfaces as bundled, while the other shows them as individual interfaces. Which explanation is most likely if both sides are using LACP?

Accepted Answer

The member interface settings do not match closely enough for bundling, even though both sides use LACP.. The most likely explanation is that some other interface settings do not match, even though both sides are using the same EtherChannel protocol. In practical terms, LACP alone is not enough. The candidate member interfaces also need to agree on characteristics such as speed, duplex, switchport mode, allowed VLANs where relevant, and other channel-related settings. If they do not, one side may treat the links as separate instead of bundling them.

This is a common troubleshooting pattern because it tests whether you know that EtherChannel success depends on more than just the negotiation protocol name.

Answer

LACP always requires one side to use PAgP as a backup.

Answer

EtherChannel cannot operate on switch trunks.

Answer

One switch must disable STP before EtherChannel can form.

Question 14

A switch shows a clock that is several minutes off from other devices even though an NTP server has been configured. Which issue is the most likely cause?

Accepted Answer

The NTP server is unsynchronized or unreachable. NTP requires IP reachability to the time source. If the NTP server is unreachable due to routing or ACL issues, the switch falls back to its local clock, causing drift. Option A is correct. Option B is wrong because Syslog has no effect on NTP synchronization. Option C is incorrect because NTP does not require a trunk port; it can operate over any VLAN with IP connectivity. Option D is false because DNS is only needed if the NTP server is specified by hostname; the server can be reached by IP address without DNS.

Answer

The device must run Syslog before NTP can sync

Answer

NTP requires a trunk port on the management VLAN

Answer

The clock can sync only if DNS is configured

Question 15

R1 and R2 are directly connected and both configured for OSPF area 0. The IP addresses are correct, but the routers do not become neighbors. What is the most likely cause?

Accepted Answer

The OSPF network types on the interfaces do not match.. The most likely cause is an OSPF network type mismatch. In practical terms, both routers are on the same IP segment and both are trying to use OSPF in the same area, but they do not agree on the type of OSPF network the interface represents. That matters because OSPF behavior changes depending on the network type, including how neighbors are discovered and how adjacencies are formed.

This is a classic exam-style troubleshooting case because the obvious items look correct: IP addressing works and the area matches. But a mismatch between point-to-point and broadcast expectations can still stop the relationship from forming cleanly. That makes network type mismatch the strongest answer here.

Answer

The routers need matching hostnames to exchange LSAs.

Answer

The /30 subnet is too small for OSPF to operate.

Answer

The interfaces must be converted into switch trunks.