CCNA Practice Test 35 — 15 Questions

Question 1

A network engineer configures a static route: ip route 192.168.10.0 255.255.255.0 10.1.1.2. The next hop 10.1.1.2 is reachable via OSPF. Later, the engineer notices that the route to 192.168.10.0/24 has disappeared from the routing table. What is the most likely cause?

Accepted Answer

The OSPF route to 10.1.1.0/30 has been lost, making the next-hop address 10.1.1.2 unresolvable.. A recursive static route uses a next-hop IP address; the router must have a route that resolves that next hop. If the OSPF route to the 10.1.1.0/30 network is lost, the next-hop 10.1.1.2 becomes unreachable, and the static route is withdrawn from the routing table. None of the other explanations account for the route disappearance given the scenario.

Answer

The static route has a higher administrative distance than OSPF, so OSPF's route to 192.168.10.0/24 replaced it.

Answer

The static route uses a next-hop IP address that is not directly connected, which is unsupported on this platform.

Answer

A routing loop caused by recursive lookups has suppressed the static route to prevent loops.

Question 2

R1 loses its route to 192.168.20.0/24 whenever R2's GigabitEthernet0/0 interface flaps. The network engineer has configured a floating static route with an administrative distance of 200. The OSPF route has an AD of 110. After R2's G0/0 interface recovers, the floating static route appears in the routing table instead of the OSPF route. What should the technician do next?

Accepted Answer

Check the carrier delay timers on R2's GigabitEthernet0/0 interface.. The next step is to check the carrier delay timers on R2's G0/0 interface. If a high debounce (carrier-delay) timer is configured, the interface remains down for several seconds after physical link recovery. During this time OSPF neighbor adjacency cannot form, so the floating static route (which is already installed) remains in the table. This is a Layer 2/Layer 1 timing issue that directly impacts OSPF convergence.

Answer

Adjust the administrative distance of the floating static route to 201.

Answer

Clear the IP routing table and reset the OSPF process on R1.

Answer

Verify that the MTU on R1 and R2's GigabitEthernet0/0 interfaces match.

Question 3

A network engineer configures OSPF on R1 and R2 over a point-to-point link. The interfaces are in the same OSPF area, with matching hello and dead timers, and are on the same IP subnet. However, the command show ip ospf neighbor on both routers shows no neighbors. A firewall sits between R1 and R2. What should the technician do next?

Accepted Answer

Check the firewall rules to verify that multicast address 224.0.0.5 is not being blocked.. OSPF uses multicast address 224.0.0.5 for hello packets on all OSPF network types except non-broadcast. With a firewall in the path, the most common reason for a complete lack of neighbor discovery, even when the interface-level OSPF parameters match, is that the firewall is blocking this multicast traffic. Checking the firewall rules directly addresses the most likely layer-3/layer-4 filtering issue and is a non-intrusive first step before examining deeper OSPF-specific settings.

Answer

Verify that the OSPF router IDs on R1 and R2 are unique.

Answer

Check the OSPF network type on the connecting interfaces.

Answer

Verify that the MTU on the connecting interfaces matches.

Question 4

A network engineer adds a loopback interface Lo0 with IP address 172.16.0.1/32 to router R1. After restarting the OSPF process, the OSPF router-ID changes from 10.1.1.1 to 172.16.0.1, and the neighbor relationship with R2 resets. What should the technician do next to prevent this disruption the next time a loopback is added?

Accepted Answer

Configure a static router-id using the router-id command under the OSPF process. Configuring a static router-id under the OSPF process ensures the router-ID never changes due to interface IP changes or loopback additions. This directly addresses the root cause of the adjacency reset—dynamic router-ID re-election.

Answer

Configure passive-interface Lo0 under the OSPF process

Answer

Set a higher OSPF priority on the router’s interfaces

Answer

Configure the OSPF area as a stub area

Question 5

Refer to the exhibit. A network engineer notices that traffic from R1 to the 10.1.0.0/16 network is taking a longer path than expected despite OSPF being the only routing protocol. The engineer examines the OSPF LSDB on R1 to investigate. Based on the output, what is the most likely cause of the suboptimal routing?

Accepted Answer

The ABR is configured with the 'area 1 range 10.1.0.0 255.255.0.0 cost 1000' command.. The exhibit shows three Type 3 summary LSAs from the same ABR (10.1.1.1). Two of them have metrics 10 and 20, which are consistent with normal OSPF intra-area path costs. The LSA for 10.1.0.0/16 has metric 1000, an abnormally high value. This indicates that the ABR is injecting this summary with a manually configured cost, typically done with the 'area range cost ' command. Global reference bandwidth changes would affect all metrics equally, and route filtering does not alter metric values. External route metric types are unrelated to Type 3 inter-area summaries.

Answer

The reference bandwidth has been misconfigured on R1, causing the OSPF cost calculation to be inflated for some links.

Answer

The ABR is filtering the 10.1.0.0/16 route from Area 1 into Area 0, causing the router to recalculate the metric higher.

Answer

The metric-type for OSPF external routes has been set to type 2, causing the metric to be inflated to 1000 for the 10.1.0.0/16 prefix.

Question 6

A technician is troubleshooting an OSPF network. On a broadcast segment, R1 is the DR and R2 is the BDR. R1's interface GigabitEthernet0/0 is shut down for maintenance. The technician expects that R2 will assume the DR role, but instead a new DR election occurs and another router is elected DR. What is the most likely cause?

Accepted Answer

R2 has an OSPF priority of 0.. When the DR fails on a broadcast OSPF network, the BDR normally takes over as DR and a new BDR is elected. However, if the BDR's OSPF priority is set to 0, the router is ineligible to become DR or BDR. With the DR down and the BDR ineligible, the remaining routers must hold a fresh election, and the router with the highest non-zero priority (or highest router-ID if priorities tie) becomes the new DR. Therefore, R2's priority of 0 explains why it did not become DR and a new election was triggered.

Answer

The OSPF hello and dead intervals on R2 do not match those of other routers on the segment.

Answer

R2 has an OSPF priority of 255.

Answer

The OSPF network type on the segment was changed to point-to-point.

Question 7

After configuring a static discard route with the command 'ip route 0.0.0.0 0.0.0.0 Null0 254' on R1, a network engineer finds that traffic to destinations that are not in the routing table is still being forwarded out to the ISP instead of being dropped. What is the most likely cause?

Accepted Answer

The ISP static default route has an administrative distance of 1, which is lower than the administrative distance of 254 set for the Null0 route.. The static default route via the ISP has an administrative distance of 1 (either explicitly configured or inherited as a static route), which is lower than the Null0 route's AD of 254. Because the router always prefers the route with the lowest administrative distance for the same destination, the ISP route is installed in the forwarding table, and the discard route is never used. For the discard route to be selected, its AD would need to be less than or equal to the ISP route's AD, or the ISP route must be removed.

Answer

The Null0 interface is administratively shut down.

Answer

The address 0.0.0.0/0 is an invalid destination for a static route because it is not a real network.

Answer

The static discard route must include a next-hop IP address instead of specifying Null0 as the interface.

Question 8

A router output shows this neighbor state:

Neighbor ID 10.1.1.1   State FULL/DR   Address 192.168.12.1

What does the FULL/DR state indicate?

Accepted Answer

The neighbor relationship is complete and the neighbor is the DR on that segment. FULL means the OSPF adjacency is fully formed. The /DR suffix indicates that the listed neighbor is the Designated Router for that multiaccess segment.

Answer

The local router is the DR and adjacency formation has failed

Answer

The routers are exchanging only link-state requests

Answer

The neighbor has been learned through BGP redistribution

Question 9

A network technician is troubleshooting a router-on-a-stick configuration. R1 has sub-interface G0/0.10 with encapsulation dot1q 10 and IP 192.168.10.1/24, and sub-interface G0/0.20 with encapsulation dot1q 20 and IP 192.168.20.1/24. Hosts in VLAN 10 cannot reach hosts in VLAN 20. The physical interface G0/0 is up and no shutdown. Both sub-interfaces show up/up. What should the technician do next?

Accepted Answer

Verify the switch port connected to R1 is configured as a trunk and allows VLANs 10 and 20.. The router's sub-interfaces being 'up/up' only confirms the physical link and Layer 2 protocol (using the native VLAN untagged, often VLAN 1) are active. It does not prove that the switch port is a trunk, nor that VLANs 10 and 20 are allowed across the link. Without a properly configured trunk, tagged frames for those VLANs will not traverse. Verifying the switch port trunk configuration and allowed VLANs is the most logical next step to resolve inter-VLAN communication at Layer 2 before investigating Layer 3 settings.

Answer

Verify the encapsulation dot1Q numbers on the sub-interfaces match the VLAN assignments.

Answer

Verify the default gateway settings on hosts in VLANs 10 and 20.

Answer

Check the physical interface G0/0 for interface errors or duplex mismatches.

Question 10

Refer to the exhibit. A network engineer is troubleshooting a DHCP issue where DHCP clients on the LAN subnet are sending DHCPDISCOVER messages but the DHCP server does not receive them. The output of the show ip dhcp binding command on R1 is shown. What is the most likely cause of the problem?

Accepted Answer

The ip helper-address command is configured on the WAN interface instead of the LAN interface facing the DHCP clients.. The show ip dhcp binding output explicitly displays 'Total number of bindings = 0', confirming that no DHCP leases have been issued. Because the router is acting as a DHCP relay agent, this indicates it is not receiving any DHCPDISCOVER broadcasts from the clients. The most plausible reason is that the ip helper-address command is mistakenly placed on the WAN interface, which faces away from the client subnet, rather than on the LAN interface where the clients reside. Without the helper address on the correct interface, broadcast DHCP messages are not forwarded to the DHCP server, resulting in zero bindings.

Answer

DHCP service is disabled on R1.

Answer

The DHCP pool is configured with a network address that does not match the client subnet.

Answer

The default-router option is missing from the DHCP pool configuration.

Question 11

A client PC is receiving an APIPA address (169.254.x.x) instead of a valid IP from the DHCP server. The DHCP server is on the same subnet as the client. The technician runs the command 'show ip dhcp binding' and confirms that the correct scope is configured. The command 'show ip dhcp pool' shows that there are plenty of addresses remaining in the pool. The client's NIC status shows 'connected'. What should the technician do next?

Accepted Answer

Check for a rogue DHCP server on the network.. When a client on the same subnet as the DHCP server still receives an APIPA address, the problem is often that the client's DHCP Discover broadcasts are not reaching the legitimate DHCP server or the server's offers are not reaching the client. Since the technician has already verified the DHCP server configuration (scope exists, addresses available) and the client's physical connectivity (NIC connected), the most logical next step is to check for a rogue DHCP server. A rogue server can intercept DHCP Discover messages and respond with invalid or malicious offers, causing the client to disregard legitimate offers, or it might respond with offers that conflict and confuse the client. This addresses the DHCP application layer (Layer 7) and ensures that only the authorized server is responding. Identifying a rogue server can be done via packet capture or by inspecting DHCP lease database inconsistencies.

Answer

Check the DHCP snooping configuration on the access switch.

Answer

Verify that no firewall is blocking UDP ports 67 and 68 on the local network.

Answer

Run the ipconfig /release and /renew commands on the client.

Question 12

What is the operational purpose of configuring the IPv6 route ::/0?

Accepted Answer

It provides a fallback path for unknown remote IPv6 destinations.. The configured route is a default route. In practical terms, it gives the router one simple next hop for any remote IPv6 destination that is not matched by a more specific entry. That is exactly what a small branch router often needs when it has a single upstream path.

This is the same design logic as an IPv4 default route, but with IPv6 syntax and addressing.

Answer

It enables OSPFv3 on the upstream interface.

Answer

It converts link-local addresses into global unicast addresses.

Answer

It summarizes all IPv6 routes into one /64 route.

Question 13

A network engineer notices that clients in the 192.168.10.0/24 subnet are receiving the IP address 192.168.10.1 from the DHCP server, causing a duplicate IP conflict with the router’s own interface. What is the most likely cause?

Accepted Answer

The DHCP pool does not exclude the router’s own interface IP address.. The DHCP server is handing out 192.168.10.1, which is the router’s interface IP, because the pool includes the entire subnet without excluding that address. The correct fix is to configure 'ip dhcp excluded-address 192.168.10.1'. The other options describe features that do not control whether the server offers a specific address: conflict logging, lease time, and default-router settings do not prevent assignment of a duplicate address.

Answer

The DHCP conflict logging feature is disabled on the router.

Answer

The DHCP lease time is set too low, causing frequent re-issuing of addresses.

Answer

The DHCP pool’s default-router address is misconfigured, so the client uses the router’s IP as its own.

Question 14

A network technician has configured static NAT with the command ip nat inside source static 192.168.1.10 203.0.113.10. The web server at 192.168.1.10 is accessible from the internet on TCP port 80 but not on TCP port 443. The ACL applied to the outside interface permits all IP traffic. What is the most appropriate next step to troubleshoot this issue?

Accepted Answer

Check if the web server is running HTTPS service on port 443.. Since the ACL already permits all IP traffic and the static NAT translation works for port 80, the problem is not at Layer 3/4 filtering or NAT. The most likely cause is an application-layer issue: the web server is not listening on port 443. Checking the server's HTTPS service directly addresses that.

Answer

Verify that the ACL applied to the outside interface explicitly permits TCP port 443.

Answer

Examine the NAT translation table for any conflicting dynamic entries.

Answer

Confirm the inside global IP address mapped to the server is correct.

Question 15

Refer to the exhibit. A network administrator is troubleshooting connectivity issues. Hosts on the 192.168.10.0/24 network cannot reach servers on the 192.168.20.0/24 network, but they can successfully reach other networks, including the Internet. The administrator runs the show ip access-lists command on the router (output shown). What is the most likely cause?

Accepted Answer

The order of the ACL entries causes the deny statement to match first.. The exhibit shows Extended IP access list 110 with a deny statement for traffic from 192.168.10.0/24 to 192.168.20.0/24 (entry 10) placed before a permit ip any statement (entry 20). Because ACLs are processed in sequential order, the first matching entry is used. Traffic from 192.168.10.0/24 to 192.168.20.0/24 matches the deny statement and is dropped, even though a subsequent permit entry would allow it. The counters (145 matches for deny, 95 matches for permit) confirm that the deny is being hit first.

Answer

The ACL is applied in the wrong direction on the interface.

Answer

The ACL is missing a permit statement for the 192.168.20.0/24 destination.

Answer

The implicit deny at the end is blocking the traffic to 192.168.20.0/24.