CCNA Practice Test 35 — 15 Questions

Question 1

Two switches should form an LACP EtherChannel. One side is configured passive, and the other side is also passive. What is the most likely result?

Accepted Answer

The EtherChannel is unlikely to form because neither side initiates LACP negotiation.. If both sides are passive, the EtherChannel is unlikely to form because passive mode waits for the other side to initiate LACP negotiation. In plain language, both switches are listening, but neither is actively starting the conversation. Because neither side takes the active role, the bundle normally stays down or unformed unless one side is changed to active.

This is a classic LACP negotiation question. It reinforces the difference between valid pairings such as active/active or active/passive and the passive/passive pairing that usually fails to initiate negotiation.

Answer

The EtherChannel always forms because passive mode is stronger than active mode.

Answer

The link becomes a routed port automatically.

Answer

Both switches delete the port-channel configuration.

Question 2

A switchport is configured with sticky MAC learning and a maximum secure MAC value of 2. What is the main benefit of sticky learning in this situation?

Accepted Answer

It allows secure MAC addresses to be learned dynamically and used by port security.. Sticky MAC learning allows the switch to learn secure MAC addresses dynamically and treat them as port-security entries without the administrator typing them manually. In plain language, it combines some of the convenience of automatic learning with the control of port security. If the configuration is later saved, those learned entries can become persistent.

This is a common CCNA port-security concept because it shows how sticky learning works with, not instead of, port security. The correct answer is the one focused on dynamic secure learning and convenience, not on disabling the maximum limit or turning the port into a trunk.

Answer

It removes the maximum secure MAC limit automatically.

Answer

It converts the port into a trunk after two MAC addresses are learned.

Answer

It disables port security after the first reboot.

Question 3

A client can join a corporate SSID and authenticate successfully, but it consistently loses connectivity when moving between floors. Which area is most strongly suggested for deeper investigation?

Accepted Answer

Roaming and RF behavior between AP coverage areas. The strongest area for deeper investigation is wireless mobility and RF behavior between the AP coverage areas involved. In practical terms, the client can already authenticate and use the WLAN initially, so the issue is more likely tied to movement, signal transition, channel behavior, or roaming-related operation rather than basic SSID existence or initial authentication alone.

This is a mobility-troubleshooting question, not a simple association problem.

Answer

Whether the SSID is visible at all

Answer

Whether the host has a BGP autonomous system number

Answer

Whether the switch uses a smaller wildcard mask

Question 4

A user on a wireless guest network can associate successfully, obtains an IP address, but cannot reach the Internet. Which troubleshooting area should be examined first if the WLAN itself is working?

Accepted Answer

The post-association forwarding or policy path, such as guest routing or Internet access policy. If association and addressing are already successful, the first area to examine is the forwarding or policy path beyond simple WLAN join behavior. In practical terms, the client has passed the discovery, authentication, and addressing stages. The problem is now more likely to involve routing, gateway reachability, NAT, firewall policy, or guest-access restrictions rather than the SSID itself.

This question is about understanding which stage of the workflow has already succeeded.

Answer

The SSID broadcast name, because it must be wrong

Answer

The AP radio antenna type only

Answer

OSPFv3 area configuration on the laptop

Question 5

An EtherChannel uses LACP. One side is configured correctly, but the peer side has a different switchport mode on one of the member links. What is the most likely result?

Accepted Answer

The bundle may fail to form correctly because the member-link settings are inconsistent.. The most likely result is that the bundle will not form cleanly because EtherChannel requires member links to agree on important operational settings. In practical terms, LACP negotiation alone is not enough. The links also need compatible characteristics such as switchport mode, VLAN handling, speed, and duplex where relevant.

This is a common troubleshooting pattern. It tests whether you know that bundle membership depends on configuration consistency, not just on enabling LACP.

Answer

The switch automatically rewrites the peer configuration to match.

Answer

LACP converts the mismatched link into a routed interface automatically.

Answer

The mismatched link is placed in a spanning-tree blocking state.

Question 6

A monitoring system already collects Syslog and SNMP data. The network team now wants visibility into which applications or host conversations are driving link utilization. What is the strongest addition?

Accepted Answer

NetFlow. The strongest addition is NetFlow because it provides traffic-flow visibility. In practical terms, Syslog and SNMP are useful, but they do not directly answer detailed conversation-level questions such as which hosts, protocols, or flows are consuming the most bandwidth. NetFlow is designed to answer exactly that kind of question.

This is about choosing the right operational tool for the visibility gap.

Answer

Another SSID

Answer

PortFast

Answer

A larger wildcard mask

Question 7

A host uses subnet mask 255.255.255.224. How many total addresses exist in each subnet block?

Accepted Answer

32. The subnet mask 255.255.255.224 (/27) has 5 host bits, so each subnet has 2^5 = 32 total addresses. Option A (16) results from confusing /27 with /28 (4 host bits = 16). Option D (64) results from confusing /27 with /26 (6 host bits = 64). Option C (30) is the number of usable host addresses (32 - 2 = 30), not the total addresses asked for in the question.

Answer

16

Answer

30

Answer

64

Question 8

A host has the address 10.10.10.94/27. Which subnet contains that host?

Accepted Answer

10.10.10.64/27. A /27 mask creates subnets in blocks of 32 addresses. In plain language, that means the fourth-octet ranges are 0–31, 32–63, 64–95, 96–127, and so on. Since the host address ends in 94, it falls inside the 64–95 block. That means the subnet is 10.10.10.64/27.

This is a classic subnetting task because it checks whether you can move from prefix length to block size and then locate the host inside the correct range. The key skill is recognizing the increment boundary and not guessing based only on the nearest familiar address.

Answer

10.10.10.32/27

Answer

10.10.10.96/27

Answer

10.10.10.0/27

Question 9

Which term in the CIA triad refers to ensuring systems and data remain accessible when needed?

Accepted Answer

Availability. The term is availability. In plain language, availability means that authorized users should be able to reach systems, services, and data when they actually need them. If a service is down, overwhelmed, or otherwise unreachable, availability has been affected. This is different from confidentiality, which focuses on preventing unauthorized disclosure, and integrity, which focuses on preventing unauthorized change.

This distinction matters because the CIA triad appears often in security foundations and exam questions. Availability is not about whether data is secret or whether it has been altered; it is about whether the service is usable. That is why availability is the best answer here.

Answer

Integrity

Answer

Accounting

Answer

Confidentiality

Question 10

Why is a northbound API valuable to orchestration systems in a controller-based architecture?

Accepted Answer

It provides a defined software interface through which orchestration tools can interact with the controller.. A northbound API is valuable because it provides a defined software interface for orchestration systems to interact with the controller programmatically. Option B is incorrect because northbound APIs do not enable direct device-to-device communication; that is a function of the data plane. Option C is incorrect because northbound APIs are logical software interfaces, not physical cables or ports. Option D is also incorrect as it mischaracterizes the API as a hardware standard.

Answer

It allows network devices to communicate directly with each other without the controller.

Answer

It is a physical interface used to connect the controller to the orchestration system.

Answer

It is a physical cable standard for controller uplinks.

Question 11

A company wants unauthorized devices plugged into unused wall ports to have as little chance of gaining access as possible. Which action most directly supports that goal?

Accepted Answer

Administratively disable unused switch ports.. Administratively shutting down unused switch ports most directly supports the goal because it eliminates the access point entirely. Option B, converting unused ports into trunks, would actually increase risk by potentially allowing VLAN hopping and unauthorized traffic. Option D, removing VLAN assignments from active user ports, does not address unused ports and could disrupt legitimate users by forcing them into the default VLAN. Disabling unused ports is a simple and effective hardening measure that reduces attack surface.

Answer

Convert every unused port into a trunk.

Answer

Enable Telnet on unused ports for monitoring.

Answer

Remove all VLAN assignments from active user ports.

Question 12

A host address is 192.168.88.66/27. Which address is the network address of the subnet?

Accepted Answer

192.168.88.64. A /27 subnet has a block size of 32. In practical terms, the fourth-octet ranges are 0-31, 32-63, 64-95, and so on. Because 66 falls within the 64-95 block, the network address is 192.168.88.64.

This is a classic subnet-boundary calculation. The key step is identifying the correct block first.

Answer

192.168.88.32

Answer

192.168.88.95

Answer

192.168.88.96

Question 13

In a controller-based WLAN, what is the main job of the access point?

Accepted Answer

To provide the radio connection between wireless clients and the network. The main job of the access point is to provide the actual radio connection between wireless clients and the network. In practical terms, the controller may centralize policy and management, but the AP is still the device that transmits and receives the wireless frames in the local area.

This distinction matters because CCNA wireless questions often separate the controller’s management role from the AP’s RF and client-connectivity role.

Answer

To replace the wireless LAN controller entirely

Answer

To act as the default gateway for every wired VLAN

Answer

To perform OSPF route summarization for wireless users

Question 14

Which two statements accurately compare IPv4 private addresses and public addresses?

Accepted Answer

Private IPv4 addresses are not directly Internet-routable.. Private IPv4 addresses are intended for internal use and are not directly routable on the public Internet. In plain language, they are designed for use inside organizations, homes, and other local environments without consuming globally unique public space. Public addresses, by contrast, are intended to be unique and routable across the Internet. This is one of the main reasons NAT became so common in IPv4 environments.

CCNA questions often test this distinction because learners sometimes confuse “valid inside a LAN” with “routable everywhere.” Private addressing is extremely useful, but it does not eliminate the need for translation or public addressing when reaching the Internet. The two correct statements are the ones that preserve that basic separation between internal-use ranges and globally routable address space.

Answer

Private IPv4 addresses always require OSPF to function inside a LAN.

Answer

Public IPv4 addresses cannot exist on Internet-facing devices.

Answer

Private and public IPv4 addresses are both automatically translated by ARP.

Question 15

A host with address 10.0.0.130/25 needs to identify its subnet. Which subnet is correct?

Accepted Answer

10.0.0.128/25. A /25 uses blocks of 128 addresses. In plain language, that means the fourth-octet ranges are 0–127 and 128–255. Since the host address ends in 130, it belongs to the upper block, which means the subnet is 10.0.0.128/25.

This kind of question is a staple of subnetting because it tests whether you can identify the correct subnet boundary from the prefix and host address. Once you recognize the /25 split, the answer becomes straightforward.

Answer

10.0.0.0/25

Answer

10.0.0.64/25

Answer

10.0.0.192/25