CCNA Practice Test 36 — 15 Questions

Question 1

Why is NTP especially valuable when a network uses centralized Syslog servers?

Accepted Answer

Because synchronized clocks make log timestamps easier to correlate across devices. NTP is especially valuable because centralized logs are much easier to interpret when device clocks are synchronized. In plain language, if multiple routers and switches send messages to one logging server but each device believes a different time, the event sequence becomes confusing. NTP helps align those clocks so the timestamps in the logs are consistent and the team can reconstruct incidents more accurately.

This is a practical operations concept rather than a syntax question. Syslog solves the collection problem, and NTP solves the time-correlation problem. Together they make logs more useful than either one alone. That is why the best answer focuses on timestamp consistency rather than on routing, VLAN, or NAT behavior.

Answer

Because NTP converts Syslog into a routing protocol

Answer

Because NTP automatically creates DHCP pools

Answer

Because NTP eliminates the need for a Syslog server

Question 2

What is a common requirement for interfaces to successfully bundle into an EtherChannel?

Accepted Answer

All member interfaces must use matching speed, duplex, and trunk/access settings. EtherChannel members must have compatible operational and administrative settings, including speed, duplex, and switchport mode.

Answer

Each interface must belong to a different VLAN

Answer

Only odd-numbered switch ports can be bundled

Answer

Each interface must have a different STP path cost

Question 3

A user on VLAN 10 reports that they cannot ping the default gateway at 192.168.10.1 from their PC with IP 192.168.10.50/24. The switch interface connecting to the PC is up/up, and the PC shows a valid IP configuration. What is the most likely cause of this connectivity failure?

Accepted Answer

Configure an SVI for VLAN 10 with an IP address in the 192.168.10.0/24 subnet.. The PC and default gateway are on the same subnet (192.168.10.0/24), but the switch lacks a Layer 3 interface for VLAN 10. Without an SVI (Switch Virtual Interface) configured with an IP address in that subnet, the switch cannot route traffic to the gateway or respond to ARP requests from the PC, breaking connectivity even though the access port is up/up.

Answer

Change the switchport mode to trunk to allow VLAN 10 traffic.

Answer

Change the PC's IP address to a different subnet, such as 192.168.20.0/24.

Answer

Recreate VLAN 10 and reassign the port to it.

Question 4

Refer to the exhibit. A network engineer configured an EtherChannel between SW1 and SW2 using LACP. After the configuration is applied, the Port-channel 1 interface remains in a down state and does not pass traffic. The engineer runs the show etherchannel detail command on SW1. Based on the output, what is the most likely cause of the problem?

Accepted Answer

The interface Gi0/1 is administratively down.. An EtherChannel requires all member ports to have consistent VLAN configurations. However, if one port (Gi0/2) has a native VLAN mismatch, only that port is suspended/excluded from the channel. The port-channel can still become active using other valid members. In this scenario, the port-channel remains down because Gi0/1 is administratively down, leaving no valid member ports to form the channel. The show etherchannel detail output would indicate Gi0/1 in an administratively down state and Gi0/2 in a suspended state due to the native VLAN mismatch.

Answer

The native VLAN is mismatched on member interface Gi0/2.

Answer

The load-balancing method on the port-channel is set incorrectly to src-dst-ip.

Answer

Spanning Tree Protocol has placed the port-channel in a blocking state due to a loop.

Question 5

An EtherChannel between two switches is configured for LACP. One switch shows the member interfaces as bundled, while the other shows them as individual interfaces. Which explanation is most likely if both sides are using LACP?

Accepted Answer

The member interface settings do not match closely enough for bundling, even though both sides use LACP.. The most likely explanation is that some other interface settings do not match, even though both sides are using the same EtherChannel protocol. In practical terms, LACP alone is not enough. The candidate member interfaces also need to agree on characteristics such as speed, duplex, switchport mode, allowed VLANs where relevant, and other channel-related settings. If they do not, one side may treat the links as separate instead of bundling them.

This is a common troubleshooting pattern because it tests whether you know that EtherChannel success depends on more than just the negotiation protocol name.

Answer

LACP always requires one side to use PAgP as a backup.

Answer

EtherChannel cannot operate on switch trunks.

Answer

One switch must disable STP before EtherChannel can form.

Question 6

A switch shows a clock that is several minutes off from other devices even though an NTP server has been configured. Which issue is the most likely cause?

Accepted Answer

The NTP server is unsynchronized or unreachable. NTP requires IP reachability to the time source. If the NTP server is unreachable due to routing or ACL issues, the switch falls back to its local clock, causing drift. Option A is correct. Option B is wrong because Syslog has no effect on NTP synchronization. Option C is incorrect because NTP does not require a trunk port; it can operate over any VLAN with IP connectivity. Option D is false because DNS is only needed if the NTP server is specified by hostname; the server can be reached by IP address without DNS.

Answer

The device must run Syslog before NTP can sync

Answer

NTP requires a trunk port on the management VLAN

Answer

The clock can sync only if DNS is configured

Question 7

R1 cannot reach host 10.3.3.1 on R3. The technician checks routing: R1 has a route to 10.3.3.0/24 via next-hop 10.1.1.2 (R2). R2 has a route to 10.3.3.0/24 via next-hop 10.2.2.2 (R3). A ping from R1 to 10.3.3.1 times out. A ping from R2 to 10.3.3.1 succeeds. What should the technician do next?

Accepted Answer

Verify that R3 has a route back to R1’s subnet.. Since R2 can ping 10.3.3.1 successfully, R2 has connectivity to R3, and R3 can send replies to R2's subnet. The failure from R1 indicates that while the forward path from R1 to R3 works, the return path from R3 to R1 is broken. The most likely cause is that R3 does not have a route back to R1's subnet (10.1.1.0/24). Therefore, the technician should verify R3's routing table for a return route to R1's subnet. An inbound ACL on R3 would affect the forward path (the echo request), not the return path, and would be a secondary check after confirming routing.

Answer

Check whether an inbound ACL on R3 is blocking packets with R1’s source IP address.

Answer

Verify the OSPF neighbor adjacency between R2 and R3.

Answer

Test for an MTU mismatch along the path from R1 to R3.

Question 8

R1 and R2 are directly connected and both configured for OSPF area 0. The IP addresses are correct, but the routers do not become neighbors. What is the most likely cause?

Accepted Answer

The OSPF network types on the interfaces do not match.. The most likely cause is an OSPF network type mismatch. In practical terms, both routers are on the same IP segment and both are trying to use OSPF in the same area, but they do not agree on the type of OSPF network the interface represents. That matters because OSPF behavior changes depending on the network type, including how neighbors are discovered and how adjacencies are formed.

This is a classic exam-style troubleshooting case because the obvious items look correct: IP addressing works and the area matches. But a mismatch between point-to-point and broadcast expectations can still stop the relationship from forming cleanly. That makes network type mismatch the strongest answer here.

Answer

The routers need matching hostnames to exchange LSAs.

Answer

The /30 subnet is too small for OSPF to operate.

Answer

The interfaces must be converted into switch trunks.

Question 9

Which THREE statements correctly describe the configuration of AAA with RADIUS or TACACS+ on Cisco IOS-XE?

Accepted Answer

TACACS+ encrypts the entire body of the packet but leaves the standard TCP header unencrypted.. TACACS+ encrypts the entire body of the packet (including all attributes) but leaves the TCP header unencrypted. Option D is correct: TACACS+ separates authentication, authorization, and accounting into three distinct functions, allowing independent server configuration for each. Option E is correct: RADIUS combines authentication and authorization into a single process, so an access-accept packet includes both authentication success and authorization attributes. Option A is wrong: RADIUS only encrypts the password in the Access-Request packet, not the entire payload. Option C is wrong: TACACS+ uses TCP (port 49), while RADIUS uses UDP (ports 1812/1645 for authentication, 1813/1646 for accounting). Option F is wrong: In 802.1X on IOS-XE, the switch acts as an authenticator (not the authentication server) and forwards credentials to an external RADIUS server.

Answer

RADIUS encrypts the entire packet payload, including all attributes.

Answer

TACACS+ uses UDP as its transport protocol, while RADIUS uses TCP.

Answer

When configuring 802.1X on IOS-XE, the switch acts as the authentication server and validates client credentials locally.

Question 10

Users can browse websites by IP address but not by hostname. The default gateway is reachable and general internet connectivity works. Which two causes are the most likely?

Accepted Answer

The clients are missing a valid DNS server setting. If IP connectivity works but hostnames fail, the problem is usually DNS configuration or DNS reachability, not general routing.

Answer

The routers are missing NTP configuration

Answer

The switch access ports should be changed to dynamic desirable

Question 11

Based on the exhibit, which command is the best next step to verify whether the floating static route becomes active after the primary route is lost?

Accepted Answer

show ip route. The best next step is to examine the routing table directly after removing or losing the primary route. In practical terms, the purpose of a floating static route is to appear when the better route disappears. The clearest way to verify that behavior is to inspect the route table for the default route after the failure condition.

This is a simulation-style verification question. It is not asking how to configure the route, but how to confirm failover actually happened.

Answer

show vlan brief

Answer

show spanning-tree

Answer

show power inline

Question 12

A phone and PC share one switchport. The phone registers successfully, but the workstation receives an address from the wrong subnet. Which explanation is strongest?

Accepted Answer

The workstation is likely in the wrong data VLAN even though the phone is in the correct voice VLAN.. The phone and PC share a single switchport configured with separate voice and data VLANs. The phone successfully registers in the voice VLAN, but the workstation receives an IP address from the wrong subnet, indicating it is placed in an incorrect data VLAN. This typically occurs when the switchport's access VLAN (data VLAN) is misconfigured or mismatched with the workstation's expected subnet, while the voice VLAN (often using 802.1Q tagging) is correctly set for the phone.

Answer

If the phone works, the data VLAN must also be correct automatically.

Answer

The problem must be CAPWAP because phones require AP controllers.

Answer

The phone registration proves that DHCP cannot be the issue for the PC.

Question 13

Which TWO statements correctly describe interface errors and duplex mismatches on Cisco switches?

Accepted Answer

Late collisions on a half-duplex interface can indicate a duplex mismatch with the connected device.. Late collisions occur when a frame is transmitted onto the wire and collides after the first 512 bit-times of the frame. In a half-duplex Ethernet segment, a duplex mismatch causes the full-duplex side to never defer and transmit at any time, while the half-duplex side expects to detect collisions only during the collision window. When the full-duplex device sends a frame while the half-duplex device is already transmitting, the half-duplex device detects a collision after the 512-bit window, resulting in a late collision.

Answer

Runts are typically caused by CRC errors on the transmitting device.

Answer

Full-duplex interfaces use CSMA/CD to detect collisions before transmitting.

Answer

Auto-MDIX can resolve a duplex mismatch by renegotiating the speed and duplex settings.

Question 14

Which two tasks are strong candidates for network automation? (Choose two.)

Accepted Answer

Polling many devices for interface status on a schedule. Automation works best for repetitive, rule-based tasks such as gathering state information or pushing standard configuration changes across many devices.

Answer

Replacing a failed power supply in a branch switch

Answer

Tracing one cable through a crowded rack by hand

Answer

Listening for fan noise in a wiring closet

Question 15

Which command correctly configures an IPv6 default route using next-hop address 2001:db8:1::1?

Accepted Answer

ipv6 route ::/0 2001:db8:1::1. The correct IPv6 default route uses the prefix ::/0 with the command 'ipv6 route ::/0'. Option B is wrong because 'ip route' is used for IPv4 routes, not IPv6. Option C uses 'ipv6 default-route', which is not a valid Cisco IOS command. Option D sets the management default gateway for IPv4 only and does not insert a route into the IPv6 routing table.

Answer

ip route :: 2001:db8:1::1

Answer

ipv6 default-route 2001:db8:1::1

Answer

ip default-gateway 2001:db8:1::1