CCNA Practice Test 36 — 15 Questions

Question 1

Which THREE statements correctly describe the configuration of AAA with RADIUS or TACACS+ on Cisco IOS-XE?

Accepted Answer

TACACS+ encrypts the entire body of the packet but leaves the standard TCP header unencrypted.. TACACS+ encrypts the entire body of the packet (including all attributes) but leaves the TCP header unencrypted. Option D is correct: TACACS+ separates authentication, authorization, and accounting into three distinct functions, allowing independent server configuration for each. Option E is correct: RADIUS combines authentication and authorization into a single process, so an access-accept packet includes both authentication success and authorization attributes. Option A is wrong: RADIUS only encrypts the password in the Access-Request packet, not the entire payload. Option C is wrong: TACACS+ uses TCP (port 49), while RADIUS uses UDP (ports 1812/1645 for authentication, 1813/1646 for accounting). Option F is wrong: In 802.1X on IOS-XE, the switch acts as an authenticator (not the authentication server) and forwards credentials to an external RADIUS server.

Answer

RADIUS encrypts the entire packet payload, including all attributes.

Answer

TACACS+ uses UDP as its transport protocol, while RADIUS uses TCP.

Answer

When configuring 802.1X on IOS-XE, the switch acts as the authentication server and validates client credentials locally.

Question 2

Users can browse websites by IP address but not by hostname. The default gateway is reachable and general internet connectivity works. Which two causes are the most likely?

Accepted Answer

The clients are missing a valid DNS server setting. If IP connectivity works but hostnames fail, the problem is usually DNS configuration or DNS reachability, not general routing.

Answer

The routers are missing NTP configuration

Answer

The switch access ports should be changed to dynamic desirable

Question 3

A phone and PC share one switchport. The phone registers successfully, but the workstation receives an address from the wrong subnet. Which explanation is strongest?

Accepted Answer

The workstation is likely in the wrong data VLAN even though the phone is in the correct voice VLAN.. The phone and PC share a single switchport configured with separate voice and data VLANs. The phone successfully registers in the voice VLAN, but the workstation receives an IP address from the wrong subnet, indicating it is placed in an incorrect data VLAN. This typically occurs when the switchport's access VLAN (data VLAN) is misconfigured or mismatched with the workstation's expected subnet, while the voice VLAN (often using 802.1Q tagging) is correctly set for the phone.

Answer

If the phone works, the data VLAN must also be correct automatically.

Answer

The problem must be CAPWAP because phones require AP controllers.

Answer

The phone registration proves that DHCP cannot be the issue for the PC.

Question 4

Which TWO statements correctly describe interface errors and duplex mismatches on Cisco switches?

Accepted Answer

Late collisions on a half-duplex interface can indicate a duplex mismatch with the connected device.. Late collisions occur when a frame is transmitted onto the wire and collides after the first 512 bit-times of the frame. In a half-duplex Ethernet segment, a duplex mismatch causes the full-duplex side to never defer and transmit at any time, while the half-duplex side expects to detect collisions only during the collision window. When the full-duplex device sends a frame while the half-duplex device is already transmitting, the half-duplex device detects a collision after the 512-bit window, resulting in a late collision.

Answer

Runts are typically caused by CRC errors on the transmitting device.

Answer

Full-duplex interfaces use CSMA/CD to detect collisions before transmitting.

Answer

Auto-MDIX can resolve a duplex mismatch by renegotiating the speed and duplex settings.

Question 5

Which two tasks are strong candidates for network automation? (Choose two.)

Accepted Answer

Polling many devices for interface status on a schedule. Automation works best for repetitive, rule-based tasks such as gathering state information or pushing standard configuration changes across many devices.

Answer

Replacing a failed power supply in a branch switch

Answer

Tracing one cable through a crowded rack by hand

Answer

Listening for fan noise in a wiring closet

Question 6

Which command correctly configures an IPv6 default route using next-hop address 2001:db8:1::1?

Accepted Answer

ipv6 route ::/0 2001:db8:1::1. The correct IPv6 default route uses the prefix ::/0 with the command 'ipv6 route ::/0'. Option B is wrong because 'ip route' is used for IPv4 routes, not IPv6. Option C uses 'ipv6 default-route', which is not a valid Cisco IOS command. Option D sets the management default gateway for IPv4 only and does not insert a route into the IPv6 routing table.

Answer

ip route :: 2001:db8:1::1

Answer

ipv6 default-route 2001:db8:1::1

Answer

ip default-gateway 2001:db8:1::1

Question 7

A network troubleshooter is using Cisco IOS-XE's embedded packet capture feature to capture traffic on an interface and then analyze it in Wireshark to isolate a Layer 2 or Layer 3 fault. Which of the following sequences represents the correct order of steps?

Accepted Answer

Define the capture point with interface and optional filter, start the capture, stop the capture, export the capture file, then analyze in Wireshark.. The correct workflow is to first define the capture point (interface and any filters), then start the capture, stop it when sufficient data is collected, export the captured packets to a file, and finally open that file in Wireshark for analysis. Starting the capture before defining the point, exporting before stopping, or defining the point after stopping all result in an invalid or incomplete capture process.

Answer

Start the capture, define the capture point with interface and filter, stop the capture, export the capture file, then analyze in Wireshark.

Answer

Define the capture point, start the capture, export the capture file, stop the capture, then analyze in Wireshark.

Answer

Start the capture, stop the capture, define the capture point, export the capture file, then analyze in Wireshark.

Question 8

A network engineer is troubleshooting an OSPFv3 adjacency issue between two directly connected routers. Both routers are configured for OSPFv3 in area 0 on their GigabitEthernet0/0 interfaces. The engineer checks the OSPFv3 neighbor status on R1 and sees that the neighbor state is stuck in EXSTART. The engineer verifies that both interfaces are up and have IPv6 link-local addresses. What is the most likely cause of this problem?

Accepted Answer

Ensure that the MTU is the same on both sides of the link.. The EXSTART state in OSPF indicates that the routers have formed a bidirectional communication and are negotiating the master/slave relationship and the initial Database Description (DBD) packet exchange. A common cause for getting stuck in EXSTART is an MTU mismatch between the two interfaces, which prevents the DBD packets from being accepted by the neighbor, causing the process to stall.

Answer

Configure a global unicast IPv6 address on the interface.

Answer

Change the router ID to be the same on both routers.

Answer

Change the network type to point-to-point.

Question 9

Why is HTTPS preferred over HTTP when accessing sensitive controller APIs?

Accepted Answer

Because HTTPS encrypts the API traffic in transit.. HTTPS is preferred because it encrypts the traffic in transit. In practical terms, sensitive controller APIs may carry tokens, credentials, operational details, and configuration data. Sending that information over plain HTTP would expose it to interception on the network. HTTPS reduces that risk by protecting the session.

This does not make HTTPS a replacement for authentication. It is a transport-security choice that works alongside access control, not instead of it.

Answer

Because HTTPS removes the need for tokens and credentials.

Answer

Because HTTPS is the only way JSON can be transmitted.

Answer

Because HTTP cannot carry API requests at all.

Question 10

A branch office needs four subnets from the 192.168.50.0/24 network, with each subnet supporting up to 50 hosts. Which prefix length should be used for each subnet?

Accepted Answer

/26. Each subnet must support at least 50 hosts, so /26 is the smallest suitable prefix because it provides 62 usable addresses. A /24 can be split into exactly four /26 subnets.

Answer

/25

Answer

/27

Answer

/28

Question 11

Which TWO statements correctly describe the behavior of PortFast and BPDU Guard on a Cisco switch?

Accepted Answer

PortFast immediately transitions a port from blocking to forwarding state, bypassing listening and learning.. PortFast immediately transitions an access port from blocking to forwarding, bypassing listening and learning (Option A). BPDU Guard errdisables a PortFast-enabled port if any BPDU is received, protecting against accidental loops (Option B). Option C is incorrect because PortFast does not alter BPDU handling; the port still processes BPDUs and reverts to normal STP if one is received. Option D is false because BPDU Guard disables the port entirely rather than ignoring BPDUs. Option E is incorrect because BPDU Guard is typically configured on access ports connected to end devices, not on trunk ports.

Answer

PortFast allows BPDUs to pass through the port normally, but the port remains in forwarding state.

Answer

BPDU Guard prevents the port from becoming a root port or designated port by ignoring superior BPDUs.

Answer

BPDU Guard is typically configured on trunk ports to prevent loops between switches.

Question 12

A phone and a PC are attached to the same switchport. The intended data VLAN is VLAN 10, and the phone uses voice VLAN 20. The switchport currently has `switchport voice vlan 20` configured. The phone works, but the PC cannot reach the data network. Which command is most likely missing?

Accepted Answer

switchport access vlan 10. When a Cisco IP phone and a PC share one port, the switchport often needs both a data VLAN and a voice VLAN. If the voice VLAN exists but the data access VLAN is wrong or missing, the phone can work while the PC fails.

Answer

switchport mode dynamic auto

Answer

switchport voice vlan 20

Answer

spanning-tree guard root

Question 13

A router has a static route to 10.20.20.0/24 and also has a default route. Which route is used for traffic to 10.20.20.8?

Accepted Answer

The static route to 10.20.20.0/24. The static route to 10.20.20.0/24 is used because it is more specific than the default route. In practical terms, the router always chooses the route that most precisely matches the destination before falling back to the default route.

This question reinforces the idea that the default route is a route of last resort, not a preferred choice when a better match already exists.

Answer

The default route

Answer

Both routes are used equally

Answer

Neither route is valid

Question 14

Match each HTTP method to the action it most commonly performs in a REST API.

Accepted Answer

GET: Retrieve a resource or collection of resources.. All listed mappings are correct according to RESTful API conventions. GET retrieves a resource, POST creates a new resource, PUT replaces an existing resource, and PATCH applies a partial update.

Question 15

A network engineer is configuring an EtherChannel between two switches. After applying the configuration, the port-channel fails to form. What is the most likely reason?

Accepted Answer

The member links use different switchport modes, so the channel cannot form correctly.. The port-channel is not forming because the two member interfaces are not configured consistently. In practical terms, EtherChannel requires important characteristics to align across candidate member links. Here, one interface is a trunk and the other is configured as an access port, so the channel cannot be built cleanly.

This is a classic EtherChannel consistency problem. The protocol alone is not enough if the member-link settings disagree.

Answer

LACP requires both interfaces to use different channel-group numbers.

Answer

The interfaces must both be configured for PPP.

Answer

The bundle fails because BGP is not enabled on the switch.