CCNA Practice Test 37 — 15 Questions

Question 1

A router is configured as a DHCP server for VLAN 20. Clients on the VLAN can reach the default gateway, but they do not receive leases. Which two configuration issues on the router would directly prevent successful address assignment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The excluded-address range removes the entire usable subnet. The router can serve DHCP locally without an ip helper-address. The real problem is that the excluded-address range consumes every usable host address, leaving the pool with no assignable leases.

Answer

The DHCP pool is missing a dns-server statement

Answer

The subinterface lacks an ip helper-address

Question 2

A host address is 10.77.4.141/28. Which address is the network address of the subnet?

Accepted Answer

10.77.4.128. A /28 subnet has a block size of 16. In practical terms, the last-octet blocks are 0-15, 16-31, 32-47, and so on. Because 141 falls within the 128-143 block, the network address is 10.77.4.128.

This is a clean addressing-boundary question that rewards careful block calculation rather than guesswork.

Answer

10.77.4.143

Answer

10.77.4.144

Answer

10.77.4.112

Question 3

A static default route is configured on R1 toward ISP-A, and a second default route toward ISP-B is configured with a higher administrative distance. Which two statements are correct during normal operation and after ISP-A failure?

Accepted Answer

The route through ISP-A is preferred during normal operation. This is a classic floating static design. The lower-AD default route is primary, and the higher-AD default waits in reserve.

Answer

Both defaults are always installed and used equally

Answer

The backup route is ignored permanently because only one default route can exist

Question 4

A router is configured with an access list intended to block Telnet from 192.168.10.0/24 to 10.1.1.10, but Telnet still works. What is the most likely reason?

Accepted Answer

The ACL is applied in the wrong place or direction. The most common reason an ACL fails to block traffic is incorrect application—either it is applied to the wrong interface or in the wrong direction. For Telnet traffic from 192.168.10.0/24 to 10.1.1.10, the ACL must be applied inbound on the interface closest to the source or outbound on the interface closest to the destination. Option A is incorrect because the wildcard mask 0.0.0.255 is correct for matching the 192.168.10.0/24 network; 255.255.255.0 is a subnet mask, not a wildcard mask. Option C is false—standard ACLs can only filter by source IP and cannot match the destination port (Telnet), so an extended ACL is actually required. Option D is unrelated; PAT (Port Address Translation) has no bearing on whether an ACL can filter Telnet traffic.

Answer

The ACL must use wildcard mask 255.255.255.0 instead of 0.0.0.255

Answer

Standard ACLs should always be used for Telnet filtering

Answer

The router must run PAT before ACLs can filter Telnet

Question 5

Why is centralized logging especially useful when combined with NTP?

Accepted Answer

Because synchronized clocks make centralized log timelines easier to analyze accurately.. Centralized logging is much more useful when device clocks are synchronized because the timestamps can be correlated properly. In practical terms, collecting messages in one place is valuable, but if one router thinks it is 9:00 and another thinks it is 9:17, the event sequence becomes confusing. NTP solves that time-alignment problem.

This is a common operations best practice. Syslog provides the central visibility, and NTP makes the timeline trustworthy.

Answer

Because NTP assigns the Syslog server its IP address.

Answer

Because Syslog replaces authentication when NTP is present.

Answer

Because centralized logging blocks unauthorized traffic automatically.

Question 6

Which TWO interface issues can be identified by analyzing the output of the 'show interfaces' command?

Accepted Answer

Duplex mismatch. The 'show interfaces' command displays interface statistics and operational status, including duplex and speed settings. A duplex mismatch occurs when one end of a link is set to full-duplex and the other to half-duplex, leading to collisions and CRC errors visible in the output. Speed mismatch is also detectable because the interface will show the negotiated speed or errors like 'input errors' if the speeds do not match.

Answer

Routing protocol misconfiguration

Answer

VLAN mismatch

Answer

STP topology change

Question 7

Why does DNS make networks easier for people to use?

Accepted Answer

It lets people use memorable names instead of raw IP addresses.. DNS makes networks easier to use because it lets people work with names instead of memorizing numeric IP addresses. In practical terms, users can remember a server name much more easily than a string of numbers. DNS creates that naming layer while the network still uses IP underneath.

This usability benefit is one of the main reasons DNS is so important in everyday network operations.

Answer

It assigns IP addresses automatically.

Answer

It replaces the need for default gateways.

Answer

It elects the root bridge for STP.

Question 8

A device administrator can log in securely over SSH, but the organization still insists on restricting source IP ranges and keeping detailed logs. Which statement best explains that decision?

Accepted Answer

Because secure transport alone does not remove the need for source restriction and accountability controls.. The decision reflects defense in depth. SSH encrypts the session and authenticates users, but it does not limit which source IPs can connect or provide audit trails. Source IP restriction reduces the attack surface by allowing only trusted hosts, and logging provides accountability and forensic evidence. Option B is incorrect because SSH is more secure than Telnet, not less. Option C is incorrect because logs record events but do not enforce ACLs. Option D is incorrect because source IP restriction complements authentication rather than replacing it.

Answer

Because SSH is less secure than Telnet and must be compensated for.

Answer

Because logs automatically enforce ACL policy.

Answer

Because source IP restriction replaces the need for authentication.

Question 9

Based on the exhibit, why is the ACL not meeting the requirement to block only HTTPS traffic to the server?

Accepted Answer

Because the ACL entry is too broad and blocks all IP traffic to the host.. The ACL fails because it uses 'deny ip' which blocks all IP traffic to the server, not just HTTPS. To block only HTTPS, the ACL should match TCP port 443 with 'deny tcp eq 443'. Option B is wrong because HTTPS uses TCP, not UDP. Option C is wrong because extended ACLs (not standard) are required to filter by port. Option D is wrong because a host destination is perfectly valid in extended ACLs; a wildcard subnet is not required.

Answer

Because HTTPS uses UDP, not TCP.

Answer

Because standard ACLs are required for HTTPS filtering.

Answer

Because the destination must always be a wildcarded subnet, not a host.

Question 10

Which IPv6 protocol function replaces ARP?

Accepted Answer

Neighbor Discovery. IPv6 uses Neighbor Discovery Protocol to resolve Layer 3-to-Layer 2 information and perform related local-link functions such as router discovery and address resolution.

Answer

DHCPv6

Answer

EUI-64

Answer

SLAAC

Question 11

A network engineer has implemented DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers. The switch's VLAN 100 SVI is configured with ip helper-address to relay DHCP requests to a legitimate server in VLAN 200. Clients in VLAN 100 cannot obtain IP leases, even though the DHCP server is reachable from the switch and has available addresses.

Accepted Answer

The switch port that connects to the DHCP server's VLAN is not configured as a trusted DHCP snooping port.. DHCP snooping treats all switch ports as untrusted by default, which blocks DHCP server messages (OFFER, ACK) from entering the switch. Even though the switch itself can reach the DHCP server, the relayed reply from the server arrives on a port that is not trusted, so DHCP snooping drops the packet before it can be forwarded to the client. Configuring the port connecting to the DHCP server as a trusted port allows the server's responses to pass through the switch, resolving the issue.

Answer

The ip helper-address command has been incorrectly applied to VLAN 100 instead of VLAN 200.

Answer

DHCP snooping must be disabled globally because it conflicts with the configured DHCP relay agent.

Answer

The DHCP server lacks a valid default gateway, preventing replies from reaching the relay agent's SVI subnet.

Question 12

Refer to the exhibit. A network engineer is troubleshooting DHCP issues on a branch office network. Several users report that new devices are unable to obtain IP addresses, even though the DHCP pool configured on R1 appears to have sufficient free addresses. The engineer executes the show ip dhcp conflict command and observes the output. Based on the output, what is the most likely cause of the problem?

Accepted Answer

Several hosts on the network are using static IP addresses from the DHCP pool range, causing the DHCP server to mark those addresses as conflicts and depleting the available pool.. The output of 'show ip dhcp conflict' lists IP addresses that the DHCP server detected as already in use via ping or gratuitous ARP. When hosts use static IP addresses from the DHCP pool range, the server marks those addresses as conflicts and removes them from the available pool, effectively depleting the pool even though the scope shows free addresses. This matches the scenario where new devices cannot obtain IP addresses despite the pool appearing to have sufficient free addresses.

Answer

The DHCP scope is misconfigured with an exclusion range that includes 192.168.1.50 to 192.168.1.59.

Answer

The ping timeout on the DHCP server is set too low, causing it to falsely detect conflicts.

Answer

The DHCP server is not properly releasing expired leases, causing the conflict table to fill up.

Question 13

A wireless client can associate to the correct corporate SSID and authenticate successfully, but receives an address from the guest network instead of the employee network. Which troubleshooting area is strongest?

Accepted Answer

Incorrect WLAN-to-role or VLAN mapping after successful authentication.. The client successfully authenticates to the corporate SSID but receives an IP address from the guest network, indicating that the authentication phase is working correctly. The issue lies in the post-authentication mapping: the WLAN is likely mapped to the wrong VLAN or role (e.g., a RADIUS server attribute or local VLAN assignment is misconfigured), causing the client to be placed in the guest VLAN instead of the employee VLAN. This is a common misconfiguration in WLAN-to-VLAN or WLAN-to-role mapping after successful 802.1X authentication.

Answer

The client must be using the wrong subnet mask manually.

Answer

The AP must be missing PPP encapsulation.

Answer

The issue is that STP root election failed.

Question 14

A user reports that the corporate SSID is visible and accepts the correct password, but the client always lands in a quarantined remediation network. Which troubleshooting area is strongest?

Accepted Answer

Post-authentication policy, role, or VLAN assignment logic. The strongest troubleshooting area is post-authentication policy or role assignment. The client already sees the SSID and successfully authenticates, so the problem is not RF visibility or password failure. Landing in a remediation network indicates a policy decision after authentication, such as a mismatched VLAN assignment or client role. Option B (hidden SSID) is irrelevant because the SSID is visible. Option C (PPP encapsulation) does not affect post-authentication network placement. Option D (OSPF DR election) is unrelated to client VLAN assignment.

Answer

Whether the SSID is hidden instead of broadcast

Answer

Whether the AP uplink uses PPP encapsulation

Answer

Whether OSPF designated routers are elected correctly

Question 15

Why are tokens commonly used in API workflows instead of sending raw credentials with every request?

Accepted Answer

They allow controlled repeated API access without resending raw credentials on every request.. Tokens are commonly used because they provide a more controlled and practical way to manage repeated API access. In practical terms, a client can authenticate, receive a token, and then present that token on later requests instead of resending a username and password every time. That makes automation workflows easier to operate while still fitting into an access-control model.

This does not eliminate the need for transport security or authorization. It simply provides a common mechanism for controlled repeated API access.

Answer

They replace the need for HTTPS.

Answer

They automatically assign IP addresses to controllers.

Answer

They convert API data into VLAN tags.