CCNA Practice Test 37 — 15 Questions

Question 1

A network engineer is troubleshooting an OSPFv3 adjacency issue between two directly connected routers. Both routers are configured for OSPFv3 in area 0 on their GigabitEthernet0/0 interfaces. The engineer checks the OSPFv3 neighbor status on R1 and sees that the neighbor state is stuck in EXSTART. The engineer verifies that both interfaces are up and have IPv6 link-local addresses. What is the most likely cause of this problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Ensure that the MTU is the same on both sides of the link.. The EXSTART state in OSPF indicates that the routers have formed a bidirectional communication and are negotiating the master/slave relationship and the initial Database Description (DBD) packet exchange. A common cause for getting stuck in EXSTART is an MTU mismatch between the two interfaces, which prevents the DBD packets from being accepted by the neighbor, causing the process to stall.

Answer

Configure a global unicast IPv6 address on the interface.

Answer

Change the router ID to be the same on both routers.

Answer

Change the network type to point-to-point.

Question 2

Why is HTTPS preferred over HTTP when accessing sensitive controller APIs?

Accepted Answer

Because HTTPS encrypts the API traffic in transit.. HTTPS is preferred because it encrypts the traffic in transit. In practical terms, sensitive controller APIs may carry tokens, credentials, operational details, and configuration data. Sending that information over plain HTTP would expose it to interception on the network. HTTPS reduces that risk by protecting the session.

This does not make HTTPS a replacement for authentication. It is a transport-security choice that works alongside access control, not instead of it.

Answer

Because HTTPS removes the need for tokens and credentials.

Answer

Because HTTPS is the only way JSON can be transmitted.

Answer

Because HTTP cannot carry API requests at all.

Question 3

A branch office needs four subnets from the 192.168.50.0/24 network, with each subnet supporting up to 50 hosts. Which prefix length should be used for each subnet?

Accepted Answer

/26. Each subnet must support at least 50 hosts, so /26 is the smallest suitable prefix because it provides 62 usable addresses. A /24 can be split into exactly four /26 subnets.

Answer

/25

Answer

/27

Answer

/28

Question 4

Which TWO statements correctly describe the behavior of PortFast and BPDU Guard on a Cisco switch?

Accepted Answer

PortFast immediately transitions a port from blocking to forwarding state, bypassing listening and learning.. PortFast immediately transitions an access port from blocking to forwarding, bypassing listening and learning (Option A). BPDU Guard errdisables a PortFast-enabled port if any BPDU is received, protecting against accidental loops (Option B). Option C is incorrect because PortFast does not alter BPDU handling; the port still processes BPDUs and reverts to normal STP if one is received. Option D is false because BPDU Guard disables the port entirely rather than ignoring BPDUs. Option E is incorrect because BPDU Guard is typically configured on access ports connected to end devices, not on trunk ports.

Answer

PortFast allows BPDUs to pass through the port normally, but the port remains in forwarding state.

Answer

BPDU Guard prevents the port from becoming a root port or designated port by ignoring superior BPDUs.

Answer

BPDU Guard is typically configured on trunk ports to prevent loops between switches.

Question 5

A phone and a PC are attached to the same switchport. The intended data VLAN is VLAN 10, and the phone uses voice VLAN 20. The switchport currently has `switchport voice vlan 20` configured. The phone works, but the PC cannot reach the data network. Which command is most likely missing?

Accepted Answer

switchport access vlan 10. When a Cisco IP phone and a PC share one port, the switchport often needs both a data VLAN and a voice VLAN. If the voice VLAN exists but the data access VLAN is wrong or missing, the phone can work while the PC fails.

Answer

switchport mode dynamic auto

Answer

switchport voice vlan 20

Answer

spanning-tree guard root

Question 6

A router has a static route to 10.20.20.0/24 and also has a default route. Which route is used for traffic to 10.20.20.8?

Accepted Answer

The static route to 10.20.20.0/24. The static route to 10.20.20.0/24 is used because it is more specific than the default route. In practical terms, the router always chooses the route that most precisely matches the destination before falling back to the default route.

This question reinforces the idea that the default route is a route of last resort, not a preferred choice when a better match already exists.

Answer

The default route

Answer

Both routes are used equally

Answer

Neither route is valid

Question 7

Match each HTTP method to the action it most commonly performs in a REST API.

Accepted Answer

GET: Retrieve a resource or collection of resources.. All listed mappings are correct according to RESTful API conventions. GET retrieves a resource, POST creates a new resource, PUT replaces an existing resource, and PATCH applies a partial update.

Question 8

A network engineer is configuring an EtherChannel between two switches. After applying the configuration, the port-channel fails to form. What is the most likely reason?

Accepted Answer

The member links use different switchport modes, so the channel cannot form correctly.. The port-channel is not forming because the two member interfaces are not configured consistently. In practical terms, EtherChannel requires important characteristics to align across candidate member links. Here, one interface is a trunk and the other is configured as an access port, so the channel cannot be built cleanly.

This is a classic EtherChannel consistency problem. The protocol alone is not enough if the member-link settings disagree.

Answer

LACP requires both interfaces to use different channel-group numbers.

Answer

The interfaces must both be configured for PPP.

Answer

The bundle fails because BGP is not enabled on the switch.

Question 9

A router is configured as a DHCP server for VLAN 20. Clients on the VLAN can reach the default gateway, but they do not receive leases. Which two configuration issues on the router would directly prevent successful address assignment?

Accepted Answer

The excluded-address range removes the entire usable subnet. The router can serve DHCP locally without an ip helper-address. The real problem is that the excluded-address range consumes every usable host address, leaving the pool with no assignable leases.

Answer

The DHCP pool is missing a dns-server statement

Answer

The subinterface lacks an ip helper-address

Question 10

A host address is 10.77.4.141/28. Which address is the network address of the subnet?

Accepted Answer

10.77.4.128. A /28 subnet has a block size of 16. In practical terms, the last-octet blocks are 0-15, 16-31, 32-47, and so on. Because 141 falls within the 128-143 block, the network address is 10.77.4.128.

This is a clean addressing-boundary question that rewards careful block calculation rather than guesswork.

Answer

10.77.4.143

Answer

10.77.4.144

Answer

10.77.4.112

Question 11

A static default route is configured on R1 toward ISP-A, and a second default route toward ISP-B is configured with a higher administrative distance. Which two statements are correct during normal operation and after ISP-A failure?

Accepted Answer

The route through ISP-A is preferred during normal operation. This is a classic floating static design. The lower-AD default route is primary, and the higher-AD default waits in reserve.

Answer

Both defaults are always installed and used equally

Answer

The backup route is ignored permanently because only one default route can exist

Question 12

A router is configured with an access list intended to block Telnet from 192.168.10.0/24 to 10.1.1.10, but Telnet still works. What is the most likely reason?

Accepted Answer

The ACL is applied in the wrong place or direction. The most common reason an ACL fails to block traffic is incorrect application—either it is applied to the wrong interface or in the wrong direction. For Telnet traffic from 192.168.10.0/24 to 10.1.1.10, the ACL must be applied inbound on the interface closest to the source or outbound on the interface closest to the destination. Option A is incorrect because the wildcard mask 0.0.0.255 is correct for matching the 192.168.10.0/24 network; 255.255.255.0 is a subnet mask, not a wildcard mask. Option C is false—standard ACLs can only filter by source IP and cannot match the destination port (Telnet), so an extended ACL is actually required. Option D is unrelated; PAT (Port Address Translation) has no bearing on whether an ACL can filter Telnet traffic.

Answer

The ACL must use wildcard mask 255.255.255.0 instead of 0.0.0.255

Answer

Standard ACLs should always be used for Telnet filtering

Answer

The router must run PAT before ACLs can filter Telnet

Question 13

Which TWO interface issues can be identified by analyzing the output of the 'show interfaces' command?

Accepted Answer

Duplex mismatch. The 'show interfaces' command displays interface statistics and operational status, including duplex and speed settings. A duplex mismatch occurs when one end of a link is set to full-duplex and the other to half-duplex, leading to collisions and CRC errors visible in the output. Speed mismatch is also detectable because the interface will show the negotiated speed or errors like 'input errors' if the speeds do not match.

Answer

Routing protocol misconfiguration

Answer

VLAN mismatch

Answer

STP topology change

Question 14

Why does DNS make networks easier for people to use?

Accepted Answer

It lets people use memorable names instead of raw IP addresses.. DNS makes networks easier to use because it lets people work with names instead of memorizing numeric IP addresses. In practical terms, users can remember a server name much more easily than a string of numbers. DNS creates that naming layer while the network still uses IP underneath.

This usability benefit is one of the main reasons DNS is so important in everyday network operations.

Answer

It assigns IP addresses automatically.

Answer

It replaces the need for default gateways.

Answer

It elects the root bridge for STP.

Question 15

A device administrator can log in securely over SSH, but the organization still insists on restricting source IP ranges and keeping detailed logs. Which statement best explains that decision?

Accepted Answer

Because secure transport alone does not remove the need for source restriction and accountability controls.. The decision reflects defense in depth. SSH encrypts the session and authenticates users, but it does not limit which source IPs can connect or provide audit trails. Source IP restriction reduces the attack surface by allowing only trusted hosts, and logging provides accountability and forensic evidence. Option B is incorrect because SSH is more secure than Telnet, not less. Option C is incorrect because logs record events but do not enforce ACLs. Option D is incorrect because source IP restriction complements authentication rather than replacing it.

Answer

Because SSH is less secure than Telnet and must be compensated for.

Answer

Because logs automatically enforce ACL policy.

Answer

Because source IP restriction replaces the need for authentication.