CCNA Practice Test 38 — 15 Questions

Question 1

Based on the exhibit, why is the ACL not meeting the requirement to block only HTTPS traffic to the server?

Accepted Answer

Because the ACL entry is too broad and blocks all IP traffic to the host.. The ACL fails because it uses 'deny ip' which blocks all IP traffic to the server, not just HTTPS. To block only HTTPS, the ACL should match TCP port 443 with 'deny tcp eq 443'. Option B is wrong because HTTPS uses TCP, not UDP. Option C is wrong because extended ACLs (not standard) are required to filter by port. Option D is wrong because a host destination is perfectly valid in extended ACLs; a wildcard subnet is not required.

Answer

Because HTTPS uses UDP, not TCP.

Answer

Because standard ACLs are required for HTTPS filtering.

Answer

Because the destination must always be a wildcarded subnet, not a host.

Question 2

Which IPv6 protocol function replaces ARP?

Accepted Answer

Neighbor Discovery. IPv6 uses Neighbor Discovery Protocol to resolve Layer 3-to-Layer 2 information and perform related local-link functions such as router discovery and address resolution.

Answer

DHCPv6

Answer

EUI-64

Answer

SLAAC

Question 3

A network engineer has implemented DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers. The switch's VLAN 100 SVI is configured with ip helper-address to relay DHCP requests to a legitimate server in VLAN 200. Clients in VLAN 100 cannot obtain IP leases, even though the DHCP server is reachable from the switch and has available addresses.

Accepted Answer

The switch port that connects to the DHCP server's VLAN is not configured as a trusted DHCP snooping port.. DHCP snooping treats all switch ports as untrusted by default, which blocks DHCP server messages (OFFER, ACK) from entering the switch. Even though the switch itself can reach the DHCP server, the relayed reply from the server arrives on a port that is not trusted, so DHCP snooping drops the packet before it can be forwarded to the client. Configuring the port connecting to the DHCP server as a trusted port allows the server's responses to pass through the switch, resolving the issue.

Answer

The ip helper-address command has been incorrectly applied to VLAN 100 instead of VLAN 200.

Answer

DHCP snooping must be disabled globally because it conflicts with the configured DHCP relay agent.

Answer

The DHCP server lacks a valid default gateway, preventing replies from reaching the relay agent's SVI subnet.

Question 4

Refer to the exhibit. A network engineer is troubleshooting DHCP issues on a branch office network. Several users report that new devices are unable to obtain IP addresses, even though the DHCP pool configured on R1 appears to have sufficient free addresses. The engineer executes the show ip dhcp conflict command and observes the output. Based on the output, what is the most likely cause of the problem?

Accepted Answer

Several hosts on the network are using static IP addresses from the DHCP pool range, causing the DHCP server to mark those addresses as conflicts and depleting the available pool.. The output of 'show ip dhcp conflict' lists IP addresses that the DHCP server detected as already in use via ping or gratuitous ARP. When hosts use static IP addresses from the DHCP pool range, the server marks those addresses as conflicts and removes them from the available pool, effectively depleting the pool even though the scope shows free addresses. This matches the scenario where new devices cannot obtain IP addresses despite the pool appearing to have sufficient free addresses.

Answer

The DHCP scope is misconfigured with an exclusion range that includes 192.168.1.50 to 192.168.1.59.

Answer

The ping timeout on the DHCP server is set too low, causing it to falsely detect conflicts.

Answer

The DHCP server is not properly releasing expired leases, causing the conflict table to fill up.

Question 5

A wireless client can associate to the correct corporate SSID and authenticate successfully, but receives an address from the guest network instead of the employee network. Which troubleshooting area is strongest?

Accepted Answer

Incorrect WLAN-to-role or VLAN mapping after successful authentication.. The client successfully authenticates to the corporate SSID but receives an IP address from the guest network, indicating that the authentication phase is working correctly. The issue lies in the post-authentication mapping: the WLAN is likely mapped to the wrong VLAN or role (e.g., a RADIUS server attribute or local VLAN assignment is misconfigured), causing the client to be placed in the guest VLAN instead of the employee VLAN. This is a common misconfiguration in WLAN-to-VLAN or WLAN-to-role mapping after successful 802.1X authentication.

Answer

The client must be using the wrong subnet mask manually.

Answer

The AP must be missing PPP encapsulation.

Answer

The issue is that STP root election failed.

Question 6

A user reports that the corporate SSID is visible and accepts the correct password, but the client always lands in a quarantined remediation network. Which troubleshooting area is strongest?

Accepted Answer

Post-authentication policy, role, or VLAN assignment logic. The strongest troubleshooting area is post-authentication policy or role assignment. The client already sees the SSID and successfully authenticates, so the problem is not RF visibility or password failure. Landing in a remediation network indicates a policy decision after authentication, such as a mismatched VLAN assignment or client role. Option B (hidden SSID) is irrelevant because the SSID is visible. Option C (PPP encapsulation) does not affect post-authentication network placement. Option D (OSPF DR election) is unrelated to client VLAN assignment.

Answer

Whether the SSID is hidden instead of broadcast

Answer

Whether the AP uplink uses PPP encapsulation

Answer

Whether OSPF designated routers are elected correctly

Question 7

Why are tokens commonly used in API workflows instead of sending raw credentials with every request?

Accepted Answer

They allow controlled repeated API access without resending raw credentials on every request.. Tokens are commonly used because they provide a more controlled and practical way to manage repeated API access. In practical terms, a client can authenticate, receive a token, and then present that token on later requests instead of resending a username and password every time. That makes automation workflows easier to operate while still fitting into an access-control model.

This does not eliminate the need for transport security or authorization. It simply provides a common mechanism for controlled repeated API access.

Answer

They replace the need for HTTPS.

Answer

They automatically assign IP addresses to controllers.

Answer

They convert API data into VLAN tags.

Question 8

A trunk between two switches is up, but users in VLAN 40 cannot communicate across it. The output shows both sides allow VLAN 40. What is another likely trunk-related cause to check next?

Accepted Answer

Native VLAN mismatch between the two trunk ends. If VLAN 40 is allowed on both ends and the trunk is up, a native VLAN mismatch is still worth checking because trunk problems are not limited to the allowed VLAN list. In plain language, the link may be carrying traffic, but if the two switches disagree on how untagged traffic should be treated, behavior can still become unpredictable. Native VLAN mismatches are a well-known source of warnings and unexpected traffic handling on 802.1Q trunks.

That does not mean every VLAN problem is caused by the native VLAN, but once the obvious allowed-list issue has been ruled out, it becomes a logical next trunk-specific item to verify.

Answer

Missing router ID in OSPF

Answer

Incorrect NTP source interface

Answer

Lack of PAT overload on the WAN router

Question 9

A REST API query returns this JSON snippet:

{
  "interface": {
    "name": "GigabitEthernet1",
    "admin-status": "up",
    "oper-status": "down"
  }
}

What does this indicate?

Accepted Answer

The interface is enabled but the link is not operational.. The interface is administratively enabled, but it is not operationally passing traffic or achieving link.

Answer

The interface is shut down by configuration.

Answer

The interface is operating normally.

Answer

The interface is a loopback.

Question 10

You are connected to R1 via console. R1 is a router that connects two internal subnets (192.168.1.0/24 and 192.168.2.0/24) to the internet via a serial link to ISP. Currently, no ACL is applied. Your task is to configure an extended named ACL on R1 that permits only HTTP (TCP/80) and HTTPS (TCP/443) traffic from the 192.168.1.0/24 subnet to the internet, and denies all other traffic from that subnet. Traffic from 192.168.2.0/24 must be permitted without restriction. Apply the ACL inbound on the interface facing the internal subnets. Additionally, verify that the implicit deny is not blocking necessary traffic by ensuring that the ACL correctly handles the traffic.

Accepted Answer

ip access-list extended FILTER
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 permit tcp 192.168.1.0 0.0.0.255 any eq 443
 permit ip 192.168.2.0 0.0.0.255 any
 interface g0/0
 ip access-group FILTER in. The task required an extended ACL to permit HTTP/HTTPS from 192.168.1.0/24 and all traffic from 192.168.2.0/24. The candidate must create a named ACL (e.g., FILTER), add two permit statements for TCP/80 and TCP/443 from 192.168.1.0 0.0.0.255 to any, then a permit ip from 192.168.2.0 0.0.0.255 to any. The ACL is applied inbound on G0/0 (the interface facing 192.168.1.0/24) because traffic from that subnet enters R1 through G0/0. Applying it outbound on G0/0 would be incorrect, as it would only filter traffic leaving that subnet, not entering. Also, the ACL must be applied on the correct interface to avoid blocking traffic from 192.168.2.0/24, which enters via G0/1.

Answer

ip access-list extended FILTER
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 permit tcp 192.168.1.0 0.0.0.255 any eq 443
 permit ip 192.168.2.0 0.0.0.255 any
 interface g0/0
 ip access-group FILTER out

Answer

ip access-list extended FILTER
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 permit tcp 192.168.1.0 0.0.0.255 any eq 443
 permit ip 192.168.2.0 0.0.0.255 any
 interface g0/1
 ip access-group FILTER in

Answer

ip access-list extended FILTER
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 permit tcp 192.168.1.0 0.0.0.255 any eq 443
 permit ip 192.168.2.0 0.0.0.255 any
 interface g0/0
 ip access-group FILTER in
 interface g0/1
 ip access-group FILTER in

Question 11

You are connected to SW1. Configure an LACP EtherChannel between SW1 and SW2 using interfaces GigabitEthernet0/1 and GigabitEthernet0/2. Set the channel-group mode to active on both switches. Verify that the port-channel interface is configured with VLAN 100 as an access port. Then, troubleshoot and fix the issue that prevents the EtherChannel from forming due to a mismatched speed on one of the member links. After correction, verify the EtherChannel is up with 'show etherchannel summary'.

Accepted Answer

Set speed 1000 and duplex full on interface GigabitEthernet0/2 of SW1, ensuring the corresponding interface on SW2 has matching settings, then verify with 'show etherchannel summary'.. The EtherChannel fails because interface GigabitEthernet0/2 on SW1 has a mismatched speed (likely 100 Mbps) compared to the other member link (1000 Mbps). LACP requires all member ports to have identical speed and duplex. The solution is to set the speed on Gi0/2 to 1000 and duplex to full. After correction, the port will bundle, and the port-channel will come up. Verification with 'show etherchannel summary' should show both ports as 'P' (bundled) and the port-channel as 'SU' (in use, Layer2).

Answer

Change the channel-group mode to desirable on both switches and verify with 'show etherchannel summary'.

Answer

Remove the access VLAN configuration from the port-channel interface and configure it as a trunk port instead.

Answer

Configure the channel-group mode to passive on SW1 and active on SW2, then verify with 'show etherchannel summary'.

Question 12

A static route is configured as 198.51.100.0/24 via 192.0.2.9, but the connected network to the next hop goes down. What happens to the static route in the routing table?

Accepted Answer

It is removed because the recursive next hop is no longer reachable.. If the outgoing interface or connected path to the next hop becomes unreachable, the router cannot resolve the recursive next hop and the route is removed from the table.

Answer

It remains permanently because static routes never disappear.

Answer

It changes automatically into a default route.

Answer

It becomes an OSPF external route.

Question 13

You are connected to R1, a multilayer switch acting as the root bridge for VLAN 10. The network has experienced a loop, and interface GigabitEthernet0/1 on R1 is currently in err-disabled state due to a BPDU guard violation. Configure the switch to recover automatically from err-disable state after 300 seconds, then verify that the interface comes back up.

Accepted Answer

Configure 'errdisable recovery cause bpduguard' and 'errdisable recovery interval 300' globally, then verify with 'show interfaces status'.. The interface Gi0/1 is in err-disabled state because BPDU Guard detected an unexpected BPDU on a PortFast-enabled access port. To recover automatically, configure errdisable recovery cause bpduguard and set the recovery interval to 300 seconds with errdisable recovery interval 300. After applying these commands, the interface will automatically come out of err-disable state after 300 seconds. The blocking port on Gi0/2 is expected because R1 is the root bridge and Gi0/2 is an alternate port providing redundancy; no action is needed for that blocking state.

Answer

Configure 'spanning-tree portfast bpduguard default' and 'errdisable recovery interval 300' globally, then verify with 'show spanning-tree'.

Answer

Configure 'errdisable recovery cause all' and 'errdisable recovery interval 300' globally, then verify with 'show errdisable recovery'.

Answer

Configure 'errdisable recovery cause bpduguard' and 'errdisable recovery interval 300' on interface GigabitEthernet0/1, then verify with 'show interfaces GigabitEthernet0/1'.

Question 14

Exhibit: A router has both an OSPF-learned default route and a floating static default route. Which route is currently active?

Accepted Answer

The OSPF default route, because AD 110 beats the floating static AD 150. A floating static route only takes over when its administrative distance is set higher than the preferred route and the preferred route disappears. The routing table shows the OSPF default because AD 110 is lower than the floating static AD 150.

Answer

The static route, because static routes always override dynamic routes

Answer

Both routes load-balance automatically

Answer

Neither route, because a default route cannot be learned by OSPF

Question 15

Drag and drop the following steps into the correct order to configure Root Guard on designated ports, Loop Guard on non-designated ports, and BPDU Guard on PortFast ports, and then recover a port that enters err-disabled due to BPDU Guard.

Accepted Answer

1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Recover a port in err-disabled state due to BPDU Guard by shutting it down and re-enabling it.. The correct order begins with Root Guard on designated ports to prevent them from becoming root ports upon receiving superior BPDUs. Next, Loop Guard is applied to non-designated ports (alternate/backup) to protect against unidirectional link failures. Then, BPDU Guard is placed on PortFast-enabled ports to shut them down if a BPDU is received, preventing rogue switch connections. Finally, recovery from BPDU Guard err-disable requires a manual interface reset (shutdown/no shutdown) because the errdisable cause 'bpduguard' has no automatic timeout.

Answer

1. Configure BPDU Guard on designated ports. 2. Configure Root Guard on non-designated ports. 3. Configure Loop Guard on PortFast ports. 4. Recover a port in err-disabled state by reloading the switch.

Answer

1. Configure Loop Guard on designated ports. 2. Configure BPDU Guard on non-designated ports. 3. Configure Root Guard on PortFast ports. 4. Recover a port in err-disabled state by waiting for the errdisable timeout.

Answer

1. Configure Root Guard on non-designated ports. 2. Configure Loop Guard on designated ports. 3. Configure BPDU Guard on all ports. 4. Recover a port in err-disabled state by removing BPDU Guard configuration.