CCNA Practice Test 39 — 15 Questions

Question 1

Refer to the exhibit. A network engineer is troubleshooting a missing route on R1. The router R3 is configured to advertise network 192.168.30.0/24 via OSPF, but the route is not present in the OSPF routing table of R1 when issuing the show ip route ospf command. What is the most likely cause?

Accepted Answer

R3 has passive-interface default configured and has not issued the no passive-interface command on the interface facing the OSPF neighbor.. The exhibit from R1# show ip route ospf displays OSPF routes for 192.168.10.0/24 and 192.168.20.0/24 learned via 10.1.1.2 on GigabitEthernet0/1, proving that OSPF is functioning with neighbor R2. The route 192.168.30.0/24 that R3 is supposed to advertise is missing, indicating that R1 has not formed an OSPF adjacency with R3. When 'passive-interface default' is configured, OSPF hello packets are suppressed on all interfaces unless explicitly overridden with 'no passive-interface'. As a result, R3 does not send hellos, preventing adjacency and route advertisement. This directly explains why the exhibit lacks the 192.168.30.0/24 entry.

Answer

R3 has not enabled OSPF on the network 192.168.30.0/24 using the network command.

Answer

R1 has an inbound ACL applied to GigabitEthernet0/1 that blocks OSPF multicast traffic to 224.0.0.5 and 224.0.0.6.

Answer

R3's OSPF router ID is duplicated with another OSPF router, causing the SPF algorithm to drop routes.

Question 2

After configuring the area 0 range 10.0.0.0 255.255.0.0 command on an OSPF ABR, a technician finds that a host at 10.0.5.100 in Area 1 cannot reach hosts in Area 0. The ABR’s OSPF database shows only the summary 10.0.0.0/16 in Area 0, and no individual /24 routes. What is the most likely cause?

Accepted Answer

The area range command causes the ABR to advertise only the summary LSA and suppress the more-specific Type-3 LSAs for the range.. The area 0 range command on an OSPF ABR creates a summary Type-3 LSA and suppresses the more-specific Type-3 LSAs within that range. This is expected OSPF route summarization behavior; only the summary route is advertised into Area 0, which explains why the /24 routes are missing. The ABR continues to forward traffic properly because it retains specific routes learned from Area 1, so connectivity within the summary should still work under normal conditions. The other answers either describe non-existent configurations or misunderstand the discard route's role.

Answer

The ABR is filtering the specific /24 routes using a distribute-list under the OSPF process.

Answer

The routers in Area 1 are no longer advertising their /24 routes to the ABR because the ABR is in a different area.

Answer

The ABR has automatically created a discard route to null0 for the summary, which is dropping all traffic destined to the summarized networks.

Question 3

A technician is troubleshooting an issue where internal hosts can successfully ping internet addresses but cannot establish HTTP sessions. The router is configured with PAT (overload) and uses an access list to define the inside local addresses. Recently, the internal network was renumbered from 192.168.0.0/24 to 10.0.0.0/24. What is the most likely cause?

Accepted Answer

The NAT access list still permits 192.168.0.0/24 and does not match the new 10.0.0.0/24 addresses.. PAT translates private addresses to a single public IP by matching the source against a NAT access list. The ACL permits only 192.168.0.0/24, so packets from the new 10.0.0.0/24 addresses are not translated. ICMP may still succeed due to an existing static NAT entry for ICMP echo or a separate rule, but HTTP requires new dynamic translations that the ACL blocks. The other options are plausible but do not align as directly with the recent renumbering and the configured NAT ACL.

Answer

The router's HTTP inspection rule is blocking outbound TCP port 80.

Answer

The outside interface access list is blocking TCP packets from the new 10.0.0.0/24 subnet.

Answer

The default route has been changed to point to the wrong next-hop address, causing only HTTP packets to be dropped.

Question 4

Why is a default route useful on a small branch router connected to a single upstream provider?

Accepted Answer

It provides a simple next hop for unknown destinations toward the upstream connection.. A default route is useful because it gives the branch a simple fallback next hop for destinations the router does not know specifically. In practical terms, the branch router does not need a full table of every external destination if all unknown traffic should go upstream. That keeps the design simple and efficient.

This is one of the most practical default-route use cases in small or edge networks.

Answer

It makes every route more specific.

Answer

It replaces the need for any interface addressing.

Answer

It forces all users into one VLAN.

Question 5

Refer to the exhibit. An administrator has configured PAT for internal hosts to access the internet, but users report that they cannot reach external websites. The administrator suspects a NAT issue and runs the show ip nat statistics command. What is the most likely cause of the problem?

Accepted Answer

The NAT overload pool is incorrectly configured with the inside interface Gi0/1 instead of the outside interface Gi0/0.. The Dynamic mappings section reveals an inside source overload entry bound to interface GigabitEthernet0/1, which is listed under Inside interfaces. For PAT to work, the overload rule must use an outside (WAN) interface (here GigabitEthernet0/0), not an inside interface. This misconfiguration causes all translation attempts to fail, reflected in Hits: 0 and Misses: 15042.

Answer

The access-list 1 used in the NAT statement is not matching any traffic.

Answer

CEF switching is disabled, causing all packets to be punted to the process level and NAT to fail.

Answer

The maximum number of NAT translations has been reached, causing new translations to be denied.

Question 6

A router learns 172.16.40.0/24 from OSPF with AD 110 and metric 20. It also learns the same prefix from EIGRP with AD 90 and feasible distance 30720. Which route is installed?

Accepted Answer

The EIGRP route because its administrative distance is lower. When the same prefix is learned from different routing protocols, the router compares administrative distance first. EIGRP internal routes have AD 90, which beats OSPF AD 110, so the EIGRP path goes into the table.

Answer

The OSPF route because metric 20 is lower than 30720

Answer

Both routes because ECMP is automatic across different protocols

Answer

Neither route until one is redistributed into the other protocol

Question 7

Refer to the exhibit. An administrator has configured NAT on router R1 to allow hosts on the 192.168.1.0/24 LAN to access the Internet. However, users report that they cannot reach external websites. The administrator runs the show ip nat translations command. What is the most likely reason for the problem?

Accepted Answer

The ip nat inside command is missing from the LAN-facing interface.. The output shows only static NAT entries (protocol column "---") with no dynamic translations. The presence of static entries does not depend on the dynamic NAT configuration. For dynamic NAT (like PAT overloading) to create translations for outbound traffic, the interface that receives packets from the inside hosts must have the ip nat inside command. Because the LAN-facing interface is missing this command, no packets from 192.168.1.0/24 are evaluated for NAT, resulting in an empty dynamic translation table and connectivity failure.

Answer

The access list used for dynamic NAT does not match the LAN subnet.

Answer

The ip nat outside command is missing from the WAN interface.

Answer

The ip nat inside source static commands have incorrect IP addresses.

Question 8

Exhibit: R3 learns 10.50.0.0/16 by OSPF through two equal-cost paths. What will R3 do by default?

Accepted Answer

Install both routes and load balance. When OSPF has equal-cost routes to the same destination, the router installs multiple paths and can load balance across them, assuming the platform supports the default maximum-paths value.

Answer

Choose the route from the neighbor with the highest router ID only

Answer

Install only one route because OSPF does not support ECMP

Answer

Prefer the path with the lower next-hop IP address

Question 9

Refer to the exhibit. A network engineer is troubleshooting DHCP issues on a branch office network. Several users report that new devices are unable to obtain IP addresses, even though the DHCP pool configured on R1 appears to have sufficient free addresses. The engineer executes the show ip dhcp conflict command and observes the output. Based on the output, what is the most likely cause of the problem?

Accepted Answer

Several hosts on the network are using static IP addresses from the DHCP pool range, causing the DHCP server to mark those addresses as conflicts and depleting the available pool.. The exhibit lists ten IP addresses (192.168.1.50 through .59) that have been detected as conflicts via Ping. This means the DHCP server sent ICMP echo requests to these addresses before offering them and received replies, confirming that hosts with those IPs already exist on the network—likely devices with static IP configurations. The server then marks them as conflicts and excludes them from the pool, reducing the number of available addresses. With multiple static hosts consuming the address space, the DHCP pool becomes effectively exhausted, preventing new devices from obtaining IPs.

Answer

The DHCP scope is misconfigured with an exclusion range that includes 192.168.1.50 to 192.168.1.59.

Answer

The ping timeout on the DHCP server is set too low, causing it to falsely detect conflicts.

Answer

The DHCP server is not properly releasing expired leases, causing the conflict table to fill up.

Question 10

Refer to the exhibit. An administrator is trying to access a web server in the DMZ at 192.168.1.10 using HTTPS, but the connection times out. The web server is confirmed to be running and listening on both port 80 and port 443. The administrator examines the access list configuration on the perimeter router. Based on the output of the show access-lists command, what is the most likely cause of the failure?

Accepted Answer

The access list does not include a permit statement for TCP port 443.. Line 10 of ACL 100 explicitly permits only TCP traffic with destination port 80 ('eq www'). HTTPS relies on TCP port 443, which is not matched by any permit entry. Consequently, HTTPS traffic from any source to any host in 192.168.1.0/24 hits the explicit deny at line 20 (or the implicit deny) and is dropped. The high match count on the deny statement (1356) confirms that traffic other than HTTP is being blocked, including HTTPS.

Answer

The access list is applied in the wrong direction on the interface.

Answer

The web server is not actually listening on TCP port 443, despite the configuration.

Answer

The 'deny ip any any log' statement at the end of the access list is blocking the HTTPS traffic, so it must be removed.

Question 11

A network engineer notices that hosts in the 192.168.2.0/24 network connected to router R1's GigabitEthernet0/1 interface cannot reach the Internet. R1 has a standard ACL 10 configured as 'access-list 10 permit 192.168.1.0 0.0.0.255' and applied inbound on interface GigabitEthernet0/0, which connects to the 192.168.1.0/24 LAN. What is the most likely cause?

Accepted Answer

The ACL is filtering return traffic from the Internet that enters G0/0, because it is applied inbound on that interface instead of outbound.. The ACL 10 is applied inbound on the G0/0 interface that faces the 192.168.1.0/24 LAN and the Internet. Inbound ACLs on that interface examine packets entering the router on G0/0, such as return traffic from the Internet. Since the ACL permits only source IPs from 192.168.1.0/24, all return traffic from the Internet destined for 192.168.2.0/24 hosts is denied by the implicit deny. This blocks replies, preventing connectivity. The ACL direction is incorrect for filtering egress traffic; an outbound ACL would be needed to filter packets leaving G0/0, and even then the source would still be denied unless explicitly permitted.

Answer

The implicit deny at the end of ACL 10 is blocking all outbound traffic from the 192.168.2.0/24 network.

Answer

The router is not performing inter-VLAN routing between the 192.168.1.0 and 192.168.2.0 networks.

Answer

The ACL is missing a permit statement for the 192.168.2.0/24 network to allow traffic from that subnet.

Question 12

Exhibit: R1 has a static default route to 192.0.2.2 and also learns a default route from OSPF. Which default route is installed in the routing table?

Accepted Answer

The static default route because its administrative distance is lower. When two routes to the same prefix are learned from different sources, the router compares administrative distance first. A static route has AD 1 by default, while OSPF has AD 110, so the static default route wins unless its AD was changed manually.

Answer

The OSPF default route because dynamic routes are preferred

Answer

Both default routes because they have the same prefix length

Answer

Neither route until a floating static route is configured

Question 13

Refer to the exhibit. A network administrator is troubleshooting an NTP synchronization issue on R1. The router is configured with the command ntp server 10.1.1.100, but the clock remains unsynchronized. The administrator issues the show ntp status command. What is the most likely cause of the problem?

Accepted Answer

The router cannot reach the NTP server 10.1.1.100 at UDP port 123 due to a routing issue or an access list.. The output shows 'Clock is unsynchronized, stratum 16, no reference clock,' which means the router has not received any valid NTP updates from the configured server. This state is typical when the NTP server 10.1.1.100 is unreachable at the network layer—either because of a missing route or an ACL blocking UDP port 123. If the server were reachable but authentication failed, the output might still show a reference clock (but unsynchronized) or show reachability in the NTP associations table, which is absent here.

Answer

The NTP authentication key configured on R1 does not match the one on the server.

Answer

The system time on R1 is set to an epoch that is too far from the server's time, causing NTP to refuse to synchronize.

Answer

The NTP service is not enabled on R1; the 'ntp server' command only defines a server but does not start the NTP process.

Question 14

A network engineer wants a static route to be used only when the OSPF-learned route disappears. Which configuration approach meets that goal?

Accepted Answer

Use a static route with administrative distance higher than 110. That is a floating static route. You configure the static route with an administrative distance higher than the OSPF route so it stays in reserve until the dynamic path is lost.

Answer

Use a static route with administrative distance 1

Answer

Use a static route with metric 0

Answer

Redistribute the static route into OSPF

Question 15

Refer to the exhibit. A network administrator is reviewing the NAT translations on router R1 and notices that the internal host 192.168.1.10 appears in both a static NAT entry (for ports 80 and 443) using global address 203.0.113.10, and a dynamic PAT entry (port 49152) using global address 203.0.113.1. The administrator is concerned this might indicate a misconfiguration. Based on the output, which statement is correct?

Accepted Answer

The translations are functioning correctly; the static entries allow inbound web traffic to the host, while the dynamic PAT entry supports an outbound client connection.. The output shows static NAT entries mapping TCP ports 80 and 443 from global 203.0.113.10 to inside host 192.168.1.10. Simultaneously, a dynamic PAT entry maps a high ephemeral port 49152 to the same inside host for an outbound connection to 198.51.100.5:80. Because the static entries use a different global IP (203.0.113.10) and different port numbers than the dynamic PAT entry (203.0.113.1:49152), both can coexist correctly — static NAT handles inbound web requests, dynamic PAT handles outbound client traffic. This is a normal operational state, not a misconfiguration.

Answer

The static NAT rule is being overridden by the dynamic PAT rule, causing inbound web traffic to the server to fail.

Answer

The dynamic PAT entry indicates a duplicate session that will cause asymmetric routing and packet drops.

Answer

The router is incorrectly performing both static and dynamic NAT for the same inside address, which violates the configured NAT order.