CCNA Practice Test 39 — 15 Questions

Question 1

An administrator configures a GRE tunnel interface on a router with the following: interface Tunnel0, tunnel source GigabitEthernet0/0, tunnel destination 192.168.2.2. What is the main purpose of this configured tunnel?

Accepted Answer

It creates a logical tunnel across another network.. GRE is a tunneling mechanism used to carry one type of traffic over another network path by encapsulating packets. In practical terms, the configuration creates a logical tunnel between endpoints so traffic can cross an underlying IP network as if a virtual path existed between them. The key point is that GRE is about tunneling, not encryption by itself.

This distinction matters because people often assume tunnels automatically imply encryption. GRE by itself does not provide that.

Answer

It enables PPP authentication on a serial interface.

Answer

It configures WPA3 security for a wireless bridge.

Answer

It enables BGP between autonomous systems automatically.

Question 2

You are connected to R1. The network consists of three routers: R1, R2, and R3. R1 must reach the loopback network 203.0.113.0/24 on R3 via two paths: a primary static route through R2's G0/0 (192.0.2.2) and a floating static route through R2's G0/1 (198.51.100.2) with an administrative distance of 150. Additionally, R1 already has a default route pointing to 192.0.2.2. Configure the two static routes to 203.0.113.0/24 on R1 as described. The default route does not need to be changed. Verify that the primary route is active and the floating route is used only if the primary fails.

Accepted Answer

Configure ip route 203.0.113.0 255.255.255.0 192.0.2.2 and ip route 203.0.113.0 255.255.255.0 198.51.100.2 150. The default route is already configured. No further changes needed.. It correctly configures the primary static route to 203.0.113.0/24 via 192.0.2.2 (default AD 1) and the floating static route via 198.51.100.2 with AD 150, ensuring the primary route is preferred. The default route to 192.0.2.2 is already configured and does not need modification. Options B, C, and D are incorrect: B wrongly adds a higher AD to the default route, C inverts the ADs on the two routes, and D omits the required AD on the floating route, causing both routes to have equal AD and potential load balancing or conflict.

Answer

Configure ip route 203.0.113.0 255.255.255.0 192.0.2.2 and ip route 203.0.113.0 255.255.255.0 198.51.100.2 150. Also, remove the existing default route and re-add it with a higher administrative distance.

Answer

Configure ip route 203.0.113.0 255.255.255.0 192.0.2.2 150 and ip route 203.0.113.0 255.255.255.0 198.51.100.2. The default route is already configured.

Answer

Configure ip route 203.0.113.0 255.255.255.0 192.0.2.2 and ip route 203.0.113.0 255.255.255.0 198.51.100.2. The default route is already configured. No administrative distance is needed because the router will automatically prefer the route with the lower metric.

Question 3

You are connected to R1, a router that must establish OSPFv3 adjacency with R2 over the directly connected link G0/0. The current configuration is incomplete: OSPFv3 process is configured but not enabled on the interface, and global IPv6 unicast routing is missing. Configure R1 so that it becomes an OSPFv3 neighbor with R2 and learns the loopback route 2001:db8:1:2::/64 via OSPFv3. Then verify neighbor state and routing table.

Accepted Answer

Enable IPv6 unicast routing globally and activate OSPFv3 on GigabitEthernet0/0 with the command 'ipv6 ospf 1 area 0'.. R1 is missing two critical configurations: global IPv6 unicast routing must be enabled with 'ipv6 unicast-routing', and OSPFv3 must be activated on GigabitEthernet0/0 using 'ipv6 ospf 1 area 0' under the interface. Without these, R1 cannot send or receive OSPFv3 hellos, so no adjacency forms and routes are not exchanged. After applying both commands, the neighbor state becomes FULL and the remote loopback appears in the IPv6 routing table.

Answer

Enable IPv6 unicast routing globally and configure OSPFv3 process 1 with the 'network' command under the OSPFv3 router configuration mode.

Answer

Enable IPv6 unicast routing globally and configure OSPFv3 process 1 with the 'router-id' command to ensure adjacency.

Answer

Enable IPv6 unicast routing globally and configure OSPFv3 process 1 with the 'passive-interface default' command to allow adjacency.

Question 4

You are connected to R1. The network currently uses a static default route pointing to ISP1 (198.51.100.1) via GigabitEthernet0/0. However, the backup link to ISP2 (203.0.113.1) via Serial0/0/0 has a floating static default route with an administrative distance of 130. The backup route is not taking over when the primary link fails. Configure the floating static route correctly so that it becomes active when the primary route is lost, and verify that the routing table shows the backup default route with the appropriate next-hop.

Accepted Answer

Remove the primary static route and reconfigure it without the 'permanent' keyword, then verify the backup route appears in the routing table.. The primary static default route was configured with the 'permanent' keyword, which keeps the route in the routing table even when the GigabitEthernet0/0 interface goes down. This prevents the floating static route (AD 130) from becoming active. The solution is to remove the primary route (no ip route 0.0.0.0 0.0.0.0 198.51.100.1 permanent) and reconfigure it without the 'permanent' keyword. After that, when the primary link fails, the route is removed, and the backup route (AD 130) enters the routing table. Option A is correct. Option B would make the backup preferred over the primary, which is not the intended behavior. Option C (adding permanent to the backup) would not help and could cause issues. Option D (track) is an alternative but not the required configuration here.

Answer

Change the administrative distance of the floating static route to 1 so it is preferred over the primary route.

Answer

Add the 'permanent' keyword to the floating static route to ensure it remains in the routing table.

Answer

Configure a static route with a next-hop of 203.0.113.1 and an administrative distance of 130, but also add the 'track' command to monitor the primary link.

Question 5

You are connected to R1, a branch router connected to a central NTP server at 203.0.113.10 and a syslog server at 198.51.100.20. Configure R1 as an NTP client using its Loopback0 interface (192.168.1.1/32) as the source, and ensure syslog messages of severity 'informational' and above are sent to the syslog server. Currently, R1 shows 'Clock is unsynchronized, stratum 16'. Identify and fix the NTP issue, then apply the syslog configuration.

Accepted Answer

Configure 'ntp source Loopback0' and 'logging trap informational'.. The NTP client was configured but the source interface was not specified, causing the router to use a default source that may not be reachable. Additionally, the syslog trap level was set to 'warnings' (severity 4), which filters out informational (severity 6) messages. To fix: configure 'ntp source Loopback0' to use a consistent source IP, and change 'logging trap informational' to allow all messages severity 6 and above.

Answer

Configure 'ntp server 203.0.113.10 source Loopback0' and 'logging trap warnings'.

Answer

Configure 'ntp source Loopback0' and 'logging trap debugging'.

Answer

Configure 'ntp source Loopback0' and 'logging host 198.51.100.20' without changing the trap level.

Question 6

You are connected to R1 via the console. The network operations center (NOC) has asked you to configure R1 as an NTP client of the NTP server at 192.0.2.10 (reachable via VLAN 100, SVI 192.168.1.1/24). They also need all system messages of level 'debug' (level 7) and higher forwarded to the syslog server at 203.0.113.50. The current configuration shows that NTP is not working (stratum 16) and syslog is only sending critical and higher messages. Fix both issues.

Accepted Answer

Configure 'ntp source Vlan100' and 'logging trap debugging'.. The NTP client is not synchronizing because there is no source interface specified; the NTP packets may be sourced from an unexpected interface and the server may ignore them. The solution is to configure 'ntp source Vlan100' to ensure NTP packets use the correct source IP. Additionally, the syslog trap level is set to 'critical', which filters out messages with severity lower than critical (like warnings, errors, etc.). The NOC requires all messages up to debug level; therefore, change the logging trap level to 'debugging' with 'logging trap debugging'.

Answer

Configure 'ntp server 192.0.2.10' and 'logging trap 7'.

Answer

Configure 'ntp source Vlan100' and 'logging trap warnings'.

Answer

Configure 'ntp update-calendar' and 'logging trap informational'.

Question 7

You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on the designated port facing a downstream switch to prevent a rogue switch from becoming root. Also, enable Loop Guard on the uplink port to prevent STP loops, and configure BPDU Guard on a PortFast-enabled access port. Ensure that if a superior BPDU is received on the Root Guard port, it is blocked, and if a BPDU is received on the BPDU Guard port, it goes err-disabled.

Accepted Answer

The configuration is correct; no changes are needed.. R1 is the STP root for VLAN 10. The downstream port (G0/1) is a designated port, so Root Guard is correctly applied to prevent a superior BPDU from being accepted. The uplink port (G0/0) is a root port, so Loop Guard should be applied there to prevent an STP loop if BPDUs stop arriving. The access port (G0/2) has PortFast and BPDU Guard enabled, which will err-disable the port if a BPDU is received. The current configuration is correct; no changes are needed. If a superior BPDU arrives on G0/1, Root Guard will block the port. If a BPDU arrives on G0/2, BPDU Guard will err-disable it.

Answer

Root Guard should be applied on G0/0 instead of G0/1, and Loop Guard on G0/1 instead of G0/0.

Answer

BPDU Guard should be configured on G0/1 instead of G0/2, and Loop Guard should be removed from G0/0.

Answer

Root Guard should be applied on G0/2 instead of G0/1, and BPDU Guard should be removed from G0/2.

Question 8

A router has a directly connected route to 10.1.1.0/24 and a static default route. Which route is used for traffic to 10.1.1.200?

Accepted Answer

The directly connected 10.1.1.0/24 route. The directly connected route is used because it is the most specific and most immediate match. In practical terms, the router already knows that 10.1.1.200 belongs to a network on one of its own interfaces, so there is no reason to use the default route. The default route exists only for destinations that do not match anything more specific.

This is one of the most fundamental route-selection behaviors in IP routing.

Answer

The static default route

Answer

Both routes equally

Answer

Neither route

Question 9

Drag and drop the following steps into the correct order to capture and analyze traffic for L2/L3 troubleshooting.

Accepted Answer

Identify the source interface or VLAN to monitor for traffic capture.. The steps follow the logical sequence of a packet capture: first identify the traffic source, then configure a SPAN session to mirror it, connect the capture device, start capture, reproduce the issue, stop capture, and finally analyze the output. Each step must be completed before the next can succeed.

Question 10

Which TWO statements are true about configuring and verifying VLANs, 802.1Q trunking, native VLAN, and inter-VLAN routing with router-on-a-stick?

Accepted Answer

On a router-on-a-stick configuration, each subinterface must be configured with an IP address and the encapsulation dot1Q command to specify the VLAN ID.. In a router-on-a-stick configuration, each subinterface must be assigned an IP address and use the encapsulation dot1Q command to associate it with a specific VLAN ID; this enables the router to process tagged frames from multiple VLANs over a single physical link. Option D is also correct because the native VLAN configured on the switchport trunk must match the native VLAN used on the router's subinterface (or physical interface if no subinterface); a mismatch causes the router to mishandle untagged frames because it expects them to belong to the configured native VLAN, leading to communication failures. Option B is wrong because on an 802.1Q trunk, the native VLAN frames are sent untagged, not tagged. Option C is wrong because the command 'switchport trunk native vlan 10' only changes the native VLAN; it does not restrict which VLANs are allowed—that requires 'switchport trunk allowed vlan'. Option E is wrong because 'show interfaces trunk' shows trunking status, native VLAN, and allowed VLAN lists on switch ports, not IP addresses of router subinterfaces.

Answer

The native VLAN is always tagged on an 802.1Q trunk link.

Answer

The command switchport trunk native vlan 10 is used to restrict which VLANs are allowed on a trunk.

Answer

The command show interfaces trunk displays the IP addresses configured on router subinterfaces.

Question 11

Which THREE of the following best describe how agentic AI is used in network automation, specifically regarding AI agents, tool-calling, and closed-loop remediation workflows?

Accepted Answer

AI agents can autonomously decide which network troubleshooting steps to perform and invoke appropriate tools via APIs.. Options A, C, and D are correct because agentic AI in network automation involves autonomous decision-making (A), tool-calling to execute network commands or gather data (C), and closed-loop remediation that continuously monitors, diagnoses, and applies fixes automatically (D). Options B and E are incorrect because they contradict the autonomous nature of agentic AI: B describes a passive monitoring system with human-only remediation, and E states that closed-loop remediation always requires human approval, which is not true for full closed-loop automation.

Answer

AI agents only monitor network traffic and alert humans for any remediation actions.

Answer

Closed-loop remediation always requires a human to approve each corrective action before it is executed.

Question 12

A port connected to an end host is configured with PortFast and BPDU Guard. What is the most likely result if a small unmanaged switch is connected and starts sending BPDUs?

Accepted Answer

The port is error-disabled by BPDU Guard.. The most likely result is that the port is placed into an err-disabled state by BPDU Guard. In practical terms, PortFast tells the switch to treat the interface like an edge port for a normal endpoint, which is why it starts forwarding quickly. BPDU Guard protects that assumption. If the port suddenly receives a spanning-tree BPDU, the switch treats that as a sign that the port is no longer connected to a simple end device.

This combination is common in enterprise access-layer design because it improves user startup time while still protecting the topology. The correct answer is the one that describes the port being shut down automatically when BPDUs appear unexpectedly.

Answer

The port automatically becomes the root port.

Answer

The port is converted into a trunk.

Answer

The port ignores the BPDU because PortFast disables STP entirely.

Question 13

A host can reach remote websites by IP address but fails when using their hostnames. Which missing configuration item is the strongest suspect?

Accepted Answer

A DNS server address. When a host can reach remote websites by IP address but not by hostname, the issue is that the host cannot resolve the hostname to an IP address. DNS (Domain Name System) is responsible for this resolution, and if the DNS server address is missing or misconfigured on the host, name resolution fails. This is the strongest suspect because all other network connectivity (routing, switching) is functional, as proven by successful IP-based access.

Answer

A new MAC address

Answer

A trunk native VLAN

Answer

An OSPF router ID

Question 14

You are connected to R1. Configure SNMPv3 with authentication (SHA) and encryption (AES-128) for user 'monitor' in group 'AdminGroup', and also configure SNMPv2c read-only community string 'cisco123' to send traps to the management server at 192.0.2.100. Additionally, configure NetFlow on interface GigabitEthernet0/0 to export flow data to 198.51.100.50 using version 9. Verify your configuration using the appropriate show commands.

Accepted Answer

snmp-server group AdminGroup v3 priv read AdminView; snmp-server user monitor AdminGroup v3 auth sha cisco123 priv aes 128 cisco123; snmp-server community cisco123 ro; snmp-server host 192.0.2.100 traps version 2c cisco123; interface GigabitEthernet0/0; ip flow-export destination 198.51.100.50 9996; ip flow-export version 9; ip flow ingress. The configuration was missing SNMPv3 user, group, and trap settings. We added the SNMPv3 user 'monitor' with SHA authentication and AES-128 encryption, created a view and group 'AdminGroup' with read access, and configured the SNMPv2c community string 'cisco123' for read-only access. We also enabled SNMP traps to the manager at 192.0.2.100 and configured NetFlow on GigabitEthernet0/0 to export to 198.51.100.50 using version 9. Verification commands show the SNMP configuration and NetFlow flow cache.

Answer

snmp-server group AdminGroup v3 auth read AdminView; snmp-server user monitor AdminGroup v3 auth sha cisco123 priv aes 128 cisco123; snmp-server community cisco123 ro; snmp-server host 192.0.2.100 traps version 2c cisco123; interface GigabitEthernet0/0; ip flow-export destination 198.51.100.50 9996; ip flow-export version 9; ip flow ingress

Answer

snmp-server group AdminGroup v3 priv read AdminView; snmp-server user monitor AdminGroup v3 auth sha cisco123 priv des 56 cisco123; snmp-server community cisco123 ro; snmp-server host 192.0.2.100 traps version 2c cisco123; interface GigabitEthernet0/0; ip flow-export destination 198.51.100.50 9996; ip flow-export version 9; ip flow ingress

Answer

snmp-server group AdminGroup v3 priv read AdminView; snmp-server user monitor AdminGroup v3 auth sha cisco123 priv aes 128 cisco123; snmp-server community cisco123 ro; snmp-server host 192.0.2.100 traps version 2c cisco123; interface GigabitEthernet0/0; ip flow-export destination 198.51.100.50 9996; ip flow-export version 5; ip flow ingress

Question 15

Exhibit: A switch port connected to an end host is stuck in a blocking state much longer than expected after a reboot. Which configuration change most directly speeds host access while still keeping loop protection elsewhere?

Accepted Answer

Enable PortFast on the access port. PortFast should be enabled on access ports that connect to end devices. It lets the port move to forwarding quickly without waiting through normal STP listening and learning delays. Disabling STP globally removes all loop protection, which contradicts the requirement to keep loop protection elsewhere. Changing the trunk native VLAN is irrelevant to an access port's STP state transition. Adjusting duplex has no effect on STP timers and would not speed up host access.

Answer

Disable STP globally

Answer

Change the trunk native VLAN

Answer

Set the port to half-duplex