CCNA Practice Test 41 — 15 Questions

Question 1

You are troubleshooting connectivity from R1 to the 203.0.113.0/24 network. R1 is a multilayer switch running routed ports. Currently, R1 has two paths to reach that network: one via R2 (192.0.2.2) and one via R3 (198.51.100.2). The path via R2 is preferred, but after a link failure between R1 and R2, traffic should automatically fail over to the R3 path. However, after the failure, traffic is still being sent to R2. Examine the routing table and configuration, then fix the issue so that the floating static route takes over correctly when the primary route is lost.

Accepted Answer

Replace the primary static route with one that uses an exit interface: ip route 203.0.113.0 255.255.255.0 GigabitEthernet1/0/1 192.0.2.2. The issue is that the primary static route to 203.0.113.0/24 via 192.0.2.2 has an administrative distance of 1 (default), and the backup floating static route via 198.51.100.2 has an AD of 200. When the next-hop interface (Gi1/0/1) goes down, the route via 192.0.2.2 should be removed from the routing table because its next-hop is unreachable. However, the show output indicates that the route remains, which suggests that the static route is configured with the 'permanent' keyword or that the next-hop is still considered reachable via some other mechanism (e.g., a recursive lookup to a still-active route). In this case, the most common fix is to add the 'track' option or to remove the static route and re-add it without the 'permanent' keyword, or to ensure that the static route uses an interface instead of just an IP address. The correct solution is to replace the primary static route with one that uses an exit interface, so that the route is automatically removed when the interface goes down. For example: 'ip route 203.0.113.0 255.255.255.0 GigabitEthernet1/0/1 192.0.2.2'. This causes the route to be directly dependent on the interface state.

Answer

Increase the administrative distance of the floating static route to 255

Answer

Add the permanent keyword to the floating static route

Answer

Change the administrative distance of the primary static route to 200 and the floating static route to 1

Question 2

A switch interface connected to a Cisco IP phone with a PC behind it must carry voice and data correctly. Which two switchport commands are appropriate on that access port?

Accepted Answer

switchport access vlan 10. The access VLAN carries the workstation data traffic, and the voice VLAN carries tagged voice traffic for the IP phone. That is the standard campus switchport design for a phone with a PC behind it. The port itself remains an access port, but the two most directly relevant commands here are the access VLAN and voice VLAN assignments.

Answer

switchport mode trunk

Answer

channel-group 1 mode active

Answer

spanning-tree cost 1

Question 3

You are connected to R1. The network team reports intermittent connectivity between R1 and R2. Examine the following `show interface` output from R1 to identify the root cause of the issue. Then apply the necessary configuration commands on R1 to resolve the problem.

GigabitEthernet0/0 is up, line protocol is up
  Internet address is 10.0.0.1/30
  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
     reliability 255/255, txload 1/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, 100Mb/s, media type is RJ45
  output flow-control is unsupported, input flow-control is unsupported
  Last input 00:00:01, output 00:00:01, output hang never
  Last clearing of "show interface" counters never
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 0 bits/sec, 0 packets/sec
     100 packets input, 8000 bytes, 0 no buffer
     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles
     100 input errors, 100 CRC, 0 frame, 0 overrun, 0 ignored
     0 output errors, 0 collisions, 0 interface resets
     0 output buffer failures, 0 output buffers swapped out

Accepted Answer

Enter interface configuration mode for the problematic interface and issue the 'no speed' and 'no duplex' commands to revert to auto-negotiation.. The show interface output reveals 100 CRC errors and 100 input errors, indicating a physical layer problem. Additionally, the interface is manually configured for full-duplex and 100 Mb/s. CRC errors often point to a duplex mismatch or faulty cable. Since R1 is set to full-duplex, if R2 is set to auto-negotiation (or half-duplex), a mismatch occurs. The fix is to set both sides to auto-negotiation by removing manual speed and duplex settings. On R1, enter interface configuration mode and issue 'no speed' and 'no duplex' to revert to auto-negotiation, then verify with 'show interfaces' that the interface negotiates to full-duplex and errors stop incrementing.

Answer

Enter interface configuration mode and issue the 'speed 100' and 'duplex full' commands to ensure both sides are set to the same values.

Answer

Enter interface configuration mode and issue the 'no shutdown' command to bring the interface up.

Answer

Enter interface configuration mode and issue the 'duplex half' command to match the remote side's duplex setting.

Question 4

What prefix length corresponds to the subnet mask 255.255.255.224?

Accepted Answer

/27. The subnet mask 255.255.255.224 corresponds to /27. In plain language, the first three octets contribute 24 network bits, and 224 in binary is 11100000, which contributes 3 more network bits. That gives a total of 27 network bits.

This is a common prefix-conversion question because it checks whether you can move between dotted-decimal masks and prefix lengths confidently.

Answer

/26

Answer

/28

Answer

/29

Question 5

A switch has DHCP snooping enabled, but users still experience IP-to-MAC spoofing attacks. Which additional feature should be considered to help address that specific problem?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection (DAI) validates ARP packets against trusted binding information learned through DHCP snooping, directly preventing IP-to-MAC spoofing. PortFast is used to speed up STP convergence and does not provide ARP security. EtherChannel aggregates multiple links for bandwidth and redundancy but does not inspect ARP traffic. NetFlow is a traffic accounting and monitoring tool, not a security control for ARP spoofing. Therefore, DAI is the correct additional feature to address IP-to-MAC spoofing.

Answer

PortFast

Answer

EtherChannel

Answer

NetFlow

Question 6

An engineer is troubleshooting an OSPFv3 adjacency issue between two routers R1 and R2 connected over a serial link. The link is up/up on both sides, and IPv6 is enabled on the interfaces. However, the 'show ipv6 ospf neighbor' command shows no neighbors. The engineer checks the OSPFv3 configuration. What is the most likely cause of the missing adjacency?

Accepted Answer

OSPFv3 authentication is configured on R1 but not on R2.. OSPFv3 uses IPsec for authentication, unlike OSPFv2 which uses plaintext or MD5 authentication. If authentication is configured on one router but not the other, the OSPFv3 Hello packets will be dropped, preventing neighbor adjacency from forming. The 'show ipv6 ospf neighbor' command will show no neighbors because the routers cannot exchange Hello packets successfully.

Answer

The serial interface on R2 is administratively down.

Answer

The IPv6 address on R2 is in a different subnet than R1.

Answer

The OSPFv3 router-id is not configured on R2.

Question 7

A switch port and a host NIC have a duplex mismatch. Which symptom is most likely?

Accepted Answer

Increased late collisions and poor performance. A duplex mismatch often causes collisions, frame errors, and degraded throughput, especially on the half-duplex side. It is a classic physical/link layer performance problem.

Answer

Incorrect VLAN tagging on trunks

Answer

OSPF area mismatch errors

Answer

A change in the subnet mask on the host

Question 8

A network engineer is troubleshooting connectivity between two hosts in different VLANs on the same switch. Host A in VLAN 10 (10.10.10.5/24) cannot ping Host B in VLAN 20 (10.10.20.5/24). The switch is configured as a router-on-a-stick with a trunk port to an external router. The trunk port is up/up, but inter-VLAN routing fails. What is the most likely cause?

Accepted Answer

The VLANs are not allowed on the trunk; the allowed VLAN list is missing VLAN 10 and 20.. The most likely cause is that the allowed VLAN list on the trunk is missing VLAN 10 and 20. Even though the trunk port is up/up, if the switch's allowed VLAN list has been restricted (for example, using the switchport trunk allowed vlan command) and does not include those VLANs, all frames tagged with VLAN 10 or 20 will be discarded at the trunk. This directly prevents inter-VLAN routing despite the trunk being operational, whereas a native VLAN mismatch only affects untagged traffic and would not impact the tagged frames between the two hosts.

Answer

The trunk port is not in trunking mode; it is in dynamic desirable mode.

Answer

The native VLAN on the switch trunk is VLAN 1, but the router subinterface for VLAN 1 is not configured with the 'native' keyword or is missing.

Answer

The switch ports Gi0/4 and Gi0/5 are in access mode but not assigned to the correct VLANs.

Question 9

A company wants all routers and switches to use a common time source so log timestamps line up during incident review. Which two statements about NTP are correct?

Accepted Answer

It helps synchronize device clocks. NTP (Network Time Protocol) is used to synchronize device clocks (option A) so that event timestamps are consistent across network devices, which improves correlation of syslog and other event data (option B). Option C is incorrect because NTP does not advertise Layer 3 reachability; that is a function of routing protocols like OSPF or EIGRP. Option D is incorrect because NTP does not encrypt data traffic by default; it only synchronizes time and does not provide encryption.

Answer

It advertises Layer 3 reachability between routers

Answer

It encrypts data traffic between endpoints by default

Question 10

A network administrator needs to configure VLANs and access ports on 200 managed switches across multiple locations. The administrator requires a solution that uses a push‑based deployment model, does not require any agent software to be installed on the switches, and can be executed from a central control node. Which automation tool is most suitable for this task?

Accepted Answer

Ansible. Ansible is the most suitable tool because it uses a push-based model (SSH) to apply configurations directly to network devices without requiring any agent software. It operates from a central control node, making it ideal for managing 200 switches across multiple locations with a single playbook execution.

Answer

Puppet

Answer

Chef

Answer

Python scripts

Question 11

Exhibit: A branch router receives time from an NTP server, but the show output marks the server with a tilde instead of an asterisk. What does that mean?

Accepted Answer

The server is reachable but not the one currently selected for synchronization. In Cisco NTP output, the asterisk (*) indicates the current synchronization source. The tilde (~) specifically means the server is statically configured and reachable but has not been selected for synchronization. This differs from the plus sign (+), which denotes a candidate for synchronization. Therefore, the router is not using that server as its active time source.

Answer

That server is the current system clock source

Answer

NTP authentication has disabled the server permanently

Answer

The router is acting as an NTP master for that server

Question 12

You are connected to R1 via the console. R1 has two directly connected routers: R2 and R3. Currently, R1 cannot reach R2's loopback interface (203.0.113.1/32). Additionally, R3 is IPv6-only and must be reachable from R1 using a statically assigned global unicast address. Configure R1's interfaces and static routes so that: (1) R1 can ping R2's loopback, (2) R1 can ping R3's IPv6 address 2001:db8:acad:2::1/64, and (3) R1's IPv6 address on the link to R3 is derived using EUI-64.

Accepted Answer

Configure R1's G0/0 with IP 192.168.1.1/24 and add a static route to 203.0.113.1/32 via 192.168.1.2. Configure R1's G0/1 with IPv6 address 2001:db8:acad:2::/64 eui-64.. The ping to R2's loopback fails because R1's G0/0 is configured with a /24 mask, but the network should be /24 (which is correct), but the loopback is on a different subnet (203.0.113.0/24 vs 192.168.1.0/24). Actually the issue is that R1 has no route to 203.0.113.1. The solution is to add a static route on R1 pointing to R2's G0/0 IP. For IPv6, R1's EUI-64 address is on the wrong subnet (2001:db8:acad:1::/64) but R3 is on 2001:db8:acad:2::/64. The fix is to change the IPv6 address on R1's G0/1 to 2001:db8:acad:2::/64 eui-64. Then add an IPv6 static route if needed (but R1 and R3 are directly connected, so after fixing the subnet, ping should work).

Answer

Configure R1's G0/0 with IP 192.168.1.1/24 and add a static route to 203.0.113.0/24 via 192.168.1.2. Configure R1's G0/1 with IPv6 address 2001:db8:acad:1::/64 eui-64.

Answer

Configure R1's G0/0 with IP 192.168.1.1/24 and add a static route to 203.0.113.1/32 via 192.168.1.2. Configure R1's G0/1 with IPv6 address 2001:db8:acad:2::1/64.

Answer

Configure R1's G0/0 with IP 192.168.1.1/24 and add a static route to 203.0.113.1/32 via 192.168.1.2. Configure R1's G0/1 with IPv6 address 2001:db8:acad:1::/64 eui-64.

Question 13

Exhibit: R1 has a static default route to 192.0.2.2 and also learns a default route from OSPF. Which default route is installed in the routing table?

Accepted Answer

The static default route because its administrative distance is lower. When two routes to the same prefix are learned from different sources, the router compares administrative distance first. A static route has AD 1 by default, while OSPF has AD 110, so the static default route wins unless its AD was changed manually.

Answer

The OSPF default route because dynamic routes are preferred

Answer

Both default routes because they have the same prefix length

Answer

Neither route until a floating static route is configured

Question 14

A user reports that their desk port stopped working immediately after they connected a small switch. The interface shows err-disabled, and the log mentions BPDU Guard. What most likely happened?

Accepted Answer

The port received a BPDU and BPDU Guard shut it down.. BPDU Guard is commonly enabled on PortFast access ports to protect the topology. If the port receives a BPDU, the switch assumes another switch may have been connected and places the port into err-disabled state. That is exactly the protective behavior you want at the edge.

Answer

DHCP snooping blocked the user's ARP requests.

Answer

Port security moved the port to protect mode.

Answer

The trunk native VLAN matched incorrectly.

Question 15

Which tool type is most appropriate for turning a variable set of interface values into a reusable configuration template?

Accepted Answer

A templating engine. A templating engine allows you to create a reusable configuration pattern and populate it with variable values, making it ideal for turning variable interface values into templates. A packet sniffer captures network traffic and analyzes packets but does not generate configuration templates. A DNS recursive resolver translates domain names to IP addresses, which is unrelated to configuration templating. An STP root bridge manages loop-free topology in a switched network, not template creation.

Answer

A packet sniffer

Answer

A DNS recursive resolver

Answer

An STP root bridge