CCNA Practice Test 42 — 15 Questions

Question 1

Users on VLAN 20 are not receiving IPv4 addresses from the centralized DHCP server at 10.50.0.10. Users in other VLANs are working normally. Based on the exhibit, which change should fix the issue for VLAN 20 clients?

Accepted Answer

Change the helper address on interface Vlan20 to 10.50.0.10.. The SVI for VLAN 20 is forwarding DHCP requests to the wrong helper address. DHCP relay depends on the Layer 3 interface for that VLAN sending client broadcasts to the correct server. Trunks, access ports, and the DHCP pool name on the server are not the first issue shown here. DHCP snooping can filter DHCP server replies on untrusted ports, but since other VLANs are working and no trust misconfiguration is indicated, the root cause is the incorrect ip helper-address on Vlan20.

Answer

Convert the VLAN 20 user ports to trunk mode.

Answer

Configure a default gateway on the user PCs manually.

Answer

Disable DHCP snooping on VLAN 20.

Question 2

You are connected to R1. The network uses a single router with two subnets: 192.168.1.0/24 (connected to GigabitEthernet0/0) and 10.0.0.0/30 (connected to GigabitEthernet0/1). Configure an extended named ACL called 'FILTER_HTTP' that permits HTTP traffic (TCP port 80) from the 192.168.1.0/24 subnet to any destination, and includes an explicit deny statement to deny all other IP traffic. Apply the ACL inbound on GigabitEthernet0/0. Then verify that HTTP traffic is allowed and all other traffic is blocked.

Accepted Answer

ip access-list extended FILTER_HTTP
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 deny ip any any
interface GigabitEthernet0/0
 ip access-group FILTER_HTTP in. The task requires creating an extended named ACL 'FILTER_HTTP' that permits TCP port 80 from source 192.168.1.0/24 to any destination, and then denies all other IP traffic (the implicit deny will block everything else, but you must explicitly add a deny ip any any statement to make the intent clear). The ACL must be applied inbound on GigabitEthernet0/0. The solution uses the commands: ip access-list extended FILTER_HTTP, permit tcp 192.168.1.0 0.0.0.255 any eq 80, deny ip any any, and interface GigabitEthernet0/0, ip access-group FILTER_HTTP in. Verification with show access-lists and show ip interface GigabitEthernet0/0 confirms the ACL and its application.

Answer

access-list 100 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 access-list 100 deny ip any any
interface GigabitEthernet0/0
 ip access-group 100 in

Answer

ip access-list extended FILTER_HTTP
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
interface GigabitEthernet0/0
 ip access-group FILTER_HTTP in

Answer

ip access-list extended FILTER_HTTP
 permit tcp 192.168.1.0 0.0.0.255 any eq 80
 deny ip any any
interface GigabitEthernet0/1
 ip access-group FILTER_HTTP in

Question 3

An automation script needs to send a bearer token when calling a controller REST API over HTTPS. Where is that token most commonly included?

Accepted Answer

In the HTTP Authorization header. Bearer tokens are typically sent in the HTTP Authorization header. Query parameters or request bodies may carry credentials in some custom APIs, but the normal REST pattern is an Authorization header such as 'Authorization: Bearer <token>'.

Answer

In the Ethernet trailer

Answer

In the DNS response section

Answer

In the TCP checksum field

Question 4

Which TWO statements accurately describe characteristics of copper and fiber optic cabling used in modern Ethernet networks?

Accepted Answer

Fiber optic cables are immune to electromagnetic interference (EMI).. Fiber optic cables transmit data as light pulses through glass or plastic cores, which are completely unaffected by electromagnetic interference (EMI), unlike copper cables that rely on electrical signals and are susceptible to EMI. Option D is correct because single-mode fiber uses a narrow core (typically 9 microns) and laser transmitters to support long-distance transmission (up to tens of kilometers) with low signal loss. Option A is wrong because copper UTP cables are limited to 100 meters without a repeater, not 500 meters. Option C is wrong because multi-mode fiber typically uses LED or VCSEL transmitters for short-range communication, while laser-based transmitters are used with single-mode fiber. Option E is wrong because fiber optic cabling is generally more expensive per meter than copper cabling, though installation and equipment costs may differ.

Answer

Copper UTP cables can reliably transmit data up to 500 meters without a repeater.

Answer

Multi-mode fiber typically uses laser-based transmitters for short-range communication.

Answer

Fiber optic cabling is generally less expensive per meter than copper cabling.

Question 5

At which OSI layer do routers make forwarding decisions based on logical addressing?

Accepted Answer

Layer 3. Routers operate at the network layer when making forwarding decisions based on logical Layer 3 addresses such as IPv4 or IPv6 destination addresses.

Answer

Layer 1

Answer

Layer 2

Answer

Layer 4

Question 6

Two OSPF routers connected on an Ethernet link remain in the INIT state. Which issue is the most likely cause?

Accepted Answer

The routers cannot exchange Hellos bidirectionally on the segment. INIT means a router is seeing Hellos from its neighbor but does not see its own router ID in the neighbor field of received Hellos. A common cause is one-way communication or a mismatched multicast/adjacency problem, often at Layer 2.

Answer

The routers have identical router IDs

Answer

The routers have already reached FULL and are waiting to install routes

Answer

The routers are using the same OSPF process ID

Question 7

A router learns a route to 172.16.0.0/16 via OSPF (administrative distance 110) and a route to 172.16.10.0/24 via EIGRP (administrative distance 90). No other overlapping routes exist. Which TWO statements about how the router handles these routes are correct?

Accepted Answer

Both the OSPF and EIGRP routes are installed in the routing table.. B is correct because the router installs both routes in the routing table when they have different prefix lengths. The EIGRP route to 172.16.10.0/24 (AD 90) is more specific than the OSPF route to 172.16.0.0/16 (AD 110). The router uses the longest prefix match rule for forwarding, so both routes coexist without conflict.

Answer

The router installs only the EIGRP route because it has a lower administrative distance.

Answer

Traffic to 172.16.10.100 is forwarded using the OSPF route.

Answer

The EIGRP route is used for all traffic destined to any address within 172.16.0.0/16.

Question 8

Refer to the exhibit. A network administrator is troubleshooting why not all OSPF neighbors are fully adjacent on a multi-access broadcast segment. After issuing the show ip ospf neighbor command on R1, the output is displayed. What is the most likely cause of the 2WAY/DROTHER state for neighbor 172.16.1.1?

Accepted Answer

The neighbor is a DROther and a full adjacency with another DROther is not required; adjacency is formed only with the DR and BDR.. In a multi-access broadcast OSPF network, only the Designated Router (DR) and Backup Designated Router (BDR) form full adjacencies with all other routers. DROthers (routers that are neither DR nor BDR) only form full adjacencies with the DR and BDR, and remain in the 2WAY state with other DROthers. The show ip ospf neighbor output on R1 shows neighbor 172.16.1.1 as 2WAY/DROTHER, which is normal behavior because both are DROthers and do not need to exchange LSAs directly.

Answer

The OSPF hello and dead timers are mismatched between R1 and neighbor 172.16.1.1.

Answer

The network type is configured as point-to-point on one side and broadcast on the other, causing a DR/BDR election failure.

Answer

The neighbor's router ID 172.16.1.1 is not reachable, preventing the completion of the adjacency process.

Question 9

You are connected to switch SW1. The network uses Rapid-PVST+ and SW1 has been accidentally configured with a low spanning-tree priority, causing it to become the root bridge for VLAN 10 even though it should not be. Additionally, an edge port connected to a server is repeatedly receiving BPDUs, causing it to go into err-disabled state. Configure SW1 so that it is never the root bridge for VLAN 10, and configure the edge port so that it automatically recovers from err-disabled state after 300 seconds. Finally, verify that SW1 is not the root bridge for VLAN 10.

Accepted Answer

spanning-tree vlan 10 priority 36864; errdisable recovery cause bpduguard; errdisable recovery interval 300; show spanning-tree vlan 10. The issue is that SW1 has the spanning-tree priority for VLAN 10 set to 4096, which makes it the root bridge. To prevent this, you must set the priority higher than the current root bridge's priority (e.g., 32768 or higher). Additionally, the edge port (G0/1) is in err-disabled state because it received a BPDU while PortFast was enabled (BPDU Guard triggered). To automatically recover from err-disabled, you need to configure errdisable recovery cause bpduguard and set the interval to 300 seconds. After configuration, verify with 'show spanning-tree vlan 10' that SW1 is no longer the root and 'show errdisable recovery' to confirm the recovery settings.

Answer

spanning-tree vlan 10 priority 4096; errdisable recovery cause bpduguard; errdisable recovery interval 300; show spanning-tree vlan 10

Answer

spanning-tree vlan 10 root secondary; errdisable recovery cause bpduguard; errdisable recovery interval 300; show spanning-tree vlan 10

Answer

spanning-tree vlan 10 priority 32768; errdisable recovery cause all; errdisable recovery interval 300; show spanning-tree vlan 10

Question 10

Which term describes a string or credential passed to an API to prove the client is allowed to access a resource?

Accepted Answer

Token. A token is commonly used for API authorization. It is often included in an HTTP header and lets the server verify the caller has permission.

Answer

Metric

Answer

Lease

Answer

Tuple

Question 11

A host with IP address 172.16.50.130 and mask 255.255.255.192 needs to reach 172.16.50.190. Which statement is correct?

Accepted Answer

The destination is local, so the host ARPs for 172.16.50.190 directly.. Both 172.16.50.130 and 172.16.50.190 fall within the 172.16.50.128/26 subnet (range .128 to .191). Therefore, the destination is local, and the host will use ARP to resolve the destination IP directly. Option A is incorrect because the destination is not remote. Option C is incorrect because the directed broadcast address for this subnet is 172.16.50.191, not .190. Option D is incorrect because 172.16.50.130 is a valid host address, not the network address (.128).

Answer

The destination is on a remote subnet, so the host must send to the default gateway.

Answer

The destination is a directed broadcast for the local subnet.

Answer

The source host is using the network address of the subnet.

Question 12

You are managing a Cisco WLC (192.168.1.10) via its web UI. The wireless network 'CorpSecure' has been configured but clients cannot associate. Some report 'wrong password' errors; others see the SSID but fail to connect. Additionally, management access to the WLC web UI is intermittent. Identify and resolve the issues so that wireless clients can successfully associate with 'CorpSecure' using WPA3-Personal and the WLC web UI is reliably accessible from the management VLAN (VLAN 10).

Accepted Answer

Configure the SSID with WPA3-Personal; verify management interface is on VLAN 10 with correct gateway.. The primary issue is a security mismatch: the SSID is set to WPA2-PSK while clients expect WPA3, causing 'wrong password' errors. Since clients can see the SSID, broadcast is already enabled; the secondary connection failures may be due to incompatible devices, but the correct fix is to change the security to WPA3-Personal (AES). Additionally, verify that the management interface is on VLAN 10 with the correct gateway to ensure reliable WLC web UI access.

Answer

Change the SSID security to WPA2-PSK and disable SSID broadcast; reset the WLC to factory defaults.

Answer

Update the WLC firmware to the latest version and change the management VLAN to VLAN 1.

Answer

Reconfigure the SSID with WPA3-Enterprise and enable SSID broadcast; set the management interface to use DHCP.

Question 13

You are connected to SW1. Configure an LACP EtherChannel between SW1 and SW2 using ports GigabitEthernet0/1 and GigabitEthernet0/2. Set the channel-group mode to active on both sides. The port-channel interface should be configured as a trunk allowing VLANs 10, 20, and 30. Initially, the EtherChannel fails to form due to mismatched speed/duplex on one link. Identify and correct the issue, then verify the channel is up and operational.

Accepted Answer

Change speed and duplex on Gi0/2 to 1000 and full, then verify with 'show etherchannel summary'.. The EtherChannel fails because GigabitEthernet0/2 has speed 100 and duplex half, while GigabitEthernet0/1 has speed 1000 and duplex full. LACP requires all member ports to have identical speed and duplex settings. To resolve, change the speed and duplex on Gi0/2 to match Gi0/1: 'speed 1000' and 'duplex full'. After correction, the channel will bundle. Verify with 'show etherchannel summary' to see both ports in the 'P' (bundled) state.

Answer

Change the channel-group mode on Gi0/2 to passive, then verify with 'show etherchannel summary'.

Answer

Change the allowed VLANs on the port-channel to include only VLAN 1, then verify with 'show etherchannel summary'.

Answer

Change the port-channel interface to access mode, then verify with 'show etherchannel summary'.

Question 14

Exhibit: Users report that they can see the corporate SSID but fail authentication immediately after entering credentials. Guest wireless works on the same access point. Which issue is most likely?

Accepted Answer

The RADIUS or AAA server is unreachable for the enterprise WLAN. When clients can see the SSID and associate at Layer 2 but fail right after entering credentials, a broken 802.1X or RADIUS path is a common cause. RF coverage is clearly not the main problem because the SSID is visible and guest service works.

Answer

The AP is using the wrong channel width

Answer

The corporate SSID has a mismatched RADIUS shared secret

Answer

The SSID must be configured as hidden

Question 15

You are connected to R1 (192.0.2.1/24). Use RESTCONF to query the operational state of GigabitEthernet0/0 using the ietf-interfaces YANG module. Then, send a PATCH request to disable the interface (set 'enabled' to false) using the Cisco-IOS-XE-native YANG module. Identify the error when a PATCH request is sent with the wrong Content-Type header (application/json instead of application/yang-data+json) and when the PATCH URI uses an incorrect YANG path (ietf-interfaces instead of Cisco-IOS-XE-native).

Accepted Answer

The PATCH request fails with a 415 Unsupported Media Type error because the Content-Type header must be application/yang-data+json, not application/json.. The correct GET request uses the ietf-interfaces YANG module path to retrieve interface state. For the PATCH, the Cisco-IOS-XE-native module is used because it supports writing native configuration (including shutdown). Sending PATCH with Content-Type: application/json is rejected because RESTCONF requires application/yang-data+json. Using ietf-interfaces in the PATCH URI fails because that module is read-only for operational state; the server returns 404 or 405. The correct PATCH body sets 'shutdown' to true within the native interface container.

Answer

The PATCH request fails with a 404 Not Found error because the URI uses ietf-interfaces, which is a read-only module for operational state; the server cannot write to it.

Answer

The PATCH request succeeds but the interface is not disabled because the body must use 'shutdown' instead of 'enabled'.

Answer

The PATCH request fails with a 400 Bad Request error because the body must be XML, not JSON.