CCNA Practice Test 46 — 15 Questions

Question 1

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on an IOS-XE switch.

Accepted Answer

Configure RADIUS server, enable AAA globally, create an authentication list for 802.1X, apply 802.1X to the port. First configure the RADIUS server, then enable AAA, create an authentication list for 802.1X, and finally apply 802.1X to the port.

Answer

Enable AAA globally, configure RADIUS server, apply 802.1X to the port, create an authentication list for 802.1X

Answer

Configure RADIUS server, create an authentication list for 802.1X, enable AAA globally, apply 802.1X to the port

Answer

Apply 802.1X to the port, configure RADIUS server, enable AAA globally, create an authentication list for 802.1X

Question 2

Which two statements accurately compare SLAAC and DHCPv6?

Accepted Answer

SLAAC allows a host to form its own address using information from router advertisements.. SLAAC and DHCPv6 are both IPv6 host-configuration approaches, but they are not the same. In practical terms, SLAAC lets a host build its own address using router advertisements and the advertised prefix, while DHCPv6 can be used to provide addressing information or other configuration in a more server-driven way. Depending on design, IPv6 networks can use one, the other, or a mixture of behaviors.

The key is not to oversimplify. SLAAC is not “IPv6 DHCP,” and DHCPv6 is not the only way IPv6 hosts learn how to operate. Router advertisements remain very important.

Answer

SLAAC requires NAT to function.

Answer

DHCPv6 replaces the need for router advertisements completely.

Answer

Neither SLAAC nor DHCPv6 can provide any addressing information to hosts.

Question 3

A network team wants centralized logging and also wants log timestamps from different devices to line up accurately. Which combination best supports that goal?

Accepted Answer

Syslog and NTP. The right combination is Syslog plus NTP. In plain language, Syslog gives the team a central place to collect and review device messages, while NTP makes sure the timestamps on those messages are consistent across the network. Centralized logs are useful on their own, but without synchronized clocks, incident timelines can become confusing and misleading.

This pairing is a common operational best practice. Syslog handles the collection side, and NTP handles the time-correlation side. Other services such as DHCP, STP, or NAT do not solve this combination of requirements. The best answer is the one that recognizes that centralized logging and time synchronization are complementary, not competing, services.

Answer

DHCP and STP

Answer

PAT and EtherChannel

Answer

ARP and CDP

Question 4

A technician is troubleshooting an OSPF network. On a broadcast segment, R1 is the DR and R2 is the BDR. R1's interface GigabitEthernet0/0 is shut down for maintenance. The technician expects that R2 will assume the DR role, but instead a new DR election occurs and another router is elected DR. What is the most likely cause?

Accepted Answer

R2 has an OSPF priority of 0.. When the DR (R1) goes down, a new DR election occurs. R2 is the BDR, but if its OSPF priority is 0, it is ineligible to become the DR. Therefore, a new election takes place among the remaining routers with non-zero priorities, and another router wins the DR role.

Answer

The OSPF hello and dead intervals on R2 do not match those of other routers on the segment.

Answer

R2 has an OSPF priority of 255.

Answer

The OSPF network type on the segment was changed to point-to-point.

Question 5

Which TWO of the following are valid interpretations of errors seen in the output of the 'show interface' command?

Accepted Answer

CRC errors indicate that frames were received with an invalid checksum, often due to cabling issues.. CRC errors (option A) indicate frames with an invalid checksum, often due to cabling issues, which is correct. Option D is also correct: 'Input errors' is a cumulative counter that includes runts, giants, CRC errors, and frame errors. Option B is wrong because runts are frames smaller than 64 bytes, not larger. Option C is wrong because giants are frames larger than the maximum allowed size (typically 1518 bytes), not smaller than 64 bytes. Option E is wrong because 'flaps' refer to an interface going up and down repeatedly, not necessarily physically disconnected; it could be due to duplex mismatch or other reasons.

Answer

Runts are frames that are larger than the maximum allowed size.

Answer

Giants are frames that are smaller than 64 bytes.

Answer

Flaps indicate that the interface is physically disconnected.

Question 6

A switchport should allow only one learned MAC address and shut down if a different device is connected later. Which port security violation mode and limit combination best fits that goal?

Accepted Answer

maximum 1 with violation shutdown. The usual setup is maximum 1 MAC address with violation mode shutdown. That way the port is disabled when an unauthorized device appears.

Answer

maximum 10 with violation protect

Answer

maximum 1 with violation restrict and no logging

Answer

maximum unlimited with violation shutdown

Question 7

You are connected to R1 via console. The link between R1 and R2 is experiencing packet loss and CRC errors. Configure interface speed and duplex on R1's GigabitEthernet0/0 to match R2's settings, then replace the SFP module with one that supports the required 2 km distance. Finally, verify the interface is operational without errors.

Accepted Answer

Configure speed 1000, duplex full, and no negotiation auto on Gi0/0, then replace the SFP-GE-SX with SFP-GE-L.. The CRC errors indicate a duplex mismatch or faulty medium. R1 is set to auto-negotiation while R2 is hardcoded to 1000/full, causing mismatch. First, set speed and duplex on R1 to match R2: 'speed 1000' and 'duplex full'. Also disable auto-negotiation with 'no negotiation auto'. The existing SFP-GE-SX only supports 550m, but the link requires 2 km; replace it with a 1000BASE-LX/LH SFP (SFP-GE-L) which supports up to 10 km. After changes, verify with 'show interfaces Gi0/0' to confirm no CRC errors and correct speed/duplex.

Answer

Configure speed 1000 and duplex full on Gi0/0, then replace the SFP-GE-SX with SFP-GE-SX-MM.

Answer

Configure speed 100 and duplex full on Gi0/0, then replace the SFP-GE-SX with SFP-GE-L.

Answer

Configure no negotiation auto on Gi0/0, then replace the SFP-GE-SX with SFP-GE-L.

Question 8

You are connected to R1. The network has two routers: R1 (192.168.1.0/24 LAN) and R2 (Internet gateway). R1's inside LAN (192.168.1.0/24) must be translated to the public IP 203.0.113.1 using PAT (NAT overload) for Internet access. Additionally, the server at 192.168.1.100 must be reachable from the Internet via static NAT to 203.0.113.5. The current configuration is broken. Identify and fix the issues so that both PAT and static NAT work correctly.

Accepted Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and ensure the PAT command includes 'overload'.. The configuration had three issues: 1) ACL 10 permitted 10.0.0.0/8 instead of the actual inside subnet 192.168.1.0/24, so no traffic matched PAT. 2) The PAT command was missing the 'overload' keyword, which is required for Port Address Translation; without it, the device attempts one-to-one dynamic NAT. 3) The interface facing the public network (G0/1) was incorrectly configured as 'ip nat inside' instead of 'ip nat outside'. The fix is to correct the ACL to permit 192.168.1.0 0.0.0.255, ensure the PAT command includes 'overload', and change G0/1 to 'ip nat outside'.

Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and ensure the PAT command includes 'overload'.

Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and remove the 'overload' keyword from the PAT command.

Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and remove the 'overload' keyword from the PAT command.

Question 9

Which security concept gives a user only the permissions required to perform assigned tasks and nothing more?

Accepted Answer

Least privilege. Least privilege is the security principle that grants users only the specific permissions necessary to perform their job functions, minimizing potential damage from errors or malicious actions. Defense in depth is a layered security strategy using multiple controls, not a principle of limiting permissions. Segmentation divides a network into isolated segments to contain threats, but does not directly govern individual user permissions. Availability ensures systems and data are accessible when needed, which is unrelated to restricting access rights.

Answer

Defense in depth

Answer

Segmentation

Answer

Availability

Question 10

You are connected to R1. Configure IPv4 and IPv6 addressing on R1's GigabitEthernet0/0 and GigabitEthernet0/1 interfaces so that R1 can ping both R2's IPv4 address (203.0.113.2) and R2's IPv6 address (2001:db8:1::2). The current configuration has an incorrect subnet mask on G0/0, missing default gateway, and R1's G0/1 has a duplicate IPv4 address with R3. Also, use EUI-64 for IPv6 on G0/0 and static IPv6 assignment on G0/1. Ensure all issues are resolved and connectivity verified.

Accepted Answer

Change G0/0 subnet mask to 255.255.255.252, add default gateway 203.0.113.2, change G0/1 IPv4 to 192.168.1.254, enable IPv6 routing, configure G0/0 with ipv6 address 2001:db8:1::/64 eui-64, and G0/1 with ipv6 address 2001:db8:2::1/64.. The subnet mask on G0/0 was incorrectly set to /24 instead of /30. While a /24 mask on 203.0.113.1 would include 203.0.113.2 in the same subnet from R1's perspective, the mismatch with R2's /30 mask leads to inconsistent subnet definitions and potential ARP or routing issues. Additionally, no default gateway was configured, so traffic to remote networks would fail. On G0/1, the IPv4 address 192.168.1.1 was already used by R3, causing a duplicate IP conflict. IPv6 was not configured on either interface. The fix involved correcting the subnet mask on G0/0 to 255.255.255.252, adding a default gateway (203.0.113.2), assigning a unique IPv4 address to G0/1 (192.168.1.254), enabling IPv6 routing globally with `ipv6 unicast-routing`, configuring EUI-64 on G0/0 (`ipv6 address 2001:db8:1::/64 eui-64`), and static IPv6 on G0/1 (`ipv6 address 2001:db8:2::1/64`).

Answer

Change G0/0 subnet mask to 255.255.255.0, add default gateway 203.0.113.1, change G0/1 IPv4 to 192.168.1.254, enable IPv6 routing, configure G0/0 with ipv6 address 2001:db8:1::1/64, and G0/1 with ipv6 address 2001:db8:2::1/64.

Answer

Change G0/0 subnet mask to 255.255.255.252, add default gateway 203.0.113.2, change G0/1 IPv4 to 192.168.1.1, enable IPv6 routing, configure G0/0 with ipv6 address 2001:db8:1::/64 eui-64, and G0/1 with ipv6 address 2001:db8:2::1/64.

Answer

Change G0/0 subnet mask to 255.255.255.252, add default gateway 203.0.113.2, change G0/1 IPv4 to 192.168.1.254, enable IPv6 routing, configure G0/0 with ipv6 address 2001:db8:1::1/64, and G0/1 with ipv6 address 2001:db8:2::/64 eui-64.

Question 11

Which TWO statements about HSRP active/standby election, priority, and preempt are true?

Accepted Answer

The router with the highest priority becomes the active router.. In HSRP, the router with the highest priority (default 100, range 0-255) becomes the active router (A). If priorities are equal, the router with the highest IP address on the subnet wins, not the highest MAC address (B). Preemption is disabled by default; 'standby preempt' must be configured for a higher-priority router to take over (C). The 'show standby' command displays active/standby router roles, priority values, and preemption status, verifying D. The standby router is the one with the second-highest priority, not the lowest (E).

Answer

If priorities are equal, the router with the highest MAC address becomes active.

Answer

Preemption is enabled by default on all HSRP routers.

Answer

The router with the lowest priority becomes the standby router.

Question 12

Which TWO of the following statements about Spanning Tree Protocol (STP) and Rapid PVST+ are true?

Accepted Answer

The root bridge in STP is elected based on the lowest bridge ID.. The root bridge in STP is elected based on the numerically smallest bridge ID (priority + MAC address). Option D is correct because BPDU Guard, when enabled on a PortFast-enabled port, immediately error-disables the port if a BPDU is received, protecting against accidental loops. Option B is incorrect because the root bridge is chosen by the lowest bridge ID, not the highest. Option C is incorrect because PortFast and BPDU Guard are independent features; PortFast does not automatically enable BPDU Guard. Option E is incorrect because both traditional STP (802.1D) and Rapid PVST+ (RSTP-based) use the same root bridge election process—lowest bridge ID.

Answer

The root bridge in STP is elected based on the highest bridge ID.

Answer

PortFast automatically enables BPDU Guard on an interface.

Answer

Rapid PVST+ uses a different root bridge election process than traditional STP.

Question 13

You are troubleshooting PAT and static NAT on R1. The inside network 192.168.10.0/24 must be translated to the public IP 203.0.113.1 (interface G0/1) using port address translation. Additionally, the server at 192.168.10.100 must be reachable from the outside via static NAT to 203.0.113.5. The current configuration is not working. Identify and correct the errors in the running config on R1.

Accepted Answer

The ACL in the NAT configuration incorrectly permits network 192.168.20.0/24 instead of 192.168.10.0/24, and the PAT command is missing the 'overload' keyword.. The running configuration has two errors. First, access-list 100 incorrectly permits the 192.168.20.0/24 network instead of the inside network 192.168.10.0/24, so PAT will not translate any internal hosts. Second, the PAT command is missing the 'overload' keyword, which means only a single translation is possible, breaking connectivity for multiple devices. The static NAT entry for the server is correctly mapping 192.168.10.100 to 203.0.113.5 and does not need correction.

Answer

The static NAT entry uses the wrong inside address; it should be 192.168.10.100 but is configured with 192.168.10.1.

Answer

The PAT command is missing the 'overload' keyword, and the static NAT entry maps to the wrong public IP; it should use 203.0.113.1 instead of 203.0.113.5.

Answer

The static NAT entry maps the server to the wrong public IP, 203.0.113.1 instead of 203.0.113.5, and the ACL incorrectly permits network 192.168.20.0/24.

Question 14

You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on port GigabitEthernet0/1 (designated port) to protect against superior BPDUs from an unauthorized switch, Loop Guard on uplink GigabitEthernet0/2 to prevent loops, and BPDU Guard on PortFast-enabled GigabitEthernet0/3. After configuration, a superior BPDU arrives on G0/1, blocking the port; verify the Root Guard state and ensure BPDU Guard triggers err-disable on G0/3.

Accepted Answer

G0/1 is in root-inconsistent state; G0/3 is in err-disabled state.. Root Guard is needed on the designated port (G0/1) to prevent an unauthorized switch from becoming root by sending superior BPDUs. Loop Guard on the uplink (G0/2) prevents loops if BPDUs stop arriving. BPDU Guard on PortFast ports (G0/3) immediately err-disables them upon BPDU reception. The configuration uses 'spanning-tree guard root' on G0/1, 'spanning-tree guard loop' on G0/2, and 'spanning-tree bpduguard enable' on G0/3. Verification shows G0/1 blocked by root-inconsistent state and G0/3 in err-disabled state.

Answer

G0/1 is in blocking state; G0/3 is in err-disabled state.

Answer

G0/1 is in root-inconsistent state; G0/3 is in blocking state.

Answer

G0/1 is in err-disabled state; G0/3 is in root-inconsistent state.

Question 15

Match the security feature to its main purpose.

Accepted Answer

Firewall: Filters traffic based on security rules. ACLs are correct because they use permit and deny statements to filter traffic based on source/destination IP, protocol, or port. DHCP Snooping is correct because it identifies trusted ports and builds a DHCP binding table to block rogue DHCP servers and prevent spoofed DHCP messages. DAI is correct because it leverages the DHCP Snooping binding table to validate ARP packets, dropping those that do not match trusted bindings and thus preventing ARP spoofing attacks. Port Security is correct because it restricts the number and specific MAC addresses learned on a switch port, mitigating MAC flooding and unauthorized device access.