CCNA Practice Test 46 — 15 Questions

Question 1

You are connected to the console of R1. The network team wants to secure remote access. R1 currently has no SSH configuration. The domain name is 'example.com' and you need to generate an RSA key pair of 2048 bits and enable SSH version 2 on vty lines.

Accepted Answer

Configure IP domain name, generate RSA key pair with 2048 bits, set SSH version 2, and configure vty lines to use SSH.. SSH requires a hostname and domain name to generate RSA keys. Use 'ip domain-name example.com' then 'crypto key generate rsa general-keys modulus 2048' (the 'general-keys' keyword is required to avoid interactive prompts). Set SSH version 2 with 'ip ssh version 2' and restrict vty lines to SSH only with 'line vty 0 4' and 'transport input ssh'. Answer A includes all required steps correctly. Option B misses the domain name. Option C omits vty line configuration. Option D uses the wrong key size.

Answer

Generate RSA key pair with 2048 bits, set SSH version 2, and configure vty lines to use SSH. Domain name is optional.

Answer

Configure IP domain name, generate RSA key pair with 2048 bits, and set SSH version 2. No need to configure vty lines.

Answer

Configure IP domain name, generate RSA key pair with 1024 bits, set SSH version 2, and configure vty lines to use SSH.

Question 2

A network team wants centralized logging and also wants log timestamps from different devices to line up accurately. Which combination best supports that goal?

Accepted Answer

Syslog and NTP. The right combination is Syslog plus NTP. In plain language, Syslog gives the team a central place to collect and review device messages, while NTP makes sure the timestamps on those messages are consistent across the network. Centralized logs are useful on their own, but without synchronized clocks, incident timelines can become confusing and misleading.

This pairing is a common operational best practice. Syslog handles the collection side, and NTP handles the time-correlation side. Other services such as DHCP, STP, or NAT do not solve this combination of requirements. The best answer is the one that recognizes that centralized logging and time synchronization are complementary, not competing, services.

Answer

DHCP and STP

Answer

PAT and EtherChannel

Answer

ARP and CDP

Question 3

A technician is troubleshooting an OSPF network. On a broadcast segment, R1 is the DR and R2 is the BDR. R1's interface GigabitEthernet0/0 is shut down for maintenance. The technician expects that R2 will assume the DR role, but instead a new DR election occurs and another router is elected DR. What is the most likely cause?

Accepted Answer

R2 has an OSPF priority of 0.. When the DR (R1) goes down, a new DR election occurs. R2 is the BDR, but if its OSPF priority is 0, it is ineligible to become the DR. Therefore, a new election takes place among the remaining routers with non-zero priorities, and another router wins the DR role.

Answer

The OSPF hello and dead intervals on R2 do not match those of other routers on the segment.

Answer

R2 has an OSPF priority of 255.

Answer

The OSPF network type on the segment was changed to point-to-point.

Question 4

Which TWO of the following are valid interpretations of errors seen in the output of the 'show interface' command?

Accepted Answer

CRC errors indicate that frames were received with an invalid checksum, often due to cabling issues.. CRC errors (option A) indicate frames with an invalid checksum, often due to cabling issues, which is correct. Option D is also correct: 'Input errors' is a cumulative counter that includes runts, giants, CRC errors, and frame errors. Option B is wrong because runts are frames smaller than 64 bytes, not larger. Option C is wrong because giants are frames larger than the maximum allowed size (typically 1518 bytes), not smaller than 64 bytes. Option E is wrong because 'flaps' refer to an interface going up and down repeatedly, not necessarily physically disconnected; it could be due to duplex mismatch or other reasons.

Answer

Runts are frames that are larger than the maximum allowed size.

Answer

Giants are frames that are smaller than 64 bytes.

Answer

Flaps indicate that the interface is physically disconnected.

Question 5

Drag and drop the following steps into the correct order to install a new fiber optic link between two switches, including SFP insertion and basic troubleshooting.

Accepted Answer

Insert SFP into Switch A, connect fiber cable to SFP on Switch A, then insert SFP into Switch B and connect fiber cable to SFP on Switch B, then verify link status on both switches.. The correct installation order follows best practice: insert the SFP and connect the cable on one switch before moving to the other. This minimizes the time the SFP module is exposed and prevents potential damage. Option A is the only correct sequence. Option B exposes both SFPs before cabling, increasing risk of contamination. Option C attempts to connect cables before inserting SFPs, which is impractical and can cause damage. Option D verifies link on Switch A before the other end is connected, which will show a down state and is not a valid step sequence.

Answer

Insert SFP into Switch A, then insert SFP into Switch B, then connect fiber cable to both SFPs, then verify link status on both switches.

Answer

Connect fiber cable to SFP on Switch A, then insert SFP into Switch A, then connect fiber cable to SFP on Switch B, then insert SFP into Switch B, then verify link status on both switches.

Answer

Insert SFP into Switch A, connect fiber cable to SFP on Switch A, then verify link status on Switch A, then insert SFP into Switch B and connect fiber cable to SFP on Switch B, then verify link status on Switch B.

Question 6

A router is configured for NAT overload, but translations never appear when inside users browse the internet. Which issue is most likely?

Accepted Answer

The outside interface is missing the ip nat outside command. NAT needs the inside and outside interfaces marked correctly. If those roles are missing or reversed, the router has no context for translating traffic and the NAT table stays empty.

Answer

The ACL used by NAT must deny inside addresses

Answer

PAT requires DHCP on the inside interface

Answer

NAT overload works only with OSPF-learned routes

Question 7

A switchport should allow only one learned MAC address and shut down if a different device is connected later. Which port security violation mode and limit combination best fits that goal?

Accepted Answer

maximum 1 with violation shutdown. The usual setup is maximum 1 MAC address with violation mode shutdown. That way the port is disabled when an unauthorized device appears.

Answer

maximum 10 with violation protect

Answer

maximum 1 with violation restrict and no logging

Answer

maximum unlimited with violation shutdown

Question 8

You are connected to R1 via console. The link between R1 and R2 is experiencing packet loss and CRC errors. Configure interface speed and duplex on R1's GigabitEthernet0/0 to match R2's settings, then replace the SFP module with one that supports the required 2 km distance. Finally, verify the interface is operational without errors.

Accepted Answer

Configure speed 1000, duplex full, and no negotiation auto on Gi0/0, then replace the SFP-GE-SX with SFP-GE-L.. The CRC errors indicate a duplex mismatch or faulty medium. R1 is set to auto-negotiation while R2 is hardcoded to 1000/full, causing mismatch. First, set speed and duplex on R1 to match R2: 'speed 1000' and 'duplex full'. Also disable auto-negotiation with 'no negotiation auto'. The existing SFP-GE-SX only supports 550m, but the link requires 2 km; replace it with a 1000BASE-LX/LH SFP (SFP-GE-L) which supports up to 10 km. After changes, verify with 'show interfaces Gi0/0' to confirm no CRC errors and correct speed/duplex.

Answer

Configure speed 1000 and duplex full on Gi0/0, then replace the SFP-GE-SX with SFP-GE-SX-MM.

Answer

Configure speed 100 and duplex full on Gi0/0, then replace the SFP-GE-SX with SFP-GE-L.

Answer

Configure no negotiation auto on Gi0/0, then replace the SFP-GE-SX with SFP-GE-L.

Question 9

You are connected to R1. The network has two routers: R1 (192.168.1.0/24 LAN) and R2 (Internet gateway). R1's inside LAN (192.168.1.0/24) must be translated to the public IP 203.0.113.1 using PAT (NAT overload) for Internet access. Additionally, the server at 192.168.1.100 must be reachable from the Internet via static NAT to 203.0.113.5. The current configuration is broken. Identify and fix the issues so that both PAT and static NAT work correctly.

Accepted Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and ensure the PAT command includes 'overload'.. The configuration had three issues: 1) ACL 10 permitted 10.0.0.0/8 instead of the actual inside subnet 192.168.1.0/24, so no traffic matched PAT. 2) The PAT command was missing the 'overload' keyword, which is required for Port Address Translation; without it, the device attempts one-to-one dynamic NAT. 3) The interface facing the public network (G0/1) was incorrectly configured as 'ip nat inside' instead of 'ip nat outside'. The fix is to correct the ACL to permit 192.168.1.0 0.0.0.255, ensure the PAT command includes 'overload', and change G0/1 to 'ip nat outside'.

Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and ensure the PAT command includes 'overload'.

Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and remove the 'overload' keyword from the PAT command.

Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and remove the 'overload' keyword from the PAT command.

Question 10

Which security concept gives a user only the permissions required to perform assigned tasks and nothing more?

Accepted Answer

Least privilege. Least privilege is the security principle that grants users only the specific permissions necessary to perform their job functions, minimizing potential damage from errors or malicious actions. Defense in depth is a layered security strategy using multiple controls, not a principle of limiting permissions. Segmentation divides a network into isolated segments to contain threats, but does not directly govern individual user permissions. Availability ensures systems and data are accessible when needed, which is unrelated to restricting access rights.

Answer

Defense in depth

Answer

Segmentation

Answer

Availability

Question 11

You are connected to R1. Configure IPv4 and IPv6 addressing on R1's GigabitEthernet0/0 and GigabitEthernet0/1 interfaces so that R1 can ping both R2's IPv4 address (203.0.113.2) and R2's IPv6 address (2001:db8:1::2). The current configuration has an incorrect subnet mask on G0/0, missing default gateway, and R1's G0/1 has a duplicate IPv4 address with R3. Also, use EUI-64 for IPv6 on G0/0 and static IPv6 assignment on G0/1. Ensure all issues are resolved and connectivity verified.

Accepted Answer

Change G0/0 subnet mask to 255.255.255.252, add default gateway 203.0.113.2, change G0/1 IPv4 to 192.168.1.254, enable IPv6 routing, configure G0/0 with ipv6 address 2001:db8:1::/64 eui-64, and G0/1 with ipv6 address 2001:db8:2::1/64.. The subnet mask on G0/0 was incorrectly set to /24 instead of /30. While a /24 mask on 203.0.113.1 would include 203.0.113.2 in the same subnet from R1's perspective, the mismatch with R2's /30 mask leads to inconsistent subnet definitions and potential ARP or routing issues. Additionally, no default gateway was configured, so traffic to remote networks would fail. On G0/1, the IPv4 address 192.168.1.1 was already used by R3, causing a duplicate IP conflict. IPv6 was not configured on either interface. The fix involved correcting the subnet mask on G0/0 to 255.255.255.252, adding a default gateway (203.0.113.2), assigning a unique IPv4 address to G0/1 (192.168.1.254), enabling IPv6 routing globally with `ipv6 unicast-routing`, configuring EUI-64 on G0/0 (`ipv6 address 2001:db8:1::/64 eui-64`), and static IPv6 on G0/1 (`ipv6 address 2001:db8:2::1/64`).

Answer

Change G0/0 subnet mask to 255.255.255.0, add default gateway 203.0.113.1, change G0/1 IPv4 to 192.168.1.254, enable IPv6 routing, configure G0/0 with ipv6 address 2001:db8:1::1/64, and G0/1 with ipv6 address 2001:db8:2::1/64.

Answer

Change G0/0 subnet mask to 255.255.255.252, add default gateway 203.0.113.2, change G0/1 IPv4 to 192.168.1.1, enable IPv6 routing, configure G0/0 with ipv6 address 2001:db8:1::/64 eui-64, and G0/1 with ipv6 address 2001:db8:2::1/64.

Answer

Change G0/0 subnet mask to 255.255.255.252, add default gateway 203.0.113.2, change G0/1 IPv4 to 192.168.1.254, enable IPv6 routing, configure G0/0 with ipv6 address 2001:db8:1::1/64, and G0/1 with ipv6 address 2001:db8:2::/64 eui-64.

Question 12

Which TWO statements about HSRP active/standby election, priority, and preempt are true?

Accepted Answer

The router with the highest priority becomes the active router.. In HSRP, the router with the highest priority (default 100, range 0-255) becomes the active router (A). If priorities are equal, the router with the highest IP address on the subnet wins, not the highest MAC address (B). Preemption is disabled by default; 'standby preempt' must be configured for a higher-priority router to take over (C). The 'show standby' command displays active/standby router roles, priority values, and preemption status, verifying D. The standby router is the one with the second-highest priority, not the lowest (E).

Answer

If priorities are equal, the router with the highest MAC address becomes active.

Answer

Preemption is enabled by default on all HSRP routers.

Answer

The router with the lowest priority becomes the standby router.

Question 13

Which TWO of the following statements about Spanning Tree Protocol (STP) and Rapid PVST+ are true?

Accepted Answer

The root bridge in STP is elected based on the lowest bridge ID.. The root bridge in STP is elected based on the numerically smallest bridge ID (priority + MAC address). Option D is correct because BPDU Guard, when enabled on a PortFast-enabled port, immediately error-disables the port if a BPDU is received, protecting against accidental loops. Option B is incorrect because the root bridge is chosen by the lowest bridge ID, not the highest. Option C is incorrect because PortFast and BPDU Guard are independent features; PortFast does not automatically enable BPDU Guard. Option E is incorrect because both traditional STP (802.1D) and Rapid PVST+ (RSTP-based) use the same root bridge election process—lowest bridge ID.

Answer

The root bridge in STP is elected based on the highest bridge ID.

Answer

PortFast automatically enables BPDU Guard on an interface.

Answer

Rapid PVST+ uses a different root bridge election process than traditional STP.

Question 14

You are troubleshooting PAT and static NAT on R1. The inside network 192.168.10.0/24 must be translated to the public IP 203.0.113.1 (interface G0/1) using port address translation. Additionally, the server at 192.168.10.100 must be reachable from the outside via static NAT to 203.0.113.5. The current configuration is not working. Identify and correct the errors in the running config on R1.

Accepted Answer

The ACL in the NAT configuration incorrectly permits network 192.168.20.0/24 instead of 192.168.10.0/24, and the PAT command is missing the 'overload' keyword.. The running configuration has two errors. First, access-list 100 incorrectly permits the 192.168.20.0/24 network instead of the inside network 192.168.10.0/24, so PAT will not translate any internal hosts. Second, the PAT command is missing the 'overload' keyword, which means only a single translation is possible, breaking connectivity for multiple devices. The static NAT entry for the server is correctly mapping 192.168.10.100 to 203.0.113.5 and does not need correction.

Answer

The static NAT entry uses the wrong inside address; it should be 192.168.10.100 but is configured with 192.168.10.1.

Answer

The PAT command is missing the 'overload' keyword, and the static NAT entry maps to the wrong public IP; it should use 203.0.113.1 instead of 203.0.113.5.

Answer

The static NAT entry maps the server to the wrong public IP, 203.0.113.1 instead of 203.0.113.5, and the ACL incorrectly permits network 192.168.20.0/24.

Question 15

You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on port GigabitEthernet0/1 (designated port) to protect against superior BPDUs from an unauthorized switch, Loop Guard on uplink GigabitEthernet0/2 to prevent loops, and BPDU Guard on PortFast-enabled GigabitEthernet0/3. After configuration, a superior BPDU arrives on G0/1, blocking the port; verify the Root Guard state and ensure BPDU Guard triggers err-disable on G0/3.

Accepted Answer

G0/1 is in root-inconsistent state; G0/3 is in err-disabled state.. Root Guard is needed on the designated port (G0/1) to prevent an unauthorized switch from becoming root by sending superior BPDUs. Loop Guard on the uplink (G0/2) prevents loops if BPDUs stop arriving. BPDU Guard on PortFast ports (G0/3) immediately err-disables them upon BPDU reception. The configuration uses 'spanning-tree guard root' on G0/1, 'spanning-tree guard loop' on G0/2, and 'spanning-tree bpduguard enable' on G0/3. Verification shows G0/1 blocked by root-inconsistent state and G0/3 in err-disabled state.

Answer

G0/1 is in blocking state; G0/3 is in err-disabled state.

Answer

G0/1 is in root-inconsistent state; G0/3 is in blocking state.

Answer

G0/1 is in err-disabled state; G0/3 is in root-inconsistent state.