CCNA Practice Test 47 — 15 Questions

Question 1

Match the security feature to its main purpose.

Accepted Answer

Firewall: Filters traffic based on security rules. ACLs are correct because they use permit and deny statements to filter traffic based on source/destination IP, protocol, or port. DHCP Snooping is correct because it identifies trusted ports and builds a DHCP binding table to block rogue DHCP servers and prevent spoofed DHCP messages. DAI is correct because it leverages the DHCP Snooping binding table to validate ARP packets, dropping those that do not match trusted bindings and thus preventing ARP spoofing attacks. Port Security is correct because it restricts the number and specific MAC addresses learned on a switch port, mitigating MAC flooding and unauthorized device access.

Question 2

Drag and drop the following steps into the correct order to replace a faulty fiber optic SFP module and verify the interface on a Cisco IOS-XE switch. Assume the fiber cable is already disconnected from the SFP module.

Accepted Answer

Remove the old SFP module, insert the new SFP module, connect the fiber cable, verify interface status with 'show interfaces', and check for errors with 'show interfaces counters errors'. [CORRECT]. The correct order for replacing a faulty SFP module is: first remove the old module, then insert the new one, then connect the fiber cable, and finally verify the interface status and check for errors. Option A follows this sequence exactly. Options B, C, and D each have steps out of order: B connects the cable before removing the old module; C connects the cable before inserting the new module; D verifies the interface before connecting the cable, which would result in the interface being down during verification.

Answer

Connect the fiber cable, remove the old SFP module, insert the new SFP module, verify interface status with 'show interfaces', and check for errors with 'show interfaces counters errors'.

Answer

Remove the old SFP module, connect the fiber cable, insert the new SFP module, verify interface status with 'show interfaces', and check for errors with 'show interfaces counters errors'.

Answer

Remove the old SFP module, insert the new SFP module, verify interface status with 'show interfaces', connect the fiber cable, and check for errors with 'show interfaces counters errors'.

Question 3

You are connected to a multilayer switch MLSW1. PortFast and BPDU Guard have already been enabled on interface GigabitEthernet0/1, which connects to an end device, and a BPDU received on that interface placed it in the err-disabled state. Configure Rapid PVST+ so that MLSW1 becomes the root bridge for VLAN 10 with a priority of 4096. Recover the interface by re-enabling it. Finally, verify which port is blocking on VLAN 10 by connecting to MLSW2 and executing the appropriate show command.

Accepted Answer

spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; shutdown; no shutdown; show spanning-tree vlan 10. The correct solution sets the spanning-tree priority for VLAN 10 to 4096 on MLSW1, ensuring it becomes the root bridge. PortFast and BPDU Guard are already configured on G0/1, which caused the interface to go err-disabled when a BPDU was received. To recover, you must issue the 'shutdown' followed by 'no shutdown' commands on the interface. Because MLSW1 is the root bridge, it has no blocking ports; the blocking port (alternate) will be seen on a downstream switch like MLSW2. Therefore, verification must be done on MLSW2 using 'show spanning-tree vlan 10' to view the alternate blocking port. Option A correctly includes all required steps. Option B uses 'root primary' (priority 24576) instead of the specified 4096, lacks the recovery commands, and verifies on the wrong device. Option C omits the err-disabled recovery and uses the wrong verification command. Option D also verifies with 'show running-config', which does not display STP port roles.

Answer

spanning-tree vlan 10 root primary; interface GigabitEthernet0/1; no shutdown; show spanning-tree vlan 10

Answer

spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; no shutdown; show interfaces status

Answer

spanning-tree vlan 10 priority 4096; interface GigabitEthernet0/1; shutdown; no shutdown; show running-config

Question 4

Which two statements accurately describe software-defined networking and network virtualization concepts at a basic CCNA level?

Accepted Answer

SDN is associated with more centralized or programmable control of network behavior.. At a basic level, these concepts point toward more abstracted, software-driven ways of controlling or delivering networking capabilities. SDN is associated with more centralized or programmable control behavior. NFV is associated with delivering network functions in virtualized software form instead of relying only on fixed-purpose hardware.

The goal here is conceptual recognition, not deep architectural implementation detail.

Answer

Both terms are just new names for subnet masks.

Answer

Both terms replace the need for routing protocols completely.

Answer

Both terms refer only to wireless client roaming.

Question 5

You are connected to R1. Configure HSRP so that R1 becomes the active router for VLAN 10, with a virtual IP of 192.168.10.1. Ensure that R1 preempts if it comes back online after a failure. Also, configure R1 to decrement its HSRP priority by 20 if its GigabitEthernet0/1 interface goes down. The current configuration shows both routers as active — identify and fix the issues.

Accepted Answer

Change the virtual IP to 192.168.10.1, set priority to 110, enable preempt, and track interface GigabitEthernet0/1 with decrement 20.. The scenario indicates both routers appear as Active, which is abnormal. This could result from a misconfigured virtual IP or group number mismatch. The required fix is to set the virtual IP to 192.168.10.1, assign R1 a higher priority (110 vs R2's default 100), enable preempt so R1 reclaims active role after failure, and track GigabitEthernet0/1 with a decrement of 20 to lower priority if that interface goes down.

Answer

Change the virtual IP to 192.168.10.1, set priority to 100, enable preempt, and track interface GigabitEthernet0/1 with decrement 20.

Answer

Change the virtual IP to 192.168.10.254, set priority to 110, enable preempt, and track interface GigabitEthernet0/1 with decrement 20.

Answer

Change the virtual IP to 192.168.10.1, set priority to 110, enable preempt, but do not track any interface.

Question 6

Drag and drop the following steps into the correct order to configure an LACP EtherChannel on two Cisco switches using active mode.

Accepted Answer

Create the port-channel interface, configure its properties, then assign physical interfaces with channel-group active mode.. First create the logical port-channel interface and configure its properties, then assign physical interfaces to it using channel-group with active mode to initiate LACP negotiation.

Answer

Assign physical interfaces with channel-group active mode, then create the port-channel interface and configure its properties.

Answer

Configure physical interfaces with channel-group passive mode, then create the port-channel interface.

Answer

Create the port-channel interface, assign physical interfaces with channel-group desirable mode, then configure properties.

Question 7

Drag and drop the following steps into the correct order to configure Root Guard on designated ports, Loop Guard on non-designated ports, and BPDU Guard on PortFast ports, and then recover a port that enters err-disabled state.

Accepted Answer

1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Enable errdisable recovery globally. 5. Re-enable the err-disabled port manually.. Only option A correctly follows the sequence of configuring Root Guard on designated ports, Loop Guard on non-designated ports, BPDU Guard on PortFast ports, then enabling errdisable recovery globally, and finally manually re-enabling the port. Option B assigns Loop Guard to designated ports and Root Guard to non-designated ports, which is incorrect. Option C correctly assigns protections but starts with BPDU Guard, deviating from the specified order. Option D assigns Root Guard to non-designated ports and Loop Guard to designated ports, which is incorrect.

Answer

1. Configure Loop Guard on designated ports. 2. Configure Root Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Re-enable the err-disabled port manually. 5. Enable errdisable recovery globally.

Answer

1. Configure BPDU Guard on PortFast ports. 2. Configure Root Guard on designated ports. 3. Configure Loop Guard on non-designated ports. 4. Re-enable the err-disabled port manually. 5. Enable errdisable recovery globally.

Answer

1. Configure Root Guard on non-designated ports. 2. Configure Loop Guard on designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Enable errdisable recovery globally. 5. Re-enable the err-disabled port manually.

Question 8

A switchport connected to an IP phone and a PC must carry user traffic and voice traffic separately. Which feature is designed for that purpose on a Cisco access port?

Accepted Answer

Voice VLAN. The correct feature is a voice VLAN. In plain language, a voice VLAN lets the switch treat the IP phone’s traffic differently from the user PC’s traffic even though both devices may be connected through the same physical access port. The phone can tag voice traffic for the voice VLAN while the PC remains in the normal data access VLAN. This is a practical design because it keeps voice traffic logically separate, which helps with policy, QoS, and management.

This is a classic CCNA switching concept because it shows that one physical edge port can still support more than one logical traffic type in a controlled way. A standard access VLAN by itself would not provide the same voice/data separation. EtherChannel, SPAN, and native VLAN concepts solve different problems. The best answer is the feature specifically built to support phones and workstations together on one access connection while keeping their traffic logically distinct.

Answer

EtherChannel

Answer

SPAN

Answer

Native VLAN

Question 9

Drag and drop the following steps into the correct order to configure HSRP version 2 on an interface and ensure the router becomes the active router, then verify the HSRP state.

Accepted Answer

1. Configure HSRP version 2 on the interface
2. Configure the HSRP group and virtual IP address
3. Set the HSRP priority to a higher value
4. Enable HSRP preempt
5. Verify HSRP state using show standby. The correct order for configuring HSRP version 2 to ensure the router becomes the active router is: first configure HSRP version 2 on the interface, then configure the HSRP group and virtual IP address, then set the HSRP priority to a higher value, then enable HSRP preempt, and finally verify using 'show standby'. Only option A follows this sequence. Options B, C, and D are incorrect because they place version after group, priority before version, or preempt before priority.

Answer

1. Configure the HSRP group and virtual IP address
2. Set the HSRP priority to a higher value
3. Enable HSRP preempt
4. Configure HSRP version 2 on the interface
5. Verify HSRP state using show standby

Answer

1. Configure HSRP version 2 on the interface
2. Set the HSRP priority to a higher value
3. Enable HSRP preempt
4. Configure the HSRP group and virtual IP address
5. Verify HSRP state using show standby

Answer

1. Configure HSRP version 2 on the interface
2. Configure the HSRP group and virtual IP address
3. Enable HSRP preempt
4. Set the HSRP priority to a higher value
5. Verify HSRP state using show standby

Question 10

You are connected to R1. Configure SNMP v2c with a read-only community string 'monitorRO' and a read-write community string 'controlRW', and enable SNMP traps for link status to the management server at 203.0.113.100. Additionally, configure NetFlow to export version 9 flow records to the same server on UDP port 2055, and ensure that only traffic from the 10.10.10.0/24 network is monitored. Finally, verify your configurations with the appropriate show commands.

Accepted Answer

Configure SNMP community strings, enable link-status traps, set trap destination, configure NetFlow export version 9, and apply flow monitor to interface(s) carrying 10.10.10.0/24 traffic.. The solution correctly configures SNMP v2c with the required read-only and read-write community strings, enables only link-status traps, and sets the trap destination. For NetFlow, it uses Flexible NetFlow by defining a flow record, an exporter, and a monitor. Importantly, the export version (9) must be configured under the flow exporter, not with the legacy global `ip flow-export version 9` command. The flow monitor is applied to GigabitEthernet0/1, which carries traffic from the 10.10.10.0/24 network. Verification can be done with `show snmp` to confirm communities and trap receivers, and `show flow monitor name MONITOR-10NET cache` or `show ip cache flow` to view exported flow records.

Answer

Configure SNMP community strings, enable link-status traps, set trap destination, and configure NetFlow export version 5. Apply flow monitor to all interfaces.

Answer

Configure SNMP community strings, enable all SNMP traps, set trap destination, and configure NetFlow export version 9. Apply flow monitor to interface with IP 10.10.10.0/24.

Answer

Configure SNMP community strings, enable link-status traps, set trap destination, and configure NetFlow export version 9. Do not apply any flow monitor; NetFlow automatically monitors all traffic.

Question 11

A router has routes to 192.168.100.0/24 and 192.168.100.128/25. Which route is used for traffic to 192.168.100.140?

Accepted Answer

192.168.100.128/25. The /25 route is used because it is the most specific matching prefix. In practical terms, 192.168.100.140 falls inside the upper half of the /24, which is exactly what the 192.168.100.128/25 route describes. Even though the /24 also matches, the router always prefers the narrower route when both are valid.

This is a direct longest-prefix-match question. It reinforces that specificity is checked before broader route-source preferences matter.

Answer

192.168.100.0/24

Answer

The default route

Answer

Neither route, because the prefixes overlap

Question 12

You are connected to R1, a branch router that must synchronize time with the NTP server at 198.51.100.1 (reachable via G0/0) and send critical syslog messages (severity 0-4) to the logging server at 203.0.113.10. The current configuration has NTP pointing to a wrong server and syslog set to debug level, flooding the server. Correct the NTP server, set the NTP source interface to Loopback0 (10.10.10.1/32), and adjust the syslog trap level so that only emergencies through warnings are logged.

Accepted Answer

ntp server 198.51.100.1 source Loopback0; logging trap warnings. The NTP server was misconfigured to 192.0.2.1, which is unreachable, leaving the router at stratum 16. The correct NTP server is 198.51.100.1, so the ntp server command must be updated. The source interface should be Loopback0 for reachability consistency. The syslog trap level was set to debugging (level 7), which sends all messages; it should be changed to warnings (level 4) to filter only severity 0-4. Verification includes checking NTP synchronization and syslog configuration.

Answer

ntp server 198.51.100.1 source G0/0; logging trap errors

Answer

ntp server 192.0.2.1 source Loopback0; logging trap warnings

Answer

ntp server 198.51.100.1 source Loopback0; logging trap debugging

Question 13

A router is performing PAT for inside users. Which detail allows multiple inside sessions to share one public IPv4 address at the same time?

Accepted Answer

Use of transport-layer port numbers to distinguish sessions. PAT works because it uses transport-layer port numbers to keep different conversations distinct even when they share the same public IP address. In plain language, the router rewrites and tracks port information so that return traffic can be matched back to the correct inside host and application session. That is what makes one public address usable for many simultaneous internal users.

This is a key difference between PAT and simple static NAT. Static NAT creates a fixed one-to-one relationship, while PAT creates many simultaneous translations differentiated by port values. The correct answer is the one that identifies port-based tracking as the reason the design scales beyond a single host.

Answer

Replacement of all MAC addresses with broadcast addresses

Answer

Automatic conversion of every subnet into a /32

Answer

Requirement that every inside host use the same private IP address

Question 14

You are connected to R1 (192.0.2.1/24, management IP). The network team needs to automate interface configuration using RESTCONF. Construct a valid RESTCONF GET request to retrieve the operational status of GigabitEthernet0/1 using the ietf-interfaces YANG module, and a PATCH request to set the description of that interface to 'Link to R2' using the Cisco-IOS-XE-native YANG module. Identify the error that occurs if the Accept header is set to application/json instead of application/yang-data+json.

Accepted Answer

The server returns a 406 Not Acceptable error because RESTCONF requires the Accept header to be 'application/yang-data+json'.. The correct base URI for RESTCONF on Cisco IOS-XE is https://<device-ip>/restconf/data. For the ietf-interfaces module, the YANG path is /ietf-interfaces:interfaces/interface=GigabitEthernet0%2F1 (note the percent-encoded slash in the key). For the Cisco-IOS-XE-native module, the path is /Cisco-IOS-XE-native:native/interface/GigabitEthernet=0%2F1/description. The Accept header must be 'application/yang-data+json'; using 'application/json' returns a 406 Not Acceptable error. The PATCH request body must contain the new description in JSON format. Failing to percent-encode the interface name will result in an invalid URI.

Answer

The server returns a 400 Bad Request error because the Accept header must be 'application/json' for RESTCONF.

Answer

The server returns a 415 Unsupported Media Type error because the Accept header is set incorrectly.

Answer

The server returns a 200 OK response but ignores the Accept header and returns data in XML format.

Question 15

You are connected to R1, a router that must send SNMP traps to a management server at 203.0.113.10 and export NetFlow data to a collector at 203.0.113.20. Currently, SNMPv2c traps are not being sent, and SNMPv3 is not configured for read-only access with authentication and privacy. Additionally, NetFlow export is missing the destination and version configuration. Configure the necessary commands on R1 to enable SNMPv2c traps (community string 'public'), configure SNMPv3 user 'admin' with SHA authentication and AES 128 encryption (password 'cisco123' for both auth and priv), and set NetFlow export to version 9.

Accepted Answer

snmp-server host 203.0.113.10 traps version 2c public
snmp-server group MyGroup v3 priv
snmp-server user admin MyGroup v3 auth sha cisco123 priv aes 128 cisco123
ip flow-export version 9. The configuration is missing SNMPv3 user setup, trap destination, and NetFlow export version. First, enable SNMPv2c traps with `snmp-server host 203.0.113.10 traps version 2c public`. Then, configure SNMPv3 user with `snmp-server user admin MyGroup v3 auth sha cisco123 priv aes 128 cisco123` after creating a group with `snmp-server group MyGroup v3 priv`. For NetFlow, set the export version with `ip flow-export version 9`. Finally, verify with `show snmp` to see trap host and v3 user, and `show ip cache flow` to confirm export configuration.

Answer

snmp-server host 203.0.113.10 traps version 2c public
snmp-server group MyGroup v3 auth
snmp-server user admin MyGroup v3 auth sha cisco123 priv aes 128 cisco123
ip flow-export version 9

Answer

snmp-server host 203.0.113.10 traps version 2c public
snmp-server user admin v3 auth sha cisco123 priv aes 128 cisco123
ip flow-export version 9

Answer

snmp-server host 203.0.113.10 traps version 2c public
snmp-server group MyGroup v3 priv
snmp-server user admin MyGroup v3 auth sha cisco123 priv aes 128 cisco123
ip flow-export destination 203.0.113.20 2055