CCNA Practice Test 49 — 15 Questions

Question 1

You are connected to the multilayer switch MLS1 in a branch network. The DHCP server on router R1 is supposed to serve the 192.168.20.0/24 VLAN 20, but clients in VLAN 20 are not receiving IP addresses. Additionally, a rogue DHCP server has been detected on VLAN 20. Configure MLS1 to enable DHCP snooping on VLAN 20, set the trust state on the uplink port to R1, and limit the rate of DHCP packets on access ports. Then, on R1, correct the DHCP configuration so that the pool for VLAN 20 uses the correct default-router (192.168.20.1) and DNS server (8.8.8.8), and ensure that the excluded-address range is not too large (exclude only the first 10 addresses). Verify the solution.

Accepted Answer

On MLS1: ip dhcp snooping, ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8. The problem had three faults: First, the DHCP pool on R1 had a wrong default-router (192.168.10.1 instead of 192.168.20.1) and an incorrect DNS server (4.4.4.4 instead of 8.8.8.8). Second, the excluded-address range was too large (excluding all addresses from .1 to .254 effectively blocked all dynamic assignments; corrected to exclude only .1 through .10). Third, DHCP snooping was disabled on MLS1, allowing a rogue DHCP server. To enable DHCP snooping, both the global `ip dhcp snooping` command and the VLAN-specific `ip dhcp snooping vlan 20` command are required. With snooping enabled, the uplink port Gig0/0 was set as trusted and the access port Gig0/1 was configured with rate limiting to prevent DHCP starvation attacks.

Answer

On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.254, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8

Answer

On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.10.1 dns-server 4.4.4.4

Answer

On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8, but no ip dhcp snooping enabled globally on MLS1

Question 2

You are connected to SW1. The current configurations of interfaces GigabitEthernet0/1 and GigabitEthernet0/2 are as follows:

Gi0/1: speed 100, duplex half, switchport access vlan 10
Gi0/2: speed 1000, duplex full, switchport access vlan 20

The port-channel interface 1 does not exist. Configure a LACP EtherChannel between SW1 and SW2 using these two interfaces, with port-channel 1 and mode active on both sides. Ensure the channel forms by resolving any speed/duplex or VLAN mismatches. After configuration, verify with 'show etherchannel summary'.

Accepted Answer

The EtherChannel will not form because the physical interfaces have mismatched speed/duplex and VLAN assignments. You must configure both interfaces with the same speed (1000), duplex (full), and access VLAN (10), then apply channel-group 1 mode active on each.. The EtherChannel fails because member interfaces have mismatched speed/duplex (Gi0/1 is 100/half, Gi0/2 is 1000/full) and different VLANs (VLAN 10 vs 20). Additionally, the port-channel interface and physical interfaces must have matching VLAN assignments. To fix, unify both physical interfaces to the same speed (1000), duplex (full), and access VLAN (10). Then set channel-group mode active on each physical interface. Finally, ensure the port-channel interface also uses VLAN 10. Verify with 'show etherchannel summary' which should show the port-channel as SU (in use).

Answer

The EtherChannel will form successfully because LACP active mode negotiates the channel regardless of speed/duplex or VLAN differences.

Answer

The EtherChannel will not form because the port-channel interface must be configured with the same VLAN as the physical interfaces, but the physical interfaces can have different speeds.

Answer

The EtherChannel will form successfully because the port-channel interface inherits the VLAN from the first physical interface added, so no additional configuration is needed.

Question 3

Drag and drop the following steps into the correct order to configure an LACP EtherChannel on Cisco IOS-XE switches.

Accepted Answer

Enter global configuration mode, create the port-channel interface, configure channel-group mode active on each physical interface, verify the configuration.. First, enter global config mode. Then create the port-channel interface. Next, configure the channel-group mode on each physical interface to active for LACP. Finally, verify the configuration.

Answer

Create the port-channel interface, enter global configuration mode, configure channel-group mode active on each physical interface, verify the configuration.

Answer

Enter global configuration mode, configure channel-group mode active on each physical interface, create the port-channel interface, verify the configuration.

Answer

Create the port-channel interface, configure channel-group mode active on each physical interface, enter global configuration mode, verify the configuration.

Question 4

Exhibit: An OSPFv2 adjacency between two routers on Ethernet is not forming. Which two mismatches would directly prevent the routers from becoming neighbors?

Accepted Answer

Different OSPF area assignments on the interfaces. On an OSPFv2 network, area mismatch and authentication mismatch both directly prevent adjacency formation. Mismatched timers (such as hello or dead intervals) also block adjacency on all network types, including Ethernet. In this scenario, the correct choices are area mismatch (A) and authentication mismatch (B).

Answer

Different hostnames on the routers

Answer

Different loopback addresses used for management

Answer

One router using SSH version 2

Question 5

You are connected to R1. Configure static NAT for a public web server (198.51.100.10 to 192.168.1.10) and PAT for the 192.168.1.0/24 LAN to use interface GigabitEthernet0/1 with overload. The current configuration has misconfigured NAT that prevents both types from working. Identify and fix the issues so that internal hosts can access the internet and external hosts can reach the internal web server.

Accepted Answer

Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.. Three issues exist: (1) GigabitEthernet0/1 is the outside interface but is configured as 'ip nat inside' — it should be 'ip nat outside'. (2) The PAT command lacks the 'overload' keyword, so it does one-to-one translation instead of port address translation. (3) ACL 1 permits 192.168.2.0/24, but the inside LAN is 192.168.1.0/24 — the ACL must match the correct subnet. Correcting these allows PAT for the LAN and static NAT for the web server.

Answer

Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and change ACL 1 to permit 192.168.2.0 0.0.0.255.

Answer

Change interface GigabitEthernet0/1 to 'ip nat inside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.

Answer

Change interface GigabitEthernet0/1 to 'ip nat outside', remove the 'overload' keyword from the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.

Question 6

Match each address-related concept to its most accurate meaning.

Accepted Answer

Subnet mask: Indicates network versus host portions of an IPv4 address. The subnet mask is used to distinguish the network portion from the host portion of an IPv4 address. The default gateway is the next-hop router that forwards traffic destined for off-subnet networks. The broadcast address sends packets to all hosts within the local broadcast domain, while the network address identifies the subnet itself and is the first address in the subnet range.

Question 7

You are connected to R1. The link between R1 and R2 is down. The output of 'show interfaces gigabitEthernet0/0' on R1 shows: 'GigabitEthernet0/0 is administratively down, line protocol is down (disabled)', with IP address 203.0.113.1/30, MTU 1500, and no input/output errors. Determine the root cause and configure the necessary fix to bring the interface up and restore connectivity.

Accepted Answer

Enter interface configuration mode for GigabitEthernet0/0 and issue the 'no shutdown' command.. The interface status 'administratively down' means the interface was manually shut down using the 'shutdown' command. To bring it up, you must enter interface configuration mode and issue 'no shutdown', which administratively enables the interface. The other options are incorrect: setting speed to 100 Mbps or forcing full-duplex will not fix an administratively down state, and disabling keepalives is unrelated to the interface being disabled.

Answer

Enter interface configuration mode and issue the 'speed 100' command to match the remote interface speed.

Answer

Enter interface configuration mode and issue the 'duplex full' command to force full-duplex operation.

Answer

Enter interface configuration mode and issue the 'no keepalive' command to disable keepalives.

Question 8

Drag and drop the following steps into the correct order to configure a WLAN for WPA3-Enterprise on a Cisco WLC and sequence a wireless client association process.

Accepted Answer

Create WLAN with WPA3-Enterprise security, enable WLAN, client associates, 802.1X authentication, DHCP IP assignment. The configuration creates the WLAN with WPA3-Enterprise security, enables it, then the client associates and completes 802.1X authentication before getting an IP.

Answer

Create WLAN with WPA3-Enterprise security, enable WLAN, client associates, DHCP IP assignment, 802.1X authentication

Answer

Enable WLAN, create WLAN with WPA3-Enterprise security, client associates, 802.1X authentication, DHCP IP assignment

Answer

Create WLAN with WPA3-Enterprise security, client associates, enable WLAN, 802.1X authentication, DHCP IP assignment

Question 9

You are connected to R1 via console. R1 and R2 are directly connected via GigabitEthernet0/0. Your task is to configure IPv4 and IPv6 addressing on both routers so that they can ping each other's IPv4 and IPv6 addresses. The current configuration has intentional faults: R1's IPv4 subnet mask is incorrect, R2 is missing its default gateway, and R1's IPv6 address uses EUI-64 but is not working due to a duplicate IP. Correct the IPv4 mask on R1, assign a static IPv6 address on R2, and ensure both routers can reach each other.

Accepted Answer

On R1, change the IPv4 mask to 255.255.255.252; on R2, assign IPv4 address 192.0.2.2/30 and IPv6 address 2001:db8:1::2/64; configure a default route on R2 pointing to 192.0.2.1.. R1's IPv4 mask was /28, but the correct mask for the link should be /30 to avoid overlapping subnets (192.0.2.0/28 includes both .1 and .14, but they are on the same link). R2 had no IPv6 address configured. Additionally, R1's EUI-64 address was valid but R2 needed a static IPv6 address. The solution: on R1, change the mask to 255.255.255.252; on R2, assign an IPv4 address with mask /30 and a static IPv6 address 2001:db8:1::2/64; also add a default route on R2 pointing to 192.0.2.1 for IPv4. After these changes, both routers can ping each other's IPv4 and IPv6 addresses.

Answer

On R1, change the IPv4 mask to 255.255.255.0; on R2, assign IPv4 address 192.0.2.2/24 and IPv6 address 2001:db8:1::2/64; no default route needed.

Answer

On R1, change the IPv4 mask to 255.255.255.252; on R2, assign IPv4 address 192.0.2.2/28 and IPv6 address 2001:db8:1::2/64; configure a default route on R2 pointing to 192.0.2.1.

Answer

On R1, change the IPv4 mask to 255.255.255.252; on R2, assign IPv4 address 192.0.2.2/30 and IPv6 address 2001:db8:1::1/64; configure a default route on R2 pointing to 192.0.2.1.

Question 10

An ACL permits only tcp 10.10.10.0/24 host 192.0.2.10 eq 443 and has no other permit entries. What happens to an ICMP echo request from 10.10.10.5 to 192.0.2.10?

Accepted Answer

It is denied by the implicit deny. ACLs end with an implicit deny. Since the only explicit permit is for HTTPS traffic, the ICMP packet is denied.

Answer

It is permitted because the destination matches

Answer

It is permitted because the packet matches the source network stated in the ACE.

Answer

It is permitted only if the source port is 443

Question 11

Which two statements correctly describe syslog severity levels?

Accepted Answer

Level 0 is the most severe. Syslog uses numbered severity levels where lower numbers indicate more critical events. Level 0 (Emergency) is the most severe, and Level 7 (Debugging) is the least. Option D is incorrect because severity levels are a syslog function, not specific to NTP. Option E is wrong because syslog defines eight severity levels (0–7), not four.

Answer

Higher numbers always mean more critical issues

Answer

Severity levels are used only by NTP

Answer

Syslog has only four severity levels

Question 12

Drag and drop the following steps into the correct order to install a new fiber optic cable and SFP module on a Cisco switch, then verify the interface status.

Accepted Answer

Insert the SFP module into the port while the switch is powered on. The correct procedure for installing a fiber optic cable and SFP module on a modern Cisco switch is: first, insert the SFP module into the port while the switch is powered on (hot-swap); second, connect the fiber optic cable to the SFP module; third, verify the interface status using 'show interfaces status'. Option D is incorrect because fiber optic cables cannot connect directly to a switch port without an SFP module, and powering down the switch is unnecessary when hot-swapping SFPs.

Answer

Power down the switch, connect the fiber optic cable directly to the switch port without an SFP module, power up the switch, and verify the interface status.

Question 13

Why is shutting down unused switch ports considered a useful hardening measure?

Accepted Answer

Because it removes unused active connection points and reduces attack surface.. Shutting down unused switch ports reduces attack surface by removing unnecessary active connection points. This is a simple but effective control because it eliminates the risk of unauthorized physical access. Option B is incorrect because disabling a port does not change its mode to trunk; trunking is a separate configuration. Option C is incorrect because shutting down ports does not replace VLAN segmentation; VLANs provide logical separation, while port shutdown is a physical access control. Option D is incorrect because shutting down ports does not force devices to use SSH; SSH is an application-layer protocol for secure remote management, unrelated to port shutdown.

Answer

Because it converts all other ports into trunks.

Answer

Because it replaces VLAN segmentation.

Answer

Because it forces devices to use SSH.

Question 14

Which three statements about IPv6 routing are correct? (Choose three.)

Accepted Answer

The next-hop address for a directly attached IPv6 static route can be a link-local address.. All three statements are correct. The 'ipv6 route' command is used to configure static routes in IPv6, similar to 'ip route' in IPv4. A directly attached IPv6 static route can indeed use a link-local address as the next hop, which is common for point-to-point interfaces. OSPFv3 (OSPF for IPv6) uses the same fundamental SPF algorithm and link-state concepts as OSPFv2 but is designed to support IPv6 addressing and runs per-link rather than per-subnet.

Answer

EIGRP for IPv6 uses the same autonomous system number as EIGRP for IPv4 and shares the same routing table.

Answer

IPv6 routing is enabled by default on all Cisco routers.

Answer

The default route in IPv6 is represented as ::/128.

Question 15

Drag and drop the following OSPFv2 neighbor state transitions and DR/BDR election steps into the correct order for a multi-access network with default priority values.

Accepted Answer

Down, Init, 2-Way (DR/BDR election), ExStart, Exchange, Loading, Full. The correct OSPF neighbor state progression on a multi-access network is: Down, Init, 2-Way (with DR/BDR election), ExStart (master/slave negotiation), Exchange (DBD exchange), Loading (link-state request and update), and Full. Each option missing the Loading state or placing it incorrectly fails to represent the complete adjacency process.

Answer

Down, Init, ExStart, Exchange, Loading, 2-Way (DR/BDR election), Full

Answer

Down, Init, 2-Way (DR/BDR election), Loading, Exchange, ExStart, Full

Answer

Down, Init, 2-Way (DR/BDR election), ExStart, Exchange, Full