CCNA Practice Test 49 — 15 Questions

Question 1

You are connected to R1 via the console. The network administrator reports that PC1 (connected to R1's GigabitEthernet0/1) cannot reach the internet. Troubleshoot the issue step by step. The current configuration and show outputs are provided.

Accepted Answer

routing or NAT issue beyond the local network. The issue is that PC1 cannot reach the internet despite having correct IP, gateway, and DNS. PC1 can ping the default gateway and even the next-hop router (203.0.113.2), but fails to ping 8.8.8.8. This indicates that the problem is beyond the local network — likely a routing or NAT issue on the ISP side. However, the task requires troubleshooting client connectivity; the provided outputs show no misconfiguration on PC1 or R1. The fault is external (ISP not routing or no NAT), but the candidate must verify that client configuration is correct and then escalate or check the ISP link. For the PBQ, the candidate should confirm that PC1's IP, subnet mask, gateway, and DNS are correct, and that R1 has a default route and can reach the next hop. No configuration changes are needed on R1 or PC1; the problem is outside the scope of the local network.

Answer

PC1 has an incorrect default gateway configured.

Answer

R1 is missing a default route to the ISP.

Answer

PC1 has a DNS resolution issue.

Question 2

When two routes to the same destination are learned by OSPF from different paths, what criterion does OSPF use to select the best path?

Accepted Answer

Lowest OSPF cost. Within OSPF, the router compares the total path cost to the destination. Lower cost is preferred. Administrative distance is used when comparing routes from different routing sources, not between two OSPF paths.

Answer

Lowest administrative distance

Answer

Highest bandwidth of the first hop only

Answer

Lowest next-hop IP address

Question 3

What is the correct order of steps to capture and analyze traffic on IOS-XE using the embedded packet capture feature, and in Wireshark to isolate a Layer 2 or Layer 3 fault?

Accepted Answer

Define the capture point with interface and optional filter, then start the capture, stop it, and export the capture file for analysis in Wireshark.. The correct order for embedded packet capture on IOS-XE is to first define the capture point with the desired interface and optional filter, then start the capture, stop it after capturing the needed traffic, and finally export the file for analysis in Wireshark. Option A accurately reflects this sequence. Option B fails because the capture must be defined before starting. Option C fails because exporting should occur after stopping the capture. Option D fails because analysis is performed externally, not on the router.

Answer

Start the capture immediately, then define the capture point with interface and filter, stop the capture, and export the file for analysis.

Answer

Define the capture point, start the capture, export the file, and then stop the capture.

Answer

Define the capture point, start the capture, stop it, then analyze the capture directly on the router without exporting.

Question 4

You are connected to the multilayer switch MLS1 in a branch network. The DHCP server on router R1 is supposed to serve the 192.168.20.0/24 VLAN 20, but clients in VLAN 20 are not receiving IP addresses. Additionally, a rogue DHCP server has been detected on VLAN 20. Configure MLS1 to enable DHCP snooping on VLAN 20, set the trust state on the uplink port to R1, and limit the rate of DHCP packets on access ports. Then, on R1, correct the DHCP configuration so that the pool for VLAN 20 uses the correct default-router (192.168.20.1) and DNS server (8.8.8.8), and ensure that the excluded-address range is not too large (exclude only the first 10 addresses). Verify the solution.

Accepted Answer

On MLS1: ip dhcp snooping, ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8. The problem had three faults: First, the DHCP pool on R1 had a wrong default-router (192.168.10.1 instead of 192.168.20.1) and an incorrect DNS server (4.4.4.4 instead of 8.8.8.8). Second, the excluded-address range was too large (excluding all addresses from .1 to .254 effectively blocked all dynamic assignments; corrected to exclude only .1 through .10). Third, DHCP snooping was disabled on MLS1, allowing a rogue DHCP server. To enable DHCP snooping, both the global `ip dhcp snooping` command and the VLAN-specific `ip dhcp snooping vlan 20` command are required. With snooping enabled, the uplink port Gig0/0 was set as trusted and the access port Gig0/1 was configured with rate limiting to prevent DHCP starvation attacks.

Answer

On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.254, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8

Answer

On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.10.1 dns-server 4.4.4.4

Answer

On MLS1: ip dhcp snooping vlan 20, interface Gig0/0 ip dhcp snooping trust, interface Gig0/1 ip dhcp snooping limit rate 10. On R1: ip dhcp excluded-address 192.168.20.1 192.168.20.10, ip dhcp pool VLAN20 network 192.168.20.0 255.255.255.0 default-router 192.168.20.1 dns-server 8.8.8.8, but no ip dhcp snooping enabled globally on MLS1

Question 5

You are connected to SW1. The current configurations of interfaces GigabitEthernet0/1 and GigabitEthernet0/2 are as follows:

Gi0/1: speed 100, duplex half, switchport access vlan 10
Gi0/2: speed 1000, duplex full, switchport access vlan 20

The port-channel interface 1 does not exist. Configure a LACP EtherChannel between SW1 and SW2 using these two interfaces, with port-channel 1 and mode active on both sides. Ensure the channel forms by resolving any speed/duplex or VLAN mismatches. After configuration, verify with 'show etherchannel summary'.

Accepted Answer

The EtherChannel will not form because the physical interfaces have mismatched speed/duplex and VLAN assignments. You must configure both interfaces with the same speed (1000), duplex (full), and access VLAN (10), then apply channel-group 1 mode active on each.. The EtherChannel fails because member interfaces have mismatched speed/duplex (Gi0/1 is 100/half, Gi0/2 is 1000/full) and different VLANs (VLAN 10 vs 20). Additionally, the port-channel interface and physical interfaces must have matching VLAN assignments. To fix, unify both physical interfaces to the same speed (1000), duplex (full), and access VLAN (10). Then set channel-group mode active on each physical interface. Finally, ensure the port-channel interface also uses VLAN 10. Verify with 'show etherchannel summary' which should show the port-channel as SU (in use).

Answer

The EtherChannel will form successfully because LACP active mode negotiates the channel regardless of speed/duplex or VLAN differences.

Answer

The EtherChannel will not form because the port-channel interface must be configured with the same VLAN as the physical interfaces, but the physical interfaces can have different speeds.

Answer

The EtherChannel will form successfully because the port-channel interface inherits the VLAN from the first physical interface added, so no additional configuration is needed.

Question 6

Drag and drop the following steps into the correct order to configure an LACP EtherChannel on Cisco IOS-XE switches.

Accepted Answer

Enter global configuration mode, create the port-channel interface, configure channel-group mode active on each physical interface, verify the configuration.. First, enter global config mode. Then create the port-channel interface. Next, configure the channel-group mode on each physical interface to active for LACP. Finally, verify the configuration.

Answer

Create the port-channel interface, enter global configuration mode, configure channel-group mode active on each physical interface, verify the configuration.

Answer

Enter global configuration mode, configure channel-group mode active on each physical interface, create the port-channel interface, verify the configuration.

Answer

Create the port-channel interface, configure channel-group mode active on each physical interface, enter global configuration mode, verify the configuration.

Question 7

Exhibit: An OSPFv2 adjacency between two routers on Ethernet is not forming. Which two mismatches would directly prevent the routers from becoming neighbors?

Accepted Answer

Different OSPF area assignments on the interfaces. On an OSPFv2 network, area mismatch and authentication mismatch both directly prevent adjacency formation. Mismatched timers (such as hello or dead intervals) also block adjacency on all network types, including Ethernet. In this scenario, the correct choices are area mismatch (A) and authentication mismatch (B).

Answer

Different hostnames on the routers

Answer

Different loopback addresses used for management

Answer

One router using SSH version 2

Question 8

You are connected to R1. Configure static NAT for a public web server (198.51.100.10 to 192.168.1.10) and PAT for the 192.168.1.0/24 LAN to use interface GigabitEthernet0/1 with overload. The current configuration has misconfigured NAT that prevents both types from working. Identify and fix the issues so that internal hosts can access the internet and external hosts can reach the internal web server.

Accepted Answer

Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.. Three issues exist: (1) GigabitEthernet0/1 is the outside interface but is configured as 'ip nat inside' — it should be 'ip nat outside'. (2) The PAT command lacks the 'overload' keyword, so it does one-to-one translation instead of port address translation. (3) ACL 1 permits 192.168.2.0/24, but the inside LAN is 192.168.1.0/24 — the ACL must match the correct subnet. Correcting these allows PAT for the LAN and static NAT for the web server.

Answer

Change interface GigabitEthernet0/1 to 'ip nat outside', add 'overload' to the PAT command, and change ACL 1 to permit 192.168.2.0 0.0.0.255.

Answer

Change interface GigabitEthernet0/1 to 'ip nat inside', add 'overload' to the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.

Answer

Change interface GigabitEthernet0/1 to 'ip nat outside', remove the 'overload' keyword from the PAT command, and correct ACL 1 to permit 192.168.1.0 0.0.0.255.

Question 9

Match each address-related concept to its most accurate meaning.

Accepted Answer

Subnet mask: Indicates network versus host portions of an IPv4 address. The subnet mask is used to distinguish the network portion from the host portion of an IPv4 address. The default gateway is the next-hop router that forwards traffic destined for off-subnet networks. The broadcast address sends packets to all hosts within the local broadcast domain, while the network address identifies the subnet itself and is the first address in the subnet range.

Question 10

You are connected to R1. The link between R1 and R2 is down. The output of 'show interfaces gigabitEthernet0/0' on R1 shows: 'GigabitEthernet0/0 is administratively down, line protocol is down (disabled)', with IP address 203.0.113.1/30, MTU 1500, and no input/output errors. Determine the root cause and configure the necessary fix to bring the interface up and restore connectivity.

Accepted Answer

Enter interface configuration mode for GigabitEthernet0/0 and issue the 'no shutdown' command.. The interface status 'administratively down' means the interface was manually shut down using the 'shutdown' command. To bring it up, you must enter interface configuration mode and issue 'no shutdown', which administratively enables the interface. The other options are incorrect: setting speed to 100 Mbps or forcing full-duplex will not fix an administratively down state, and disabling keepalives is unrelated to the interface being disabled.

Answer

Enter interface configuration mode and issue the 'speed 100' command to match the remote interface speed.

Answer

Enter interface configuration mode and issue the 'duplex full' command to force full-duplex operation.

Answer

Enter interface configuration mode and issue the 'no keepalive' command to disable keepalives.

Question 11

Drag and drop the following steps into the correct order to configure a WLAN for WPA3-Enterprise on a Cisco WLC and sequence a wireless client association process.

Accepted Answer

Create WLAN with WPA3-Enterprise security, enable WLAN, client associates, 802.1X authentication, DHCP IP assignment. The configuration creates the WLAN with WPA3-Enterprise security, enables it, then the client associates and completes 802.1X authentication before getting an IP.

Answer

Create WLAN with WPA3-Enterprise security, enable WLAN, client associates, DHCP IP assignment, 802.1X authentication

Answer

Enable WLAN, create WLAN with WPA3-Enterprise security, client associates, 802.1X authentication, DHCP IP assignment

Answer

Create WLAN with WPA3-Enterprise security, client associates, enable WLAN, 802.1X authentication, DHCP IP assignment

Question 12

An ACL permits only tcp 10.10.10.0/24 host 192.0.2.10 eq 443 and has no other permit entries. What happens to an ICMP echo request from 10.10.10.5 to 192.0.2.10?

Accepted Answer

It is denied by the implicit deny. ACLs end with an implicit deny. Since the only explicit permit is for HTTPS traffic, the ICMP packet is denied.

Answer

It is permitted because the destination matches

Answer

It is permitted because the packet matches the source network stated in the ACE.

Answer

It is permitted only if the source port is 443

Question 13

Which two statements correctly describe syslog severity levels?

Accepted Answer

Level 0 is the most severe. Syslog uses numbered severity levels where lower numbers indicate more critical events. Level 0 (Emergency) is the most severe, and Level 7 (Debugging) is the least. Option D is incorrect because severity levels are a syslog function, not specific to NTP. Option E is wrong because syslog defines eight severity levels (0–7), not four.

Answer

Higher numbers always mean more critical issues

Answer

Severity levels are used only by NTP

Answer

Syslog has only four severity levels

Question 14

Drag and drop the following steps into the correct order to install a new fiber optic cable and SFP module on a Cisco switch, then verify the interface status.

Accepted Answer

Insert the SFP module into the port while the switch is powered on. The correct procedure for installing a fiber optic cable and SFP module on a modern Cisco switch is: first, insert the SFP module into the port while the switch is powered on (hot-swap); second, connect the fiber optic cable to the SFP module; third, verify the interface status using 'show interfaces status'. Option D is incorrect because fiber optic cables cannot connect directly to a switch port without an SFP module, and powering down the switch is unnecessary when hot-swapping SFPs.

Answer

Power down the switch, connect the fiber optic cable directly to the switch port without an SFP module, power up the switch, and verify the interface status.

Question 15

Which three statements about IPv6 routing are correct? (Choose three.)

Accepted Answer

The next-hop address for a directly attached IPv6 static route can be a link-local address.. All three statements are correct. The 'ipv6 route' command is used to configure static routes in IPv6, similar to 'ip route' in IPv4. A directly attached IPv6 static route can indeed use a link-local address as the next hop, which is common for point-to-point interfaces. OSPFv3 (OSPF for IPv6) uses the same fundamental SPF algorithm and link-state concepts as OSPFv2 but is designed to support IPv6 addressing and runs per-link rather than per-subnet.

Answer

The default route in IPv6 is represented as ::/128.

Answer

IPv6 routing is enabled by default on all Cisco routers.

Answer

EIGRP for IPv6 uses the same autonomous system number as EIGRP for IPv4 and shares the same routing table.