CCNA Practice Questions 1 — 50 Questions

Question 1

Drag and drop the following steps into the correct order to configure a Cisco switch as a DHCP relay agent with DHCP snooping, where the DHCP server is located on a remote router.

Accepted Answer

Configure a DHCP pool with network, default gateway, and lease parameters on the router acting as the DHCP server.. First, the DHCP server must be properly configured on the router. Next, DHCP snooping is enabled globally on the switch to protect against rogue servers. Then, the specific client VLANs must be added to the snooping database. After that, the uplink interface to the DHCP server must be trusted to allow legitimate server responses. Finally, the ip helper-address command is placed on the client's SVI to forward DHCP broadcasts to the remote server.

Question 2

Match each REST-style method to the most common intent.

Accepted Answer

GET - Retrieve a resource. RESTful methods map to CRUD operations: GET retrieves, POST creates, PUT replaces, PATCH partially updates, DELETE removes, and OPTIONS returns allowed methods.

Answer

GET - Create a new resource

Answer

POST - Retrieve a resource

Answer

PUT - Partially update a resource

Question 3

A network engineer notices that internal hosts (192.168.1.0/24) can reach external servers on the internet, but replies from external servers never reach the internal hosts. The router R1 is configured with dynamic NAT to translate the internal subnet to a pool of public IPs (203.0.113.10-203.0.113.20). The engineer runs 'show ip nat translations' and sees only a few stale translations. What is the most likely cause of the issue?

Accepted Answer

The outside interface (GigabitEthernet0/0) is missing the 'ip nat outside' command.. The 'ip nat outside' command must be applied to the interface facing the external network (GigabitEthernet0/0) for the router to translate return traffic. Without it, the router does not perform NAT on packets arriving on that interface, so replies from external servers are forwarded without translation back to the inside local IPs, which are not routable on the internet. The stale translations indicate that outbound translations were created but never used for return traffic, confirming the missing outside interface command.

Answer

The access list 'NAT' is incorrect; it should permit only specific hosts, not the entire subnet.

Answer

The NAT configuration lacks the 'overload' keyword, so the pool is exhausted quickly.

Answer

The NAT pool 'POOL' has too few addresses; it should be expanded to a /24 subnet.

Question 4

A network administrator is troubleshooting a wireless connectivity issue in a large office. Users on the 5 GHz band report intermittent disconnections and slow performance, while 2.4 GHz clients are unaffected. The office uses a Cisco 9800 WLC with APs that support 802.11ac Wave 2. The administrator checks the WLC's RF profile and notices a high number of channel utilization reports on channel 36. What is the most likely cause of the problem?

Accepted Answer

Change some APs to use channels 40, 44, or 48 to reduce co-channel interference.. Channel 36 is a 20 MHz channel in the 5 GHz band. When many APs use the same channel (channel 36), they share the same medium, leading to co-channel interference (CCI). This causes intermittent disconnections and slow performance for 5 GHz clients because they must contend for airtime. Spreading APs across non-overlapping channels like 40, 44, or 48 reduces CCI and improves performance.

Answer

Enable DFS channels to avoid radar interference.

Answer

Increase the channel width to 160 MHz to improve throughput.

Answer

Disable the 2.4 GHz radios to force all clients to 5 GHz.

Question 5

Drag and drop the following steps into the correct order to configure a switch port for data and voice traffic.

Accepted Answer

Enter interface configuration mode for the desired switch port.. The correct order is: 1) Enter interface configuration mode, because all port-specific commands must be applied under the interface. 2) Set the port as an access port with 'switchport mode access'—a voice VLAN can only be assigned on an access port. 3) Assign the data VLAN with 'switchport access vlan' to ensure proper Layer 2 forwarding for data traffic. 4) Assign the voice VLAN with 'switchport voice vlan' so the IP phone's voice frames are tagged with the voice VLAN. 5) Enable PortFast with 'spanning-tree portfast' to immediately transition the port to forwarding, preventing DHCP timeouts for the phone and host.

Question 6

Which TWO statements about IPv4 and IPv6 ACLs are true?

Accepted Answer

Extended IPv4 ACLs should be placed as close to the source as possible to minimize unnecessary traffic on the network.. Extended IPv4 ACLs filter on source and destination IP addresses, ports, and protocols, so placing them as close to the source as possible prevents unwanted traffic from traversing the network, reducing bandwidth waste and security risks. This is a best practice for extended ACLs, unlike standard ACLs which should be placed close to the destination.

Answer

Standard IPv4 ACLs use numbers in the range 100-199.

Answer

Standard IPv4 ACLs filter only the source IP address and are best placed close to the source to be most effective.

Answer

Numbered ACLs allow individual access control entries (ACEs) to be deleted without removing the entire ACL.

Question 7

A network administrator is troubleshooting an IPv6 connectivity issue on a newly deployed router. The router's G0/0/0 interface is configured with an IPv6 address using EUI-64, but hosts on that subnet cannot reach the router's link-local address. The administrator runs 'show ipv6 interface g0/0/0' and sees that the interface is up/up but the IPv6 address is not in the expected format. What is the most likely cause of the problem?

Accepted Answer

The IPv6 address was not configured correctly; the 'ipv6 address' command was likely omitted or misconfigured.. The router's G0/0/0 interface is up/up, but the IPv6 address is not in the expected EUI-64 format. This indicates that the 'ipv6 address' command was likely omitted entirely, because if it were simply misconfigured (e.g., without the `eui-64` keyword), the router would still automatically generate a link-local address, and hosts would be able to reach it. Since hosts cannot reach the link-local address, IPv6 is not enabled on the interface at all. The correct configuration requires the `ipv6 address` command with the appropriate prefix and the `eui-64` keyword.

Answer

The interface is administratively down.

Answer

The MAC address of the interface is invalid, preventing EUI-64 from generating a proper address.

Answer

The router is not sending Router Advertisements, so hosts cannot autoconfigure.

Question 8

A network administrator is configuring a new Windows workstation on a small office network that uses IPv4 addressing. The workstation must be able to communicate with devices on other subnets and resolve hostnames via a company DNS server at 10.10.10.5. The administrator has already set the IP address to 10.10.10.10 and the subnet mask to 255.255.255.0. Which additional parameter must be configured to meet both requirements?

Accepted Answer

Configure a default gateway of 10.10.10.1 and a DNS server of 10.10.10.5.. To communicate with devices on other subnets, the workstation needs a default gateway (router) to forward traffic beyond its local subnet. The IP address 10.10.10.10 with subnet mask 255.255.255.0 places it in the 10.10.10.0/24 network, so a default gateway (e.g., 10.10.10.1) is required for inter-subnet routing. Additionally, to resolve hostnames, the DNS server address must be explicitly configured; the company DNS server is at 10.10.10.5. Option A correctly provides both parameters.

Answer

Configure only a DNS server of 10.10.10.5.

Answer

Change the subnet mask to 255.255.0.0 to allow communication across subnets.

Answer

Configure a default gateway of 10.10.20.1 and a DNS server of 10.10.10.5.

Question 9

Which TWO statements accurately describe the characteristics and deployment considerations for fiber optic cabling in a modern enterprise network?

Accepted Answer

When using a 10GBASE-SR SFP+ transceiver over OM3 multimode fiber, the maximum supported distance is 300 meters.. The correct statements are that 10GBASE-SR over OM3 multimode fiber supports up to 300 meters and that fiber optic cabling is immune to electromagnetic interference (EMI), making it ideal for electrically noisy environments. Single-mode fiber actually has a smaller core diameter than multimode, making option A incorrect. Multimode fiber is designed for shorter links, so option B is wrong. Standard 1000BASE-LX SFP transceivers over single-mode fiber are limited to 5 km, not 10 km, so option C is inaccurate.

Answer

Single-mode fiber (SMF) typically uses a larger core diameter than multimode fiber (MMF).

Answer

Multimode fiber (MMF) is generally preferred for longer-distance links, such as between buildings on a campus network.

Answer

A 1000BASE-LX SFP transceiver operating over single-mode fiber can support distances up to 10 km.

Question 10

A network administrator is troubleshooting connectivity issues in a switched network. Users on VLAN 10 report intermittent connectivity to the server farm. The network uses Rapid PVST+ as the spanning-tree protocol. The administrator examines the switch that is the root bridge for VLAN 10 and notices that one of the uplink interfaces to an access switch is in a blocking state. What is the most likely cause of this issue?

Accepted Answer

Check the spanning-tree priority on other switches to ensure the intended root bridge has the lowest priority for VLAN 10.. In Rapid PVST+, the root bridge for a VLAN should have all its ports in a forwarding state. If an uplink interface on the root bridge is blocking, it indicates that another switch is being elected as the root bridge for VLAN 10, likely because it has a lower spanning-tree priority. By checking and adjusting the priority on other switches, the administrator can ensure the intended switch becomes the root bridge, resolving the intermittent connectivity caused by suboptimal path selection.

Answer

Change the port type of Gi0/3 to trunk to allow multiple VLANs.

Answer

Configure spanning-tree portfast on Gi0/3 to speed up convergence.

Answer

Enable BPDU guard on Gi0/3 to prevent unauthorized switches from affecting the network.

Question 11

A user reports that their computer cannot access the network. The technician checks the computer's IP configuration and finds an APIPA address (169.254.x.x). The computer is connected to a switch port on VLAN 20. The DHCP server is located on VLAN 1. The technician then examines the router's interfaces using 'show ip interface brief' and sees that all interfaces shown are up/up. What should the technician do next?

Accepted Answer

Verify that the ip helper-address command is configured on the router's VLAN 20 interface.. The APIPA address (169.254.x.x) indicates the host failed to obtain a DHCP lease. Since the DHCP server is on VLAN 1 and the host is on VLAN 20, a DHCP relay (ip helper-address) must be configured on the router's VLAN 20 interface to forward DHCP broadcast messages to the server. The 'show ip interface brief' shows all interfaces are up/up, so the next logical step is to verify the relay configuration.

Answer

Check the DHCP server logs to see if it is receiving Discover messages.

Answer

Attempt to ping the DHCP server's IP address from the host's APIPA address.

Answer

Restart the DHCP service on the server and recheck the host.

Question 12

A network administrator at a large enterprise notices that the network monitoring system frequently generates false positive alerts for unusual traffic patterns during normal business hours. The administrator wants to reduce these false positives while still detecting genuine security threats. Which AI/ML concept would best address this requirement?

Accepted Answer

Implement an anomaly detection system that uses machine learning to establish baseline behavior and flag deviations.. Anomaly detection using machine learning establishes a dynamic baseline of normal network behavior, allowing the system to flag only significant deviations. This reduces false positives during normal business hours while still detecting genuine threats that deviate from the learned baseline, unlike static thresholds that trigger alerts on routine traffic variations.

Answer

Deploy a predictive analytics model to forecast future traffic volumes and adjust thresholds accordingly.

Answer

Apply intent-based networking to automatically enforce security policies based on high-level business intent.

Answer

Use deep packet inspection to examine all traffic and create static rules for known threats.

Question 13

Based on the exhibit, why are clients in VLAN 70 failing to resolve hostnames even though they can reach remote IP addresses?

Accepted Answer

The clients are missing valid DNS server information.. The strongest explanation is that the clients are missing valid DNS server information. In practical terms, successful reachability to remote IP addresses proves that Layer 3 forwarding is working. The failure occurs only when a hostname is used, which points to a naming service problem rather than a general connectivity problem. The DHCP scope shown provides an address and default gateway, but no DNS server option is defined.

This is a very realistic IP-services troubleshooting pattern because the network path works while application usability still fails.

Answer

The default gateway must be removed from the DHCP scope.

Answer

The clients must use PPP before DNS works.

Answer

The VLAN must be converted to the native VLAN on all trunks.

Question 14

Match each network service to its primary function.

Accepted Answer

DNS: Translates domain names to IP addresses. Each network service has a distinct primary function: DNS translates names to IPs, DHCP automates IP assignment, NTP synchronizes time, SNMP manages devices, FTP transfers files, and HTTP serves web content.

Answer

DNS: Assigns IP addresses dynamically to devices on a network

Answer

DNS: Synchronizes time across network devices

Answer

DNS: Manages and monitors network devices

Question 15

Match each HTTP method to its common REST API action.

Accepted Answer

GET - Retrieve data. GET retrieves data; POST creates; PUT replaces; PATCH partially updates; DELETE removes; OPTIONS queries available methods.

Answer

GET - Create data

Answer

POST - Retrieve data

Answer

PUT - Partially update data

Question 16

A network administrator is troubleshooting a connectivity issue between two remote sites connected via a WAN link. Hosts on VLAN 10 at Site A (192.168.10.0/24) cannot ping the server at Site B (10.10.20.100). The router at Site A has a default route configured with the next-hop IP address 10.10.10.2. The administrator checks the routing table on Router A and notices that the default route is not installed. What is the most likely cause of the problem?

Accepted Answer

The next-hop router 10.10.10.2 is unreachable.. The default route uses a next-hop IP (10.10.10.2) and will only be installed in the routing table if that next-hop is reachable. Since the router’s routing table shows no default route, the most likely cause is that the next-hop 10.10.10.2 is unreachable, preventing the static route from being used. This explains why traffic fails despite the configuration.

Answer

The static route for 10.10.20.0/24 is missing from the routing table.

Answer

The GigabitEthernet0/0 interface is administratively down.

Answer

The default route is not configured; the gateway of last resort is missing.

Question 17

Based on the exhibit, which action is most likely required to allow AP-22 to join the controller successfully?

Accepted Answer

Correct the AP's default gateway so it matches the AP's actual subnet and reachability needs.. The correct action is to fix the AP's default gateway so it can reach the controller's subnet. Option B is wrong because APs use Ethernet, not PPP encapsulation, which is used for serial WAN links. Option C is wrong because CAPWAP does not assign IP addresses; DHCP does, but the AP already has a static IP, and removing it would cause it to fall back to DHCP, which may not fix the gateway issue. Option D is wrong because disabling DHCP on the controller would affect all APs and prevent new APs from obtaining addresses, which is not a targeted fix.

Answer

Change the AP from Ethernet to PPP encapsulation.

Answer

Remove the AP IP address so it can obtain an IP address automatically via DHCP.

Answer

Disable DHCP on the controller for all APs.

Question 18

A switch stack is running PVST+. Users on VLAN 40 lose connectivity for roughly 30 seconds every time the uplink on SW2 flaps. Based on the exhibit, which change would most directly improve convergence for this VLAN?

Accepted Answer

Configure spanning-tree mode rapid-pvst.. The output shows VLAN 40 is still using the legacy IEEE STP process, which converges much more slowly than Rapid PVST+. Moving the switch to rapid-pvst mode gives VLAN 40 the faster proposal/agreement behavior that typically cuts convergence time from tens of seconds to a few seconds.

Answer

Increase the bridge priority on SW2 for VLAN 40.

Answer

Disable PortFast on all access ports.

Answer

Convert the uplink to a routed port.

Question 19

Based on the exhibit, why is traffic to host 198.51.100.70 using the OSPF route instead of the static route?

Accepted Answer

Because the OSPF /26 route is more specific than the static /24 route.. The traffic uses the OSPF route because it is the more specific match. In practical terms, the router evaluates destination-prefix specificity before comparing route source preference. The static route points to a broader /24, while the OSPF entry points to a narrower /26 that still contains the destination. Because longest-prefix match comes first, the /26 route wins.

This is a good reminder that static routes do not automatically beat dynamic routes when the prefixes are different. Specificity matters first, then source preference only when the prefix length is the same.

Answer

Because OSPF always overrides static routing, regardless of prefix length.

Answer

Because the static route must have an administrative distance of 255 to be considered.

Answer

Because the destination 198.51.100.70 is outside both listed routes.

Question 20

A router has the following routes in its table: 172.16.0.0/16, 172.16.20.0/24, and 172.16.20.128/25. Which route is used for traffic to 172.16.20.200?

Accepted Answer

172.16.20.128/25. The /25 route is used because it is the most specific match. In plain language, the router looks for the narrowest route that still contains the destination address. Since 172.16.20.200 falls inside 172.16.20.128/25, that route wins over the broader /24 and /16 entries.

This is a direct longest-prefix-match question. It is meant to reinforce that specificity comes first in routing-table lookup. Broader routes remain useful, but they are not chosen when a more precise matching entry exists.

Answer

172.16.0.0/16

Answer

172.16.20.0/24

Answer

The default route