CCNA Practice Exam 52 — 20 Questions

Question 1

A network engineer is troubleshooting a connectivity issue between two hosts on different subnets. The sending host has constructed a packet with a destination IP address of 192.168.2.10. As the packet travels down the OSI model layers on the sending host, which Protocol Data Unit (PDU) name is assigned to the data at the Transport layer after TCP segments are created, and at which layer does the IP address get encapsulated?

Accepted Answer

PDU is a segment; IP address is added at the Network layer.. At the Transport layer, TCP divides data into segments, so the PDU is called a segment, making B correct. The destination IP address (192.168.2.10) is added at the Network layer, where the IP header encapsulates the segment into a packet. Option A is wrong because a frame is a Data Link layer PDU, and IP addresses are not added at that layer. Option C is wrong because the PDU at the Transport layer is a segment, not a packet, and IP addresses are added at the Network layer, not the Transport layer. Option D is wrong because 'datagram' typically refers to UDP’s Transport layer PDU (not TCP), and IP addresses are not added at the Transport layer.

Answer

PDU is a frame; IP address is added at the Data Link layer.

Answer

PDU is a packet; IP address is added at the Transport layer.

Answer

PDU is a datagram; IP address is added at the Transport layer.

Question 2

Drag and drop the following steps into the correct order to troubleshoot a Windows client that is unable to reach a remote server.

Accepted Answer

Run ipconfig /all to check IP configuration, subnet mask, default gateway, and DNS servers.. The correct troubleshooting order starts with verifying the client's IP configuration using ipconfig /all (A) to ensure the device has proper addressing. Next, test the TCP/IP stack by pinging the loopback address 127.0.0.1 (B). Then, ping the client's own IP address (C) to confirm the network interface card is operational. After that, ping the default gateway (D) to verify local network connectivity. If successful, ping the remote server (E) to test end-to-end connectivity. If that fails, use tracert (F) to identify where the path breaks. This bottom-up approach isolates the problem starting from the local host outwards.

Question 3

Drag and drop the following steps into the correct order to configure a router-on-a-stick topology for inter-VLAN routing between VLANs 10 and 20, using 802.1Q trunking with native VLAN 99 for management traffic.

Accepted Answer

Create VLANs 10, 20, and 99 on the switch.. The sequence follows Cisco's best practices: VLANs are created first, then access ports are assigned to them. The switch trunk is configured with 802.1Q encapsulation and the native VLAN set to 99 before the router end. On the router, the physical interface must be enabled before subinterfaces can operate. The native VLAN subinterface is created first to handle untagged frames, then the data VLAN subinterfaces are configured. This order avoids errors such as missing VLANs, incorrect encapsulation, and physical link down state.

Question 4

Drag and drop the following steps into the correct order to retrieve the operational status of interface GigabitEthernet0/0 using NETCONF and the ietf-interfaces YANG model.

Accepted Answer

Establish an SSH connection to the network device on TCP port 830, the standard NETCONF port.. First, establish an SSH connection to the device's NETCONF subsystem (TCP port 830). The NETCONF protocol then performs a capability exchange via messages to ensure both sides support the required YANG models. Next, a RPC with an XPath filter is sent to request the specific interface status. The server replies with containing the XML data. The client parses the XML to extract the desired value. Finally, the NETCONF session is closed by a RPC, and the SSH connection is terminated. This order ensures a proper NETCONF transaction lifecycle.

Question 5

Drag and drop the following steps into the correct order to configure a Windows 10 host with a static IPv4 address, subnet mask, and default gateway.

Accepted Answer

Open Control Panel and navigate to Network and Sharing Center.. The correct order begins with opening Network and Sharing Center to access network settings. Then, you must click 'Change adapter settings' to see the list of network connections. Right-clicking the appropriate adapter and selecting Properties opens its configuration. Selecting IPv4 and clicking Properties allows you to set the IP parameters. Choosing 'Use the following IP address' enables the fields for static input. Finally, entering the IP address, subnet mask, and default gateway followed by OK/Close applies the configuration. This sequence follows the logical navigation of the Windows GUI to reach the static IP assignment interface.

Question 6

Which command places a switch interface into trunking mode directly instead of relying on negotiation?

Accepted Answer

switchport mode trunk. The direct command is `switchport mode trunk`. In plain language, this tells the switch to behave as a trunk port rather than waiting to negotiate that role through DTP. That makes the administrative intent clear and avoids ambiguity. In many production environments, explicit configuration is preferred because it is easier to understand and troubleshoot than relying on negotiation behavior.

This is a core CCNA switching idea because trunks and access ports serve very different purposes. The wrong answers either describe negotiation states or commands that relate to other aspects of VLAN behavior. The best answer is the one that directly forces the interface into trunk mode instead of merely suggesting or passively waiting for trunking.

Answer

switchport access vlan 10

Answer

switchport mode dynamic auto

Answer

spanning-tree portfast

Question 7

Exhibit: A laptop has IP address 10.20.30.44/27. Which address is its directed broadcast for that subnet?

Accepted Answer

10.20.30.63. A /27 gives a block size of 32 addresses. The host 10.20.30.44 falls in the 10.20.30.32 to 10.20.30.63 subnet, so the broadcast address is 10.20.30.63.

Answer

10.20.30.31

Answer

10.20.30.32

Answer

10.20.30.64

Question 8

A network team wants routers and switches to have consistent timestamps in logs so event correlation is accurate during an outage. Which service should they verify first?

Accepted Answer

NTP. Consistent timestamps depend on synchronized clocks. NTP is the service used to keep network devices aligned to the same time reference, which makes syslog analysis and troubleshooting much more reliable.

Answer

DNS

Answer

SNMP

Answer

CDP

Question 9

Drag and drop the following steps into the correct order to configure single‑area OSPFv2 on a router, advertise the 192.168.10.0/24 and 10.0.0.0/24 networks in area 0, and set the GigabitEthernet0/0 interface as passive.

Accepted Answer

Enter global configuration mode using the 'configure terminal' command.. The correct sequence is: (1) Enter global configuration mode with 'configure terminal' – this is required before any configuration commands. (2) Initiate the OSPF process with 'router ospf 1' – this places the CLI into OSPF router configuration mode where the remaining commands are issued. (3) Advertise the 192.168.10.0/24 network in area 0 – the 'network' command must be issued under OSPF router mode to inject the connected network into OSPF. (4) Advertise the 10.0.0.0/24 network – a second 'network' statement; the order of network commands is interchangeable but they must be configured before setting passive interfaces in a logical workflow. (5) Configure GigabitEthernet0/0 as a passive interface – this prevents OSPF Hello packets and neighbor adjacency on that interface while still advertising its subnet, and it is configured under OSPF router mode. (6) Return to privileged EXEC mode with 'end' – exits configuration mode and returns to the enable prompt. While setting a passive interface before the network statement does not break the configuration, Cisco documentation suggests adding networks first to clearly define which interfaces participate in OSPF before applying passive-interface restrictions.

Question 10

A PC connected to switch port Gi0/10 should be in VLAN 20 but receives broadcasts only from VLAN 1. Which switchport setting is most likely wrong?

Accepted Answer

switchport access vlan 20 missing or incorrect. The PC is receiving broadcasts only from VLAN 1, which indicates the switchport is not correctly assigned to VLAN 20. The most likely cause is that the 'switchport access vlan 20' command is missing or incorrect, leaving the port in its default VLAN (VLAN 1). This prevents the PC from participating in VLAN 20 and receiving its broadcasts.

Answer

switchport mode trunk

Answer

speed 1000

Answer

duplex full

Question 11

Which two statements accurately describe APIs in controller-based networking?

Accepted Answer

They provide a defined interface through which software can communicate with the controller.. APIs are important in controller-based networking because they give external software a defined way to request data or trigger changes on the controller. In plain language, they make the controller accessible to automation tools, dashboards, orchestration systems, and custom scripts. This helps integrate the controller into broader workflows. APIs do not eliminate the need for security controls, but they do make software-driven operations possible.

The wrong answers usually confuse APIs with physical interfaces or claim that they remove the need for authentication. The two correct answers are the ones focused on programmatic access and software integration.

Answer

They replace all need for forwarding devices.

Answer

They remove the need for authentication and authorization.

Answer

They are Ethernet cabling standards.

Question 12

Drag and drop the following steps into the correct order to configure inter‑VLAN routing between VLANs 10 and 20, using a router‑on‑a‑stick with VLAN 99 as the native VLAN on the trunk link.

Accepted Answer

Create VLANs 10, 20, and 99 on the switch (e.g., using the 'vlan' global configuration commands).. The correct order is: first create VLANs on the switch to define the VLAN database. Second, assign switch ports to the appropriate VLANs so that end hosts are placed in their correct broadcast domains. Third, configure the switch port facing the router as an 802.1Q trunk and set the native VLAN to 99 – this allows tagged traffic from multiple VLANs to traverse a single link while matching the native VLAN on both sides. Fourth, enable the router's physical interface (no shutdown) so that subinterfaces can pass traffic. Next, create subinterfaces for each data VLAN, specifying the correct 802.1Q encapsulation and IP address for each VLAN's default gateway. Finally, configure the native VLAN subinterface with the native keyword to ensure that untagged frames from the trunk are handled correctly and that the native VLAN is explicitly defined on the router.

Question 13

A host sends a packet larger than the outgoing interface MTU, and the IPv4 header has the Don't Fragment bit set.

What will a router do with the packet?

Accepted Answer

Drop it and typically return an ICMP message indicating fragmentation is needed. The router drops the packet because the packet is too large for the next link and the sender has explicitly said the packet must not be fragmented. In IPv4, the Don't Fragment bit tells routers not to break the packet into smaller pieces. If the outgoing interface MTU is smaller than the packet size, the router cannot legally forward it as-is and cannot fragment it, so the normal result is to drop the packet and usually send back an ICMP unreachable message indicating that fragmentation is needed. In plain terms, the router is telling the sender, 'This packet is too big for the path you chose, and you told me I am not allowed to split it.' This behavior is central to path MTU discovery.

Answer

Fragment it anyway and forward the pieces

Answer

Translate it to IPv6 and forward it

Answer

Broadcast it so another router can handle fragmentation

Question 14

After hardening SSH by disabling password authentication and restricting access to an ACL permitting only the management subnet 10.1.10.0/24, configuring RADIUS AAA authentication, enabling port security with a maximum of two MAC addresses on all access ports, and implementing DHCP snooping and DAI on VLAN 10, the administrator finds that users in VLAN 10 obtain DHCP addresses and access the network normally, but SSH from the management workstation (10.1.10.20) to the switch fails with timeouts.

Accepted Answer

The management workstation’s IP-to-MAC binding is missing from the DHCP snooping binding table, causing DAI to drop its ARP traffic.. The management workstation (10.1.10.20) is on the same VLAN 10 where DHCP snooping and DAI are enabled. DAI validates ARP packets against the DHCP snooping binding table. Since the workstation uses a static IP address, its IP-to-MAC binding is not automatically added to the DHCP snooping database. DAI will drop the workstation's ARP replies, preventing the switch from learning its MAC address and causing SSH timeouts.

Answer

The SSH ACL is misconfigured and denies port 22 from the management subnet.

Answer

Port security on the switch interface connected to the management workstation has learned two MAC addresses and shut down the port.

Answer

RADIUS AAA authentication is missing the shared secret on the switch, causing SSH login timeouts.

Question 15

You are connected to R1 via console. R1 has two interfaces: GigabitEthernet0/0 (10.0.0.1/30, connected to ISP) and GigabitEthernet0/1 (192.168.1.1/24, connected to internal LAN). The LAN hosts (192.168.1.0/24) need to access the internet. Configure dynamic NAT with PAT (overload) on R1 using a NAT pool so that internal hosts share the public IP 10.0.0.1 when accessing the internet. Assume the ISP router is already configured and reachable.

Accepted Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 10.0.0.1 10.0.0.1 netmask 255.255.255.252
ip nat inside source list 1 pool PUBLIC overload
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside. It creates an ACL matching only the internal subnet (192.168.1.0/24), defines a NAT pool containing only the single public IP 10.0.0.1, enables PAT with the 'overload' keyword, and correctly assigns inside/outside interfaces. Option B is wrong because the pool includes 10.0.0.2, which is the ISP's IP and would cause conflicts, plus it lacks the 'overload' keyword so PAT is not activated. Option C is wrong because the ACL uses 'any', potentially matching unintended traffic, and the interface roles are reversed (G0/0 as inside, G0/1 as outside), breaking the NAT translation direction. Option D is incorrect because while it implements PAT correctly, it uses interface overload rather than a NAT pool, which does not meet the explicit requirement to use a pool.

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat pool PUBLIC 10.0.0.1 10.0.0.2 netmask 255.255.255.252
ip nat inside source list 1 pool PUBLIC
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside

Answer

access-list 1 permit any
ip nat pool PUBLIC 10.0.0.1 10.0.0.1 netmask 255.255.255.252
ip nat inside source list 1 pool PUBLIC overload
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside

Answer

access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside

Question 16

Refer to the exhibit. A network engineer is troubleshooting a connectivity issue between two routers connected via a serial link. The engineer runs the show interfaces Serial0/0/0 command on R1. Based on the output, what is the most likely cause of the problem?

Accepted Answer

The DCE end of the serial link is missing a clock rate configuration.. The output shows that the interface is up (line protocol is down), and the serial cable is physically connected. The absence of a clock rate on the DCE end of a serial link causes the line protocol to remain down because the receiving router cannot synchronize bit timing. Option D is correct because the DCE device must provide a clock signal for the serial link to establish Layer 2 connectivity.

Answer

The interface is configured with the wrong encapsulation type.

Answer

The interface is administratively shut down.

Answer

The serial cable is disconnected or has a physical fault.

Question 17

A switch port is configured with port security using these commands:

switchport port-security
switchport port-security maximum 1
switchport port-security violation restrict
switchport port-security mac-address sticky

A user unplugs a company laptop and connects a different unauthorized device. The interface stays up/up, but the new device has no connectivity.

Which statement best explains what happened?

Accepted Answer

Traffic from the unauthorized MAC address is being dropped while the interface remains up. With a maximum of 1 secure MAC address, the switch learns only the company laptop's MAC via sticky learning. When the unauthorized device is plugged in, it attempts to send traffic with a new source MAC address. Since the maximum is already reached, this triggers a port security violation. In restrict mode, the switch drops frames from the violating source but leaves the interface operational, matching the observed behavior: the interface stays up/up while the unauthorized device cannot pass traffic.

Answer

The port shut down because restrict mode always causes err-disable

Answer

The switch learned the new MAC address automatically and replaced the old sticky entry

Answer

Port security affects only management traffic, not user traffic

Question 18

Refer to the exhibit. A network administrator is reviewing the NAT translations on router R1 and notices that the internal host 192.168.1.10 appears in both a static NAT entry (for ports 80 and 443) using global address 203.0.113.10, and a dynamic PAT entry (port 49152) using global address 203.0.113.1. The administrator is concerned this might indicate a misconfiguration. Based on the output, which statement is correct?

Accepted Answer

The translations are functioning correctly; the static entries allow inbound web traffic to the host, while the dynamic PAT entry supports an outbound client connection.. Static NAT and dynamic PAT can coexist for the same inside host because they serve different purposes. The static NAT entries for ports 80 and 443 allow inbound web traffic from the internet to reach the internal server at 192.168.1.10 using global address 203.0.113.10. The dynamic PAT entry (port 49152) using global address 203.0.113.1 is a separate translation for an outbound connection initiated by the same host, which is normal behavior as the router maintains distinct translation entries based on direction and port.

Answer

The static NAT rule is being overridden by the dynamic PAT rule, causing inbound web traffic to the server to fail.

Answer

The dynamic PAT entry indicates a duplicate session that will cause asymmetric routing and packet drops.

Answer

The router is incorrectly performing both static and dynamic NAT for the same inside address, which violates the configured NAT order.

Question 19

Refer to the exhibit. An engineer configured PortFast on interface GigabitEthernet0/1, which connects to a server that does not participate in spanning tree. However, the port remains in the listening state for the full forward delay period before transitioning to forwarding. The engineer issues the show spanning-tree vlan 10 detail command. Based on the output, what is the most likely cause?

Accepted Answer

The port is configured as a trunk, so PortFast is not active.. PortFast is designed to immediately transition a port to the forwarding state, bypassing the listening and learning states. However, PortFast is only effective on access ports; if the interface is configured as a trunk port, PortFast is automatically disabled by the switch. The output of 'show spanning-tree vlan 10 detail' would confirm the port is a trunk, explaining why it still goes through the full forward delay.

Answer

BPDU Guard is enabled on the port, causing it to block.

Answer

The forward delay timer is set too high, and PortFast cannot override it.

Answer

The server is sending BPDUs, causing the port to lose its PortFast state.

Question 20

Why are data models such as YANG important in network automation?

Accepted Answer

They define a structured way to represent configuration and state data. Data models such as YANG standardize how configuration and operational data are described, which improves consistency for automation systems and APIs.

Answer

They replace IPv4 and IPv6 addressing

Answer

They remove the need for routing protocols

Answer

They are used only for naming wireless SSIDs