CCNA Practice Exam 52 — 20 Questions

Question 1

Which command places a switch interface into trunking mode directly instead of relying on negotiation?

Accepted Answer

switchport mode trunk. The direct command is `switchport mode trunk`. In plain language, this tells the switch to behave as a trunk port rather than waiting to negotiate that role through DTP. That makes the administrative intent clear and avoids ambiguity. In many production environments, explicit configuration is preferred because it is easier to understand and troubleshoot than relying on negotiation behavior.

This is a core CCNA switching idea because trunks and access ports serve very different purposes. The wrong answers either describe negotiation states or commands that relate to other aspects of VLAN behavior. The best answer is the one that directly forces the interface into trunk mode instead of merely suggesting or passively waiting for trunking.

Answer

switchport access vlan 10

Answer

switchport mode dynamic auto

Answer

spanning-tree portfast

Question 2

Exhibit: A laptop has IP address 10.20.30.44/27. Which address is its directed broadcast for that subnet?

Accepted Answer

10.20.30.63. A /27 gives a block size of 32 addresses. The host 10.20.30.44 falls in the 10.20.30.32 to 10.20.30.63 subnet, so the broadcast address is 10.20.30.63.

Answer

10.20.30.31

Answer

10.20.30.32

Answer

10.20.30.64

Question 3

A network team wants routers and switches to have consistent timestamps in logs so event correlation is accurate during an outage. Which service should they verify first?

Accepted Answer

NTP. Consistent timestamps depend on synchronized clocks. NTP is the service used to keep network devices aligned to the same time reference, which makes syslog analysis and troubleshooting much more reliable.

Answer

DNS

Answer

SNMP

Answer

CDP

Question 4

Drag and drop the following steps into the correct order to configure single‑area OSPFv2 on a router, advertise the 192.168.10.0/24 and 10.0.0.0/24 networks in area 0, and set the GigabitEthernet0/0 interface as passive.

Accepted Answer

Enter global configuration mode using the 'configure terminal' command.. The correct sequence is: (1) Enter global configuration mode with 'configure terminal' – this is required before any configuration commands. (2) Initiate the OSPF process with 'router ospf 1' – this places the CLI into OSPF router configuration mode where the remaining commands are issued. (3) Advertise the 192.168.10.0/24 network in area 0 – the 'network' command must be issued under OSPF router mode to inject the connected network into OSPF. (4) Advertise the 10.0.0.0/24 network – a second 'network' statement; the order of network commands is interchangeable but they must be configured before setting passive interfaces in a logical workflow. (5) Configure GigabitEthernet0/0 as a passive interface – this prevents OSPF Hello packets and neighbor adjacency on that interface while still advertising its subnet, and it is configured under OSPF router mode. (6) Return to privileged EXEC mode with 'end' – exits configuration mode and returns to the enable prompt. While setting a passive interface before the network statement does not break the configuration, Cisco documentation suggests adding networks first to clearly define which interfaces participate in OSPF before applying passive-interface restrictions.

Question 5

A PC connected to switch port Gi0/10 should be in VLAN 20 but receives broadcasts only from VLAN 1. Which switchport setting is most likely wrong?

Accepted Answer

switchport access vlan 20 missing or incorrect. The PC is receiving broadcasts only from VLAN 1, which indicates the switchport is not correctly assigned to VLAN 20. The most likely cause is that the 'switchport access vlan 20' command is missing or incorrect, leaving the port in its default VLAN (VLAN 1). This prevents the PC from participating in VLAN 20 and receiving its broadcasts.

Answer

switchport mode trunk

Answer

speed 1000

Answer

duplex full

Question 6

Drag and drop the PDU names on the left to the correct OSI model layers on the right.

Accepted Answer

Application: Message, Transport: Segment, Network: Packet, Data Link: Frame, Physical: Bit, Session: Data. In the OSI model, each layer processes a specific Protocol Data Unit (PDU). The Application layer (Layer 7) uses 'Message', the Transport layer (Layer 4) uses 'Segment', the Network layer (Layer 3) uses 'Packet', the Data Link layer (Layer 2) uses 'Frame', the Physical layer (Layer 1) uses 'Bit', and the Session layer (Layer 5) uses 'Data'. This pairing follows the correct OSI terminology as shown in Option A.

Answer

Application: Data, Transport: Segment, Network: Packet, Data Link: Frame, Physical: Bit, Session: Message

Answer

Application: Message, Transport: Packet, Network: Segment, Data Link: Frame, Physical: Bit, Session: Data

Answer

Application: Data, Transport: Segment, Network: Packet, Data Link: Frame, Physical: Bit, Session: Message

Question 7

Which two statements accurately describe APIs in controller-based networking?

Accepted Answer

They provide a defined interface through which software can communicate with the controller.. APIs are important in controller-based networking because they give external software a defined way to request data or trigger changes on the controller. In plain language, they make the controller accessible to automation tools, dashboards, orchestration systems, and custom scripts. This helps integrate the controller into broader workflows. APIs do not eliminate the need for security controls, but they do make software-driven operations possible.

The wrong answers usually confuse APIs with physical interfaces or claim that they remove the need for authentication. The two correct answers are the ones focused on programmatic access and software integration.

Answer

They replace all need for forwarding devices.

Answer

They remove the need for authentication and authorization.

Answer

They are Ethernet cabling standards.

Question 8

Drag and drop the following steps into the correct order to configure inter‑VLAN routing between VLANs 10 and 20, using a router‑on‑a‑stick with VLAN 99 as the native VLAN on the trunk link.

Accepted Answer

Create VLANs 10, 20, and 99 on the switch (e.g., using the 'vlan' global configuration commands).. The correct order is: first create VLANs on the switch to define the VLAN database. Second, assign switch ports to the appropriate VLANs so that end hosts are placed in their correct broadcast domains. Third, configure the switch port facing the router as an 802.1Q trunk and set the native VLAN to 99 – this allows tagged traffic from multiple VLANs to traverse a single link while matching the native VLAN on both sides. Fourth, enable the router's physical interface (no shutdown) so that subinterfaces can pass traffic. Next, create subinterfaces for each data VLAN, specifying the correct 802.1Q encapsulation and IP address for each VLAN's default gateway. Finally, configure the native VLAN subinterface with the native keyword to ensure that untagged frames from the trunk are handled correctly and that the native VLAN is explicitly defined on the router.

Question 9

A host sends a packet larger than the outgoing interface MTU, and the IPv4 header has the Don't Fragment bit set.

What will a router do with the packet?

Accepted Answer

Drop it and typically return an ICMP message indicating fragmentation is needed. The router drops the packet because the packet is too large for the next link and the sender has explicitly said the packet must not be fragmented. In IPv4, the Don't Fragment bit tells routers not to break the packet into smaller pieces. If the outgoing interface MTU is smaller than the packet size, the router cannot legally forward it as-is and cannot fragment it, so the normal result is to drop the packet and usually send back an ICMP unreachable message indicating that fragmentation is needed. In plain terms, the router is telling the sender, 'This packet is too big for the path you chose, and you told me I am not allowed to split it.' This behavior is central to path MTU discovery.

Answer

Fragment it anyway and forward the pieces

Answer

Translate it to IPv6 and forward it

Answer

Broadcast it so another router can handle fragmentation

Question 10

After hardening SSH by disabling password authentication and restricting access to an ACL permitting only the management subnet 10.1.10.0/24, configuring RADIUS AAA authentication, enabling port security with a maximum of two MAC addresses on all access ports, and implementing DHCP snooping and DAI on VLAN 10, the administrator finds that users in VLAN 10 obtain DHCP addresses and access the network normally, but SSH from the management workstation (10.1.10.20) to the switch fails with timeouts.

Accepted Answer

The management workstation’s IP-to-MAC binding is missing from the DHCP snooping binding table, causing DAI to drop its ARP traffic.. The management workstation (10.1.10.20) is on the same VLAN 10 where DHCP snooping and DAI are enabled. DAI validates ARP packets against the DHCP snooping binding table. Since the workstation uses a static IP address, its IP-to-MAC binding is not automatically added to the DHCP snooping database. DAI will drop the workstation's ARP replies, preventing the switch from learning its MAC address and causing SSH timeouts.

Answer

The SSH ACL is misconfigured and denies port 22 from the management subnet.

Answer

Port security on the switch interface connected to the management workstation has learned two MAC addresses and shut down the port.

Answer

RADIUS AAA authentication is missing the shared secret on the switch, causing SSH login timeouts.

Question 11

Refer to the exhibit. A network engineer is troubleshooting a connectivity issue between two routers connected via a serial link. The engineer runs the show interfaces Serial0/0/0 command on R1. Based on the output, what is the most likely cause of the problem?

Accepted Answer

The DCE end of the serial link is missing a clock rate configuration.. The output shows that the interface is up (line protocol is down), and the serial cable is physically connected. The absence of a clock rate on the DCE end of a serial link causes the line protocol to remain down because the receiving router cannot synchronize bit timing. Option D is correct because the DCE device must provide a clock signal for the serial link to establish Layer 2 connectivity.

Answer

The interface is configured with the wrong encapsulation type.

Answer

The interface is administratively shut down.

Answer

The serial cable is disconnected or has a physical fault.

Question 12

A switch port is configured with port security using these commands:

switchport port-security
switchport port-security maximum 1
switchport port-security violation restrict
switchport port-security mac-address sticky

A user unplugs a company laptop and connects a different unauthorized device. The interface stays up/up, but the new device has no connectivity.

Which statement best explains what happened?

Accepted Answer

Traffic from the unauthorized MAC address is being dropped while the interface remains up. With a maximum of 1 secure MAC address, the switch learns only the company laptop's MAC via sticky learning. When the unauthorized device is plugged in, it attempts to send traffic with a new source MAC address. Since the maximum is already reached, this triggers a port security violation. In restrict mode, the switch drops frames from the violating source but leaves the interface operational, matching the observed behavior: the interface stays up/up while the unauthorized device cannot pass traffic.

Answer

The port shut down because restrict mode always causes err-disable

Answer

The switch learned the new MAC address automatically and replaced the old sticky entry

Answer

Port security affects only management traffic, not user traffic

Question 13

Refer to the exhibit. A network administrator is reviewing the NAT translations on router R1 and notices that the internal host 192.168.1.10 appears in both a static NAT entry (for ports 80 and 443) using global address 203.0.113.10, and a dynamic PAT entry (port 49152) using global address 203.0.113.1. The administrator is concerned this might indicate a misconfiguration. Based on the output, which statement is correct?

Accepted Answer

The translations are functioning correctly; the static entries allow inbound web traffic to the host, while the dynamic PAT entry supports an outbound client connection.. Static NAT and dynamic PAT can coexist for the same inside host because they serve different purposes. The static NAT entries for ports 80 and 443 allow inbound web traffic from the internet to reach the internal server at 192.168.1.10 using global address 203.0.113.10. The dynamic PAT entry (port 49152) using global address 203.0.113.1 is a separate translation for an outbound connection initiated by the same host, which is normal behavior as the router maintains distinct translation entries based on direction and port.

Answer

The static NAT rule is being overridden by the dynamic PAT rule, causing inbound web traffic to the server to fail.

Answer

The dynamic PAT entry indicates a duplicate session that will cause asymmetric routing and packet drops.

Answer

The router is incorrectly performing both static and dynamic NAT for the same inside address, which violates the configured NAT order.

Question 14

Refer to the exhibit. An engineer configured PortFast on interface GigabitEthernet0/1, which connects to a server that does not participate in spanning tree. However, the port remains in the listening state for the full forward delay period before transitioning to forwarding. The engineer issues the show spanning-tree vlan 10 detail command. Based on the output, what is the most likely cause?

Accepted Answer

The port is configured as a trunk, so PortFast is not active.. PortFast is designed to immediately transition a port to the forwarding state, bypassing the listening and learning states. However, PortFast is only effective on access ports; if the interface is configured as a trunk port, PortFast is automatically disabled by the switch. The output of 'show spanning-tree vlan 10 detail' would confirm the port is a trunk, explaining why it still goes through the full forward delay.

Answer

BPDU Guard is enabled on the port, causing it to block.

Answer

The forward delay timer is set too high, and PortFast cannot override it.

Answer

The server is sending BPDUs, causing the port to lose its PortFast state.

Question 15

Why are data models such as YANG important in network automation?

Accepted Answer

They define a structured way to represent configuration and state data. Data models such as YANG standardize how configuration and operational data are described, which improves consistency for automation systems and APIs.

Answer

They replace IPv4 and IPv6 addressing

Answer

They remove the need for routing protocols

Answer

They are used only for naming wireless SSIDs

Question 16

A port connected to an end-user PC should not send or expect VLAN tags from the endpoint. Which interface type is appropriate on the switch?

Accepted Answer

Access port. The appropriate interface type is an access port. In plain language, a normal user PC is expected to connect to one VLAN and send ordinary untagged Ethernet frames. The switch associates that traffic with the configured access VLAN. This is different from a trunk, which is designed to carry multiple VLANs and commonly uses tagging to preserve VLAN identity across the link. Routed ports are Layer 3 interfaces used for routing between VLANs, not for attaching a single end-user PC. Port-channel interfaces aggregate multiple physical links for redundancy and bandwidth, but they do not determine whether VLAN tagging is used; the underlying port mode (access or trunk) still applies. Therefore, access port is the only correct choice for an untagged, single-VLAN end-device connection.

Answer

Trunk port

Answer

Routed port

Answer

Port-channel interface

Question 17

A network technician is troubleshooting a DHCP relay issue. The router at the branch office is supposed to forward DHCP requests from local clients to a central DHCP server. Clients connected to Gi0/1 are not receiving IP addresses. The technician verifies that the DHCP server is reachable from the router, that no ACLs are blocking DHCP traffic, and that the DHCP scope on the server has available leases. Upon checking the running configuration, the technician notices that the ip helper-address command is applied to interface Gi0/0 (the WAN link toward the server) instead of Gi0/1. What should the technician do next?

Accepted Answer

Move the ip helper-address command from interface Gi0/0 to interface Gi0/1.. The ip helper-address command must be applied to the interface that receives the DHCP broadcast from clients, which is Gi0/1 in this scenario. It converts the broadcast into a unicast directed to the DHCP server. Applying it to Gi0/0 (the WAN interface) is ineffective because broadcasts are not forwarded across routers by default, and the helper address must be on the ingress interface of the client subnet.

Answer

Check the DHCP server logs for any error or warning messages related to the clients' requests.

Answer

Issue the show ip interface brief command to ensure that interface Gi0/1 is in an up/up state.

Answer

Remove the ip helper-address from Gi0/0 and then reapply it to the same interface to ensure the command is active.

Question 18

Which TWO statements correctly describe the behavior of Root Guard, Loop Guard, and BPDU Guard in a Rapid PVST+ environment?

Accepted Answer

Root Guard is applied to a port that should never become a root port; if a superior BPDU is received, the port is placed into a root-inconsistent state.. Root Guard, applied to a port that should never become a root port, places that port into a root-inconsistent state upon receiving a superior BPDU, blocking traffic to prevent an unauthorized root bridge. Option C is correct because BPDU Guard is typically configured on access ports and error-disables the port if any BPDU is received, protecting against rogue switch connections. Option B is incorrect: when BPDUs stop on a port with Loop Guard, the port is placed into a loop-inconsistent state (blocked), not immediately forwarded, to prevent loops. Option D is incorrect because Root Guard and BPDU Guard are mutually exclusive and cannot be enabled simultaneously on the same port due to conflicting protective behaviors. Option E is incorrect because Loop Guard is effective on any port that is expected to receive BPDUs, including root ports and alternate/backup ports; it is not limited to ports already in a blocking state, and the statement's use of 'only' makes it false.

Answer

Loop Guard is used on root ports to monitor BPDU reception; if BPDUs stop, the port is immediately placed into forwarding mode to maintain connectivity.

Answer

Root Guard and BPDU Guard can be enabled simultaneously on the same port to provide both root protection and BPDU filtering.

Answer

Loop Guard is only effective when configured on ports that are in a blocking state; it prevents them from transitioning to forwarding if BPDUs are not received.

Question 19

A network administrator has configured HSRP between RouterA and RouterB for VLAN 10. End hosts using the virtual IP 192.168.1.1 as their default gateway experience intermittent connectivity losses, and pings to 192.168.1.1 often fail. The output of 'show standby brief' on both routers shows the state as Active. What is the most likely cause?

Accepted Answer

The routers are configured with mismatched HSRP authentication methods.. When both routers show the HSRP state as Active, a 'dual-active' scenario exists, which causes intermittent connectivity because both routers forward traffic for the virtual IP. Mismatched HSRP authentication methods (e.g., one router using plain-text authentication and the other using MD5) prevent the routers from exchanging proper Hello messages, so they fail to negotiate a single Active router. This is the most likely cause because authentication mismatches break the HSRP adjacency, leading to both routers assuming the Active role.

Answer

The virtual IP address is configured on only one router.

Answer

The HSRP group number on one router is set to 0.

Answer

The priority on both routers is configured to the same value.

Question 20

A technician is troubleshooting an OSPF adjacency problem: R1 and R2 are not forming a neighbor relationship. R1's OSPF configuration includes the command 'network 192.168.1.0 0.0.0.255 area 0'. R2's GigabitEthernet0/0 is configured with IP address 10.1.1.1/30 and is participating in OSPF area 0. The engineer verifies that physical connectivity is fine and OSPF is enabled on R2. What is the most likely cause?

Accepted Answer

R1's network statement does not include the subnet of the link connecting R1 and R2.. R1's network statement 'network 192.168.1.0 0.0.0.255 area 0' only enables OSPF on interfaces whose IP addresses fall within the 192.168.1.0/24 range. The link between R1 and R2 uses the 10.1.1.0/30 subnet (R2's GigabitEthernet0/0 is 10.1.1.1/30), so R1's interface on that link is not covered by the network statement. Without OSPF enabled on the connecting interface, R1 cannot send or receive OSPF hello packets, preventing neighbor adjacency formation.

Answer

The OSPF network type on R1's interface differs from the network type on R2's interface.

Answer

R1's router ID is not manually set and duplicates the router ID of R2.

Answer

Mismatched OSPF hello and dead intervals between the routers.