CCNA Practice Exam 53 — 20 Questions

Question 1

A network engineer notices that a switch port connected to a legacy server is experiencing late collisions and the server reports excessive retransmissions. The switch port is configured for auto-negotiation and shows a negotiated speed of 100 Mbps and duplex full. The server's NIC is manually set to 100 Mbps and half-duplex. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A duplex mismatch exists between the switch port and the server NIC.. The switch port is auto-negotiating to full-duplex while the server's NIC is manually set to half-duplex. This creates a duplex mismatch: the switch transmits expecting no collisions (full-duplex), but the server, operating in half-duplex, detects collisions when the switch sends frames while the server is transmitting. Late collisions occur because the collision is detected after the first 64 bytes of the frame, and the server's half-duplex CSMA/CD logic forces retransmissions, matching the symptoms described.

Answer

The switch port is incorrectly configured for auto-negotiation and should be manually set to match the server's NIC.

Answer

The server's NIC is failing, causing cyclic redundancy check (CRC) errors and forcing retransmissions.

Answer

The switch port is overloaded by a broadcast storm, causing an excessive number of collisions.

Question 2

Drag and drop the following steps into the correct order to interpret packet capture output for L2/L3 troubleshooting.

Accepted Answer

Examine the source and destination MAC addresses in the Ethernet header to verify Layer 2 connectivity.. The logical troubleshooting sequence for packet capture analysis starts at Layer 2 to verify the data link layer. First, examine the source and destination MAC addresses in the Ethernet header to confirm correct frame delivery. Next, check for ARP requests and responses to ensure proper IP-to-MAC resolution. Then, analyze the source and destination IP addresses to verify Layer 3 addressing and routing. After that, look for ICMP Destination Unreachable or Time Exceeded messages to identify network path issues. Proceed to inspect transport layer port numbers (TCP/UDP) to identify the service and possible blocking. Finally, review TCP flags (e.g., SYN, RST, FIN) to understand session state and detect retransmissions or connection issues.

Question 3

A network technician configures a Windows 10 PC with a static IPv6 address of 2001:db8:acad:1::100/64 and a default gateway of 2001:db8:acad:2::1. The PC can communicate with other hosts in the 2001:db8:acad:1::/64 subnet, but it cannot access any resources on other subnets, even though IPv4 connectivity through the same network works normally. What is the most likely reason for this issue?

Accepted Answer

The PC's default gateway address is in a different subnet than the PC's IPv6 address.. The PC's IPv6 address is 2001:db8:acad:1::100/64, placing it in the 2001:db8:acad:1::/64 subnet. The configured default gateway is 2001:db8:acad:2::1, which belongs to the 2001:db8:acad:2::/64 subnet. For IPv6, a host will only consider a default gateway on the same link-local or on-link subnet; if the gateway address is not within the same /64 prefix as the host's address, the host cannot send packets to it directly, and all off-subnet traffic fails.

Answer

The PC's IPv6 stack has a corrupted binding that prevents routing.

Answer

The router's IPv6 routing table does not have a route back to the PC's subnet.

Answer

The DNS server for IPv6 resolution is misconfigured, causing all off-subnet traffic to fail.

Question 4

A network technician is troubleshooting an inter-VLAN routing issue on a multilayer switch. Hosts on VLAN 10 can reach the SVI for VLAN 10 (10.0.10.1) but cannot reach hosts on VLAN 20. The technician has verified that 'ip routing' is enabled and that the 'show ip route' command displays directly connected routes for both VLANs. No static routes are configured. What should the technician do next?

Accepted Answer

Check the ARP table for entries on VLAN 20.. The hosts on VLAN 10 can reach the SVI (10.0.10.1) but not hosts on VLAN 20, which indicates that Layer 3 routing is working (ip routing enabled, directly connected routes present). The issue is likely that the switch does not have the MAC address of the destination host in VLAN 20 in its ARP table, so it cannot forward frames to that host. Checking the ARP table for VLAN 20 entries will reveal whether the switch has resolved the Layer 3-to-Layer 2 address mapping for the destination.

Answer

Issue the 'show ip routing' command again to confirm routing is enabled.

Answer

Configure a default route pointing to the next-hop gateway.

Answer

Verify the VLAN membership of the destination host on VLAN 20.

Question 5

Refer to the exhibit. A network administrator is troubleshooting a trunk link between SW1 and SW2. The trunk on interface GigabitEthernet0/0 on SW1 is not passing traffic, and all VLANs are isolated. The administrator issues the command 'show interfaces GigabitEthernet0/0 trunk' on SW1. What is the most likely cause of the issue?

Accepted Answer

The trunk encapsulation is set to ISL on SW1, but the peer switch only supports 802.1Q.. The 'show interfaces trunk' output on SW1 would show the trunk as up but not passing traffic if the encapsulation is set to ISL while SW2 only supports 802.1Q. Cisco switches default to Dynamic Trunking Protocol (DTP) and may negotiate ISL on older hardware, but if the peer does not support ISL, the trunk fails to form correctly, isolating all VLANs. The mismatch in encapsulation prevents proper frame tagging, causing all VLAN traffic to be dropped.

Answer

The native VLAN is mismatched between SW1 and SW2.

Answer

The interface is configured as an access port instead of a trunk.

Answer

The interface is administratively shut down.

Question 6

Refer to the exhibit. An engineer expects all traffic destined to the 10.10.10.0 network to be forwarded via 10.1.1.2. However, when testing connectivity to host 10.10.10.64, traffic is being sent to 10.2.2.2 instead. What is the most likely cause?

Accepted Answer

The router is using longest prefix matching; the /26 route is more specific, so traffic to 10.10.10.64 is forwarded via 10.2.2.2.. B is correct because routers use longest prefix matching to forward traffic. The route to 10.10.10.64/26 is more specific (longer prefix length) than the route to 10.10.10.0/24, so even though the /24 route may have a lower administrative distance, the /26 route is preferred for traffic destined to 10.10.10.64. This is a fundamental IP routing principle that overrides administrative distance when both routes exist in the routing table.

Answer

The static route to 10.10.10.0/24 has a higher administrative distance than the /26 route, making the /26 preferred.

Answer

The /26 static route was configured as a floating static route with an administrative distance of 5, overriding the /24 route.

Answer

The next-hop 10.1.1.2 for the /24 route is unreachable, causing the router to fall back to the /26 route.

Question 7

A network engineer notices that an uplink port on a distribution switch has moved to a root-inconsistent state and is blocking traffic. The port is configured with Root Guard and is connected to a new access switch. The new access switch has a lower bridge priority than the current root bridge. What is the most likely cause?

Accepted Answer

Root Guard has placed the port into root-inconsistent state because the new switch advertised a superior BPDU.. Root Guard is configured on the uplink port of the distribution switch. When the new access switch advertises a superior BPDU (lower bridge priority than the current root bridge), Root Guard places the port into a root-inconsistent state to prevent the distribution switch from accepting the new switch as the root bridge. This blocks traffic on that port to protect the spanning-tree topology.

Answer

BPDU Guard has errdisabled the port because a BPDU was received on an access port.

Answer

BPDU Filter is blocking inbound BPDUs, causing the switch to fail to detect the topology change and isolate the port.

Answer

Loop Guard has detected a unidirectional link and placed the port in a blocking state to prevent a loop.

Question 8

A network administrator notices that file transfers to a server are extremely slow, and on the switch interface connecting to the server, the output of 'show interfaces' indicates a high number of runts and CRC errors, but no collisions. Which of the following is the most likely cause?

Accepted Answer

The switch port is configured for full-duplex, but the server's NIC is set to half-duplex.. The combination of runts (frames smaller than 64 bytes) and CRC errors with zero collisions is a classic symptom of a duplex mismatch. When one side operates at full-duplex and the other at half-duplex, the half-duplex side will detect collisions and invoke its backoff algorithm, causing the full-duplex side to receive truncated frames (runts) and frames with invalid FCS (CRC errors). The switch interface statistics show no collisions because the switch port is full-duplex and does not detect collisions, while the server's half-duplex NIC is causing the corruption.

Answer

The cable connecting the server to the switch is faulty.

Answer

The switch port speed is set to 100 Mbps, but the server NIC is set to 10 Mbps.

Answer

The server's NIC driver is outdated, causing packet loss.

Question 9

A network engineer notices that clients in the 192.168.10.0/24 subnet are receiving the IP address 192.168.10.1 from the DHCP server, causing a duplicate IP conflict with the router’s own interface. What is the most likely cause?

Accepted Answer

The DHCP pool does not exclude the router’s own interface IP address.. The most likely cause is that the DHCP pool configuration does not exclude the router's own interface IP address (192.168.10.1) from the range of addresses that the DHCP server can assign. By default, a Cisco router acting as a DHCP server will lease any address within the configured network statement unless an explicit ip dhcp excluded-address command is applied. Since the router's interface already uses 192.168.10.1, leasing that same address to a client creates a duplicate IP conflict.

Answer

The DHCP conflict logging feature is disabled on the router.

Answer

The DHCP lease time is set too low, causing frequent re-issuing of addresses.

Answer

The DHCP pool’s default-router address is misconfigured, so the client uses the router’s IP as its own.

Question 10

Refer to the exhibit. A network engineer is troubleshooting an OSPF adjacency issue between R1 and R2. The output of the show ip ospf neighbor command on R1 shows the neighbor relationship with R2 stuck in the EXSTART/DROTHER state. What is the most likely cause?

Accepted Answer

MTU mismatch on the link between R1 and R2, causing DBD packets to be dropped.. The EXSTART/DROTHER state indicates that the routers have progressed beyond the 2-WAY state but are stuck during the Database Description (DBD) packet exchange phase. An MTU mismatch between R1 and R2 causes DBD packets to be dropped because the receiving router will reject packets larger than its configured interface MTU, preventing the routers from completing the master/slave election and database synchronization.

Answer

OSPF network type mismatch between R1 and R2, preventing full adjacency.

Answer

Duplicate OSPF Router IDs on R1 and R2, causing DBD packet rejection.

Answer

OSPF authentication mismatch on the link, causing DBD packets to be rejected.

Question 11

A network engineer adds a loopback interface Lo0 with IP address 172.16.0.1/32 to router R1. After restarting the OSPF process, the OSPF router-ID changes from 10.1.1.1 to 172.16.0.1, and the neighbor relationship with R2 resets. What should the technician do next to prevent this disruption the next time a loopback is added?

Accepted Answer

Configure a static router-id using the router-id command under the OSPF process. The OSPF router-ID is dynamically selected based on the highest IP address of any loopback interface, or if none exist, the highest IP of any physical interface. Adding a new loopback with a higher IP than the current router-ID causes OSPF to reselect a new router-ID upon process restart, which resets all neighbor adjacencies. Configuring a static router-ID with the 'router-id' command under the OSPF process prevents this disruption by fixing the router-ID regardless of interface IP changes.

Answer

Configure passive-interface Lo0 under the OSPF process

Answer

Set a higher OSPF priority on the router’s interfaces

Answer

Configure the OSPF area as a stub area

Question 12

Refer to the exhibit. A network administrator is troubleshooting connectivity issues. Hosts on the 192.168.10.0/24 network cannot reach servers on the 192.168.20.0/24 network, but they can successfully reach other networks, including the Internet. The administrator runs the show ip access-lists command on the router (output shown). What is the most likely cause?

Accepted Answer

The order of the ACL entries causes the deny statement to match first.. The ACL is processed top-down, and the first matching entry determines the action. In this scenario, the deny statement for 192.168.10.0/24 to 192.168.20.0/24 appears before any permit statement for that traffic, so packets from the 192.168.10.0/24 network to the 192.168.20.0/24 network are denied immediately, even if a later permit statement would have allowed them. This explains why hosts can reach other networks (including the Internet) but not the 192.168.20.0/24 servers.

Answer

The ACL is applied in the wrong direction on the interface.

Answer

The ACL is missing a permit statement for the 192.168.20.0/24 destination.

Answer

The implicit deny at the end is blocking the traffic to 192.168.20.0/24.

Question 13

Refer to the exhibit. A network administrator configures NAT overload on R1 to allow internal hosts in the 10.1.1.0/24 subnet to access the Internet. After the configuration, the administrator runs the show ip nat translations verbose command and notices that several internal sessions all appear to use the same inside global port 1024. The administrator is concerned that port conflicts will occur. Based on the output, which statement is correct?

Accepted Answer

The translations are extended entries, so the combination of inside global IP, outside global IP, and port ensures each session is unique, even though the inside global port is the same.. NAT overload (PAT) creates extended entries that uniquely identify each session by the combination of inside global IP, outside global IP, and port. Even though multiple sessions share the same inside global port 1024, the different outside global IP addresses and ports ensure that each translation entry is unique, preventing port conflicts.

Answer

The NAT configuration is missing the overload keyword, causing all internal hosts to share a single source port.

Answer

The static NAT entry mapping 203.0.113.5 to the entire 10.1.1.0/24 subnet forces all subordinate translations to use the same port 1024.

Answer

The dynamic NAT pool is exhausted, forcing the router to reuse port 1024 for all new sessions.

Question 14

A technician is troubleshooting a network-wide broadcast storm that has caused severe performance issues. The technician notices that BPDU guard is globally enabled on the access layer switch, but no ports are in an err-disabled state. All access ports have PortFast enabled. What is the most likely cause?

Accepted Answer

BPDU filter is globally enabled, causing the switch to suppress BPDUs on PortFast ports and preventing BPDU guard from triggering.. BPDU guard places a port in err-disabled state upon receiving a BPDU, but BPDU filter globally enabled on PortFast ports suppresses both sending and receiving BPDUs. Since BPDU filter prevents BPDUs from being received, BPDU guard never triggers, allowing a rogue switch to participate in spanning tree and potentially cause a broadcast storm.

Answer

Spanning tree is disabled globally, allowing the rogue switch to create a loop.

Answer

BPDU guard is misconfigured on the wrong ports, so it failed to block the rogue switch.

Answer

Root guard is incorrectly enabled on the access ports, causing the rogue switch to become the root bridge.

Question 15

An engineer wants rapid transition to forwarding on end-user switchports while still protecting the topology from accidental switch connections. Which two STP-related features fit that design?

Accepted Answer

PortFast on user-facing access ports. PortFast improves the user experience on edge ports, and BPDU Guard keeps those ports from becoming unintended switch uplinks.

Answer

Root Guard on every user-facing port instead of PortFast

Answer

Loop Guard on hosts to accelerate DHCP

Question 16

A switch port was configured for sticky MAC learning. Which two statements accurately describe how the feature behaves?

Accepted Answer

The switch can dynamically learn MAC addresses and add them to the running configuration as secure MAC addresses.. Sticky MAC learning is Cisco’s way of letting a port learn device MAC addresses automatically, while still treating them as secure addresses under port security. In everyday language, it saves the administrator from typing each allowed MAC address by hand. As devices connect, the switch can learn their MAC addresses and place them into the running configuration as sticky secure MACs. If the administrator later saves the configuration, those learned entries can also be written into startup-config and survive a reboot. The feature does not replace port security; it works as part of port security. It also does not change the port into a trunk or disable the maximum address count. So the two correct ideas are dynamic secure learning and the ability to preserve those learned MACs by saving the configuration.

Answer

Sticky learning removes the need to enable port security on the interface.

Answer

Sticky learning automatically converts the interface into a trunk port.

Answer

Sticky learning prevents the maximum secure MAC limit from being enforced.

Question 17

Refer to the exhibit. An administrator notices that all interfaces on R1 are in an administratively down state. The administrator issues the show version command and sees the following output. What is the most likely cause of the issue?

Accepted Answer

The configuration register is set to 0x2142, causing the router to ignore the startup configuration.. The configuration register value 0x2142 tells the router to ignore the startup configuration during boot, loading only the default factory configuration. This causes all interfaces to be in an administratively down state because no interface configurations from the startup-config are applied. The administrator sees the interfaces as administratively down because the default configuration does not include any 'no shutdown' commands.

Answer

The router IOS image is corrupted and needs to be reinstalled.

Answer

The interfaces have been manually shut down in the running configuration, and the startup-config file is empty.

Answer

The router experienced a memory error during boot and failed to load the startup configuration.

Question 18

Drag and drop the following steps into the correct order to enable a third-party SFP transceiver and verify its diagnostics on a Cisco switch.

Accepted Answer

Enter global configuration mode: configure terminal. Cisco switches by default only support Cisco-branded SFP transceivers. To use a third-party transceiver, the command `service unsupported-transceiver` must be enabled in global configuration mode. After configuring the interface, the `show interfaces transceiver` command displays diagnostic information including temperature, voltage, and optical power, which helps verify proper operation.

Question 19

Refer to the exhibit. A network engineer is troubleshooting an issue where syslog messages at severity 6 (informational) and severity 7 (debugging) are not being sent to the syslog server at 192.168.100.50, even though the device appears to generate these messages locally. Based on the exhibit, what is the most likely cause?

Accepted Answer

The trap logging level is set to errors (severity 3), filtering out informational and debug messages.. The exhibit shows that the logging trap level is configured to 'errors' (severity 3). This means only syslog messages with a severity of 0 (emergencies) through 3 (errors) are sent to the syslog server. Informational (severity 6) and debugging (severity 7) messages are filtered out because they are below the configured trap threshold. This directly explains why those messages are not reaching the server, even though they are generated locally.

Answer

The logging buffer is full, preventing new informational and debug messages from being sent to the syslog server.

Answer

The syslog server IP address 192.168.100.50 is unreachable from the router.

Answer

Console logging is disabled, so only severity 3 and lower messages appear.

Question 20

Users in 10.20.30.0/24 should be allowed to browse the web but should not be able to open Telnet sessions to any remote device. Which access list entry best meets the requirement?

Accepted Answer

deny tcp 10.20.30.0 0.0.0.255 any eq 23. Option A is correct because Telnet uses TCP port 23, and the entry `deny tcp 10.20.30.0 0.0.0.255 any eq 23` blocks outbound Telnet from the 10.20.30.0/24 subnet to any remote destination while leaving other traffic (such as web browsing) unaffected. The wildcard mask 0.0.0.255 correctly matches the /24 source subnet, and placing the source before `any` reflects traffic originating from those users. Option B is wrong because Telnet is TCP-based, not UDP, so denying UDP port 23 would not stop Telnet sessions. Option C reverses the source and destination, blocking Telnet destined to the users rather than originated by them. Option D is a permit for TCP port 80 (HTTP) and does not deny Telnet at all.

Answer

deny udp 10.20.30.0 0.0.0.255 any eq 23

Answer

deny tcp any 10.20.30.0 0.0.0.255 eq 23

Answer

permit tcp 10.20.30.0 0.0.0.255 any eq 80