CCNA Practice Exam 54 — 20 Questions

Question 1

A technician is troubleshooting a network-wide broadcast storm that has caused severe performance issues. The technician notices that BPDU guard is globally enabled on the access layer switch, but no ports are in an err-disabled state. All access ports have PortFast enabled. What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

BPDU filter is globally enabled, causing the switch to suppress BPDUs on PortFast ports and preventing BPDU guard from triggering.. BPDU guard places a port in err-disabled state upon receiving a BPDU, but BPDU filter globally enabled on PortFast ports suppresses both sending and receiving BPDUs. Since BPDU filter prevents BPDUs from being received, BPDU guard never triggers, allowing a rogue switch to participate in spanning tree and potentially cause a broadcast storm.

Answer

Spanning tree is disabled globally, allowing the rogue switch to create a loop.

Answer

BPDU guard is misconfigured on the wrong ports, so it failed to block the rogue switch.

Answer

Root guard is incorrectly enabled on the access ports, causing the rogue switch to become the root bridge.

Question 2

An engineer wants rapid transition to forwarding on end-user switchports while still protecting the topology from accidental switch connections. Which two STP-related features fit that design?

Accepted Answer

PortFast on user-facing access ports. PortFast improves the user experience on edge ports, and BPDU Guard keeps those ports from becoming unintended switch uplinks.

Answer

Root Guard on every user-facing port instead of PortFast

Answer

Loop Guard on hosts to accelerate DHCP

Question 3

A switch port was configured for sticky MAC learning. Which two statements accurately describe how the feature behaves?

Accepted Answer

The switch can dynamically learn MAC addresses and add them to the running configuration as secure MAC addresses.. Sticky MAC learning is Cisco’s way of letting a port learn device MAC addresses automatically, while still treating them as secure addresses under port security. In everyday language, it saves the administrator from typing each allowed MAC address by hand. As devices connect, the switch can learn their MAC addresses and place them into the running configuration as sticky secure MACs. If the administrator later saves the configuration, those learned entries can also be written into startup-config and survive a reboot. The feature does not replace port security; it works as part of port security. It also does not change the port into a trunk or disable the maximum address count. So the two correct ideas are dynamic secure learning and the ability to preserve those learned MACs by saving the configuration.

Answer

Sticky learning removes the need to enable port security on the interface.

Answer

Sticky learning automatically converts the interface into a trunk port.

Answer

Sticky learning prevents the maximum secure MAC limit from being enforced.

Question 4

Refer to the exhibit. An administrator notices that all interfaces on R1 are in an administratively down state. The administrator issues the show version command and sees the following output. What is the most likely cause of the issue?

Accepted Answer

The configuration register is set to 0x2142, causing the router to ignore the startup configuration.. The configuration register value 0x2142 tells the router to ignore the startup configuration during boot, loading only the default factory configuration. This causes all interfaces to be in an administratively down state because no interface configurations from the startup-config are applied. The administrator sees the interfaces as administratively down because the default configuration does not include any 'no shutdown' commands.

Answer

The router IOS image is corrupted and needs to be reinstalled.

Answer

The interfaces have been manually shut down in the running configuration, and the startup-config file is empty.

Answer

The router experienced a memory error during boot and failed to load the startup configuration.

Question 5

Drag and drop the following steps into the correct order to enable a third-party SFP transceiver and verify its diagnostics on a Cisco switch.

Accepted Answer

Enter global configuration mode: configure terminal. Cisco switches by default only support Cisco-branded SFP transceivers. To use a third-party transceiver, the command `service unsupported-transceiver` must be enabled in global configuration mode. After configuring the interface, the `show interfaces transceiver` command displays diagnostic information including temperature, voltage, and optical power, which helps verify proper operation.

Question 6

Refer to the exhibit. A network engineer is troubleshooting an issue where syslog messages at severity 6 (informational) and severity 7 (debugging) are not being sent to the syslog server at 192.168.100.50, even though the device appears to generate these messages locally. Based on the exhibit, what is the most likely cause?

Accepted Answer

The trap logging level is set to errors (severity 3), filtering out informational and debug messages.. The exhibit shows that the logging trap level is configured to 'errors' (severity 3). This means only syslog messages with a severity of 0 (emergencies) through 3 (errors) are sent to the syslog server. Informational (severity 6) and debugging (severity 7) messages are filtered out because they are below the configured trap threshold. This directly explains why those messages are not reaching the server, even though they are generated locally.

Answer

The logging buffer is full, preventing new informational and debug messages from being sent to the syslog server.

Answer

The syslog server IP address 192.168.100.50 is unreachable from the router.

Answer

Console logging is disabled, so only severity 3 and lower messages appear.

Question 7

Clients in VLAN 30 are not receiving addresses from the DHCP server located in VLAN 99. Which configuration change should be made on the Layer 3 interface for VLAN 30?

Accepted Answer

Add ip helper-address 10.99.99.20 under interface Vlan30.. The DHCP server is on a different subnet, so the client broadcast messages from VLAN 30 will not naturally cross the Layer 3 boundary. In simple terms, the clients are asking for an address by shouting on their own floor of the building, but the server lives on another floor and cannot hear that broadcast directly. The router or Layer 3 switch must relay the request for them. On Cisco devices, that relay function is usually configured with `ip helper-address` on the interface that receives the client broadcasts.

Here, that receiving interface is Vlan30, because that is the default gateway for the clients in VLAN 30. Pointing `ip helper-address` to 10.99.99.20 tells the Layer 3 device to forward DHCP requests to the remote server. DHCP snooping trust is a separate security feature, trunk mode is unrelated to an SVI, and `ip default-gateway` is not the correct solution for relaying DHCP across subnets.

Answer

Add ip dhcp snooping trust under interface Vlan30.

Answer

Add switchport mode trunk under interface Vlan30.

Answer

Add ip default-gateway 10.99.99.20 under interface Vlan30.

Question 8

A switch unexpectedly blocks a link toward the distribution layer. Gi1/0/24 shows a path cost of 4 while Gi1/0/23 shows a path cost of 19. Why did interface Gi1/0/24 become the root port instead of Gi1/0/23?

Accepted Answer

has a lower root path cost to the root bridge. Spanning Tree chooses a root port by looking for the best path toward the root bridge. In this case, Gi1/0/24 shows a cost of 4, while Gi1/0/23 shows a cost of 19. Lower cost is better, so Gi1/0/24 is selected as the root port and moves into forwarding. Gi1/0/23 becomes an alternate port and is placed into a blocking state to prevent a loop. STP compares root path cost first; only if the cost is tied does it move on to tie-breakers like sender bridge ID and port ID. The lower cost on Gi1/0/24 explains why that port won the root-port election.

Answer

Gi1/0/24 has a lower port number, so STP always prefers it first.

Answer

STP prefers interfaces with the highest path cost to reduce loops.

Answer

Gi1/0/23 is blocked because alternate ports are always chosen over root ports.

Question 9

A network administrator is configuring a new Windows 10 workstation on a network that uses DHCP. The workstation receives an IPv4 address of 169.254.10.20 with a subnet mask of 255.255.0.0 and no default gateway. The user cannot access the internet or other subnets. What is the most likely cause of this issue?

Accepted Answer

The DHCP server is unreachable or not responding.. The IP address 169.254.10.20 with a /16 subnet mask is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP discovery broadcast (DHCPDISCOVER) fails to receive a response from a DHCP server. Without a valid DHCP lease, the workstation has no default gateway, so it cannot communicate outside its local subnet, explaining the lack of internet or inter-subnet access. The most likely cause is that the DHCP server is unreachable or not responding, forcing the client to self-assign an APIPA address.

Answer

The workstation has a duplicate IP address conflict.

Answer

The workstation's DNS server configuration is incorrect.

Answer

The workstation's subnet mask is misconfigured.

Question 10

Match each programmability term to its most accurate description.

Accepted Answer

API: A set of protocols and tools for building software applications, specifying how components should interact.. Each term is correctly matched with its standard definition in software development and API contexts.

Answer

API: A programming language used to write automation scripts for network devices.

Answer

API: A hardware component that connects network devices to the internet.

Answer

API: A security protocol that encrypts data transmitted over a network.

Question 11

Match each NAT term to its most accurate description.

Accepted Answer

Inside Local: The IP address of an internal host as seen from inside the network.. NAT terms describe address perspectives: Inside Local is the internal host's IP, Inside Global is its external IP, Outside Local is the external host's IP seen internally, Outside Global is its actual external IP, Static NAT provides permanent mapping, and Dynamic NAT uses a pool.

Answer

Inside Local: The IP address of an external host as seen from inside the network.

Answer

Inside Local: The IP address of an internal host as seen from outside the network.

Answer

Inside Local: The IP address of an external host as seen from outside the network.

Question 12

Which TWO statements correctly describe the behavior of Rapid PVST+ in a Layer 2 network?

Accepted Answer

Rapid PVST+ runs a separate instance of RSTP for each VLAN.. Rapid PVST+ runs a separate instance of RSTP (802.1w) for each VLAN, enabling per-VLAN rapid convergence and load balancing. Option D is correct because PortFast allows access ports to transition to forwarding immediately, while BPDU Guard prevents loops by disabling a port that receives a BPDU. Option B is incorrect because Rapid PVST+ uses RSTP's handshake mechanism, not timer-based convergence like 802.1D. Option C is wrong: Rapid PVST+ is based on 802.1w, not 802.1D. Option E is false because Rapid PVST+ does not use 802.1Q to reduce instances; it maintains a separate spanning-tree instance per VLAN.

Answer

Rapid PVST+ is an enhancement of PVST+ and uses the same timer-based convergence as standard 802.1D.

Answer

Rapid PVST+ uses the 802.1D standard to compute the spanning tree for each VLAN.

Answer

Rapid PVST+ uses the 802.1Q trunking protocol to reduce the number of spanning-tree instances.

Question 13

A network technician is troubleshooting a link between two Cisco switches, SW1 and SW2, connected via a single-mode fiber optic cable. The interface on SW1 is up/up, but the interface on SW2 remains down/down. The technician has verified that the fiber cable is not damaged and that the SFP modules are correctly seated. Which configuration change should the technician make to resolve the issue?

Accepted Answer

Replace the 1000BaseSX SFP on SW2 with a 1000BaseLX SFP.. The issue is that SW1 is up/up but SW2 is down/down, indicating a unidirectional link. Since the fiber cable and SFP seating are verified, the most likely cause is an SFP wavelength mismatch. SW1 likely has a 1000BaseLX SFP (long-wavelength, single-mode), while SW2 has a 1000BaseSX SFP (short-wavelength, multimode). Single-mode fiber requires LX optics; SX optics are designed for multimode fiber and will not produce a signal that can be received correctly over single-mode fiber, causing the remote interface to remain down. Replacing the 1000BaseSX SFP on SW2 with a 1000BaseLX SFP resolves the wavelength incompatibility.

Answer

Configure the interface on SW2 to use the same speed and duplex settings as SW1.

Answer

Enable MDIX on both interfaces to allow automatic crossover detection.

Answer

Change the VLAN assignment on SW2's interface to match that of SW1.

Question 14

A network technician connects a new Cisco switch to an existing access switch using a Category 5e copper patch cable. The link fails to come up, and the interface status shows 'err-disabled'. The technician checks the interface diagnostics and the running configuration. What action should the technician take to resolve the problem?

Accepted Answer

Configure the interface as a trunk port and disable spanning-tree BPDU guard.. The most likely reason for the err-disabled state is a spanning-tree BPDU guard violation on the access switch's port configured with PortFast. When another switch is connected, it sends BPDUs, triggering BPDU guard to error-disable the port. Configuring the interface as a trunk port and disabling BPDU guard (option B) resolves the issue by allowing BPDUs without triggering the protection. Option A is unnecessary because Category 5e supports Gigabit Ethernet. Option C is irrelevant since the problem is not distance-related. Option D is risky because auto-negotiation is preferred and manual settings can cause mismatches.

Answer

Replace the Category 5e cable with a Category 6 cable to support Gigabit Ethernet.

Answer

Replace the copper SFP with a fiber SFP to increase the distance.

Answer

Manually set the speed and duplex to 1000 Mbps and full duplex on both switches.

Question 15

An administrator connects a new access-layer switch to a distribution switch. The link comes up but remains in a blocking state and does not forward frames. The administrator issues the show command shown in the exhibit. What is the most likely reason the link is blocked?

Accepted Answer

Root Guard is configured on the port, and the new access switch is sending superior BPDUs, triggering a root-inconsistent state.. The link is blocked because Root Guard is configured on the distribution switch port. When the new access-layer switch sends superior BPDUs (with a lower bridge priority), Root Guard transitions the port to a root-inconsistent (blocking) state to protect the current root bridge from being usurped. This prevents the new switch from becoming the root bridge, which would disrupt the spanning-tree topology.

Answer

BPDU Guard is enabled on the port, and the new switch's BPDUs caused the port to enter err-disable state.

Answer

Loop Guard is enabled, and the port has stopped receiving BPDUs, leading to a loop-inconsistent state.

Answer

The port is configured with PortFast, and the new switch's BPDU triggered a loop, causing the port to err-disable.

Question 16

A network administrator implements a set of spanning-tree enhancements to secure the switching infrastructure. Later, a help desk ticket reports that a user in a remote office cannot connect to any network resources. While investigating, the administrator notices that the switch port connecting the remote office switch to the distribution switch is in a 'root-inconsistent' state and is blocking traffic. Which protection feature, if misapplied, most likely caused this issue?

Accepted Answer

Root Guard. Root Guard is the correct answer because it forces an interface to be a designated port. If a switch receives a superior BPDU (indicating a root bridge with a lower bridge ID) on a Root Guard-enabled port, the port is placed into a 'root-inconsistent' state and blocks traffic to prevent the attached switch from becoming the root bridge. This matches the symptom described: a port in 'root-inconsistent' state blocking traffic after spanning-tree enhancements were applied.

Answer

Loop Guard

Answer

BPDU Guard

Answer

BPDU Filter

Question 17

After securing a switch by running 'ip ssh version 2' and generating RSA keys with 'crypto key generate rsa modulus 1024', remote SSH connections fail with a 'key exchange error'. A check of the SSH client’s documentation reveals it requires a minimum 2048-bit RSA key for SSH version 2. What should the technician do next?

Accepted Answer

Regenerate the RSA key pair on the switch with a 2048-bit modulus using the command 'crypto key generate rsa modulus 2048'.. The error is caused by the SSH client requiring a minimum 2048-bit RSA key for SSH version 2, but the switch was configured with a 1024-bit key. The correct solution is to regenerate the RSA key pair with a 2048-bit modulus using 'crypto key generate rsa modulus 2048', which satisfies the client's security requirement and allows SSH version 2 to establish a secure connection.

Answer

Verify IP connectivity between the client and the switch by issuing a ping from the client to the switch.

Answer

Check the SSH client configuration on the host to ensure it accepts 1024-bit keys.

Answer

Disable SSH version 2 on the switch and revert to SSH version 1, which does not enforce key length restrictions.

Question 18

A router learns 172.16.0.0/16 from OSPF and 172.16.10.0/24 from a static route. Which route is used for traffic to 172.16.10.55?

Accepted Answer

The static /24 route. The static /24 route is used because it is more specific than the OSPF /16 route. In plain language, even though OSPF is a dynamic source and the /16 covers the destination broadly, the router prefers the entry that describes the exact destination range more precisely. Since 172.16.10.55 falls within 172.16.10.0/24, that route wins under longest-prefix match.

This is a classic example of route specificity taking priority before broader route-source comparisons would matter between equal prefix lengths.

Answer

The OSPF /16 route

Answer

The default route

Answer

Neither route because the prefixes overlap

Question 19

Refer to the exhibit. A network administrator is troubleshooting connectivity issues for hosts on VLAN 50 on SW1. The hosts on VLAN 50 cannot reach any devices outside SW1, even though the trunk link between SW1 and SW2 is up. The administrator issues the 'show interfaces GigabitEthernet0/1 trunk' command on SW1. Based on the output, what is the most likely cause of the issue?

Accepted Answer

VLAN 50 is not in the allowed VLAN list on the trunk.. The 'show interfaces GigabitEthernet0/1 trunk' output would list the allowed VLANs on the trunk. If VLAN 50 is not included in the allowed VLAN list, traffic from VLAN 50 will be dropped at the trunk, preventing hosts on SW1 from reaching devices outside SW1. This is the most likely cause because the trunk is up but VLAN 50 traffic is not forwarded.

Answer

The native VLAN on the trunk is misconfigured, causing VLAN 50 traffic to be dropped.

Answer

The trunk is operating in access mode instead of trunk mode, preventing VLAN 50 traffic.

Answer

Spanning tree protocol has blocked the trunk port for VLAN 50, isolating the hosts.

Question 20

A host is configured as 10.10.20.190/26. Which range contains usable host addresses for that subnet?

Accepted Answer

10.10.20.129 to 10.10.20.190. A /26 uses blocks of 64 addresses. In plain language, the ranges are 0–63, 64–127, 128–191, and 192–255. Since the host ends in 190, it belongs to the 128–191 block. In that block, 10.10.20.128 is the network address and 10.10.20.191 is the broadcast address. That leaves 10.10.20.129 through 10.10.20.190 as the usable host range.

This question checks whether you can identify the correct block and then exclude the reserved endpoints properly.

Answer

10.10.20.128 to 10.10.20.191

Answer

10.10.20.130 to 10.10.20.191

Answer

10.10.20.193 to 10.10.20.254