CCNA Practice Exam 54 — 20 Questions

Question 1

A user reports they cannot access any network resources. A network administrator runs ipconfig on the user's Windows PC and sees an IPv4 address of 169.254.45.3/16. The administrator then pings the default gateway 10.0.0.1, which fails, and uses traceroute to 10.0.0.1, which shows only '1 * * * Request timed out.' What is the most likely cause of the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The DHCP server is unreachable.. The 169.254.45.3/16 address is an Automatic Private IP Addressing (APIPA) address, assigned by Windows when a DHCP discovery fails. The failed ping and traceroute to the default gateway confirm that the PC has no IP connectivity to the network. Since the PC has an APIPA address, it was unable to reach a DHCP server to obtain a valid IPv4 address; the most likely cause is that the DHCP server is unreachable. The presence of an APIPA address also indicates the PC's NIC has a working physical and data-link connection, ruling out a disconnected cable or disabled switch port.

Answer

The PC's DNS server address is incorrect.

Answer

The switch port is in an administratively down state.

Answer

The Ethernet cable is unplugged from the PC.

Question 2

Clients in VLAN 30 are not receiving addresses from the DHCP server located in VLAN 99. Which configuration change should be made on the Layer 3 interface for VLAN 30?

Accepted Answer

Add ip helper-address 10.99.99.20 under interface Vlan30.. The DHCP server is on a different subnet, so the client broadcast messages from VLAN 30 will not naturally cross the Layer 3 boundary. In simple terms, the clients are asking for an address by shouting on their own floor of the building, but the server lives on another floor and cannot hear that broadcast directly. The router or Layer 3 switch must relay the request for them. On Cisco devices, that relay function is usually configured with `ip helper-address` on the interface that receives the client broadcasts.

Here, that receiving interface is Vlan30, because that is the default gateway for the clients in VLAN 30. Pointing `ip helper-address` to 10.99.99.20 tells the Layer 3 device to forward DHCP requests to the remote server. DHCP snooping trust is a separate security feature, trunk mode is unrelated to an SVI, and `ip default-gateway` is not the correct solution for relaying DHCP across subnets.

Answer

Add ip dhcp snooping trust under interface Vlan30.

Answer

Add switchport mode trunk under interface Vlan30.

Answer

Add ip default-gateway 10.99.99.20 under interface Vlan30.

Question 3

A switch unexpectedly blocks a link toward the distribution layer. Gi1/0/24 shows a path cost of 4 while Gi1/0/23 shows a path cost of 19. Why did interface Gi1/0/24 become the root port instead of Gi1/0/23?

Accepted Answer

has a lower root path cost to the root bridge. Spanning Tree chooses a root port by looking for the best path toward the root bridge. In this case, Gi1/0/24 shows a cost of 4, while Gi1/0/23 shows a cost of 19. Lower cost is better, so Gi1/0/24 is selected as the root port and moves into forwarding. Gi1/0/23 becomes an alternate port and is placed into a blocking state to prevent a loop. STP compares root path cost first; only if the cost is tied does it move on to tie-breakers like sender bridge ID and port ID. The lower cost on Gi1/0/24 explains why that port won the root-port election.

Answer

Gi1/0/24 has a lower port number, so STP always prefers it first.

Answer

STP prefers interfaces with the highest path cost to reduce loops.

Answer

Gi1/0/23 is blocked because alternate ports are always chosen over root ports.

Question 4

A network administrator is configuring a new Windows 10 workstation on a network that uses DHCP. The workstation receives an IPv4 address of 169.254.10.20 with a subnet mask of 255.255.0.0 and no default gateway. The user cannot access the internet or other subnets. What is the most likely cause of this issue?

Accepted Answer

The DHCP server is unreachable or not responding.. The IP address 169.254.10.20 with a /16 subnet mask is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP discovery broadcast (DHCPDISCOVER) fails to receive a response from a DHCP server. Without a valid DHCP lease, the workstation has no default gateway, so it cannot communicate outside its local subnet, explaining the lack of internet or inter-subnet access. The most likely cause is that the DHCP server is unreachable or not responding, forcing the client to self-assign an APIPA address.

Answer

The workstation has a duplicate IP address conflict.

Answer

The workstation's DNS server configuration is incorrect.

Answer

The workstation's subnet mask is misconfigured.

Question 5

Match each programmability term to its most accurate description.

Accepted Answer

API: A set of protocols and tools for building software applications, specifying how components should interact.. Each term is correctly matched with its standard definition in software development and API contexts.

Answer

API: A programming language used to write automation scripts for network devices.

Answer

API: A hardware component that connects network devices to the internet.

Answer

API: A security protocol that encrypts data transmitted over a network.

Question 6

Match each NAT term to its most accurate description.

Accepted Answer

Inside Local: The IP address of an internal host as seen from inside the network.. NAT terms describe address perspectives: Inside Local is the internal host's IP, Inside Global is its external IP, Outside Local is the external host's IP seen internally, Outside Global is its actual external IP, Static NAT provides permanent mapping, and Dynamic NAT uses a pool.

Answer

Inside Local: The IP address of an external host as seen from inside the network.

Answer

Inside Local: The IP address of an internal host as seen from outside the network.

Answer

Inside Local: The IP address of an external host as seen from outside the network.

Question 7

Which TWO statements correctly describe the behavior of Rapid PVST+ in a Layer 2 network?

Accepted Answer

Rapid PVST+ runs a separate instance of RSTP for each VLAN.. Rapid PVST+ runs a separate instance of RSTP (802.1w) for each VLAN, enabling per-VLAN rapid convergence and load balancing. Option D is correct because PortFast allows access ports to transition to forwarding immediately, while BPDU Guard prevents loops by disabling a port that receives a BPDU. Option B is incorrect because Rapid PVST+ uses RSTP's handshake mechanism, not timer-based convergence like 802.1D. Option C is wrong: Rapid PVST+ is based on 802.1w, not 802.1D. Option E is false because Rapid PVST+ does not use 802.1Q to reduce instances; it maintains a separate spanning-tree instance per VLAN.

Answer

Rapid PVST+ is an enhancement of PVST+ and uses the same timer-based convergence as standard 802.1D.

Answer

Rapid PVST+ uses the 802.1D standard to compute the spanning tree for each VLAN.

Answer

Rapid PVST+ uses the 802.1Q trunking protocol to reduce the number of spanning-tree instances.

Question 8

A network technician is troubleshooting a link between two Cisco switches, SW1 and SW2, connected via a single-mode fiber optic cable. The interface on SW1 is up/up, but the interface on SW2 remains down/down. The technician has verified that the fiber cable is not damaged and that the SFP modules are correctly seated. Which configuration change should the technician make to resolve the issue?

Accepted Answer

Replace the 1000BaseSX SFP on SW2 with a 1000BaseLX SFP.. The issue is that SW1 is up/up but SW2 is down/down, indicating a unidirectional link. Since the fiber cable and SFP seating are verified, the most likely cause is an SFP wavelength mismatch. SW1 likely has a 1000BaseLX SFP (long-wavelength, single-mode), while SW2 has a 1000BaseSX SFP (short-wavelength, multimode). Single-mode fiber requires LX optics; SX optics are designed for multimode fiber and will not produce a signal that can be received correctly over single-mode fiber, causing the remote interface to remain down. Replacing the 1000BaseSX SFP on SW2 with a 1000BaseLX SFP resolves the wavelength incompatibility.

Answer

Configure the interface on SW2 to use the same speed and duplex settings as SW1.

Answer

Enable MDIX on both interfaces to allow automatic crossover detection.

Answer

Change the VLAN assignment on SW2's interface to match that of SW1.

Question 9

A network technician connects a new Cisco switch to an existing access switch using a Category 5e copper patch cable. The link fails to come up, and the interface status shows 'err-disabled'. The technician checks the interface diagnostics and the running configuration. What action should the technician take to resolve the problem?

Accepted Answer

Configure the interface as a trunk port and disable spanning-tree BPDU guard.. The most likely reason for the err-disabled state is a spanning-tree BPDU guard violation on the access switch's port configured with PortFast. When another switch is connected, it sends BPDUs, triggering BPDU guard to error-disable the port. Configuring the interface as a trunk port and disabling BPDU guard (option B) resolves the issue by allowing BPDUs without triggering the protection. Option A is unnecessary because Category 5e supports Gigabit Ethernet. Option C is irrelevant since the problem is not distance-related. Option D is risky because auto-negotiation is preferred and manual settings can cause mismatches.

Answer

Replace the Category 5e cable with a Category 6 cable to support Gigabit Ethernet.

Answer

Replace the copper SFP with a fiber SFP to increase the distance.

Answer

Manually set the speed and duplex to 1000 Mbps and full duplex on both switches.

Question 10

An administrator connects a new access-layer switch to a distribution switch. The link comes up but remains in a blocking state and does not forward frames. The administrator issues the show command shown in the exhibit. What is the most likely reason the link is blocked?

Accepted Answer

Root Guard is configured on the port, and the new access switch is sending superior BPDUs, triggering a root-inconsistent state.. The link is blocked because Root Guard is configured on the distribution switch port. When the new access-layer switch sends superior BPDUs (with a lower bridge priority), Root Guard transitions the port to a root-inconsistent (blocking) state to protect the current root bridge from being usurped. This prevents the new switch from becoming the root bridge, which would disrupt the spanning-tree topology.

Answer

BPDU Guard is enabled on the port, and the new switch's BPDUs caused the port to enter err-disable state.

Answer

Loop Guard is enabled, and the port has stopped receiving BPDUs, leading to a loop-inconsistent state.

Answer

The port is configured with PortFast, and the new switch's BPDU triggered a loop, causing the port to err-disable.

Question 11

A network administrator implements a set of spanning-tree enhancements to secure the switching infrastructure. Later, a help desk ticket reports that a user in a remote office cannot connect to any network resources. While investigating, the administrator notices that the switch port connecting the remote office switch to the distribution switch is in a 'root-inconsistent' state and is blocking traffic. Which protection feature, if misapplied, most likely caused this issue?

Accepted Answer

Root Guard. Root Guard is the correct answer because it forces an interface to be a designated port. If a switch receives a superior BPDU (indicating a root bridge with a lower bridge ID) on a Root Guard-enabled port, the port is placed into a 'root-inconsistent' state and blocks traffic to prevent the attached switch from becoming the root bridge. This matches the symptom described: a port in 'root-inconsistent' state blocking traffic after spanning-tree enhancements were applied.

Answer

Loop Guard

Answer

BPDU Guard

Answer

BPDU Filter

Question 12

After securing a switch by running 'ip ssh version 2' and generating RSA keys with 'crypto key generate rsa modulus 1024', remote SSH connections fail with a 'key exchange error'. A check of the SSH client’s documentation reveals it requires a minimum 2048-bit RSA key for SSH version 2. What should the technician do next?

Accepted Answer

Regenerate the RSA key pair on the switch with a 2048-bit modulus using the command 'crypto key generate rsa modulus 2048'.. The error is caused by the SSH client requiring a minimum 2048-bit RSA key for SSH version 2, but the switch was configured with a 1024-bit key. The correct solution is to regenerate the RSA key pair with a 2048-bit modulus using 'crypto key generate rsa modulus 2048', which satisfies the client's security requirement and allows SSH version 2 to establish a secure connection.

Answer

Verify IP connectivity between the client and the switch by issuing a ping from the client to the switch.

Answer

Check the SSH client configuration on the host to ensure it accepts 1024-bit keys.

Answer

Disable SSH version 2 on the switch and revert to SSH version 1, which does not enforce key length restrictions.

Question 13

A router learns 172.16.0.0/16 from OSPF and 172.16.10.0/24 from a static route. Which route is used for traffic to 172.16.10.55?

Accepted Answer

The static /24 route. The static /24 route is used because it is more specific than the OSPF /16 route. In plain language, even though OSPF is a dynamic source and the /16 covers the destination broadly, the router prefers the entry that describes the exact destination range more precisely. Since 172.16.10.55 falls within 172.16.10.0/24, that route wins under longest-prefix match.

This is a classic example of route specificity taking priority before broader route-source comparisons would matter between equal prefix lengths.

Answer

The OSPF /16 route

Answer

The default route

Answer

Neither route because the prefixes overlap

Question 14

Refer to the exhibit. A network administrator is troubleshooting connectivity issues for hosts on VLAN 50 on SW1. The hosts on VLAN 50 cannot reach any devices outside SW1, even though the trunk link between SW1 and SW2 is up. The administrator issues the 'show interfaces GigabitEthernet0/1 trunk' command on SW1. Based on the output, what is the most likely cause of the issue?

Accepted Answer

VLAN 50 is not in the allowed VLAN list on the trunk.. The 'show interfaces GigabitEthernet0/1 trunk' output would list the allowed VLANs on the trunk. If VLAN 50 is not included in the allowed VLAN list, traffic from VLAN 50 will be dropped at the trunk, preventing hosts on SW1 from reaching devices outside SW1. This is the most likely cause because the trunk is up but VLAN 50 traffic is not forwarded.

Answer

The native VLAN on the trunk is misconfigured, causing VLAN 50 traffic to be dropped.

Answer

The trunk is operating in access mode instead of trunk mode, preventing VLAN 50 traffic.

Answer

Spanning tree protocol has blocked the trunk port for VLAN 50, isolating the hosts.

Question 15

A host is configured as 10.10.20.190/26. Which range contains usable host addresses for that subnet?

Accepted Answer

10.10.20.129 to 10.10.20.190. A /26 uses blocks of 64 addresses. In plain language, the ranges are 0–63, 64–127, 128–191, and 192–255. Since the host ends in 190, it belongs to the 128–191 block. In that block, 10.10.20.128 is the network address and 10.10.20.191 is the broadcast address. That leaves 10.10.20.129 through 10.10.20.190 as the usable host range.

This question checks whether you can identify the correct block and then exclude the reserved endpoints properly.

Answer

10.10.20.128 to 10.10.20.191

Answer

10.10.20.130 to 10.10.20.191

Answer

10.10.20.193 to 10.10.20.254

Question 16

A network technician is troubleshooting a connectivity issue between two hosts on different subnets. During the analysis, the technician captures packets and observes that the data link layer frames are being stripped and rebuilt at each router hop. Which layer of the OSI model is responsible for encapsulating the original data into segments before transmission from the source host?

Accepted Answer

Transport layer. The Transport layer (Layer 4) is responsible for encapsulating the original data into segments. Protocols such as TCP (RFC 793) or UDP (RFC 768) add a header containing source and destination port numbers, sequence numbers, and other control information to form a segment. This segmentation occurs at the source host before the data is passed down to the Network layer for routing.

Answer

Network layer

Answer

Data Link layer

Answer

Application layer

Question 17

A network administrator is troubleshooting a user's wired workstation that cannot access the internet. The user reports that the workstation was working earlier today. The administrator runs 'ipconfig /all' on the workstation and sees an IP address of 169.254.10.55. What is the most likely cause of this issue?

Accepted Answer

The workstation is unable to communicate with a DHCP server due to a faulty network cable.. The IP address 169.254.10.55 falls within the Automatic Private IP Addressing (APIPA) range (169.254.0.0/16, RFC 3927). This address is assigned by the operating system when a DHCP client fails to receive a response from a DHCP server. A faulty network cable would prevent the workstation from communicating with the DHCP server, causing the client to self-assign an APIPA address after the DHCP discovery process times out.

Answer

The workstation has a duplicate IP address conflict with another device.

Answer

The workstation's DNS server settings are misconfigured.

Answer

The workstation is connected to the wrong VLAN, causing it to receive an incorrect IP address.

Question 18

A network engineer has configured an LACP EtherChannel between Switch1 and Switch2 by assigning interfaces to channel-group 1 with the mode passive on both switches. The engineer issues the show etherchannel summary command on Switch1 and sees the output below. The Port-channel interface remains down. Which action resolves the issue?

Accepted Answer

Change the mode on one switch to active.. When both switches are configured with LACP mode passive, neither switch initiates the negotiation process because passive mode only responds to incoming LACP packets. By changing one side to active mode, that switch will actively send LACP packets, allowing the EtherChannel to form. The Port-channel interface remains down due to this negotiation failure, not because of VLAN or physical mismatch issues.

Answer

Configure the switchport mode as trunk on both sides.

Answer

Verify that the native VLAN matches on both sides of the trunk.

Answer

Correct the speed and duplex settings on the member ports.

Question 19

A network administrator is troubleshooting a Windows 10 workstation that cannot access the internet. The workstation receives an IPv4 address starting with 169.254.x.x. The network uses DHCP, and other workstations on the same subnet are working correctly. What is the most likely cause of this issue?

Accepted Answer

The workstation's network cable is unplugged or faulty, preventing DHCP communication.. The 169.254.x.x address is an Automatic Private IP Addressing (APIPA) address assigned by Windows when DHCP fails. Since other workstations on the same subnet work correctly, the DHCP server and network are functional, isolating the issue to the specific workstation. A faulty or unplugged network cable would prevent the workstation from sending DHCP Discover messages, causing it to fall back to APIPA.

Answer

The workstation's DNS server settings are incorrect.

Answer

The DHCP server has exhausted its address pool.

Answer

The workstation's default gateway is misconfigured.

Question 20

Match the data format to its most accurate characteristic.

Accepted Answer

JSON: Lightweight, key-value based data format. JSON is lightweight and key-value based, XML uses tags and attributes, YAML relies on indentation, CSV is for tabular data, Protobuf is a binary schema-driven format, and HTML is for web page structure.

Answer

XML: Binary schema-driven format

Answer

YAML: Uses tags and attributes

Answer

CSV: For web page structure