CCNA Practice Exam 55 — 20 Questions

Question 1

A network technician is troubleshooting a connectivity issue between two hosts on different subnets. During the analysis, the technician captures packets and observes that the data link layer frames are being stripped and rebuilt at each router hop. Which layer of the OSI model is responsible for encapsulating the original data into segments before transmission from the source host?

Accepted Answer

Transport layer. The Transport layer (Layer 4) is responsible for encapsulating the original data into segments. Protocols such as TCP (RFC 793) or UDP (RFC 768) add a header containing source and destination port numbers, sequence numbers, and other control information to form a segment. This segmentation occurs at the source host before the data is passed down to the Network layer for routing.

Answer

Network layer

Answer

Data Link layer

Answer

Application layer

Question 2

A network administrator is troubleshooting a user's wired workstation that cannot access the internet. The user reports that the workstation was working earlier today. The administrator runs 'ipconfig /all' on the workstation and sees an IP address of 169.254.10.55. What is the most likely cause of this issue?

Accepted Answer

The workstation is unable to communicate with a DHCP server due to a faulty network cable.. The IP address 169.254.10.55 falls within the Automatic Private IP Addressing (APIPA) range (169.254.0.0/16, RFC 3927). This address is assigned by the operating system when a DHCP client fails to receive a response from a DHCP server. A faulty network cable would prevent the workstation from communicating with the DHCP server, causing the client to self-assign an APIPA address after the DHCP discovery process times out.

Answer

The workstation has a duplicate IP address conflict with another device.

Answer

The workstation's DNS server settings are misconfigured.

Answer

The workstation is connected to the wrong VLAN, causing it to receive an incorrect IP address.

Question 3

A network engineer has configured an LACP EtherChannel between Switch1 and Switch2 by assigning interfaces to channel-group 1 with the mode passive on both switches. The engineer issues the show etherchannel summary command on Switch1 and sees the output below. The Port-channel interface remains down. Which action resolves the issue?

Accepted Answer

Change the mode on one switch to active.. When both switches are configured with LACP mode passive, neither switch initiates the negotiation process because passive mode only responds to incoming LACP packets. By changing one side to active mode, that switch will actively send LACP packets, allowing the EtherChannel to form. The Port-channel interface remains down due to this negotiation failure, not because of VLAN or physical mismatch issues.

Answer

Configure the switchport mode as trunk on both sides.

Answer

Verify that the native VLAN matches on both sides of the trunk.

Answer

Correct the speed and duplex settings on the member ports.

Question 4

A network administrator is troubleshooting a Windows 10 workstation that cannot access the internet. The workstation receives an IPv4 address starting with 169.254.x.x. The network uses DHCP, and other workstations on the same subnet are working correctly. What is the most likely cause of this issue?

Accepted Answer

The workstation's network cable is unplugged or faulty, preventing DHCP communication.. The 169.254.x.x address is an Automatic Private IP Addressing (APIPA) address assigned by Windows when DHCP fails. Since other workstations on the same subnet work correctly, the DHCP server and network are functional, isolating the issue to the specific workstation. A faulty or unplugged network cable would prevent the workstation from sending DHCP Discover messages, causing it to fall back to APIPA.

Answer

The workstation's DNS server settings are incorrect.

Answer

The DHCP server has exhausted its address pool.

Answer

The workstation's default gateway is misconfigured.

Question 5

Match the data format to its most accurate characteristic.

Accepted Answer

JSON: Lightweight, key-value based data format. JSON is lightweight and key-value based, XML uses tags and attributes, YAML relies on indentation, CSV is for tabular data, Protobuf is a binary schema-driven format, and HTML is for web page structure.

Answer

XML: Binary schema-driven format

Answer

YAML: Uses tags and attributes

Answer

CSV: For web page structure

Question 6

Which TWO DNS record types are most commonly used together to verify both forward and reverse DNS mappings for an IPv6 address?

Accepted Answer

AAAA record. The AAAA record (Quad-A record) maps a domain name to an IPv6 address, making it the standard type for forward IPv6 lookups. The PTR record performs the reverse mapping—from an IPv6 address back to a domain name. Administrators routinely check both records with tools like nslookup or dig to ensure forward and reverse DNS consistency, which is critical for services such as email and security logging. The other options (A, CNAME, MX) do not directly provide a domain-to-IPv6 mapping or its reverse verification.

Answer

A record

Answer

CNAME record

Answer

MX record

Question 7

A branch router should automatically learn the IP address of a time source so logs from all devices show matching timestamps. Which service provides that function?

Accepted Answer

NTP. NTP synchronizes clocks across network devices. When timestamps line up, syslog messages and troubleshooting output become much more useful.

Answer

DNS

Answer

TFTP

Answer

NetFlow

Question 8

A trunk link has a native VLAN mismatch between two switches. What is the most likely result?

Accepted Answer

Untagged frames can be interpreted as belonging to different VLANs on each switch.. Untagged traffic may be placed into different VLANs on each side of the trunk, causing traffic leakage or connectivity problems.

Answer

All VLANs except the native VLAN stop forwarding immediately.

Answer

The trunk automatically converts to an access port.

Answer

STP is disabled on the trunk until the mismatch is corrected.

Question 9

You are connected to R1 via the console. R1 is a Cisco IOS-XE router. The network manager wants to use an Ansible playbook to configure a loopback interface with IP address 10.0.0.1/24 on R1. You need to write the Ansible YAML playbook that connects to R1 and configures this interface. The playbook must not use the 'parents' argument in the ios_config module.

Accepted Answer

- name: Configure Loopback
  hosts: R1
  gather_facts: no
  connection: network_cli
  tasks:
    - name: Configure interface
      ios_config:
        lines:
          - interface Loopback0
          - ip address 10.0.0.1 255.255.255.0
          - no shutdown. It uses the network_cli connection type, applies the correct subnet mask (255.255.255.0), includes 'no shutdown' to enable the interface, and does not use the 'parents' argument, meeting the requirement. Option B is wrong because it uses an 'ssh' connection (not network_cli) and writes the IP address in CIDR notation (/24) instead of the required dotted-decimal mask. Option C is wrong because it uses 'shutdown' instead of 'no shutdown', which disables the interface. Option D is wrong because it uses the 'parents' argument, which the stem explicitly forbids, even though the configuration would otherwise be valid.

Answer

- name: Configure Loopback
  hosts: R1
  gather_facts: no
  connection: ssh
  tasks:
    - name: Configure interface
      ios_config:
        lines:
          - interface Loopback0
          - ip address 10.0.0.1/24
          - no shutdown

Answer

- name: Configure Loopback
  hosts: R1
  gather_facts: no
  connection: network_cli
  tasks:
    - name: Configure interface
      ios_config:
        lines:
          - interface Loopback0
          - ip address 10.0.0.1 255.255.255.0
          - shutdown

Answer

- name: Configure Loopback
  hosts: R1
  gather_facts: no
  connection: network_cli
  tasks:
    - name: Configure interface
      ios_config:
        lines:
          - interface Loopback0
          - ip address 10.0.0.1 255.255.255.0
          - no shutdown
        parents: interface Loopback0

Question 10

Match each service to the kind of problem it most directly helps solve.

Accepted Answer

DNS - remembering IP addresses; DHCP - manual IP configuration; FTP - file transfers; SSH - encrypted remote access; RADIUS - network access; TACACS+ - device administration. DNS solves the problem of remembering IP addresses. DHCP eliminates manual IP configuration. FTP enables file transfers. SSH provides encrypted remote access. RADIUS and TACACS+ are AAA protocols, with RADIUS commonly used for network access and TACACS+ for device administration.

Answer

DNS - file transfers; DHCP - encrypted remote access; FTP - remembering IP addresses; SSH - manual IP configuration; RADIUS - device administration; TACACS+ - network access

Answer

DNS - encrypted remote access; DHCP - file transfers; FTP - manual IP configuration; SSH - remembering IP addresses; RADIUS - device administration; TACACS+ - network access

Answer

DNS - manual IP configuration; DHCP - remembering IP addresses; FTP - encrypted remote access; SSH - file transfers; RADIUS - network access; TACACS+ - device administration

Question 11

Which command places a switch port into access mode directly?

Accepted Answer

switchport mode access. A switch port is placed into access mode with the `switchport mode access` command. In plain language, this tells the switch that the interface should behave as a single-VLAN user-facing access port rather than as a trunk or a negotiation-based port. This is the normal choice for an endpoint such as a PC, printer, or IP camera that should belong to one VLAN.

This command matters because it makes the intended role of the interface explicit. That clarity is useful operationally and helps avoid accidental trunking behavior. The correct answer is the command that directly defines the switchport as access rather than assigning a VLAN without setting the role or relying on negotiation.

Answer

switchport trunk allowed vlan 10

Answer

switchport mode dynamic desirable

Answer

no switchport

Question 12

Drag and drop the following steps into the correct order to configure inter-VLAN routing using a router-on-a-stick topology.

Accepted Answer

On the switch, create the necessary VLANs (e.g., VLAN 10 and VLAN 20) using the 'vlan' command.. Inter-VLAN routing via router-on-a-stick requires creating VLANs on the switch, placing access ports in those VLANs, configuring a trunk to the router with the correct native VLAN to avoid mismatch, enabling the physical router interface, and then defining subinterfaces per VLAN with 802.1Q encapsulation and IP addresses. This ensures traffic from different VLANs can be routed.

Question 13

Users in 10.10.10.0/24 must be prevented from reaching the web server at 172.16.1.10 over HTTP, but all other traffic should be allowed. Which ACL entry best matches the requirement?

Accepted Answer

deny tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80. The correct ACL entry is an extended ACL deny statement that matches TCP from the source subnet to the destination host on port 80. In practical terms, the requirement is narrow: block HTTP only, from one source network to one server, while allowing everything else. That means using `deny tcp` with the right source, destination, and port is more accurate than using a broad `deny ip`.

This is a classic ACL precision question. The exam is testing whether you can match the requirement exactly rather than overblocking.

Answer

deny ip 10.10.10.0 0.0.0.255 host 172.16.1.10

Answer

deny udp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Answer

permit tcp 10.10.10.0 0.0.0.255 host 172.16.1.10 eq 80

Question 14

Which two statements accurately describe JSON?

Accepted Answer

JSON is a structured data format commonly used by APIs.. JSON is a lightweight structured data format commonly used in APIs and automation workflows. In plain language, it provides a readable way to represent data as key-value pairs, objects, and arrays so software can exchange information consistently. It is popular in network automation because it is compact and widely supported by tools, controllers, and web-based interfaces.

CCNA questions on JSON usually test recognition, not coding expertise. You should be able to identify that JSON is a data format, not a transport protocol, and that arrays are shown with square brackets. The correct answers in this question focus on those recognition skills rather than on advanced programming details.

Answer

JSON is the same thing as HTTPS.

Answer

JSON is required only for IPv6 networks.

Answer

JSON is a spanning-tree mode.

Question 15

You are connected to the console of R1. The network uses IPv6 with EUI-64. R1's GigabitEthernet0/0 interface has MAC address 0011.2233.4455. You must configure the interface to generate an IPv6 link-local address using the 'ipv6 enable' command, and also assign a global unicast address 2001:db8:1::/64 using EUI-64. The interface is currently administratively down.

Accepted Answer

R1(config-if)# ipv6 enable
R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64
R1(config-if)# no shutdown. The ipv6 enable command explicitly creates a link-local address as required by the scenario. The global unicast address with the eui-64 keyword automatically derives the interface ID from the MAC address. Option B is incorrect because it tries to manually configure a link-local address with eui-64, which is unnecessary and invalid. Option C omits the ipv6 enable command, failing the explicit requirement. Option D assigns a static host portion instead of using eui-64.

Answer

R1(config-if)# ipv6 address fe80::/10 eui-64
R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 enable
R1(config-if)# ipv6 address 2001:db8:1::1/64
R1(config-if)# no shutdown

Question 16

A host address is 192.168.50.158/27. Which address is the network address of its subnet?

Accepted Answer

192.168.50.128. A /27 subnet has a block size of 32. In practical terms, the relevant ranges in the last octet are 0-31, 32-63, 64-95, 96-127, 128-159, and so on. Because 158 falls in the 128-159 block, the network address is 192.168.50.128.

This is a block-identification question. Once you identify the correct /27 block, the network address is the first address in that range.

Answer

192.168.50.159

Answer

192.168.50.160

Answer

192.168.50.96

Question 17

An engineer configures a floating static route to 0.0.0.0/0 with an administrative distance of 200 while OSPF is providing a default route. What is the intended behavior?

Accepted Answer

The static default route acts as a backup and becomes active only if the OSPF default route is lost.. The intended behavior is that the static default route stays in reserve and becomes active only if the OSPF-learned default route disappears. In plain language, the administrator wants a backup path, not a replacement for the normal OSPF path. By assigning the static route a higher administrative distance than OSPF, the router treats it as less trustworthy during normal operation.

This is a standard floating-static design. The static route is still configured, but it does not normally appear as the preferred forwarding choice until the lower-distance route is lost. That is the key operational purpose of the configuration.

Answer

The static default route overrides OSPF immediately because it is manually configured.

Answer

Both default routes must always load-balance together.

Answer

The router ignores both defaults because they overlap.

Question 18

A switch should automatically disable any access port that receives a BPDU from an attached device. Which feature directly provides that behavior?

Accepted Answer

BPDU Guard. BPDU Guard is designed for edge ports that should never see BPDUs. If a BPDU arrives, the port is placed into an err-disabled state to protect the topology. Root Guard and Loop Guard solve different STP problems.

Answer

Root Guard

Answer

Loop Guard

Answer

PortFast

Question 19

You are connected to R1 via the console. R1 is configured as an NTP client that should synchronize with the NTP server at 203.0.113.1. You need to verify that R1 is synchronizing correctly and also ensure that the system clock is updated. Additionally, configure R1 to act as an NTP server for downstream devices on the internal network 192.168.1.0/24.

Accepted Answer

Use 'show ntp status' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp master' and 'ntp broadcast' on the interface facing 192.168.1.0/24.. The correct verification command is 'show ntp status' because it displays the synchronization state and stratum level. 'show ntp associations' shows configured peers but not the sync state. After NTP sync is established, the system clock is automatically updated; 'clock set' is not typically required but remains a valid command to manually adjust the clock. 'clock update' is not a valid IOS command. To make R1 an NTP server for downstream devices, use the global command 'ntp master 4', not 'ntp server' (which makes the router a client). Then, on the interface facing 192.168.1.0/24 (G0/0), apply 'ntp broadcast' to send NTP broadcasts so clients can synchronize without polling. Option A correctly combines these steps while other options mix incorrect commands or verification methods.

Answer

Use 'show ntp associations' to verify synchronization, 'clock update' to update the system clock, and configure 'ntp server' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Answer

Use 'show ntp status' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp server' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Answer

Use 'show ntp associations' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp master' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Question 20

A router shows this output:

R1#show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
10.1.1.2          1   FULL/DR         00:00:34    192.168.12.2    GigabitEthernet0/0
10.1.1.3          1   2WAY/DROTHER    00:00:39    192.168.12.3    GigabitEthernet0/0

Which statement is correct?

Accepted Answer

This can be normal on a broadcast segment where DROTHER routers remain in 2-Way. On broadcast OSPF networks, full adjacency is typically formed with the DR and BDR. DROTHER routers can remain in the 2-Way state with one another and still be operating normally.

Answer

R1 has failed to form adjacency with 10.1.1.3

Answer

R1 has a duplicate router ID with 10.1.1.3

Answer

The interface is passive