CCNA Practice Exam 55 — 20 Questions

Question 1

A wireless site reports that users can connect to the SSID, but performance drops sharply around the conference area whenever the room fills up. Based on the exhibit, what is the most likely cause?

Accepted Answer

Adjacent-channel interference caused by overlapping 2.4 GHz channels. The 2.4 GHz radios are using overlapping channels. In 2.4 GHz, the standard non-overlapping channels are 1, 6, and 11 in many regulatory domains. Using channels 1, 3, and 6 creates adjacent-channel interference, which hurts throughput especially in dense client areas.

Answer

A DHCP exhaustion problem on the WLAN

Answer

An authentication mismatch between the APs and clients

Answer

A missing default route on the wireless controller

Question 2

Two static routes exist for the 203.0.113.0/24 network: one pointing to ISP-A with an administrative distance of 10, and another pointing to ISP-B with an administrative distance of 5. Packets for that subnet are leaving through ISP-B. What explains this behavior?

Accepted Answer

The ISP-B route has a lower administrative distance.. The route via ISP-B has a lower administrative distance, so it wins for the identical /24 prefix. For routes to the same destination and mask, the router compares AD before considering anything else between different route sources.

Answer

Static routes with a higher next-hop IP are preferred.

Answer

The router always prefers the route configured last.

Answer

The route names force policy-based routing.

Question 3

A controller-based WLAN uses 5 GHz in an open office. Clients keep disconnecting when users roam between APs, but signal strength remains strong. Based on the exhibit, what is the most likely problem?

Accepted Answer

A transmit power mismatch is creating asymmetric coverage around AP-3.. The APs are transmitting at much higher power than the clients, creating a coverage imbalance. Clients may hear the AP well enough to stay associated too long, while the AP cannot reliably hear the weaker client at the same cell edge. That leads to sticky-client and roaming issues even when RSSI looks strong.

Answer

The SSID must use 2.4 GHz only for roaming to work.

Answer

WPA2 cannot support roaming between APs.

Answer

The WLAN needs a different DHCP scope on each AP.

Question 4

Which STP role identifies the port on a non-root switch that has the best path back to the root bridge?

Accepted Answer

Root port. The root port is the single port on a non-root switch that provides the lowest-cost path toward the root bridge. Designated ports forward away from the root for a segment, and alternate ports are backup paths.

Answer

Designated port

Answer

Alternate port

Answer

Disabled port

Question 5

Which two statements about standard and extended IPv4 ACLs are correct?

Accepted Answer

A standard ACL matches only the source IPv4 address.. Standard ACLs match only the source IPv4 address, while extended ACLs can match protocol and source and destination details including ports. Because standard ACLs are less granular, they are usually placed closer to the destination. Extended ACLs are usually placed closer to the source.

Answer

A standard ACL is normally placed as close to the source as possible.

Answer

An extended ACL cannot filter ICMP traffic.

Answer

Both ACL types require named ACL syntax to match traffic.

Question 6

Exhibit: A standard ACL meant to block host 10.10.10.50 from reaching any remote network was applied inbound on the branch router's LAN interface, but users report that all local traffic from that host is now blocked. What is the better placement?

Accepted Answer

Move it outbound on the WAN-facing interface closer to the destination. A standard ACL matches only the source address. If it is placed near the source, it can block that host from reaching destinations you did not intend to affect. Standard ACLs are best placed close to the destination.

Answer

Leave it inbound on the LAN because standard ACLs belong near the source

Answer

Convert it to a VTY access-class

Answer

Apply it inbound on all switch access ports

Question 7

An administrator wants an access-layer interface to shut down immediately if another switch is connected accidentally. Which feature best meets that requirement?

Accepted Answer

BPDU Guard. BPDU Guard is designed for edge ports. If the port receives a BPDU, the switch treats that as a sign that another switch has been connected and places the interface into an err-disabled state to protect the spanning-tree topology.

Answer

Root Guard

Answer

PortFast

Answer

Loop Guard

Question 8

A switch should automatically disable any access port that receives a BPDU from an attached device. Which feature directly provides that behavior?

Accepted Answer

BPDU Guard. BPDU Guard is designed for edge ports that should never see BPDUs. If a BPDU arrives, the port is placed into an err-disabled state to protect the topology. Root Guard and Loop Guard solve different STP problems.

Answer

Root Guard

Answer

Loop Guard

Answer

PortFast

Question 9

Which ACL statement permits only SSH from host 10.10.10.50 to server 192.168.1.10?

Accepted Answer

permit tcp host 10.10.10.50 host 192.168.1.10 eq 22. SSH uses TCP destination port 22. The source is the single host 10.10.10.50 and the destination is the single host 192.168.1.10.

Answer

permit udp host 10.10.10.50 host 192.168.1.10 eq 22

Answer

permit tcp any host 192.168.1.10 eq 22

Answer

permit ip host 10.10.10.50 host 192.168.1.10

Question 10

Exhibit: After PAT is configured, inside users can browse the internet, but the engineer wants to verify that translations are actually being created. Which command is the best choice?

Accepted Answer

show ip nat translations. The NAT translation table shows the inside local and inside global addresses and confirms whether active translations are being built.

Answer

show access-lists

Answer

show ip route

Answer

debug ip packet detail

Question 11

Why is SSH preferred over Telnet for device management?

Accepted Answer

SSH encrypts the session traffic. SSH encrypts the management session, including usernames, passwords, and commands. Telnet sends traffic in clear text, which makes it unsafe on modern networks.

Answer

SSH uses UDP and is therefore faster

Answer

SSH works only on Layer 2 networks

Answer

SSH does not require user authentication

Question 12

A switchport connected to an employee PC must allow the normal endpoint to connect but immediately err-disable the port if a switch is plugged in. Which two features should be configured on that access port?

Accepted Answer

spanning-tree bpduguard enable. For edge access ports, PortFast brings the port up quickly for end devices, and BPDU Guard protects against someone connecting a switch by err-disabling the interface when BPDUs arrive.

Answer

switchport port-security maximum 1

Answer

storm-control broadcast level 5.00

Question 13

A technician reports that users on a guest wireless SSID can reach the internet but can also browse internal file shares, which should be blocked. Which two design actions most directly address that issue?

Accepted Answer

Place guest clients in a separate VLAN or VRF from internal users. Guest access should be isolated through segmentation and policy enforcement. Separate broadcast domains and ACLs are the practical way to allow internet-only access.

Answer

Increase the AP transmit power

Answer

Disable DHCP on the guest WLAN

Question 14

A network team wants all devices to timestamp logs consistently so event correlation works across routers, switches, and firewalls. Which service should they configure first?

Accepted Answer

NTP. NTP provides consistent time across the infrastructure. Syslog carries log messages, but if device clocks are wrong, the log entries will still be hard to correlate. Accurate time is a foundational service for troubleshooting and forensics.

Answer

DNS

Answer

DHCP

Answer

TFTP

Question 15

Which NAT feature allows many inside hosts to share one public IPv4 address by using unique source port numbers?

Accepted Answer

PAT. PAT, sometimes called NAT overload, keeps track of connections by using Layer 4 port numbers so many private hosts can share a single public address.

Answer

Static NAT

Answer

NTP authentication

Answer

Port security

Question 16

A collector is not receiving flow records from a branch router. Based on the exhibit, what is the most likely issue?

Accepted Answer

The exporter source interface does not match what the collector expects.. The exporter is configured to send records out the wrong interface. NetFlow exports must use a source interface that has a valid path to the collector and typically matches the interface the collector expects. The collector IP itself is correct in the example, but the source interface selection is wrong.

Answer

The export destination port 2055 is invalid for flow export.

Answer

NetFlow can run only on serial interfaces.

Answer

The router must use TCP instead of UDP to export flows.

Question 17

Based on the JSON snippet below, which statement is correct?

{
  "device": {
    "hostname": "R1",
    "interfaces": [
      {"name": "Gig0/0", "status": "up"},
      {"name": "Gig0/1", "status": "down"}
    ]
  }
}

Accepted Answer

interfaces is a JSON array containing two objects.. The value associated with interfaces is an array because it is enclosed in square brackets and contains multiple objects. The device element itself is an object, and each interface entry inside the array is also an object.

Answer

device is a JSON array.

Answer

status is a JSON array with two strings.

Answer

hostname is a nested array under interfaces.

Question 18

A standard numbered ACL is applied close to the destination, but it is blocking traffic from one host while still allowing all other users on the subnet. Which two facts about standard ACLs are relevant in this design?

Accepted Answer

They filter based on source address only. Standard ACLs only match the source IP address. For that reason, they are usually placed near the source so they do not block more traffic than intended.

Answer

They can match TCP and UDP port numbers

Answer

They automatically create a permit any at the end

Question 19

Which two statements about AAA on Cisco devices are correct? Choose two.

Accepted Answer

Authentication verifies identity. AAA breaks access control into authentication, authorization, and accounting. TACACS+ is commonly preferred for device administration because it separates all three functions and encrypts the full payload.

Answer

Accounting replaces the need for local usernames entirely

Answer

AAA can only be used with RADIUS and not TACACS+

Question 20

Which Syslog severity level represents an emergency condition, the most critical level?

Accepted Answer

0. Syslog severity 0 is Emergency, the highest severity. The levels then increase numerically as urgency decreases, with 7 being Debugging.

Answer

3

Answer

5

Answer

7