CCNA Practice Exam 55 — 20 Questions

Question 1

You are connected to the console of R1, a Cisco IOS-XE router. The network operations team needs to automate the backup of the running configuration to a TFTP server using a Python netmiko script. However, the script is failing. Your task is to write the correct netmiko commands to connect to R1 and save the configuration to the TFTP server at 192.168.1.100.

Accepted Answer

from netmiko import ConnectHandler

connection = ConnectHandler(device_type='cisco_ios', ip='192.168.1.1', username='admin', password='cisco')
connection.send_command('copy running-config tftp://192.168.1.100/r1-config', expect_string=r'$$confirm$$')
connection.send_command('\n')
connection.disconnect(). The 'copy running-config tftp://...' command in Cisco IOS prompts with '[confirm]'. To handle this interactively in netmiko, the expect_string must use a regular expression that matches the literal characters '[' and ']', which requires escaping them as '$$' and '$$'. The corrected script uses r'$$confirm$$' and then sends a newline to confirm, ensuring the backup completes. Options B and D fail to expect the prompt, and C uses an incorrect prompt match (expect_string=r'#' would only wait for the privileged EXEC prompt, missing the confirmation).

Answer

from netmiko import ConnectHandler

connection = ConnectHandler(device_type='cisco_ios', ip='192.168.1.1', username='admin', password='cisco')
connection.send_command('copy running-config tftp://192.168.1.100/r1-config')
connection.disconnect()

Answer

from netmiko import ConnectHandler

connection = ConnectHandler(device_type='cisco_ios', ip='192.168.1.1', username='admin', password='cisco')
connection.send_command('copy running-config tftp://192.168.1.100/r1-config', expect_string=r'#')

Answer

from netmiko import ConnectHandler

connection = ConnectHandler(device_type='cisco_ios', ip='192.168.1.1', username='admin', password='cisco')
connection.send_command('copy running-config tftp://192.168.1.100/r1-config
')
connection.disconnect()

Question 2

Which TWO DNS record types are most commonly used together to verify both forward and reverse DNS mappings for an IPv6 address?

Accepted Answer

AAAA record. The AAAA record (Quad-A record) maps a domain name to an IPv6 address, making it the standard type for forward IPv6 lookups. The PTR record performs the reverse mapping—from an IPv6 address back to a domain name. Administrators routinely check both records with tools like nslookup or dig to ensure forward and reverse DNS consistency, which is critical for services such as email and security logging. The other options (A, CNAME, MX) do not directly provide a domain-to-IPv6 mapping or its reverse verification.

Answer

A record

Answer

CNAME record

Answer

MX record

Question 3

A branch router should automatically learn the IP address of a time source so logs from all devices show matching timestamps. Which service provides that function?

Accepted Answer

NTP. NTP synchronizes clocks across network devices. When timestamps line up, syslog messages and troubleshooting output become much more useful.

Answer

DNS

Answer

TFTP

Answer

NetFlow

Question 4

You are connected to R1 via the console. R1 is a Cisco ISR 4321 router running IOS-XE. The network team has recently changed the routing protocol from EIGRP to OSPF, but some routes are missing from the routing table. You need to analyze the OSPF neighbor states and LSDB to identify the issue.

Accepted Answer

Use 'show ip ospf neighbor' to check neighbor state; if not FULL, examine 'show ip ospf interface' for mismatched hello/dead intervals or network type.. When OSPF routes are missing, the first diagnostic step is to verify adjacency formation with 'show ip ospf neighbor'; a state other than FULL (e.g., EXSTART, EXCHANGE, or 2-WAY) points to a Layer 2/3 or parameter mismatch. The most common culprits are mismatched hello/dead intervals, area IDs, authentication, MTU, or network type, which are all visible via 'show ip ospf interface'. This methodical approach isolates whether the problem is adjacency or LSDB/route calculation.

Answer

Use 'show ip route ospf' to verify OSPF routes; if missing, re-enter the OSPF process and redistribute connected routes.

Answer

Use 'debug ip ospf events' to monitor OSPF packets; if no packets are seen, reconfigure OSPF router ID and clear the OSPF process.

Answer

Use 'show ip protocols' to verify OSPF process configuration; if incorrect, delete and recreate the OSPF process with the correct network statements.

Question 5

A trunk link has a native VLAN mismatch between two switches. What is the most likely result?

Accepted Answer

Untagged frames can be interpreted as belonging to different VLANs on each switch.. Untagged traffic may be placed into different VLANs on each side of the trunk, causing traffic leakage or connectivity problems.

Answer

All VLANs except the native VLAN stop forwarding immediately.

Answer

The trunk automatically converts to an access port.

Answer

STP is disabled on the trunk until the mismatch is corrected.

Question 6

Match each service to the kind of problem it most directly helps solve.

Accepted Answer

DNS - remembering IP addresses; DHCP - manual IP configuration; FTP - file transfers; SSH - encrypted remote access; RADIUS - network access; TACACS+ - device administration. DNS solves the problem of remembering IP addresses. DHCP eliminates manual IP configuration. FTP enables file transfers. SSH provides encrypted remote access. RADIUS and TACACS+ are AAA protocols, with RADIUS commonly used for network access and TACACS+ for device administration.

Answer

DNS - file transfers; DHCP - encrypted remote access; FTP - remembering IP addresses; SSH - manual IP configuration; RADIUS - device administration; TACACS+ - network access

Answer

DNS - encrypted remote access; DHCP - file transfers; FTP - manual IP configuration; SSH - remembering IP addresses; RADIUS - device administration; TACACS+ - network access

Answer

DNS - manual IP configuration; DHCP - remembering IP addresses; FTP - encrypted remote access; SSH - file transfers; RADIUS - network access; TACACS+ - device administration

Question 7

Which command places a switch port into access mode directly?

Accepted Answer

switchport mode access. A switch port is placed into access mode with the `switchport mode access` command. In plain language, this tells the switch that the interface should behave as a single-VLAN user-facing access port rather than as a trunk or a negotiation-based port. This is the normal choice for an endpoint such as a PC, printer, or IP camera that should belong to one VLAN.

This command matters because it makes the intended role of the interface explicit. That clarity is useful operationally and helps avoid accidental trunking behavior. The correct answer is the command that directly defines the switchport as access rather than assigning a VLAN without setting the role or relying on negotiation.

Answer

switchport trunk allowed vlan 10

Answer

switchport mode dynamic desirable

Answer

no switchport

Question 8

Drag and drop the following steps into the correct order to configure inter-VLAN routing using a router-on-a-stick topology.

Accepted Answer

On the switch, create the necessary VLANs (e.g., VLAN 10 and VLAN 20) using the 'vlan' command.. Inter-VLAN routing via router-on-a-stick requires creating VLANs on the switch, placing access ports in those VLANs, configuring a trunk to the router with the correct native VLAN to avoid mismatch, enabling the physical router interface, and then defining subinterfaces per VLAN with 802.1Q encapsulation and IP addresses. This ensures traffic from different VLANs can be routed.

Question 9

Which two statements accurately describe JSON?

Accepted Answer

JSON is a structured data format commonly used by APIs.. JSON is a lightweight structured data format commonly used in APIs and automation workflows. In plain language, it provides a readable way to represent data as key-value pairs, objects, and arrays so software can exchange information consistently. It is popular in network automation because it is compact and widely supported by tools, controllers, and web-based interfaces.

CCNA questions on JSON usually test recognition, not coding expertise. You should be able to identify that JSON is a data format, not a transport protocol, and that arrays are shown with square brackets. The correct answers in this question focus on those recognition skills rather than on advanced programming details.

Answer

JSON is the same thing as HTTPS.

Answer

JSON is required only for IPv6 networks.

Answer

JSON is a spanning-tree mode.

Question 10

A host address is 192.168.50.158/27. Which address is the network address of its subnet?

Accepted Answer

192.168.50.128. A /27 subnet has a block size of 32. In practical terms, the relevant ranges in the last octet are 0-31, 32-63, 64-95, 96-127, 128-159, and so on. Because 158 falls in the 128-159 block, the network address is 192.168.50.128.

This is a block-identification question. Once you identify the correct /27 block, the network address is the first address in that range.

Answer

192.168.50.159

Answer

192.168.50.160

Answer

192.168.50.96

Question 11

An engineer configures a floating static route to 0.0.0.0/0 with an administrative distance of 200 while OSPF is providing a default route. What is the intended behavior?

Accepted Answer

The static default route acts as a backup and becomes active only if the OSPF default route is lost.. The intended behavior is that the static default route stays in reserve and becomes active only if the OSPF-learned default route disappears. In plain language, the administrator wants a backup path, not a replacement for the normal OSPF path. By assigning the static route a higher administrative distance than OSPF, the router treats it as less trustworthy during normal operation.

This is a standard floating-static design. The static route is still configured, but it does not normally appear as the preferred forwarding choice until the lower-distance route is lost. That is the key operational purpose of the configuration.

Answer

The static default route overrides OSPF immediately because it is manually configured.

Answer

Both default routes must always load-balance together.

Answer

The router ignores both defaults because they overlap.

Question 12

A switch should automatically disable any access port that receives a BPDU from an attached device. Which feature directly provides that behavior?

Accepted Answer

BPDU Guard. BPDU Guard is designed for edge ports that should never see BPDUs. If a BPDU arrives, the port is placed into an err-disabled state to protect the topology. Root Guard and Loop Guard solve different STP problems.

Answer

Root Guard

Answer

Loop Guard

Answer

PortFast

Question 13

A router shows this output:

R1#show ip ospf neighbor
Neighbor ID     Pri   State           Dead Time   Address         Interface
10.1.1.2          1   FULL/DR         00:00:34    192.168.12.2    GigabitEthernet0/0
10.1.1.3          1   2WAY/DROTHER    00:00:39    192.168.12.3    GigabitEthernet0/0

Which statement is correct?

Accepted Answer

This can be normal on a broadcast segment where DROTHER routers remain in 2-Way. On broadcast OSPF networks, full adjacency is typically formed with the DR and BDR. DROTHER routers can remain in the 2-Way state with one another and still be operating normally.

Answer

R1 has failed to form adjacency with 10.1.1.3

Answer

R1 has a duplicate router ID with 10.1.1.3

Answer

The interface is passive

Question 14

Which TWO statements are correct regarding Protocol Data Units (PDUs) and data encapsulation in the OSI model?

Accepted Answer

Data is encapsulated with a TCP header at the Transport layer to form a segment.. Option B is correct because at the Transport layer, application data is encapsulated with a TCP header (or UDP header) to form a segment, which is the Transport-layer PDU. Option C is correct because the Network layer PDU is the packet, formed by adding an IP header to the segment, providing logical addressing and routing information. Option A is incorrect because a frame is the Data Link layer PDU, not the Transport layer PDU. Option D is incorrect because the Data Link layer adds a header and trailer to create a frame, not a bit; bits are the Physical layer PDU. Option E is incorrect because encapsulation occurs as data moves down the OSI layers from Application to Physical, not upward.

Answer

The PDU at the Transport layer is called a frame.

Answer

The Data Link layer adds a header and trailer to create a bit.

Answer

Encapsulation occurs as data moves up the OSI layers from Physical to Application.

Question 15

Which two statements accurately describe why organizations use separate employee and guest WLANs?

Accepted Answer

They allow different access policies and trust boundaries for different user groups.. Organizations use separate WLANs because different user groups usually require different trust levels, policies, and access rights. In practical terms, employees may need access to internal business systems, while guests usually need a more limited and isolated experience. Separate WLANs make that segmentation and policy enforcement easier.

This is a design and security decision, not just a naming preference.

Answer

They eliminate the need for wireless security.

Answer

They make all roaming problems disappear automatically.

Answer

They replace the need for VLANs or policy controls behind the scenes.

Question 16

Which TWO statements accurately describe cabling and SFP transceiver diagnostics?

Accepted Answer

The 'show interfaces transceiver' command displays optical power levels for both Tx and Rx on fiber SFPs.. Option C is correct because the 'show interfaces transceiver' command (and its variants like 'show interfaces transceiver detail') reports diagnostic optical parameters on fiber SFPs, including transmit (Tx) and receive (Rx) optical power levels in dBm, which is exactly how you verify link budget and signal integrity. Option E is correct because multimode fiber SFPs with LC connectors (e.g., 1000BASE-SX) are designed for short-reach campus/distribution links, typically supporting up to 550 meters over OM2 multimode fiber (and 220-550 m depending on fiber grade and modal bandwidth). Option A is wrong because copper SFPs such as 1000BASE-T have a 100-meter reach over standard Cat5e or better, not requiring Cat6a. Option B is wrong because 'GLC-T' and 'SFP-GE-T' are copper (1000BASE-T) SFP product IDs, not fiber module identifiers. Option D is wrong because 'show cable-diagnostics tdr interface' performs Time Domain Reflectometry on copper twisted-pair Ethernet cabling, not on fiber optic cables, which cannot be tested this way.

Answer

Copper SFP modules require Cat6a cabling to achieve a 100-meter reach.

Answer

Fiber SFP modules are typically identified by the 'GLC-T' or 'SFP-GE-T' product IDs.

Answer

The 'show cable-diagnostics tdr interface' command can measure the distance to a break in a fiber optic cable.

Question 17

Which summary route best represents these four networks?
10.20.0.0/24
10.20.1.0/24
10.20.2.0/24
10.20.3.0/24

Accepted Answer

10.20.0.0/22. Four contiguous /24 networks starting at 10.20.0.0 summarize cleanly into 10.20.0.0/22. That block covers 10.20.0.0 through 10.20.3.255.

Answer

10.20.0.0/23

Answer

10.20.0.0/24

Answer

10.20.0.0/21

Question 18

Which TWO of the following statements correctly describe REST API operations?

Accepted Answer

API keys and OAuth tokens are common methods for authenticating REST API requests.. Option C is correct because REST APIs typically authenticate requests using credentials such as API keys (often sent in an Authorization or custom header) or OAuth 2.0 bearer tokens, which are standard mechanisms for identifying and authorizing clients. Option E is correct because REST relies on HTTP semantics, and servers return status codes like 200 OK, 201 Created, 400 Bad Request, 401 Unauthorized, 404 Not Found, and 500 Internal Server Error to indicate the outcome of an operation. Option A is wrong because PUT is used to create or replace a resource, whereas retrieval is performed with GET. Option B is wrong because REST APIs can exchange data in multiple formats, including JSON, XML, YAML, and plain text, depending on content negotiation. Option D is wrong because DELETE maps to the Delete operation in CRUD, while Update corresponds to PUT or PATCH.

Answer

The HTTP PUT method is used to retrieve a resource representation.

Answer

JSON is the only data format supported by REST APIs.

Answer

The HTTP DELETE method corresponds to the Update operation in CRUD.

Question 19

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP relay agent and verify the DHCP DORA process for a client on a remote subnet.

OPTIONS:
  A: Configure the ip helper-address command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp relay. [CORRECT]
  B: Configure the ip helper-address command on the interface facing the DHCP server, then verify connectivity to the client, and finally capture the DORA process using debug ip dhcp server packet.
  C: Configure the ip dhcp relay information option command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp server packet.
  D: Configure the ip helper-address command on the interface facing the client, then capture the DORA process using debug ip dhcp server packet, and finally verify connectivity to the DHCP server.

Accepted Answer

Configure the ip helper-address command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp relay.. The relay agent must be configured first by setting the ip helper-address on the client-facing interface, then verifying connectivity to the DHCP server. The DORA process should be observed using a relay-specific debug command such as debug ip dhcp relay; the originally listed debug ip dhcp server packet would show no output on a pure relay agent, making it incorrect for verification. Therefore, only option A is correct.

Answer

Configure the ip helper-address command on the interface facing the DHCP server, then verify connectivity to the client, and finally capture the DORA process using debug ip dhcp server packet.

Answer

Configure the ip dhcp relay information option command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp server packet.

Answer

Configure the ip helper-address command on the interface facing the client, then capture the DORA process using debug ip dhcp server packet, and finally verify connectivity to the DHCP server.

Question 20

Which TWO statements correctly describe NTP stratum levels and syslog severity levels in a Cisco IOS-XE environment?

Accepted Answer

An NTP stratum value of 1 indicates a higher accuracy than a stratum value of 3.. A lower NTP stratum number indicates higher accuracy; stratum 1 is directly synchronized to a precise reference clock (e.g., GPS) and is thus more accurate than stratum 3, which is two hops away. Option C is correct because the 'ntp server' command configures a device to synchronize its clock to a specified NTP server, making it an NTP client. Option B is incorrect: syslog severity level 4 (warning) is more severe than level 5 (notice) because lower severity numbers indicate higher severity. Option D is incorrect: severity level 0 (emergency) is the most severe level, indicating a system-wide critical event, not a normal operational message. Option E is incorrect: NTP stratum 0 is assigned to an authoritative time source itself (e.g., atomic clock), not to devices directly connected to it; devices connected to stratum 0 sources are stratum 1.

Answer

A syslog severity level of 5 (notice) is more severe than a level of 4 (warning).

Answer

Syslog severity level 0 (emergency) indicates a normal operational message.

Answer

NTP stratum 0 is assigned to devices that are directly connected to an authoritative time source.