CCNA Practice Exam 56 — 20 Questions

Question 1

Which two statements accurately describe why organizations use separate employee and guest WLANs?

Accepted Answer

They allow different access policies and trust boundaries for different user groups.. Organizations use separate WLANs because different user groups usually require different trust levels, policies, and access rights. In practical terms, employees may need access to internal business systems, while guests usually need a more limited and isolated experience. Separate WLANs make that segmentation and policy enforcement easier.

This is a design and security decision, not just a naming preference.

Answer

They eliminate the need for wireless security.

Answer

They make all roaming problems disappear automatically.

Answer

They replace the need for VLANs or policy controls behind the scenes.

Question 2

Which summary route best represents these four networks?
10.20.0.0/24
10.20.1.0/24
10.20.2.0/24
10.20.3.0/24

Accepted Answer

10.20.0.0/22. Four contiguous /24 networks starting at 10.20.0.0 summarize cleanly into 10.20.0.0/22. That block covers 10.20.0.0 through 10.20.3.255.

Answer

10.20.0.0/23

Answer

10.20.0.0/24

Answer

10.20.0.0/21

Question 3

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP relay agent and verify the DHCP DORA process for a client on a remote subnet.

OPTIONS:
  A: Configure the ip helper-address command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp relay. [CORRECT]
  B: Configure the ip helper-address command on the interface facing the DHCP server, then verify connectivity to the client, and finally capture the DORA process using debug ip dhcp server packet.
  C: Configure the ip dhcp relay information option command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp server packet.
  D: Configure the ip helper-address command on the interface facing the client, then capture the DORA process using debug ip dhcp server packet, and finally verify connectivity to the DHCP server.

Accepted Answer

Configure the ip helper-address command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp relay.. The relay agent must be configured first by setting the ip helper-address on the client-facing interface, then verifying connectivity to the DHCP server. The DORA process should be observed using a relay-specific debug command such as debug ip dhcp relay; the originally listed debug ip dhcp server packet would show no output on a pure relay agent, making it incorrect for verification. Therefore, only option A is correct.

Answer

Configure the ip helper-address command on the interface facing the DHCP server, then verify connectivity to the client, and finally capture the DORA process using debug ip dhcp server packet.

Answer

Configure the ip dhcp relay information option command on the interface facing the client, then verify connectivity to the DHCP server, and finally capture the DORA process using debug ip dhcp server packet.

Answer

Configure the ip helper-address command on the interface facing the client, then capture the DORA process using debug ip dhcp server packet, and finally verify connectivity to the DHCP server.

Question 4

Match each trunking or switchport term to its most accurate description.

Accepted Answer

Trunk port: Carries traffic for multiple VLANs using tagging. These terms define how switchports handle VLAN traffic in trunking environments.

Question 5

Which TWO statements correctly describe NTP stratum levels and syslog severity levels in a Cisco IOS-XE environment?

Accepted Answer

An NTP stratum value of 1 indicates a higher accuracy than a stratum value of 3.. A lower NTP stratum number indicates higher accuracy; stratum 1 is directly synchronized to a precise reference clock (e.g., GPS) and is thus more accurate than stratum 3, which is two hops away. Option C is correct because the 'ntp server' command configures a device to synchronize its clock to a specified NTP server, making it an NTP client. Option B is incorrect: syslog severity level 4 (warning) is more severe than level 5 (notice) because lower severity numbers indicate higher severity. Option D is incorrect: severity level 0 (emergency) is the most severe level, indicating a system-wide critical event, not a normal operational message. Option E is incorrect: NTP stratum 0 is assigned to an authoritative time source itself (e.g., atomic clock), not to devices directly connected to it; devices connected to stratum 0 sources are stratum 1.

Answer

A syslog severity level of 5 (notice) is more severe than a level of 4 (warning).

Answer

Syslog severity level 0 (emergency) indicates a normal operational message.

Answer

NTP stratum 0 is assigned to devices that are directly connected to an authoritative time source.

Question 6

A router is configured with PAT for inside users. Which symptom most strongly suggests the NAT inside/outside roles are reversed on the interfaces?

Accepted Answer

Outbound traffic still shows private inside source addresses where translated public addresses should appear.. When NAT inside/outside roles are reversed, the router applies translation logic in the wrong direction, causing traffic from the inside network to leave the outside interface with untranslated private source addresses. The correct answer (A) directly demonstrates this failure: outbound traffic still shows private IPs where a public address should appear after PAT. The other options describe symptoms that could occur with other NAT misconfigurations but do not strongly indicate reversed roles: an empty translation table (B) suggests no NAT processing at all, possibly due to missing ACL or overload configuration; total lack of internet access (C) may result from many connectivity issues, not specifically reversed interface roles; and external hosts reaching internal servers by private IP (D) points more to a missing or incorrect static NAT rule rather than direction reversal.

Answer

The NAT translation table is empty even though internal users are browsing the internet.

Answer

Internal hosts cannot reach the internet at all.

Answer

External hosts can connect to internal servers using their private IP addresses.

Question 7

A router has routes to 192.168.0.0/16 and 192.168.50.0/24. Which route is used for traffic to 192.168.50.99?

Accepted Answer

192.168.50.0/24. The 192.168.50.0/24 route is used because it is more specific. In practical terms, even though the /16 also matches, the router always prefers the route that describes the destination more narrowly. Since 192.168.50.99 falls inside the /24, longest-prefix match chooses that entry.

This is a basic but essential routing rule. The broader /16 still matters for other destinations in 192.168.0.0/16, but not for this one.

Answer

192.168.0.0/16

Answer

The default route

Answer

Both routes equally

Question 8

After a switch replacement, users in VLAN 30 cannot reach devices in other VLANs. The replacement switch has a trunk link to the distribution switch that shows as up/up. What is the most likely cause?

Accepted Answer

VLAN 30 is not permitted on the trunk link. The trunk is up, but VLAN 30 is not allowed on it. Traffic from that VLAN never crosses the uplink, so inter-VLAN reachability fails for users in VLAN 30 even though the local access ports may still look fine.

Answer

The native VLAN must be changed to 30

Answer

The uplink should be configured as an access port

Answer

STP must be disabled on VLAN 30

Question 9

Refer to the exhibit. A network technician is troubleshooting router R1, which cannot reach hosts on the internet. R1 is connected to an ISP router at 203.0.113.1. The exhibit shows the output of the show ip route command. What is the most likely cause of the issue?

Accepted Answer

A static default route is not configured on R1, and OSPF is not advertising a default route.. The exhibit shows that R1 has no default route (0.0.0.0/0) in its routing table, and the only routes present are OSPF-learned internal routes. Since R1 cannot reach the internet, the most likely cause is that no static default route is configured pointing to the ISP router (203.0.113.1) and OSPF is not injecting a default route into R1. Without a default route, R1 has no path for traffic destined outside its OSPF domain.

Answer

The OSPF neighbor relationship with the ISP router is down.

Answer

The interface connecting to the ISP router is in a shutdown state.

Answer

An incorrect next-hop address was specified in the static default route, making the route invalid.

Question 10

Exhibit: R1 learns 192.168.50.0/24 from multiple sources. Which two statements are correct about the route that will be installed in the routing table?

Accepted Answer

The static route is preferred because its administrative distance is lowest. The router chooses the route with the lowest administrative distance first. If administrative distance ties, it then compares the metric within that routing source. In this case the static route wins because AD 1 beats eBGP 20, OSPF 110, and RIP 120.

Answer

The OSPF route is preferred because cost 20 is lower than RIP metric 2

Answer

The eBGP route would win over the static route because BGP is more dynamic

Answer

RIP would be chosen before OSPF because hop count is simpler

Question 11

Two switches are connected by a trunk. VLAN 50 exists on both switches, but hosts in VLAN 50 cannot communicate across the link. All other VLANs work. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 50 is not allowed on the trunk from SwitchA.. VLAN 50 is missing from the allowed VLAN list on the trunk, which blocks only that VLAN while allowing others. Option B is incorrect: a native VLAN mismatch would affect the native VLAN (usually VLAN 1) or cause STP issues, not specifically VLAN 50. Option C is incorrect: 802.1Q encapsulation supports all VLANs from 1 to 4094, including VLAN 50. Option D is incorrect: VLANs do not need to be the native VLAN to be transported over a trunk; any VLAN can traverse a trunk if it is allowed.

Answer

The native VLAN is mismatched.

Answer

802.1Q cannot carry VLAN 50.

Answer

VLAN 50 must be configured as the native VLAN first.

Question 12

A router learns 203.0.113.0/24 through OSPF and 203.0.113.0/25 through a static route. Which route is used for traffic destined to 203.0.113.10?

Accepted Answer

The static /25 route. Routers prefer the most specific matching route first. The /25 route is more specific than the /24 and includes 203.0.113.10.

Answer

The OSPF /24 route

Answer

Both routes equally

Answer

Neither route because the prefixes overlap

Question 13

Based on the exhibit, why is the static route not being used for 172.18.9.10?

Accepted Answer

Because the connected /24 route is more specific than the static /16 route.. The static route is not being used because the connected route is the more specific match. In practical terms, route selection starts with prefix specificity. The static route covers a broad /16, but the destination 172.18.9.10 also falls inside a connected /24. The /24 wins because it is more specific.

This is a classic routing interpretation question because it tests whether you apply longest-prefix logic before thinking about route source preference.

Answer

Because static routes are never used when a connected network exists anywhere in the table.

Answer

Because connected routes always have administrative distance 255.

Answer

Because static routes work only for default routing.

Question 14

A switch administrator enters the following commands on interface GigabitEthernet1/0/10:

interface g1/0/10
 switchport mode access
 switchport access vlan 30
 spanning-tree portfast
 spanning-tree bpduguard enable

A user connects a small managed switch to this port, and the access port immediately changes to an err-disabled state.

Which feature caused the port to shut down?

Accepted Answer

BPDU Guard. BPDU Guard is the feature that caused the shutdown. This question is really about separating two features that are often configured together on user-facing ports: PortFast and BPDU Guard. PortFast helps an edge port come up quickly, which is useful for PCs and phones. BPDU Guard adds protection by watching for BPDUs on that same port. If a switch is connected where only an end device should exist, the newly connected switch may send BPDUs. The local switch interprets that as a topology risk and disables the port to protect the Layer 2 network. The clues are the err-disabled state and the fact that another switch was connected. VLAN assignment and access mode are normal here and do not explain the shutdown.

Answer

PortFast

Answer

Access VLAN 30 assignment

Answer

The interface being in access mode

Question 15

A network administrator notices that a switchport in access mode with PortFast enabled has transitioned to an err-disabled state. What is the most likely cause?

Accepted Answer

BPDU Guard disabled the PortFast-enabled access port after it received a BPDU.. The strongest reason is a BPDU Guard violation on a PortFast-enabled access port. In practical terms, the port was expected to face an end host, not a switching device that emits BPDUs. When BPDUs appeared, the switch treated that as a topology-policy violation and error-disabled the interface to protect the network.

This is one of the most classic access-layer protection patterns on the CCNA exam.

Answer

Port security shut down the port because the VLAN was wrong.

Answer

DHCP snooping disabled the interface because a host requested an address.

Answer

EtherChannel suspended the interface because the bundle was incomplete.

Question 16

Which two statements accurately describe the value of named administrative accounts?

Accepted Answer

They improve accountability by tying actions to specific individuals.. Named administrative accounts are valuable because they tie actions to individual identities and make access review more meaningful. In practical terms, when multiple people share one generic admin account, accountability becomes weaker. Named identities improve traceability and support auditing, investigations, and operational review.

This is a core secure-administration concept and a good reasoning item rather than just a memorization exercise.

Answer

They replace the need for authorization controls.

Answer

They can be used only with Telnet and not SSH.

Answer

They exist only for wireless guest administration.

Question 17

A network engineer is troubleshooting an issue where a Windows 10 workstation (Host-A) cannot reach the internet, but can ping the local default gateway. The engineer runs 'ipconfig /all' on Host-A and reviews the output. What is the most likely cause of the problem?

Accepted Answer

The DNS server is configured as a public DNS server that may be unreachable due to network policy or firewall.. Host-A can ping the default gateway, which confirms that Layer 3 connectivity to the local network is working and that the subnet mask and default gateway are correctly configured. The inability to reach the internet despite this connectivity points to a name resolution failure, likely caused by an incorrect or unreachable DNS server. A public DNS server (e.g., 8.8.8.8) may be blocked by corporate firewall policy, preventing Host-A from resolving internet domain names.

Answer

The subnet mask is incorrect.

Answer

The default gateway is missing or incorrect.

Answer

The host has obtained an APIPA address (169.254.x.x).

Question 18

Which OSPF network type on Ethernet performs a DR and BDR election by default?

Accepted Answer

Broadcast. Broadcast multiaccess networks such as Ethernet elect a DR and BDR by default.

Answer

Point-to-point

Answer

Point-to-multipoint nonbroadcast

Answer

Loopback

Question 19

R1 and R2 are connected via a shared Ethernet segment. Both routers are configured in OSPF area 0 and are on the same IP subnet. OSPF authentication is enabled on both interfaces, but the adjacency is not forming. What is the most likely reason?

Accepted Answer

The OSPF authentication key does not match on the two routers.. The most likely reason is an OSPF authentication mismatch. In practical terms, both routers are on the same IP subnet and in the same area, but they are not using the same authentication key on the shared link. OSPF neighbors must agree on key authentication parameters before they will trust each other enough to form an adjacency.

This is a classic CCNA troubleshooting pattern because the configuration looks almost correct until you compare the security settings carefully.

Answer

The routers must use different OSPF areas to become neighbors.

Answer

OSPF message-digest authentication can be used only on serial links.

Answer

The routers must remove IP addressing before OSPF can form.

Question 20

A router interface is configured for OSPF, but neighbors do not form. The engineer checks the interface and sees Hello 10 and Dead 40. The neighbor on the same segment uses Hello 30 and Dead 120.

What is the most likely cause of the OSPF adjacency failure?

Accepted Answer

OSPF timers do not match. The adjacency fails because the OSPF hello and dead timers do not match. OSPF neighbors on the same segment must agree on several key parameters before they accept each other as neighbors, and the timer settings are one of those required matches. In plain terms, each router is expecting to hear OSPF hellos at one rhythm, but the other side is speaking at a different rhythm, so the relationship never becomes valid. This is different from cost, which matters later during path selection after neighbors are already exchanging information. The timer mismatch is a classic CCNA troubleshooting point because the interfaces can be up and IP connectivity can even appear normal while the OSPF adjacency still fails.

Answer

Router IDs are identical

Answer

The interface cost is too low

Answer

The subnet mask is invalid because it is a transit link