CCNA Practice Exam 56 — 20 Questions

Question 1

A router is configured with PAT for inside users. Which symptom most strongly suggests the NAT inside/outside roles are reversed on the interfaces?

Accepted Answer

Outbound traffic still shows private inside source addresses where translated public addresses should appear.. When NAT inside/outside roles are reversed, the router applies translation logic in the wrong direction, causing traffic from the inside network to leave the outside interface with untranslated private source addresses. The correct answer (A) directly demonstrates this failure: outbound traffic still shows private IPs where a public address should appear after PAT. The other options describe symptoms that could occur with other NAT misconfigurations but do not strongly indicate reversed roles: an empty translation table (B) suggests no NAT processing at all, possibly due to missing ACL or overload configuration; total lack of internet access (C) may result from many connectivity issues, not specifically reversed interface roles; and external hosts reaching internal servers by private IP (D) points more to a missing or incorrect static NAT rule rather than direction reversal.

Answer

The NAT translation table is empty even though internal users are browsing the internet.

Answer

Internal hosts cannot reach the internet at all.

Answer

External hosts can connect to internal servers using their private IP addresses.

Question 2

A router has routes to 192.168.0.0/16 and 192.168.50.0/24. Which route is used for traffic to 192.168.50.99?

Accepted Answer

192.168.50.0/24. The 192.168.50.0/24 route is used because it is more specific. In practical terms, even though the /16 also matches, the router always prefers the route that describes the destination more narrowly. Since 192.168.50.99 falls inside the /24, longest-prefix match chooses that entry.

This is a basic but essential routing rule. The broader /16 still matters for other destinations in 192.168.0.0/16, but not for this one.

Answer

192.168.0.0/16

Answer

The default route

Answer

Both routes equally

Question 3

A network operations team is implementing an AI-driven automation system that uses an agentic AI agent to handle routine network issues. The agent is configured to detect high CPU utilization on a core router, then automatically execute a series of diagnostic commands and, if a specific pattern is found, trigger a configuration change to reduce load. After the change, the agent re-checks CPU utilization and, if still high, escalates the issue to a human engineer. Which of the following best describes the workflow being used?

Accepted Answer

A closed-loop remediation workflow. The workflow described is a closed-loop remediation workflow because the agent detects a condition (high CPU), takes action (diagnostic commands and configuration change), then re-checks the condition (CPU utilization) and escalates if unresolved. This feedback loop—observe, act, verify, escalate—is the defining characteristic of closed-loop automation. It is not a static script because it adapts based on the outcome of its actions.

Answer

A static automation script that runs on a schedule without feedback

Answer

A tool-calling mechanism for executing network commands

Answer

An AI agent that uses reinforcement learning to optimize network performance

Question 4

After a switch replacement, users in VLAN 30 cannot reach devices in other VLANs. The replacement switch has a trunk link to the distribution switch that shows as up/up. What is the most likely cause?

Accepted Answer

VLAN 30 is not permitted on the trunk link. The trunk is up, but VLAN 30 is not allowed on it. Traffic from that VLAN never crosses the uplink, so inter-VLAN reachability fails for users in VLAN 30 even though the local access ports may still look fine.

Answer

The native VLAN must be changed to 30

Answer

The uplink should be configured as an access port

Answer

STP must be disabled on VLAN 30

Question 5

Refer to the exhibit. A network technician is troubleshooting router R1, which cannot reach hosts on the internet. R1 is connected to an ISP router at 203.0.113.1. The exhibit shows the output of the show ip route command. What is the most likely cause of the issue?

Accepted Answer

A static default route is not configured on R1, and OSPF is not advertising a default route.. The exhibit shows that R1 has no default route (0.0.0.0/0) in its routing table, and the only routes present are OSPF-learned internal routes. Since R1 cannot reach the internet, the most likely cause is that no static default route is configured pointing to the ISP router (203.0.113.1) and OSPF is not injecting a default route into R1. Without a default route, R1 has no path for traffic destined outside its OSPF domain.

Answer

The OSPF neighbor relationship with the ISP router is down.

Answer

The interface connecting to the ISP router is in a shutdown state.

Answer

An incorrect next-hop address was specified in the static default route, making the route invalid.

Question 6

Exhibit: R1 learns 192.168.50.0/24 from multiple sources. Which two statements are correct about the route that will be installed in the routing table?

Accepted Answer

The static route is preferred because its administrative distance is lowest. The router chooses the route with the lowest administrative distance first. If administrative distance ties, it then compares the metric within that routing source. In this case the static route wins because AD 1 beats eBGP 20, OSPF 110, and RIP 120.

Answer

The OSPF route is preferred because cost 20 is lower than RIP metric 2

Answer

The eBGP route would win over the static route because BGP is more dynamic

Answer

RIP would be chosen before OSPF because hop count is simpler

Question 7

Two switches are connected by a trunk. VLAN 50 exists on both switches, but hosts in VLAN 50 cannot communicate across the link. All other VLANs work. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 50 is not allowed on the trunk from SwitchA.. VLAN 50 is missing from the allowed VLAN list on the trunk, which blocks only that VLAN while allowing others. Option B is incorrect: a native VLAN mismatch would affect the native VLAN (usually VLAN 1) or cause STP issues, not specifically VLAN 50. Option C is incorrect: 802.1Q encapsulation supports all VLANs from 1 to 4094, including VLAN 50. Option D is incorrect: VLANs do not need to be the native VLAN to be transported over a trunk; any VLAN can traverse a trunk if it is allowed.

Answer

The native VLAN is mismatched.

Answer

802.1Q cannot carry VLAN 50.

Answer

VLAN 50 must be configured as the native VLAN first.

Question 8

A router learns 203.0.113.0/24 through OSPF and 203.0.113.0/25 through a static route. Which route is used for traffic destined to 203.0.113.10?

Accepted Answer

The static /25 route. Routers prefer the most specific matching route first. The /25 route is more specific than the /24 and includes 203.0.113.10.

Answer

The OSPF /24 route

Answer

Both routes equally

Answer

Neither route because the prefixes overlap

Question 9

Based on the exhibit, why is the static route not being used for 172.18.9.10?

Accepted Answer

Because the connected /24 route is more specific than the static /16 route.. The static route is not being used because the connected route is the more specific match. In practical terms, route selection starts with prefix specificity. The static route covers a broad /16, but the destination 172.18.9.10 also falls inside a connected /24. The /24 wins because it is more specific.

This is a classic routing interpretation question because it tests whether you apply longest-prefix logic before thinking about route source preference.

Answer

Because static routes are never used when a connected network exists anywhere in the table.

Answer

Because connected routes always have administrative distance 255.

Answer

Because static routes work only for default routing.

Question 10

A switch administrator enters the following commands on interface GigabitEthernet1/0/10:

interface g1/0/10
 switchport mode access
 switchport access vlan 30
 spanning-tree portfast
 spanning-tree bpduguard enable

A user connects a small managed switch to this port, and the access port immediately changes to an err-disabled state.

Which feature caused the port to shut down?

Accepted Answer

BPDU Guard. BPDU Guard is the feature that caused the shutdown. This question is really about separating two features that are often configured together on user-facing ports: PortFast and BPDU Guard. PortFast helps an edge port come up quickly, which is useful for PCs and phones. BPDU Guard adds protection by watching for BPDUs on that same port. If a switch is connected where only an end device should exist, the newly connected switch may send BPDUs. The local switch interprets that as a topology risk and disables the port to protect the Layer 2 network. The clues are the err-disabled state and the fact that another switch was connected. VLAN assignment and access mode are normal here and do not explain the shutdown.

Answer

PortFast

Answer

Access VLAN 30 assignment

Answer

The interface being in access mode

Question 11

A network administrator notices that a switchport in access mode with PortFast enabled has transitioned to an err-disabled state. What is the most likely cause?

Accepted Answer

BPDU Guard disabled the PortFast-enabled access port after it received a BPDU.. The strongest reason is a BPDU Guard violation on a PortFast-enabled access port. In practical terms, the port was expected to face an end host, not a switching device that emits BPDUs. When BPDUs appeared, the switch treated that as a topology-policy violation and error-disabled the interface to protect the network.

This is one of the most classic access-layer protection patterns on the CCNA exam.

Answer

Port security shut down the port because the VLAN was wrong.

Answer

DHCP snooping disabled the interface because a host requested an address.

Answer

EtherChannel suspended the interface because the bundle was incomplete.

Question 12

Which two statements accurately describe the value of named administrative accounts?

Accepted Answer

They improve accountability by tying actions to specific individuals.. Named administrative accounts are valuable because they tie actions to individual identities and make access review more meaningful. In practical terms, when multiple people share one generic admin account, accountability becomes weaker. Named identities improve traceability and support auditing, investigations, and operational review.

This is a core secure-administration concept and a good reasoning item rather than just a memorization exercise.

Answer

They replace the need for authorization controls.

Answer

They can be used only with Telnet and not SSH.

Answer

They exist only for wireless guest administration.

Question 13

A network engineer is troubleshooting an issue where a Windows 10 workstation (Host-A) cannot reach the internet, but can ping the local default gateway. The engineer runs 'ipconfig /all' on Host-A and reviews the output. What is the most likely cause of the problem?

Accepted Answer

The DNS server is configured as a public DNS server that may be unreachable due to network policy or firewall.. Host-A can ping the default gateway, which confirms that Layer 3 connectivity to the local network is working and that the subnet mask and default gateway are correctly configured. The inability to reach the internet despite this connectivity points to a name resolution failure, likely caused by an incorrect or unreachable DNS server. A public DNS server (e.g., 8.8.8.8) may be blocked by corporate firewall policy, preventing Host-A from resolving internet domain names.

Answer

The subnet mask is incorrect.

Answer

The default gateway is missing or incorrect.

Answer

The host has obtained an APIPA address (169.254.x.x).

Question 14

A router learns 10.0.0.0/8 from OSPF and 10.10.0.0/16 from a static route. Which route is used for traffic to 10.10.20.1?

Accepted Answer

The static 10.10.0.0/16 route. The static /16 route is used because it is more specific than the OSPF /8 route. In practical terms, even though both routes match the destination, the router chooses the one that narrows the destination range more precisely. Since 10.10.20.1 belongs to 10.10.0.0/16, that entry wins.

This question reinforces that longest-prefix match comes first. The broader OSPF route still matters for other destinations inside 10.0.0.0/8, but not for this one.

Answer

The OSPF 10.0.0.0/8 route

Answer

The default route if present

Answer

Neither route, because the networks overlap

Question 15

Which OSPF network type on Ethernet performs a DR and BDR election by default?

Accepted Answer

Broadcast. Broadcast multiaccess networks such as Ethernet elect a DR and BDR by default.

Answer

Point-to-point

Answer

Point-to-multipoint nonbroadcast

Answer

Loopback

Question 16

R1 and R2 are connected via a shared Ethernet segment. Both routers are configured in OSPF area 0 and are on the same IP subnet. OSPF authentication is enabled on both interfaces, but the adjacency is not forming. What is the most likely reason?

Accepted Answer

The OSPF authentication key does not match on the two routers.. The most likely reason is an OSPF authentication mismatch. In practical terms, both routers are on the same IP subnet and in the same area, but they are not using the same authentication key on the shared link. OSPF neighbors must agree on key authentication parameters before they will trust each other enough to form an adjacency.

This is a classic CCNA troubleshooting pattern because the configuration looks almost correct until you compare the security settings carefully.

Answer

The routers must use different OSPF areas to become neighbors.

Answer

OSPF message-digest authentication can be used only on serial links.

Answer

The routers must remove IP addressing before OSPF can form.

Question 17

A router interface is configured for OSPF, but neighbors do not form. The engineer checks the interface and sees Hello 10 and Dead 40. The neighbor on the same segment uses Hello 30 and Dead 120.

What is the most likely cause of the OSPF adjacency failure?

Accepted Answer

OSPF timers do not match. The adjacency fails because the OSPF hello and dead timers do not match. OSPF neighbors on the same segment must agree on several key parameters before they accept each other as neighbors, and the timer settings are one of those required matches. In plain terms, each router is expecting to hear OSPF hellos at one rhythm, but the other side is speaking at a different rhythm, so the relationship never becomes valid. This is different from cost, which matters later during path selection after neighbors are already exchanging information. The timer mismatch is a classic CCNA troubleshooting point because the interfaces can be up and IP connectivity can even appear normal while the OSPF adjacency still fails.

Answer

Router IDs are identical

Answer

The interface cost is too low

Answer

The subnet mask is invalid because it is a transit link

Question 18

A route table shows both a default route and a more specific route to 192.168.50.0/24. Which two statements describe how packets destined for 192.168.50.25 are handled?

Accepted Answer

The router prefers the 192.168.50.0/24 route because it is the longest prefix match. Once routes are installed, packet forwarding follows longest prefix match. The /24 route is more specific than the default route, so traffic to 192.168.50.25 uses the /24 entry.

Answer

Administrative distance is compared before prefix length for forwarding decisions

Answer

The packet is load-balanced across both routes automatically

Question 19

Which of the following sequences correctly configures and verifies PortFast and BPDU Guard on a Cisco IOS-XE switch interface, and then recovers after a BPDU guard violation?

Accepted Answer

Enter global configuration mode, then interface configuration mode, enable PortFast, enable BPDU Guard, verify with show commands, and recover by shutting down and no shutting down the interface.. The correct sequence is described in option A: enter global configuration mode, then interface configuration mode, enable PortFast first, then BPDU Guard, verify with show commands, and recover by shutting down and no shutting down the interface. Options B, C, and D are incorrect because they contain errors such as wrong order of enabling features, improper recovery methods (reload, removal of BPDU Guard, or clear errdisable interface), or enabling BPDU Guard globally. Only option A follows the proper Cisco IOS-XE procedure for configuring and recovering from a BPDU guard violation.

Answer

Enter interface configuration mode, enable BPDU Guard, enable PortFast, exit to global config, verify, and recover by reloading the switch.

Answer

Enter global configuration mode, enable BPDU Guard globally, then enter interface configuration mode, enable PortFast, verify, and recover by removing BPDU Guard.

Answer

Enter interface configuration mode, enable PortFast, enable BPDU Guard, exit to global config, verify, and recover by issuing 'clear errdisable interface' command.

Question 20

A network administrator has configured 802.1X port-based authentication on a Cisco IOS-XE switch for a new access port connected to a user workstation. The workstation is failing to gain network access. The switch port is in the 'authorized' state, but the workstation cannot ping the default gateway. The administrator checks the running configuration and the authentication session details. What is the most likely cause of the issue?

Accepted Answer

The RADIUS server returned a VLAN ID that placed the port in a VLAN lacking connectivity to the default gateway, such as a VLAN without an SVI or incorrect subnet assignment.. The switch port is in the 'authorized' state, indicating that 802.1X authentication succeeded and the RADIUS server sent an Access-Accept. However, the workstation cannot ping the default gateway, pointing to a connectivity issue after authentication. The most likely cause is that the RADIUS server returned a VLAN assignment (via the Tunnel-Private-Group-ID attribute) that placed the port in a VLAN that is not the intended one, such as a management VLAN without a gateway, or a VLAN missing a routed SVI, leaving the workstation isolated despite successful authentication.

Answer

The RADIUS server has not been configured with the correct shared secret, causing authentication to fail silently.

Answer

The switch port is in 'err-disabled' state due to a port-security violation, preventing any traffic.

Answer

The workstation's supplicant is not configured with the correct EAP method, causing the authentication to use the guest VLAN instead.