CCNA Practice Exam 57 — 20 Questions

Question 1

A route table shows both a default route and a more specific route to 192.168.50.0/24. Which two statements describe how packets destined for 192.168.50.25 are handled?

Accepted Answer

The router prefers the 192.168.50.0/24 route because it is the longest prefix match. Once routes are installed, packet forwarding follows longest prefix match. The /24 route is more specific than the default route, so traffic to 192.168.50.25 uses the /24 entry.

Answer

Administrative distance is compared before prefix length for forwarding decisions

Answer

The packet is load-balanced across both routes automatically

Question 2

Why is the combination of strong authentication and centralized logging generally better than using either one alone?

Accepted Answer

Authentication helps prevent unauthorized access, while centralized logging improves visibility and investigation.. The combination is better because strong authentication helps prevent unauthorized access, while centralized logging helps detect, review, and investigate activity across the environment. In plain language, one control focuses more on prevention, while the other improves visibility and accountability. Together they create a stronger security posture than either one alone.

This is an important design mindset. Security is stronger when controls complement each other instead of trying to solve every problem with one mechanism. The correct answer is the one focused on prevention plus visibility.

Answer

They are redundant because both perform exactly the same function.

Answer

Centralized logging makes authentication unnecessary.

Answer

Strong authentication removes the need for device event records.

Question 3

A network administrator has configured 802.1X port-based authentication on a Cisco IOS-XE switch for a new access port connected to a user workstation. The workstation is failing to gain network access. The switch port is in the 'authorized' state, but the workstation cannot ping the default gateway. The administrator checks the running configuration and the authentication session details. What is the most likely cause of the issue?

Accepted Answer

The RADIUS server returned a VLAN ID that placed the port in a VLAN lacking connectivity to the default gateway, such as a VLAN without an SVI or incorrect subnet assignment.. The switch port is in the 'authorized' state, indicating that 802.1X authentication succeeded and the RADIUS server sent an Access-Accept. However, the workstation cannot ping the default gateway, pointing to a connectivity issue after authentication. The most likely cause is that the RADIUS server returned a VLAN assignment (via the Tunnel-Private-Group-ID attribute) that placed the port in a VLAN that is not the intended one, such as a management VLAN without a gateway, or a VLAN missing a routed SVI, leaving the workstation isolated despite successful authentication.

Answer

The RADIUS server has not been configured with the correct shared secret, causing authentication to fail silently.

Answer

The switch port is in 'err-disabled' state due to a port-security violation, preventing any traffic.

Answer

The workstation's supplicant is not configured with the correct EAP method, causing the authentication to use the guest VLAN instead.

Question 4

A router shows the following route:

O    10.10.40.0/24 [110/20] via 192.0.2.2, 00:00:12, GigabitEthernet0/0

What does the value 110 represent?

Accepted Answer

The administrative distance of OSPF. In Cisco route output, the value in brackets is [administrative distance/metric].

Answer

The OSPF cost to the destination

Answer

The number of hops to the destination

Answer

The route age in seconds

Question 5

Which two statements accurately describe why NTP and Syslog are often configured together?

Accepted Answer

Syslog provides event visibility, while NTP helps keep timestamps consistent across devices.. NTP and Syslog are often configured together because logs become much more useful when the device clocks are aligned. In practical terms, Syslog provides the event messages, while NTP helps ensure that the timestamps on those messages are consistent across the environment. That makes troubleshooting and incident analysis more reliable.

This is a very practical operations concept and comes up often in real troubleshooting workflows.

Answer

NTP replaces the need for any event logging.

Answer

Syslog automatically assigns the NTP server address to all devices.

Answer

Both services can be used only on routers, not switches.

Question 6

A user can connect to the employee SSID and receive the correct employee IP subnet, but access to one internal application fails only for that WLAN while wired users succeed. Which troubleshooting area is the strongest first focus?

Accepted Answer

A WLAN-specific policy or filtering rule affecting access to that application. The strongest first focus is the policy or filtering path specific to that WLAN or traffic class. In practical terms, the user has already shown that the correct WLAN join, authentication, and subnet assignment are working. Because wired users succeed and only one application fails from that WLAN, the most likely issue is a WLAN-specific policy, ACL, firewall rule, or path treatment affecting that application.

This is a realistic selective-access troubleshooting scenario and tests whether the candidate narrows the fault domain correctly.

Answer

The SSID broadcast setting

Answer

Whether the access point has a valid hostname

Answer

Whether the client is using PPP instead of Ethernet

Question 7

Exhibit: PCs in VLAN 20 are not receiving addresses from a DHCP server in another subnet. The switch SVI for VLAN 20 is up, and routing is working. Which configuration is most likely missing on the gateway for VLAN 20?

Accepted Answer

ip helper-address 10.99.99.10. DHCP Discover messages are broadcasts and do not cross routers by default. An ip helper-address on the client gateway interface relays those requests to a remote DHCP server.

Answer

ip default-gateway 10.20.20.1

Answer

switchport trunk allowed vlan 20

Answer

spanning-tree portfast default

Question 8

A routing table contains these entries for the same destination space: 10.1.0.0/16, 10.1.10.0/24, and 0.0.0.0/0. Which route is used for traffic to 10.1.10.44?

Accepted Answer

10.1.10.0/24. The 10.1.10.0/24 route is used because it is the most specific matching prefix. In plain language, even though the /16 route and the default route could also match, the /24 route describes the destination range more precisely. Longest-prefix match therefore selects the /24 entry.

This is a foundational route-selection rule. The default route remains important as a fallback, but it is not used when more specific routes exist. Likewise, the /16 route is less specific than the /24, so it loses for this destination.

Answer

10.1.0.0/16

Answer

0.0.0.0/0

Answer

No route, because the entries overlap

Question 9

A router has an OSPF-learned route to a destination prefix and also a directly connected route to a broader supernet that includes that destination. The OSPF route is more specific. Which route is used for the destination?

Accepted Answer

The more specific OSPF route. The more specific OSPF route is used. In practical terms, route specificity is checked before broader route-source considerations when the prefixes are different. Even though the connected route is a directly attached source and often strongly trusted, it still loses if it is less specific than another matching route.

This is a subtle route-selection question because it combines source type and specificity. The key is that longest-prefix match comes first.

Answer

The directly connected broader route

Answer

Both routes equally

Answer

Neither route can be used because the sources differ

Question 10

You are connected to R1. The network uses a router-on-a-stick design with a single switch (SW1) and two VLANs (10 and 20). Currently, hosts in VLAN 10 cannot ping hosts in VLAN 20, and the trunk between R1 and SW1 shows a native VLAN mismatch. Examine the provided configuration and output, then apply the necessary corrections to R1 so that inter-VLAN routing works correctly.

Accepted Answer

Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.20 to dot1Q 20, and enable IP routing globally.. The configuration has three issues: 1) The native VLAN on the trunk is VLAN 1, but the switch expects VLAN 99 (common mismatch scenario). 2) Subinterface G0/0.20 uses encapsulation dot1Q 10 instead of 20, causing VLAN 20 traffic to be mis-tagged. 3) The 'ip routing' command is missing globally, so R1 cannot route between subinterfaces. To fix, configure the main interface G0/0 with 'encapsulation dot1Q 99 native' to set the native VLAN to 99, correct the encapsulation on G0/0.20 to 'dot1Q 20', and enable IP routing with 'ip routing'.

Answer

Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.20 to dot1Q 20, but do not enable IP routing because it is enabled by default.

Answer

Change the native VLAN on R1's trunk interface to 1, correct the encapsulation on G0/0.20 to dot1Q 20, and enable IP routing globally.

Answer

Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.10 to dot1Q 10, and enable IP routing globally.

Question 11

You are connected to R1 via console. R1 connects two networks: GigabitEthernet0/0 (10.0.0.1/30) to the ISP, and GigabitEthernet0/1 (172.16.1.1/24) to an internal network. The internal hosts (172.16.1.0/24) need to communicate with a server at 10.0.0.2 (ISP side) using a static NAT mapping. Configure static NAT so that internal host 172.16.1.100 is mapped to public IP 10.0.0.3 (which is not assigned to any interface; assume ISP routes 10.0.0.3 to R1). Also configure a static route to reach 10.0.0.3 via the ISP router (next-hop 10.0.0.2).

Accepted Answer

ip nat inside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside
ip route 10.0.0.3 255.255.255.255 10.0.0.2. Static NAT provides a one-to-one mapping between a private and public IP. The inside/outside interface designations are critical for NAT to function. The static route ensures that return traffic to 10.0.0.3 is routed via the ISP.

Answer

ip nat inside source static 10.0.0.3 172.16.1.100
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Answer

ip nat inside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat inside
interface GigabitEthernet0/1
ip nat outside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Answer

ip nat outside source static 172.16.1.100 10.0.0.3
interface GigabitEthernet0/0
ip nat outside
interface GigabitEthernet0/1
ip nat inside
ip route 10.0.0.3 255.255.255.255 10.0.0.2

Question 12

A static default route is configured with an administrative distance of 250. What is the most likely design intention?

Accepted Answer

To keep the route as a backup of last resort behind normal learned routes. The design intention is to make the static default route a very low-priority backup path. In plain language, the administrator wants the route to exist only as a last resort behind almost any normal learned path. By assigning such a high administrative distance, the route stays out of the active table unless better routes disappear.

This is a floating-static design concept. The route is not meant to be primary. It is intentionally configured to sit in reserve and become relevant only during failure conditions or severe loss of normal routing information.

Answer

To make the route override all dynamic routing immediately

Answer

To disable default routing entirely

Answer

To convert the default route into a host route

Question 13

Which three statements accurately describe the role of Cisco's AI-powered security features (such as Cisco AI Network Analytics, Stealthwatch, or DNA Center's AI-Enhanced Analytics) in network security operations? (Choose three.)

Accepted Answer

AI can automate the response to certain security incidents, such as blocking malicious IPs. Cisco's AI-powered security features detect zero-day exploits by analyzing behavioral anomalies and deviations from learned baselines, without relying on signatures. These systems correlate logs from multiple Cisco products (e.g., firewalls, endpoints, cloud) to uncover multi-step attack chains. AI can also automate responses such as blocking malicious IPs via Cisco security controls, reducing mean time to respond (MTTR). However, AI complements but does not replace traditional security tools like firewall rules or ACLs, and it requires ongoing human oversight for validation and tuning.

Answer

AI security models require no human oversight once deployed

Answer

AI eliminates the need for firewall rules and access control lists

Answer

AI is only effective against known, signature-based threats

Question 14

A router has the following routes in its routing table: a static route to 10.60.4.16/28, an OSPF route to 10.60.4.0/24, and an EIGRP route to 10.60.0.0/16. Which route will be used for a packet destined to 10.60.4.17?

Accepted Answer

The static route to 10.60.4.16/28. The route used will be the route with the longest matching prefix. In practical terms, 10.60.4.17 falls inside the /28 route shown, and that is more specific than the broader /24 and /16 alternatives. Because specificity comes first, the /28 route wins.

This is a clean route-table interpretation problem that mirrors actual exam-style thinking very closely.

Answer

The OSPF route to 10.60.4.0/24

Answer

The EIGRP route to 10.60.0.0/16

Answer

No route at all

Question 15

Drag and drop the following OSPFv2 neighbor state transitions and DR/BDR election steps into the correct order for a multi-access network where a new router joins an existing OSPF area.

Accepted Answer

Down -> Init -> 2-Way -> ExStart -> Exchange -> Loading -> Full. The new router first discovers neighbors via Hello. Then DD, LSR, LSU exchange synchronizes databases. DR/BDR election happens before Full state is achieved.

Answer

Down -> Init -> 2-Way -> ExStart -> Exchange -> Full -> Loading

Answer

Down -> Init -> ExStart -> 2-Way -> Exchange -> Loading -> Full

Answer

Down -> Init -> 2-Way -> Exchange -> ExStart -> Loading -> Full

Question 16

Two routers are directly connected and running OSPF. Their IP addresses and hello timers match, but they still do not become neighbors. One side is configured for area 0 and the other for area 1 on the shared link. What is the most likely cause?

Accepted Answer

The interfaces are in different OSPF areas on the shared link.. An OSPF area mismatch is the most likely cause. In plain language, the routers may be physically connected and able to exchange packets, but OSPF still requires that both sides agree on the area associated with the shared segment. If one interface belongs to area 0 and the other belongs to area 1, the routers do not view the segment in the same OSPF context and the adjacency fails.

This is a classic CCNA troubleshooting case because the addressing can look perfect while the protocol still refuses to form a neighbor relationship. OSPF is strict about several interface-level values, and the area assignment is one of the most important.

Answer

The routers need identical hostnames.

Answer

The link must be converted to a trunk.

Answer

The routers must use static routes first.

Question 17

An OSPF router learns a route with metric 20 and another OSPF route to the same destination with metric 30. The prefix length is the same. Which path is preferred?

Accepted Answer

The route with metric 20. The OSPF path with metric 20 is preferred because, within the same routing protocol and for the same prefix length, the metric is used to compare candidate paths. In practical terms, the router is not comparing source trust here because both routes come from OSPF. It is comparing OSPF’s own internal path-cost values, and the lower metric wins.

This question is about separating administrative distance from metric. Since both routes come from the same protocol, metric is the deciding factor.

Answer

The route with metric 30

Answer

Both routes are rejected because the metrics differ

Answer

The default route is preferred

Question 18

A host is assigned 192.168.10.33/28. Which subnet contains that host?

Accepted Answer

192.168.10.32/28. A /28 subnet uses blocks of 16 addresses. In plain language, the last octet ranges move in increments of 16: 0–15, 16–31, 32–47, 48–63, and so on. Since the host address ends in 33, it belongs to the 32–47 block. That means the containing subnet is 192.168.10.32/28.

This style of subnetting question is common because it tests whether you can identify the correct network boundary quickly. The key is to recognize the block size from the prefix and then place the address inside the correct interval without confusing the host with the network address.

Answer

192.168.10.16/28

Answer

192.168.10.48/28

Answer

192.168.10.0/28

Question 19

Two routers are in the same OSPF area and on the same subnet, but they do not form an adjacency. One interface uses a hello interval of 10 seconds and the other uses 5 seconds. What is the most likely cause?

Accepted Answer

The OSPF hello timers do not match.. An OSPF timer mismatch is the most likely cause. In plain language, the routers are trying to discover each other, but they are speaking on different timing expectations. OSPF neighbors on the same segment must agree on certain parameters before they trust each other enough to form an adjacency, and the hello and dead timers are among those critical values.

This is a very common OSPF troubleshooting issue because the interfaces may still be reachable with ping and may even appear correctly addressed and placed in the same area. But OSPF is stricter than simple IP reachability. If the hello interval does not match, the adjacency usually fails before it becomes fully operational.

Answer

The routers need matching hostnames.

Answer

The subnet must be changed to /24 before OSPF can work.

Answer

The routers must both use static routes first.

Question 20

Users report that their PCs take over 30 seconds to obtain IP addresses and reach the network after being powered on. A network technician checks a switch port connected to a PC and observes that the port transitions through blocking, listening, learning, and then forwarding states, taking about 30 seconds to complete. The switch is running standard 802.1D STP. The technician confirms the port is an access port and only connects to a PC. What should the technician do next?

Accepted Answer

Enable PortFast on the access port.. The 30-second delay is caused by the standard 802.1D STP port states (blocking → listening → learning → forwarding). Since the port is an access port connecting only to a PC (an end host), there is no risk of a bridging loop. Enabling PortFast immediately transitions the port to the forwarding state, bypassing the listening and learning states and eliminating the delay.

Answer

Reduce the STP forward delay timer globally on the switch.

Answer

Disable STP on the access VLAN assigned to the port.

Answer

Enable Rapid PVST+ on the switch.