CCNA Practice Exam 57 — 20 Questions

Question 1

A company wants an internal web server to be reachable consistently from the Internet using one known public IPv4 address. Which NAT approach best fits that requirement?

Accepted Answer

Static NAT. Static NAT is the best fit because it creates a fixed one-to-one relationship between the inside server and the public address. In practical terms, outside clients need a stable public identity for the server. They cannot rely on a translated address that changes session by session. Static NAT gives that predictability.

This is different from PAT, which is designed for many inside users sharing fewer public addresses for outbound traffic. The question is about publishing a server, not conserving addresses for client browsing. That is why static NAT is the strongest answer.

Answer

PAT overload

Answer

No NAT, because private IPv4 addresses are publicly routable

Answer

DHCP relay

Question 2

A router shows the following route:

O    10.10.40.0/24 [110/20] via 192.0.2.2, 00:00:12, GigabitEthernet0/0

What does the value 110 represent?

Accepted Answer

The administrative distance of OSPF. In Cisco route output, the value in brackets is [administrative distance/metric].

Answer

The OSPF cost to the destination

Answer

The number of hops to the destination

Answer

The route age in seconds

Question 3

Which two statements accurately describe why NTP and Syslog are often configured together?

Accepted Answer

Syslog provides event visibility, while NTP helps keep timestamps consistent across devices.. NTP and Syslog are often configured together because logs become much more useful when the device clocks are aligned. In practical terms, Syslog provides the event messages, while NTP helps ensure that the timestamps on those messages are consistent across the environment. That makes troubleshooting and incident analysis more reliable.

This is a very practical operations concept and comes up often in real troubleshooting workflows.

Answer

NTP replaces the need for any event logging.

Answer

Syslog automatically assigns the NTP server address to all devices.

Answer

Both services can be used only on routers, not switches.

Question 4

A user can connect to the employee SSID and receive the correct employee IP subnet, but access to one internal application fails only for that WLAN while wired users succeed. Which troubleshooting area is the strongest first focus?

Accepted Answer

A WLAN-specific policy or filtering rule affecting access to that application. The strongest first focus is the policy or filtering path specific to that WLAN or traffic class. In practical terms, the user has already shown that the correct WLAN join, authentication, and subnet assignment are working. Because wired users succeed and only one application fails from that WLAN, the most likely issue is a WLAN-specific policy, ACL, firewall rule, or path treatment affecting that application.

This is a realistic selective-access troubleshooting scenario and tests whether the candidate narrows the fault domain correctly.

Answer

The SSID broadcast setting

Answer

Whether the access point has a valid hostname

Answer

Whether the client is using PPP instead of Ethernet

Question 5

Exhibit: PCs in VLAN 20 are not receiving addresses from a DHCP server in another subnet. The switch SVI for VLAN 20 is up, and routing is working. Which configuration is most likely missing on the gateway for VLAN 20?

Accepted Answer

ip helper-address 10.99.99.10. DHCP Discover messages are broadcasts and do not cross routers by default. An ip helper-address on the client gateway interface relays those requests to a remote DHCP server.

Answer

ip default-gateway 10.20.20.1

Answer

switchport trunk allowed vlan 20

Answer

spanning-tree portfast default

Question 6

A team wants to know which internal hosts are sending the most traffic to a specific data center subnet. Which technology is most directly associated with that visibility goal?

Accepted Answer

NetFlow. NetFlow is the best fit because it provides visibility into traffic flows and conversations. In practical terms, it helps answer questions like who is talking to whom, over which protocols and ports, and how much traffic is being exchanged. That makes it useful for capacity, troubleshooting, and unusual-traffic analysis.

This is different from Syslog, which reports device events, and from general SNMP polling, which focuses more on device and interface counters.

Answer

Syslog

Answer

DHCP

Answer

PortFast

Question 7

You are connected to R1 via console. R1 is a router that needs to provide DHCP services to hosts on VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). The router has two subinterfaces on GigabitEthernet0/0: G0/0.10 (192.168.10.1/24) and G0/0.20 (192.168.20.1/24) with 802.1Q encapsulation. Configure R1 as a DHCP server for both VLANs, excluding addresses 192.168.10.1-10 and 192.168.20.1-10, with a lease of 1 day. Ensure DNS server 8.8.8.8 is provided.

Accepted Answer

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN10
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 8.8.8.8
 lease 1
ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
 dns-server 8.8.8.8
 lease 1. Ly uses `lease 1` for a 1-day lease, dotted decimal subnet masks, and proper DHCP pool settings. Option B incorrectly uses CIDR notation `/24` in the network command, which IOS does not accept. Option C uses `lease 24`, which is interpreted as 24 days, not 1 day. Option D also incorrectly uses `lease 24`, resulting in a 24-day lease instead of the required 1-day lease.

Answer

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN10
 network 192.168.10.0 /24
 default-router 192.168.10.1
 dns-server 8.8.8.8
 lease 1 0 0
ip dhcp pool VLAN20
 network 192.168.20.0 /24
 default-router 192.168.20.1
 dns-server 8.8.8.8
 lease 1 0 0

Answer

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN10
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 8.8.8.8
 lease 24
ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
 dns-server 8.8.8.8
 lease 24

Answer

ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp excluded-address 192.168.20.1 192.168.20.10
ip dhcp pool VLAN10
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 8.8.8.8
 lease 24
ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1
 dns-server 8.8.8.8
 lease 24

Question 8

You are connected to R1. The network uses a router-on-a-stick design with a single switch (SW1) and two VLANs (10 and 20). Currently, hosts in VLAN 10 cannot ping hosts in VLAN 20, and the trunk between R1 and SW1 shows a native VLAN mismatch. Examine the provided configuration and output, then apply the necessary corrections to R1 so that inter-VLAN routing works correctly.

Accepted Answer

Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.20 to dot1Q 20, and enable IP routing globally.. The configuration has three issues: 1) The native VLAN on the trunk is VLAN 1, but the switch expects VLAN 99 (common mismatch scenario). 2) Subinterface G0/0.20 uses encapsulation dot1Q 10 instead of 20, causing VLAN 20 traffic to be mis-tagged. 3) The 'ip routing' command is missing globally, so R1 cannot route between subinterfaces. To fix, configure the main interface G0/0 with 'encapsulation dot1Q 99 native' to set the native VLAN to 99, correct the encapsulation on G0/0.20 to 'dot1Q 20', and enable IP routing with 'ip routing'.

Answer

Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.20 to dot1Q 20, but do not enable IP routing because it is enabled by default.

Answer

Change the native VLAN on R1's trunk interface to 1, correct the encapsulation on G0/0.20 to dot1Q 20, and enable IP routing globally.

Answer

Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.10 to dot1Q 10, and enable IP routing globally.

Question 9

Which three statements accurately describe the role of Cisco's AI-powered security features (such as Cisco AI Network Analytics, Stealthwatch, or DNA Center's AI-Enhanced Analytics) in network security operations? (Choose three.)

Accepted Answer

AI models can detect zero-day exploits by analyzing behavioral anomalies. Cisco's AI-powered security features detect zero-day exploits by analyzing behavioral anomalies and deviations from learned baselines, without relying on signatures. These systems correlate logs from multiple Cisco products (e.g., firewalls, endpoints, cloud) to uncover multi-step attack chains. AI can also automate responses such as blocking malicious IPs via Cisco security controls, reducing mean time to respond (MTTR). However, AI complements but does not replace traditional security tools like firewall rules or ACLs, and it requires ongoing human oversight for validation and tuning.

Answer

AI is only effective against known, signature-based threats

Answer

AI security models require no human oversight once deployed

Answer

AI eliminates the need for firewall rules and access control lists

Question 10

A router has the following routes in its routing table: a static route to 10.60.4.16/28, an OSPF route to 10.60.4.0/24, and an EIGRP route to 10.60.0.0/16. Which route will be used for a packet destined to 10.60.4.17?

Accepted Answer

The static route to 10.60.4.16/28. The route used will be the route with the longest matching prefix. In practical terms, 10.60.4.17 falls inside the /28 route shown, and that is more specific than the broader /24 and /16 alternatives. Because specificity comes first, the /28 route wins.

This is a clean route-table interpretation problem that mirrors actual exam-style thinking very closely.

Answer

The OSPF route to 10.60.4.0/24

Answer

The EIGRP route to 10.60.0.0/16

Answer

No route at all

Question 11

Drag and drop the following OSPFv2 neighbor state transitions and DR/BDR election steps into the correct order for a multi-access network where a new router joins an existing OSPF area.

Accepted Answer

Down -> Init -> 2-Way -> ExStart -> Exchange -> Loading -> Full. The new router first discovers neighbors via Hello. Then DD, LSR, LSU exchange synchronizes databases. DR/BDR election happens before Full state is achieved.

Answer

Down -> Init -> 2-Way -> ExStart -> Exchange -> Full -> Loading

Answer

Down -> Init -> ExStart -> 2-Way -> Exchange -> Loading -> Full

Answer

Down -> Init -> 2-Way -> Exchange -> ExStart -> Loading -> Full

Question 12

An OSPF router learns a route with metric 20 and another OSPF route to the same destination with metric 30. The prefix length is the same. Which path is preferred?

Accepted Answer

The route with metric 20. The OSPF path with metric 20 is preferred because, within the same routing protocol and for the same prefix length, the metric is used to compare candidate paths. In practical terms, the router is not comparing source trust here because both routes come from OSPF. It is comparing OSPF’s own internal path-cost values, and the lower metric wins.

This question is about separating administrative distance from metric. Since both routes come from the same protocol, metric is the deciding factor.

Answer

The route with metric 30

Answer

Both routes are rejected because the metrics differ

Answer

The default route is preferred

Question 13

A host is assigned 192.168.10.33/28. Which subnet contains that host?

Accepted Answer

192.168.10.32/28. A /28 subnet uses blocks of 16 addresses. In plain language, the last octet ranges move in increments of 16: 0–15, 16–31, 32–47, 48–63, and so on. Since the host address ends in 33, it belongs to the 32–47 block. That means the containing subnet is 192.168.10.32/28.

This style of subnetting question is common because it tests whether you can identify the correct network boundary quickly. The key is to recognize the block size from the prefix and then place the address inside the correct interval without confusing the host with the network address.

Answer

192.168.10.16/28

Answer

192.168.10.48/28

Answer

192.168.10.0/28

Question 14

Two routers are in the same OSPF area and on the same subnet, but they do not form an adjacency. One interface uses a hello interval of 10 seconds and the other uses 5 seconds. What is the most likely cause?

Accepted Answer

The OSPF hello timers do not match.. An OSPF timer mismatch is the most likely cause. In plain language, the routers are trying to discover each other, but they are speaking on different timing expectations. OSPF neighbors on the same segment must agree on certain parameters before they trust each other enough to form an adjacency, and the hello and dead timers are among those critical values.

This is a very common OSPF troubleshooting issue because the interfaces may still be reachable with ping and may even appear correctly addressed and placed in the same area. But OSPF is stricter than simple IP reachability. If the hello interval does not match, the adjacency usually fails before it becomes fully operational.

Answer

The routers need matching hostnames.

Answer

The subnet must be changed to /24 before OSPF can work.

Answer

The routers must both use static routes first.

Question 15

Users report that their PCs take over 30 seconds to obtain IP addresses and reach the network after being powered on. A network technician checks a switch port connected to a PC and observes that the port transitions through blocking, listening, learning, and then forwarding states, taking about 30 seconds to complete. The switch is running standard 802.1D STP. The technician confirms the port is an access port and only connects to a PC. What should the technician do next?

Accepted Answer

Enable PortFast on the access port.. The 30-second delay is caused by the standard 802.1D STP port states (blocking → listening → learning → forwarding). Since the port is an access port connecting only to a PC (an end host), there is no risk of a bridging loop. Enabling PortFast immediately transitions the port to the forwarding state, bypassing the listening and learning states and eliminating the delay.

Answer

Reduce the STP forward delay timer globally on the switch.

Answer

Disable STP on the access VLAN assigned to the port.

Answer

Enable Rapid PVST+ on the switch.

Question 16

A network engineer sends an HTTP GET request to a controller API and receives status code 401. What does that response indicate?

Accepted Answer

Authentication is required or the token is invalid. HTTP 401 means the request is not authorized because valid authentication credentials were not supplied or were rejected. In practice, this usually means the token is missing, expired, malformed, or otherwise invalid.

Answer

The API endpoint does not exist

Answer

The request was successful but returned an empty body

Answer

The server is overloaded and cannot process the request

Question 17

Drag and drop the following steps into the correct order to configure and verify HSRP active/standby election, including priority, preempt, virtual IP, and failover verification.

Accepted Answer

1. Configure interface with IP address and no shutdown
2. Set HSRP priority and preempt
3. Configure HSRP virtual IP
4. Verify HSRP state and failover with 'show standby'. The order ensures the interface is ready, then priority and preempt are set to influence the election, followed by the virtual IP and verification of failover behavior.

Answer

1. Configure HSRP virtual IP
2. Set HSRP priority and preempt
3. Configure interface with IP address and no shutdown
4. Verify HSRP state and failover with 'show standby'

Answer

1. Set HSRP priority and preempt
2. Configure HSRP virtual IP
3. Configure interface with IP address and no shutdown
4. Verify HSRP state and failover with 'show standby'

Answer

1. Configure HSRP virtual IP
2. Configure interface with IP address and no shutdown
3. Set HSRP priority and preempt
4. Verify HSRP state and failover with 'show standby'

Question 18

A switch interface is configured as `dynamic desirable`, and the peer interface is configured as `dynamic auto`. What is the most likely result?

Accepted Answer

The link is likely to become a trunk.. The most likely result is that the link becomes a trunk. In simple terms, `dynamic desirable` actively tries to negotiate a trunk, while `dynamic auto` listens and responds. Because one side is willing to initiate the process, trunking can be established if the rest of the configuration is compatible.

This question tests whether you know the difference between passive and active DTP behavior. The classic failure pairing is auto/auto. Desirable/auto, by contrast, is a normal path to trunk formation.

Answer

The link becomes a routed port.

Answer

All VLANs are deleted from both switches.

Answer

The port is immediately error-disabled.

Question 19

Exhibit: R1 has a default route pointing to 10.1.1.2. Users lose internet access when that next hop fails, even though a floating static backup exists. Why is the backup not installed?

Accepted Answer

The primary static route remains installed because there is no tracking to remove it. A floating static route is used only when the primary route disappears from the routing table. If the primary interface stays up and the next hop becomes unreachable beyond that segment, the route can remain installed unless tracking or another detection mechanism removes it.

Answer

The backup route has a higher administrative distance and therefore is never considered

Answer

Floating statics work only with dynamic routing protocols

Answer

The backup route must use the same next hop as the primary route

Question 20

Which option performs the RESTCONF operations correctly?

Accepted Answer

GET /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0/0 with Accept: application/yang-data+json; then PATCH same URI with Content-Type: application/yang-data+json and body {"ietf-interfaces:interface":{"duplex":"full"}}; expect 204 No Content.. The correct base URI for RESTCONF is /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0/0. The Accept header must be application/yang-data+json. If the Content-Type header is incorrect (e.g., application/json), the router will return a 415 Unsupported Media Type error. Using the wrong YANG module path, such as Cisco-IOS-XE-native:interface/GigabitEthernet0/0, will result in a 404 Not Found because the data model does not match. After a successful GET, the PATCH request must include the same URI with Content-Type: application/yang-data+json and a JSON body specifying "duplex": "full". The response should be a 204 No Content if successful.

Answer

GET /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0/0 with Accept: application/json; then PATCH same URI with Content-Type: application/json and body {"duplex":"full"}; expect 204 No Content.

Answer

GET /restconf/data/Cisco-IOS-XE-native:interface/GigabitEthernet0/0 with Accept: application/yang-data+json; then PATCH same URI with Content-Type: application/yang-data+json and body {"Cisco-IOS-XE-native:interface":{"duplex":"full"}}; expect 204 No Content.

Answer

GET /restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0/0 with Accept: application/yang-data+json; then PATCH same URI with Content-Type: application/yang-data+json and body {"duplex":"full"}; expect 200 OK.