CCNA Practice Exam 58 — 20 Questions

Question 1

A switch receives superior BPDUs on a port where the design requires that no downstream device ever become the root path for that segment. Which feature is the best fit for that requirement?

Accepted Answer

Root guard. Root guard is the best fit because it is designed to prevent a port from becoming the path toward a new root bridge when superior BPDUs are received. In practical terms, it protects the intended STP topology by keeping that port from taking on a root-related forwarding role when the design says it should not.

This is different from BPDU Guard, which is more commonly used on edge ports to disable them entirely if BPDUs appear. Root guard is about protecting topology roles, not just edge-port assumptions.

Answer

BPDU Guard

Answer

Port security

Answer

DHCP Snooping

Question 2

Which two actions help protect access-layer switch ports from rogue DHCP servers?

Accepted Answer

Enable DHCP snooping globally and for the needed VLANs. DHCP snooping marks trusted and untrusted interfaces and filters server-type DHCP messages on untrusted ports. Uplink ports toward the real DHCP server or relay are typically trusted, while user-facing ports stay untrusted. Option C is incorrect because PortFast does not filter DHCP messages; it only speeds up spanning tree convergence. Option D is incorrect because disabling ARP breaks normal communication and does not block DHCP. Option E is incorrect because marking all access ports as trusted would permit rogue DHCP servers on those ports.

Answer

Enable PortFast on all trunks to block rogue servers

Answer

Disable ARP on access ports

Answer

Set every access port as trusted

Question 3

Which TWO statements correctly describe the causes or implications of CRC errors, runts, giants, or output errors as seen in the output of 'show interface' or 'show interface status'?

Accepted Answer

A high number of runts on an interface typically indicates excessive collisions or a faulty NIC.. Runts—frames smaller than 64 bytes—often result from collisions truncating frames on half-duplex links or a faulty NIC. Option D is correct because duplex mismatch can cause late collisions, which appear as output errors in 'show interface'; a device on one side full-duplex and the other half-duplex leads to collisions and framing errors. Option A is wrong because CRC errors can stem from faulty cabling, interference, or a mismatched NIC, not exclusively a bad switch port. Option C is wrong because giants (frames over maximum MTU) may be forwarded if the interface is configured with jumbo frames or the switch is set to accept oversize frames. Option E is wrong because 'show controllers' displays frame-size errors like runts and giants, including details beyond CRC errors.

Answer

CRC errors are always caused by a faulty switch port and require port replacement.

Answer

Giants are frames that exceed the maximum transmission unit (MTU) and are always discarded by the switch.

Answer

The 'show controllers' command provides a detailed view of CRC errors but does not show runts or giants.

Question 4

Which TWO commands would a network engineer use to verify that a Windows client has received an IP address from a DHCP server and can resolve a domain name to an IP address?

Accepted Answer

ipconfig /all. `ipconfig /all` displays the full TCP/IP configuration for all adapters, including whether the IP address was obtained from a DHCP server (the DHCP Enabled and DHCP Server fields). Option D is correct because `nslookup www.courseiva.com` queries the configured DNS server to resolve the domain name to an IP address, confirming DNS resolution works.

Answer

ping 8.8.8.8

Answer

tracert www.courseiva.com

Answer

arp -a

Question 5

Exhibit: After a new switch was connected, the access-layer port went into err-disabled state immediately. Which feature most likely caused this?

Accepted Answer

BPDU Guard. BPDU Guard is the most likely cause because it immediately places a PortFast-enabled port into the err-disabled state upon receiving any BPDU, which is exactly what happens when a new switch is connected to an access port meant for end devices. Root Guard does not err-disable a port; instead, it puts the port into a root-inconsistent state when a superior BPDU is received, preventing the port from becoming a root port but still allowing traffic. UDLD aggressive can cause err-disabled states, but it is specifically designed to detect unidirectional links on fiber connections and requires a delay or misconfiguration, making it less immediate than BPDU Guard in this scenario. Storm control can err-disable a port if traffic exceeds thresholds, but this is not immediate upon connection unless a broadcast storm is already occurring, which is not indicated in the scenario.

Answer

Root Guard

Answer

UDLD aggressive

Answer

Storm control

Question 6

Which traffic type is typically most sensitive to delay and jitter and is commonly prioritized with QoS?

Accepted Answer

Voice traffic. Voice traffic is highly sensitive to delay, jitter, and packet loss, so it is commonly prioritized in QoS policies.

Answer

Bulk backup traffic

Answer

Email attachments

Answer

Operating system updates

Question 7

R1 has the following static route configured:

ip route 0.0.0.0 0.0.0.0 203.0.113.1

What does this route accomplish?

Accepted Answer

It creates a default route used when no more specific route exists.. This command creates a default static route. In everyday terms, it tells the router, “If you do not know a more specific way to reach a destination, send the traffic to 203.0.113.1.” That next-hop address usually points toward an upstream router or ISP edge. The command does not describe one specific remote network; it represents every destination not otherwise matched by a more specific entry.

At the routing-table level, `0.0.0.0 0.0.0.0` is the broadest possible IPv4 prefix. Because it matches everything, it is used only when nothing more specific exists.

Answer

It blocks unknown destinations from leaving the router.

Answer

It creates a host route to 203.0.113.1 only.

Answer

It advertises all connected routes into OSPF.

Question 8

A host has a valid IP address and subnet mask from DHCP but cannot reach remote networks because no gateway was provided. What is the best explanation?

Accepted Answer

The host has no next-hop gateway for traffic destined outside its local subnet.. The best explanation is that the host has no next-hop path for off-subnet traffic. In plain language, the device knows what its own local network looks like, but it does not know where to send packets when the destination is outside that local range. Without a default gateway, remote communication usually fails even though local communication can still work.

This is a core host-configuration concept. The correct answer is the one focused on the absence of a next hop for remote destinations.

Answer

The host cannot use ARP on the local network anymore.

Answer

The host automatically becomes part of every remote subnet.

Answer

The host must convert its access port into a trunk.

Question 9

A network team wants visibility into which flows are consuming the most bandwidth between internal subnets. Which technology is most directly associated with that goal?

Accepted Answer

NetFlow. NetFlow provides visibility into traffic flows, allowing administrators to identify which flows (e.g., between internal subnets) are consuming the most bandwidth by showing source/destination, protocols, and traffic volume. Syslog only records system logs and events, not flow-level data. DHCP relay forwards DHCP broadcasts across subnets but offers no traffic analysis. PortFast is an STP optimization that speeds up port transition to forwarding; it does not monitor bandwidth usage.

Answer

Syslog

Answer

DHCP relay

Answer

PortFast

Question 10

A router is configured for PAT using the WAN interface address. Which command element is most directly associated with allowing many internal users to share that single outside address?

Accepted Answer

overload. The `overload` element is the critical part. In plain language, that keyword tells the router to perform Port Address Translation so many inside sessions can be represented through the same outside IP address at the same time. Without overload, the router would be performing a different translation behavior and would not achieve the same many-to-one sharing model.

This is one of the most recognizable NAT design terms in CCNA because it directly distinguishes PAT from simple one-to-one translation methods. The correct answer is the part of the configuration that signals multi-session sharing through port tracking.

Answer

inside

Answer

list 1

Answer

interface

Question 11

Drag and drop the following steps into the correct order to configure IPv4 and IPv6 static routes, a default route, and a floating static route with higher administrative distance, then verify the routing tables.

Accepted Answer

Configure specific IPv4 and IPv6 static routes, then configure the default route and floating static route with higher AD, then verify routing tables.. The correct order is to first configure specific IPv4 and IPv6 static routes, then configure the default route and the floating static route with higher administrative distance (the order between these two can be interchanged but typically default is configured before the floating static), and finally verify the routing tables with show ip route and show ipv6 route. Option A correctly follows this sequence. Options B, C, and D are incorrect because they either place verification before configuration, configure the default route before specific routes, or configure the floating static route first.

Answer

Configure the default route first, then specific static routes, then the floating static route, then verify routing tables.

Answer

Configure the floating static route first, then specific static routes, then the default route, then verify routing tables.

Answer

Verify routing tables first, then configure specific static routes, then the default route, then the floating static route.

Question 12

Based on the exhibit, which configuration should be added to restore DHCP service for clients in VLAN 30?

Accepted Answer

ip helper-address 10.99.99.20 under interface Vlan30. The correct fix is to add an IP helper address pointing to the remote DHCP server on the Layer 3 interface for VLAN 30. In practical terms, the clients are sending DHCP discovery as a broadcast, and the server is on another subnet. The SVI for VLAN 30 is the local gateway that must relay those requests toward the server.

This is one of the most exam-realistic campus troubleshooting scenarios because it tests both subnet boundaries and the role of the local gateway interface.

Answer

switchport mode trunk under interface Vlan30

Answer

ip default-gateway 10.99.99.20 under interface Vlan30

Answer

spanning-tree portfast under interface Vlan30

Question 13

Which two statements accurately describe why NetFlow is useful for operations teams?

Accepted Answer

It helps identify which conversations or applications contribute to link utilization.. NetFlow is useful because it helps teams move beyond simple interface utilization and see which traffic conversations are responsible for usage. In practical terms, it can reveal which hosts, protocols, or applications are contributing to the traffic profile, making it valuable for troubleshooting, capacity planning, and security investigations. Option E is incorrect because NetFlow does not eliminate the usefulness of Syslog; Syslog provides device event logging while NetFlow provides traffic flow data, and both tools complement each other in network operations.

Answer

It replaces the need for all routing protocols.

Answer

It is the main wireless encryption protocol for guest access.

Answer

It eliminates the usefulness of Syslog.

Question 14

SW2 receives the following STP details for VLAN 10: The root bridge ID is 32768:0001.0001.0001 (SW1), and SW2's bridge ID is 32768:0002.0002.0002. Its interface Gi0/1 has a path cost of 4 to the root, while Gi0/2 has a path cost of 19. Based on this information, which statement is correct?

Accepted Answer

Gi0/1 on SW2 is the root port.. The root bridge has the lowest bridge ID. SW1 is the root because its bridge ID is lower than SW2's local bridge ID. On a non-root switch, the port with the best path toward the root becomes the root port, so Gi0/1 is the root port here.

Answer

SW2 is the root bridge for VLAN 10.

Answer

All SW2 ports in VLAN 10 must be designated ports.

Answer

STP is disabled because the priorities are equal.

Question 15

Which two statements accurately describe why DNS issues can look like general connectivity problems to users?

Accepted Answer

Users often access services by name, so failed name resolution can feel like total connectivity loss.. DNS issues can look like general connectivity problems because many users think in terms of names, not IP addresses. In practical terms, they may report that 'the network is down' when the actual routed path works but hostname resolution does not. That is why testing by IP versus name is such a useful troubleshooting step.

The distinction between transport reachability and naming is critical in user-facing support.

Answer

DNS failure automatically means the default gateway is missing.

Answer

If DNS fails, DHCP and NTP must also fail immediately.

Answer

DNS replaces the need for routing between subnets.

Question 16

On a router performing NAT, where should ip nat inside be applied?

Accepted Answer

On the interface facing the internal private network. The inside designation belongs on the interface facing the private internal network. The outside designation belongs on the interface facing the public or external network.

Answer

On the interface facing the ISP only

Answer

On every routed interface on the router

Answer

Only on loopback interfaces

Question 17

Exhibit: Users on the inside network can open connections to a web server in the DMZ, but return traffic is denied by an ACL on the outside interface. Which statement best explains the issue?

Accepted Answer

The ACL should match the source port 80 on returning traffic, not the destination port 80. An ACL applied inbound on the outside interface will evaluate the return traffic entering from the DMZ or outside toward the router. If it permits only destination port 80 inbound, the returning packets will not match because their destination is an ephemeral client port, not 80.

Answer

HTTP traffic can never be filtered with a standard ACL

Answer

The ACL must be applied outbound on the inside interface only

Answer

NAT automatically bypasses interface ACLs

Question 18

Users on a new access switch can reach devices in their own VLAN but cannot reach the default gateway on the distribution switch. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 30 is missing from the allowed VLAN list on the trunk.. The trunk allows only VLANs 10 and 20, so VLAN 30 traffic never crosses the uplink. Local switching inside VLAN 30 on the access switch can still work, which is why same-VLAN communication succeeds. Adding VLAN 30 to the allowed list is the direct fix.

Answer

The user ports should be configured as trunks.

Answer

The SVI for VLAN 30 must be shutdown for inter-VLAN routing to work.

Answer

The trunk native VLAN must be changed to VLAN 30.

Question 19

An engineer wants remote administrative access to remain available but also wants session contents protected in transit. Which management choice best supports that goal?

Accepted Answer

SSH. The best choice is SSH because it provides encrypted remote administrative access. In plain language, the engineer wants administrators to keep managing devices remotely, but without exposing credentials or session contents in clear text. SSH solves that by protecting the traffic in transit, which is why it is preferred over older plaintext protocols such as Telnet.

This is a core management-plane security principle. The goal is not to remove remote administration, but to perform it safely. The correct answer is the one that aligns with secure remote access rather than convenience at the expense of protection.

Answer

Telnet

Answer

Open wireless access

Answer

Native VLAN 1

Question 20

Which two statements accurately describe ACL behavior on Cisco devices?

Accepted Answer

ACL entries are processed from top to bottom until a match is found.. ACL questions often depend on understanding how Cisco devices process entries line by line. In plain language, ACL entries are evaluated from top to bottom, and the first matching statement decides the result. If traffic reaches the end without matching a permit, it is denied by the implicit deny. These two ideas explain many real ACL troubleshooting cases.

The wrong answers often sound plausible because they borrow language from other parts of networking. But ACLs do not normally evaluate all lines before choosing, and they do not end with an implicit permit. Once you remember “first match wins” and “implicit deny at the end,” many access-list questions become much easier.

Answer

ACLs always evaluate every line before deciding the action.

Answer

ACLs end with an implicit permit unless configured otherwise.

Answer

ACLs apply only to Layer 1 traffic and not IP packets.