CCNA Practice Exam 59 — 20 Questions

Question 1

You are connected to a multilayer switch MLS1. Configure it so that IP phones connected to FastEthernet 0/1 and FastEthernet 0/2 use voice VLAN 20 and receive power via PoE. Additionally, FastEthernet 0/3 must be configured as an access port for a wireless access point (AP) on VLAN 30, with PoE enabled. Verify your configuration using 'show interfaces switchport' and 'show power inline'.

Accepted Answer

Configure 'switchport voice vlan 20' on Fa0/1 and Fa0/2; ensure PoE is enabled (auto) on all three ports.. The switch ports Fa0/1 and Fa0/2 are currently configured as access ports on VLAN 10, with no voice VLAN. To support IP phones, you must configure a voice VLAN (VLAN 20) on these interfaces. Additionally, PoE is already enabled (auto) but needs to remain active. For Fa0/3, it is already an access port on VLAN 30, which is correct for an AP, but you must ensure PoE is enabled (it is). The missing configuration for Fa0/1 and Fa0/2 is the 'switchport voice vlan 20' command. After applying, verify using 'show interfaces switchport' to see the voice VLAN set, and 'show power inline' to confirm PoE delivery.

Answer

Configure 'switchport mode trunk' on Fa0/1 and Fa0/2, and set the native VLAN to 20; enable PoE on Fa0/3.

Answer

Configure 'switchport access vlan 20' on Fa0/1 and Fa0/2, and 'switchport voice vlan 30' on Fa0/3; enable PoE globally.

Answer

Configure 'power inline never' on Fa0/1 and Fa0/2, and 'switchport voice vlan 20' on Fa0/3; ensure Fa0/3 is in trunk mode.

Question 2

You are troubleshooting inter-VLAN routing on a router-on-a-stick setup. R1 is connected to SW1 via trunk port G0/0. VLANs 10, 20, and 30 exist on SW1, and R1 should route between them. Currently, hosts in VLAN 10 can communicate with VLAN 20 but cannot reach VLAN 30. Review the provided configuration and fix the issue.

Accepted Answer

Change the encapsulation on subinterface G0/0.30 to dot1Q 30 and reapply the IP address.. The subinterface for VLAN 30 (G0/0.30) is misconfigured with encapsulation dot1Q 100 instead of dot1Q 30, so R1 cannot forward packets to VLAN 30. VLAN 20 is correctly set up, which is why VLAN 10-to-VLAN 20 pings succeed. Changing the encapsulation to dot1Q 30 and reapplying the IP address restores full inter-VLAN routing. IP routing is enabled by default, so no additional command is needed; the native VLAN does not require a subinterface because no hosts are in that VLAN.

Answer

Add a subinterface for native VLAN 1 on R1 and assign an IP address.

Answer

Enable IP routing on R1 with the 'ip routing' command.

Answer

Change the allowed VLAN list on the trunk to include VLAN 30.

Question 3

You are connected to SW1. This is a Layer 2 switch that connects multiple IP phones and an AP. The AP is on Gi0/3 and must receive PoE and be placed in VLAN 100 (native VLAN). IP phones on Gi0/1 and Gi0/2 must use VLAN 20 for voice and VLAN 10 for data, and must receive PoE. Currently, the AP cannot get an IP address and the phones have no voice connectivity. Configure SW1 to fix these issues.

Accepted Answer

interface Gi0/1; switchport voice vlan 20; power inline auto; interface Gi0/2; switchport voice vlan 20; power inline auto; interface Gi0/3; power inline auto. The AP on Gi0/3 requires PoE (power inline auto) and must be on a trunk port with native VLAN 100. The current configuration likely lacks PoE, and the port may be set as an access port instead of a trunk. For the IP phones on Gi0/1 and Gi0/2, the missing 'switchport voice vlan 20' command prevents voice traffic from using VLAN 20, and PoE must also be enabled. The provided solution adds the necessary voice VLAN and PoE commands. Option A is correct because it applies voice VLAN 20 and PoE to the phone ports, and PoE to the AP port. Option B incorrectly assigns voice VLAN 10; Option C omits PoE on the AP port; Option D applies PoE globally but fails to set voice VLANs and incorrectly configures trunk native VLAN on all ports.

Answer

interface Gi0/1; switchport voice vlan 10; power inline auto; interface Gi0/2; switchport voice vlan 10; power inline auto; interface Gi0/3; switchport access vlan 100; power inline auto

Answer

interface Gi0/1; switchport voice vlan 20; interface Gi0/2; switchport voice vlan 20; interface Gi0/3; switchport access vlan 100

Answer

interface Gi0/1; power inline auto; interface Gi0/2; power inline auto; interface Gi0/3; power inline auto; switchport trunk native vlan 100

Question 4

You are connected to a multilayer switch MLS1 via the console. Configure MLS1 so that IP phones connected to interface GigabitEthernet0/1 receive power via PoE, use VLAN 10 for data traffic, and use VLAN 20 for voice traffic, while the access port for an AP on GigabitEthernet0/2 should be placed in VLAN 30 and have PoE disabled. Verify your configuration using appropriate show commands.

Accepted Answer

interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 power inline auto
!
interface GigabitEthernet0/2
 switchport mode access
 switchport access vlan 30
 power inline never. For the IP phone port (G0/1), you need to enable PoE (power inline auto) and configure the voice VLAN (switchport voice vlan 20) so that the phone uses VLAN 20 for voice and the access VLAN 10 for data. For the AP port (G0/2), you must change the access VLAN to 30 and disable PoE (power inline never) to prevent powering the AP through the switch. Verify with 'show interfaces switchport' to confirm voice VLAN and access VLAN settings, and 'show power inline' to check PoE status.

Answer

interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 power inline auto
!
interface GigabitEthernet0/2
 switchport mode access
 switchport access vlan 30
 power inline never

Answer

interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 20
 switchport voice vlan 10
 power inline auto
!
interface GigabitEthernet0/2
 switchport mode access
 switchport access vlan 30
 power inline never

Answer

interface GigabitEthernet0/1
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 power inline never
!
interface GigabitEthernet0/2
 switchport mode access
 switchport access vlan 30
 power inline auto

Question 5

You are connected to a multilayer switch MLS1. Configure FastEthernet0/1 as an access port for an IP phone and a PC, with voice VLAN 20 and data VLAN 10. Also enable PoE on the port. Then verify the configuration using 'show interfaces switchport' and 'show power inline'.

Accepted Answer

interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 power inline auto
 no shutdown. Option A is correct because it configures FastEthernet0/1 as an access port with data VLAN 10, voice VLAN 20, and PoE enabled, which is the required setup for an IP phone and PC. Option B is incorrect because 'no switchport' makes the interface a routed port (Layer 3), but it needs to be a Layer 2 access port to support an IP phone and PC. Option C is incorrect because trunk mode is used for switch-to-switch links, not for connecting end devices like an IP phone and PC. Option D is incorrect because 'power inline never' disables PoE, but the IP phone requires power; it should use 'power inline auto'.

Answer

interface FastEthernet0/1
 no switchport
 ip address 192.168.1.1 255.255.255.0
 power inline auto
 no shutdown

Answer

interface FastEthernet0/1
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 power inline auto
 no shutdown

Answer

interface FastEthernet0/1
 switchport mode access
 switchport access vlan 10
 switchport voice vlan 20
 power inline never
 no shutdown

Question 6

You are connected to SW1 via the console. The network uses Rapid-PVST+ and you need to ensure that SW1 becomes the root bridge for VLAN 10 and VLAN 20. Additionally, configure PortFast and BPDU Guard on interface GigabitEthernet0/1, which connects to a workstation. After configuration, the workstation is moved and the port goes err-disabled. Diagnose the cause and recover the port without reloading the switch.

Accepted Answer

Configure spanning-tree vlan 10 priority 4096 and spanning-tree vlan 20 priority 4096. Then on interface GigabitEthernet0/1, configure spanning-tree portfast and spanning-tree bpduguard enable. After removing the BPDU source, use 'shutdown' and 'no shutdown' to recover the port.. SW1 is currently the root for VLAN 10 but not for VLAN 20. To become root for both VLANs, set the spanning-tree priority to a lower value (e.g., 4096) for each VLAN. The port Gi0/1 went err-disabled because it received a BPDU, which is unexpected on a PortFast edge port with BPDU Guard enabled. To recover, first identify and remove the BPDU source (likely another switch connected to that port), then use 'shutdown' followed by 'no shutdown' on the interface to bring it back up.

Answer

Configure spanning-tree vlan 10,20 root primary and spanning-tree portfast on Gi0/1; then use 'errdisable recovery cause bpduguard' to automatically recover the port.

Answer

Configure spanning-tree vlan 10,20 priority 0 and spanning-tree bpduguard enable on Gi0/1; then use 'no spanning-tree bpduguard' to recover the port.

Answer

Configure spanning-tree vlan 10,20 priority 4096 and spanning-tree portfast on Gi0/1; then use 'clear spanning-tree detected-protocols' to recover the port.

Question 7

You are connected to a multilayer switch MLS1. The network has two other switches: SW2 and SW3. The interface GigabitEthernet0/1 already has PortFast and BPDU Guard enabled. Configure MLS1 as the root bridge for VLAN 10 and VLAN 20 using the root primary command. After configuration, verify that the interface is not in err-disabled state and that the root bridge role is correctly assigned.

Accepted Answer

Configure 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary' on MLS1. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.. The interface Gi0/1 already has PortFast and BPDU Guard configured, so no additional configuration is needed for that step. Using 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary' sets the priority to 24576, ensuring MLS1 becomes root for both VLANs. Verify with 'show spanning-tree vlan 10' to see the priority changed and 'show interfaces gigabitEthernet0/1 status' to confirm the port is not err-disabled.

Answer

Configure 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root secondary' on MLS1. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

Answer

Configure 'spanning-tree vlan 10 priority 4096' and 'spanning-tree vlan 20 priority 4096' on MLS1. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

Answer

Configure 'spanning-tree vlan 10 root primary' and 'spanning-tree vlan 20 root primary' on MLS1. Then configure 'spanning-tree portfast default' and 'spanning-tree bpduguard default' globally. Verify with 'show spanning-tree vlan 10' and 'show interfaces gigabitEthernet0/1 status'.

Question 8

You are connected to SW1. The network has three switches (SW1, SW2, SW3) running Rapid-PVST+. SW1 should be the root bridge for VLAN 10. PortFast and BPDU Guard must be enabled on all edge ports connected to end hosts. An err-disabled port (G0/1) has occurred due to a BPDU violation on an edge port. Recover the port and ensure it is configured correctly to prevent recurrence.

Accepted Answer

Enter interface configuration mode for Gi0/1, issue 'shutdown' followed by 'no shutdown', then verify that the connected device is not a switch or remove it from the network.. The port Gi0/1 is in err-disabled state because BPDU Guard disabled it after receiving a BPDU on a PortFast edge port. First, shut down the interface and then re-enable it with 'no shutdown' to recover from err-disabled. However, to prevent recurrence, the root cause must be addressed: the connected device (likely another switch) should not be sending BPDUs on an edge port. Optionally, you can disable BPDU Guard on that specific port if it is not truly an edge port, but the task requires PortFast and BPDU Guard on edge ports. The correct fix is to ensure no BPDUs are sent from the downstream device or use 'spanning-tree bpduguard disable' on that port if it is not an edge port (but the task mandates BPDU Guard). Since the scenario requires BPDU Guard, the candidate should recover the port and then verify that the connected device is not a switch (or remove it from the topology).

Answer

Enter interface configuration mode for Gi0/1, issue 'shutdown' followed by 'no shutdown', then configure 'spanning-tree bpduguard disable' on the interface.

Answer

Enter interface configuration mode for Gi0/1, issue 'shutdown' followed by 'no shutdown', then configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable' on the interface.

Answer

Enter interface configuration mode for Gi0/1, issue 'shutdown' followed by 'no shutdown', then configure 'spanning-tree guard root' on the interface.

Question 9

You are connected to R1, a multilayer switch acting as the root bridge for VLAN 10. The network has experienced a loop, and interface GigabitEthernet0/1 on R1 is currently in err-disabled state due to a BPDU guard violation. Configure the switch to recover automatically from err-disable state after 300 seconds, then verify that the interface comes back up.

Accepted Answer

Configure 'errdisable recovery cause bpduguard' and 'errdisable recovery interval 300' globally, then verify with 'show interfaces status'.. The interface Gi0/1 is in err-disabled state because BPDU Guard detected an unexpected BPDU on a PortFast-enabled access port. To recover automatically, configure errdisable recovery cause bpduguard and set the recovery interval to 300 seconds with errdisable recovery interval 300. After applying these commands, the interface will automatically come out of err-disable state after 300 seconds. The blocking port on Gi0/2 is expected because R1 is the root bridge and Gi0/2 is an alternate port providing redundancy; no action is needed for that blocking state.

Answer

Configure 'spanning-tree portfast bpduguard default' and 'errdisable recovery interval 300' globally, then verify with 'show spanning-tree'.

Answer

Configure 'errdisable recovery cause all' and 'errdisable recovery interval 300' globally, then verify with 'show errdisable recovery'.

Answer

Configure 'errdisable recovery cause bpduguard' and 'errdisable recovery interval 300' on interface GigabitEthernet0/1, then verify with 'show interfaces GigabitEthernet0/1'.

Question 10

You are connected to R1, a Catalyst 3650 multilayer switch running IOS-XE. Configure Root Guard on all designated ports, Loop Guard on uplink interfaces, and BPDU Guard on all PortFast-enabled ports. Troubleshoot the current issue: one port is receiving a superior BPDU and is being blocked by Root Guard, and a different PortFast port has gone err-disabled after BPDU Guard triggered. Verify that Root Guard is active on port Gi1/0/1, Loop Guard is active on Gi1/0/2, and BPDU Guard is enabled on Gi1/0/3.

Accepted Answer

Remove Root Guard from Gi1/0/1 and apply it to Gi1/0/2; remove Loop Guard from Gi1/0/2 and apply it to Gi1/0/1; on Gi1/0/3, issue shutdown then no shutdown; verify Root Guard on Gi1/0/2, Loop Guard on Gi1/0/1, BPDU Guard on Gi1/0/3.. The network requires Root Guard on designated ports, Loop Guard on uplink (root/alternate) ports, and BPDU Guard on PortFast ports. Gi1/0/1 is receiving a superior BPDU and being blocked by Root Guard, indicating Root Guard is misapplied to a non-designated port; it should be moved to the designated port Gi1/0/2. Loop Guard belongs on the uplink port Gi1/0/1, not Gi1/0/2, so the configuration is swapped. The PortFast port Gi1/0/3 experienced a BPDU Guard violation and is err-disabled; recovering it requires a shutdown followed by a no shutdown command, not just no shutdown. Finally, verification must confirm the correct new placement: Root Guard on Gi1/0/2, Loop Guard on Gi1/0/1, and BPDU Guard on Gi1/0/3.

Answer

Remove Root Guard from Gi1/0/1 and apply it to Gi1/0/2; remove Loop Guard from Gi1/0/2 and apply it to Gi1/0/1; on Gi1/0/3, issue no shutdown; verify Root Guard on Gi1/0/2, Loop Guard on Gi1/0/1, BPDU Guard on Gi1/0/3.

Answer

Remove Root Guard from Gi1/0/1 and apply it to Gi1/0/2; remove Loop Guard from Gi1/0/2 and apply it to Gi1/0/1; on Gi1/0/3, issue shutdown then no shutdown; verify Root Guard on Gi1/0/1, Loop Guard on Gi1/0/2, BPDU Guard on Gi1/0/3.

Answer

Remove Root Guard from Gi1/0/1 and apply it to Gi1/0/2; remove Loop Guard from Gi1/0/2 and apply it to Gi1/0/1; on Gi1/0/3, issue shutdown then no shutdown; verify Root Guard on Gi1/0/2, Loop Guard on Gi1/0/2, BPDU Guard on Gi1/0/3.

Question 11

You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on the designated port facing a downstream switch to prevent a rogue switch from becoming root. Also, enable Loop Guard on the uplink port to prevent STP loops, and configure BPDU Guard on a PortFast-enabled access port. Ensure that if a superior BPDU is received on the Root Guard port, it is blocked, and if a BPDU is received on the BPDU Guard port, it goes err-disabled.

Accepted Answer

The configuration is correct; no changes are needed.. R1 is the STP root for VLAN 10. The downstream port (G0/1) is a designated port, so Root Guard is correctly applied to prevent a superior BPDU from being accepted. The uplink port (G0/0) is a root port, so Loop Guard should be applied there to prevent an STP loop if BPDUs stop arriving. The access port (G0/2) has PortFast and BPDU Guard enabled, which will err-disable the port if a BPDU is received. The current configuration is correct; no changes are needed. If a superior BPDU arrives on G0/1, Root Guard will block the port. If a BPDU arrives on G0/2, BPDU Guard will err-disable it.

Answer

Root Guard should be applied on G0/0 instead of G0/1, and Loop Guard on G0/1 instead of G0/0.

Answer

BPDU Guard should be configured on G0/1 instead of G0/2, and Loop Guard should be removed from G0/0.

Answer

Root Guard should be applied on G0/2 instead of G0/1, and BPDU Guard should be removed from G0/2.

Question 12

You are connected to the multilayer switch SW1. Configure Root Guard on the designated port towards the access switch SW2, Loop Guard on the uplink port towards the distribution switch SW3, and BPDU Guard on the PortFast-enabled port connected to a workstation. After configuration, a superior BPDU is received on the designated port, causing it to be blocked by Root Guard. Later, a BPDU is received on the PortFast port, triggering err-disable state. Identify and resolve these issues.

Accepted Answer

Remove Root Guard from interface Gi0/0 and re-enable interface Gi0/2 with a shutdown/no shutdown sequence.. The issue is that Root Guard was incorrectly applied to the designated port (Gi0/0) which should normally be the root port if a superior BPDU is received. Root Guard blocks the port when a superior BPDU arrives, but this is expected on a designated port; instead, Root Guard should be applied to ports that should never become root ports. In this scenario, the superior BPDU is legitimate (from a root bridge with lower priority), so Root Guard should be removed from Gi0/0. For the PortFast port (Gi0/2), BPDU Guard correctly err-disabled the port upon receiving a BPDU, indicating an unauthorized switch connection. To restore the port, you must shut/no shut the interface and then investigate why a BPDU was received. The solution involves removing Root Guard from Gi0/0 and re-enabling Gi0/2 after verifying the connecting device.

Answer

Disable BPDU Guard on interface Gi0/2 and increase the root bridge priority on SW1 to prevent superior BPDUs.

Answer

Apply Root Guard to interface Gi0/2 instead of Gi0/0 and configure Loop Guard on Gi0/0.

Answer

Remove Loop Guard from interface Gi0/1 and configure it on Gi0/0 instead, then re-enable Gi0/2 using the 'errdisable recovery cause bpduguard' command.

Question 13

Drag and drop the following steps into the correct order to troubleshoot a suspected duplex mismatch and CRC errors on an interface using Cisco IOS-XE CLI commands.

Accepted Answer

1. Connect to the device via console or SSH
2. Enter privileged EXEC mode
3. Enter global configuration mode
4. Use 'interface' command to enter the specific interface
5. Use 'duplex full' to set duplex manually
6. Use 'speed 100' to set speed manually
7. Use 'end' to exit configuration mode
8. Use 'show interfaces' to check for CRC errors and duplex mismatch
9. Use 'copy running-config startup-config' to save. First, access the device and enter privileged mode, then run 'show interfaces' to diagnose CRC errors and confirm a duplex mismatch. Next, enter configuration mode and set the speed manually before duplex; setting speed first prevents the duplex from reverting to auto. Finally, exit configuration mode and save the running config to ensure the change persists.

Answer

1. Connect to the device via console or SSH
2. Enter privileged EXEC mode
3. Use 'show interfaces' to check for CRC errors and duplex mismatch
4. Enter global configuration mode
5. Use 'interface' command to enter the specific interface
6. Use 'duplex full' to set duplex manually
7. Use 'speed 100' to set speed manually
8. Use 'end' to exit configuration mode
9. Use 'copy running-config startup-config' to save

Question 14

You are connected to R1 via console. R1 is a router that should restrict SSH access to only the management station at 192.168.1.100. Currently, SSH is enabled but any IP can connect. Configure a standard named ACL called 'SSH_ACL' to permit only the management station, and apply it to the VTY lines to filter incoming SSH connections. Ensure the VTY lines use SSH only (no Telnet). The SSH version should be set to 2.

Accepted Answer

R1(config)# ip access-list standard SSH_ACL
R1(config-std-nacl)# permit host 192.168.1.100
R1(config-std-nacl)# deny any
R1(config-std-nacl)# exit
R1(config)# line vty 0 4
R1(config-line)# ip access-class SSH_ACL in
R1(config-line)# transport input ssh
R1(config)# ip ssh version 2. The standard ACL restricts inbound connections to the VTY lines. Applying it with 'ip access-class in' filters incoming Telnet/SSH sessions. Setting 'transport input ssh' disables Telnet, and 'ip ssh version 2' ensures secure SSH version 2.

Answer

R1(config)# access-list SSH_ACL permit 192.168.1.100
R1(config)# line vty 0 4
R1(config-line)# access-group SSH_ACL in
R1(config-line)# transport input ssh
R1(config)# ip ssh version 2

Answer

R1(config)# ip access-list standard SSH_ACL
R1(config-std-nacl)# permit 192.168.1.100
R1(config)# line vty 0 4
R1(config-line)# ip access-class SSH_ACL out
R1(config-line)# transport input ssh
R1(config)# ip ssh version 2

Answer

R1(config)# access-list SSH_ACL permit 192.168.1.100
R1(config)# line vty 0 4
R1(config-line)# ip access-class SSH_ACL in
R1(config-line)# transport input all
R1(config)# ip ssh version 2

Question 15

You are connected to R1. Configure IPv4 and IPv6 static routes so that R1 can reach the loopback networks on R2 (192.0.2.0/24 and 2001:db8:1::/32) via G0/0. Also, configure a floating static default route via G0/1 (next-hop 203.0.113.2) with an administrative distance of 200 so that it is only used if the directly connected default route fails. The current configuration has a recursive routing failure for the IPv6 route and a missing default route.

Accepted Answer

ip route 0.0.0.0 0.0.0.0 203.0.113.2 200
ipv6 route 2001:db8:1::/32 GigabitEthernet0/0. The IPv6 static route uses a next-hop address (2001:db8:0:1::2) that is not directly connected; the router will attempt recursive lookup but fails because there is no route to that subnet. The fix is to use the exit interface (GigabitEthernet0/0) instead. The IPv4 default route is present but has AD 1, which prevents it from being a floating route; change it to AD 200 so it only activates when the connected default route (if any) is down. The task did not require a connected default route, so the floating static is the only default.

Answer

ip route 0.0.0.0 0.0.0.0 203.0.113.2 200
ipv6 route 2001:db8:1::/32 2001:db8:0:1::2

Answer

ip route 0.0.0.0 0.0.0.0 203.0.113.2
ipv6 route 2001:db8:1::/32 GigabitEthernet0/0

Answer

ip route 0.0.0.0 0.0.0.0 203.0.113.2 200
ipv6 route 2001:db8:1::/32 2001:db8:0:1::2 200

Question 16

You are connected to R1 via the console. R1's GigabitEthernet0/0 (192.168.1.1/24) connects to the management network, and GigabitEthernet0/1 (10.0.0.1/30) connects to the core. You need to restrict SSH access to R1 from only the management subnet 192.168.1.0/24. Additionally, SSH should be configured with a domain name 'example.com' and a modulus of 2048 bits. The username 'admin' with password 'Cisco123' should be created for SSH login.

Accepted Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT in
 transport input ssh
 login local
 username admin secret Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048. SSH requires RSA keys for encryption. The access-class applies an ACL to incoming VTY connections, allowing only the management subnet. Setting 'transport input ssh' disables less secure protocols like Telnet.

Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT out
 transport input ssh
 login local
 username admin secret Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048

Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT in
 transport input telnet ssh
 login local
 username admin secret Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048

Answer

ip access-list standard MGMT permit 192.168.1.0 0.0.0.255
line vty 0 4
 access-class MGMT in
 transport input ssh
 login local
 username admin password Cisco123
ip domain-name example.com
crypto key generate rsa modulus 2048

Question 17

You are connected to a multilayer switch MLS1. Configure a static default route for IPv4 that points to next-hop 192.0.2.2, but also configure a floating static default route with an administrative distance of 10 that uses next-hop 198.51.100.2. Additionally, configure a static host route for IPv6 host 2001:db8:1::10/128 via next-hop 2001:db8:1::1. The current configuration has a recursive routing failure for the IPv4 default route because the next-hop 192.0.2.2 is not reachable; you must first fix that by adding a directly connected static route. Ensure the floating route becomes active only when the primary route fails.

Accepted Answer

ip route 0.0.0.0 0.0.0.0 192.0.2.2
ip route 0.0.0.0 0.0.0.0 198.51.100.2 10
ip route 192.0.2.0 255.255.255.252 GigabitEthernet0/0 192.0.2.2
ipv6 route 2001:db8:1::10/128 2001:db8:1::1. The IPv4 primary default route fails because next-hop 192.0.2.2 is not directly connected and no recursive route exists to it. The floating static route with next-hop 198.51.100.2 is in the directly connected Vlan20 subnet (198.51.100.1/30), so it installs without issue. To fix the primary default route, add a directly connected static route for the network containing 192.0.2.2, e.g., ip route 192.0.2.0 255.255.255.252 GigabitEthernet0/0 192.0.2.2. The IPv6 host route is correct if next-hop 2001:db8:1::1 is reachable.

Answer

ip route 0.0.0.0 0.0.0.0 192.0.2.2
ip route 0.0.0.0 0.0.0.0 198.51.100.2 10
ip route 192.0.2.0 255.255.255.0 GigabitEthernet0/0
ipv6 route 2001:db8:1::10/128 2001:db8:1::1

Answer

ip route 0.0.0.0 0.0.0.0 192.0.2.2
ip route 0.0.0.0 0.0.0.0 198.51.100.2 10
ip route 192.0.2.2 255.255.255.255 GigabitEthernet0/0
ipv6 route 2001:db8:1::10/128 2001:db8:1::1

Answer

ip route 0.0.0.0 0.0.0.0 192.0.2.2
ip route 0.0.0.0 0.0.0.0 198.51.100.2 10
ip route 192.0.2.0 255.255.255.252 198.51.100.2
ipv6 route 2001:db8:1::10/128 2001:db8:1::1

Question 18

You are connected to R1 via console. R1 must reach the remote loopback 2001:db8:1::1/128 on R3 via R2 (2001:db8:0:2::2/64). Currently, IPv6 ping fails. Additionally, configure a floating static default route via R2 (198.51.100.2/30) with an appropriate AD so that it only becomes active if a dynamic default route (with default AD 1) is absent. Identify and fix the recursive routing failure, correct the next-hop, set the correct AD, and ensure the default route is present.

Accepted Answer

Change the IPv6 static route to '2001:db8:1::1/128 GigabitEthernet0/1 2001:db8:0:2::2' and set the floating default route's AD to 254.. The original IPv6 static route uses the next-hop 2001:db8:0:2::1, which is R1's own G0/1 address, causing a routing loop. Correct the route by specifying a directly connected remote next-hop (2001:db8:0:2::2) either with or without the exit interface. Set the floating static default route with an AD higher than the dynamic route's default AD (e.g., 254) so it becomes a backup. Option A (exit interface + next-hop) and Option D (next-hop only) both achieve this; Options B and C fail due to wrong next-hop or AD.

Answer

Change the IPv6 static route to '2001:db8:1::1/128 2001:db8:0:2::1' and set the floating default route's AD to 1.

Answer

Change the IPv6 static route to '2001:db8:1::1/128 GigabitEthernet0/1 2001:db8:0:2::2' and set the floating default route's AD to 1.

Question 19

You are connected to R1 via console. R1 must forward traffic to the 203.0.113.0/24 and 2001:db8:1::/48 networks through R2 (10.0.0.2/30, 2001:db8:ff::2/64). The primary path must use a next-hop of 10.0.0.2 for IPv4 and 2001:db8:ff::2 for IPv6. Additionally, configure a floating static default route for IPv4 that uses R3 (192.0.2.2/30) as a backup only when the primary path fails. The current configuration has errors: the IPv4 static route points to a wrong next-hop (10.0.0.5) and the primary default route is missing, causing the floating route (AD 100) to become active instead of serving as a backup. Fix these issues so that both primary and backup routes work correctly.

Accepted Answer

Change the next-hop of the static route to 203.0.113.0/24 from 10.0.0.5 to 10.0.0.2, and add a default route 0.0.0.0/0 via 10.0.0.2 with AD 1. Keep the floating default route 0.0.0.0/0 via 192.0.2.2 with AD 100.. The IPv4 static route to 203.0.113.0/24 used a next-hop of 10.0.0.5, which is not a directly connected interface (R1's G0/0 is 10.0.0.1/30, so only .2 is valid). This caused a recursive lookup failure. The floating static default route had AD 100, but a floating route must have an AD higher than the primary route's AD (typically 1) so it is only used when the primary fails; setting AD 100 is correct for backup, but the primary default route was missing. The fix: change the next-hop for 203.0.113.0/24 to 10.0.0.2, and add a primary default route with AD 1 via 10.0.0.2. The floating route's AD of 100 is fine as backup. IPv6 route was correct.

Answer

Change the next-hop of the static route to 203.0.113.0/24 from 10.0.0.5 to 10.0.0.2, and change the administrative distance of the floating default route from 100 to 1 so it becomes the primary default route.

Answer

Change the next-hop of the static route to 203.0.113.0/24 from 10.0.0.5 to 10.0.0.2, and change the administrative distance of the floating default route from 100 to 255 so it is never used.

Answer

Change the next-hop of the static route to 203.0.113.0/24 from 10.0.0.5 to 10.0.0.2, and remove the floating default route because it is unnecessary.

Question 20

You are connected to R1. Configure static routes so that R1 can reach the IPv4 network 203.0.113.0/24 and the IPv6 network 2001:db8:acad:1::/64 via R2 (G0/0 10.0.0.2/30). Additionally, configure a floating static default route (IPv4) with an administrative distance of 200 via R2, and a fully specified IPv6 default route via R2. Then, verify that the IPv4 static route to 203.0.113.0/24 is correctly installed by checking the routing table. The current configuration has an incorrect next-hop causing recursive routing failure for the IPv4 static route.

Accepted Answer

Change the IPv4 static route next-hop from 10.0.0.1 to 10.0.0.2, change the IPv6 static route next-hop from 10.0.0.2 to 2001:db8:acad:2::2, and change the IPv6 default route to use next-hop 2001:db8:acad:2::2.. The IPv4 static route to 203.0.113.0/24 incorrectly uses next-hop 10.0.0.1 (R1's own interface) instead of 10.0.0.2 (R2), causing recursive routing failure because R1 tries to reach itself. To fix, change the next-hop to 10.0.0.2. The IPv6 static route to 2001:db8:acad:1::/64 also incorrectly uses an IPv4 next-hop; it must be a fully specified IPv6 next-hop (2001:db8:acad:2::2) or an exit interface. The IPv4 default route has AD 200 which is correct for a floating route, but it is not shown in the routing table because there is no route to the next-hop; after fixing the recursive route, the default route will appear. The IPv6 default route uses an IPv4 next-hop which is invalid; it should be a fully specified IPv6 route (e.g., ipv6 route ::/0 2001:db8:acad:2::2).

Answer

Change the IPv4 static route next-hop from 10.0.0.1 to 10.0.0.2, and change the IPv6 static route to use exit interface G0/0 instead of a next-hop.

Answer

Change the IPv4 static route next-hop from 10.0.0.1 to 10.0.0.2, and change the IPv4 default route administrative distance to 1.

Answer

Change the IPv4 static route next-hop from 10.0.0.1 to 10.0.0.2, and change the IPv6 default route to use exit interface G0/0.

CCNA Practice Exam 59 — 20 Questions

Exhibit

CCNA Practice Exam 59 — 20 Questions

Exhibit