CCNA Practice Exam 59 — 20 Questions

Question 1

Based on the exhibit, which configuration should be added to restore DHCP service for clients in VLAN 30?

Accepted Answer

ip helper-address 10.99.99.20 under interface Vlan30. The correct fix is to add an IP helper address pointing to the remote DHCP server on the Layer 3 interface for VLAN 30. In practical terms, the clients are sending DHCP discovery as a broadcast, and the server is on another subnet. The SVI for VLAN 30 is the local gateway that must relay those requests toward the server.

This is one of the most exam-realistic campus troubleshooting scenarios because it tests both subnet boundaries and the role of the local gateway interface.

Answer

switchport mode trunk under interface Vlan30

Answer

ip default-gateway 10.99.99.20 under interface Vlan30

Answer

spanning-tree portfast under interface Vlan30

Question 2

Which two statements accurately describe why NetFlow is useful for operations teams?

Accepted Answer

It helps identify which conversations or applications contribute to link utilization.. NetFlow is useful because it helps teams move beyond simple interface utilization and see which traffic conversations are responsible for usage. In practical terms, it can reveal which hosts, protocols, or applications are contributing to the traffic profile, making it valuable for troubleshooting, capacity planning, and security investigations. Option E is incorrect because NetFlow does not eliminate the usefulness of Syslog; Syslog provides device event logging while NetFlow provides traffic flow data, and both tools complement each other in network operations.

Answer

It replaces the need for all routing protocols.

Answer

It is the main wireless encryption protocol for guest access.

Answer

It eliminates the usefulness of Syslog.

Question 3

SW2 receives the following STP details for VLAN 10: The root bridge ID is 32768:0001.0001.0001 (SW1), and SW2's bridge ID is 32768:0002.0002.0002. Its interface Gi0/1 has a path cost of 4 to the root, while Gi0/2 has a path cost of 19. Based on this information, which statement is correct?

Accepted Answer

Gi0/1 on SW2 is the root port.. The root bridge has the lowest bridge ID. SW1 is the root because its bridge ID is lower than SW2's local bridge ID. On a non-root switch, the port with the best path toward the root becomes the root port, so Gi0/1 is the root port here.

Answer

SW2 is the root bridge for VLAN 10.

Answer

All SW2 ports in VLAN 10 must be designated ports.

Answer

STP is disabled because the priorities are equal.

Question 4

Which two statements accurately describe why DNS issues can look like general connectivity problems to users?

Accepted Answer

Users often access services by name, so failed name resolution can feel like total connectivity loss.. DNS issues can look like general connectivity problems because many users think in terms of names, not IP addresses. In practical terms, they may report that 'the network is down' when the actual routed path works but hostname resolution does not. That is why testing by IP versus name is such a useful troubleshooting step.

The distinction between transport reachability and naming is critical in user-facing support.

Answer

DNS failure automatically means the default gateway is missing.

Answer

If DNS fails, DHCP and NTP must also fail immediately.

Answer

DNS replaces the need for routing between subnets.

Question 5

On a router performing NAT, where should ip nat inside be applied?

Accepted Answer

On the interface facing the internal private network. The inside designation belongs on the interface facing the private internal network. The outside designation belongs on the interface facing the public or external network.

Answer

On the interface facing the ISP only

Answer

On every routed interface on the router

Answer

Only on loopback interfaces

Question 6

Exhibit: Users on the inside network can open connections to a web server in the DMZ, but return traffic is denied by an ACL on the outside interface. Which statement best explains the issue?

Accepted Answer

The ACL should match the source port 80 on returning traffic, not the destination port 80. An ACL applied inbound on the outside interface will evaluate the return traffic entering from the DMZ or outside toward the router. If it permits only destination port 80 inbound, the returning packets will not match because their destination is an ephemeral client port, not 80.

Answer

HTTP traffic can never be filtered with a standard ACL

Answer

The ACL must be applied outbound on the inside interface only

Answer

NAT automatically bypasses interface ACLs

Question 7

Users on a new access switch can reach devices in their own VLAN but cannot reach the default gateway on the distribution switch. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 30 is missing from the allowed VLAN list on the trunk.. The trunk allows only VLANs 10 and 20, so VLAN 30 traffic never crosses the uplink. Local switching inside VLAN 30 on the access switch can still work, which is why same-VLAN communication succeeds. Adding VLAN 30 to the allowed list is the direct fix.

Answer

The user ports should be configured as trunks.

Answer

The SVI for VLAN 30 must be shutdown for inter-VLAN routing to work.

Answer

The trunk native VLAN must be changed to VLAN 30.

Question 8

An engineer wants remote administrative access to remain available but also wants session contents protected in transit. Which management choice best supports that goal?

Accepted Answer

SSH. The best choice is SSH because it provides encrypted remote administrative access. In plain language, the engineer wants administrators to keep managing devices remotely, but without exposing credentials or session contents in clear text. SSH solves that by protecting the traffic in transit, which is why it is preferred over older plaintext protocols such as Telnet.

This is a core management-plane security principle. The goal is not to remove remote administration, but to perform it safely. The correct answer is the one that aligns with secure remote access rather than convenience at the expense of protection.

Answer

Telnet

Answer

Open wireless access

Answer

Native VLAN 1

Question 9

Which two statements accurately describe ACL behavior on Cisco devices?

Accepted Answer

ACL entries are processed from top to bottom until a match is found.. ACL questions often depend on understanding how Cisco devices process entries line by line. In plain language, ACL entries are evaluated from top to bottom, and the first matching statement decides the result. If traffic reaches the end without matching a permit, it is denied by the implicit deny. These two ideas explain many real ACL troubleshooting cases.

The wrong answers often sound plausible because they borrow language from other parts of networking. But ACLs do not normally evaluate all lines before choosing, and they do not end with an implicit permit. Once you remember “first match wins” and “implicit deny at the end,” many access-list questions become much easier.

Answer

ACLs always evaluate every line before deciding the action.

Answer

ACLs end with an implicit permit unless configured otherwise.

Answer

ACLs apply only to Layer 1 traffic and not IP packets.

Question 10

Which two statements accurately describe Syslog in a Cisco network environment?

Accepted Answer

Syslog can send device event messages to a centralized logging server.. Syslog is used to centralize device event messages such as warnings, errors, and informational entries. In plain language, it gives administrators one place to review what devices are reporting rather than checking each device individually. This makes troubleshooting and incident review easier, especially in larger environments. Syslog does not replace time synchronization, but it becomes much more useful when paired with NTP so timestamps are consistent.

A common trap is to assume Syslog is a routing protocol or a DHCP-like service. It is neither. It is about event reporting and centralized logging.

Answer

Syslog is primarily used to assign IP addresses to hosts.

Answer

Syslog automatically prevents switching loops.

Answer

Syslog replaces the need for any monitoring system.

Question 11

Match each API workflow concept to the description that best fits it.

Accepted Answer

REST is a stateless architectural style that uses standard HTTP methods and typically exchanges data in JSON or XML format.. Ly defines REST as a stateless architectural style using standard HTTP methods (GET, POST, PUT, DELETE) and typically exchanging data in JSON or XML. Option B is incorrect because SOAP uses XML, not JSON, and is not lightweight; it is a protocol with strict standards. Option C is incorrect because GraphQL is a query language, not a protocol requiring XML schemas; it allows clients to request specific data, often using JSON. Option D is incorrect because webhooks are callback-based push notifications triggered by events, not periodic polling.

Answer

SOAP is a lightweight protocol that uses JSON for data exchange and is commonly used in RESTful services.

Answer

GraphQL is a protocol that requires strict XML schemas and is used for real-time event notifications.

Answer

Webhooks are a method for polling servers at regular intervals to check for updates.

Question 12

Users in a branch office can reach internal networks but cannot browse the Internet. The router has a correct default route and PAT is configured. Which missing item is the most likely cause if inside hosts are still using private source addresses on the WAN?

Accepted Answer

A correct ACL or source match identifying inside local addresses for NAT. If inside hosts are still appearing with private source addresses on the WAN side, the most likely missing element is a correct NAT inside source match for the internal subnet. In plain language, the router knows where Internet traffic should go because the default route exists, but it is not actually translating the private addresses before sending the traffic out. That means upstream devices see RFC 1918 private addresses that are not valid on the public Internet and return traffic fails.

This is a common CCNA troubleshooting pattern: routing and NAT are separate functions. A valid default route only tells the router where to send packets. It does not automatically translate them. PAT also depends on a correct ACL or source match identifying which inside addresses should be translated. If that match is missing or wrong, the router forwards the traffic but without performing the necessary translation. That is why the missing or incorrect NAT match is the most likely root cause.

Answer

An STP root bridge election on the WAN side

Answer

A voice VLAN on the branch access switches

Answer

A loopback interface with a higher IP address

Question 13

Which protocol is preferred over Telnet for remote CLI management because it encrypts the session?

Accepted Answer

SSH. SSH encrypts credentials and management traffic, making it the standard secure replacement for Telnet.

Answer

FTP

Answer

TFTP

Answer

SNMPv1

Question 14

A router performing PAT is using a single public IPv4 address for many inside hosts. Which value most often distinguishes one inside flow from another on the same outside address?

Accepted Answer

TCP or UDP source port. PAT commonly multiplexes sessions by translating Layer 4 source port numbers.

Answer

TTL

Answer

DSCP

Answer

MAC address of the host

Question 15

An administrator wants to allow HTTPS traffic from a source subnet to a server but deny all Telnet traffic from that same subnet to the same server. Which ACL capability is required to express that policy accurately?

Accepted Answer

An extended ACL that can match protocol and destination port information. The policy requires extended ACL capability because it must distinguish traffic by protocol and destination port, not just by source address. In practical terms, the rule needs to treat TCP port 443 differently from TCP port 23 even though the source and destination networks are the same. A standard ACL is too limited for that.

This question is about matching precision. When the policy depends on protocol and port, extended ACLs are the right tool.

Answer

A standard ACL because source matching is enough

Answer

A wildcard mask with all zeros only

Answer

A wireless SSID ACL

Question 16

A switch has DHCP snooping enabled and Dynamic ARP Inspection enabled on VLAN 30. A printer with a static IP on VLAN 30 cannot communicate because its ARP packets are being dropped.

What is the best fix?

Accepted Answer

Configure a static ARP inspection entry or ARP ACL for the printer.. DAI relies on trusted bindings. Static-IP devices that are not learned through DHCP often require a static ARP ACL or equivalent trusted binding mechanism.

Answer

Disable DAI on all VLANs globally.

Answer

Trust the user-facing printer access port for DHCP snooping and DAI.

Answer

Change the printer to use a larger MTU.

Question 17

A router allows SSH management from anywhere on the internal network. A new policy requires that only the management subnet 10.50.50.0/24 be allowed to initiate SSH to the device. Which approach best enforces that requirement?

Accepted Answer

Restrict SSH access so only the 10.50.50.0/24 management subnet is permitted. The best approach is to use an access control mechanism that limits SSH access to the approved source subnet. In practical terms, SSH is the correct secure protocol, but protocol choice alone is not enough. The device should also restrict who is allowed to reach that management service. That usually means applying an ACL or equivalent source restriction focused on the management subnet.

This is a common management-plane security pattern: use a secure protocol, then limit the set of trusted sources that are allowed to use it.

Answer

Replace SSH with Telnet so the traffic is easier to identify

Answer

Enable PortFast on all access switches

Answer

Raise the Syslog severity threshold

Question 18

Which wireless security method is considered strongest among these choices for modern enterprise WLAN deployments?

Accepted Answer

WPA2 with AES. WPA2 with AES provides substantially stronger security than WEP, legacy WPA, or open authentication. In current enterprise environments, WPA2 and WPA3 are the expected baseline approaches depending on platform support.

Answer

WEP

Answer

WPA

Answer

Open authentication

Question 19

Which protocol is most directly responsible for keeping device clocks synchronized across a network?

Accepted Answer

NTP. The correct protocol is NTP. In plain language, NTP helps devices agree on the current time so that logs, authentication events, monitoring data, and troubleshooting records line up accurately. Without consistent time, a network team may see events from multiple devices but be unable to reconstruct the actual sequence correctly.

This matters more than many people realize because accurate time underpins many operational workflows. Syslog messages, security events, and monitoring alerts become much easier to trust when devices are synchronized. DHCP, TFTP, and CDP are useful for other purposes, but they do not exist to align device clocks. NTP is the protocol specifically associated with time synchronization.

Answer

TFTP

Answer

DHCP

Answer

CDP

Question 20

Exhibit: A client can ping 8.8.8.8 but cannot browse to www.example.com. Which service is most likely failing?

Accepted Answer

DNS. The client has IP connectivity because it can reach 8.8.8.8 directly. The problem appears only when using a hostname, which points to a DNS resolution issue rather than a routing issue.

Answer

NTP

Answer

DHCP snooping

Answer

HSRP