CCNA Practice Exam 59 — 20 Questions

Question 1

Which two statements accurately describe Syslog in a Cisco network environment?

Accepted Answer

Syslog can send device event messages to a centralized logging server.. Syslog is used to centralize device event messages such as warnings, errors, and informational entries. In plain language, it gives administrators one place to review what devices are reporting rather than checking each device individually. This makes troubleshooting and incident review easier, especially in larger environments. Syslog does not replace time synchronization, but it becomes much more useful when paired with NTP so timestamps are consistent.

A common trap is to assume Syslog is a routing protocol or a DHCP-like service. It is neither. It is about event reporting and centralized logging.

Answer

Syslog is primarily used to assign IP addresses to hosts.

Answer

Syslog automatically prevents switching loops.

Answer

Syslog replaces the need for any monitoring system.

Question 2

Match each API workflow concept to the description that best fits it.

Accepted Answer

REST is a stateless architectural style that uses standard HTTP methods and typically exchanges data in JSON or XML format.. Ly defines REST as a stateless architectural style using standard HTTP methods (GET, POST, PUT, DELETE) and typically exchanging data in JSON or XML. Option B is incorrect because SOAP uses XML, not JSON, and is not lightweight; it is a protocol with strict standards. Option C is incorrect because GraphQL is a query language, not a protocol requiring XML schemas; it allows clients to request specific data, often using JSON. Option D is incorrect because webhooks are callback-based push notifications triggered by events, not periodic polling.

Answer

SOAP is a lightweight protocol that uses JSON for data exchange and is commonly used in RESTful services.

Answer

GraphQL is a protocol that requires strict XML schemas and is used for real-time event notifications.

Answer

Webhooks are a method for polling servers at regular intervals to check for updates.

Question 3

Users in a branch office can reach internal networks but cannot browse the Internet. The router has a correct default route and PAT is configured. Which missing item is the most likely cause if inside hosts are still using private source addresses on the WAN?

Accepted Answer

A correct ACL or source match identifying inside local addresses for NAT. If inside hosts are still appearing with private source addresses on the WAN side, the most likely missing element is a correct NAT inside source match for the internal subnet. In plain language, the router knows where Internet traffic should go because the default route exists, but it is not actually translating the private addresses before sending the traffic out. That means upstream devices see RFC 1918 private addresses that are not valid on the public Internet and return traffic fails.

This is a common CCNA troubleshooting pattern: routing and NAT are separate functions. A valid default route only tells the router where to send packets. It does not automatically translate them. PAT also depends on a correct ACL or source match identifying which inside addresses should be translated. If that match is missing or wrong, the router forwards the traffic but without performing the necessary translation. That is why the missing or incorrect NAT match is the most likely root cause.

Answer

An STP root bridge election on the WAN side

Answer

A voice VLAN on the branch access switches

Answer

A loopback interface with a higher IP address

Question 4

Which protocol is preferred over Telnet for remote CLI management because it encrypts the session?

Accepted Answer

SSH. SSH encrypts credentials and management traffic, making it the standard secure replacement for Telnet.

Answer

FTP

Answer

TFTP

Answer

SNMPv1

Question 5

A router performing PAT is using a single public IPv4 address for many inside hosts. Which value most often distinguishes one inside flow from another on the same outside address?

Accepted Answer

TCP or UDP source port. PAT commonly multiplexes sessions by translating Layer 4 source port numbers.

Answer

TTL

Answer

DSCP

Answer

MAC address of the host

Question 6

Refer to the exhibit. A network administrator is troubleshooting a connectivity issue on switch SW1. Users connected to port Gi0/3 are unable to reach resources in VLAN 30. The administrator issues the show vlan brief command and receives the output shown. What is the most likely cause of the problem?

Accepted Answer

VLAN 30 is administratively shut down.. The 'show vlan brief' output shows VLAN 30 with a status of 'act/lshut' (administratively shutdown) or 'shutdown', indicating that the VLAN has been disabled via the 'shutdown' command in VLAN configuration mode. A shutdown VLAN does not forward traffic, and all access ports assigned to it become operationally inactive for that VLAN, even though the ports themselves may still be listed in the output. The SVI for VLAN 30 would also be down. Therefore, the most likely cause is that VLAN 30 has been administratively shut down.

Answer

The Gi0/3 port is in an error-disabled state due to port security violations.

Answer

The VLAN 30 SVI is administratively down.

Answer

Spanning Tree Protocol has placed Gi0/3 into a blocking state for VLAN 30.

Question 7

A branch router has two equal-cost static routes to the same destination network. Both routes are displayed in the output of the show ip route command, and pings from the router to both next-hop IP addresses succeed. Despite this, all traffic heading toward that destination is egressing only a single interface. The technician suspects Cisco Express Forwarding (CEF) is not performing load balancing as expected. What should the technician do next?

Accepted Answer

Issue the show ip cef detail command to inspect the CEF FIB entry and verify both adjacencies are present.. CEF performs load balancing over equal-cost paths using a hash of the packet's destination (or source/destination) address to select a path. The interface bandwidth is not a factor for equal-cost load balancing; it is used for metric calculation in routing protocols, not for CEF path selection. When traffic uses only one interface despite two equal-cost routes in the routing table, you should verify that CEF has installed both paths in its FIB and resolved both next-hop addresses to adjacencies. The command 'show ip cef detail' displays the FIB entry and associated adjacencies, confirming both paths are available for load balancing.

Answer

Check the interface output rates with show interface to see if both interfaces are transmitting traffic.

Answer

Display the routing table again with show ip route to ensure both static routes are still installed.

Answer

Verify the bandwidth configured on the outgoing interfaces using show interfaces or show running-config.

Question 8

An administrator wants to allow HTTPS traffic from a source subnet to a server but deny all Telnet traffic from that same subnet to the same server. Which ACL capability is required to express that policy accurately?

Accepted Answer

An extended ACL that can match protocol and destination port information. The policy requires extended ACL capability because it must distinguish traffic by protocol and destination port, not just by source address. In practical terms, the rule needs to treat TCP port 443 differently from TCP port 23 even though the source and destination networks are the same. A standard ACL is too limited for that.

This question is about matching precision. When the policy depends on protocol and port, extended ACLs are the right tool.

Answer

A standard ACL because source matching is enough

Answer

A wildcard mask with all zeros only

Answer

A wireless SSID ACL

Question 9

A switch has DHCP snooping enabled and Dynamic ARP Inspection enabled on VLAN 30. A printer with a static IP on VLAN 30 cannot communicate because its ARP packets are being dropped.

What is the best fix?

Accepted Answer

Configure a static ARP inspection entry or ARP ACL for the printer.. DAI relies on trusted bindings. Static-IP devices that are not learned through DHCP often require a static ARP ACL or equivalent trusted binding mechanism.

Answer

Disable DAI on all VLANs globally.

Answer

Trust the user-facing printer access port for DHCP snooping and DAI.

Answer

Change the printer to use a larger MTU.

Question 10

A router allows SSH management from anywhere on the internal network. A new policy requires that only the management subnet 10.50.50.0/24 be allowed to initiate SSH to the device. Which approach best enforces that requirement?

Accepted Answer

Restrict SSH access so only the 10.50.50.0/24 management subnet is permitted. The best approach is to use an access control mechanism that limits SSH access to the approved source subnet. In practical terms, SSH is the correct secure protocol, but protocol choice alone is not enough. The device should also restrict who is allowed to reach that management service. That usually means applying an ACL or equivalent source restriction focused on the management subnet.

This is a common management-plane security pattern: use a secure protocol, then limit the set of trusted sources that are allowed to use it.

Answer

Replace SSH with Telnet so the traffic is easier to identify

Answer

Enable PortFast on all access switches

Answer

Raise the Syslog severity threshold

Question 11

Which wireless security method is considered strongest among these choices for modern enterprise WLAN deployments?

Accepted Answer

WPA2 with AES. WPA2 with AES provides substantially stronger security than WEP, legacy WPA, or open authentication. In current enterprise environments, WPA2 and WPA3 are the expected baseline approaches depending on platform support.

Answer

WEP

Answer

WPA

Answer

Open authentication

Question 12

Which protocol is most directly responsible for keeping device clocks synchronized across a network?

Accepted Answer

NTP. The correct protocol is NTP. In plain language, NTP helps devices agree on the current time so that logs, authentication events, monitoring data, and troubleshooting records line up accurately. Without consistent time, a network team may see events from multiple devices but be unable to reconstruct the actual sequence correctly.

This matters more than many people realize because accurate time underpins many operational workflows. Syslog messages, security events, and monitoring alerts become much easier to trust when devices are synchronized. DHCP, TFTP, and CDP are useful for other purposes, but they do not exist to align device clocks. NTP is the protocol specifically associated with time synchronization.

Answer

TFTP

Answer

DHCP

Answer

CDP

Question 13

Exhibit: A client can ping 8.8.8.8 but cannot browse to www.example.com. Which service is most likely failing?

Accepted Answer

DNS. The client has IP connectivity because it can reach 8.8.8.8 directly. The problem appears only when using a hostname, which points to a DNS resolution issue rather than a routing issue.

Answer

NTP

Answer

DHCP snooping

Answer

HSRP

Question 14

What problem does DHCP snooping help prevent?

Accepted Answer

Unauthorized DHCP server responses from user-facing ports. DHCP snooping marks interfaces as trusted or untrusted and blocks rogue DHCP server messages arriving on untrusted ports.

Answer

Layer 3 route loops

Answer

Trunk encapsulation mismatch

Answer

Weak SSH ciphers

Question 15

Which HTTP method is typically used to retrieve data from a REST API without modifying the resource?

Accepted Answer

GET. GET requests are used to retrieve resource information. They are intended for read operations rather than creation, replacement, or deletion.

Answer

POST

Answer

PUT

Answer

DELETE

Question 16

Exhibit: A network engineer wants to identify which applications are consuming most WAN bandwidth over time. Which feature should be enabled on the router?

Accepted Answer

NetFlow. NetFlow records conversations and traffic characteristics so an external collector can analyze top talkers, protocols, and usage trends. Syslog and SNMP have different purposes.

Answer

NTP authentication

Answer

DNS forwarding

Answer

DHCP snooping

Question 17

A wireless site reports that users can connect to the SSID, but performance drops sharply around the conference area whenever the room fills up. Based on the exhibit, what is the most likely cause?

Accepted Answer

Adjacent-channel interference caused by overlapping 2.4 GHz channels. The 2.4 GHz radios are using overlapping channels. In 2.4 GHz, the standard non-overlapping channels are 1, 6, and 11 in many regulatory domains. Using channels 1, 3, and 6 creates adjacent-channel interference, which hurts throughput especially in dense client areas.

Answer

A DHCP exhaustion problem on the WLAN

Answer

An authentication mismatch between the APs and clients

Answer

A missing default route on the wireless controller

Question 18

A network engineer notices that users in VLAN 10 report intermittent connectivity and slow file transfers to a server on the same switch. The engineer issues the show interfaces fa0/1 command on the switch port connected to the server and observes a high number of runts, input errors, and CRC errors, while output errors are minimal. The interface configuration shows speed 100 and duplex full.

Accepted Answer

The server NIC is auto-negotiating to 100 Mbps half-duplex, resulting in a duplex mismatch.. The symptoms—high runts, input errors, and CRC errors with minimal output errors—are classic indicators of a duplex mismatch. When the switch port is hardcoded to 100 Mbps full-duplex and the server NIC auto-negotiates to 100 Mbps half-duplex (a common fallback when one side is manually set), the half-duplex side experiences collisions while the full-duplex side does not sense the collision. These collisions cause the half-duplex side to truncate frames, resulting in runts and CRC errors on the full-duplex switch port. The speed matches (both 100 Mbps), so the issue is purely duplex-related.

Answer

The server NIC is set to 10 Mbps half-duplex, causing a speed mismatch.

Answer

The cable connecting the server to the switch is faulty, introducing excessive noise.

Answer

The switch port is configured with an incorrect native VLAN, causing duplex negotiation issues.

Question 19

A router interface applies this ACL inbound:

10 deny tcp any any eq 80
20 permit ip any any

A user reports that web browsing to a server by IP address fails, but ping works. Which statement best explains the behavior?

Accepted Answer

The ACL blocks HTTP but allows ICMP. ACLs are processed top down. Line 10 denies TCP destination port 80, which blocks HTTP. Line 20 then permits all remaining IP traffic, including ICMP echo packets used by ping.

Answer

The ACL blocks all traffic because the first entry is a deny

Answer

The ACL permits HTTP because line 20 overrides line 10

Answer

The ACL blocks ping because ICMP is not explicitly permitted

Question 20

A network engineer configures OSPF on R1 and R2 over a point-to-point link. The interfaces are in the same OSPF area, with matching hello and dead timers, and are on the same IP subnet. However, the command show ip ospf neighbor on both routers shows no neighbors. A firewall sits between R1 and R2. What should the technician do next?

Accepted Answer

Check the firewall rules to verify that multicast address 224.0.0.5 is not being blocked.. OSPF uses multicast address 224.0.0.5 (AllSPFRouters) to send hello packets and establish neighbor adjacencies. A firewall blocking this multicast address would prevent R1 and R2 from receiving each other's hello packets, resulting in no neighbors appearing in the show ip ospf neighbor output. Since all other OSPF parameters (area, timers, subnet) are correctly configured, the firewall is the most likely cause.

Answer

Verify that the OSPF router IDs on R1 and R2 are unique.

Answer

Check the OSPF network type on the connecting interfaces.

Answer

Verify that the MTU on the connecting interfaces matches.