CCNA Practice Test 6 — 10 Questions

Question 1

A company wants a server on the inside network to be reachable consistently from outside using one known public IP address. Which NAT approach best fits that goal?

Accepted Answer

Static NAT. Static NAT best fits that goal because it creates a fixed, predictable one-to-one mapping between the internal server and a public address. In plain language, outside systems always know which public IP represents that server. This predictability is exactly what is needed when a service must be reachable consistently from the outside.

PAT is better suited for many outbound clients sharing one address, not for presenting one inside server with a permanent public identity. Dynamic NAT from a pool can also vary depending on design. The correct answer is the one that provides the most stable and direct one-to-one mapping.

Answer

PAT overload only

Answer

No NAT at all, because private IPv4 addresses are Internet-routable

Answer

DHCP relay

Question 2

An internal server must always be reachable from outside using the same public IP address. Which translation approach is most appropriate?

Accepted Answer

Static NAT. A static NAT mapping is the most appropriate approach. In plain language, the outside world needs a stable public address that always represents the same internal server. Static NAT provides that fixed one-to-one relationship, which makes the service reachable predictably.

PAT is better suited for many outbound users sharing one public address, not for presenting one inside server with a consistent external identity. The correct answer is the one that provides a permanent mapping.

Answer

PAT overload

Answer

No NAT

Answer

DHCP relay

Question 3

In a controller-based design, which statement best describes a northbound API?

Accepted Answer

An application-facing API used by external software to communicate with the controller. A northbound API is the interface exposed by the controller to external applications, orchestration systems, dashboards, or automation tools. In plain language, it is the way software above the controller communicates with the controller so that it can request data, apply policy, or trigger changes. This is different from the southbound side, where the controller interacts with the underlying infrastructure devices.

This concept appears often in automation topics because it helps define where the controller sits in the larger architecture. A northbound API is not a physical cable, and it does not replace security controls. It is an application-facing software interface, which is exactly what the correct answer should capture.

Answer

A cable type used between controller clusters

Answer

The link-state protocol the controller uses to reach switches

Answer

A mechanism that removes the need for authentication

Question 4

Two directly connected routers running OSPFv3 do not form an adjacency. Both interfaces have valid IPv6 addresses and can ping each other using link-local addresses. What is the most likely cause?

Accepted Answer

The interfaces are assigned to different OSPFv3 areas.. The most likely cause is an OSPFv3 area mismatch on the interface. In practical terms, OSPFv3 still requires neighbors on the same link to agree on the area assignment, just as OSPF for IPv4 does. Link-local reachability alone is not enough to form an adjacency. The protocol parameters still have to match.

This is an important IPv6 routing point because people sometimes assume that successful IPv6 ping means the routing protocol should automatically work. It does not. Adjacency depends on protocol alignment, not just basic connectivity.

Answer

The routers need global unicast addresses before OSPFv3 can run.

Answer

The router IDs must be identical before adjacency can form.

Answer

The link-local addresses must be learned from DHCPv6.

Question 5

A host with address 172.16.5.10/23 wants to determine whether 172.16.6.20 is on the same local network. What is the correct conclusion?

Accepted Answer

It is on a different network, so the host should use the default gateway. A /23 prefix covers two consecutive /24 ranges. In plain language, that means the network boundaries move in blocks of 2 in the third octet. The address 172.16.5.10/23 belongs to the 172.16.4.0/23 network, which covers 172.16.4.x and 172.16.5.x. The destination 172.16.6.20 belongs to a different /23 block, so it is not on the same local network.

This question checks whether you can think beyond default /24 boundaries and understand how a broader prefix changes the local network range. The host would therefore need to use its default gateway to reach 172.16.6.20, because that destination is off-subnet relative to the /23 in use.

Answer

It is on the same local network because both addresses begin with 172.16.

Answer

It is on the same local network because /23 covers all addresses in 172.16.5.x and 172.16.6.x

Answer

It is on a different network, so ARP will resolve it across the router automatically

Question 6

Based on the exhibit, what is the most likely reason PAT is not working correctly?

Accepted Answer

The inside and outside NAT interface roles are reversed.. PAT is not working correctly because the inside and outside NAT roles are reversed on the interfaces. In practical terms, the private LAN-facing interface should be marked as inside, and the public-facing WAN interface should be marked as outside. In the exhibit, the router has those roles backwards, so translation logic is applied in the wrong direction.

This is a very realistic NAT troubleshooting item because the configuration is close to correct and the failure comes from one directional mistake.

Answer

PAT requires OSPF to be enabled on the WAN link.

Answer

The ACL must be numbered 100 instead of 1.

Answer

The router must use GRE before PAT can overload.

Question 7

Match each switching feature to its most accurate purpose.

Accepted Answer

STP prevents loops, VTP manages VLANs, EtherChannel aggregates links, Port Security restricts MAC addresses, DTP negotiates trunks, and Rapid PVST+ provides fast per-VLAN convergence.. Which accurately pairs each switching feature with its purpose: Spanning Tree Protocol (STP) prevents loops in a switched network by blocking redundant paths; VLAN Trunking Protocol (VTP) manages the addition, deletion, and renaming of VLANs across the network; EtherChannel aggregates multiple physical links into a single logical link for increased bandwidth and redundancy; Port Security limits the number of MAC addresses allowed on a switch port to prevent unauthorized access; Dynamic Trunking Protocol (DTP) automatically negotiates trunking between switches; and Rapid PVST+ provides fast convergence for each VLAN using multiple spanning tree instances. The other options contain incorrect pairings, such as mixing up STP with VLAN management or EtherChannel with loop prevention.

Answer

STP manages VLANs, VTP prevents loops, EtherChannel restricts MAC addresses, Port Security aggregates links, DTP provides fast per-VLAN convergence, and Rapid PVST+ negotiates trunks.

Answer

STP aggregates links, VTP prevents loops, EtherChannel manages VLANs, Port Security negotiates trunks, DTP restricts MAC addresses, and Rapid PVST+ provides fast per-VLAN convergence.

Answer

STP provides fast per-VLAN convergence, VTP aggregates links, EtherChannel prevents loops, Port Security manages VLANs, DTP restricts MAC addresses, and Rapid PVST+ negotiates trunks.

Question 8

A subnet has the network address 192.168.30.0/26. What is the broadcast address?

Accepted Answer

192.168.30.63. A /26 subnet contains 64 addresses. In plain language, the block that starts at 192.168.30.0 runs through 192.168.30.63. The first address is the network address and the last address is the broadcast address, so the broadcast for this subnet is 192.168.30.63.

This is a standard subnet-boundary calculation. Once the block size is identified, the broadcast address is simply the final address in that block.

Answer

192.168.30.64

Answer

192.168.30.255

Answer

192.168.30.31

Question 9

A switchport is configured as an access port in VLAN 10, but a user plugs in a small unmanaged switch and connects multiple devices behind it. Which security feature most directly limits that behavior at the switchport?

Accepted Answer

Port security. Port security most directly limits that behavior because it can restrict how many MAC addresses are learned on the switchport. In practical terms, if the interface is supposed to support one endpoint but suddenly begins presenting multiple MAC addresses from a downstream mini-switch, port security can detect and react to that change.

This is a classic access-layer control question. VLAN assignment alone does not limit how many devices appear behind the port.

Answer

OSPF authentication

Answer

NetFlow

Answer

NTP

Question 10

An EtherChannel should form using LACP between two switches. One side is configured for LACP active, and the other side is configured for LACP active. What is the expected result if the other link settings also match?

Accepted Answer

The EtherChannel should form if the other interface settings are compatible.. The EtherChannel should form successfully if the underlying link settings are compatible. LACP active/active is a valid combination, as both switches actively negotiate the bundle. However, the channel does not automatically become a routed interface (option C is incorrect because EtherChannel can operate as Layer 2 or Layer 3 depending on configuration, not automatically due to LACP mode). Additionally, VLAN tags are not removed by default from the bundle (option D is incorrect; VLAN tagging is preserved based on the switchport mode and allowed VLAN settings). The key troubleshooting point is to ensure that other interface parameters such as speed, duplex, and VLAN settings match across the member ports.

Answer

The channel fails because both sides must be passive.

Answer

The channel becomes a routed interface automatically.

Answer

All VLAN tags are removed from the bundle by default.