CCNA Practice Exam 60 — 20 Questions

Question 1

You are connected to R1 via console. The network administrator has attempted to configure OSPFv2 between R1, R2, and R3 but OSPF neighbor adjacencies are failing. Configure R1 to correct all issues so that R1 becomes FULL neighbors with both R2 and R3. Do not modify any other device's configuration.

Accepted Answer

Add 'no passive-interface GigabitEthernet0/0' and 'no passive-interface GigabitEthernet0/1' under OSPF configuration, but keep 'passive-interface default'.. The core issue is that R1 has 'passive-interface default' under the OSPF process, which prevents all interfaces from sending or receiving OSPF hello packets, breaking neighbor formation. The correct fix is to override this default with 'no passive-interface' on the interfaces that connect to neighbors (GigabitEthernet0/0 and GigabitEthernet0/1), allowing OSPF to form adjacencies while keeping other interfaces passive for security. Option B matches the solution commands and is the intended approach. Option A would also work but removes the default entirely, potentially enabling OSPF on all interfaces, which is not the recommended best practice in this scenario.

Answer

Remove the 'passive-interface default' command and remove the 'passive-interface GigabitEthernet0/0' and 'passive-interface GigabitEthernet0/1' commands under OSPF configuration.

Answer

Change the network statements to include the correct wildcard masks for the subnets on GigabitEthernet0/0 and GigabitEthernet0/1.

Answer

Add 'ip ospf network point-to-point' on both GigabitEthernet0/0 and GigabitEthernet0/1 interfaces.

Question 2

You are connected to R1. R1, R2, and R3 are connected via serial links as shown. Configure single-area OSPFv2 on all three routers so that all interfaces in the 10.0.0.0/8 range participate in OSPF area 0, except the loopback interfaces. Currently R1 cannot form OSPF adjacencies with R2 and R3. Examine the running-config of R1 below and determine the corrective actions needed.

Accepted Answer

Remove the passive-interface configuration from GigabitEthernet0/0, Serial0/0/0, and Serial0/0/1, and adjust the hello timer on Serial0/0/0 to 30 seconds.. R1 has passive-interface configured on all active interfaces (G0/0, Se0/0/0, Se0/0/1), which prevents OSPF hello packets from being sent and stops adjacencies from forming. Additionally, the hello timer on Serial0/0/0 is mismatched (default 10 vs. required 30). To resolve the adjacency issues while keeping loopback interfaces inactive, the passive-interface command must be removed from only the necessary interfaces and the hello timer on Se0/0/0 must be set to 30 seconds.

Answer

Change the OSPF network type on all interfaces to point-to-point and increase the dead timer to 120 seconds.

Answer

Add the network 10.0.0.0 0.255.255.255 area 0 command under router ospf and enable OSPF on all interfaces.

Answer

Configure the loopback interfaces with the ip ospf network point-to-point command to ensure they participate in OSPF.

Question 3

You are connected to R1 via console. R1 and R2 are directly connected via GigabitEthernet0/0. Configure OSPF process 1 on both routers so that they form a full adjacency. R1's router-id must be 1.1.1.1, and R2's router-id must be 2.2.2.2. Use network statements to advertise the direct link. Ensure that R1 does not send OSPF hellos out of its GigabitEthernet0/1 interface. The current configuration on R1 has mismatched hello and dead timers, and an incorrect network type, preventing adjacency. Fix all issues.

Accepted Answer

On R1, configure 'ip ospf hello-interval 10' and 'ip ospf dead-interval 40' under interface GigabitEthernet0/0, and ensure network type is broadcast. On R2, configure 'router-id 2.2.2.2' under router ospf 1. Also, on R1, add 'passive-interface GigabitEthernet0/1' under router ospf 1.. The adjacency was failing because R1 had incorrect hello (30) and dead (120) timers, while R2 used defaults (10/40). Additionally, R1’s network type was set to a non-broadcast type, causing a mismatch. To fix, on R1’s GigabitEthernet0/0, set hello-interval 10, dead-interval 40, and network type broadcast. In OSPF process 1 on R1, configure passive-interface GigabitEthernet0/1 to suppress hellos on that interface. On R2, under router ospf 1, set router-id 2.2.2.2. Option A addresses all requirements. Option B uses wrong timers and passive-interface default, which blocks hellos on all interfaces, breaking adjacency. Option C sets network type point-to-point, creating a type mismatch with R2’s broadcast, preventing adjacency. Option D omits the passive-interface command, failing to suppress hellos on GigabitEthernet0/1 as required.

Answer

On R1, configure 'ip ospf hello-interval 30' and 'ip ospf dead-interval 120' under interface GigabitEthernet0/0, and set network type to point-to-point. On R2, configure 'router-id 2.2.2.2' under router ospf 1. Also, on R1, add 'passive-interface default' under router ospf 1.

Answer

On R1, configure 'ip ospf hello-interval 10' and 'ip ospf dead-interval 40' under interface GigabitEthernet0/0, and set network type to point-to-point. On R2, configure 'router-id 2.2.2.2' under router ospf 1. Also, on R1, add 'passive-interface GigabitEthernet0/1' under router ospf 1.

Answer

On R1, configure 'ip ospf hello-interval 10' and 'ip ospf dead-interval 40' under interface GigabitEthernet0/0, and ensure network type is broadcast. On R2, configure 'router-id 2.2.2.2' under router ospf 1. Also, on R1, add 'network 10.0.0.0 0.255.255.255 area 0' under router ospf 1.

Question 4

You are connected to R1. R1 has OSPF configured on GigabitEthernet0/0 with network 10.0.0.0 0.0.0.3 area 1, ip ospf hello-interval 10, and ip ospf dead-interval 40. R2 has OSPF configured on its GigabitEthernet0/0 with network 10.0.0.0 0.0.0.3 area 0, ip ospf hello-interval 5, and ip ospf dead-interval 20. Correct these mismatches so that R1 and R2 become OSPF neighbors.

Accepted Answer

On R1, change the network statement to area 0 and set ip ospf hello-interval 5 and ip ospf dead-interval 20 under the interface.. The OSPF adjacency fails due to two mismatches. First, the area is mismatched: R1 uses area 1, R2 uses area 0 (both must be the same area, typically area 0). Second, the hello and dead timers are mismatched: R1 uses Hello 10/Dead 40, R2 uses Hello 5/Dead 20. To fix, on R1 change the network statement to area 0 and adjust timers to match R2 (or vice versa). The solution below changes R1's area to 0 and sets hello to 5 and dead to 20 to match R2.

Answer

On R2, change the network statement to area 1 and set ip ospf hello-interval 10 and ip ospf dead-interval 40 under the interface.

Answer

On R1, change the network statement to area 0 and set ip ospf hello-interval 10 and ip ospf dead-interval 40 under the interface.

Answer

On R2, change the network statement to area 0 and set ip ospf hello-interval 10 and ip ospf dead-interval 40 under the interface.

Question 5

You are connected to R1 via the console. R1 is a router that connects to the internet via GigabitEthernet0/0 (198.51.100.1/30) and to the internal network via GigabitEthernet0/1 (10.1.1.1/24). You need to implement a security policy that permits HTTP traffic (port 80) from the internal network to a web server at 10.1.1.100, and denies all other traffic from internal hosts to the internet. The ACL should be named 'INTERNET-FILTER' and applied inbound on GigabitEthernet0/1.

Accepted Answer

ip access-list extended INTERNET-FILTER
 permit tcp 10.1.1.0 0.0.0.255 host 10.1.1.100 eq 80
 deny ip 10.1.1.0 0.0.0.255 any
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in. The named extended ACL filters traffic based on source, destination, and protocol. The permit allows HTTP from internal to the web server. The deny blocks all other internal-to-internet traffic. Applying it inbound on the internal interface filters traffic as it enters the router.

Answer

ip access-list standard INTERNET-FILTER
 permit 10.1.1.0 0.0.0.255
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in

Answer

ip access-list extended INTERNET-FILTER
 permit tcp host 10.1.1.100 10.1.1.0 0.0.0.255 eq 80
 deny ip any any
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in

Answer

ip access-list extended INTERNET-FILTER
 permit tcp 10.1.1.0 0.0.0.255 host 10.1.1.100 eq 80
 deny ip any any
!
interface GigabitEthernet0/0
 ip access-group INTERNET-FILTER in

Question 6

You are connected to R1 via console. Configure OSPFv3 for IPv6 on R1 and R2 so that IPv6 loopback interfaces on both routers can communicate. R1's GigabitEthernet0/0 and R2's GigabitEthernet0/1 are directly connected. Ensure OSPFv3 is enabled on the correct interfaces and verify neighbors and routes.

Accepted Answer

Enable OSPFv3 on R1's GigabitEthernet0/0 and Loopback0, and on R2's GigabitEthernet0/1 and Loopback0.. The issue is that OSPFv3 is not enabled on the interfaces. On R1, OSPFv3 must be enabled on GigabitEthernet0/0 (the link to R2) and Loopback0 (to advertise the loopback). On R2, OSPFv3 must be enabled on GigabitEthernet0/1 (the link to R1) and Loopback0. After enabling OSPFv3 on the correct interfaces, the neighbor adjacency forms and routes are exchanged.

Answer

Enable OSPFv3 only on the loopback interfaces of both routers.

Answer

Enable OSPFv3 on R1's GigabitEthernet0/0 and R2's GigabitEthernet0/1 only, without loopbacks.

Answer

Enable OSPFv3 on R1's Loopback0 and R2's GigabitEthernet0/1 only.

Question 7

You are connected to R1. Configure AAA with a RADIUS server at 10.0.0.2/30 (key 'cisco123') so that console and VTY login use RADIUS first, then local authentication. Additionally, troubleshoot why an 802.1X-enabled switch port (GigabitEthernet0/1) on R1 is stuck in the unauthorized state. The RADIUS server is reachable but authentication fails. Verify using 'show aaa servers' and 'show dot1x interface GigabitEthernet0/1 details'.

Accepted Answer

Configure 'aaa authentication login default group RADIUS local' and correct the RADIUS server key to match the actual server key.. The RADIUS server is reachable but AAA and 802.1X authentication fail because the pre-shared key on R1 does not match the server's actual key. The correct repair is to first apply 'aaa authentication login default group RADIUS local' to correctly reference the RADIUS server by its name, then set the matching key under 'radius server RADIUS'. Once the key matches, the switch port will transition to authorized state.

Answer

Configure 'aaa authentication login default group radius local' and verify the RADIUS server IP address is correct.

Answer

Configure 'aaa authentication login default group radius local' and enable 802.1X globally with 'dot1x system-auth-control'.

Answer

Configure 'aaa authentication login default local' and remove the RADIUS server configuration.

Question 8

You are connected to R1. Configure OSPFv3 for IPv6 on R1 and R2 so that the loopback0 interface on R1 (IPv6 address 2001:db8:1::1/64) can ping the loopback0 interface on R2 (IPv6 address 2001:db8:2::1/64). The routers are connected via their GigabitEthernet0/0 interfaces using IPv6 addresses 2001:db8:12::1/64 (R1) and 2001:db8:12::2/64 (R2). OSPFv3 process ID 100 must be used, and all interfaces must be in area 0.

Accepted Answer

R1(config)# ipv6 unicast-routing
R1(config)# ipv6 router ospf 100
R1(config-rtr)# router-id 1.1.1.1
R1(config-rtr)# interface gigabitethernet0/0
R1(config-if)# ipv6 ospf 100 area 0
R1(config-if)# interface loopback0
R1(config-if)# ipv6 ospf 100 area 0

R2(config)# ipv6 unicast-routing
R2(config)# ipv6 router ospf 100
R2(config-rtr)# router-id 2.2.2.2
R2(config-rtr)# interface gigabitethernet0/0
R2(config-if)# ipv6 ospf 100 area 0
R2(config-if)# interface loopback0
R2(config-if)# ipv6 ospf 100 area 0. OSPFv3 for IPv6 requires enabling IPv6 unicast routing globally and configuring OSPFv3 on interfaces. The missing step was enabling OSPFv3 process 100 and assigning area 0 to the interfaces. On R1, the commands 'ipv6 router ospf 100' and 'router-id 1.1.1.1' create the OSPFv3 process, then 'ipv6 ospf 100 area 0' under each interface enables OSPFv3 on those interfaces. Similar commands on R2 with a unique router-id complete the configuration. Verification with 'show ospfv3 neighbor' should show R2's router-id, and 'show ipv6 route ospf' should display the remote loopback network.

Answer

R1(config)# ipv6 unicast-routing
R1(config)# ipv6 router ospf 100
R1(config-rtr)# router-id 1.1.1.1
R1(config-rtr)# network 2001:db8:12::0/64 area 0
R1(config-rtr)# network 2001:db8:1::0/64 area 0

R2(config)# ipv6 unicast-routing
R2(config)# ipv6 router ospf 100
R2(config-rtr)# router-id 2.2.2.2
R2(config-rtr)# network 2001:db8:12::0/64 area 0
R2(config-rtr)# network 2001:db8:2::0/64 area 0

Answer

R1(config)# ipv6 unicast-routing
R1(config)# ipv6 router ospf 100
R1(config-rtr)# router-id 1.1.1.1
R1(config-rtr)# interface gigabitethernet0/0
R1(config-if)# ipv6 ospf 100 area 0

R2(config)# ipv6 unicast-routing
R2(config)# ipv6 router ospf 100
R2(config-rtr)# router-id 2.2.2.2
R2(config-rtr)# interface gigabitethernet0/0
R2(config-if)# ipv6 ospf 100 area 0

Answer

R1(config)# ipv6 unicast-routing
R1(config)# ipv6 router ospf 100
R1(config-rtr)# router-id 1.1.1.1
R1(config-rtr)# interface gigabitethernet0/0
R1(config-if)# ipv6 ospf 100 area 0
R1(config-if)# interface loopback0
R1(config-if)# ipv6 ospf 100 area 0

R2(config)# ipv6 unicast-routing
R2(config)# ipv6 router ospf 100
R2(config-rtr)# router-id 1.1.1.1
R2(config-rtr)# interface gigabitethernet0/0
R2(config-if)# ipv6 ospf 100 area 0
R2(config-if)# interface loopback0
R2(config-if)# ipv6 ospf 100 area 0

Question 9

You are connected to R1. The network must route IPv6 traffic between two directly connected routers using OSPFv3. Configure OSPFv3 on R1's GigabitEthernet0/0 interface in area 0, enable IPv6 unicast routing, and verify that R1 forms an OSPFv3 neighbor adjacency with R2 and learns the remote network 2001:DB8:CAFE:2::/64 via OSPFv3.

Accepted Answer

Enable OSPFv3 on the interface with 'ipv6 ospf 1 area 0' under GigabitEthernet0/0.. The issue is that OSPFv3 is not enabled on R1's GigabitEthernet0/0 interface, and the OSPFv3 routing process has not been started. To fix this, first ensure ipv6 unicast-routing is already enabled (it is). Then configure the OSPFv3 process with a process ID (e.g., 1) and enable OSPFv3 on the interface in area 0 using the command 'ipv6 ospf 1 area 0' under the interface. After that, R1 will form a neighbor adjacency with R2 and learn the remote route.

Answer

Configure 'ipv6 router ospf 1' and then 'network 2001:DB8:CAFE:1::/64 area 0' under the OSPFv3 process.

Answer

Enable OSPFv3 on the interface with 'ipv6 ospf 1 area 0' under the OSPFv3 router configuration mode.

Answer

Configure 'ipv6 unicast-routing' and then 'ipv6 ospf 1 area 0' under the interface.

Question 10

You are connected to R1. The network uses HSRP for default gateway redundancy. Currently, both routers R1 and R2 are in the 'Active' state for HSRP group 10, causing traffic issues. Configure HSRP on R1 so that it becomes the Active router with a priority of 150, preempt enabled, a virtual IP of 192.168.1.254, and track interface GigabitEthernet0/1 so that if it goes down, the priority decrements by 20. Then verify the configuration with 'show standby brief'.

Accepted Answer

standby 10 ip 192.168.1.254
standby 10 priority 150
standby 10 preempt
standby 10 track GigabitEthernet0/1 20. The required HSRP configuration consists of all four commands: virtual IP, priority 150, preempt, and tracking with a decrement of 20. Option A lists them correctly. Option B fails because the track command is missing the decrement value. Option C is incorrect because it omits the 'standby 10 preempt' command; without preempt, the router will not take over the active role even when its priority is higher. Option D uses a decrement of 10 instead of 20, which does not meet the requirement.

Answer

standby 10 ip 192.168.1.254
standby 10 priority 150
standby 10 preempt
standby 10 track GigabitEthernet0/1

Answer

standby 10 ip 192.168.1.254
standby 10 priority 150
standby 10 track GigabitEthernet0/1 20

Answer

standby 10 ip 192.168.1.254
standby 10 priority 150
standby 10 preempt
standby 10 track GigabitEthernet0/1 10

Question 11

You are connected to R1. Configure AAA with RADIUS authentication for all login methods. The RADIUS server is at 203.0.113.10 with key 'CiscoKey123'. Then troubleshoot why the 802.1X port on interface GigabitEthernet0/1 remains in unauthorized state. The port is configured for dot1x port-control auto, but authentication fails. Ensure that the AAA authentication default method uses RADIUS first, then local fallback, and that the RADIUS server is correctly reachable and configured for authentication.

Accepted Answer

Configure RADIUS server with IP 203.0.113.10 and key 'CiscoKey123', then configure AAA authentication login default group radius local.. The issue is twofold: First, AAA is not fully configured — 'aaa new-model' is present but no RADIUS server or authentication method list is defined. Second, the RADIUS server configuration is missing. To fix, configure the RADIUS server with IP and key using the 'radius server' block, then create an AAA authentication login default list that uses RADIUS first then local fallback (e.g., 'aaa authentication login default group radius local'). The port configuration is correct for 802.1X, but without AAA and RADIUS, authentication cannot proceed; the switch will not contact the RADIUS server, causing the port to remain unauthorized. Option D is incorrect because while 'aaa new-model' and RADIUS server configuration are necessary steps, they alone do not create an authentication method list; without 'aaa authentication login default group radius local', the RADIUS server is never referenced for login authentication.

Answer

Change the interface port-control to 'force-authorized' to bypass authentication and bring the port up.

Answer

Configure AAA authentication login default local radius to use local authentication first, then RADIUS.

Answer

Add the command 'aaa new-model' and configure the RADIUS server with IP 203.0.113.10 and key 'CiscoKey123'.

Question 12

You are connected to R1. The inside network 192.168.10.0/24 must be able to reach the Internet via PAT (NAT overload) using the outside interface G0/1 with IP 203.0.113.2/30. Additionally, the internal server at 192.168.10.100 must be statically mapped to public IP 203.0.113.10. The current configuration is incomplete and contains errors. Fix the NAT configuration on R1 so that both requirements are met.

Accepted Answer

ip access-list standard 100 permit 192.168.10.0 0.0.0.255
ip nat inside source list 100 interface GigabitEthernet0/1 overload
ip nat inside source static 192.168.10.100 203.0.113.10
interface GigabitEthernet0/1
 ip nat outside. The correct configuration is a standard ACL matching the entire 192.168.10.0/24 subnet, a PAT statement with the overload keyword, and the outside interface correctly configured as ip nat outside. Option A achieves all three. Option B fails because its ACL only matches the server host, so only 192.168.10.100 can use the PAT translation. Option C omits the overload keyword, meaning only one inside host can translate at a time – PAT is not enabled. Option D configures the external interface as ip nat inside instead of outside, blocking translation of outbound traffic.

Answer

ip access-list standard 100 permit host 192.168.10.100
ip nat inside source list 100 interface GigabitEthernet0/1 overload
ip nat inside source static 192.168.10.100 203.0.113.10
interface GigabitEthernet0/1
 ip nat outside

Answer

ip access-list standard 100 permit 192.168.10.0 0.0.0.255
ip nat inside source list 100 interface GigabitEthernet0/1
ip nat inside source static 192.168.10.100 203.0.113.10
interface GigabitEthernet0/1
 ip nat outside

Answer

ip access-list standard 100 permit 192.168.10.0 0.0.0.255
ip nat inside source list 100 interface GigabitEthernet0/1 overload
ip nat inside source static 192.168.10.100 203.0.113.10
interface GigabitEthernet0/1
 ip nat inside

Question 13

You are connected to R1. Configure HSRP on R1 and R2 so that R1 is the active gateway for VLAN 100 with a virtual IP of 192.0.2.254. R1 should preempt and track its G0/1 interface to decrement priority by 20 if it goes down. Currently, both routers show active for the group, and the virtual IP is incorrectly set. Troubleshoot and fix the configuration on R1 only.

Accepted Answer

Change the virtual IP to 192.0.2.254 and set priority to 110.. The issue is that both routers are active because the virtual IP on R1 was 192.168.100.254, which is not in the same subnet as the interface IP (192.0.2.1/24), so HSRP couldn't form a common group. Changing the virtual IP to 192.0.2.254 fixes the subnet mismatch. Additionally, setting R1's priority to 110 ensures it becomes the active router because it has preempt configured, and the higher priority overrides R2's default 100. The track command remains correct as it reduces priority if G0/1 fails.

Answer

Change the virtual IP to 192.0.2.254 and remove the track command.

Answer

Change the virtual IP to 192.0.2.254 and configure preempt on R2.

Answer

Change the virtual IP to 192.0.2.254 and set priority to 100.

Question 14

You are connected to R1. The network currently permits all HTTP traffic from hosts on the 192.168.1.0/24 LAN to reach the web server at 203.0.113.10, but SSH traffic (TCP port 22) from the same LAN is being blocked. Additionally, you must ensure that no other traffic from the LAN reaches the server. Configure an extended ACL on R1 to allow only HTTP and SSH from the LAN to the server, and apply it inbound on the correct interface. Verify your solution.

Accepted Answer

Remove the existing ACL from the interface, delete the ACL, create a new extended ACL that permits tcp from 192.168.1.0/24 to host 203.0.113.10 for ports 80 and 22, and apply it inbound on GigabitEthernet0/0.. The existing ACL BLOCK_SSH is applied inbound on GigabitEthernet0/0 and explicitly denies SSH from the LAN to the server, but permits all other IP traffic (including HTTP). The requirement is to allow only HTTP and SSH, blocking everything else. The solution is to remove the current ACL from the interface, delete the ACL, create a new extended ACL that permits tcp from the LAN to the server for ports 80 (HTTP) and 22 (SSH), and implicitly deny all other traffic, then reapply it inbound on GigabitEthernet0/0.

Answer

Modify the existing ACL BLOCK_SSH by adding a permit statement for HTTP and changing the deny SSH to permit SSH, then reapply it inbound on GigabitEthernet0/0.

Answer

Create a new extended ACL that permits tcp from 192.168.1.0/24 to host 203.0.113.10 for ports 80 and 22, and apply it inbound on GigabitEthernet0/1 (the WAN interface).

Answer

Create a new extended ACL that permits tcp from 192.168.1.0/24 to host 203.0.113.10 for ports 80 and 22, and apply it outbound on GigabitEthernet0/0.

Question 15

You are connected to R1. The network uses OSPF between R1 and R2. Configure an extended ACL on R1 so that hosts in VLAN 10 (192.168.10.0/24) can reach the web server at 203.0.113.100 only via HTTP/HTTPS, and hosts in VLAN 20 (192.168.20.0/24) can reach it via any TCP service except HTTP/HTTPS. All other traffic to the server must be denied. Apply the ACL outbound on the interface facing the server. Currently, the ACL is missing the permit for VLAN 20 traffic, causing connectivity loss.

Accepted Answer

Remove the two deny statements and add: permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 1 79, permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 81 442, permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 444 65535, then deny ip any any. The ACL BLOCK_HTTP is applied inbound on G0/0, which is the interface toward the server. The first two deny statements incorrectly block HTTP/HTTPS from any source, including VLAN 20 which should be allowed. The correct approach is to permit HTTP/HTTPS only for VLAN 10, and permit all other TCP services (except HTTP/HTTPS) for VLAN 20, then deny all other traffic. The solution removes the overly broad deny statements and adds specific permits for VLAN 20 to reach the server on any TCP port except 80 and 443, followed by an explicit deny ip any any to enforce the implicit deny.

Answer

Add a permit statement for VLAN 20 before the deny statements: permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 1 65535

Answer

Remove the two deny statements and add: permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 eq www, permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 eq 443

Answer

Add a deny statement for VLAN 20 HTTP/HTTPS before the existing permit statements: deny tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 eq www, deny tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 eq 443, then add a permit tcp 192.168.20.0 0.0.0.255 host 203.0.113.100 range 1 65535

Question 16

You are connected to R1 via the console. The routers R1 and R2 are directly connected using their GigabitEthernet0/0 interfaces, which are in VLAN 100 and use subnet 192.168.1.0/24. Both routers are currently showing as active for HSRP group 10. Configure HSRP on R1's GigabitEthernet0/0 to become the active router (priority 150, preempt enabled, virtual IP 192.168.1.254). Ensure that if R1's GigabitEthernet0/1 WAN interface goes down, its HSRP priority decrements by 30 so that R2 can take over. Also, correct any existing misconfiguration in the HSRP setup.

Accepted Answer

Configure: interface GigabitEthernet0/0, standby 10 ip 192.168.1.254, standby 10 priority 150, standby 10 preempt, standby 10 track GigabitEthernet0/1 decrement 30. Also, ensure preempt is enabled on R1 (currently missing) and correct any duplicate virtual IP.. Both routers showing as active means either R2 has an equal or higher priority or preempt is missing, preventing a single active election. To fix this, on R1's GigabitEthernet0/0 interface, set standby priority 150 with preempt enabled. Add tracking of GigabitEthernet0/1 with decrement 30 so the priority drops to 120 if the WAN link fails, allowing R2 to become active. The existing misconfiguration is that preempt is either absent or disabled, causing a split-brain scenario; this solution makes R1 the active router and provides correct failover.

Answer

Configure: interface GigabitEthernet0/0, standby 10 ip 192.168.1.254, standby 10 priority 150, standby 10 preempt, standby 10 track GigabitEthernet0/1 decrement 30. No other changes needed because preempt is already enabled.

Answer

Configure: interface GigabitEthernet0/0, standby 10 ip 192.168.1.254, standby 10 priority 150, standby 10 preempt, standby 10 track GigabitEthernet0/1 decrement 30. Also, change the virtual IP to 192.168.1.1 because the current one is wrong.

Answer

Configure: interface GigabitEthernet0/0, standby 10 ip 192.168.1.254, standby 10 priority 150, standby 10 preempt, standby 10 track GigabitEthernet0/1 decrement 30. Also, remove the standby 10 track command from R2 to prevent conflicts.

Question 17

You are connected to R1. Configure R1 so that it uses a floating static route to reach the 203.0.113.0/24 network via R2 only when the primary route (learned via EIGRP) fails. The primary route has an administrative distance of 90. Currently, R1 has no route to 203.0.113.0/24 because EIGRP is down on the direct link. Ensure the floating static route is installed and used.

Accepted Answer

ip route 203.0.113.0 255.255.255.0 10.0.0.2 95. The issue is that R1 has no route to 203.0.113.0/24 because EIGRP is not working (likely due to misconfiguration or link failure). A floating static route with an administrative distance greater than EIGRP's default AD of 90 is needed. By configuring a static route to 203.0.113.0/24 via next-hop 10.0.0.2 with AD 95, the static route will be used only when EIGRP is down (since 95 > 90, EIGRP is preferred when active). The command 'ip route 203.0.113.0 255.255.255.0 10.0.0.2 95' accomplishes this.

Answer

ip route 203.0.113.0 255.255.255.0 10.0.0.2 90

Answer

ip route 203.0.113.0 255.255.255.0 10.0.0.2 85

Answer

ip route 203.0.113.0 255.255.255.0 10.0.0.2

Question 18

You are troubleshooting connectivity from R1 to the 172.16.20.0/24 network. The network engineer configured a floating static route on R1 as a backup for the OSPF-learned route, but after the primary OSPF route fails, the backup does not take over. Examine the current routing table and partial configuration on R1, then fix the issue so that when the OSPF neighbor goes down, R1 can still reach 172.16.20.0/24 via R3.

Accepted Answer

Change the static route to use an exit interface: ip route 172.16.20.0 255.255.255.0 GigabitEthernet0/1 203.0.113.2. The floating static route was configured with an administrative distance of 130, intended to be higher than OSPF's default AD of 110 so it would only be used as a backup. However, the static route's AD is set as 130 (the command uses the distance option), which is correct. The problem is that OSPF's AD is 110, which is lower, so the static route is not installed while OSPF is up. But when OSPF fails, the static route should appear. The issue is that the static route is pointing to a next-hop (203.0.113.2) that is not directly connected; R1 has no route to 203.0.113.2, causing the static route to be inactive. To fix, you must either change the next-hop to a directly connected interface (e.g., GigabitEthernet0/1) or add a route to reach 203.0.113.2. The simplest solution is to configure the static route with an exit interface: 'ip route 172.16.20.0 255.255.255.0 GigabitEthernet0/1 203.0.113.2'. This ensures the route is valid when the OSPF route disappears.

Answer

Change the administrative distance of the static route to 110

Answer

Remove the OSPF process from R1

Answer

Add a static route to 203.0.113.0/24 via R1's directly connected interface

Question 19

You are connected to R1. Configure AAA with a RADIUS server at 10.0.0.2 using key 'cisco123' for authentication. Then troubleshoot why 802.1X on interface GigabitEthernet0/1 remains in unauthorized state. Ensure that the default login authentication uses RADIUS first, then local fallback, and fix any configuration issues that prevent 802.1X from working.

Accepted Answer

Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and ensure the RADIUS server is reachable with the correct key.. The 802.1X port is stuck in UNAUTHORIZED because AAA authentication for dot1x is set to 'local' but there is no local user database configured. Additionally, the RADIUS server is configured but not used for dot1x or login. The fix is to change 'aaa authentication dot1x default' to use group radius, and 'aaa authentication login default' to group radius local for fallback. Also ensure the RADIUS server is reachable and the key matches the server.

Answer

Configure 'aaa authentication dot1x default local' and 'aaa authentication login default local' and create a local user with the same credentials as the RADIUS server.

Answer

Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default local' and ensure the RADIUS server key is 'cisco123'.

Answer

Configure 'aaa authentication dot1x default group radius' and 'aaa authentication login default group radius local' and change the RADIUS server key to 'cisco'.

Question 20

You are connected to R1 via the console. The network currently uses EIGRP as its IGP, but you recently configured a static default route toward R2 (next-hop 203.0.113.2) to reach the Internet. However, traffic from R1 to the Internet is not taking the expected path. Examine the provided routing table and partial configuration, then fix the issue so that the static default route is used only when the EIGRP-learned default route is unavailable.

Accepted Answer

Configure the static route with an administrative distance of 100 using 'ip route 0.0.0.0 0.0.0.0 203.0.113.2 100'.. The static default route was configured with an administrative distance (AD) of 10, which is lower than the EIGRP‑learned default route's AD of 90. This made the static route the preferred path, overriding the intended primary EIGRP route. To create a floating static route that only activates when the EIGRP route disappears, the static AD must be raised above 90—using 'ip route 0.0.0.0 0.0.0.0 203.0.113.2 100' ensures the EIGRP route is primary. Option B is wrong because removing the EIGRP route eliminates the preferred path entirely, defeating the backup purpose. Option C fails because EIGRP metrics are irrelevant against a lower‑AD static route; AD dictates route source preference. Option D is incorrect because static routes do not accept a metric parameter—the trailing number sets the AD, not a metric.

Answer

Remove the EIGRP default route by configuring 'no network 0.0.0.0' under the EIGRP process.

Answer

Increase the metric of the EIGRP default route to make it less preferred than the static route.

Answer

Configure the static route with a next-hop of 203.0.113.2 and a metric of 100.