CCNA Practice Exam 62 — 20 Questions

Question 1

Drag and drop the following IOS-XE CLI commands into the correct order to configure AAA with a RADIUS server and then enable 802.1X port authentication on an interface.

Accepted Answer

aaa new-model. AAA configuration must precede 802.1X. The correct order is: first enable AAA globally with 'aaa new-model', then define the RADIUS server with 'radius server RADIUS-SERVER', then globally enable 802.1X with 'dot1x system-auth-control', and finally on the interface set authentication port-control with 'authentication port-control auto'.

Question 2

An administrator has just configured OSPF in a single area between router R1 and router R2, which are directly connected via their Gi0/0 interfaces with IP addresses 10.0.0.1/30 and 10.0.0.2/30. On R1, the command show ip ospf neighbor shows no entries, and a further check on R2 with show ip ospf interface gi0/0 indicates that the interface is passive. Which configuration error is most likely causing the adjacency failure?

Accepted Answer

R2 has the passive-interface default command but no no passive-interface command for Gi0/0.. The output on R2 shows the Gi0/0 interface is passive, meaning OSPF will not send or receive hello packets on that interface, preventing neighbor discovery. The passive-interface default command makes all interfaces passive by default, and without a no passive-interface Gi0/0 command, the interface remains passive, blocking adjacency formation. This directly explains why R1's show ip ospf neighbor shows no entries.

Answer

The network command on R1 does not cover the 10.0.0.0/30 subnet.

Answer

The OSPF process IDs on R1 and R2 are mismatched.

Answer

The hello and dead intervals on R1 and R2 are not the same.

Question 3

Match each automation term to the best description.

Accepted Answer

Playbook: A YAML file defining automation tasks in Ansible. In Ansible, a Playbook is a YAML file that defines automation tasks, making option A correct. A Module is a reusable unit of code that performs a specific task, such as managing files or installing software, matching option B. An Inventory is a list of managed nodes (hosts) that Ansible targets, aligning with option C. A Role is a structured way to group tasks, variables, and files for reuse, which corresponds to option D. These terms are central to Ansible automation and should not be confused with data modeling languages or APIs.

Question 4

Match each service or visibility technology to the most appropriate use case.

Accepted Answer

SNMP for device metrics, NetFlow for traffic analysis, Syslog for logs, IP SLA for performance measurement, Wireshark for packet analysis, Nmap for discovery and security.. Syslog collects device events and messages centrally, providing a centralized log repository. SNMP reads interface status and counters from devices, offering real-time device monitoring. NetFlow analyzes network traffic to identify bandwidth usage by host, making it ideal for finding top talkers. NTP synchronizes clocks across systems to maintain consistent event timelines. Each technology is matched to its primary use case.

Answer

SNMP for traffic analysis, NetFlow for device metrics, Syslog for performance measurement, IP SLA for logs, Wireshark for discovery and security, Nmap for packet analysis.

Answer

SNMP for logs, NetFlow for performance measurement, Syslog for device metrics, IP SLA for traffic analysis, Wireshark for discovery and security, Nmap for packet analysis.

Answer

SNMP for performance measurement, NetFlow for logs, Syslog for device metrics, IP SLA for traffic analysis, Wireshark for discovery and security, Nmap for packet analysis.

Question 5

An administrator wants to prevent a specific subnet from using Telnet to reach network devices, while still allowing SSH from that same subnet. What is the strongest reason a standard ACL is not enough by itself?

Accepted Answer

Because the policy must distinguish Telnet from SSH, which requires protocol or port-level matching.. A standard ACL is not enough by itself because the policy depends on distinguishing different protocols or destination ports, not just source address. In practical terms, the source subnet is the same for both Telnet and SSH. The ACL therefore needs to tell those two management protocols apart, which requires more granular matching than source-only logic.

This is one of the clearest examples of why extended ACL capability matters.

Answer

Because standard ACLs are valid only on wireless networks.

Answer

Because Telnet and SSH always use the same destination port.

Answer

Because SSH can never be filtered with ACLs.

Question 6

Drag and drop the following steps into the correct order to configure and verify HSRP on a router interface.

Accepted Answer

Enter interface configuration mode for the target interface.. The correct order begins by entering interface configuration mode, because all HSRP commands are applied at the interface level. Next, assign a physical IPv4 address to the interface, as HSRP requires a Layer 3 interface with an IP address to function. Set HSRP version 2 before defining the HSRP group to ensure compatibility with extended group numbers and newer features. Then configure the HSRP group number and virtual IP address to create the standby group. After that, set the router’s priority and enable preemption; these steps customize the active/standby election process. Finally, verify the configuration with the show standby command to confirm HSRP operation.

Question 7

Which of the following is the correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from the 192.168.1.0/24 network to the 10.0.0.0/24 network, applied inbound on the router's G0/0 interface?

Accepted Answer

Enter global configuration mode, create ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, permit ip any any, then enter interface G0/0, apply ip access-group in. The correct order to plan, configure, and apply an extended ACL that blocks Telnet traffic from 192.168.1.0/24 to 10.0.0.0/24, applied inbound on G0/0, is: first enter global configuration mode, create the ACL with a deny statement for the specific source and destination, then add a permit ip any any statement, then enter interface G0/0, and apply the ACL inbound with ip access-group in. Option B is incorrect because the ACL must be created before entering the interface. Option C is incorrect because the order of ACEs within the ACL must have the specific deny before the broad permit. Option D is incorrect because ip access-group must be applied on an interface, not globally.

Answer

Enter interface G0/0, apply ip access-group <acl-number> in, then create ACL with deny tcp any any eq telnet, permit ip any any

Answer

Enter global configuration mode, create ACL with permit ip any any, deny tcp any any eq telnet, then enter interface G0/0, apply ip access-group <acl-number> in

Answer

Enter global configuration mode, create ACL with deny tcp any any eq telnet, permit ip any any, then apply ip access-group <acl-number> in without entering interface

Question 8

You are troubleshooting a PC connected to switch SW1. The PC cannot access the internet. SW1 is connected to router R1 via port G0/1. R1 provides default gateway and DHCP services. Analyze the provided show output and fix the connectivity issue so that the PC can ping 8.8.8.8. === Show output from R1 ===

R1# show ip interface brief
Interface             IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0    unassigned      YES manual administratively down down
GigabitEthernet0/1    10.0.0.1        YES NVRAM  up                    up

=== Show output from PC ===

C:\> ipconfig
Ethernet adapter Ethernet0:
   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . : 169.254.123.45
   Subnet Mask . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . :

=== Show output from SW1 ===

SW1# show vlan brief
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/1, Gi0/2, Gi0/3

Accepted Answer

Configure R1's interface G0/0 with IP address 192.168.1.1/24 and ensure the interface is not administratively down.. The PC's APIPA address (169.254.x.x) indicates DHCP failure. The router's DHCP pool is correctly configured and has a lease, but the show output reveals that R1's interface G0/0 is administratively down and has no IP address. Without a working IP on G0/0, the router cannot serve DHCP or route traffic for VLAN 1, even though both the PC and the router are in the same VLAN. Option A fixes the root cause by assigning the correct subnet IP and bringing the interface up. Option B is incorrect because moving the PC to a different VLAN or creating subinterfaces does nothing to enable the router's physical interface where DHCP and routing must run. Option C is wrong because DHCP snooping or trust configurations are irrelevant when the router's own interface is down/unaddressed. Option D is a workaround that only masks the problem; the scenario requires a working DHCP service, and a static IP would not restore the intended design.

Answer

Change the VLAN on SW1's port G0/2 to VLAN 10 and configure R1's subinterface G0/0.10 with IP 192.168.1.1/24.

Answer

Enable DHCP snooping on SW1 and configure the port G0/2 as a trusted port.

Answer

Configure a static IP address of 192.168.1.10/24 on the PC with default gateway 192.168.1.1.

Question 9

Which three of the following are characteristics of wireless LAN (WLAN) operation in the 2.4 GHz and 5 GHz bands? (Choose three.)

Accepted Answer

The 5 GHz band offers more non-overlapping channels than the 2.4 GHz band.. The 5 GHz band offers more non-overlapping channels (up to 23 or 25, depending on regulatory domain) compared to the 2.4 GHz band, which has only three non-overlapping channels (1, 6, 11). The 2.4 GHz band generally provides longer range due to better propagation characteristics and lower attenuation through obstacles. Dual-band access points can operate simultaneously on both bands, allowing clients to connect on either frequency.

Answer

The 5 GHz band experiences more interference from Bluetooth devices.

Answer

Both bands require a license for operation in enterprise environments.

Answer

The 2.4 GHz band supports higher data rates than the 5 GHz band.

Question 10

A switchport connected to another switch should carry VLANs 10, 20, and 30. The interface is operational, but only VLAN 10 works. VLANs 20 and 30 fail. Which explanation is most likely if the port was accidentally configured as an access port in VLAN 10?

Accepted Answer

The interface is carrying only VLAN 10 because an access port does not transport multiple VLANs like a trunk.. An access port is limited to a single VLAN, so only VLAN 10 traverses the link. Option B is incorrect: IP subnet masks are irrelevant on switchports that operate at Layer 2. Option C is incorrect: inter-switch links typically use trunk ports, not routed ports. Option D is incorrect: STP does not block based on VLAN IDs; it blocks redundant paths, not specific VLANs.

Answer

VLAN 20 and 30 require different IP subnet masks on the switches.

Answer

Every inter-switch link must use a routed port instead of a trunk.

Answer

STP blocks all VLANs except VLAN 10 by design.

Question 11

You are connected to R1. Configure inter-VLAN routing on R1 using router-on-a-stick so that hosts in VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24) can communicate. The switch SW1 is already configured with VLANs and trunking, but R1's current configuration prevents traffic. Identify and fix the issues.

Accepted Answer

Enable the physical interface with the 'no shutdown' command on R1.. The issue was that the physical interface GigabitEthernet0/0 on R1 was administratively down, causing all subinterfaces for VLANs 10 and 20 to be in a down state. Enabling it with 'no shutdown' brings the trunk up, allowing inter-VLAN routing because the switch already has trunking configured. The other options are incorrect because they suggest steps that are either already in place (IP routing) or not needed (changing encapsulation or moving no shutdown to subinterfaces).

Answer

Change the encapsulation on the subinterfaces to use dot1Q with native VLAN 10 and 20 respectively.

Answer

Enable IP routing globally with the 'ip routing' command on R1.

Answer

Remove the 'no shutdown' from the subinterfaces and apply it only to the physical interface.

Question 12

You are troubleshooting a wireless client association failure on a Cisco WLC. The client is unable to connect to the corporate SSID 'CorpNet' and reports an authentication error. Review the WLC configuration and fix the issue so that the client can associate and obtain an IP address from VLAN 100. The WLC management IP is 192.168.1.10/24.

Accepted Answer

Change the WLAN security to WPA2, enable SSID broadcast, and configure the WLAN interface to use VLAN 100 with a DHCP scope on that VLAN.. The client authentication and DHCP issues are caused by: (1) WPA3 being configured while the client only supports WPA2, (2) SSID broadcast disabled, preventing client discovery, and (3) the WLAN's client VLAN (100) lacking a DHCP server or scope. The management interface VLAN (1) does not interfere with client DHCP. To resolve, change security to WPA2, enable SSID broadcast, and ensure the WLAN is associated with the correct VLAN (100) and a DHCP scope exists on that VLAN.

Answer

Change the WLAN security to WPA3 only, enable SSID broadcast, and change the management interface IP to 192.168.100.10/24.

Answer

Keep WPA3, disable SSID broadcast for security, and configure the WLAN interface to use VLAN 100 with a DHCP scope on VLAN 1.

Answer

Change the WLAN security to WPA2, keep SSID broadcast disabled, and configure the WLAN interface to use VLAN 1.

Question 13

You are connected to R1 via console. R1 is directly connected to R2 over a 1000BASE-T link that is failing to come up. Configure interface GigabitEthernet0/0 on R1 with the correct speed and duplex settings to match R2's configuration, and then verify the link is operational. Additionally, determine the appropriate SFP type for a new 40 km fiber link between R1 and R2.

Accepted Answer

Configure interface GigabitEthernet0/0 with 'speed 1000' and 'duplex full'. For the new fiber link, use a 1000BASE-ZX SFP.. The link is down because R1 is set to auto-negotiate speed and duplex while R2 is hardcoded to 1000 Mbps full duplex. This mismatch causes the link to fail. To fix, configure R1's GigabitEthernet0/0 with 'speed 1000' and 'duplex full'. For the new 40 km fiber link, a 1000BASE-ZX SFP is required as it supports distances up to 70 km. (1000BASE-LX supports only up to 10 km and is insufficient for 40 km.) Verify with 'show interfaces GigabitEthernet0/0' to see the link state change to up/up.

Answer

Configure interface GigabitEthernet0/0 with 'speed auto' and 'duplex auto'. For the new fiber link, use a 1000BASE-SX SFP.

Answer

Configure interface GigabitEthernet0/0 with 'speed 1000' and 'duplex half'. For the new fiber link, use a 1000BASE-LX SFP.

Answer

Configure interface GigabitEthernet0/0 with 'speed 100' and 'duplex full'. For the new fiber link, use a 1000BASE-EX SFP.

Question 14

Exhibit: A wireless client can see the SSID and associates successfully, but it never gets network access. Other users on the same SSID work. Which issue is the best fit?

Accepted Answer

The client failed to obtain a valid IP address from DHCP. Successful association means the radio connection is up. If only one client fails to get network access while others work, the most likely issue is a client-specific addressing problem such as not obtaining a valid DHCP lease. Option A is incorrect because channel width affects all clients, not just one. Option C is incorrect because hiding the SSID does not affect network access after association. Option D is incorrect because WPA2 does not block clients due to NTP; NTP is unrelated to client authentication.

Answer

The AP is advertising the wrong channel width

Answer

The SSID must be changed from broadcast to hidden

Answer

WPA2 automatically blocks clients until NTP is configured

Question 15

Why is JSON often preferred over completely unstructured text in API responses?

Accepted Answer

Because JSON provides structured, machine-readable data that software can parse consistently.. JSON is preferred because it gives software a predictable structure to parse. In practical terms, an application can look for keys, values, arrays, and objects instead of trying to interpret a free-form text paragraph meant mainly for human readers. That makes programmatic processing far more reliable. This is one of the main reasons JSON is so common in controller APIs and automation tools. It is about structure and machine readability, not encryption, authentication, or HTTPS.

Answer

Because JSON automatically encrypts the payload.

Answer

Because JSON replaces the need for authentication.

Answer

Because JSON is the same thing as HTTPS.

Question 16

Drag and drop the port configuration commands/technologies on the left to their corresponding descriptions on the right.

Accepted Answer

switchport mode access: Sets the interface as a nontrunking access port. These are common Cisco IOS commands used for port configuration, each with a specific function.

Question 17

Which protocol is used to resolve a hostname such as www.example.com into an IP address?

Accepted Answer

DNS. DNS resolves names to addresses. DHCP hands out addressing parameters, NTP synchronizes time, and SNMP is used for management and monitoring.

Answer

DHCP

Answer

NTP

Answer

SNMP

Question 18

Which TWO statements about IPv4/IPv6 static routing are true?

Accepted Answer

An IPv6 default static route can be configured using the destination prefix ::/0.. The IPv6 default static route uses the destination prefix ::/0, which matches all IPv6 addresses, similar to 0.0.0.0/0 in IPv4. Option D is correct because a floating static route is configured with a higher administrative distance and only becomes active when the primary route (with a lower AD) is removed or fails. Option A is wrong: a floating static route is configured with a higher administrative distance, not lower. Option C is wrong: a directly connected route has an administrative distance of 0, which is always preferred over a static route (even with AD 1). Option E is wrong: IPv4 static routes use the 'ip route' command, while IPv6 static routes use the 'ipv6 route' command; the syntax is different.

Answer

A floating static route is configured with a lower administrative distance than the primary route.

Answer

A static route with an administrative distance of 1 is preferred over a directly connected route.

Answer

IPv4 and IPv6 static routes are configured using the same command syntax.

Question 19

A network engineer replaces a failed 1000BASE-LX SFP on a core switch with a new transceiver of the same type. After connecting the single-mode fiber, the link remains down and a 'show interfaces gig1/0/49 transceiver' reveals an Rx power of –30 dBm, while the far-end SFP is transmitting at –3 dBm over a 2 km span. The fiber patch cord shows no visible damage.

Accepted Answer

Excessive attenuation due to a dirty or damaged fiber connector is preventing the link from coming up.. The measured Rx power of –30 dBm is far below the receive sensitivity threshold for 1000BASE-LX (typically –19 to –22 dBm), even though the transmitter is outputting a healthy –3 dBm over only 2 km. This indicates excessive loss in the optical path, most commonly caused by a dirty or damaged fiber connector. Cleaning the connector ends with an appropriate fiber cleaning tool and inspecting with a microscope would likely resolve the issue.

Answer

The new SFP is a counterfeit Cisco transceiver that cannot establish a stable link.

Answer

The SFP is not fully seated in the switch port, causing an intermittent optical connection.

Answer

The single-mode fiber distance exceeds the 10 km maximum for 1000BASE-LX, leading to severe signal dispersion.

Question 20

You are connected to R1 via console. R1 and R2 are directly connected via GigabitEthernet0/0. Configure OSPF process 1 on both routers so that they form a full adjacency. R1's router-id must be 1.1.1.1, and R2's router-id must be 2.2.2.2. Use network statements to advertise the direct link. Ensure that R1 does not send OSPF hellos out of its GigabitEthernet0/1 interface. The current configuration on R1 has mismatched hello and dead timers, and an incorrect network type, preventing adjacency. Fix all issues.

Accepted Answer

On R1, configure 'ip ospf hello-interval 10' and 'ip ospf dead-interval 40' under interface GigabitEthernet0/0, and ensure network type is broadcast. On R2, configure 'router-id 2.2.2.2' under router ospf 1. Also, on R1, add 'passive-interface GigabitEthernet0/1' under router ospf 1.. The adjacency was failing because R1 had incorrect hello (30) and dead (120) timers, while R2 used defaults (10/40). Additionally, R1’s network type was set to a non-broadcast type, causing a mismatch. To fix, on R1’s GigabitEthernet0/0, set hello-interval 10, dead-interval 40, and network type broadcast. In OSPF process 1 on R1, configure passive-interface GigabitEthernet0/1 to suppress hellos on that interface. On R2, under router ospf 1, set router-id 2.2.2.2. Option A addresses all requirements. Option B uses wrong timers and passive-interface default, which blocks hellos on all interfaces, breaking adjacency. Option C sets network type point-to-point, creating a type mismatch with R2’s broadcast, preventing adjacency. Option D omits the passive-interface command, failing to suppress hellos on GigabitEthernet0/1 as required.

Answer

On R1, configure 'ip ospf hello-interval 30' and 'ip ospf dead-interval 120' under interface GigabitEthernet0/0, and set network type to point-to-point. On R2, configure 'router-id 2.2.2.2' under router ospf 1. Also, on R1, add 'passive-interface default' under router ospf 1.

Answer

On R1, configure 'ip ospf hello-interval 10' and 'ip ospf dead-interval 40' under interface GigabitEthernet0/0, and set network type to point-to-point. On R2, configure 'router-id 2.2.2.2' under router ospf 1. Also, on R1, add 'passive-interface GigabitEthernet0/1' under router ospf 1.

Answer

On R1, configure 'ip ospf hello-interval 10' and 'ip ospf dead-interval 40' under interface GigabitEthernet0/0, and ensure network type is broadcast. On R2, configure 'router-id 2.2.2.2' under router ospf 1. Also, on R1, add 'network 10.0.0.0 0.255.255.255 area 0' under router ospf 1.