CCNA Practice Exam 63 — 20 Questions

Question 1

Match each term to the best description.

Accepted Answer

Northbound API: Interface between SDN controller and applications. These terms are correctly matched with their definitions in the context of network programmability and SDN.

Answer

Southbound API: Interface between SDN controller and network devices

Answer

Eastbound API: Interface between SDN controller and network devices

Answer

Westbound API: Interface between SDN controller and applications

Question 2

Match each route source or concept to its most accurate description.

Accepted Answer

Directly connected route: A route that is automatically added to the routing table when an interface is configured with an IP address and is up/up.. These are fundamental routing concepts and sources. Each pairing matches the route source with its accurate description as taught in Cisco certification exams.

Answer

Static route: A route that is learned via a dynamic routing protocol such as OSPF or EIGRP.

Answer

Default route: A route that is used when no other specific route matches the destination IP address, typically pointing to a next-hop router.

Answer

Floating static route: A static route that is used as a backup and has a higher administrative distance than the primary route.

Question 3

Match each IPv6 host-configuration concept to its most accurate description.

Accepted Answer

Stateless address autoconfiguration: Host generates its own IPv6 address using router advertisements. SLAAC enables stateless autoconfiguration; stateful DHCPv6 assigns addresses; SLAAC uses RA and EUI-64; DHCPv6-PD delegates prefixes; link-local addresses are for local links.

Question 4

Match each HTTP method to the most accurate action it commonly represents in REST-style APIs.

Accepted Answer

GET: Retrieve data from a resource. HTTP methods correspond to CRUD operations in REST: GET for read, POST for create, PUT for full update, PATCH for partial update, DELETE for delete, and HEAD for headers only.

Answer

GET: Create a new resource

Answer

GET: Update an existing resource

Answer

GET: Delete a resource

Question 5

Match each HTTP method to the action it most commonly performs in a REST API.

Accepted Answer

GET: Retrieve a resource or collection of resources.. These are the standard HTTP methods and their typical CRUD operations in RESTful APIs, as defined by the HTTP specification.

Question 6

Drag and drop the following steps into the correct order to configure a WLAN for WPA3-Enterprise on a Cisco WLC and sequence a wireless client association process.

Accepted Answer

Create WLAN with WPA3-Enterprise security, enable WLAN, client associates, 802.1X authentication, DHCP IP assignment. The configuration creates the WLAN with WPA3-Enterprise security, enables it, then the client associates and completes 802.1X authentication before getting an IP.

Answer

Create WLAN with WPA3-Enterprise security, enable WLAN, client associates, DHCP IP assignment, 802.1X authentication

Answer

Enable WLAN, create WLAN with WPA3-Enterprise security, client associates, 802.1X authentication, DHCP IP assignment

Answer

Create WLAN with WPA3-Enterprise security, client associates, enable WLAN, 802.1X authentication, DHCP IP assignment

Question 7

An engineer configures a floating static route to 0.0.0.0/0 with an administrative distance of 200 while OSPF is providing a default route. What is the intended behavior?

Accepted Answer

The static default route acts as a backup and becomes active only if the OSPF default route is lost.. The intended behavior is that the static default route stays in reserve and becomes active only if the OSPF-learned default route disappears. In plain language, the administrator wants a backup path, not a replacement for the normal OSPF path. By assigning the static route a higher administrative distance than OSPF, the router treats it as less trustworthy during normal operation.

This is a standard floating-static design. The static route is still configured, but it does not normally appear as the preferred forwarding choice until the lower-distance route is lost. That is the key operational purpose of the configuration.

Answer

The static default route overrides OSPF immediately because it is manually configured.

Answer

Both default routes must always load-balance together.

Answer

The router ignores both defaults because they overlap.

Question 8

PCs in VLAN 30 on SwitchA cannot reach PCs in VLAN 30 on SwitchB. VLAN 30 exists on both switches and all other VLANs work across the same link. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 30 is not allowed on the trunk from SwitchA.. The trunk is up, but VLAN 30 is missing from the allowed list on SwitchA. In plain language, the hallway between the switches is open, but one side is refusing to carry that specific VLAN through the hallway. Since the other VLANs are working, the failure is selective rather than total. That strongly points to an allowed-VLAN problem rather than a broader trunk outage.

This is a classic CCNA switching scenario because it tests whether you can separate trunk health from per-VLAN forwarding. A trunk can be operational and still block one VLAN if that VLAN is not permitted on one side. The native VLAN and encapsulation are not the issue shown here — the mismatch in the allowed list is.

Answer

The native VLAN is mismatched.

Answer

The trunk must use ISL instead of 802.1Q.

Answer

VLAN 30 must be configured as the native VLAN.

Question 9

Why is the combination of strong authentication and centralized logging generally better than using either one alone?

Accepted Answer

Authentication helps prevent unauthorized access, while centralized logging improves visibility and investigation.. The combination is better because strong authentication helps prevent unauthorized access, while centralized logging helps detect, review, and investigate activity across the environment. In plain language, one control focuses more on prevention, while the other improves visibility and accountability. Together they create a stronger security posture than either one alone.

This is an important design mindset. Security is stronger when controls complement each other instead of trying to solve every problem with one mechanism. The correct answer is the one focused on prevention plus visibility.

Answer

They are redundant because both perform exactly the same function.

Answer

Centralized logging makes authentication unnecessary.

Answer

Strong authentication removes the need for device event records.

Question 10

Why is administratively shutting down unused switch ports considered a useful hardening practice?

Accepted Answer

Because it reduces attack surface by removing unused active connection points.. Unused active ports create unnecessary exposure. In practical terms, if a port is not needed, leaving it active gives someone an opportunity to connect a device where no legitimate business need exists. Shutting the port down removes that access point and reduces attack surface.

This is a simple but effective hardening measure. It does not replace other controls, but it removes a risk that does not need to exist in the first place.

Answer

Because it forces all users to manage devices with SSH.

Answer

Because it converts remaining ports into trunks.

Answer

Because it replaces VLAN segmentation.

Question 11

Why is HTTPS usually preferred over HTTP when accessing a controller API?

Accepted Answer

Because HTTPS provides encrypted transport for API traffic.. HTTPS is preferred because it protects the communication with encryption while it crosses the network. In practical terms, controller APIs often carry tokens, credentials, device state, or configuration information that should not be exposed in clear text. HTTPS helps protect those requests and responses in transit.

This does not make HTTPS the same thing as JSON, nor does it remove the need for authentication. It is simply the more secure transport choice for sensitive API communication.

Answer

Because HTTPS automatically replaces authentication.

Answer

Because HTTPS is the only format that can carry JSON.

Answer

Because HTTP cannot carry controller data at all.

Question 12

A network operations team wants centralized logging from routers and switches and also wants meaningful severity filtering. Which two statements about syslog are correct?

Accepted Answer

Devices can send log messages to a remote syslog server for central storage. Syslog provides centralized event reporting by allowing devices to send log messages to a remote server (option A is correct). Severity levels enable filtering based on event seriousness (option B is correct). Option C is incorrect because syslog does not assign IP addresses dynamically—that is the role of DHCP. Option D is incorrect because syslog logs events and does not replace SNMP counters, which remain the primary method for collecting interface statistics.

Answer

Syslog is used to assign IP addresses dynamically to endpoints

Answer

Syslog entries replace SNMP counters for interface statistics

Question 13

Why is shutting down unused switch ports considered a useful hardening measure?

Accepted Answer

Because it removes unused active connection points and reduces attack surface.. Shutting down unused switch ports reduces attack surface by removing unnecessary active connection points. This is a simple but effective control because it eliminates the risk of unauthorized physical access. Option B is incorrect because disabling a port does not change its mode to trunk; trunking is a separate configuration. Option C is incorrect because shutting down ports does not replace VLAN segmentation; VLANs provide logical separation, while port shutdown is a physical access control. Option D is incorrect because shutting down ports does not force devices to use SSH; SSH is an application-layer protocol for secure remote management, unrelated to port shutdown.

Answer

Because it converts all other ports into trunks.

Answer

Because it replaces VLAN segmentation.

Answer

Because it forces devices to use SSH.

Question 14

Which two statements accurately describe WPA2 and WPA3 in wireless security?

Accepted Answer

Both are wireless security standards used to help protect WLAN access and traffic.. WPA2 and WPA3 are wireless security standards used to protect WLAN access and traffic. In practical terms, both are associated with securing wireless communication, but WPA3 is generally positioned as the newer standard with security improvements over WPA2. The key idea at CCNA level is recognizing them as WLAN security standards rather than confusing them with SSIDs, controllers, or radio bands.

You do not need deep protocol internals here. You need the role and relative positioning right.

Answer

Both are names for specific 802.11 radio frequencies.

Answer

WPA2 and WPA3 are types of trunk ports.

Answer

WPA3 eliminates the need for SSIDs.

Question 15

A switch has a root port and an alternate port for the same VLAN. Which statement best explains the operational role of the alternate port?

Accepted Answer

It is a backup path toward the root bridge and normally does not forward while the active root path is healthy.. The alternate port acts as a backup path toward the root bridge and stays in a non-forwarding state under normal conditions. In practical terms, STP keeps it ready in case the active path fails, but it does not allow it to forward frames while the primary root path is healthy. That is how STP preserves redundancy without creating loops.

This question is useful because many learners understand root ports and designated ports but do not clearly understand what the alternate role represents.

Answer

It always forwards traffic at the same time as the root port for load balancing.

Answer

It is the port that elects the root bridge for the VLAN.

Answer

It is a special routed port used for inter-VLAN communication.

Question 16

Drag and drop the following steps into the correct order to replace a faulty SFP on a Cisco switch and verify the fiber link.

Accepted Answer

Physically replace the SFP, then connect the cable, and finally verify the link and check for errors.. The correct order is to physically replace the SFP first because installing the new module before connecting the cable prevents potential damage to the connector or fiber from inserting the cable into an empty port. After the SFP is seated, you connect the cable to establish the physical link. Finally, you verify the link status and check for errors (using commands like show interface) to confirm the replacement was successful and the link is operational. Wrong orders either verify before the change (making the verification meaningless) or connect the cable before installing the SFP, which can damage the equipment.

Question 17

Which of the following correctly describes the sequence of the TCP three-way handshake between a client and a server?

Accepted Answer

Client sends SYN, Server responds with SYN-ACK, Client sends ACK. The TCP three-way handshake establishes a reliable connection in three steps: the client sends a SYN, the server replies with SYN-ACK, and the client acknowledges with an ACK. Option A correctly depicts this. Option B omits the server's SYN, leaving synchronization incomplete. Option C reverses the roles by having the server initiate, which never occurs in a standard handshake. Option D begins with a SYN-ACK, which is not a valid initial packet; the handshake must start with a SYN.

Answer

Client sends SYN, Server responds with ACK, Client sends SYN-ACK

Answer

Server sends SYN, Client responds with SYN-ACK, Server sends ACK

Answer

Client sends SYN-ACK, Server responds with SYN, Client sends ACK

Question 18

Drag and drop the following steps into the correct order to configure a WPA3 SSID on a Cisco WLC and complete a wireless client association.

Accepted Answer

Create a new WLAN with SSID and WPA3-Personal security, enable the WLAN, then the client scans, associates, and obtains an IP via DHCP.. The steps follow the standard WLC configuration sequence: create the WLAN, set WPA3-Personal security, enable it, then the client associates and gets an IP.

Answer

Enable the WLAN first, then create the WLAN with SSID and WPA3-Personal security, then the client associates and obtains an IP.

Answer

Create the WLAN, enable it, then configure WPA3-Personal security, then the client associates and gets an IP.

Answer

Create the WLAN, configure WPA3-Personal security, enable the WLAN, then the client obtains an IP before associating.

Question 19

Switch SW1 sends traffic for VLAN 30 across a trunk to SW2, but hosts in VLAN 30 on SW2 cannot communicate with hosts in VLAN 30 on SW1. Other VLANs work across the trunk. Which trunk issue is most likely?

Accepted Answer

VLAN 30 is pruned or missing from the allowed VLAN list. If only one VLAN fails across an otherwise healthy trunk, a missing or filtered VLAN in the allowed list is a common cause. Native VLAN matching and encapsulation would affect broader trunk behavior, not usually just one VLAN in this way.

Answer

The native VLAN is set to 1 on both switches

Answer

The trunk uses 802.1Q encapsulation

Answer

SW1 is the STP root bridge

Question 20

Which DHCP message does the client send to formally accept an offered address?

Accepted Answer

REQUEST. In the DORA process, the client sends DHCPREQUEST after receiving an offer. The server then responds with DHCPACK if the lease is granted.

Answer

DISCOVER

Answer

OFFER

Answer

ACK