CCNA Practice Exam 64 — 20 Questions

Question 1

Drag and drop the following steps into the correct order to configure and apply an extended ACL that permits only HTTP traffic from the 192.168.1.0/24 network to the server at 10.0.0.1, with the ACL applied inbound on the router's GigabitEthernet0/0 interface, and then verify the configuration.

Accepted Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then exit and verify with 'show access-lists'.. First, enter config mode. Create the ACL permitting HTTP from the source network to the destination host. Apply it inbound on the correct interface. Then exit and verify.

Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it outbound on GigabitEthernet0/0 with 'ip access-group 100 out', then exit and verify with 'show access-lists'.

Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then verify with 'show running-config' without exiting configuration mode.

Answer

Enter global configuration mode, create the ACL with 'access-list 100 permit tcp 192.168.1.0 0.0.0.255 host 10.0.0.1 eq www', apply it inbound on GigabitEthernet0/0 with 'ip access-group 100 in', then exit and verify with 'show ip interface brief'.

Question 2

Match each basic IPv4 concept to its most accurate role.

Accepted Answer

IP address: Unique identifier for a device on an IP network. An IP address uniquely identifies a device on an IP network. A subnet mask separates the network and host portions of an IP address, enabling devices to determine if a destination is local or remote. A default gateway is the router IP that forwards traffic to other networks when the destination is not on the local subnet. A DNS server translates domain names into IP addresses, allowing devices to reach websites by name.

Question 3

You are connected to R1. The network uses private IP 10.10.10.0/24 on the inside and must reach the Internet via the outside interface G0/1 with public IP 203.0.113.1/29. Configure PAT (NAT overload) so that inside hosts can access the Internet, and also configure a static NAT for the internal server 10.10.10.100 to public IP 203.0.113.2. The current configuration has errors: the inside and outside interfaces are swapped, the ACL is incorrectly defined, and the overload keyword is missing. Fix all issues.

Accepted Answer

On G0/0: ip nat inside; on G0/1: ip nat outside; ACL 10 permit 10.10.10.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1 overload. The configuration had three faults: (1) The inside interface (G0/0 with private IP) was marked 'ip nat outside', and the outside interface (G0/1 with public IP) was marked 'ip nat inside' — these must be swapped. (2) The ACL 10 permitted 192.168.1.0/24 instead of the actual inside subnet 10.10.10.0/24. (3) The NAT command 'ip nat inside source list 10 interface GigabitEthernet0/1' was missing the 'overload' keyword, which is required for PAT. The static NAT was correctly defined. After fixing all three, inside hosts will be able to access the Internet using PAT.

Answer

On G0/0: ip nat outside; on G0/1: ip nat inside; ACL 10 permit 10.10.10.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1 overload

Answer

On G0/0: ip nat inside; on G0/1: ip nat outside; ACL 10 permit 192.168.1.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1 overload

Answer

On G0/0: ip nat inside; on G0/1: ip nat outside; ACL 10 permit 10.10.10.0 0.0.0.255; ip nat inside source list 10 interface GigabitEthernet0/1

Question 4

Which HTTP method is normally used by a REST API client to retrieve data from a resource without changing it?

Accepted Answer

GET. GET requests read a resource. They are used to retrieve state or information without modifying the target object.

Answer

POST

Answer

PUT

Answer

DELETE

Question 5

An administrator wants to prevent users from browsing to one specific web server while still allowing them to reach other web destinations. Which ACL design principle is most important here?

Accepted Answer

Use the narrowest possible match so only the intended traffic is denied.. The most important principle is to write the ACL as narrowly as possible so it matches only the unwanted traffic and does not overblock unrelated traffic. In practical terms, the rule should target the specific destination and service being denied rather than using a broader deny that unintentionally blocks other communication.

This is a precision-and-scope question. Good ACL design is as much about what you avoid blocking as what you intend to block.

Answer

Always deny all IP traffic to the destination subnet first.

Answer

Use a standard ACL because destination details never matter.

Answer

Place the ACL only where no routing exists.

Question 6

A router learns route 198.51.100.0/24 from OSPF with AD 110 and also has a static route to the same prefix configured with AD 150. Which route is installed?

Accepted Answer

The OSPF route, because 110 is lower than 150. The route with the lower administrative distance is installed. A static route configured with a higher AD becomes a floating static route and remains as a backup until the preferred route disappears.

Answer

The static route, because static routes always win

Answer

Both routes, because administrative distances are different

Answer

Neither route, because the static route is floating

Question 7

Two switches are bundled with LACP, but only one physical link is forwarding traffic in the port-channel. What is the most likely reason?

Accepted Answer

One member interface has a trunk configuration mismatch. For an EtherChannel to form correctly, the member interfaces must match on key settings such as speed, duplex, trunking, and allowed VLAN list. A mismatch keeps one link from bundling even if LACP is enabled on both sides.

Answer

LACP requires exactly one active and one passive side only

Answer

STP blocks all but one interface inside every EtherChannel

Answer

EtherChannel cannot be used on trunk ports

Question 8

You are connected to R1 via the console. R1 is a router that needs to provide DHCP services for hosts on VLAN 10 (192.168.10.0/24) and VLAN 20 (192.168.20.0/24). The DHCP server is located on VLAN 10 at 192.168.10.100, but hosts on VLAN 20 cannot reach it directly. Configure R1 to forward DHCP broadcasts from VLAN 20 to the DHCP server.

Accepted Answer

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip helper-address 192.168.10.100. The ip helper-address command enables the router to forward UDP broadcasts (including DHCP) to a specific server. Placing it on the VLAN 20 subinterface ensures that DHCP requests from VLAN 20 are unicast to the server on VLAN 10.

Answer

interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip helper-address 192.168.10.100

Answer

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip dhcp relay information option

Answer

ip dhcp pool VLAN20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.1

Question 9

A route to 10.10.20.0/24 disappears when an OSPF adjacency fails. Which design would most directly provide an automatic backup without changing the primary OSPF path during normal operation?

Accepted Answer

A floating static route with a higher administrative distance than OSPF. The most direct design is a floating static route with a higher administrative distance than OSPF. In plain language, that means the router keeps a manually configured backup route in reserve but does not use it while the OSPF route remains healthy. If the OSPF path disappears, the backup static route becomes active automatically. This is a very common and practical way to add simple failover.

The key requirement in the question is that the primary OSPF path should remain unchanged under normal conditions. A normal static route with default distance would override OSPF and break that goal. A floating static route avoids that by staying less preferred until a failure occurs. That is why it is the correct design choice here.

Answer

A standard static route with the default administrative distance of 1

Answer

Removing OSPF entirely and using only a default route

Answer

Disabling the routing table on the router until failure occurs

Question 10

A user can authenticate successfully to a network device but is denied access to certain commands. Which statement best explains the situation?

Accepted Answer

Authentication succeeded, but authorization limits the user's command access.. The situation is best explained by authorization controls. In practical terms, authentication confirms who the user is, but authorization determines what that user can do after login. A successful login followed by restricted command access means the identity is valid but the permission set is limited.

This is one of the most important practical distinctions within AAA.

Answer

The device lost all routing information after login.

Answer

The subnet mask on the user workstation is incorrect.

Answer

Syslog is blocking the commands for security reasons.

Question 11

Which TWO commands are required to configure a switch port to support both a desktop PC and a VoIP phone using voice VLAN?

Accepted Answer

switchport mode access. 'switchport mode access,' is required because voice VLAN only operates on an access port. Option C, 'switchport voice vlan <vlan-id>,' is the command that actually assigns the voice VLAN ID. Option B is incorrect because a trunk port would not properly separate voice and data traffic as the phone expects an access port. Option D is a common data VLAN configuration but is not strictly necessary for voice VLAN operation; the access VLAN can be left as the default or configured separately. Option E is wrong because 'switchport port-security maximum 1' would allow only a single MAC address, while the port must support two devices (the phone and the PC), second MAC being the phone's internal switch.

Answer

switchport mode trunk

Answer

switchport access vlan <vlan-id>

Answer

switchport port-security maximum 1

Question 12

Exhibit: A standard ACL meant to block host 10.10.10.50 from reaching any remote network was applied inbound on the branch router's LAN interface, but users report that all local traffic from that host is now blocked. What is the better placement?

Accepted Answer

Move it outbound on the WAN-facing interface closer to the destination. A standard ACL matches only the source address. If it is placed near the source, it can block that host from reaching destinations you did not intend to affect. Standard ACLs are best placed close to the destination.

Answer

Leave it inbound on the LAN because standard ACLs belong near the source

Answer

Convert it to a VTY access-class

Answer

Apply it inbound on all switch access ports

Question 13

Which three statements about the Spanning Tree Protocol (STP) are true? (Choose three.)

Accepted Answer

STP places redundant ports in blocking state to prevent loops.. All three statements are correct because STP relies on Bridge Protocol Data Units (BPDUs) to share topology information between switches, elects a root bridge by comparing bridge IDs (a combination of priority and MAC address, with the lowest value winning), and prevents loops by placing redundant ports into a blocking state (discarding state in Rapid PVST+). These are fundamental behaviors of the 802.1D Spanning Tree Protocol.

Answer

STP is used to increase the number of broadcast domains.

Answer

STP always uses the highest port cost to select the root port.

Answer

STP converges instantly after a topology change.

Question 14

Drag and drop the following steps into the correct order to configure an IPv4 default static route with a floating backup route on a Cisco router.

Accepted Answer

Enter privileged EXEC mode using the enable command.. The correct order is: 1. Enter privileged EXEC mode using the enable command, because you must be in privileged mode to enter global configuration. 2. Enter global configuration mode with configure terminal, as static routes are configured in global configuration. 3. Configure the primary default route using ip route 0.0.0.0 0.0.0.0 with default administrative distance (1), establishing the primary path. 4. Configure the floating backup route using ip route 0.0.0.0 0.0.0.0

(e.g., 10), so it is less preferred. 5. Exit global configuration mode using end to return to privileged EXEC. 6. Save the configuration with copy running-config startup-config to ensure the routes persist after a reboot.

Question 15

Match each API or programmability term to its most accurate meaning.

Accepted Answer

Controller: Centralized management or policy platform. The 'Controller' is a centralized platform that manages network devices and enforces policies. The 'Northbound API' provides an interface for applications and users to interact with the controller. 'JSON' is a lightweight, structured data format commonly used to exchange data in API payloads. A 'Token' is a credential-like value used to authenticate and authorize API requests, ensuring secure access to the controller.

Question 16

Drag and drop the AI/ML concepts on the left to the correct descriptions on the right.

Accepted Answer

Anomaly detection: Identifies deviations from normal network behavior, such as unusual traffic spikes or security threats.. Supervised learning uses labeled data, unsupervised finds hidden patterns, reinforcement learning uses rewards, neural networks mimic brain structure, training data is for learning, and inference is applying the model to new data.

Question 17

You are connected to R1 via the console. R1 and R2 are running OSPFv2 in area 0. R1's router ID is 1.1.1.1, and R2's router ID is 2.2.2.2. Both routers are connected via GigabitEthernet0/0 on the 192.168.12.0/30 subnet. You need to ensure that R1 does not send OSPF hello messages out of its Loopback0 interface, while still advertising the loopback network into OSPF.

Accepted Answer

Configure the passive-interface Loopback0 command under the OSPF process.. Configuring the Loopback0 interface as passive under the OSPF process suppresses the sending of hello messages on that interface, preventing unnecessary adjacencies. The network is still advertised because OSPF includes the subnet in its LSAs.

Answer

Remove the network 192.168.12.0 0.0.0.3 area 0 command from the OSPF configuration.

Answer

Configure the ip ospf passive-interface command on GigabitEthernet0/0.

Answer

Configure the network 192.168.12.0 0.0.0.3 area 0 command under the OSPF process.

Question 18

Which two statements accurately describe DHCP?

Accepted Answer

It can automatically provide an IP address to a client.. Option A is correct because DHCP (Dynamic Host Configuration Protocol) automatically leases an IPv4 address to a client from a configured pool using the DORA process (Discover, Offer, Request, Acknowledge). Option B is correct because DHCP options, such as option 3 (default gateway/router) and option 6 (DNS servers), deliver additional configuration parameters alongside the IP address, subnet mask, and lease time. Option C is incorrect because hostname-to-IP resolution is performed by DNS, not DHCP. Option D is incorrect because OSPF elects a Designated Router (DR) and Backup Designated Router (BDR) via hello packets and priority values, which is unrelated to DHCP. Option E is incorrect because DHCP still supplies a subnet mask (option 1) as part of the lease; it does not eliminate the need for subnet masks.

Answer

It resolves hostnames into IP addresses.

Answer

It elects the designated router in OSPF.

Answer

It replaces the need for subnet masks.

Question 19

Match each common API or data term to its most accurate meaning.

Accepted Answer

API: Defined software interface used for communication. API (Application Programming Interface) is a defined set of rules that allows software components to communicate, matching 'Defined software interface used for communication.' JSON (JavaScript Object Notation) is a lightweight data-interchange format with key-value pairs, matching 'Structured data format.' HTTPS (Hypertext Transfer Protocol Secure) encrypts HTTP traffic using TLS/SSL, providing secure transport, matching 'Secure transport for the communication.' Token is a unique string used for authentication and authorization, matching 'Credential-like value used to help control access.'

Question 20

A network technician is troubleshooting a newly installed fiber link between two Cisco Catalyst 9300 switches. The link is up, but the interface shows excessive CRC errors and input errors. The technician runs 'show interfaces' and 'show interfaces transceiver details' on the suspect interface. Based on the output, what is the most likely cause of the errors?

Accepted Answer

The receive power is too low, likely due to a dirty or damaged fiber connector or excessive attenuation.. The output from 'show interfaces transceiver details' would show the receive power level. A receive power that is too low (e.g., below the receiver sensitivity threshold) indicates excessive signal loss, often due to dirty or damaged fiber connectors, poor splices, or excessive cable attenuation. This causes bit errors that manifest as CRC and input errors, even though the link is physically up. Option D correctly identifies this as the most likely cause.

Answer

The interface is configured for full duplex but the switchport is set to auto-negotiation, causing a duplex mismatch.

Answer

The SFP transceiver is faulty because the transmit power is too low at -3.5 dBm.

Answer

The fiber cable is too long for the SX SFP, exceeding the distance limit.