CCNA Practice Exam 64 — 20 Questions

Question 1

You are connected to the console of R1. The network uses IPv6 with EUI-64. R1's GigabitEthernet0/0 interface has MAC address 001e.4a7b.9c0d. You need to configure an IPv6 address on this interface using EUI-64, with the subnet 2001:db8:abcd:1::/64.

Accepted Answer

ipv6 address 2001:db8:abcd:1::/64 eui-64. The 'ipv6 address 2001:db8:abcd:1::/64 eui-64' command configures the IPv6 address using EUI-64, which generates the interface ID from the MAC address. This command alone enables IPv6 on the interface and assigns the global address; the 'ipv6 enable' command is not strictly necessary and is only required if a link-local address is needed without a global address. Option B would configure a static interface ID, not EUI-64. Option C incorrectly uses the 'link-local' keyword, which is not valid in this context. Option D only enables IPv6 for link-local addressing without assigning a global unicast address.

Answer

ipv6 address 2001:db8:abcd:1::/64

Answer

ipv6 address 2001:db8:abcd:1::/64 link-local

Answer

ipv6 enable

Question 2

A route to 10.10.20.0/24 disappears when an OSPF adjacency fails. Which design would most directly provide an automatic backup without changing the primary OSPF path during normal operation?

Accepted Answer

A floating static route with a higher administrative distance than OSPF. The most direct design is a floating static route with a higher administrative distance than OSPF. In plain language, that means the router keeps a manually configured backup route in reserve but does not use it while the OSPF route remains healthy. If the OSPF path disappears, the backup static route becomes active automatically. This is a very common and practical way to add simple failover.

The key requirement in the question is that the primary OSPF path should remain unchanged under normal conditions. A normal static route with default distance would override OSPF and break that goal. A floating static route avoids that by staying less preferred until a failure occurs. That is why it is the correct design choice here.

Answer

A standard static route with the default administrative distance of 1

Answer

Removing OSPF entirely and using only a default route

Answer

Disabling the routing table on the router until failure occurs

Question 3

A user can authenticate successfully to a network device but is denied access to certain commands. Which statement best explains the situation?

Accepted Answer

Authentication succeeded, but authorization limits the user's command access.. The situation is best explained by authorization controls. In practical terms, authentication confirms who the user is, but authorization determines what that user can do after login. A successful login followed by restricted command access means the identity is valid but the permission set is limited.

This is one of the most important practical distinctions within AAA.

Answer

The device lost all routing information after login.

Answer

The subnet mask on the user workstation is incorrect.

Answer

Syslog is blocking the commands for security reasons.

Question 4

Which TWO commands are required to configure a switch port to support both a desktop PC and a VoIP phone using voice VLAN?

Accepted Answer

switchport mode access. 'switchport mode access,' is required because voice VLAN only operates on an access port. Option C, 'switchport voice vlan <vlan-id>,' is the command that actually assigns the voice VLAN ID. Option B is incorrect because a trunk port would not properly separate voice and data traffic as the phone expects an access port. Option D is a common data VLAN configuration but is not strictly necessary for voice VLAN operation; the access VLAN can be left as the default or configured separately. Option E is wrong because 'switchport port-security maximum 1' would allow only a single MAC address, while the port must support two devices (the phone and the PC), second MAC being the phone's internal switch.

Answer

switchport mode trunk

Answer

switchport access vlan <vlan-id>

Answer

switchport port-security maximum 1

Question 5

Exhibit: A standard ACL meant to block host 10.10.10.50 from reaching any remote network was applied inbound on the branch router's LAN interface, but users report that all local traffic from that host is now blocked. What is the better placement?

Accepted Answer

Move it outbound on the WAN-facing interface closer to the destination. A standard ACL matches only the source address. If it is placed near the source, it can block that host from reaching destinations you did not intend to affect. Standard ACLs are best placed close to the destination.

Answer

Leave it inbound on the LAN because standard ACLs belong near the source

Answer

Convert it to a VTY access-class

Answer

Apply it inbound on all switch access ports

Question 6

Which three statements about the Spanning Tree Protocol (STP) are true? (Choose three.)

Accepted Answer

STP places redundant ports in blocking state to prevent loops.. All three statements are correct because STP relies on Bridge Protocol Data Units (BPDUs) to share topology information between switches, elects a root bridge by comparing bridge IDs (a combination of priority and MAC address, with the lowest value winning), and prevents loops by placing redundant ports into a blocking state (discarding state in Rapid PVST+). These are fundamental behaviors of the 802.1D Spanning Tree Protocol.

Answer

STP converges instantly after a topology change.

Answer

STP always uses the highest port cost to select the root port.

Answer

STP is used to increase the number of broadcast domains.

Question 7

Why is NTP especially valuable when a company uses a centralized Syslog server?

Accepted Answer

It synchronizes device clocks so centralized log timestamps can be correlated accurately.. NTP is especially valuable because it aligns device clocks, which makes centralized log timestamps much easier to interpret. In practical terms, if devices disagree on time, the combined log stream becomes harder to trust and correlate. NTP improves the timeline accuracy of operational and security analysis.

This is why NTP and Syslog are often discussed together. One centralizes events, and the other makes those events easier to line up correctly.

Answer

It assigns the Syslog server its IP address.

Answer

It replaces the need for Syslog entirely.

Answer

It encrypts all Syslog messages automatically.

Question 8

Drag and drop the following steps into the correct order to configure an IPv4 default static route with a floating backup route on a Cisco router.

Accepted Answer

Enter privileged EXEC mode using the enable command.. The correct order is: 1. Enter privileged EXEC mode using the enable command, because you must be in privileged mode to enter global configuration. 2. Enter global configuration mode with configure terminal, as static routes are configured in global configuration. 3. Configure the primary default route using ip route 0.0.0.0 0.0.0.0 with default administrative distance (1), establishing the primary path. 4. Configure the floating backup route using ip route 0.0.0.0 0.0.0.0

(e.g., 10), so it is less preferred. 5. Exit global configuration mode using end to return to privileged EXEC. 6. Save the configuration with copy running-config startup-config to ensure the routes persist after a reboot.

Question 9

Match each API or programmability term to its most accurate meaning.

Accepted Answer

Controller: Centralized management or policy platform. The 'Controller' is a centralized platform that manages network devices and enforces policies. The 'Northbound API' provides an interface for applications and users to interact with the controller. 'JSON' is a lightweight, structured data format commonly used to exchange data in API payloads. A 'Token' is a credential-like value used to authenticate and authorize API requests, ensuring secure access to the controller.

Question 10

You are connected to SW1, a Layer 2 switch. The network administrator wants to prevent unauthorized switches from being connected to access ports. Port G0/1 is an access port in VLAN 10. You need to configure BPDU Guard on this port to protect against STP loops caused by rogue switches. Additionally, enable PortFast for immediate transition to forwarding.

Accepted Answer

SW1(config-if)# spanning-tree portfast
SW1(config-if)# spanning-tree bpduguard enable. PortFast allows an access port to skip STP listening/learning and transition immediately to forwarding. BPDU Guard protects against STP loops by error-disabling the port if a BPDU is received, which would indicate an unauthorized switch connection.

Answer

SW1(config)# spanning-tree portfast default
SW1(config)# spanning-tree bpduguard default

Answer

SW1(config-if)# spanning-tree portfast
SW1(config-if)# spanning-tree guard root

Answer

SW1(config-if)# spanning-tree portfast
SW1(config-if)# spanning-tree bpduguard disable

Question 11

Drag and drop the AI/ML concepts on the left to the correct descriptions on the right.

Accepted Answer

Anomaly detection: Identifies deviations from normal network behavior, such as unusual traffic spikes or security threats.. Supervised learning uses labeled data, unsupervised finds hidden patterns, reinforcement learning uses rewards, neural networks mimic brain structure, training data is for learning, and inference is applying the model to new data.

Question 12

Based on the exhibit, which route will be used for destination 10.1.1.70?

Accepted Answer

The static route to 10.1.1.64/26. The route used will be the one with the longest matching prefix. In practical terms, 10.1.1.70 falls inside 10.1.1.64/26, and that prefix is more specific than both 10.1.1.0/24 and 10.1.0.0/16. Route selection begins with specificity, so the /26 route wins regardless of the broader alternatives.

This is a clean simulation-style routing-table interpretation question and very close to real exam thinking.

Answer

The OSPF route to 10.1.1.0/24

Answer

The OSPF route to 10.1.0.0/16

Answer

The default route

Question 13

Match each common API or data term to its most accurate meaning.

Accepted Answer

API: Defined software interface used for communication. API (Application Programming Interface) is a defined set of rules that allows software components to communicate, matching 'Defined software interface used for communication.' JSON (JavaScript Object Notation) is a lightweight data-interchange format with key-value pairs, matching 'Structured data format.' HTTPS (Hypertext Transfer Protocol Secure) encrypts HTTP traffic using TLS/SSL, providing secure transport, matching 'Secure transport for the communication.' Token is a unique string used for authentication and authorization, matching 'Credential-like value used to help control access.'

Question 14

You are connected to R1, a Cisco IOS-XE router. Configure SNMP v2c with read-only community 'NetOpsRO' and SNMP v3 with user 'AdminUser' using SHA authentication (password: AuthPass1) and AES-128 encryption (password: PrivPass2). Also enable SNMP traps to the NMS at 192.0.2.10 with community 'TrapComm'. Additionally, configure NetFlow export to 192.0.2.20 using version 9, and ensure the flow exporter is applied to GigabitEthernet0/0. Verify your configuration using 'show snmp' and 'show ip cache flow'.

Accepted Answer

snmp-server community NetOpsRO ro
snmp-server group AdminGroup v3 priv
snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2
snmp-server enable traps
snmp-server host 192.0.2.10 TrapComm
flow exporter EXPORTER
destination 192.0.2.20
version 9
!
flow monitor FLOW-MONITOR
exporter EXPORTER
record netflow ipv4 original-input
!
interface GigabitEthernet0/0
ip flow monitor FLOW-MONITOR input. The only complete configuration. It defines the SNMPv3 group and user, enables traps, sets up the flow exporter, and crucially defines a flow monitor globally before applying it to the interface. Without the global `flow monitor` definition, the `ip flow monitor ... input` command on the interface would be rejected. Option B omits the SNMP group and uses the deprecated `ip flow export` instead of the modern flow monitor method. Option C is missing the flow monitor definition, and its `snmp-server host` version syntax is unnecessary but not harmful; the real flaw is the absent monitor. Option D attempts to add the flow monitor but incorrectly places the global definition commands inside the interface configuration, which would cause a syntax error.

Answer

snmp-server community NetOpsRO ro
snmp-server user AdminUser v3 auth sha AuthPass1 priv aes 128 PrivPass2
snmp-server enable traps
snmp-server host 192.0.2.10 TrapComm
flow exporter EXPORTER
destination 192.0.2.20
version 9
!
interface GigabitEthernet0/0
ip flow export EXPORTER

Answer

snmp-server community NetOpsRO ro
snmp-server group AdminGroup v3 priv
snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2
snmp-server enable traps
snmp-server host 192.0.2.10 version 2c TrapComm
flow exporter EXPORTER
destination 192.0.2.20
version 9
!
interface GigabitEthernet0/0
ip flow monitor FLOW-MONITOR input

Answer

snmp-server community NetOpsRO ro
snmp-server group AdminGroup v3 priv
snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2
snmp-server enable traps
snmp-server host 192.0.2.10 TrapComm
flow exporter EXPORTER
destination 192.0.2.20
version 9
!
interface GigabitEthernet0/0
ip flow monitor FLOW-MONITOR input
flow monitor FLOW-MONITOR
exporter EXPORTER

Question 15

A network technician is troubleshooting a newly installed fiber link between two Cisco Catalyst 9300 switches. The link is up, but the interface shows excessive CRC errors and input errors. The technician runs 'show interfaces' and 'show interfaces transceiver details' on the suspect interface. Based on the output, what is the most likely cause of the errors?

Accepted Answer

The receive power is too low, likely due to a dirty or damaged fiber connector or excessive attenuation.. The output from 'show interfaces transceiver details' would show the receive power level. A receive power that is too low (e.g., below the receiver sensitivity threshold) indicates excessive signal loss, often due to dirty or damaged fiber connectors, poor splices, or excessive cable attenuation. This causes bit errors that manifest as CRC and input errors, even though the link is physically up. Option D correctly identifies this as the most likely cause.

Answer

The interface is configured for full duplex but the switchport is set to auto-negotiation, causing a duplex mismatch.

Answer

The SFP transceiver is faulty because the transmit power is too low at -3.5 dBm.

Answer

The fiber cable is too long for the SX SFP, exceeding the distance limit.

Question 16

Match each data-structure term to its most accurate meaning.

Accepted Answer

Key: Field name. These pairs correctly match data-structure terms to their definitions. Array uses indices, hash table uses key-value mapping, stack is LIFO, queue is FIFO, linked list uses nodes with references, and tree is hierarchical.

Question 17

Based on the exhibit, why does the ACL still allow HTTPS traffic from the branch subnet to the server?

Accepted Answer

The ACL blocks TCP port 80 instead of TCP port 443.. The ACL still allows the HTTPS traffic because the deny statement is matching TCP port 80, not TCP port 443. In practical terms, the entry blocks HTTP, not HTTPS. Since the requirement is specifically to block encrypted web traffic on TCP 443, the current line is aimed at the wrong service.

This is a good precision question because it tests whether the candidate pays attention to the exact destination port rather than just seeing a generic web-related deny.

Answer

HTTPS uses UDP port 443, so TCP matching can never work.

Answer

The ACL must deny all IP traffic to the server to stop HTTPS.

Answer

ACLs cannot filter by destination port when a host keyword is used.

Question 18

Why is version control valuable for network automation files?

Accepted Answer

It tracks changes and allows rollback to earlier versions. Version control systems help teams track who changed what, compare revisions, and restore earlier states when needed. That improves operational discipline but does not guarantee correctness by itself.

Answer

It increases interface bandwidth

Answer

It replaces the need for device backups

Answer

It guarantees that configuration changes are error free

Question 19

Which spanning-tree port state listens for BPDUs and participates in STP, but does not learn MAC addresses yet?

Accepted Answer

Listening. In the classic 802.1D sequence, the listening state processes BPDUs and prepares for forwarding decisions, but it does not populate the MAC address table yet.

Answer

Blocking

Answer

Learning

Answer

Forwarding

Question 20

A network administrator is configuring a Layer 2 EtherChannel between two switches. Switch A uses 'channel-group 1 mode active', and Switch B uses 'channel-group 1 mode desirable'. All member interfaces are trunk ports with identical allowed VLANs. The EtherChannel fails to form. What is the most likely cause?

Accepted Answer

The switches are using different EtherChannel negotiation protocols.. The two switches are using different negotiation protocols: LACP (active) on one side and PAgP (desirable) on the other. EtherChannel requires both sides to use the same protocol, so this protocol mismatch prevents the bundle from forming. The other settings—trunking, VLAN configuration, and channel-group number—are correctly configured and do not cause the failure.

Answer

A Layer 2 EtherChannel cannot carry trunk links.

Answer

The channel-group number must be different on each switch.

Answer

The member interfaces must be in access mode before the bundle can form.