CCNA Practice Exam 65 — 20 Questions

Question 1

A technician configures OSPF on R1 using the command network 10.0.0.0 0.0.0.255 area 0. R1's GigabitEthernet0/0 interface has IP address 10.0.0.1/30 and is included in the OSPF process. The technician confirms the interface is not passive using the show ip ospf interface GigabitEthernet0/0 command. However, R2 is not forming an OSPF adjacency with R1. What should the technician do next?

Accepted Answer

Verify the subnet mask configured on R2's connecting interface.. The OSPF network command 10.0.0.0 0.0.0.255 area 0 uses a wildcard mask that matches only the first 24 bits. The interface on R1 has a /30 mask (255.255.255.252), so its IP 10.0.0.1 falls within the 10.0.0.0/24 range. However, if R2's connecting interface has a different subnet mask (e.g., /24 or /28), the two interfaces will be in different subnets, preventing OSPF adjacency from forming. OSPF requires that interfaces on the same link share the same subnet prefix length to establish a neighbor relationship.

Answer

Check the OSPF hello and dead intervals on R1 and R2.

Answer

Verify the OSPF area ID configured on R2's interface.

Answer

Check whether R2's interface is configured as a passive interface.

Question 2

A subnet must support 30 usable IPv4 host addresses. Which prefix is the smallest that meets the requirement?

Accepted Answer

/27. A /27 is the smallest valid prefix. In plain language, a /27 provides 32 total addresses, and after subtracting the network and broadcast addresses, 30 usable host addresses remain. A /28 would be too small because it provides only 14 usable hosts.

This is a classic minimum-prefix question because it checks whether you can work backward from a host requirement and choose the smallest subnet that fits without over-allocating more space than necessary.

Answer

/28

Answer

/26

Answer

/25

Question 3

Drag and drop the following steps into the correct order to implement DHCP services for clients in VLAN 10 using a centralized DHCP server in VLAN 20 and to protect the network with DHCP snooping.

Accepted Answer

Configure the DHCP server with an IP address pool for the 192.168.10.0/24 subnet and ensure connectivity to VLAN 20.. The correct order requires the DHCP server to be configured first so it can respond to requests. Then the IP helper-address is configured on the default gateway interface for VLAN 10 to forward client broadcasts to the server. Next, DHCP snooping is enabled globally, followed by identifying the trusted port to the server (to allow DHCP replies), and then snooping is enabled on the client VLAN. Finally, a client connection triggers a DHCP transaction that you can verify with the snooping binding table.

Question 4

Which two statements accurately describe JSON in network automation contexts?

Accepted Answer

It is a structured data format that software can parse reliably.. JSON is widely used in network automation because it provides structured, machine-readable data. In practical terms, software can reliably identify keys, values, objects, and arrays without having to guess meaning from free-form text. That makes it a common format in modern APIs.

The important point is that JSON is a data format. It is not the API itself and it is not the secure transport that carries the data.

Answer

It is the encryption protocol that protects the API session.

Answer

It replaces the need for authentication.

Answer

It is the same thing as a southbound API.

Question 5

Which two statements accurately compare TCP and UDP? (Choose two.)

Accepted Answer

TCP provides connection-oriented transport. TCP is connection-oriented and uses sequencing, acknowledgments, and related controls. UDP is simpler and has lower overhead, but it does not guarantee delivery.

Answer

UDP guarantees delivery through acknowledgments

Answer

TCP does not use port numbers

Answer

UDP is always faster because it avoids congestion

Question 6

Which two statements accurately describe UDP compared with TCP?

Accepted Answer

UDP is connectionless.. UDP is designed for simplicity and speed rather than built-in reliability. In plain terms, it sends data without creating a formal conversation first. That is why it is called connectionless. Because it does not perform the same reliability features as TCP, its header is smaller and the protocol adds less overhead. This makes UDP a good fit for applications that care more about speed or low delay than guaranteed delivery at the transport layer.

UDP does not perform a three-way handshake, and it does not guarantee delivery. It is also used by many real services, including DNS in common query scenarios.

Answer

UDP always guarantees delivery and sequencing.

Answer

UDP requires a three-way handshake before application data can be sent.

Answer

UDP cannot be used by DNS.

Question 7

Which wireless design objective is achieved by using nonoverlapping channels in adjacent cells?

Accepted Answer

It reduces interference between nearby APs. Using nonoverlapping channels minimizes interference between adjacent APs, improving wireless performance in dense environments. Option A is wrong because nonoverlapping channels have no effect on PoE budget, which is determined by the switch and cable specifications. Option C is wrong because authentication mechanisms operate independently of channel assignment and are still required. Option D is wrong because nonoverlapping channels are used in both the 2.4 GHz and 5 GHz bands, and they do not mandate client use of a specific frequency.

Answer

It increases PoE budget for the access points

Answer

It removes the need for authentication

Answer

It forces all clients to use 5 GHz only

Question 8

A host is configured with 172.16.10.62/27. Which address is the broadcast address for that subnet?

Accepted Answer

172.16.10.63. A /27 uses blocks of 32 addresses. In plain language, the last-octet ranges are 0–31, 32–63, 64–95, and so on. Since the host address ends in 62, it belongs to the 32–63 block. The last address in that block is the broadcast address, so the broadcast is 172.16.10.63.

This is a classic subnetting question because it requires you to place the host inside the correct block and then identify the last address in that block rather than guessing based on the host value alone.

Answer

172.16.10.31

Answer

172.16.10.32

Answer

172.16.10.64

Question 9

R1 and R2 are directly connected. Their interfaces are up/up and belong to the same subnet. R1's OSPF configuration places the interface in area 0, while R2's interface is in area 1. R1 does not show R2 as an OSPF neighbor. What is the most likely cause?

Accepted Answer

The area IDs do not match. OSPF neighbors on the same link must agree on the area ID. Here, one side is in area 0 and the other is in area 1, so adjacency never forms even though the interfaces are up and in the same subnet.

Answer

R1 must use a loopback as the router ID

Answer

The subnet mask is too small for OSPF to work

Answer

R2 should be configured as the DR manually

Question 10

A subnet uses the mask 255.255.255.252. How many usable host addresses are available in each subnet?

Accepted Answer

2. The mask 255.255.255.252 corresponds to /30. In practical terms, that gives 4 total addresses per subnet. After subtracting the network and broadcast addresses, 2 usable host addresses remain.

This is a classic small-subnet calculation that often appears in point-to-point addressing scenarios.

Answer

4

Answer

6

Answer

14

Question 11

Why is administratively shutting down unused switch ports considered a useful hardening practice?

Accepted Answer

Because it reduces attack surface by removing unused active connection points.. Unused active ports create unnecessary exposure. In practical terms, if a port is not needed, leaving it active gives someone an opportunity to connect a device where no legitimate business need exists. Shutting the port down removes that access point and reduces attack surface.

This is a simple but effective hardening measure. It does not replace other controls, but it removes a risk that does not need to exist in the first place.

Answer

Because it forces all users to manage devices with SSH.

Answer

Because it converts remaining ports into trunks.

Answer

Because it replaces VLAN segmentation.

Question 12

A JSON response from a controller contains a list of interfaces, each with its own name and status fields. Which JSON structure is most likely used to represent that list?

Accepted Answer

An array of objects. The most likely structure is an array containing objects. In practical terms, an array is the natural way to represent a list of similar items, and each item can then be an object with named fields such as name and status. This is a very common pattern in API payloads.

The question is testing structure recognition, not programming syntax mastery.

Answer

A single scalar string only

Answer

A wildcard mask

Answer

A route metric table

Question 13

A network engineer successfully logs in to a router, but cannot enter configuration mode because the command is rejected by policy. Which AAA function is controlling this behavior?

Accepted Answer

Authorization. Authentication confirms identity. Authorization determines which commands, privilege levels, or resources that authenticated user is permitted to access.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 14

A switch has a root port and an alternate port for the same VLAN. Which statement best explains the operational role of the alternate port?

Accepted Answer

It is a backup path toward the root bridge and normally does not forward while the active root path is healthy.. The alternate port acts as a backup path toward the root bridge and stays in a non-forwarding state under normal conditions. In practical terms, STP keeps it ready in case the active path fails, but it does not allow it to forward frames while the primary root path is healthy. That is how STP preserves redundancy without creating loops.

This question is useful because many learners understand root ports and designated ports but do not clearly understand what the alternate role represents.

Answer

It always forwards traffic at the same time as the root port for load balancing.

Answer

It is the port that elects the root bridge for the VLAN.

Answer

It is a special routed port used for inter-VLAN communication.

Question 15

R1 is an IPv6-only branch router. The administrator wants all unknown IPv6 destinations to be sent to the upstream router at 2001:db8:ff::1. Which command best achieves that goal?

Accepted Answer

ipv6 route ::/0 2001:db8:ff::1. The correct configuration is an IPv6 default static route pointing to the upstream next hop. In practical terms, this is the IPv6 version of a route of last resort. The router does not need specific entries for every remote IPv6 network if all unknown traffic should go to the upstream device.

The key distinction is that IPv6 static routing uses IPv6 syntax and the double-colon default prefix representation. This is a foundational branch-routing concept for IPv6 deployments.

Answer

ip route 0.0.0.0 0.0.0.0 2001:db8:ff::1

Answer

ipv6 route 2001:db8:ff::/64 ::1

Answer

ipv6 default-gateway 2001:db8:ff::1

Question 16

You are connected to a multilayer switch MLS1. The network has two other switches SW1 and SW2 forming a triangle topology. Currently, SW1 is the root bridge but it should be SW2. Additionally, configure PortFast and BPDU Guard on interface GigabitEthernet0/2 of MLS1, which connects to a host. Simulate a BPDU violation on that port and then recover the port from err-disabled state.

Accepted Answer

On MLS1, remove 'spanning-tree vlan 1 root primary' and set priority to 4096; on SW2, set priority to 0. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover with 'shutdown' then 'no shutdown'.. Currently, SW1 is the root bridge per the topology, but the goal is to make SW2 the root. On MLS1, removing the 'spanning-tree vlan 1 root primary' command and setting a higher priority (4096) ensures it does not interfere. On SW2, set priority to 0 to make it root. On MLS1 Gi0/2, configure PortFast and BPDU Guard. If a BPDU is received, the port goes err-disabled; to recover, issue 'shutdown' then 'no shutdown' after resolving the BPDU source.

Answer

On MLS1, set priority to 0 to make it root; on SW2, set priority to 4096. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover by removing BPDU Guard.

Answer

On MLS1, remove 'spanning-tree vlan 1 root primary' and set priority to 4096; on SW2, set priority to 0. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover by reloading MLS1.

Answer

On MLS1, set priority to 0; on SW2, set priority to 4096. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover with 'no shutdown'.

Question 17

Which two statements accurately describe why structured telemetry and APIs improve operational tooling?

Accepted Answer

They make it easier for software to process known fields consistently.. Structured telemetry and APIs improve tooling because they reduce ambiguity and make automation more reliable. In practical terms, software can collect and compare known fields, counters, and states without brittle text parsing. That supports dashboards, reporting, and automated checks much better than relying only on human-oriented command output.

This is a broad operations-and-automation value question rather than a protocol memorization item.

Answer

They eliminate the need for secure transport or access control.

Answer

They force all devices to stop supporting CLI access.

Answer

They are used only on wireless LAN controllers.

Question 18

You are connected to R1 via console. R1 must forward traffic to the 203.0.113.0/24 and 2001:db8:1::/48 networks through R2 (10.0.0.2/30, 2001:db8:ff::2/64). The primary path must use a next-hop of 10.0.0.2 for IPv4 and 2001:db8:ff::2 for IPv6. Additionally, configure a floating static default route for IPv4 that uses R3 (192.0.2.2/30) as a backup only when the primary path fails. The current configuration has errors: the IPv4 static route points to a wrong next-hop (10.0.0.5) and the primary default route is missing, causing the floating route (AD 100) to become active instead of serving as a backup. Fix these issues so that both primary and backup routes work correctly.

Accepted Answer

Change the next-hop of the static route to 203.0.113.0/24 from 10.0.0.5 to 10.0.0.2, and add a default route 0.0.0.0/0 via 10.0.0.2 with AD 1. Keep the floating default route 0.0.0.0/0 via 192.0.2.2 with AD 100.. The IPv4 static route to 203.0.113.0/24 used a next-hop of 10.0.0.5, which is not a directly connected interface (R1's G0/0 is 10.0.0.1/30, so only .2 is valid). This caused a recursive lookup failure. The floating static default route had AD 100, but a floating route must have an AD higher than the primary route's AD (typically 1) so it is only used when the primary fails; setting AD 100 is correct for backup, but the primary default route was missing. The fix: change the next-hop for 203.0.113.0/24 to 10.0.0.2, and add a primary default route with AD 1 via 10.0.0.2. The floating route's AD of 100 is fine as backup. IPv6 route was correct.

Answer

Change the next-hop of the static route to 203.0.113.0/24 from 10.0.0.5 to 10.0.0.2, and change the administrative distance of the floating default route from 100 to 1 so it becomes the primary default route.

Answer

Change the next-hop of the static route to 203.0.113.0/24 from 10.0.0.5 to 10.0.0.2, and change the administrative distance of the floating default route from 100 to 255 so it is never used.

Answer

Change the next-hop of the static route to 203.0.113.0/24 from 10.0.0.5 to 10.0.0.2, and remove the floating default route because it is unnecessary.

Question 19

What is a key difference between SNMPv3 and earlier SNMP versions?

Accepted Answer

SNMPv3 adds authentication and encryption features. SNMPv3 improves security by adding authentication, message integrity, and privacy features. Earlier versions, especially SNMPv1 and v2c, rely on community strings and provide much weaker protection.

Answer

SNMPv3 supports IPv4 only

Answer

SNMPv3 cannot be used for monitoring interface counters

Answer

SNMPv3 replaces syslog completely

Question 20

Which three of the following are characteristics of DHCP snooping on a Cisco switch? (Choose three.)

Accepted Answer

It prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports.. DHCP snooping is a security feature that filters untrusted DHCP messages by differentiating trusted and untrusted ports. It builds and maintains a DHCP snooping binding database to track valid IP-to-MAC address assignments. Additionally, it prevents DHCP starvation attacks by rate-limiting DHCP messages on untrusted ports, typically using the 'ip dhcp snooping limit rate' command.

Answer

It encrypts DHCP traffic between the client and the server.

Answer

It requires all DHCP servers to be connected to untrusted ports.

Answer

It replaces the DHCP server's IP address with a static route.