CCNA Practice Exam 65 — 20 Questions

Question 1

Match each data-structure term to its most accurate meaning.

Accepted Answer

Key: Field name. These pairs correctly match data-structure terms to their definitions. Array uses indices, hash table uses key-value mapping, stack is LIFO, queue is FIFO, linked list uses nodes with references, and tree is hierarchical.

Question 2

Based on the exhibit, why does the ACL still allow HTTPS traffic from the branch subnet to the server?

Accepted Answer

The ACL blocks TCP port 80 instead of TCP port 443.. The ACL still allows the HTTPS traffic because the deny statement is matching TCP port 80, not TCP port 443. In practical terms, the entry blocks HTTP, not HTTPS. Since the requirement is specifically to block encrypted web traffic on TCP 443, the current line is aimed at the wrong service.

This is a good precision question because it tests whether the candidate pays attention to the exact destination port rather than just seeing a generic web-related deny.

Answer

HTTPS uses UDP port 443, so TCP matching can never work.

Answer

The ACL must deny all IP traffic to the server to stop HTTPS.

Answer

ACLs cannot filter by destination port when a host keyword is used.

Question 3

You are connected via the console to R1, a new Cisco ISR 4321 router. The network team requires that all routers be reachable via SSH for management. R1's management interface is GigabitEthernet0/0 with IP 192.168.1.1/24. You need to configure SSH on R1, including a hostname, domain name, RSA key pair of 1024 bits, local user 'admin' with secret 'cisco123', and enable SSH version 2. Additionally, configure the vty lines to accept only SSH connections and use local authentication.

Accepted Answer

R1(config)# hostname R1
R1(config)# ip domain-name example.com
R1(config)# crypto key generate rsa modulus 1024
R1(config)# username admin secret cisco123
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# transport input ssh
R1(config-line)# login local. SSH configuration requires a hostname, domain name, RSA key pair, local username, and vty line settings. The command sequence ensures SSH version 2 is used and only SSH connections are accepted on the vty lines.

Answer

R1(config)# hostname R1
R1(config)# ip domain-name example.com
R1(config)# crypto key generate rsa general-keys modulus 1024
R1(config)# username admin password cisco123
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# transport input ssh telnet
R1(config-line)# login local

Answer

R1(config)# hostname R1
R1(config)# ip domain-name example.com
R1(config)# crypto key generate rsa modulus 1024
R1(config)# username admin secret cisco123
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# transport input all
R1(config-line)# login local

Answer

R1(config)# hostname R1
R1(config)# ip domain-name example.com
R1(config)# crypto key generate rsa modulus 1024
R1(config)# username admin secret cisco123
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# transport input ssh
R1(config-line)# password cisco123
R1(config-line)# login

Question 4

Why is version control valuable for network automation files?

Accepted Answer

It tracks changes and allows rollback to earlier versions. Version control systems help teams track who changed what, compare revisions, and restore earlier states when needed. That improves operational discipline but does not guarantee correctness by itself.

Answer

It increases interface bandwidth

Answer

It replaces the need for device backups

Answer

It guarantees that configuration changes are error free

Question 5

Which spanning-tree port state listens for BPDUs and participates in STP, but does not learn MAC addresses yet?

Accepted Answer

Listening. In the classic 802.1D sequence, the listening state processes BPDUs and prepares for forwarding decisions, but it does not populate the MAC address table yet.

Answer

Blocking

Answer

Learning

Answer

Forwarding

Question 6

A network administrator is configuring a Layer 2 EtherChannel between two switches. Switch A uses 'channel-group 1 mode active', and Switch B uses 'channel-group 1 mode desirable'. All member interfaces are trunk ports with identical allowed VLANs. The EtherChannel fails to form. What is the most likely cause?

Accepted Answer

The switches are using different EtherChannel negotiation protocols.. The two switches are using different negotiation protocols: LACP (active) on one side and PAgP (desirable) on the other. EtherChannel requires both sides to use the same protocol, so this protocol mismatch prevents the bundle from forming. The other settings—trunking, VLAN configuration, and channel-group number—are correctly configured and do not cause the failure.

Answer

A Layer 2 EtherChannel cannot carry trunk links.

Answer

The channel-group number must be different on each switch.

Answer

The member interfaces must be in access mode before the bundle can form.

Question 7

A technician configures OSPF on R1 using the command network 10.0.0.0 0.0.0.255 area 0. R1's GigabitEthernet0/0 interface has IP address 10.0.0.1/30 and is included in the OSPF process. The technician confirms the interface is not passive using the show ip ospf interface GigabitEthernet0/0 command. However, R2 is not forming an OSPF adjacency with R1. What should the technician do next?

Accepted Answer

Verify the subnet mask configured on R2's connecting interface.. The OSPF network command 10.0.0.0 0.0.0.255 area 0 uses a wildcard mask that matches only the first 24 bits. The interface on R1 has a /30 mask (255.255.255.252), so its IP 10.0.0.1 falls within the 10.0.0.0/24 range. However, if R2's connecting interface has a different subnet mask (e.g., /24 or /28), the two interfaces will be in different subnets, preventing OSPF adjacency from forming. OSPF requires that interfaces on the same link share the same subnet prefix length to establish a neighbor relationship.

Answer

Check the OSPF hello and dead intervals on R1 and R2.

Answer

Verify the OSPF area ID configured on R2's interface.

Answer

Check whether R2's interface is configured as a passive interface.

Question 8

A subnet must support 30 usable IPv4 host addresses. Which prefix is the smallest that meets the requirement?

Accepted Answer

/27. A /27 is the smallest valid prefix. In plain language, a /27 provides 32 total addresses, and after subtracting the network and broadcast addresses, 30 usable host addresses remain. A /28 would be too small because it provides only 14 usable hosts.

This is a classic minimum-prefix question because it checks whether you can work backward from a host requirement and choose the smallest subnet that fits without over-allocating more space than necessary.

Answer

/28

Answer

/26

Answer

/25

Question 9

Drag and drop the following steps into the correct order to implement DHCP services for clients in VLAN 10 using a centralized DHCP server in VLAN 20 and to protect the network with DHCP snooping.

Accepted Answer

Configure the DHCP server with an IP address pool for the 192.168.10.0/24 subnet and ensure connectivity to VLAN 20.. The correct order requires the DHCP server to be configured first so it can respond to requests. Then the IP helper-address is configured on the default gateway interface for VLAN 10 to forward client broadcasts to the server. Next, DHCP snooping is enabled globally, followed by identifying the trusted port to the server (to allow DHCP replies), and then snooping is enabled on the client VLAN. Finally, a client connection triggers a DHCP transaction that you can verify with the snooping binding table.

Question 10

Which two statements accurately compare TCP and UDP? (Choose two.)

Accepted Answer

TCP provides connection-oriented transport. TCP is connection-oriented and uses sequencing, acknowledgments, and related controls. UDP is simpler and has lower overhead, but it does not guarantee delivery.

Answer

UDP guarantees delivery through acknowledgments

Answer

TCP does not use port numbers

Answer

UDP is always faster because it avoids congestion

Question 11

Which two statements accurately describe UDP compared with TCP?

Accepted Answer

UDP is connectionless.. UDP is designed for simplicity and speed rather than built-in reliability. In plain terms, it sends data without creating a formal conversation first. That is why it is called connectionless. Because it does not perform the same reliability features as TCP, its header is smaller and the protocol adds less overhead. This makes UDP a good fit for applications that care more about speed or low delay than guaranteed delivery at the transport layer.

UDP does not perform a three-way handshake, and it does not guarantee delivery. It is also used by many real services, including DNS in common query scenarios.

Answer

UDP always guarantees delivery and sequencing.

Answer

UDP requires a three-way handshake before application data can be sent.

Answer

UDP cannot be used by DNS.

Question 12

Which wireless design objective is achieved by using nonoverlapping channels in adjacent cells?

Accepted Answer

It reduces interference between nearby APs. Using nonoverlapping channels minimizes interference between adjacent APs, improving wireless performance in dense environments. Option A is wrong because nonoverlapping channels have no effect on PoE budget, which is determined by the switch and cable specifications. Option C is wrong because authentication mechanisms operate independently of channel assignment and are still required. Option D is wrong because nonoverlapping channels are used in both the 2.4 GHz and 5 GHz bands, and they do not mandate client use of a specific frequency.

Answer

It increases PoE budget for the access points

Answer

It removes the need for authentication

Answer

It forces all clients to use 5 GHz only

Question 13

R1 and R2 are directly connected. Their interfaces are up/up and belong to the same subnet. R1's OSPF configuration places the interface in area 0, while R2's interface is in area 1. R1 does not show R2 as an OSPF neighbor. What is the most likely cause?

Accepted Answer

The area IDs do not match. OSPF neighbors on the same link must agree on the area ID. Here, one side is in area 0 and the other is in area 1, so adjacency never forms even though the interfaces are up and in the same subnet.

Answer

R1 must use a loopback as the router ID

Answer

The subnet mask is too small for OSPF to work

Answer

R2 should be configured as the DR manually

Question 14

A subnet uses the mask 255.255.255.252. How many usable host addresses are available in each subnet?

Accepted Answer

2. The mask 255.255.255.252 corresponds to /30. In practical terms, that gives 4 total addresses per subnet. After subtracting the network and broadcast addresses, 2 usable host addresses remain.

This is a classic small-subnet calculation that often appears in point-to-point addressing scenarios.

Answer

4

Answer

6

Answer

14

Question 15

Why is administratively shutting down unused switch ports considered a useful hardening practice?

Accepted Answer

Because it reduces attack surface by removing unused active connection points.. Unused active ports create unnecessary exposure. In practical terms, if a port is not needed, leaving it active gives someone an opportunity to connect a device where no legitimate business need exists. Shutting the port down removes that access point and reduces attack surface.

This is a simple but effective hardening measure. It does not replace other controls, but it removes a risk that does not need to exist in the first place.

Answer

Because it forces all users to manage devices with SSH.

Answer

Because it converts remaining ports into trunks.

Answer

Because it replaces VLAN segmentation.

Question 16

A JSON response from a controller contains a list of interfaces, each with its own name and status fields. Which JSON structure is most likely used to represent that list?

Accepted Answer

An array of objects. The most likely structure is an array containing objects. In practical terms, an array is the natural way to represent a list of similar items, and each item can then be an object with named fields such as name and status. This is a very common pattern in API payloads.

The question is testing structure recognition, not programming syntax mastery.

Answer

A single scalar string only

Answer

A wildcard mask

Answer

A route metric table

Question 17

A network engineer successfully logs in to a router, but cannot enter configuration mode because the command is rejected by policy. Which AAA function is controlling this behavior?

Accepted Answer

Authorization. Authentication confirms identity. Authorization determines which commands, privilege levels, or resources that authenticated user is permitted to access.

Answer

Authentication

Answer

Accounting

Answer

Encryption

Question 18

A switch has a root port and an alternate port for the same VLAN. Which statement best explains the operational role of the alternate port?

Accepted Answer

It is a backup path toward the root bridge and normally does not forward while the active root path is healthy.. The alternate port acts as a backup path toward the root bridge and stays in a non-forwarding state under normal conditions. In practical terms, STP keeps it ready in case the active path fails, but it does not allow it to forward frames while the primary root path is healthy. That is how STP preserves redundancy without creating loops.

This question is useful because many learners understand root ports and designated ports but do not clearly understand what the alternate role represents.

Answer

It always forwards traffic at the same time as the root port for load balancing.

Answer

It is the port that elects the root bridge for the VLAN.

Answer

It is a special routed port used for inter-VLAN communication.

Question 19

R1 is an IPv6-only branch router. The administrator wants all unknown IPv6 destinations to be sent to the upstream router at 2001:db8:ff::1. Which command best achieves that goal?

Accepted Answer

ipv6 route ::/0 2001:db8:ff::1. The correct configuration is an IPv6 default static route pointing to the upstream next hop. In practical terms, this is the IPv6 version of a route of last resort. The router does not need specific entries for every remote IPv6 network if all unknown traffic should go to the upstream device.

The key distinction is that IPv6 static routing uses IPv6 syntax and the double-colon default prefix representation. This is a foundational branch-routing concept for IPv6 deployments.

Answer

ip route 0.0.0.0 0.0.0.0 2001:db8:ff::1

Answer

ipv6 route 2001:db8:ff::/64 ::1

Answer

ipv6 default-gateway 2001:db8:ff::1

Question 20

You are connected to a multilayer switch MLS1. The network has two other switches SW1 and SW2 forming a triangle topology. Currently, SW1 is the root bridge but it should be SW2. Additionally, configure PortFast and BPDU Guard on interface GigabitEthernet0/2 of MLS1, which connects to a host. Simulate a BPDU violation on that port and then recover the port from err-disabled state.

Accepted Answer

On MLS1, remove 'spanning-tree vlan 1 root primary' and set priority to 4096; on SW2, set priority to 0. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover with 'shutdown' then 'no shutdown'.. Currently, SW1 is the root bridge per the topology, but the goal is to make SW2 the root. On MLS1, removing the 'spanning-tree vlan 1 root primary' command and setting a higher priority (4096) ensures it does not interfere. On SW2, set priority to 0 to make it root. On MLS1 Gi0/2, configure PortFast and BPDU Guard. If a BPDU is received, the port goes err-disabled; to recover, issue 'shutdown' then 'no shutdown' after resolving the BPDU source.

Answer

On MLS1, set priority to 0 to make it root; on SW2, set priority to 4096. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover by removing BPDU Guard.

Answer

On MLS1, remove 'spanning-tree vlan 1 root primary' and set priority to 4096; on SW2, set priority to 0. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover by reloading MLS1.

Answer

On MLS1, set priority to 0; on SW2, set priority to 4096. On MLS1 Gi0/2, configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'. After BPDU violation, recover with 'no shutdown'.