CCNA Practice Exam 65 — 20 Questions

Question 1

You are connected to SW1 via the console. The network uses VLANs 10 (Sales) and 20 (Engineering). A new switch SW2 is connected to SW1 via G0/1. You need to enable CDP to discover neighbor devices and verify that SW1 sees SW2. Currently, CDP is disabled globally.

Accepted Answer

Enable CDP globally with 'cdp run' and verify with 'show cdp neighbors'.. CDP is disabled globally with 'no cdp run'. Re-enabling with 'cdp run' allows SW1 to discover directly connected Cisco devices, including SW2. Option B is incorrect because interface-level 'cdp enable' requires CDP to already be enabled globally; since CDP is globally disabled, this command has no effect. Option C is incorrect because 'show cdp interface' displays CDP parameters per interface, not the neighbor table; you need 'show cdp neighbors' to see discovered devices. Option D is incorrect because 'cdp enable' is not a valid global command; the correct global command is 'cdp run'.

Answer

Enable CDP on interface G0/1 with 'cdp enable' and verify with 'show cdp neighbors'.

Answer

Enable CDP globally with 'cdp run' and verify with 'show cdp interface'.

Answer

Enable CDP globally with 'cdp enable' and verify with 'show cdp neighbors'.

Question 2

You are connected to the console of SW1. The network administrator reports that SW1 cannot discover neighbouring devices using CDP. SW1 is connected to R1 via GigabitEthernet0/1. CDP is globally enabled, but still no neighbours are shown.

Accepted Answer

Enable CDP on interface GigabitEthernet0/1 with the command 'cdp enable'.. CDP was globally enabled but the interface GigabitEthernet0/1 had CDP disabled by default (or was explicitly disabled). Enabling CDP on the interface allowed neighbour discovery.

Answer

Enable CDP globally with the command 'cdp run'.

Answer

Use the command 'lldp run' to enable LLDP as an alternative.

Answer

Check the physical cable and interface status on GigabitEthernet0/1.

Question 3

You are connected to the console of R1. The network uses IPv6 and you need to configure an IPv6 address on interface G0/0 using the EUI-64 format. The subnet is 2001:db8:acad:1::/64. The interface MAC address is 0011.2233.4455. After configuration, verify that the full IPv6 address is correct.

Accepted Answer

ipv6 address 2001:db8:acad:1:0211:22ff:fe33:4455/64. The EUI-64 method inserts FFFE in the middle of the MAC and flips the U/L bit. With the given MAC, the resulting interface ID is 0211:22FF:FE33:4455, forming the full IPv6 address.

Answer

ipv6 address 2001:db8:acad:1:0011:22ff:fe33:4455/64

Answer

ipv6 address 2001:db8:acad:1:0011:2233:4455/64

Answer

ipv6 address 2001:db8:acad:1:0211:2233:4455/64

Question 4

You are connected to the console of R1. The network uses IPv6 with EUI-64. R1's GigabitEthernet0/0 has MAC address 0011.2233.4455. You need to configure an IPv6 address on this interface using the prefix 2001:db8:1:1::/64 with EUI-64, and ensure the interface is operational.

Accepted Answer

ipv6 address 2001:db8:1:1::/64 eui-64. Option B uses the correct syntax 'ipv6 address 2001:db8:1:1::/64 eui-64', which configures the prefix and derives the interface ID automatically from the MAC address via EUI-64. Option A is invalid because specifying the full 128-bit address with the eui-64 keyword is not allowed; the eui-64 keyword requires only a prefix. Option C omits the eui-64 keyword, so it configures a static address without using EUI-64, which would not match the requirement to use EUI-64. Option D appends the MAC address after the eui-64 keyword, which is invalid syntax; the eui-64 keyword does not accept an explicit MAC address.

Answer

ipv6 address 2001:db8:1:1:0011:22ff:fe33:4455/64 eui-64

Answer

ipv6 address 2001:db8:1:1:0211:22ff:fe33:4455/64

Answer

ipv6 address 2001:db8:1:1::/64 eui-64 0011.2233.4455

Question 5

You are connected to the console of R1. The network has a point-to-point serial link between R1 and R2. The link is down and the line protocol is down. The cable is a DCE/DTE crossover, and R1 is the DCE. The initial configuration shows the interface with an IP address but no clock rate set.

Accepted Answer

Configure the clock rate on R1's serial interface.. On a serial DCE cable, the DCE end must configure a clock rate to provide timing. Without it, the line protocol stays down. Setting 'clock rate 128000' on R1 resolved the issue.

Answer

Configure the clock rate on R2's serial interface.

Answer

Replace the serial cable with a straight-through cable.

Answer

Set the encapsulation on both ends to PPP.

Question 6

You are connected to the console of R1. R1 is a new router that needs to be configured for remote management. The network administrator wants to enable SSH for secure access with a local user 'admin' and password 'cisco123'. The router already has an IP address 192.168.1.1/24 on GigabitEthernet0/0 and the interface is up.

Accepted Answer

Enable SSH by configuring a hostname, domain name, generating RSA keys, creating local user 'admin' with password 'cisco123', and configuring VTY lines with 'login local' and 'transport input ssh'. No further configuration is needed.. To enable SSH with local authentication, the router requires a unique hostname, an IP domain name, RSA keys, a local username/password, and VTY lines configured with both 'transport input ssh' and 'login local'. Option D correctly includes all these elements, while the others omit critical steps like 'login local' or the domain name, or use Telnet instead of SSH.

Answer

Enable SSH by configuring a hostname, domain name, generating RSA keys, creating local user 'admin' with password 'cisco123', and configuring VTY lines for SSH transport.

Answer

Enable SSH by configuring a hostname, generating RSA keys, creating local user 'admin' with password 'cisco123', and configuring VTY lines for SSH transport. No domain name is needed.

Answer

Enable SSH by configuring a hostname, domain name, generating RSA keys, creating local user 'admin' with password 'cisco123', and configuring VTY lines for Telnet transport.

Question 7

You are connected to the console of R1. The network administrator reports that users cannot communicate with the server at 192.168.2.10. R1 is connected to R2 via a serial link (S0/0/0) with IP 10.0.0.1/30 on R1 and 10.0.0.2/30 on R2. The network uses OSPF for routing. You suspect an interface issue on the serial link.

Accepted Answer

Use the show interfaces serial0/0/0 command to verify the interface status and check for encapsulation mismatch.. The serial interface may be administratively down or have incorrect encapsulation. Setting the clock rate on the DCE side and ensuring PPP encapsulation matches the neighbor resolves the issue.

Answer

Use the show ip route command to verify that the route to 192.168.2.0/24 is present in the routing table.

Answer

Use the ping 10.0.0.2 command to test Layer 3 connectivity to the neighbor router.

Answer

Use the show running-config interface serial0/0/0 command to check the configuration of the serial interface.

Question 8

You are connected to the console of R1. The network uses IPv6 with EUI-64. R1's GigabitEthernet0/0 has MAC address 0011.2233.4455. You need to configure an IPv6 global unicast address on this interface using EUI-64 format, based on the prefix 2001:db8:acad:1::/64. The interface is currently configured with an IPv4 address only.

Accepted Answer

R1(config-if)# ipv6 address 2001:db8:acad:1:0211:22ff:fe33:4455/64. The EUI-64 process inserts FF:FE in the middle of the MAC and flips the U/L bit. The command configures the IPv6 address automatically based on the prefix and the interface MAC.

Answer

R1(config-if)# ipv6 address 2001:db8:acad:1:0011:22ff:fe33:4455/64

Answer

R1(config-if)# ipv6 address 2001:db8:acad:1:0211:2233:4455:5566/64

Answer

R1(config-if)# ipv6 address 2001:db8:acad:1::/64 eui-64

Question 9

You are connected to the console of R1. The output of 'show interfaces serial0/0/0' displays that the interface is administratively down (status: administratively down, line protocol is down). The network administrator reports that the serial link between R1 and R2 was recently configured but is not working. You need to troubleshoot and restore connectivity. The serial interface on R1 is Serial0/0/0, and the link is a point-to-point HDLC connection.

Accepted Answer

Enter interface configuration mode for Serial0/0/0 and issue the 'no shutdown' command.. The interface status 'administratively down' indicates the interface has been manually shut down with the 'shutdown' command. Issuing 'no shutdown' in interface configuration mode re-enables it, bringing the line protocol up and restoring connectivity. Option B is incorrect because clock rate configuration is necessary only if R1 is the DCE and clocking is missing; the issue here is the administrative state, not clocking. Option C is incorrect because changing the encapsulation to PPP would not resolve an administratively down state and could create a mismatch. Option D is wrong because 'clear interface' only resets counters and does not change the interface's administrative status.

Answer

Enter global configuration mode and issue the 'clock rate 64000' command.

Answer

Enter interface configuration mode for Serial0/0/0 and issue the 'encapsulation ppp' command.

Answer

Enter privileged EXEC mode and issue the 'clear interface serial0/0/0' command.

Question 10

You are connected via the console to R1, a Cisco ISR 4331 router. The network administrator reports that the link between R1's GigabitEthernet0/0 and a switch is experiencing high error rates and intermittent connectivity. Upon inspection, you notice that the interface is configured with speed 1000 and duplex full. The switch port is set to auto-negotiate. Your task is to resolve the duplex mismatch by configuring the router interface to match the switch's settings.

Accepted Answer

Configure the router interface with 'no speed' and 'no duplex' to restore defaults, then set 'speed auto' and 'duplex auto'.. The duplex mismatch was caused by manually forcing speed and duplex on the router while the switch was set to auto-negotiate. Changing the router to auto-negotiate allows both sides to negotiate the best duplex (full duplex) and speed, eliminating errors.

Answer

Configure the router interface with 'speed 1000' and 'duplex full'.

Answer

Configure the router interface with 'no speed' and 'no duplex' to restore defaults, then set 'speed 1000' and 'duplex full'.

Answer

Configure the router interface with 'no speed' and 'no duplex' to restore defaults, then set 'speed 1000' and 'duplex half'.

Question 11

You are connected to SW1 via the console. SW1 is a multilayer switch with SVIs for VLANs 10 (192.168.10.1/24) and 20 (192.168.20.1/24). Hosts in VLAN 10 can ping their default gateway (192.168.10.1), but cannot ping hosts in VLAN 20. You suspect IP routing is not enabled or the SVIs are not up.

Accepted Answer

Enable IP routing on SW1 with the 'ip routing' global configuration command.. A multilayer switch requires 'ip routing' to forward packets between VLANs. Without it, the switch acts as a Layer 2 device. Enabling IP routing allows the SVIs to route traffic between VLANs. The verification commands confirm routing is active and SVIs are operational.

Answer

Configure a trunk port between SW1 and an external router, then enable routing on the router.

Answer

Ensure the SVIs are not shut down and have the 'no shutdown' command applied.

Answer

Add a static route on SW1 pointing to the VLAN 20 subnet via the VLAN 10 SVI.

Question 12

You are connected via the console to R1, a Cisco ISR 4331 router. The network uses IPv6. R1's GigabitEthernet0/0 interface has the MAC address 00:1C:0F:9A:7B:32. You need to configure the interface to use EUI-64 to form a global unicast address from the prefix 2001:DB8:CAFE:1::/64. Additionally, ensure that the interface is enabled for IPv6.

Accepted Answer

R1(config-if)# ipv6 address 2001:DB8:CAFE:1:021C:0FFF:FE9A:7B32/64 eui-64
R1(config-if)# no shutdown. The EUI-64 process inserts FF:FE in the middle of the MAC address and inverts the 7th bit. Configuring the IPv6 address with the eui-64 keyword automatically generates the interface ID from the MAC address.

Answer

R1(config-if)# ipv6 address 2001:DB8:CAFE:1::/64 eui-64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 address 2001:DB8:CAFE:1:021C:0FFF:FE9A:7B32/64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 address 2001:DB8:CAFE:1:001C:0FFF:FE9A:7B32/64 eui-64
R1(config-if)# no shutdown

Question 13

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to router R1 via trunk link G0/1. R1 performs inter-VLAN routing using subinterfaces. VLANs 10, 20, and 30 exist on SW1. Hosts in VLAN 10 (192.168.10.0/24) can ping R1's subinterface, but cannot communicate with hosts in VLAN 20. You suspect the trunk is not allowing VLAN 20 traffic.

Accepted Answer

Configure 'switchport trunk allowed vlan add 20' on SW1's G0/1 interface.. Trunks carry traffic for multiple VLANs. The 'switchport trunk allowed vlan' command restricts which VLANs are permitted. Initially, VLAN 20 was not in the allowed list, so traffic was dropped. Adding VLAN 20 to the allowed list resolves the issue.

Answer

Configure 'switchport mode access' on SW1's G0/1 interface.

Answer

Configure 'switchport trunk native vlan 20' on SW1's G0/1 interface.

Answer

Configure 'switchport trunk allowed vlan except 20' on SW1's G0/1 interface.

Question 14

You are connected to SW1, a Layer 2 switch. Port G0/1 connects to a PC in VLAN 10. Management requires that only one MAC address is allowed on this port, and if a violation occurs, the port should shut down and a log message should be generated. Additionally, you need to ensure that the port enables rapidly and does not wait for STP convergence. Currently, the PC has MAC address aaaa.bbbb.cccc.

Accepted Answer

switchport port-security; switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation shutdown; spanning-tree portfast. Port security limits access to a port based on MAC addresses. The correct sequence must first enable port security with the `switchport port-security` command. Then setting maximum to 1 with a specific MAC ensures only that device can connect. Violation shutdown disables the port if an unauthorized MAC appears. PortFast allows the port to transition to forwarding immediately, which is appropriate for end-user devices. Options B and C use wrong violation modes (restrict or protect) that do not shut the port and may not log. Option D uses correct violation mode but omits PortFast, causing STP delays.

Answer

switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation restrict; spanning-tree portfast

Answer

switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation protect; spanning-tree portfast

Answer

switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation shutdown; no spanning-tree portfast

Question 15

You are connected to SW1 via console. SW1 is a Layer 2 switch with two ports (G0/1 and G0/2) connected to a host. The host should be able to send and receive traffic on VLAN 10 and VLAN 20. Configure the two ports as a trunk link to the host, but ensure that the trunk only carries VLANs 10 and 20, and set the native VLAN to VLAN 99.

Accepted Answer

interface range gigabitethernet0/1-2
switchport mode trunk
switchport trunk allowed vlan 10,20
switchport trunk native vlan 99. Configuring the ports as trunks allows multiple VLANs. The 'allowed vlan' command restricts the trunk to only VLANs 10 and 20, while 'native vlan 99' sets the untagged VLAN to 99, ensuring proper tagging and avoiding VLAN mismatch.

Answer

interface range gigabitethernet0/1-2
switchport mode trunk
switchport trunk allowed vlan 10-20
switchport trunk native vlan 99

Answer

interface range gigabitethernet0/1-2
switchport mode trunk
switchport trunk allowed vlan 10,20
switchport native vlan 99

Answer

interface range gigabitethernet0/1-2
switchport mode trunk
switchport trunk allowed vlan 10,20
switchport trunk native vlan 1

Question 16

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two redundant links to SW2 (G0/1 and G0/2). The network administrator wants to use both links for load balancing and redundancy by configuring EtherChannel. You need to configure a Layer 2 EtherChannel using LACP on both switches. The port-channel should be in VLAN 1.

Accepted Answer

interface port-channel 1
switchport mode access
switchport access vlan 1
interface range GigabitEthernet0/1-2
channel-group 1 mode active. EtherChannel bundles multiple physical links into a single logical link for load balancing and redundancy. LACP (mode active) negotiates the bundle automatically. The port-channel interface must be configured with the desired switchport settings.

Answer

interface port-channel 1
switchport mode trunk
switchport trunk allowed vlan 1
interface range g0/1-2
channel-group 1 mode desirable

Answer

interface port-channel 1
switchport mode access
switchport access vlan 1
interface range g0/1-2
channel-group 1 mode passive

Answer

interface port-channel 1
switchport mode access
switchport access vlan 1
interface g0/1
channel-group 1 mode active
interface g0/2
channel-group 2 mode active

Question 17

You are connected to SW1 via console. SW1 is a Layer 2 switch. Port G0/1 connects to a PC that should be allowed only one MAC address. Currently, the port is configured with default settings. You need to enable port security on G0/1, set the maximum MAC addresses to 1, configure the port to shut down if a violation occurs, and ensure that the first learned MAC address is sticky (i.e., saved to the running config).

Accepted Answer

interface G0/1
switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown
switchport port-security mac-address sticky. Enabling port security and setting maximum MAC addresses to 1 limits the port to one device. The violation shutdown mode disables the port if another MAC attempts to use it. Sticky MAC learning dynamically learns the first MAC and saves it to the running configuration.

Answer

interface G0/1
switchport port-security
switchport port-security maximum 1
switchport port-security violation protect
switchport port-security mac-address sticky

Answer

interface G0/1
switchport port-security
switchport port-security maximum 2
switchport port-security violation shutdown
switchport port-security mac-address sticky

Answer

interface G0/1
switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown
switchport port-security mac-address 0000.1111.2222

Question 18

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two VLANs: VLAN 10 (Sales) and VLAN 20 (Engineering). A router R1 is connected to port G0/1 on SW1 for inter-VLAN routing. Currently, the router is not routing between VLANs because the trunk is not configured correctly. Configure the switch port as a trunk and ensure the router can route between VLANs using subinterfaces (Router-on-a-Stick).

Accepted Answer

Configure the switch port as a trunk with 802.1Q encapsulation and allow VLANs 10 and 20.. The switch port was in access mode, which only carries one VLAN. Changing it to trunk with 802.1Q encapsulation allows multiple VLANs to traverse to the router. The allowed VLAN list restricts to VLANs 10 and 20 for security.

Answer

Configure the switch port as an access port in VLAN 10 and add VLAN 20 as a secondary VLAN.

Answer

Configure the switch port as a trunk with ISL encapsulation and allow all VLANs.

Answer

Configure the switch port as a trunk with 802.1Q encapsulation and allow VLANs 1, 10, and 20.

Question 19

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two VLANs: VLAN 10 (Sales) and VLAN 20 (Engineering). Port G0/1 is connected to a sales PC, and port G0/2 is connected to an engineering PC. You need to ensure that each PC is in the correct VLAN. However, the sales PC is currently unable to ping the engineering PC because they are in different VLANs. You have a router R1 connected to SW1 via port G0/3. Configure inter-VLAN routing using Router-on-a-Stick on R1, and ensure SW1's port G0/3 is properly configured as a trunk.

Accepted Answer

Configure subinterfaces on R1 with encapsulation dot1Q and assign IP addresses in VLAN 10 and VLAN 20. Configure SW1 interface G0/3 as a trunk port.. Router-on-a-Stick allows a single router interface to route between VLANs by using subinterfaces with 802.1Q encapsulation. The switch port must be a trunk to carry the tagged frames. This configuration enables communication between VLAN 10 and VLAN 20.

Answer

Configure a routed port on SW1 G0/3 and assign an IP address. Then configure static routes on R1 to reach each VLAN.

Answer

Configure SW1 interface G0/3 as an access port in VLAN 10. Then configure R1 with a single IP address in VLAN 10 and enable proxy ARP.

Answer

Configure SW1 interface G0/3 as a trunk port. Then configure R1 with a single IP address on the physical interface and enable VLAN routing using the 'vlan' command.

Question 20

You are connected to SW1 via the console. SW1 is a Layer 2 switch with an access port G0/1 connected to a server. The network administrator has noticed that the server is sending BPDUs, which could cause network instability. You need to configure PortFast and BPDU Guard on port G0/1 to prevent BPDU-related issues and ensure the port transitions to forwarding state immediately.

Accepted Answer

interface G0/1
spanning-tree portfast
spanning-tree bpduguard enable. PortFast allows an access port to bypass STP listening/learning states, providing immediate connectivity. BPDU Guard protects the network by shutting down the port if a BPDU is received, preventing potential loops from unauthorized switches.

Answer

interface G0/1
spanning-tree portfast
spanning-tree guard root

Answer

interface G0/1
spanning-tree portfast
spanning-tree bpdufilter enable

Answer

interface G0/1
spanning-tree portfast
spanning-tree bpduguard default