CCNA Practice Exam 67 — 20 Questions

Question 1

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to the ISP. GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The network has an NTP server at 192.168.1.200. R1 must be configured as an NTP client to synchronize its time with the server. Additionally, R1 should serve as an NTP server for internal devices on the LAN with a stratum of 5 to maintain proper hierarchy. The time zone is UTC. No NTP configuration exists. Configure NTP on R1 as specified.

Accepted Answer

R1(config)# ntp server 192.168.1.200
R1(config)# ntp master 5
R1(config)# clock timezone UTC 0. Option A correctly configures R1 as an NTP client pointing to the NTP server at 192.168.1.200, enables R1 to serve time to LAN devices using `ntp master 5` which sets the required stratum to 5, and sets the accurate UTC time zone. Option B fails because `ntp master` without a stratum number defaults to stratum 8, which does not satisfy the explicit stratum 5 requirement. Option C uses an incorrect time zone (EST) instead of the required UTC. Option D points to an IP (10.0.0.2) that is not the NTP server—the correct server is at 192.168.1.200.

Answer

R1(config)# ntp server 192.168.1.200
R1(config)# ntp master
R1(config)# clock timezone UTC 0

Answer

R1(config)# ntp server 192.168.1.200
R1(config)# ntp master 5
R1(config)# clock timezone EST 5

Answer

R1(config)# ntp server 10.0.0.2
R1(config)# ntp master 5
R1(config)# clock timezone UTC 0

Question 2

You are connected to R1 via the console. R1 is a Cisco ISR 4321 router running IOS-XE. The network manager wants to monitor interface utilization changes. Use RESTCONF to retrieve the operational state of GigabitEthernet0/0/0 on R1. The device has RESTCONF enabled with username 'admin' and password 'cisco'. The management IP is 192.168.1.1.

Accepted Answer

curl -X GET -u admin:cisco https://192.168.1.1/restconf/data/ietf-interfaces:interfaces-state/interface=GigabitEthernet0%2F0%2F0. RESTCONF uses GET to retrieve data. To retrieve operational state (including interface counters), the path must lead to the `interfaces-state` container, not `interfaces`. The correct YANG data model for operational interface state is `ietf-interfaces:interfaces-state`, and the interface name must be URL-encoded to replace slashes with `%2F`. Option C uses POST, which is wrong. Option B lacks URL encoding and uses the config container. Option D uses a Cisco-specific module and unencoded slashes, and is not the standard operational state path.

Answer

curl -X GET -u admin:cisco https://192.168.1.1/restconf/data/ietf-interfaces:interfaces/GigabitEthernet0/0/0

Answer

curl -X POST -u admin:cisco https://192.168.1.1/restconf/data/ietf-interfaces:interfaces/interface=GigabitEthernet0%2F0%2F0

Answer

curl -X GET -u admin:cisco https://192.168.1.1/restconf/data/Cisco-IOS-XE-interfaces-oper:interfaces/GigabitEthernet0/0/0

Question 3

You are connected to the console of R1, a Cisco router that is part of a larger network. The network operations team uses Ansible to manage configurations. You need to write an Ansible playbook that configures an interface description on R1. The playbook should use the ios_config module.

Accepted Answer

---
- name: Configure interface description
  hosts: R1
  gather_facts: no
  tasks:
    - name: Add description to Gi0/0
      ios_config:
        lines:
          - description Link to Core
        parents: interface GigabitEthernet0/0. The playbook uses the ios_config module to add the description line under the interface configuration. The 'parents' parameter sets the context to 'interface GigabitEthernet0/0'. The playbook must be saved as a .yml file and run with ansible-playbook.

Answer

---
- name: Configure interface description
  hosts: R1
  gather_facts: no
  tasks:
    - name: Add description to Gi0/0
      ios_config:
        lines:
          - interface GigabitEthernet0/0
          - description Link to Core

Answer

---
- name: Configure interface description
  hosts: R1
  gather_facts: no
  tasks:
    - name: Add description to Gi0/0
      ios_command:
        commands:
          - configure terminal
          - interface GigabitEthernet0/0
          - description Link to Core

Answer

---
- name: Configure interface description
  hosts: R1
  gather_facts: no
  tasks:
    - name: Add description to Gi0/0
      ios_config:
        lines:
          - description Link to Core
        parents: GigabitEthernet0/0

Question 4

You are connected to R1 via the console. R1 is a Cisco IOS-XE router. The network manager wants to use an Ansible playbook to configure a loopback interface with IP address 10.0.0.1/24 on R1. You need to write the Ansible YAML playbook that connects to R1 and configures this interface. The playbook must not use the 'parents' argument in the ios_config module.

Accepted Answer

- name: Configure Loopback
  hosts: R1
  gather_facts: no
  connection: network_cli
  tasks:
    - name: Configure interface
      ios_config:
        lines:
          - interface Loopback0
          - ip address 10.0.0.1 255.255.255.0
          - no shutdown. Option A is correct because it uses the network_cli connection type, applies the correct subnet mask (255.255.255.0), includes 'no shutdown' to enable the interface, and does not use the 'parents' argument, meeting the requirement. Option B is wrong because it uses an 'ssh' connection (not network_cli) and writes the IP address in CIDR notation (/24) instead of the required dotted-decimal mask. Option C is wrong because it uses 'shutdown' instead of 'no shutdown', which disables the interface. Option D is wrong because it uses the 'parents' argument, which the stem explicitly forbids, even though the configuration would otherwise be valid.

Answer

- name: Configure Loopback
  hosts: R1
  gather_facts: no
  connection: ssh
  tasks:
    - name: Configure interface
      ios_config:
        lines:
          - interface Loopback0
          - ip address 10.0.0.1/24
          - no shutdown

Answer

- name: Configure Loopback
  hosts: R1
  gather_facts: no
  connection: network_cli
  tasks:
    - name: Configure interface
      ios_config:
        lines:
          - interface Loopback0
          - ip address 10.0.0.1 255.255.255.0
          - shutdown

Answer

- name: Configure Loopback
  hosts: R1
  gather_facts: no
  connection: network_cli
  tasks:
    - name: Configure interface
      ios_config:
        lines:
          - interface Loopback0
          - ip address 10.0.0.1 255.255.255.0
          - no shutdown
        parents: interface Loopback0

Question 5

Match each API or automation concept to the most accurate description.

Accepted Answer

REST API: Uses HTTP methods to perform CRUD operations on resources. These pairings accurately describe common API and automation concepts.

Question 6

Match each automation transport or interaction term to its most accurate description.

Accepted Answer

RESTCONF: A stateless, HTTP-based protocol that uses RESTful APIs and supports both XML and JSON data encoding.. These are common automation transport or interaction patterns. Each pairing correctly describes the term as used in system integration and API design.

Answer

NETCONF: A stateful, RPC-based protocol that uses XML encoding and operates over SSH or TLS.

Answer

gRPC: A stateless, HTTP/2-based protocol that uses Protocol Buffers for data serialization.

Answer

SSH: A stateless, secure shell protocol used for remote CLI access and file transfers.

Question 7

Match each IPv6 address type or concept to its most accurate description.

Accepted Answer

Global Unicast: Routable over the public internet, assigned by RIRs.. Each IPv6 address type has a distinct purpose: Global Unicast for public routing, Link-Local for local segment, Unique Local for private site, Multicast for group communication, Anycast for nearest device, and SLAAC for stateless address assignment.

Answer

Link-Local: Routable across the entire enterprise network, used for inter-VLAN routing.

Answer

Unique Local: Globally unique and routable on the public internet, similar to Global Unicast.

Answer

Multicast: Used for one-to-one communication between two specific hosts.

Question 8

What is the correct order of steps to capture and analyze traffic on IOS-XE using the embedded packet capture feature, and in Wireshark to isolate a Layer 2 or Layer 3 fault?

Accepted Answer

Define the capture point with interface and optional filter, then start the capture, stop it, and export the capture file for analysis in Wireshark.. The correct order for embedded packet capture on IOS-XE is to first define the capture point with the desired interface and optional filter, then start the capture, stop it after capturing the needed traffic, and finally export the file for analysis in Wireshark. Option A accurately reflects this sequence. Option B fails because the capture must be defined before starting. Option C fails because exporting should occur after stopping the capture. Option D fails because analysis is performed externally, not on the router.

Answer

Start the capture immediately, then define the capture point with interface and filter, stop the capture, and export the file for analysis.

Answer

Define the capture point, start the capture, export the file, and then stop the capture.

Answer

Define the capture point, start the capture, stop it, then analyze the capture directly on the router without exporting.

Question 9

Match each common network device or concept to its primary role.

Accepted Answer

Router: routes between networks; Switch: forwards within LAN; Hub: repeats signals; Firewall: filters traffic; AP: provides Wi-Fi; Modem: converts digital to analog for WAN. Router routes between networks; switch forwards within LAN; hub repeats signals; firewall filters traffic; AP provides Wi-Fi; modem converts digital to analog for WAN.

Answer

Router: forwards within LAN; Switch: routes between networks; Hub: filters traffic; Firewall: repeats signals; AP: converts digital to analog; Modem: provides Wi-Fi

Answer

Router: filters traffic; Switch: repeats signals; Hub: routes between networks; Firewall: forwards within LAN; AP: converts digital to analog; Modem: provides Wi-Fi

Answer

Router: provides Wi-Fi; Switch: converts digital to analog; Hub: routes between networks; Firewall: forwards within LAN; AP: filters traffic; Modem: repeats signals

Question 10

Match each VLAN-related term to its most accurate meaning.

Accepted Answer

Access VLAN: A VLAN that carries traffic for a single end device, typically assigned to an access port.. Each VLAN type serves a specific purpose: Access VLAN for end devices, Trunk VLAN for multiple VLANs over a link, Native VLAN for untagged frames, Voice VLAN for phones, Management VLAN for admin access, and Data VLAN for user traffic.

Answer

Trunk VLAN: A VLAN that carries traffic for multiple VLANs over a single link, typically using 802.1Q tagging.

Answer

Native VLAN: A VLAN that carries all untagged traffic on a trunk link, typically VLAN 1 by default.

Answer

Voice VLAN: A VLAN dedicated to carrying voice traffic, typically with QoS markings and separate from data VLANs.

Question 11

Match each trunking term to its most accurate meaning.

Accepted Answer

Trunk: A single physical link carrying multiple VLANs. These pairings match common trunking terms with their accurate definitions in networking.

Question 12

Match each wireless term to its most accurate meaning.

Accepted Answer

SSID: The human-readable network name that identifies a wireless network.. SSID is the human-readable network name. BSSID is the unique MAC address of an AP radio. ESSID is the same SSID used across multiple APs in an extended network. Beacons are management frames that advertise the network. Probe requests are sent by clients to find APs. Association is the process of connecting a client to an AP.

Answer

SSID: The unique MAC address assigned to each access point radio.

Answer

SSID: A management frame sent by access points to advertise the network.

Answer

SSID: The process by which a client connects to an access point.

Question 13

Match each term to the most appropriate description in an API context.

Accepted Answer

Endpoint: The URL where an API can be accessed. These pairings define key API terms with their descriptions.

Question 14

Match each WAN or interdomain concept to its most accurate description.

Accepted Answer

Autonomous System (AS): A collection of networks under a single administrative domain with a unified routing policy.. PPP is the standard Layer 2 encapsulation for point-to-point WAN links. PPPoE adapts PPP’s authentication and session features for Ethernet-based broadband networks. GRE provides a simple tunneling mechanism that encapsulates any protocol across another network. BGP is the path-vector routing protocol used to exchange routes between autonomous systems.

Answer

Autonomous System (AS): A routing protocol used to exchange routes between different administrative domains.

Answer

Autonomous System (AS): A type of VPN that uses MPLS labels to forward traffic across a service provider network.

Answer

Autonomous System (AS): A software-defined approach to managing WAN connections that abstracts underlying hardware.

Question 15

Match each routing term to its most accurate meaning.

Accepted Answer

Route: A path that network traffic takes from source to destination. Administrative distance is a measure of trustworthiness of the route source; a lower AD is preferred when the same prefix is learned from multiple routing protocols. Metric is a protocol-specific value (e.g., OSPF cost, EIGRP composite) used to choose the best path among routes from the same source. Longest-prefix match is the fundamental routing table lookup rule: the route with the longest subnet mask (most specific) is used regardless of AD or metric. Default route (0.0.0.0/0) acts as a gateway of last resort, forwarding packets when no more specific route exists.

Question 16

Match each common IP service to its primary purpose.

Accepted Answer

SSH: Encrypted remote management; NTP: Time synchronization; DNS: Name resolution; AAA: Authentication, authorization, and accounting; Syslog: Event logging. DNS maps domain names to IP addresses. DHCP automates IP configuration. NTP synchronizes clocks across network devices. Syslog collects and stores event messages from network devices for monitoring and troubleshooting.

Answer

SSH: Unencrypted remote management; NTP: File transfer; DNS: IP address assignment; AAA: Encryption; Syslog: Time synchronization

Answer

SSH: Encrypted remote management; NTP: Time synchronization; DNS: IP address assignment; AAA: Event logging; Syslog: Authentication

Answer

SSH: Unencrypted remote management; NTP: Time synchronization; DNS: Name resolution; AAA: Encryption; Syslog: Event logging

Question 17

Match each basic security term to its most accurate meaning.

Accepted Answer

Vulnerability: A weakness in a system or its design that could be exploited.. Authentication is the process of verifying the claimed identity of a user or device, confirming 'who you are'. Authorization determines what resources or actions an authenticated entity is allowed to access, essentially 'what you can do'. Confidentiality ensures that sensitive information is not disclosed to unauthorized individuals, protecting data from being read. Integrity guarantees that data has not been altered in an unauthorized manner, preserving its accuracy and trustworthiness.

Answer

Vulnerability: A potential danger that might exploit a weakness to cause harm.

Answer

Vulnerability: The likelihood and potential impact of a threat exploiting a weakness.

Answer

Vulnerability: An action or code that takes advantage of a weakness to cause harm.

Question 18

Match each NAT term to its most accurate description.

Accepted Answer

Inside Local: The IP address of an internal host as seen from inside the network.. NAT terms describe address perspectives: Inside Local is the internal host's IP, Inside Global is its external IP, Outside Local is the external host's IP seen internally, Outside Global is its actual external IP, Static NAT provides permanent mapping, and Dynamic NAT uses a pool.

Answer

Inside Local: The IP address of an external host as seen from inside the network.

Answer

Inside Local: The IP address of an internal host as seen from outside the network.

Answer

Inside Local: The IP address of an external host as seen from outside the network.

Question 19

Match each technology to the kind of visibility or function it most directly provides.

Accepted Answer

SIEM: Provides centralized log analysis and correlation.. Each technology is matched to the primary visibility or function it provides in a security architecture.

Question 20

Match each JSON concept to its most accurate description.

Accepted Answer

JSON: Lightweight data-interchange format that is easy for humans to read and write. These pairings match fundamental JSON concepts with their correct definitions as per the JSON specification.