CCNA Practice Exam 67 — 20 Questions

Question 1

You are connected to R1. The network requires HSRP for default gateway redundancy on subnet 192.168.1.0/24. R2 should be the active router, and R1 the standby. Currently, both routers show as active. Configure R1 with priority 90, enable preempt, ensure the virtual IP is 192.168.1.254, and configure tracking of interface GigabitEthernet0/1 (subnet 203.0.113.0/30) so that if R1's tracked interface goes down, its priority decreases by 20. Verify the final state with 'show standby brief'.

Accepted Answer

interface GigabitEthernet0/0
 standby version 2
 standby 1 ip 192.168.1.254
 standby 1 priority 90
 standby 1 preempt
 standby 1 track GigabitEthernet0/1 20. The scenario requires R2 to be the HSRP active router. By default, both routers have priority 100, and HSRP election would select the router with the higher IP address as active if priorities are equal. To ensure R2 becomes active, R1's priority must be lowered to 90. Additionally, tracking interface GigabitEthernet0/1 with a decrement of 20 is configured so that if R1's uplink fails, its priority drops to 70, further preventing it from becoming active. The correct configuration on R1 sets priority 90, enables preempt, and tracks the correct interface with decrement 20. Options B, C, and D are wrong because: B sets a higher priority (110) which would make R1 active; C uses an incorrect decrement of 30; and D tracks the wrong interface (Gig0/0 instead of Gig0/1).

Answer

interface GigabitEthernet0/0
 standby version 2
 standby 1 ip 192.168.1.254
 standby 1 priority 110
 standby 1 preempt
 standby 1 track GigabitEthernet0/1 20

Answer

interface GigabitEthernet0/0
 standby version 2
 standby 1 ip 192.168.1.254
 standby 1 priority 90
 standby 1 preempt
 standby 1 track GigabitEthernet0/1 30

Answer

interface GigabitEthernet0/0
 standby version 2
 standby 1 ip 192.168.1.254
 standby 1 priority 90
 standby 1 preempt
 standby 1 track GigabitEthernet0/0 20

Question 2

What is version control primarily used for in network automation workflows?

Accepted Answer

To track changes and maintain history for code and templates. Version control tracks changes to code and configuration artifacts, enabling rollback, collaboration, and auditability.

Answer

To replace authentication for API clients

Answer

To automatically assign switchport VLANs in real time

Answer

To discover neighboring devices at Layer 2

Question 3

A packet destined for 10.1.1.130 arrives at the router. Based on the routing table, which route will be used?

Accepted Answer

The static route to 10.1.1.128/25. Routers do not choose the route with the lowest administrative distance first when several routes match a destination. They begin with the most specific matching prefix. In practical terms, the router looks for the narrowest route that still contains the destination address. The packet is going to 10.1.1.130. That address fits inside 10.1.1.128/25, and it also fits inside 10.1.1.0/24 and 10.1.0.0/16. But /25 is the most specific of those matches, so the router uses it.

Only after determining that two routes have the same prefix length would the router consider administrative distance and metric. The default route is ignored because more specific matches exist.

Answer

The default route

Answer

The OSPF route to 10.1.1.0/24

Answer

The OSPF route to 10.1.0.0/16

Question 4

A router receives two routes to 10.50.0.0/16: one from OSPF and one static route with an administrative distance of 90. Which route is installed by default?

Accepted Answer

The static route, because its administrative distance is lower than OSPF's. By default, the static route with administrative distance 90 is installed because it is preferred over the OSPF route with default administrative distance 110. In plain language, the router is being told that the manually configured route is more trustworthy than the OSPF-learned one, so it chooses the static path first. The protocol type alone does not decide the outcome. Administrative distance is the key comparison when two different route sources offer the same destination prefix length.

This is a classic routing-selection question because many learners incorrectly assume OSPF always wins over static routes unless the static route uses the default administrative distance. Once the static route is given a value lower than OSPF’s 110, it becomes the preferred path unless a more specific route exists elsewhere.

Answer

The OSPF route, because dynamic routes always override static routes

Answer

Both routes, because equal destination networks always load-balance

Answer

Neither route, because the destinations overlap

Question 5

A phone and PC share one switchport. The phone works, but the PC cannot reach its normal data resources. The switchport voice VLAN is configured, and the access VLAN is incorrect. Which explanation is strongest?

Accepted Answer

The PC is likely in the wrong data VLAN even though the phone still uses the correct voice VLAN.. The switchport is configured with a voice VLAN for the phone and an access VLAN for the PC. If the access VLAN is incorrect, the PC will be placed in the wrong data VLAN, preventing it from reaching its normal data resources, while the phone continues to operate correctly on its designated voice VLAN. This is a common misconfiguration where the data VLAN ID does not match the network segment the PC expects.

Answer

If the phone works, the PC must also work because both use the same VLAN always.

Answer

The issue must be BGP because phones cannot use VLANs.

Answer

The access VLAN becomes irrelevant whenever a voice VLAN is configured.

Question 6

Which TWO statements about network automation tools are true?

Accepted Answer

Ansible uses an agentless architecture and communicates with network devices over SSH by default.. Ansible is agentless, meaning it does not require any software installed on managed network devices. It connects to devices over SSH by default (or API for some platforms) and pushes configuration modules directly, making it lightweight and easy to deploy in network environments.

Answer

Puppet and Chef both use a push-based model where the master server initiates configuration changes on managed nodes.

Answer

Chef playbooks are written in YAML, while Ansible uses a Ruby-based DSL for defining desired state.

Answer

Ansible requires an agent to be installed on managed network devices, while Puppet does not.

Question 7

A host address is 192.168.22.145/28. Which subnet contains that host?

Accepted Answer

192.168.22.144/28. A /28 prefix creates address blocks of 16. In practical terms, the fourth-octet ranges are 0–15, 16–31, 32–47, and so on. Because 145 falls inside the 144–159 range, the network address of the containing subnet is 192.168.22.144/28.

This type of question checks whether you can move from prefix length to block size and then place a host into the correct interval. The common mistake is choosing a nearby familiar number instead of calculating the actual block boundary.

Answer

192.168.22.128/28

Answer

192.168.22.160/28

Answer

192.168.22.148/28

Question 8

What is a northbound API in a controller-based network architecture?

Accepted Answer

An interface used by applications to communicate with the controller. Northbound APIs allow external applications, dashboards, and automation tools to interact with the controller. Southbound APIs are used by the controller to communicate with the network devices it manages.

Answer

An interface used by the controller to program forwarding tables on switches

Answer

A dedicated out-of-band management port on the controller

Answer

A wireless uplink between access points and the controller

Question 9

A host is configured with 10.10.10.130/25. What is the network address of its subnet?

Accepted Answer

10.10.10.128. A /25 divides the address space into two blocks of 128 addresses. In plain language, the ranges are 0–127 and 128–255. Since the host ends in 130, it belongs to the 128–255 half. That means the network address is 10.10.10.128.

This is a common subnet-boundary question because it tests whether you can map a host address into the correct prefix block quickly and confidently.

Answer

10.10.10.0

Answer

10.10.10.64

Answer

10.10.10.255

Question 10

You are connected to R1 via console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to an ISP, and GigabitEthernet0/1 (192.168.1.1/24) connects to the internal LAN. The network administrator needs to monitor R1's system messages. Configure R1 to send syslog messages with severity level 5 (notifications) and above to the syslog server at 10.0.0.2. Also, ensure that logging is enabled and that messages include the timestamp and source interface.

Accepted Answer

logging on
logging trap notifications
logging source-interface GigabitEthernet0/0
logging host 10.0.0.2
service timestamps log datetime. The logging commands enable syslog output. 'logging trap notifications' sets severity to 5 (notifications). 'logging source-interface' ensures syslog messages originate from a consistent IP. 'service timestamps' adds time information to log entries for easier troubleshooting.

Answer

logging on
logging trap informational
logging source-interface GigabitEthernet0/1
logging host 10.0.0.2
service timestamps log datetime

Answer

logging on
logging trap 5
logging source-interface GigabitEthernet0/0
logging 10.0.0.2
service timestamps

Answer

logging on
logging trap notifications
logging source-interface GigabitEthernet0/1
logging host 10.0.0.2
service timestamps debug datetime

Question 11

A router learns 10.10.10.0/24 from OSPF and EIGRP at the same time. OSPF reports a metric of 20, and EIGRP reports a metric of 30720. Which route is installed in the routing table by default?

Accepted Answer

The EIGRP route, because its administrative distance is lower. When the same prefix is learned from different routing protocols, the router compares administrative distance first. EIGRP internal routes use AD 90, while OSPF uses AD 110, so the EIGRP route is preferred.

Answer

The OSPF route, because 20 is lower than 30720

Answer

Both routes, because they point to the same prefix

Answer

Neither route, because the metrics are not comparable

Question 12

A network administrator configured dynamic NAT on a Cisco router to allow internal hosts to access the internet. After the configuration, users report that they can access some websites but not others. The administrator checks the router and discovers that the NAT translation table is full, and new connection attempts are being dropped. What is the most likely cause of this issue?

Accepted Answer

The NAT pool is exhausted; configure PAT to allow multiple hosts to share a single public IP.. When the NAT pool is exhausted, no new translations can be created, so only hosts that already have established translations can continue to communicate, causing intermittent connectivity. A full NAT table means the pool of public IP addresses is completely allocated, preventing new sessions. Implementing PAT allows multiple inside hosts to share a single public IP by multiplexing port numbers, resolving the pool exhaustion.

Answer

The inside local addresses are not properly defined in the access list.

Answer

The outside interface is not configured with the ip nat outside command.

Answer

The inside interface is not configured with the ip nat inside command.

Question 13

You are connected to R1. The inside network 192.168.1.0/24 must be able to reach the internet via PAT (overload) using the public IP 203.0.113.1 on interface GigabitEthernet0/1. Additionally, a web server at 192.168.1.10 must be reachable from the internet via static NAT to 203.0.113.10. The current configuration is not working. Identify and fix all issues.

Accepted Answer

Change ACL 100 to permit 192.168.1.0 0.0.0.255, add 'overload' to the ip nat inside source list command, and verify with 'show ip nat translations'.. The configuration has two issues: (1) ACL 100 permits 192.168.2.0/24 instead of 192.168.1.0/24, so the inside traffic is not matched for PAT. (2) The 'ip nat inside source list' command lacks the 'overload' keyword, preventing port address translation. The static NAT entry for the web server is correctly configured and does not depend on the ACL; it will work once the ACL is fixed. To resolve: change ACL 100 to permit 192.168.1.0 0.0.0.255, add 'overload' to the ip nat inside source list command, and verify with 'show ip nat translations'.

Answer

Change ACL 100 to permit 192.168.1.0 0.0.0.255 and add the 'overload' keyword to the ip nat inside source list command.

Answer

Add the 'overload' keyword to the ip nat inside source list command and verify with 'show ip nat translations'.

Answer

Change ACL 100 to permit 192.168.1.0 0.0.0.255 and verify with 'show ip nat translations'.

Question 14

Match each IPv6 address type or concept to its most accurate description.

Accepted Answer

Global Unicast: Routable over the public internet, assigned by RIRs.. Each IPv6 address type has a distinct purpose: Global Unicast for public routing, Link-Local for local segment, Unique Local for private site, Multicast for group communication, Anycast for nearest device, and SLAAC for stateless address assignment.

Answer

Link-Local: Routable across the entire enterprise network, used for inter-VLAN routing.

Answer

Unique Local: Globally unique and routable on the public internet, similar to Global Unicast.

Answer

Multicast: Used for one-to-one communication between two specific hosts.

Question 15

R1 has the following routes installed:

O    10.10.10.0/24 via 192.0.2.2
S    10.10.10.128/25 via 198.51.100.2
S*   0.0.0.0/0 via 203.0.113.1

A packet destined for 10.10.10.200 arrives at R1. Which route is used?

Accepted Answer

The static route to 10.10.10.128/25 via 198.51.100.2. Routers forward using longest prefix match first. Even though the OSPF /24 exists, the static /25 is more specific and covers 10.10.10.200, so the packet is sent via 198.51.100.2. The default route is used only when nothing more specific matches.

Answer

The OSPF route to 10.10.10.0/24 via 192.0.2.2

Answer

The default route via 203.0.113.1

Answer

The packet is dropped because OSPF routes cannot overlap with static routes.

Question 16

A router has a static default route with administrative distance 250 and also learns a default route through OSPF. What is the main design purpose of the static default route?

Accepted Answer

To serve as a backup default route if the OSPF default is lost.. The main purpose is to act as a backup route of last resort if the OSPF-learned default route disappears. In practical terms, the very high administrative distance keeps the static default out of the active table while the OSPF default is available. It remains in reserve only for failure conditions.

This is a classic floating-static-default design. It provides resilience without replacing the primary dynamic path.

Answer

To override the OSPF default route immediately.

Answer

To make the router ignore all default routes.

Answer

To turn the default route into a host route.

Question 17

A switch port is configured with `switchport voice vlan 150` and `switchport access vlan 20`. Which statement best explains the design purpose?

Accepted Answer

It separates voice and data traffic on the same edge port by assigning them to different VLANs.. The design purpose is to let the switch support a phone and an attached workstation on the same physical access port while placing their traffic into different VLANs. In practical terms, the phone can use the voice VLAN while the user's data traffic uses the access VLAN. This is a common enterprise edge design for IP telephony.

The key idea is role separation on one port, not trunking the port as a normal inter-switch link.

Answer

It turns the port into a routed WAN interface.

Answer

It forces the phone to use CAPWAP before receiving power.

Answer

It makes VLAN 150 the native VLAN on all trunks automatically.

Question 18

An administrator wants an access-layer interface to shut down immediately if another switch is connected accidentally. Which feature best meets that requirement?

Accepted Answer

BPDU Guard. BPDU Guard is designed for edge ports. If the port receives a BPDU, the switch treats that as a sign that another switch has been connected and places the interface into an err-disabled state to protect the spanning-tree topology.

Answer

Root Guard

Answer

PortFast

Answer

Loop Guard

Question 19

A switch interface connects to a user PC and should belong only to VLAN 30. Which command assigns that VLAN after the interface is in access mode?

Accepted Answer

switchport access vlan 30. After an interface is placed into access mode, the command used to assign its VLAN is `switchport access vlan 30`. In plain language, this tells the switch which VLAN the endpoint traffic on that access port belongs to. Access mode defines the role of the interface, and the access VLAN command defines the specific VLAN membership for that role.

This distinction matters because some commands change the port’s behavior while others set the VLAN it uses. The correct answer is the one that directly assigns VLAN 30 to the access port rather than modifying a trunk or a native VLAN setting.

Answer

switchport trunk allowed vlan 30

Answer

encapsulation dot1Q 30

Answer

ip helper-address 30

Question 20

An engineer is troubleshooting an OSPF adjacency between two directly connected routers, R1 and R2. R1 is configured with a passive-interface default under the OSPF process, and the interface connecting to R2 is not explicitly set to no passive-interface. The engineer runs a show ip ospf neighbor command on R1 and sees no neighbors. What is the most likely reason for the missing adjacency?

Accepted Answer

The passive-interface default command is preventing OSPF hellos on the interface.. The `passive-interface default` command under the OSPF process makes all interfaces passive by default, meaning OSPF Hellos are not sent unless explicitly overridden with `no passive-interface`. Since the interface to R2 was not configured with `no passive-interface`, R1 does not send Hellos, preventing adjacency. Option A is less likely because even if the network statement is correct, a passive interface still blocks Hellos. Option C is incorrect because OSPF automatically selects a router-id if not configured (highest loopback or interface IP), and a missing router-id does not prevent Hellos. Option D is unsupported by the scenario; no authentication mismatch is indicated.

Answer

The network statement does not match the interface IP address.

Answer

The router-id is not configured, so OSPF cannot form an adjacency.

Answer

There is an OSPF authentication mismatch between R1 and R2.

CCNA Practice Exam 67 — 20 Questions

Exhibit

CCNA Practice Exam 67 — 20 Questions

Exhibit