CCNA Practice Exam 68 — 20 Questions

Question 1

Exhibit: A controller returns an authentication token after a successful API login. Why does the client include that token in later requests?

Accepted Answer

To prove identity and authorization on later API calls. The token proves the client already authenticated and is authorized to use the API. It saves the client from resending credentials on every request and lets the server validate session or access scope.

Answer

To replace the need for an IP address on the client

Answer

To encrypt every packet at Layer 1

Answer

To change HTTP from a stateless protocol to a routing protocol

Question 2

Two static routes exist for the 203.0.113.0/24 network: one pointing to ISP-A with an administrative distance of 10, and another pointing to ISP-B with an administrative distance of 5. Packets for that subnet are leaving through ISP-B. What explains this behavior?

Accepted Answer

The ISP-B route has a lower administrative distance.. The route via ISP-B has a lower administrative distance, so it wins for the identical /24 prefix. For routes to the same destination and mask, the router compares AD before considering anything else between different route sources.

Answer

Static routes with a higher next-hop IP are preferred.

Answer

The router always prefers the route configured last.

Answer

The route names force policy-based routing.

Question 3

PCs in VLAN 30 on SwitchA cannot reach PCs in VLAN 30 on SwitchB. VLAN 30 exists on both switches and all other VLANs work across the same link. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 30 is not allowed on the trunk from SwitchA.. The trunk is up, but VLAN 30 is missing from the allowed list on SwitchA. In plain language, the hallway between the switches is open, but one side is refusing to carry that specific VLAN through the hallway. Since the other VLANs are working, the failure is selective rather than total. That strongly points to an allowed-VLAN problem rather than a broader trunk outage.

This is a classic CCNA switching scenario because it tests whether you can separate trunk health from per-VLAN forwarding. A trunk can be operational and still block one VLAN if that VLAN is not permitted on one side. The native VLAN and encapsulation are not the issue shown here — the mismatch in the allowed list is.

Answer

The native VLAN is mismatched.

Answer

The trunk must use ISL instead of 802.1Q.

Answer

VLAN 30 must be configured as the native VLAN.

Question 4

A user types www.example.com into a browser. Which service is used first to resolve that name into an IP address?

Accepted Answer

DNS. DNS maps hostnames to IP addresses, which is the first step when a user enters a URL. DHCP assigns IP addresses, NTP synchronizes time, and Syslog handles logging—none of these services resolve domain names to IP addresses. The web session itself uses HTTP or HTTPS later, but name resolution happens first.

Answer

DHCP

Answer

NTP

Answer

Syslog

Question 5

You are troubleshooting a client connectivity issue on PC1, which is connected to switch SW1. PC1 reports that it cannot access the internet, but it can ping its default gateway (192.168.1.1). The network uses VLAN 10 for the client subnet. Examine the following show outputs: On PC1, ipconfig shows IP 192.168.1.10, default gateway 192.168.1.1, DNS server 192.168.1.1. On SW1, show running-config includes 'interface Vlan10' with IP 192.168.1.1 255.255.255.0, but no 'ip dns server' and no 'ip name-server' commands. SW1's show ip route displays a default route via 203.0.113.1. Identify the root cause. Configure the necessary fix on the appropriate device to restore full connectivity.

Accepted Answer

Configure 'ip dns server' and 'ip name-server 8.8.8.8' on SW1.. PC1 is configured with DNS server 192.168.1.1, which is the switch SW1. However, SW1 lacks DNS forwarding capability. To enable DNS relay on the switch, both the 'ip dns server' command (to activate the DNS forwarder) and 'ip name-server 8.8.8.8' (to point to an upstream resolver) are required. Option A provides the necessary configuration to restore DNS resolution and internet connectivity.

Answer

Configure 'ip default-gateway 192.168.1.1' on SW1.

Answer

Configure 'ip route 0.0.0.0 0.0.0.0 203.0.113.1' on SW1.

Answer

Configure 'ip domain-lookup' on SW1.

Question 6

Which two statements accurately describe REST-based APIs in a network automation context?

Accepted Answer

They commonly use HTTP methods such as GET, POST, PUT, and DELETE.. REST APIs are a modern way for software tools to interact with networking systems. In plain language, they let one application ask another application for information or tell it to make a change using standard web-style requests. That is why methods such as GET, POST, PUT, and DELETE show up so often in automation examples. REST APIs also commonly exchange structured data, and JSON is one of the most common formats because it is compact and easy to process programmatically.

They do not depend on Telnet, and they absolutely do not remove the need for security controls. In real deployments, authentication and authorization are often critical. REST APIs are also not limited to one device category. They can exist on routers, switches, wireless controllers, cloud platforms, and many other systems.

Answer

They require Telnet to exchange structured data.

Answer

They can be used only on physical routers and never on controllers.

Answer

They eliminate the need for authentication or authorization.

Question 7

Which three options correctly describe how a router processes a packet destined for a remote network? (Choose three.)

Accepted Answer

It rewrites the source and destination MAC addresses for the next hop.. When a router forwards a packet to a remote network, it first decrements the Time-to-Live (TTL) field in the IP header to prevent infinite loops. It then performs a routing table lookup for the destination IP address to determine the next-hop interface and IP. Finally, it rewrites the source and destination MAC addresses for the next hop, because MAC addresses are only relevant on the local link and must be updated at each Layer 3 hop.

Answer

It sends an ARP request for every destination IP address in the packet.

Answer

It encapsulates the entire packet in a new Layer 2 frame with the original MAC addresses.

Answer

It replaces the source IP address with its own outgoing interface IP.

Question 8

Drag and drop the following steps into the correct order to troubleshoot and resolve excessive interface errors caused by a duplex mismatch on a Cisco switch interface.

Accepted Answer

Use the show interfaces command to examine the input errors, CRC, and late collisions counters.. The correct order starts with identifying symptoms using show interfaces to see error counters like CRC and late collisions. Next, check the local interface speed and duplex with show interfaces status. Then discover the neighbor's speed and duplex, for instance via show cdp neighbors detail, to confirm a mismatch. After identifying the mismatch, configure the interface with the correct settings (e.g., speed and duplex commands). Finally, verify the resolution by running show interfaces again to ensure errors are no longer incrementing.

Question 9

What is the operational purpose of configuring the IPv6 route ::/0?

Accepted Answer

It provides a fallback path for unknown remote IPv6 destinations.. The configured route is a default route. In practical terms, it gives the router one simple next hop for any remote IPv6 destination that is not matched by a more specific entry. That is exactly what a small branch router often needs when it has a single upstream path.

This is the same design logic as an IPv4 default route, but with IPv6 syntax and addressing.

Answer

It enables OSPFv3 on the upstream interface.

Answer

It converts link-local addresses into global unicast addresses.

Answer

It summarizes all IPv6 routes into one /64 route.

Question 10

A router has a connected route to 192.168.1.0/24 and also has a default route. Which route is used for traffic to 192.168.1.55?

Accepted Answer

The connected route to 192.168.1.0/24. The connected route is used because it is both directly attached and more specific than the default route. In plain language, the router already knows that the destination belongs to one of its local interface networks, so it has no reason to send that traffic to a fallback route.

This is one of the most basic route-selection behaviors. Default routes matter only when no better match exists. Here, a directly connected, exact matching network is already present.

Answer

The default route

Answer

Both routes equally

Answer

Neither route

Question 11

A host is configured with 192.168.60.33/26. Which address is the network address of its subnet?

Accepted Answer

192.168.60.0. A /26 uses blocks of 64 addresses. In practical terms, the fourth-octet ranges are 0–63, 64–127, 128–191, and 192–255. Since 33 falls within the 0–63 block, the network address is 192.168.60.0.

This is a straightforward boundary-identification question, but it catches people who memorize masks without understanding block sizes. The right approach is to find the correct block first, then take the first address in that block as the network address.

Answer

192.168.60.32

Answer

192.168.60.64

Answer

192.168.60.63

Question 12

Users on the inside network can browse the web, but the company now needs an internal web server at 192.168.10.50 to be reachable consistently from outside using one public IP address. Which design is most appropriate?

Accepted Answer

Use static NAT for the server and continue using PAT for user outbound access.. The best design is static NAT for the server while continuing to use PAT for general user outbound traffic. In plain language, user browsing and server publishing are two different requirements. PAT is great for letting many inside users share one public address for outbound access. But a server that outside clients must find reliably needs a fixed one-to-one public identity. That is exactly what static NAT provides.

This is an important design distinction. PAT solves address conservation for many clients. Static NAT solves predictability for inbound access to a specific internal system. The strongest answer is the one that uses each NAT method for the job it fits best.

Answer

Use PAT only for everything, including the published server.

Answer

Disable NAT because private IPv4 addresses are Internet-routable.

Answer

Use DHCP relay for the server to make it reachable from outside.

Question 13

You are connected to a multilayer switch MLS1. Configure Root Guard on switchport GigabitEthernet 0/1 (connected to an unauthorized switch) so that if a superior BPDU is received, the port is blocked instead of causing a topology change. Also enable Loop Guard on uplink GigabitEthernet 0/2 (connected to the root bridge) to prevent unidirectional link issues. Finally, enable BPDU Guard on PortFast-enabled access port GigabitEthernet 0/3 (connected to a host) so that if a BPDU is received, the port goes err-disabled. After configuration, a superior BPDU is received on G0/1 and the port is blocked; a BPDU is received on G0/3 and the port goes err-disabled. Verify these protections are active.

Accepted Answer

Root Guard on G0/1, Loop Guard on G0/2, BPDU Guard on G0/3. Root Guard was correctly configured on G0/1, so when a superior BPDU arrived, the port entered root-inconsistent state instead of becoming root port. Loop Guard on G0/2 prevents alternate port from becoming root if BPDUs stop. BPDU Guard on G0/3 correctly triggered err-disable upon receiving a BPDU on a PortFast port. To restore G0/3, use 'shutdown' then 'no shutdown' after removing the BPDU source. Verification commands confirm the protections are working.

Answer

Root Guard on G0/1, UplinkFast on G0/2, BPDU Guard on G0/3

Answer

BPDU Guard on G0/1, Loop Guard on G0/2, Root Guard on G0/3

Answer

Root Guard on G0/1, Loop Guard on G0/2, PortFast on G0/3

Question 14

Exhibit: SW2 receives superior BPDUs on both uplinks. One uplink becomes the root port and the other becomes alternate. Which factor is considered first when SW2 chooses the root port?

Accepted Answer

Lowest root path cost. STP chooses the best path to the root bridge based first on the lowest root path cost. If the cost ties, it then checks the sender bridge ID and sender port ID as tie-breakers.

Answer

Lowest local interface MAC address

Answer

Highest duplex setting

Answer

Lowest configured VLAN number

Question 15

Which three statements are true about the operation of Dynamic Host Configuration Protocol (DHCP) in an enterprise network? (Choose three.)

Accepted Answer

DHCP options, such as default gateway and DNS server, are included in DHCPOFFER and DHCPACK messages.. The DHCP client sends a DHCPDISCOVER message as a broadcast (destination IP 255.255.255.255) because it does not yet know the IP address of any DHCP server. The server uses the client's MAC address (from the CHADDR field) to uniquely identify the client and assign an IP address. DHCP options like default gateway and DNS server are carried in the DHCPOFFER and DHCPACK messages as part of the Options field, allowing the server to provide essential network configuration parameters.

Answer

DHCP ensures that IP addresses are permanently assigned and never expire.

Answer

The DHCPREQUEST message is always sent as a unicast directly to the DHCP server.

Answer

A DHCP relay agent is required only if the client and server are on the same subnet.

Question 16

A host is configured with 10.10.10.33/27. What is the broadcast address of its subnet?

Accepted Answer

10.10.10.63. A /27 uses address blocks of 32. In practical terms, the ranges are 0–31, 32–63, 64–95, and so on. Because .33 falls inside the 32–63 block, the broadcast address is the last address in that block, which is 10.10.10.63.

This is a classic subnet-boundary question. The trick is to identify the correct block first and then choose its last address as the broadcast.

Answer

10.10.10.31

Answer

10.10.10.32

Answer

10.10.10.64

Question 17

You are connected to R1. The network currently permits all HTTP traffic from hosts on the 192.168.1.0/24 LAN to reach the web server at 203.0.113.10, but SSH traffic (TCP port 22) from the same LAN is being blocked. Additionally, you must ensure that no other traffic from the LAN reaches the server. Configure an extended ACL on R1 to allow only HTTP and SSH from the LAN to the server, and apply it inbound on the correct interface. Verify your solution.

Accepted Answer

Remove the existing ACL from the interface, delete the ACL, create a new extended ACL that permits tcp from 192.168.1.0/24 to host 203.0.113.10 for ports 80 and 22, and apply it inbound on GigabitEthernet0/0.. The existing ACL BLOCK_SSH is applied inbound on GigabitEthernet0/0 and explicitly denies SSH from the LAN to the server, but permits all other IP traffic (including HTTP). The requirement is to allow only HTTP and SSH, blocking everything else. The solution is to remove the current ACL from the interface, delete the ACL, create a new extended ACL that permits tcp from the LAN to the server for ports 80 (HTTP) and 22 (SSH), and implicitly deny all other traffic, then reapply it inbound on GigabitEthernet0/0.

Answer

Modify the existing ACL BLOCK_SSH by adding a permit statement for HTTP and changing the deny SSH to permit SSH, then reapply it inbound on GigabitEthernet0/0.

Answer

Create a new extended ACL that permits tcp from 192.168.1.0/24 to host 203.0.113.10 for ports 80 and 22, and apply it inbound on GigabitEthernet0/1 (the WAN interface).

Answer

Create a new extended ACL that permits tcp from 192.168.1.0/24 to host 203.0.113.10 for ports 80 and 22, and apply it outbound on GigabitEthernet0/0.

Question 18

A host reaches websites by IP address but fails when using hostnames. Which service is the strongest suspect?

Accepted Answer

DNS. The strongest suspect is DNS. In plain language, the host can already reach the remote system when given the numeric address directly, which suggests the underlying IP connectivity works. The missing piece is the translation of hostnames into IP-related information, and that is exactly the role of DNS.

This is one of the most common real troubleshooting patterns because it cleanly separates connectivity problems from name-resolution problems. If IP works but names fail, DNS becomes the most likely area to investigate.

Answer

STP

Answer

PAT

Answer

Port security

Question 19

Match each common network device or concept to its primary role.

Accepted Answer

Router: routes between networks; Switch: forwards within LAN; Hub: repeats signals; Firewall: filters traffic; AP: provides Wi-Fi; Modem: converts digital to analog for WAN. Router routes between networks; switch forwards within LAN; hub repeats signals; firewall filters traffic; AP provides Wi-Fi; modem converts digital to analog for WAN.

Answer

Router: forwards within LAN; Switch: routes between networks; Hub: filters traffic; Firewall: repeats signals; AP: converts digital to analog; Modem: provides Wi-Fi

Answer

Router: filters traffic; Switch: repeats signals; Hub: routes between networks; Firewall: forwards within LAN; AP: converts digital to analog; Modem: provides Wi-Fi

Answer

Router: provides Wi-Fi; Switch: converts digital to analog; Hub: routes between networks; Firewall: forwards within LAN; AP: filters traffic; Modem: repeats signals

Question 20

You are connected to SW1. The network has experienced a spanning-tree topology change, and the new root bridge is not the intended core switch. Configure SW1 with a root primary priority, enable PortFast and BPDU Guard on interface GigabitEthernet0/3 (an edge port connected to a server), and verify that a specific port in the topology is blocking. Then, after a BPDU violation occurs on G0/3, recover the interface from err-disable state without reloading the switch.

Accepted Answer

spanning-tree vlan 1 root primary; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpduguard enable; interface GigabitEthernet0/3; shutdown; no shutdown. The current root bridge has priority 32769, but the intended root should be SW1 with a lower priority. First, configure SW1 as root primary using 'spanning-tree vlan 1 root primary' or manually set priority to 24576. For edge port Gi0/3, enable PortFast with 'spanning-tree portfast' and BPDU Guard with 'spanning-tree bpduguard enable'. After the BPDU violation, the port is err-disabled. To recover, first shut down and then no shut the interface, or use 'errdisable recovery cause bpduguard' and wait for the recovery interval, but the most direct method is to manually bounce the interface.

Answer

spanning-tree vlan 1 priority 4096; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpduguard enable; interface GigabitEthernet0/3; errdisable recovery cause bpduguard

Answer

spanning-tree vlan 1 root secondary; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpduguard enable; interface GigabitEthernet0/3; no shutdown

Answer

spanning-tree vlan 1 root primary; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpdufilter enable; interface GigabitEthernet0/3; shutdown; no shutdown