CCNA Practice Exam 69 — 20 Questions

Question 1

Exhibit: SW2 receives superior BPDUs on both uplinks. One uplink becomes the root port and the other becomes alternate. Which factor is considered first when SW2 chooses the root port?

Accepted Answer

Lowest root path cost. STP chooses the best path to the root bridge based first on the lowest root path cost. If the cost ties, it then checks the sender bridge ID and sender port ID as tie-breakers.

Answer

Lowest local interface MAC address

Answer

Highest duplex setting

Answer

Lowest configured VLAN number

Question 2

You are connected to R1 via console. R1 is a router that has two paths to the Internet: one via ISP1 with next-hop 203.0.113.1, and a backup via ISP2 with next-hop 203.0.113.2. The primary path should be via ISP1, but if it fails, traffic should automatically use ISP2. Currently, R1 has a static default route to ISP1 only. You need to configure a floating static route to ISP2 with an administrative distance of 150 to provide backup connectivity. Additionally, you must ensure that the backup route is only used when the primary route is not available.

Accepted Answer

ip route 0.0.0.0 0.0.0.0 203.0.113.2 150. By setting the administrative distance to 150, the backup static route is less preferred than the primary static route (distance 1). If the primary route is removed due to a failure, the floating route is installed, providing backup connectivity.

Answer

ip route 0.0.0.0 0.0.0.0 203.0.113.2 1

Answer

ip route 0.0.0.0 0.0.0.0 203.0.113.2 250

Answer

ip route 0.0.0.0 0.0.0.0 203.0.113.2

Question 3

Which three statements are true about the operation of Dynamic Host Configuration Protocol (DHCP) in an enterprise network? (Choose three.)

Accepted Answer

A DHCP server uses the client's MAC address to uniquely identify and assign an IP address.. The DHCP client sends a DHCPDISCOVER message as a broadcast (destination IP 255.255.255.255) because it does not yet know the IP address of any DHCP server. The server uses the client's MAC address (from the CHADDR field) to uniquely identify the client and assign an IP address. DHCP options like default gateway and DNS server are carried in the DHCPOFFER and DHCPACK messages as part of the Options field, allowing the server to provide essential network configuration parameters.

Answer

A DHCP relay agent is required only if the client and server are on the same subnet.

Answer

The DHCPREQUEST message is always sent as a unicast directly to the DHCP server.

Answer

DHCP ensures that IP addresses are permanently assigned and never expire.

Question 4

You are connected via the console to R1, a Cisco ISR 4331 router. The network administrator reports that the link between R1's GigabitEthernet0/0 and a switch is experiencing high error rates and intermittent connectivity. Upon inspection, you notice that the interface is configured with speed 1000 and duplex full. The switch port is set to auto-negotiate. Your task is to resolve the duplex mismatch by configuring the router interface to match the switch's settings.

Accepted Answer

Configure the router interface with 'no speed' and 'no duplex' to restore defaults, then set 'speed auto' and 'duplex auto'.. The duplex mismatch was caused by manually forcing speed and duplex on the router while the switch was set to auto-negotiate. Changing the router to auto-negotiate allows both sides to negotiate the best duplex (full duplex) and speed, eliminating errors.

Answer

Configure the router interface with 'speed 1000' and 'duplex full'.

Answer

Configure the router interface with 'no speed' and 'no duplex' to restore defaults, then set 'speed 1000' and 'duplex full'.

Answer

Configure the router interface with 'no speed' and 'no duplex' to restore defaults, then set 'speed 1000' and 'duplex half'.

Question 5

A host is configured with 10.10.10.33/27. What is the broadcast address of its subnet?

Accepted Answer

10.10.10.63. A /27 uses address blocks of 32. In practical terms, the ranges are 0–31, 32–63, 64–95, and so on. Because .33 falls inside the 32–63 block, the broadcast address is the last address in that block, which is 10.10.10.63.

This is a classic subnet-boundary question. The trick is to identify the correct block first and then choose its last address as the broadcast.

Answer

10.10.10.31

Answer

10.10.10.32

Answer

10.10.10.64

Question 6

You are connected to R1 via console. R1 is connected to R2 via GigabitEthernet0/0 and to R3 via GigabitEthernet0/1. OSPF has been configured, but R1 is not forming a full adjacency with R2. You run `show ip ospf neighbor` on R1 and see R2 stuck in EXSTART state. You also run `show ip ospf interface GigabitEthernet0/0` and see the network type is broadcast. You need to identify and resolve the issue.

Accepted Answer

Change the OSPF network type on R1's GigabitEthernet0/0 interface to point-to-point.. R1's Gi0/0 defaults to OSPF broadcast network type, while R2 is likely configured as point-to-point. This mismatch prevents the routers from forming a full adjacency, often leaving them stuck in EXSTART or 2-WAY state. Changing R1's interface to point-to-point aligns the network types, allowing adjacency to form. The other options are incorrect because hello interval mismatches (B) or DR priority (C) are not the root cause, and adding the broadcast command (D) would not fix a point-to-point mismatch.

Answer

Increase the OSPF hello interval on R1's GigabitEthernet0/0 interface to match R2's hello interval.

Answer

Configure the OSPF priority on R1's GigabitEthernet0/0 interface to 0 to prevent it from becoming the DR.

Answer

Add the 'ip ospf network broadcast' command on R1's GigabitEthernet0/0 interface.

Question 7

You are connected to R1. The network currently permits all HTTP traffic from hosts on the 192.168.1.0/24 LAN to reach the web server at 203.0.113.10, but SSH traffic (TCP port 22) from the same LAN is being blocked. Additionally, you must ensure that no other traffic from the LAN reaches the server. Configure an extended ACL on R1 to allow only HTTP and SSH from the LAN to the server, and apply it inbound on the correct interface. Verify your solution.

Accepted Answer

Remove the existing ACL from the interface, delete the ACL, create a new extended ACL that permits tcp from 192.168.1.0/24 to host 203.0.113.10 for ports 80 and 22, and apply it inbound on GigabitEthernet0/0.. The existing ACL BLOCK_SSH is applied inbound on GigabitEthernet0/0 and explicitly denies SSH from the LAN to the server, but permits all other IP traffic (including HTTP). The requirement is to allow only HTTP and SSH, blocking everything else. The solution is to remove the current ACL from the interface, delete the ACL, create a new extended ACL that permits tcp from the LAN to the server for ports 80 (HTTP) and 22 (SSH), and implicitly deny all other traffic, then reapply it inbound on GigabitEthernet0/0.

Answer

Modify the existing ACL BLOCK_SSH by adding a permit statement for HTTP and changing the deny SSH to permit SSH, then reapply it inbound on GigabitEthernet0/0.

Answer

Create a new extended ACL that permits tcp from 192.168.1.0/24 to host 203.0.113.10 for ports 80 and 22, and apply it inbound on GigabitEthernet0/1 (the WAN interface).

Answer

Create a new extended ACL that permits tcp from 192.168.1.0/24 to host 203.0.113.10 for ports 80 and 22, and apply it outbound on GigabitEthernet0/0.

Question 8

A host reaches websites by IP address but fails when using hostnames. Which service is the strongest suspect?

Accepted Answer

DNS. The strongest suspect is DNS. In plain language, the host can already reach the remote system when given the numeric address directly, which suggests the underlying IP connectivity works. The missing piece is the translation of hostnames into IP-related information, and that is exactly the role of DNS.

This is one of the most common real troubleshooting patterns because it cleanly separates connectivity problems from name-resolution problems. If IP works but names fail, DNS becomes the most likely area to investigate.

Answer

STP

Answer

PAT

Answer

Port security

Question 9

Match each common network device or concept to its primary role.

Accepted Answer

Router: routes between networks; Switch: forwards within LAN; Hub: repeats signals; Firewall: filters traffic; AP: provides Wi-Fi; Modem: converts digital to analog for WAN. Router routes between networks; switch forwards within LAN; hub repeats signals; firewall filters traffic; AP provides Wi-Fi; modem converts digital to analog for WAN.

Answer

Router: forwards within LAN; Switch: routes between networks; Hub: filters traffic; Firewall: repeats signals; AP: converts digital to analog; Modem: provides Wi-Fi

Answer

Router: filters traffic; Switch: repeats signals; Hub: routes between networks; Firewall: forwards within LAN; AP: converts digital to analog; Modem: provides Wi-Fi

Answer

Router: provides Wi-Fi; Switch: converts digital to analog; Hub: routes between networks; Firewall: forwards within LAN; AP: filters traffic; Modem: repeats signals

Question 10

You are connected to SW1. The network has experienced a spanning-tree topology change, and the new root bridge is not the intended core switch. Configure SW1 with a root primary priority, enable PortFast and BPDU Guard on interface GigabitEthernet0/3 (an edge port connected to a server), and verify that a specific port in the topology is blocking. Then, after a BPDU violation occurs on G0/3, recover the interface from err-disable state without reloading the switch.

Accepted Answer

spanning-tree vlan 1 root primary; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpduguard enable; interface GigabitEthernet0/3; shutdown; no shutdown. The current root bridge has priority 32769, but the intended root should be SW1 with a lower priority. First, configure SW1 as root primary using 'spanning-tree vlan 1 root primary' or manually set priority to 24576. For edge port Gi0/3, enable PortFast with 'spanning-tree portfast' and BPDU Guard with 'spanning-tree bpduguard enable'. After the BPDU violation, the port is err-disabled. To recover, first shut down and then no shut the interface, or use 'errdisable recovery cause bpduguard' and wait for the recovery interval, but the most direct method is to manually bounce the interface.

Answer

spanning-tree vlan 1 priority 4096; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpduguard enable; interface GigabitEthernet0/3; errdisable recovery cause bpduguard

Answer

spanning-tree vlan 1 root secondary; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpduguard enable; interface GigabitEthernet0/3; no shutdown

Answer

spanning-tree vlan 1 root primary; interface GigabitEthernet0/3; spanning-tree portfast; spanning-tree bpdufilter enable; interface GigabitEthernet0/3; shutdown; no shutdown

Question 11

Match each DHCPv4 message in the DORA process to its role.

Accepted Answer

Discover: Client broadcasts to locate DHCP servers. The DORA process includes Discover (client broadcast), Offer (server response), Request (client accepts), and Ack (server confirms). Additional messages like NAK and Decline handle errors.

Answer

Discover: Server responds with an IP lease offer

Answer

Discover: Client requests the offered IP address

Answer

Discover: Server acknowledges the lease

Question 12

A switch displays the following output:

Switch# show interfaces trunk

Port        Mode    Encapsulation  Status     Native vlan
Gi1/0/24    on      802.1q         trunking   99

Port        Vlans allowed on trunk
Gi1/0/24    10,20,30

Port        Vlans active in management domain
Gi1/0/24    10,20,30,40

Users in VLAN 40 cannot reach resources across this trunk.

What is the most likely reason?

Accepted Answer

VLAN 40 is not permitted on the trunk. The trunk is not carrying VLAN 40 because VLAN 40 is missing from the allowed VLAN list (only 10, 20, 30 are allowed). Option A is incorrect because spanning tree does not block VLANs by default without evidence of a loop; the output shows no STP blocking. Option B is incorrect because native VLAN only affects tagging, not whether a VLAN can traverse a trunk; all VLANs can cross a trunk if permitted. Option D is incorrect because 802.1Q can carry up to 4094 VLANs, not just three. The key distinction is that a VLAN may be active on the switch but still fail to cross a specific trunk if it is not in the allowed list.

Answer

VLAN 40 is active, so spanning tree must be blocking it

Answer

VLAN 40 is not in the native VLAN, so it cannot cross the trunk

Answer

802.1Q trunks can carry only three VLANs at a time

Question 13

A network administrator has configured a DHCP server on VLAN 100 with an IP address of 192.168.100.10/24. Clients on VLAN 200 (192.168.200.0/24) report that they cannot obtain an IP address via DHCP. The router is configured with a DHCP relay on the VLAN 200 interface. The administrator checks the router configuration and verifies that the relay is in place, but clients still fail to get an address. The switch that the router and clients connect to has DHCP snooping enabled. What is the most likely cause of this issue?

Accepted Answer

DHCP snooping is blocking the relay agent because the relay interface is not trusted.. The scenario states that DHCP snooping is enabled on the switch. When DHCP snooping is active, it discards DHCP messages received on untrusted ports. The router's VLAN 200 interface, which is configured as a DHCP relay agent, must be configured as a trusted port for DHCP snooping; otherwise, the relayed messages are silently dropped. Option A is incorrect because the relay address is correctly pointing to the DHCP server's subnet. Option C is too generic and unlikely since the router and switch are directly connected. Option D is incorrect because the relay is verified to be in place. Therefore, the most likely cause is DHCP snooping blocking the relay agent due to the relay interface not being trusted.

Answer

The DHCP server is on a different subnet and the relay address is incorrect.

Answer

The DHCP server is unreachable from the router.

Answer

The ip helper-address command is missing from the VLAN 200 interface.

Question 14

Match each routing concept to its most accurate meaning.

Accepted Answer

Administrative Distance is a measure of the trustworthiness of a routing information source, such as a routing protocol or a static route.. Administrative Distance measures route source trustworthiness; Metric determines best path within a protocol; Convergence is the time to reach consistent routing; Route Summarization reduces routing table size; Floating Static Route acts as a backup; ECMP enables load balancing.

Answer

Administrative Distance is the metric used by a routing protocol to determine the best path within that protocol.

Answer

Administrative Distance is the time it takes for a routing protocol to converge after a network change.

Answer

Administrative Distance is the number of hops a packet takes to reach its destination.

Question 15

A network engineer notices that a root port on a switch has transitioned to a loop-inconsistent state. The port was previously receiving BPDUs normally, but after a suspected unidirectional fiber cut, it no longer receives BPDUs. What is the most likely cause?

Accepted Answer

Loop Guard is active on the root port and transitioned it to loop-inconsistent state upon BPDU loss.. Loop Guard is a Spanning Tree Protocol (STP) enhancement that prevents alternate or root ports from becoming designated forwarding ports when BPDUs are no longer received. When a unidirectional fiber cut causes BPDU loss on a root port, Loop Guard transitions the port to the loop-inconsistent state, blocking traffic until BPDUs are received again. This matches the scenario exactly, making option B correct.

Answer

BPDU Guard is enabled on the port, causing it to be placed in error-disabled state.

Answer

UDLD has detected a unidirectional link and has shut down the port.

Answer

Root Guard is preventing the port from transitioning to designated forwarding after losing BPDUs.

Question 16

A host is configured as 192.168.100.65/26. What is the valid host range for its subnet?

Accepted Answer

192.168.100.65 to 192.168.100.126. A /26 creates blocks of 64 addresses. In plain language, the subnets in the last octet are 0–63, 64–127, 128–191, and 192–255. Because the host address is 192.168.100.65, it belongs to the 64–127 block. In that block, 192.168.100.64 is the network address and 192.168.100.127 is the broadcast address. That leaves 192.168.100.65 through 192.168.100.126 as the valid host range.

This checks whether you can identify both the subnet boundary and the usable range.

Answer

192.168.100.64 to 192.168.100.127

Answer

192.168.100.1 to 192.168.100.62

Answer

192.168.100.66 to 192.168.100.127

Question 17

Which two statements about NTP are correct? (Choose two.)

Accepted Answer

Accurate time helps correlate log messages across multiple devices.. NTP synchronizes time across devices, which is important for logging, certificates, and event correlation.

Answer

NTP replaces the need for DNS in enterprise networks.

Answer

NTP is used to negotiate EtherChannel parameters.

Question 18

A router is configured for PAT overload. What does the inside global address represent for an internal PC?

Accepted Answer

The public address that represents the internal PC to external networks. With NAT overload, the inside local address is the private address on the internal host. The inside global is the translated public address that represents that inside host to the outside network.

Answer

The private IP address assigned to the internal PC

Answer

The remote server address as seen from the inside host

Answer

The MAC address of the outside interface

Question 19

A packet is larger than the outgoing interface MTU and the DF bit is set in the IPv4 header. What should the router do?

Accepted Answer

Drop the packet and send an ICMP message indicating fragmentation was needed.. If fragmentation is required but DF is set, the router drops the packet and returns an ICMP unreachable message indicating fragmentation was needed.

Answer

Fragment the packet anyway and forward all fragments.

Answer

Clear the DF bit and then fragment the packet.

Answer

Encapsulate the packet in GRE automatically.

Question 20

Why might a controller return interface information as a JSON array instead of a single JSON object?

Accepted Answer

Because an array is the appropriate structure for an ordered list of multiple interface entries.. A controller might return interface information as a JSON array because there are multiple interface records to present as a list. In practical terms, an array is the correct structure when the response includes several similar items, such as multiple interfaces, routes, or VLANs. Each element in the array can then be its own object with fields like name, status, or IP address.

This is a data-structure recognition question. It is not about networking behavior directly, but about understanding how automation systems represent repeated information.

Answer

Because a JSON object cannot contain fields.

Answer

Because arrays are used only for IPv6 interfaces.

Answer

Because arrays eliminate the need for API authentication.