CCNA Practice Exam 69 — 20 Questions

Question 1

Match each DHCPv4 message in the DORA process to its role.

Accepted Answer

Discover: Client broadcasts to locate DHCP servers. The DORA process includes Discover (client broadcast), Offer (server response), Request (client accepts), and Ack (server confirms). Additional messages like NAK and Decline handle errors.

Answer

Discover: Server responds with an IP lease offer

Answer

Discover: Client requests the offered IP address

Answer

Discover: Server acknowledges the lease

Question 2

A switch displays the following output:

Switch# show interfaces trunk

Port        Mode    Encapsulation  Status     Native vlan
Gi1/0/24    on      802.1q         trunking   99

Port        Vlans allowed on trunk
Gi1/0/24    10,20,30

Port        Vlans active in management domain
Gi1/0/24    10,20,30,40

Users in VLAN 40 cannot reach resources across this trunk.

What is the most likely reason?

Accepted Answer

VLAN 40 is not permitted on the trunk. The trunk is not carrying VLAN 40 because VLAN 40 is missing from the allowed VLAN list (only 10, 20, 30 are allowed). Option A is incorrect because spanning tree does not block VLANs by default without evidence of a loop; the output shows no STP blocking. Option B is incorrect because native VLAN only affects tagging, not whether a VLAN can traverse a trunk; all VLANs can cross a trunk if permitted. Option D is incorrect because 802.1Q can carry up to 4094 VLANs, not just three. The key distinction is that a VLAN may be active on the switch but still fail to cross a specific trunk if it is not in the allowed list.

Answer

VLAN 40 is active, so spanning tree must be blocking it

Answer

VLAN 40 is not in the native VLAN, so it cannot cross the trunk

Answer

802.1Q trunks can carry only three VLANs at a time

Question 3

A network administrator has configured a DHCP server on VLAN 100 with an IP address of 192.168.100.10/24. Clients on VLAN 200 (192.168.200.0/24) report that they cannot obtain an IP address via DHCP. The router is configured with a DHCP relay on the VLAN 200 interface. The administrator checks the router configuration and verifies that the relay is in place, but clients still fail to get an address. The switch that the router and clients connect to has DHCP snooping enabled. What is the most likely cause of this issue?

Accepted Answer

DHCP snooping is blocking the relay agent because the relay interface is not trusted.. The scenario states that DHCP snooping is enabled on the switch. When DHCP snooping is active, it discards DHCP messages received on untrusted ports. The router's VLAN 200 interface, which is configured as a DHCP relay agent, must be configured as a trusted port for DHCP snooping; otherwise, the relayed messages are silently dropped. Option A is incorrect because the relay address is correctly pointing to the DHCP server's subnet. Option C is too generic and unlikely since the router and switch are directly connected. Option D is incorrect because the relay is verified to be in place. Therefore, the most likely cause is DHCP snooping blocking the relay agent due to the relay interface not being trusted.

Answer

The DHCP server is on a different subnet and the relay address is incorrect.

Answer

The DHCP server is unreachable from the router.

Answer

The ip helper-address command is missing from the VLAN 200 interface.

Question 4

Match each routing concept to its most accurate meaning.

Accepted Answer

Administrative Distance is a measure of the trustworthiness of a routing information source, such as a routing protocol or a static route.. Administrative Distance measures route source trustworthiness; Metric determines best path within a protocol; Convergence is the time to reach consistent routing; Route Summarization reduces routing table size; Floating Static Route acts as a backup; ECMP enables load balancing.

Answer

Administrative Distance is the metric used by a routing protocol to determine the best path within that protocol.

Answer

Administrative Distance is the time it takes for a routing protocol to converge after a network change.

Answer

Administrative Distance is the number of hops a packet takes to reach its destination.

Question 5

A network engineer notices that a root port on a switch has transitioned to a loop-inconsistent state. The port was previously receiving BPDUs normally, but after a suspected unidirectional fiber cut, it no longer receives BPDUs. What is the most likely cause?

Accepted Answer

Loop Guard is active on the root port and transitioned it to loop-inconsistent state upon BPDU loss.. Loop Guard is a Spanning Tree Protocol (STP) enhancement that prevents alternate or root ports from becoming designated forwarding ports when BPDUs are no longer received. When a unidirectional fiber cut causes BPDU loss on a root port, Loop Guard transitions the port to the loop-inconsistent state, blocking traffic until BPDUs are received again. This matches the scenario exactly, making option B correct.

Answer

BPDU Guard is enabled on the port, causing it to be placed in error-disabled state.

Answer

UDLD has detected a unidirectional link and has shut down the port.

Answer

Root Guard is preventing the port from transitioning to designated forwarding after losing BPDUs.

Question 6

Which two statements about NTP are correct? (Choose two.)

Accepted Answer

Accurate time helps correlate log messages across multiple devices.. NTP synchronizes time across devices, which is important for logging, certificates, and event correlation.

Answer

NTP replaces the need for DNS in enterprise networks.

Answer

NTP is used to negotiate EtherChannel parameters.

Question 7

A router is configured for PAT overload. What does the inside global address represent for an internal PC?

Accepted Answer

The public address that represents the internal PC to external networks. With NAT overload, the inside local address is the private address on the internal host. The inside global is the translated public address that represents that inside host to the outside network.

Answer

The private IP address assigned to the internal PC

Answer

The remote server address as seen from the inside host

Answer

The MAC address of the outside interface

Question 8

A packet is larger than the outgoing interface MTU and the DF bit is set in the IPv4 header. What should the router do?

Accepted Answer

Drop the packet and send an ICMP message indicating fragmentation was needed.. If fragmentation is required but DF is set, the router drops the packet and returns an ICMP unreachable message indicating fragmentation was needed.

Answer

Fragment the packet anyway and forward all fragments.

Answer

Clear the DF bit and then fragment the packet.

Answer

Encapsulate the packet in GRE automatically.

Question 9

Why might a controller return interface information as a JSON array instead of a single JSON object?

Accepted Answer

Because an array is the appropriate structure for an ordered list of multiple interface entries.. A controller might return interface information as a JSON array because there are multiple interface records to present as a list. In practical terms, an array is the correct structure when the response includes several similar items, such as multiple interfaces, routes, or VLANs. Each element in the array can then be its own object with fields like name, status, or IP address.

This is a data-structure recognition question. It is not about networking behavior directly, but about understanding how automation systems represent repeated information.

Answer

Because a JSON object cannot contain fields.

Answer

Because arrays are used only for IPv6 interfaces.

Answer

Because arrays eliminate the need for API authentication.

Question 10

A network engineer wants a static route to be used only when the OSPF-learned route disappears. Which configuration approach meets that goal?

Accepted Answer

Use a static route with administrative distance higher than 110. That is a floating static route. You configure the static route with an administrative distance higher than the OSPF route so it stays in reserve until the dynamic path is lost.

Answer

Use a static route with administrative distance 1

Answer

Use a static route with metric 0

Answer

Redistribute the static route into OSPF

Question 11

A subnet uses network address 192.168.200.96/28. Which range contains the usable host addresses?

Accepted Answer

192.168.200.97 to 192.168.200.110. A /28 block contains 16 addresses. In practical terms, the block starting at 192.168.200.96 runs through 192.168.200.111. The first address is the network address and the last address is the broadcast address. That means the usable host range is 192.168.200.97 through 192.168.200.110.

This question checks whether you can calculate the correct block and then exclude the two reserved boundary addresses.

Answer

192.168.200.96 to 192.168.200.111

Answer

192.168.200.98 to 192.168.200.111

Answer

192.168.200.81 to 192.168.200.94

Question 12

Match each STP or switch protection feature to the problem it is mainly designed to prevent.

Accepted Answer

Root Guard: Prevents a switch from becoming root bridge due to rogue BPDUs. STP protection features prevent specific problems: Root Guard protects root bridge election, BPDU Guard prevents loops on access ports, Loop Guard handles BPDU loss, UDLD detects unidirectional links, and PortFast speeds up port transition.

Question 13

Drag and drop the following steps into the correct order to configure NTP with authentication on a Cisco router.

Accepted Answer

Define an NTP authentication key using the ntp authentication-key command.. First, define the NTP authentication key using the ntp authentication-key command to create the key that will be used. Second, enable NTP authentication globally with ntp authenticate so that the router requires keys for NTP associations. Third, specify which keys are trusted with ntp trusted-key so the router accepts those keys. Fourth, associate the NTP server with the key using the ntp server command with the key option, linking the server to the trusted key. Finally, verify the authenticated association using show ntp associations to confirm the configuration is working. This order is required because the key must exist before it can be trusted, authentication must be enabled before keys are checked, and the server must be configured with the key only after it is trusted.

Question 14

Which TWO statements accurately describe the responsibilities of the OSI model's Transport layer?

Accepted Answer

It segments data from the upper layers and manages end-to-end flow control.. The Transport layer (Layer 4) segments data from upper layers and manages end-to-end flow control using mechanisms like TCP's sliding window to prevent overwhelming a slow receiver. Option D is correct because the Transport layer provides either reliable delivery (TCP) or unreliable delivery (UDP) between applications on different hosts, ensuring data reaches the appropriate application via port numbers. Option A is incorrect because logical addressing and routing are functions of the Network layer (Layer 3). Option C is incorrect because converting data into electrical signals is the responsibility of the Physical layer (Layer 1). Option E is incorrect because encapsulating data into frames with MAC addresses is a function of the Data Link layer (Layer 2).

Answer

It provides logical addressing and routing to determine the best path for data.

Answer

It converts data into electrical signals for transmission over the physical medium.

Answer

It encapsulates data into frames and adds source and destination MAC addresses.

Question 15

You are connected to R1. Configure IPv4 and IPv6 addressing on R1's interfaces so that R1 can reach R2's loopback0 (192.0.2.1/32) and R2's IPv6 loopback0 (2001:db8:1::1/64). R1 has a misconfigured subnet mask on G0/0 and is missing its default gateway. Additionally, R1 has a duplicate IPv4 address on G0/1 that must be corrected. Use EUI-64 for R1's IPv6 link-local address on G0/0 and static IPv6 for the global unicast address on G0/1.

Accepted Answer

Change G0/0 mask to /30, add default route via 10.0.0.2, change G0/1 IP to 192.0.2.2/30, enable IPv6 on G0/0 with EUI-64 link-local, assign 2001:db8:2::1/64 to G0/1. Ly fixes the subnet mask on G0/0 to /30, adds the default gateway via 10.0.0.2, resolves the duplicate IP on G0/1 by assigning 192.0.2.2/30, and sets up IPv6 addressing as required (EUI-64 on G0/0 and static 2001:db8:2::1/64 on G0/1). However, for full IPv6 reachability to R2's loopback0 (2001:db8:1::1/64), R1 also needs an IPv6 route (e.g., a static route to 2001:db8:1::/64 via R2's link-local or global address on G0/1). Without this, Option A only ensures IPv4 connectivity but not IPv6. Among the given options, A is the best because it addresses all IPv4 issues and the IPv6 addressing requirements, though it is incomplete for IPv6 routing.

Answer

Change G0/0 mask to /24, add default route via 10.0.0.1, change G0/1 IP to 10.0.0.6/30, enable IPv6 on G0/0 with EUI-64 link-local, assign 2001:db8:1::1/64 to G0/1

Answer

Change G0/0 mask to /30, add default route via 10.0.0.1, change G0/1 IP to 192.0.2.2/30, enable IPv6 on G0/0 with EUI-64 link-local, assign 2001:db8:2::1/64 to G0/1

Answer

Change G0/0 mask to /30, add default route via 10.0.0.2, change G0/1 IP to 10.0.0.6/30, enable IPv6 on G0/0 with EUI-64 link-local, assign 2001:db8:2::1/64 to G0/1

Question 16

Given the JSON snippet below, what is the value of hostname?

{
  "device": {
    "hostname": "R1",
    "mgmt_ip": "192.0.2.10"
  }
}

Accepted Answer

R1. The key hostname inside the device object has the value R1.

Answer

device

Answer

hostname

Answer

192.0.2.10

Question 17

A network engineer configures an EtherChannel between two switches. Switch A's interface is set with channel-group 1 mode active, while Switch B's identical interface is set with channel-group 1 mode auto. When verifying with show etherchannel summary, the engineer observes that the port-channel interface is down and the physical interfaces are not bundled. What is the most likely cause of the problem?

Accepted Answer

The mode 'auto' is a PAgP negotiation mode that is incompatible with the LACP active mode.. 'active' is an LACP mode that initiates negotiations, while 'auto' is a PAgP mode that passively waits for PAgP packets. Since LACP and PAgP are incompatible protocols, the interfaces will never negotiate a bundle, leaving the port-channel down. The engineer must use matching protocol modes (e.g., both LACP active/passive or both PAgP desirable/auto) for EtherChannel to form.

Answer

The LACP system priority on the active side must be lower than the auto side.

Answer

LACP requires one side to be active and the other passive; two active interfaces will not bundle.

Answer

The physical interfaces must be shut down and then re-enabled after configuring LACP for the bundle to form.

Question 18

A network automation script sends this HTTP request to a controller API:

POST /api/v1/devices

What does the POST method typically indicate in a RESTful API?

Accepted Answer

It creates a new resource or submits data to be processed. POST usually means the client is submitting information to create a new resource or asking the server to process the provided payload. In a controller-based networking context, that often means onboarding a device, creating an object, or starting a workflow. This question is testing method recognition rather than deep programming skill. GET is commonly used for retrieval, DELETE for removal, and PUT for full replacement or update behavior that is typically idempotent. POST is different because repeating the same POST can create multiple objects or trigger repeated actions, depending on the API design. For CCNA purposes, the plain-English takeaway is simple: POST is generally associated with create-or-submit behavior, not read-only retrieval.

Answer

It retrieves an existing resource without changing it

Answer

It deletes the targeted resource permanently

Answer

It replaces the entire existing resource in an idempotent way

Question 19

Drag and drop the following steps into the correct order to configure Rapid PVST+ on SW1, make it the root bridge, and enable PortFast with BPDU Guard on all access ports.

Accepted Answer

Enter global configuration mode on SW1 using the command configure terminal.. The correct order begins by entering global configuration mode, then enabling Rapid PVST+ so that subsequent spanning-tree commands operate under that mode. Next, the switch is designated as the root bridge for VLAN 1 using 'spanning-tree vlan 1 root primary', which sets a superior bridge priority. After the root election is influenced, PortFast is applied to all access interfaces to transition them directly into forwarding state. Finally, BPDU Guard is enabled globally to protect all PortFast-enabled ports; if a BPDU is received on such a port, it is immediately put into err-disabled state, preventing potential loops. Each step builds on the previous one: enabling Rapid PVST+ must precede root setup, root selection should be completed before any access-port optimization, and BPDU Guard is applied last to secure the already-accelerated ports.

Question 20

A host sends an IPv4 packet larger than the outgoing interface MTU, and the DF bit is not set. What will a router normally do?

Accepted Answer

Fragment the packet before forwarding. If fragmentation is allowed, an IPv4 router can fragment a packet to fit the outgoing interface MTU. If DF were set, the router would instead drop the packet and typically send an ICMP message back to the source.

Answer

Drop the packet without notification

Answer

Convert the packet into UDP

Answer

Forward it unchanged and let the switch fragment it