CCNA Mock Exam 71 — 25 Questions

Question 1

You are connected to R1 via the console. R1 is an NTP client that should synchronize its clock with NTP server 192.168.1.100. The timezone is UTC-5 (Eastern Standard Time). Configure NTP on R1 so that it becomes an NTP client. Additionally, configure the router to log NTP synchronization status messages to the console and buffer logging using the numeric severity level 6 (informational).

Accepted Answer

ntp server 192.168.1.100
logging console 6
logging buffered 6. The correct NTP client command is 'ntp server 192.168.1.100', not 'ntp peer'. The logging commands must use the numeric level 6 to match the requirement. 'logging console 6' and 'logging buffered 6' achieve this; keyword 'informational' is technically valid but does not follow the explicit numeric specification. Mixing numeric and keyword is also incorrect under the given requirement.

Answer

ntp server 192.168.1.100
logging console informational
logging buffered informational

Answer

ntp peer 192.168.1.100
logging console 6
logging buffered 6

Answer

ntp server 192.168.1.100
logging console informational
logging buffered 6

Question 2

Drag and drop the following steps into the correct order to configure a secure Cisco switch, from enabling secure management access to implementing advanced dynamic ARP inspection.

Accepted Answer

Configure the switch hostname and IP domain name.. 1. Hostname and IP domain name: required to generate RSA keys for SSH in the next step. 2. RSA key generation: SSH cannot function without cryptographic keys. 3. SSH v2 enabled and Telnet disabled: ensures secure remote access before any authentication method is applied. 4. AAA authentication with RADIUS/TACACS+ on vty lines: controls who can access the switch after SSH transport is established. 5. Port security on access ports: protects the data plane by restricting MAC addresses once management plane is secured. 6. DHCP snooping: builds a binding database used to validate traffic; must be active before DAI can work. 7. Dynamic ARP Inspection: relies on the DHCP snooping database to filter ARP packets and prevent man-in-the-middle attacks, so it must be configured last.

Question 3

A network technician has configured static NAT with the command ip nat inside source static 192.168.1.10 203.0.113.10. The web server at 192.168.1.10 is accessible from the internet on TCP port 80 but not on TCP port 443. The ACL applied to the outside interface permits all IP traffic. What is the most appropriate next step to troubleshoot this issue?

Accepted Answer

Check if the web server is running HTTPS service on port 443.. The symptom (port 80 works, port 443 fails) with a static NAT that maps the entire IP address (not just specific ports) indicates the issue is likely at the server itself, not the NAT configuration. Static NAT translates all traffic for the inside local IP to the inside global IP, so if one TCP port works and another does not, the NAT is functioning correctly. The most appropriate next step is to verify that the web server is actually listening on TCP port 443 (HTTPS), as the server may not have the HTTPS service running or configured.

Answer

Verify that the ACL applied to the outside interface explicitly permits TCP port 443.

Answer

Examine the NAT translation table for any conflicting dynamic entries.

Answer

Confirm the inside global IP address mapped to the server is correct.

Question 4

Which THREE statements correctly describe the behavior of LACP modes in an EtherChannel configuration?

Accepted Answer

Passive mode will only respond to LACP packets and will not initiate negotiation.. B is correct because passive mode interfaces only respond to LACP packets and never initiate negotiation. C is correct because two passive interfaces will both wait for the other to initiate, so no LACP packets are sent and the EtherChannel never forms. D is correct because active mode interfaces actively send LACP packets to initiate negotiation with either an active or passive peer. A is incorrect: active mode sends LACP packets regardless of the peer’s mode; it can form a channel with passive just as well as with active. E is incorrect because PAgP supports only desirable and auto modes, not LACP’s active/passive modes; PAgP and LACP are separate protocols.

Answer

Active mode will not send LACP packets unless the peer is also in active mode.

Answer

Both active and passive modes are supported in PAgP.

Question 5

Which TWO statements correctly describe characteristics of SNMPv2c and SNMPv3 for network monitoring?

Accepted Answer

SNMPv3 supports authentication and encryption for secure network monitoring.. SNMPv3 is correct because it introduces authentication (MD5/SHA) and encryption (DES/AES) for secure monitoring. SNMPv2c is correct because it uses community strings transmitted in cleartext, lacking security. Option C is wrong: SNMPv3 is more secure than v2c, not the same. Option D is wrong: SNMPv2c supports traps in addition to GET and SET. Option E is wrong: SNMPv3 uses usernames and security models, not community strings.

Answer

SNMPv3 provides the same security level as SNMPv2c but with additional trap support.

Answer

SNMPv2c supports only GET and SET operations, but not traps.

Answer

SNMPv3 uses community strings to authenticate agents and managers.

Question 6

Users complain that log timestamps from several routers do not line up with one another. Which two actions are most appropriate?

Accepted Answer

Configure NTP on the network devices. When timestamps disagree, the first fix is time synchronization. NTP should be configured consistently, and devices should have correct timezone or clock settings so syslog messages can be correlated across the network.

Answer

Increase the syslog severity threshold to debugging

Answer

Disable console logging

Answer

Clear the logging buffer on all devices

Question 7

Which command or tool would a network engineer use to verify if a client has a duplicate IP address conflict on the local subnet?

Accepted Answer

arp -a. The two tools to verify a duplicate IP conflict are arp -a and ping. The arp -a command displays the ARP cache; if a duplicate IP exists, the ARP table may show multiple MAC addresses for the same IP or rapid changes. Ping can be used to send traffic to the local IP address; if a reply is received from a different MAC address than expected, it indicates a conflict. Together, these commands help network engineers confirm IP address duplication. Other commands like ipconfig /all, nslookup, and tracert do not directly reveal such conflicts.

Answer

ipconfig /all

Answer

nslookup

Answer

tracert

Question 8

You are securing the spanning-tree topology on R1, the root bridge for VLAN 10. Intended configurations: Root Guard on GigabitEthernet1/0/3, Loop Guard on gigabit interfaces 1/0/1 and 1/0/2, and BPDU Guard on all PortFast-enabled interfaces. After initial configuration, a superior BPDU on G1/0/3 blocks the port (expected), and a host on G1/0/5 triggers BPDU Guard, causing err-disable (expected). However, you realize Loop Guard was not applied to the uplinks. Troubleshoot and apply the missing configuration.

Accepted Answer

Configure Loop Guard on G1/0/1 and G1/0/2 with 'spanning-tree guard loop' and recover G1/0/5 from err-disable by issuing 'shutdown' followed by 'no shutdown'.. The candidate must first identify that Root Guard is correctly configured on G1/0/3, causing it to block (BKN*ROOT_Guard) upon receiving a superior BPDU, which is correct behavior. However, the task states to protect the root bridge role; since R1 is already root, Root Guard is appropriate. The err-disabled port G1/0/5 indicates BPDU Guard triggered; this is expected because a host connected to a PortFast port sent a BPDU. To resolve, the candidate should re-enable the port with 'no shutdown' and ensure BPDU Guard is properly applied. Additionally, Loop Guard is missing on uplinks G1/0/1 and G1/0/2; it must be configured with 'spanning-tree guard loop' under each interface. No changes to Root Guard are needed; the blockage is intentional.

Answer

Remove Root Guard from G1/0/3 and configure it with 'spanning-tree guard loop' to prevent the blockage.

Answer

Re-enable G1/0/5 with 'no shutdown' and apply 'spanning-tree bpduguard enable' on all PortFast-enabled interfaces to prevent future err-disable.

Answer

Remove BPDU Guard from all PortFast interfaces and configure 'spanning-tree portfast bpdufilter default' to prevent err-disable.

Question 9

Drag and drop the following steps into the correct order to diagnose and resolve a duplex/speed mismatch causing interface errors on a Cisco switch.

Accepted Answer

Enter the 'show interfaces' command to examine interface status and error counters.. The correct diagnostic process begins by collecting interface statistics with 'show interfaces' to detect anomalies (step 1). If CRC errors, runts, and late collisions are present, these indicate a duplex mismatch (step 2). Next, check the current duplex and speed configuration for that interface using 'show interfaces <int>' (step 3). Compare this setting with the expected configuration or with the remote device's interface (step 4) to confirm the mismatch. Based on the findings, apply the correct duplex and speed commands to align both ends (step 5). Finally, verify that the error counters stop incrementing after the fix (step 6).

Question 10

A wireless client can see two SSIDs from the same company: Corp and Guest. Which statement best explains what an SSID represents in this situation?

Accepted Answer

It is the wireless network name presented to clients for a specific WLAN.. An SSID is the name that identifies a specific wireless LAN to clients. In practical terms, Corp and Guest are two different WLAN identifiers presented to users, even if they are broadcast by the same physical access point infrastructure. The SSID tells the client which wireless network it is trying to join.

This matters because people often confuse SSIDs with the access point itself or with the security protocol. The SSID is the network identifier, not the hardware or the encryption standard.

Answer

It is the encryption algorithm securing the WLAN.

Answer

It is the radio antenna inside the AP.

Answer

It is the management IP address of the controller.

Question 11

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two links to SW2: G0/1 and G0/2. The administrator wants to combine these two links into an EtherChannel using LACP. Configure an EtherChannel on SW1 for these ports and verify.

Accepted Answer

interface range g0/1-2
channel-group 1 mode active. It applies the LACP 'active' mode to both interfaces in the range, which will dynamically negotiate an EtherChannel with the peer. Option B uses PAgP 'desirable' mode, which is Cisco proprietary and not LACP, failing the requirement for LACP. Option C mixes LACP modes (active on one interface and passive on the other); both member ports must use the same mode (either active/active or passive/passive) to form a channel. Option D attempts to configure the 'channel-group' command on the port-channel interface itself, but this command must be applied to the physical interfaces, not the logical port-channel.

Answer

interface range g0/1-2
channel-group 1 mode desirable

Answer

interface g0/1
channel-group 1 mode active
interface g0/2
channel-group 1 mode passive

Answer

interface port-channel 1
channel-group 1 mode active

Question 12

A switch port connected to an edge host immediately transitions to forwarding and then later goes err-disabled after a BPDU is received. Which feature combination most likely produced this behavior?

Accepted Answer

PortFast with BPDU Guard. The most likely combination is PortFast with BPDU Guard. In practical terms, PortFast explains why the port moved quickly into forwarding when the host connected. BPDU Guard explains why the same port later shut down after seeing a BPDU that should not normally appear on an edge port.

This is a very common enterprise edge-port design pattern and a classic exam scenario.

Answer

NetFlow with SNMP traps

Answer

OSPF passive-interface with EUI-64

Answer

WPA3 with CAPWAP

Question 13

A client PC is receiving an APIPA address (169.254.x.x) instead of a valid IP from the DHCP server. The DHCP server is on the same subnet as the client. The technician runs the command 'show ip dhcp binding' and confirms that the correct scope is configured. The command 'show ip dhcp pool' shows that there are plenty of addresses remaining in the pool. The client's NIC status shows 'connected'. What should the technician do next?

Accepted Answer

Check for a rogue DHCP server on the network.. The client is receiving an APIPA address (169.254.x.x) despite the DHCP server having available addresses and being on the same subnet. This indicates that the client's DHCP discover broadcast is not reaching the legitimate DHCP server, or the server's offer is not reaching the client. Since the DHCP server is local and the scope is correctly configured, the most likely cause is a rogue DHCP server responding faster than the legitimate server, or a device (like a home router) acting as a DHCP server and handing out APIPA-like addresses or conflicting leases. Option D directly addresses this by suggesting to check for a rogue DHCP server, which can interfere with the DHCP process and cause the client to fail to obtain a valid IP.

Answer

Check the DHCP snooping configuration on the access switch.

Answer

Verify that no firewall is blocking UDP ports 67 and 68 on the local network.

Answer

Run the ipconfig /release and /renew commands on the client.

Question 14

Match each security concept to its most accurate purpose.

Accepted Answer

Confidentiality: Ensures data is accessible only to authorized parties. These pairings correctly define core security concepts (CIA triad plus authentication and authorization).

Question 15

Which two statements accurately describe why least privilege and source restriction work well together for administrative access?

Accepted Answer

Least privilege reduces the scope of actions an authenticated user can perform.. Least privilege and source restriction work well together because they reduce risk in different ways. In practical terms, least privilege limits what a user can do after access is granted, while source restriction reduces where an administrative session is even allowed to originate. Together they reduce both exposure and potential impact.

This is a layered management-security concept and a strong exam-style reasoning item.

Answer

Either one by itself removes the need for logging.

Answer

Both exist only for wireless guest access policies.

Answer

They require all administrative traffic to use PPP encapsulation.

Question 16

Why might voice traffic be placed in a priority queue on a WAN link?

Accepted Answer

To reduce delay and jitter for time-sensitive traffic. Voice traffic is delay-sensitive. Prioritization helps reduce queuing delay and jitter so real-time audio remains intelligible.

Answer

To increase the TTL value of voice packets

Answer

To change RTP into TCP for reliability

Answer

To avoid assigning IP addresses to phones

Question 17

Why does a passive interface in OSPF still matter even though it does not send hello packets?

Accepted Answer

The connected network can still be advertised into OSPF through other active adjacencies. A passive interface still matters because the connected network can still be advertised into OSPF even though the interface itself does not form neighbor relationships. In plain language, the router is saying, “This network is mine, and I want others to know about it, but I do not want to speak OSPF directly on this interface.” That is useful on user-facing or stub-like interfaces where no OSPF neighbor should exist.

This distinction is important because some engineers assume passive means “ignored entirely.” It does not. The connected network can still appear in routing updates sent through real neighbors on other interfaces. What changes is neighbor formation on the passive interface itself.

Answer

The passive interface automatically becomes the OSPF router ID

Answer

The passive interface disables all OSPF operation on the router

Answer

The passive interface converts OSPF into EIGRP on that link

Question 18

Which spanning-tree port role receives the best BPDU toward the root bridge on a nonroot switch?

Accepted Answer

Root port. The root port is the port on a nonroot switch with the lowest path cost to the root bridge.

Answer

Designated port

Answer

Alternate port

Answer

Disabled port

Question 19

You are verifying OSPF operation on router R1. After confirming that OSPF is configured on the correct interfaces, which command should you use next to directly check whether R1 has established a neighbor adjacency with another OSPF router?

Accepted Answer

show ip ospf neighbor. The command show ip ospf neighbor directly displays the OSPF neighbor table, showing whether an adjacency has formed, the neighbor's Router ID, and the current state (e.g., FULL). This is the quickest verification step after confirming configurations. The other commands are unrelated to OSPF: show vlan brief displays VLAN assignments, show spanning-tree shows STP topology, and show mac address-table shows the MAC address table. None of these provide any OSPF neighbor information and would only delay troubleshooting.

Answer

show vlan brief

Answer

show spanning-tree

Answer

show mac address-table

Question 20

Exhibit: R1 can ping 10.1.23.2 but cannot ping 192.168.3.10 behind R3. The routing table on R1 lacks 192.168.3.0/24. What is the best next check?

Accepted Answer

Verify whether the remote LAN is being advertised into the routing process. Because the directly connected next router is reachable, the problem is likely missing routing information for the remote LAN. The best next check is whether R3 is advertising 192.168.3.0/24 or whether that network is present in the routing domain at all.

Answer

Replace the Ethernet cable between R1 and R2

Answer

Change the OSPF router ID on R1 immediately

Answer

Disable CEF so the route can be learned