CCNA Mock Exam 71 — 25 Questions

Question 1

You are verifying OSPF operation on router R1. After confirming that OSPF is configured on the correct interfaces, which command should you use next to directly check whether R1 has established a neighbor adjacency with another OSPF router?

Accepted Answer

show ip ospf neighbor. The command show ip ospf neighbor directly displays the OSPF neighbor table, showing whether an adjacency has formed, the neighbor's Router ID, and the current state (e.g., FULL). This is the quickest verification step after confirming configurations. The other commands are unrelated to OSPF: show vlan brief displays VLAN assignments, show spanning-tree shows STP topology, and show mac address-table shows the MAC address table. None of these provide any OSPF neighbor information and would only delay troubleshooting.

Answer

show vlan brief

Answer

show spanning-tree

Answer

show mac address-table

Question 2

Exhibit: R1 can ping 10.1.23.2 but cannot ping 192.168.3.10 behind R3. The routing table on R1 lacks 192.168.3.0/24. What is the best next check?

Accepted Answer

Verify whether the remote LAN is being advertised into the routing process. Because the directly connected next router is reachable, the problem is likely missing routing information for the remote LAN. The best next check is whether R3 is advertising 192.168.3.0/24 or whether that network is present in the routing domain at all.

Answer

Replace the Ethernet cable between R1 and R2

Answer

Change the OSPF router ID on R1 immediately

Answer

Disable CEF so the route can be learned

Question 3

Dynamic ARP Inspection is most effective at preventing which attack?

Accepted Answer

ARP spoofing. Dynamic ARP Inspection (DAI) validates ARP packets on a per-interface basis, dropping invalid ARP replies and thus preventing ARP spoofing and poisoning attacks. Option A (SYN flood) is a Layer 4 TCP attack mitigated by TCP flood protection or SYN cookies, not DAI. Option C (route summarization error) is a routing misconfiguration unrelated to ARP security. Option D (rogue DHCP relay) is prevented by DHCP snooping, which works alongside DAI but DAI itself does not block rogue DHCP relays.

Answer

SYN flood

Answer

Route summarization error

Answer

Rogue DHCP relay

Question 4

A technician is troubleshooting a network issue where hosts in VLAN 20 on SW1 cannot communicate with hosts in VLAN 20 on SW2. Both switches are connected by an Ethernet trunk link that is up/up and configured as a trunk. The VLAN databases on both switches include VLAN 20, and the spanning tree for VLAN 20 is in a forwarding state on all ports. Hosts within VLAN 20 on each switch can communicate with each other locally. What is the most likely cause?

Accepted Answer

VLAN 20 is not in the switchport trunk allowed VLAN list on the trunk port between SW1 and SW2.. The most likely cause is that VLAN 20 is not included in the allowed VLAN list on the trunk port between SW1 and SW2. Even though the trunk is up/up and VLAN 20 exists in the VLAN database, the switchport trunk allowed vlan command restricts which VLANs can traverse the trunk. If VLAN 20 is omitted from this list, frames from VLAN 20 will be dropped at the trunk, preventing inter-switch communication for that VLAN.

Answer

The native VLAN is mismatched on the two ends of the trunk.

Answer

VLAN 20 has not been created in the VLAN database on SW2.

Answer

The trunk encapsulation is mismatched between SW1 and SW2.

Question 5

Why is SSH preferred over Telnet for remote device administration?

Accepted Answer

SSH encrypts management traffic, while Telnet sends data in clear text. SSH protects credentials and management traffic by encrypting the session. Telnet does not provide encryption, so usernames, passwords, and commands can be exposed in transit.

Answer

SSH uses less bandwidth because it removes the TCP header

Answer

SSH works only on console ports, which are more secure

Answer

SSH does not require user authentication

Question 6

You are connected to R1 via console. R1 and R2 are connected via a serial link. OSPFv2 has been configured, but the adjacency is stuck in EXSTART state. You suspect a mismatched MTU. On R1, the interface MTU is currently set to 1400, while R2 uses the default MTU of 1500. You need to verify and fix the issue.

Accepted Answer

On R1, configure the interface MTU to 1500 and then clear the OSPF process using 'clear ip ospf process'.. OSPF requires matching MTU values on a link. The incorrect MTU on R1 (1400) caused the adjacency to stall in EXSTART. Setting MTU to 1500 and clearing the OSPF process allows proper adjacency formation.

Answer

On R1, configure the interface MTU to 1500 and then reload the router to apply the change.

Answer

On R1, configure the interface MTU to 1500 and then change the OSPF network type to point-to-point.

Answer

On R1, configure the interface MTU to 1500 and then adjust the OSPF hello and dead timers to match R2.

Question 7

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two links to SW2: G0/1 and G0/2. The administrator wants to combine these two links into an EtherChannel using LACP. Configure an EtherChannel on SW1 for these ports and verify.

Accepted Answer

interface range g0/1-2
channel-group 1 mode active. LACP (IEEE 802.3ad) uses 'active' or 'passive' modes; at least one side must be active for the bundle to form. Configuring both G0/1 and G0/2 under an interface range with 'channel-group 1 mode active' correctly places both physical interfaces into EtherChannel 1 using LACP in active negotiation mode, which is the standard Cisco-recommended configuration for LACP on both ends.

Answer

interface range g0/1-2
channel-group 1 mode desirable

Answer

interface g0/1
channel-group 1 mode active
interface g0/2
channel-group 1 mode passive

Answer

interface port-channel 1
channel-group 1 mode active

Question 8

Which two statements about RESTful APIs are correct? (Choose two.)

Accepted Answer

They commonly use HTTP methods such as GET and POST.. REST commonly uses HTTP verbs and typically exchanges structured data such as JSON.

Answer

They require Layer 2 adjacency between client and server.

Answer

They replace the need for routing protocols on the network.

Question 9

Which two statements accurately describe longest-prefix match?

Accepted Answer

The most specific matching route is preferred over broader matching routes.. Longest-prefix match means the router prefers the most specific route that matches the destination. In plain language, if several routes could all work, the router chooses the one that describes the destination range most precisely. That is why a /25 wins over a /24, and a /24 wins over a /16, when all of them match the same destination.

This is a foundational routing rule. The wrong answers usually confuse route specificity with route-source trust or assume the default route is considered first. The two correct answers are the ones that keep the focus on specificity.

Answer

The default route is always preferred over a matching specific route.

Answer

Administrative distance replaces the need for longest-prefix match.

Answer

A /16 is more specific than a /24.

Question 10

A network engineer is tasked with monitoring a large enterprise network that requires high-frequency, real-time data collection from thousands of routers and switches. The engineer needs a solution that minimizes CPU overhead on the network devices and supports push-based data delivery. Which technology should the engineer choose for this requirement?

Accepted Answer

Streaming telemetry. Streaming telemetry uses a push model (e.g., gRPC or UDP-based dial-out) to continuously send structured data (YANG-modeled, often encoded in GPB or JSON) from network devices to a collector, which eliminates the need for periodic polling. This minimizes CPU overhead because the device only encodes and transmits data when a subscription triggers an update, rather than processing repeated SNMP GET requests. It is designed for high-frequency, real-time data collection at scale, making it ideal for monitoring thousands of routers and switches with minimal performance impact.

Answer

SNMPv2c with frequent polling intervals

Answer

NetFlow

Answer

IPFIX

Question 11

A technician is troubleshooting an issue where internal hosts can successfully ping internet addresses but cannot establish HTTP sessions. The router is configured with PAT (overload) and uses an access list to define the inside local addresses. Recently, the internal network was renumbered from 192.168.0.0/24 to 10.0.0.0/24. What is the most likely cause?

Accepted Answer

The NAT access list still permits 192.168.0.0/24 and does not match the new 10.0.0.0/24 addresses.. The NAT access list (used with 'ip nat inside source list') still references the old 192.168.0.0/24 subnet. After renumbering to 10.0.0.0/24, the access list does not match the new inside local addresses, so PAT (overload) translation is not performed for those hosts. ICMP (ping) can still succeed if the router has a route to the internet and the packets are not translated, but HTTP sessions fail because the return traffic cannot be mapped back to the internal hosts without a NAT translation entry.

Answer

The router's HTTP inspection rule is blocking outbound TCP port 80.

Answer

The outside interface access list is blocking TCP packets from the new 10.0.0.0/24 subnet.

Answer

The default route has been changed to point to the wrong next-hop address, causing only HTTP packets to be dropped.

Question 12

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two VLANs: VLAN 10 (Sales) and VLAN 20 (Engineering). A router R1 is connected to port G0/1 on SW1 for inter-VLAN routing. Currently, the router is not routing between VLANs because the trunk is not configured correctly. Configure the switch port as a trunk and ensure the router can route between VLANs using subinterfaces (Router-on-a-Stick).

Accepted Answer

Configure the switch port as a trunk with 802.1Q encapsulation and allow VLANs 10 and 20.. The switch port was in access mode, which only carries one VLAN. Changing it to trunk with 802.1Q encapsulation allows multiple VLANs to traverse to the router. The allowed VLAN list restricts to VLANs 10 and 20 for security.

Answer

Configure the switch port as an access port in VLAN 10 and add VLAN 20 as a secondary VLAN.

Answer

Configure the switch port as a trunk with ISL encapsulation and allow all VLANs.

Answer

Configure the switch port as a trunk with 802.1Q encapsulation and allow VLANs 1, 10, and 20.

Question 13

A routing table entry begins with the code C. What does that code indicate?

Accepted Answer

A connected network. In Cisco routing table output, C indicates a directly connected network. These routes are installed when an interface is up and has an address in that subnet.

Answer

A route learned through EIGRP

Answer

A candidate default route

Answer

A static route to a classful network

Question 14

Which feature helps prevent a rogue DHCP server from handing out addresses on a campus switch network?

Accepted Answer

DHCP snooping. DHCP snooping classifies interfaces as trusted or untrusted and can block unauthorized DHCP server replies arriving on untrusted ports.

Answer

PortFast

Answer

HSRP

Answer

LLDP

Question 15

Match each wireless term to its most accurate meaning.

Accepted Answer

SSID: The human-readable network name that identifies a wireless network.. SSID is the human-readable network name. BSSID is the unique MAC address of an AP radio. ESSID is the same SSID used across multiple APs in an extended network. Beacons are management frames that advertise the network. Probe requests are sent by clients to find APs. Association is the process of connecting a client to an AP.

Answer

SSID: The unique MAC address assigned to each access point radio.

Answer

SSID: A management frame sent by access points to advertise the network.

Answer

SSID: The process by which a client connects to an access point.

Question 16

A switch interface connected to another switch must carry VLANs 10, 20, and 30 only. Which command best enforces that requirement on the trunk?

Accepted Answer

switchport trunk allowed vlan 10,20,30. The correct command is the one that explicitly sets the allowed VLAN list on the trunk. In plain language, the administrator wants the inter-switch link to carry only the named VLANs instead of every VLAN by default. Cisco trunks can transport multiple VLANs, but that does not mean every VLAN should always be permitted. Restricting the allowed list supports cleaner design and helps reduce unnecessary VLAN transport.

This is a common CCNA switching task because it distinguishes between creating a trunk and controlling what the trunk actually carries. Simply enabling trunking is not enough when the requirement names exact VLANs. The answer must directly restrict the allowed list rather than change the native VLAN or apply an unrelated access-port command.

Answer

switchport access vlan 10,20,30

Answer

switchport mode dynamic auto

Answer

switchport trunk native vlan 10,20,30

Question 17

Drag and drop the following commands into the correct order to configure OSPFv3 for IPv6 on a Cisco router.

Accepted Answer

ipv6 unicast-routing. Commands must be executed in order: global config, IPv6 routing, interface config, OSPFv3 on interface, then verification.

Question 18

You are connected to SW1, a Layer 2 switch. Port G0/1 connects to a PC in VLAN 10. Management requires that only one MAC address is allowed on this port, and if a violation occurs, the port should shut down and a log message should be generated. Additionally, you need to ensure that the port enables rapidly and does not wait for STP convergence. Currently, the PC has MAC address aaaa.bbbb.cccc.

Accepted Answer

switchport port-security; switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation shutdown; spanning-tree portfast. It includes the mandatory 'switchport port-security' command that globally enables port security on the interface before any other port-security parameters can take effect. It sets the maximum MAC count to 1, statically binds the PC's MAC (aaaa.bbbb.cccc), configures the violation mode to shutdown (which err-disables the port and generates a syslog/SNMP log), and enables PortFast so the port transitions to forwarding immediately without waiting for STP convergence.

Answer

switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation restrict; spanning-tree portfast

Answer

switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation protect; spanning-tree portfast

Answer

switchport port-security maximum 1; switchport port-security mac-address aaaa.bbbb.cccc; switchport port-security violation shutdown; no spanning-tree portfast

Question 19

A router has an OSPF-learned route to a destination prefix and also a directly connected route to a broader supernet that includes that destination. The OSPF route is more specific. Which route is used for the destination?

Accepted Answer

The more specific OSPF route. The more specific OSPF route is used. In practical terms, route specificity is checked before broader route-source considerations when the prefixes are different. Even though the connected route is a directly attached source and often strongly trusted, it still loses if it is less specific than another matching route.

This is a subtle route-selection question because it combines source type and specificity. The key is that longest-prefix match comes first.

Answer

The directly connected broader route

Answer

Both routes equally

Answer

Neither route can be used because the sources differ

Question 20

Drag and drop the following steps into the correct order to sequence the DNS resolution process from a client query to receiving an A-record response, followed by the nslookup and dig diagnostic workflow for troubleshooting missing or wrong DNS records.

Accepted Answer

Client sends DNS query to local resolver; server responds with A-record; client uses IP address; then nslookup for basic query; then dig for detailed diagnostics.. The DNS resolution process starts with the client query, server response, and client use. Troubleshooting follows with nslookup for basic queries and dig for detailed diagnostics.

Answer

Client sends DNS query to local resolver; server responds with A-record; client uses IP address; then dig for detailed diagnostics; then nslookup for basic query.

Answer

Client sends DNS query to local resolver; client uses IP address; server responds with A-record; then nslookup for basic query; then dig for detailed diagnostics.

Answer

Client sends DNS query to local resolver; server responds with A-record; then nslookup for basic query; then dig for detailed diagnostics; then client uses IP address.