CCNA Mock Exam 73 — 25 Questions

Question 1

Exhibit: A switch interface connected to an IP phone and PC is configured as an access port in VLAN 10. The PC works, but the phone does not register. What additional configuration is most likely needed?

Accepted Answer

switchport voice vlan <voice-vlan-id>. An IP phone commonly requires a voice VLAN so tagged voice traffic is separated from the data VLAN used by the attached PC. Without a voice VLAN, the PC can still work on the access VLAN while the phone fails to register properly.

Answer

switchport trunk encapsulation dot1q

Answer

channel-group 1 mode active

Answer

ip helper-address on the switchport

Question 2

A subnet uses the prefix /29. How many usable host addresses are available in each subnet?

Accepted Answer

6. A /29 prefix leaves 3 host bits, which creates 8 total addresses per subnet. In plain language, two of those addresses cannot be assigned to hosts because one identifies the subnet itself and one is reserved as the broadcast address. That leaves 6 usable host addresses. This is a standard CCNA calculation because it checks whether you understand both the total address count and the subtraction of the reserved addresses.

Many candidates remember powers of two but forget to account for the network and broadcast addresses when the question asks for usable hosts. The safest process is to calculate the total size first and then reduce it by two. That is how you arrive at 6 usable addresses for a /29.

Answer

2

Answer

14

Answer

30

Question 3

A branch office uses PAT overload on the edge router. Inside users can reach the internet, but return traffic for a newly deployed server must be mapped to a specific inside host. Which two statements are correct?

Accepted Answer

A static NAT entry can provide a consistent public-to-private mapping for the server. PAT overload is great for many inside clients sharing a public IP for outbound sessions. A public-facing server that needs predictable inbound reachability typically requires static NAT or static PAT.

Answer

Dynamic NAT always supports inbound access without additional configuration

Answer

NAT is unrelated to whether private addresses can reach the public internet

Question 4

A network engineer is troubleshooting intermittent connectivity on an access switch port connected to a server. The output of 'show interfaces gigabitEthernet 1/0/24' shows an increasing number of runts and giants, but no CRC errors. The 'show interfaces status' command indicates the port is in 'err-disabled' state every few hours and must be manually re-enabled. What is the most likely cause of this issue?

Accepted Answer

Faulty cable or connector causing physical layer errors. Runts and giants without CRC errors indicate a physical-layer issue that corrupts the frame preamble or interframe gap but not the actual data payload. A faulty cable or connector can cause signal degradation leading to these framing errors. The intermittent err-disabled state is typically triggered by link-flap (repeated link up/down events) caused by the unstable physical connection, not directly by alignment or frame-check error counters.

Answer

Duplex mismatch between the switch port and the server NIC

Answer

Incorrect VLAN configuration on the switch port

Answer

Speed mismatch between the switch port and the server NIC

Question 5

A host is physically connected to switch port Gi0/3. The technician runs 'show mac address-table' but does not find the host's MAC address for Gi0/3. The port status shows 'up/up', and the host was connected only a few minutes ago. What should the technician do next?

Accepted Answer

Verify the VLAN assignment on Gi0/3 using 'show vlan brief' or 'show interfaces Gi0/3 switchport'.. The most likely reason a newly connected host's MAC address does not appear in the MAC address table is that the switch port is in the wrong VLAN or is administratively configured as an access port in a VLAN that does not match the host's expected VLAN. The 'show vlan brief' command verifies VLAN existence and port membership, while 'show interfaces Gi0/3 switchport' confirms the operational VLAN assignment. Since the port is up/up and the host was connected only minutes ago, the switch should have learned the MAC address via normal flooding; its absence points to a VLAN mismatch or port configuration issue, not a stale table or STP blocking.

Answer

Clear the MAC address table with 'clear mac address-table dynamic' to force immediate relearning.

Answer

Check the STP state of Gi0/3 with 'show spanning-tree interface Gi0/3' to ensure it is not blocking.

Answer

Inspect the ARP cache with 'show ip arp' to check for duplicate IP addresses.

Question 6

A small office network uses a single public IP address on its router's WAN interface. The network administrator needs to allow all internal hosts to access the internet, but must also ensure that an internal web server with a private IP address is reachable from the internet. Which NAT configuration should the administrator implement to meet both requirements?

Accepted Answer

Configure PAT (overload) for internal hosts and static NAT for the web server.. PAT (Port Address Translation), also known as NAT overload, allows multiple internal hosts to share a single public IP address by mapping each session to a unique port number, satisfying the requirement for internet access. Static NAT is then used to create a one-to-one mapping from the public IP (on a specific port) to the private IP of the internal web server, making it reachable from the internet. This combination meets both outbound connectivity for all hosts and inbound access to the web server without needing additional public IPs.

Answer

Configure dynamic NAT with a pool of public IPs and static NAT for the web server.

Answer

Configure only PAT (overload) for all internal hosts including the web server.

Answer

Configure static NAT for the web server and use only the public IP for internal hosts.

Question 7

You are connected to R1 via the console. R1 is an NTP client that should synchronize its clock with NTP server 192.168.1.100. The timezone is UTC-5 (Eastern Standard Time). Configure NTP on R1 so that it becomes an NTP client. Additionally, configure the router to log NTP synchronization status messages to the console and buffer logging using the numeric severity level 6 (informational).

Accepted Answer

ntp server 192.168.1.100
logging console 6
logging buffered 6. The correct configuration uses 'ntp server 192.168.1.100' to set the NTP server, and 'logging console 6' and 'logging buffered 6' to set both console and buffer logging to severity level 6 (informational). The numeric level 6 is equivalent to 'informational', but the question specifies using the numeric severity level 6.

Answer

ntp server 192.168.1.100
logging console informational
logging buffered informational

Answer

ntp peer 192.168.1.100
logging console 6
logging buffered 6

Answer

ntp server 192.168.1.100
logging console informational
logging buffered 6

Question 8

A host with address 192.168.1.130/26 needs to identify its local subnet. Which subnet does it belong to?

Accepted Answer

192.168.1.128/26. A /26 creates subnets in blocks of 64 addresses each. In plain language, that means the fourth octet ranges are 0–63, 64–127, 128–191, and 192–255. Since 192.168.1.130 falls within the 128–191 block, the host belongs to the 192.168.1.128/26 subnet. That is the local network boundary the host will use to decide what is on-link and what requires the default gateway.

This kind of question is a very common CCNA subnetting task. The main challenge is not the arithmetic itself but recognizing the block size and locating the destination inside the correct range. Once you know a /26 moves in increments of 64, the right subnet becomes much easier to see.

Answer

192.168.1.0/26

Answer

192.168.1.64/26

Answer

192.168.1.192/26

Question 9

Which data format uses key-value pairs and is commonly returned by REST APIs?

Accepted Answer

JSON. JSON is a lightweight, human-readable data format that uses key-value pairs and is the most common format returned by REST APIs. YANG is a data modeling language used for configuration and state data, not a data format. Syslog is a logging protocol used for system messages. CDP (Cisco Discovery Protocol) is a Layer 2 discovery protocol for Cisco devices. None of these are key-value pair data formats typically returned by REST APIs.

Answer

YANG

Answer

Syslog

Answer

CDP

Question 10

Refer to the exhibit. A network engineer is troubleshooting connectivity to server 10.10.10.130. The routing table contains both a static route and an OSPF route for overlapping prefixes. The engineer examines the specific routing entry for 10.10.10.130. Based on the output, why does the router choose the route via 10.1.1.2 instead of the OSPF route via 10.2.2.2 (for 10.10.10.0/24)?

Accepted Answer

The static route has a longer prefix length (/26) than the OSPF route (/24), making it a more specific match.. The router selects the route via 10.1.1.2 because the static route has a prefix length of /26, which is longer (more specific) than the OSPF route's /24. When multiple routes to the same destination exist, the router uses the most specific match (longest prefix) regardless of administrative distance or metric. Since 10.10.10.130 falls within the 10.10.10.128/26 range, the /26 route is preferred over the /24 route.

Answer

The static route has a lower administrative distance (1) than the OSPF route (110).

Answer

The OSPF route is inactive because its next-hop 10.2.2.2 is down.

Answer

The router prefers the static route because it has a metric of 0, which is better than the OSPF metric.

Question 11

A network engineer must summarize the following routes before advertising them upstream:

172.16.32.0/24
172.16.33.0/24
172.16.34.0/24
172.16.35.0/24

Which summary route should be used?

Accepted Answer

172.16.32.0/22. The correct summary is 172.16.32.0/22 because a /22 covers exactly four consecutive /24 networks when the starting boundary is aligned correctly. This is the part many people miss: summarization is not only about how many networks fit into a block, but also where that block starts. Here the four /24 networks begin neatly at 172.16.32.0 and continue through 172.16.35.255, which is the exact range a /22 covers. A /23 would be too small, while a /21 would be unnecessarily broad and could advertise addresses you do not intend to include. The /22 beginning at 172.16.34.0 is not on a valid /22 boundary, so that option is misaligned.

Answer

172.16.32.0/23

Answer

172.16.32.0/21

Answer

172.16.34.0/22

Question 12

An administrator configures an EtherChannel between SW1 and SW2. The port-channel interfaces are physically up, but the EtherChannel bundle fails to come up. On SW1, the channel-group is set to mode active; on SW2, it is set to mode on. What is the most likely cause?

Accepted Answer

One side is using LACP active while the other side is set to on. EtherChannel requires compatible modes: LACP active mode sends negotiation packets, while 'on' mode disables all negotiation, so the two sides cannot agree and the bundle stays down. Option A is wrong because switch priority values are used in STP root election, not EtherChannel formation. Option C is wrong because the native VLAN does not need to be VLAN 1; it only needs to match on both ends. Option D is wrong because all member interfaces in an EtherChannel must be in the same VLAN, not different ones.

Answer

The switch priority values are mismatched

Answer

The native VLAN must be VLAN 1 for EtherChannel to form

Answer

Gi1/0/2 cannot be bundled because interfaces must be in different VLANs

Question 13

Refer to the exhibit. A network administrator is troubleshooting an NTP synchronization issue on R1. The router is configured with the command ntp server 10.1.1.100, but the clock remains unsynchronized. The administrator issues the show ntp status command. What is the most likely cause of the problem?

Accepted Answer

The router cannot reach the NTP server 10.1.1.100 at UDP port 123 due to a routing issue or an access list.. The `show ntp status` output would show the clock as unsynchronized if R1 cannot communicate with the NTP server at 10.1.1.100. NTP uses UDP port 123, and a routing issue or an access list blocking this port would prevent the exchange of NTP packets, leaving the clock unsynchronized. The `ntp server` command configures R1 as a client to request synchronization, but it does not guarantee reachability.

Answer

The NTP authentication key configured on R1 does not match the one on the server.

Answer

The system time on R1 is set to an epoch that is too far from the server's time, causing NTP to refuse to synchronize.

Answer

The NTP service is not enabled on R1; the 'ntp server' command only defines a server but does not start the NTP process.

Question 14

Refer to the exhibit. A network engineer is troubleshooting a missing route on R1. The router R3 is configured to advertise network 192.168.30.0/24 via OSPF, but the route is not present in the OSPF routing table of R1 when issuing the show ip route ospf command. What is the most likely cause?

Accepted Answer

R3 has passive-interface default configured and has not issued the no passive-interface command on the interface facing the OSPF neighbor.. R3 has passive-interface default configured, which makes all interfaces passive by default, preventing OSPF hello packets from being sent. Without the no passive-interface command on the interface facing R1, R3 cannot form an OSPF adjacency, so R1 never learns the 192.168.30.0/24 route. This is a common misconfiguration when using passive-interface default to suppress OSPF on non-neighbor interfaces.

Answer

R3 has not enabled OSPF on the network 192.168.30.0/24 using the network command.

Answer

R1 has an inbound ACL applied to GigabitEthernet0/1 that blocks OSPF multicast traffic to 224.0.0.5 and 224.0.0.6.

Answer

R3's OSPF router ID is duplicated with another OSPF router, causing the SPF algorithm to drop routes.

Question 15

Refer to the exhibit. Users on the inside network can browse the web, but return traffic is failing for some sessions. A partial configuration shows:

interface GigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/1
 ip address 203.0.113.10 255.255.255.0
 ip nat inside
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.10.0 0.0.0.255

Based on this configuration, which change is required to make PAT work correctly?

Accepted Answer

Swap the inside and outside NAT roles on the two interfaces.. The problem is that the router has the NAT directions backwards. In simple terms, the interface facing the private LAN should be marked as inside, and the interface facing the public or WAN side should be marked as outside. Here, GigabitEthernet0/0 uses the private address 192.168.10.1, but it is configured as outside. GigabitEthernet0/1 uses the public address 203.0.113.10, but it is configured as inside. That reverses the translation logic and breaks normal PAT behavior.

Technically, the command `ip nat inside source list 1 interface GigabitEthernet0/1 overload` is otherwise reasonable for dynamic PAT using the WAN interface address. The ACL also correctly identifies the inside local subnet. The essential fix is to mark G0/0 as `ip nat inside` and G0/1 as `ip nat outside`. Once the directions are corrected, PAT can create and track translations properly for outbound traffic and returning sessions.

Answer

Apply ip nat enable on both interfaces.

Answer

Replace overload with pool.

Answer

Change access-list 1 to a standard ACL numbered 100.

Question 16

Which two statements accurately describe why source restriction and logging are often used together for administrative access?

Accepted Answer

Source restriction narrows the allowed origin space for administrative sessions.. Source restriction and logging are often used together because they help answer two different security questions. In practical terms, source restriction limits where administrative sessions may originate, while logging helps show what happened once access was attempted or granted. This combination improves both exposure reduction and post-event visibility.

This is a strong layered-security reasoning item because it focuses on complementary controls rather than one-control thinking.

Answer

Logging removes the need for authentication.

Answer

Source restriction works only when Syslog is disabled.

Answer

Both controls exist only for guest wireless networks.

Question 17

A network engineer notices that R1 is using the static route to 192.168.10.0/24 via next-hop 10.1.1.2 instead of the OSPF route via 10.2.2.2, even though the OSPF path has lower latency. What is the most likely cause?

Accepted Answer

The static route has a lower administrative distance than the OSPF route.. R1 prefers the static route over the OSPF route because static routes have a default administrative distance (AD) of 1, whereas OSPF has a default AD of 110. Since a lower AD indicates a more trustworthy route, the static route is installed in the routing table regardless of metric or latency. The OSPF route, despite having lower latency, is not used because AD is evaluated before metric.

Answer

The OSPF route has a higher metric than the static route.

Answer

Equal-cost multi-path (ECMP) is disabled for OSPF.

Answer

The static route is configured with a higher next-hop IP address, so it is preferred.

Question 18

Why might an automation script prefer a token-based API session over repeatedly prompting a human operator for credentials?

Accepted Answer

Because tokens support controlled repeated API access in a way that is practical for automation workflows.. Token-based API sessions allow scripts to make repeated, programmatic requests without requiring a human to re-enter credentials each time. This makes them more practical for automation workflows than constant interactive prompts. Options B, C, and D are incorrect: tokens do not eliminate the need for security controls (they still require proper management like expiration and revocation); they have nothing to do with VLAN creation; and they do not replace routing protocols—tokens are strictly used for authentication and authorization in API interactions.

Answer

Because tokens eliminate the need for any security controls.

Answer

Because tokens automatically create VLANs on the switch.

Answer

Because tokens replace all routing protocols.

Question 19

Which TWO statements about floating static routes and default routes are correct?

Accepted Answer

A floating static route uses an administrative distance higher than that of the primary route to act as a backup.. A floating static route is configured with a higher administrative distance (AD) than the primary route. This ensures the floating route remains inactive in the routing table unless the primary route fails, at which point the router installs the floating static route as a backup. The higher AD makes it less preferred than the primary dynamic or static route.

Answer

A floating static route must have a lower administrative distance than the primary route to ensure faster convergence.

Answer

Floating static routes are supported only for IPv6, not for IPv4.

Answer

A default static route cannot be configured as a floating static route.

Question 20

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to a PC on port G0/1. The network administrator wants to secure the port by allowing only two MAC addresses and enabling sticky MAC learning. Additionally, if a violation occurs, the port should be put into error-disabled state. Configure port security on G0/1 with maximum MAC addresses of 2, sticky learning, and shutdown violation mode.

Accepted Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation shutdown. The correct configuration enables port security, sets the maximum MAC addresses to 2, enables sticky learning, and sets the violation mode to shutdown. This meets all requirements: limiting MAC addresses, sticky learning, and error-disabling the port on violation.

Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation restrict

Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation protect

Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address 0000.1111.2222
SW1(config-if)# switchport port-security violation shutdown