CCNA Mock Exam 74 — 25 Questions

Question 1

A small office network uses a single public IP address on its router's WAN interface. The network administrator needs to allow all internal hosts to access the internet, but must also ensure that an internal web server with a private IP address is reachable from the internet. Which NAT configuration should the administrator implement to meet both requirements?

Accepted Answer

Configure PAT (overload) for internal hosts and static NAT for the web server.. PAT (Port Address Translation), also known as NAT overload, allows multiple internal hosts to share a single public IP address by mapping each session to a unique port number, satisfying the requirement for internet access. Static NAT is then used to create a one-to-one mapping from the public IP (on a specific port) to the private IP of the internal web server, making it reachable from the internet. This combination meets both outbound connectivity for all hosts and inbound access to the web server without needing additional public IPs.

Answer

Configure dynamic NAT with a pool of public IPs and static NAT for the web server.

Answer

Configure only PAT (overload) for all internal hosts including the web server.

Answer

Configure static NAT for the web server and use only the public IP for internal hosts.

Question 2

A host with address 192.168.1.130/26 needs to identify its local subnet. Which subnet does it belong to?

Accepted Answer

192.168.1.128/26. A /26 creates subnets in blocks of 64 addresses each. In plain language, that means the fourth octet ranges are 0–63, 64–127, 128–191, and 192–255. Since 192.168.1.130 falls within the 128–191 block, the host belongs to the 192.168.1.128/26 subnet. That is the local network boundary the host will use to decide what is on-link and what requires the default gateway.

This kind of question is a very common CCNA subnetting task. The main challenge is not the arithmetic itself but recognizing the block size and locating the destination inside the correct range. Once you know a /26 moves in increments of 64, the right subnet becomes much easier to see.

Answer

192.168.1.0/26

Answer

192.168.1.64/26

Answer

192.168.1.192/26

Question 3

A router has a default route and a specific route to 203.0.113.0/24. Which route is used for traffic to 203.0.113.25?

Accepted Answer

The specific route to 203.0.113.0/24. The specific route to 203.0.113.0/24 is used because it is a more specific match than the default route. In plain language, even though the default route could technically match almost anything, the router always prefers a route that more precisely describes the destination network. Since 203.0.113.25 is inside 203.0.113.0/24, that route wins under longest-prefix match.

This is one of the most basic routing-table interpretation rules. The default route remains important as a fallback, but it is not chosen when a more specific valid route exists.

Answer

The default route

Answer

Both routes are always load-balanced

Answer

Neither route because defaults cannot coexist with specific routes

Question 4

Which data format uses key-value pairs and is commonly returned by REST APIs?

Accepted Answer

JSON. JSON is a lightweight, human-readable data format that uses key-value pairs and is the most common format returned by REST APIs. YANG is a data modeling language used for configuration and state data, not a data format. Syslog is a logging protocol used for system messages. CDP (Cisco Discovery Protocol) is a Layer 2 discovery protocol for Cisco devices. None of these are key-value pair data formats typically returned by REST APIs.

Answer

YANG

Answer

Syslog

Answer

CDP

Question 5

An administrator has just configured OSPF in a single area between router R1 and router R2, which are directly connected via their Gi0/0 interfaces with IP addresses 10.0.0.1/30 and 10.0.0.2/30. On R1, the command show ip ospf neighbor shows no entries, and a further check on R2 with show ip ospf interface gi0/0 indicates that the interface is passive. Which configuration error is most likely causing the adjacency failure?

Accepted Answer

R2 has the passive-interface default command but no no passive-interface command for Gi0/0.. The output on R2 shows the Gi0/0 interface is passive, meaning OSPF will not send or receive hello packets on that interface, preventing neighbor discovery. The passive-interface default command makes all interfaces passive by default, and without a no passive-interface Gi0/0 command, the interface remains passive, blocking adjacency formation. This directly explains why R1's show ip ospf neighbor shows no entries.

Answer

The network command on R1 does not cover the 10.0.0.0/30 subnet.

Answer

The OSPF process IDs on R1 and R2 are mismatched.

Answer

The hello and dead intervals on R1 and R2 are not the same.

Question 6

Refer to the exhibit. A network engineer is troubleshooting connectivity to server 10.10.10.130. The routing table contains both a static route and an OSPF route for overlapping prefixes. The engineer examines the specific routing entry for 10.10.10.130. Based on the output, why does the router choose the route via 10.1.1.2 instead of the OSPF route via 10.2.2.2 (for 10.10.10.0/24)?

Accepted Answer

The static route has a longer prefix length (/26) than the OSPF route (/24), making it a more specific match.. The router selects the route via 10.1.1.2 because the static route has a prefix length of /26, which is longer (more specific) than the OSPF route's /24. When multiple routes to the same destination exist, the router uses the most specific match (longest prefix) regardless of administrative distance or metric. Since 10.10.10.130 falls within the 10.10.10.128/26 range, the /26 route is preferred over the /24 route.

Answer

The static route has a lower administrative distance (1) than the OSPF route (110).

Answer

The OSPF route is inactive because its next-hop 10.2.2.2 is down.

Answer

The router prefers the static route because it has a metric of 0, which is better than the OSPF metric.

Question 7

A network engineer must summarize the following routes before advertising them upstream:

172.16.32.0/24
172.16.33.0/24
172.16.34.0/24
172.16.35.0/24

Which summary route should be used?

Accepted Answer

172.16.32.0/22. The correct summary is 172.16.32.0/22 because a /22 covers exactly four consecutive /24 networks when the starting boundary is aligned correctly. This is the part many people miss: summarization is not only about how many networks fit into a block, but also where that block starts. Here the four /24 networks begin neatly at 172.16.32.0 and continue through 172.16.35.255, which is the exact range a /22 covers. A /23 would be too small, while a /21 would be unnecessarily broad and could advertise addresses you do not intend to include. The /22 beginning at 172.16.34.0 is not on a valid /22 boundary, so that option is misaligned.

Answer

172.16.32.0/23

Answer

172.16.32.0/21

Answer

172.16.34.0/22

Question 8

An administrator configures an EtherChannel between SW1 and SW2. The port-channel interfaces are physically up, but the EtherChannel bundle fails to come up. On SW1, the channel-group is set to mode active; on SW2, it is set to mode on. What is the most likely cause?

Accepted Answer

One side is using LACP active while the other side is set to on. EtherChannel requires compatible modes: LACP active mode sends negotiation packets, while 'on' mode disables all negotiation, so the two sides cannot agree and the bundle stays down. Option A is wrong because switch priority values are used in STP root election, not EtherChannel formation. Option C is wrong because the native VLAN does not need to be VLAN 1; it only needs to match on both ends. Option D is wrong because all member interfaces in an EtherChannel must be in the same VLAN, not different ones.

Answer

The switch priority values are mismatched

Answer

The native VLAN must be VLAN 1 for EtherChannel to form

Answer

Gi1/0/2 cannot be bundled because interfaces must be in different VLANs

Question 9

A subnet must support at least 126 usable IPv4 host addresses. Which prefix is the longest that meets the requirement?

Accepted Answer

/25. A /25 is the smallest valid answer. In practical terms, a /25 provides 128 total addresses. After subtracting the network and broadcast addresses, 126 usable hosts remain. A /26 would be too small because it supports only 62 usable hosts.

This is a typical minimum-prefix question. The goal is to choose the smallest subnet that satisfies the host requirement without wasting more address space than necessary.

Answer

/26

Answer

/24

Answer

/27

Question 10

Refer to the exhibit. A network administrator is troubleshooting an NTP synchronization issue on R1. The router is configured with the command ntp server 10.1.1.100, but the clock remains unsynchronized. The administrator issues the show ntp status command. What is the most likely cause of the problem?

Accepted Answer

The router cannot reach the NTP server 10.1.1.100 at UDP port 123 due to a routing issue or an access list.. The `show ntp status` output would show the clock as unsynchronized if R1 cannot communicate with the NTP server at 10.1.1.100. NTP uses UDP port 123, and a routing issue or an access list blocking this port would prevent the exchange of NTP packets, leaving the clock unsynchronized. The `ntp server` command configures R1 as a client to request synchronization, but it does not guarantee reachability.

Answer

The NTP authentication key configured on R1 does not match the one on the server.

Answer

The system time on R1 is set to an epoch that is too far from the server's time, causing NTP to refuse to synchronize.

Answer

The NTP service is not enabled on R1; the 'ntp server' command only defines a server but does not start the NTP process.

Question 11

Refer to the exhibit. A network engineer is troubleshooting a missing route on R1. The router R3 is configured to advertise network 192.168.30.0/24 via OSPF, but the route is not present in the OSPF routing table of R1 when issuing the show ip route ospf command. What is the most likely cause?

Accepted Answer

R3 has passive-interface default configured and has not issued the no passive-interface command on the interface facing the OSPF neighbor.. R3 has passive-interface default configured, which makes all interfaces passive by default, preventing OSPF hello packets from being sent. Without the no passive-interface command on the interface facing R1, R3 cannot form an OSPF adjacency, so R1 never learns the 192.168.30.0/24 route. This is a common misconfiguration when using passive-interface default to suppress OSPF on non-neighbor interfaces.

Answer

R3 has not enabled OSPF on the network 192.168.30.0/24 using the network command.

Answer

R1 has an inbound ACL applied to GigabitEthernet0/1 that blocks OSPF multicast traffic to 224.0.0.5 and 224.0.0.6.

Answer

R3's OSPF router ID is duplicated with another OSPF router, causing the SPF algorithm to drop routes.

Question 12

Refer to the exhibit. Users on the inside network can browse the web, but return traffic is failing for some sessions. A partial configuration shows:

interface GigabitEthernet0/0
 ip address 192.168.10.1 255.255.255.0
 ip nat outside
!
interface GigabitEthernet0/1
 ip address 203.0.113.10 255.255.255.0
 ip nat inside
!
ip nat inside source list 1 interface GigabitEthernet0/1 overload
access-list 1 permit 192.168.10.0 0.0.0.255

Based on this configuration, which change is required to make PAT work correctly?

Accepted Answer

Swap the inside and outside NAT roles on the two interfaces.. The problem is that the router has the NAT directions backwards. In simple terms, the interface facing the private LAN should be marked as inside, and the interface facing the public or WAN side should be marked as outside. Here, GigabitEthernet0/0 uses the private address 192.168.10.1, but it is configured as outside. GigabitEthernet0/1 uses the public address 203.0.113.10, but it is configured as inside. That reverses the translation logic and breaks normal PAT behavior.

Technically, the command `ip nat inside source list 1 interface GigabitEthernet0/1 overload` is otherwise reasonable for dynamic PAT using the WAN interface address. The ACL also correctly identifies the inside local subnet. The essential fix is to mark G0/0 as `ip nat inside` and G0/1 as `ip nat outside`. Once the directions are corrected, PAT can create and track translations properly for outbound traffic and returning sessions.

Answer

Apply ip nat enable on both interfaces.

Answer

Replace overload with pool.

Answer

Change access-list 1 to a standard ACL numbered 100.

Question 13

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two links to SW2 configured as an EtherChannel using LACP. The EtherChannel is not coming up. Interface G0/2 was accidentally configured as an access port in VLAN 10, while G0/1 is configured as a trunk. The administrator wants to use LACP to bundle the links. Troubleshoot and fix the configuration to bring up the EtherChannel.

Accepted Answer

Change interface G0/2 to trunk mode and ensure both interfaces have the same allowed VLAN list.. The EtherChannel was down because interface G0/2 was an access port in VLAN 10, while G0/1 was a trunk. For LACP to bundle the links, all member interfaces must have the same configuration, including VLAN and trunk settings. Changing G0/2 to trunk mode resolved the issue.

Answer

Change interface G0/1 to access VLAN 10 to match G0/2.

Answer

Remove the access VLAN configuration from G0/2 and leave it as a default switchport (dynamic desirable).

Answer

Change the EtherChannel mode from LACP to PAgP on both switches.

Question 14

Which two statements accurately describe why source restriction and logging are often used together for administrative access?

Accepted Answer

Source restriction narrows the allowed origin space for administrative sessions.. Source restriction and logging are often used together because they help answer two different security questions. In practical terms, source restriction limits where administrative sessions may originate, while logging helps show what happened once access was attempted or granted. This combination improves both exposure reduction and post-event visibility.

This is a strong layered-security reasoning item because it focuses on complementary controls rather than one-control thinking.

Answer

Logging removes the need for authentication.

Answer

Source restriction works only when Syslog is disabled.

Answer

Both controls exist only for guest wireless networks.

Question 15

A network engineer notices that R1 is using the static route to 192.168.10.0/24 via next-hop 10.1.1.2 instead of the OSPF route via 10.2.2.2, even though the OSPF path has lower latency. What is the most likely cause?

Accepted Answer

The static route has a lower administrative distance than the OSPF route.. R1 prefers the static route over the OSPF route because static routes have a default administrative distance (AD) of 1, whereas OSPF has a default AD of 110. Since a lower AD indicates a more trustworthy route, the static route is installed in the routing table regardless of metric or latency. The OSPF route, despite having lower latency, is not used because AD is evaluated before metric.

Answer

The OSPF route has a higher metric than the static route.

Answer

Equal-cost multi-path (ECMP) is disabled for OSPF.

Answer

The static route is configured with a higher next-hop IP address, so it is preferred.

Question 16

Why might an automation script prefer a token-based API session over repeatedly prompting a human operator for credentials?

Accepted Answer

Because tokens support controlled repeated API access in a way that is practical for automation workflows.. Token-based API sessions allow scripts to make repeated, programmatic requests without requiring a human to re-enter credentials each time. This makes them more practical for automation workflows than constant interactive prompts. Options B, C, and D are incorrect: tokens do not eliminate the need for security controls (they still require proper management like expiration and revocation); they have nothing to do with VLAN creation; and they do not replace routing protocols—tokens are strictly used for authentication and authorization in API interactions.

Answer

Because tokens eliminate the need for any security controls.

Answer

Because tokens automatically create VLANs on the switch.

Answer

Because tokens replace all routing protocols.

Question 17

Exhibit: A host has address 192.168.14.77/27. Which address is its valid default gateway if the first usable address in the subnet is chosen for the router interface?

Accepted Answer

192.168.14.65. A /27 has a block size of 32. Address 192.168.14.77 falls in the 192.168.14.64/27 subnet, where the usable host range is 192.168.14.65 through 192.168.14.94. The first usable address is 192.168.14.65.

Answer

192.168.14.63

Answer

192.168.14.64

Answer

192.168.14.95

Question 18

You are connected to the console of R1. The network administrator reports that hosts in VLAN 10 cannot reach the server at 192.168.1.100. R1 is the default gateway for VLAN 10 via subinterface G0/0.10. The link between R1 and the switch SW1 appears to be up, but pings fail. Your task is to identify and resolve the issue.

Accepted Answer

Check the duplex and speed settings on the physical interface G0/0 of R1 and the corresponding switchport on SW1; they may be mismatched.. The link between R1 and SW1 had mismatched duplex/speed settings because auto-negotiation failed, causing excessive CRC errors and packet loss. Manually setting both sides to 100/full resolves the issue.

Answer

Check the interface status on R1's G0/0.10 subinterface; it may be administratively down.

Answer

Verify that the VLAN 10 SVI on SW1 has an IP address in the correct subnet.

Answer

Ensure that the native VLAN on the trunk between R1 and SW1 is VLAN 1.

Question 19

Which TWO statements about floating static routes and default routes are correct?

Accepted Answer

A floating static route uses an administrative distance higher than that of the primary route to act as a backup.. A floating static route is configured with a higher administrative distance (AD) than the primary route. This ensures the floating route remains inactive in the routing table unless the primary route fails, at which point the router installs the floating static route as a backup. The higher AD makes it less preferred than the primary dynamic or static route.

Answer

A floating static route must have a lower administrative distance than the primary route to ensure faster convergence.

Answer

Floating static routes are supported only for IPv6, not for IPv4.

Answer

A default static route cannot be configured as a floating static route.

Question 20

You are connected to R1 via console. R1 has two upstream paths to the Internet: a primary via ISP1 (G0/0 10.1.1.1/30) and a backup via ISP2 (G0/1 10.2.2.1/30). The backup path should only be used when the primary fails. The default route to ISP1 has been configured, but you must now configure a floating static default route to ISP2 with an administrative distance of 200.

Accepted Answer

ip route 0.0.0.0 0.0.0.0 10.2.2.2 200. A floating static route ensures backup connectivity by using an administrative distance (AD) higher than the primary route's AD. Here, the primary default route has an AD of 1, so the backup must be configured with AD 200 as specified. Crucially, the next-hop address must be the ISP's IP address (10.2.2.2) in the /30 subnet, not R1's own interface IP (10.2.2.1). Using the local interface IP creates an invalid static route. Option A is correct only with the next-hop set to 10.2.2.2. Options B and C fail because they use AD 2 and 1 respectively (not the required 200) and also point to the wrong next-hop. Option D uses AD 250 instead of 200 and has the same next-hop error.

Answer

ip route 0.0.0.0 0.0.0.0 10.2.2.1 2

Answer

ip route 0.0.0.0 0.0.0.0 10.2.2.1 1

Answer

ip route 0.0.0.0 0.0.0.0 10.2.2.1 250