CCNA Mock Exam 75 — 25 Questions

Question 1

A user reports that they cannot access the company's internal web server at 'intranet.company.local' from their workstation. The workstation can ping the web server's IP address 192.168.10.50 successfully, and other internal services like email (mail.company.local) are reachable. Which DNS record issue is most likely causing this problem?

Accepted Answer

Add an A record mapping 'intranet.company.local' to IP address 192.168.10.50. The workstation can ping the web server's IP address (192.168.10.50), confirming network connectivity and that the server is online. However, the user cannot access the server by its hostname 'intranet.company.local', which indicates a DNS resolution failure. Since other internal services like email are reachable, the DNS zone is functioning, but there is no A record that maps the hostname 'intranet' to its IP address. Adding an A record for 'intranet.company.local' pointing to 192.168.10.50 will resolve the issue.

Answer

Add a CNAME record that aliases 'intranet.company.local' to 'webserver.company.local'

Answer

Verify the PTR record for 192.168.10.50 points to 'intranet.company.local'

Answer

Check the NS records for the 'company.local' zone to ensure proper delegation

Question 2

A network administrator is troubleshooting connectivity from the 192.168.10.0/24 subnet to the server at 10.10.10.10. Users report that they can reach the server initially, but after a few minutes, connectivity drops and only returns after the interface is cleared. The administrator reviews the router's running configuration and ACL configuration. What is the most likely cause of the intermittent connectivity loss?

Accepted Answer

Remove the 'established' keyword from the ACL to allow initial TCP connections.. The 'established' keyword in an ACL permits TCP packets that have the ACK or RST bit set, which are responses to outbound connections. However, it does not permit the initial SYN packet from the client to the server. Since users can reach the server initially (likely due to a temporary permit or stateful inspection elsewhere), but connectivity drops after a few minutes, the issue is that the ACL is blocking the initial SYN packets needed to establish new TCP connections. Removing the 'established' keyword (or adding a permit for the initial SYN) resolves this by allowing all TCP traffic from the source subnet.

Answer

Apply the ACL inbound on the interface instead of outbound.

Answer

Add a permit statement for UDP traffic to allow DNS resolution.

Answer

Change the wildcard mask to 0.0.0.255 to match the subnet more accurately.

Question 3

A small office network uses a single public IP address on its router's WAN interface. The network administrator needs to allow all internal hosts to access the internet, but must also ensure that an internal web server with a private IP address is reachable from the internet. Which NAT configuration should the administrator implement to meet both requirements?

Accepted Answer

Configure PAT (overload) for internal hosts and static NAT for the web server.. Option B is correct because PAT (Port Address Translation), also known as NAT overload, allows multiple internal hosts to share a single public IP address by mapping each session to a unique port number, satisfying the requirement for internet access. Static NAT is then used to create a one-to-one mapping from the public IP (on a specific port) to the private IP of the internal web server, making it reachable from the internet. This combination meets both outbound connectivity for all hosts and inbound access to the web server without needing additional public IPs.

Answer

Configure dynamic NAT with a pool of public IPs and static NAT for the web server.

Answer

Configure only PAT (overload) for all internal hosts including the web server.

Answer

Configure static NAT for the web server and use only the public IP for internal hosts.

Question 4

Which three of the following are characteristics of Layer 2 Ethernet switches that support VLANs? (Choose three.)

Accepted Answer

They use the Spanning Tree Protocol to prevent Layer 2 loops.. Layer 2 Ethernet switches that support VLANs forward frames based on the destination MAC address, which is the fundamental switching decision. They can segment a LAN into multiple broadcast domains because each VLAN creates its own isolated broadcast domain, preventing unnecessary traffic propagation. They use the Spanning Tree Protocol (STP) to prevent Layer 2 loops by dynamically blocking redundant paths, ensuring a loop-free topology.

Answer

They use ARP to resolve IP addresses to MAC addresses.

Answer

They perform routing between VLANs without a router.

Answer

They forward frames based on the destination IP address.

Question 5

A network administrator at a large enterprise notices that the network monitoring system frequently generates false positive alerts for unusual traffic patterns during normal business hours. The administrator wants to reduce these false positives while still detecting genuine security threats. Which AI/ML concept would best address this requirement?

Accepted Answer

Implement an anomaly detection system that uses machine learning to establish baseline behavior and flag deviations.. Option B is correct because anomaly detection using machine learning establishes a dynamic baseline of normal network behavior, allowing the system to flag only significant deviations. This reduces false positives during normal business hours while still detecting genuine threats that deviate from the learned baseline, unlike static thresholds that trigger alerts on routine traffic variations.

Answer

Deploy a predictive analytics model to forecast future traffic volumes and adjust thresholds accordingly.

Answer

Apply intent-based networking to automatically enforce security policies based on high-level business intent.

Answer

Use deep packet inspection to examine all traffic and create static rules for known threats.

Question 6

A network engineer needs to automate the configuration of multiple Cisco IOS XE routers in a data center. The team requires a standard, vendor-neutral data modeling language to define the configuration parameters, and they need a protocol that uses XML-based remote procedure calls over SSH for secure, reliable configuration transactions. Which combination of technologies best meets these requirements?

Accepted Answer

Use YANG data models combined with NETCONF over SSH.. Option B is correct because YANG is a standard, vendor-neutral data modeling language (RFC 6020) for defining configuration parameters, and NETCONF (RFC 6241) uses XML-based remote procedure calls (RPCs) over SSH for secure, reliable configuration transactions. This combination directly satisfies the requirement for a standard data model and XML-based RPCs over SSH, unlike RESTCONF which uses HTTPS and JSON/XML but not SSH.

Answer

Use YANG data models combined with RESTCONF over HTTPS.

Answer

Use CLI commands combined with NETCONF over SSH.

Answer

Use CLI commands combined with RESTCONF over HTTPS.

Question 7

A network administrator is troubleshooting a new branch office where hosts in VLAN 20 on switch SW1 cannot obtain IP addresses from the DHCP server located at 192.168.10.5 in the main data center. The router R1 is configured as the default gateway for VLAN 20 with interface GigabitEthernet0/1.20. The administrator verifies that the DHCP server is reachable and has available addresses. What configuration change should the administrator make to resolve the issue?

Accepted Answer

Configure the 'ip helper-address 192.168.10.5' command on the router interface GigabitEthernet0/1.20.. The correct answer is B because the DHCP server is on a different subnet than the hosts in VLAN 20. By default, DHCP broadcasts are not forwarded across routers. The 'ip helper-address 192.168.10.5' command on the router's subinterface GigabitEthernet0/1.20 converts the broadcast DHCP request into a unicast and forwards it to the DHCP server, allowing the hosts to obtain IP addresses.

Answer

Configure a static IP address on the DHCP server to ensure it is always reachable.

Answer

Enable DHCP snooping globally on the switch SW1.

Answer

Increase the DHCP lease time on the server to 30 days.

Question 8

Which three options correctly describe how a router processes a packet destined for a remote network? (Choose three.)

Accepted Answer

It rewrites the source and destination MAC addresses for the next hop.. When a router forwards a packet to a remote network, it first decrements the Time-to-Live (TTL) field in the IP header to prevent infinite loops. It then performs a routing table lookup for the destination IP address to determine the next-hop interface and IP. Finally, it rewrites the source and destination MAC addresses for the next hop, because MAC addresses are only relevant on the local link and must be updated at each Layer 3 hop.

Answer

It replaces the source IP address with its own outgoing interface IP.

Answer

It sends an ARP request for every destination IP address in the packet.

Answer

It encapsulates the entire packet in a new Layer 2 frame with the original MAC addresses.

Question 9

A network engineer is troubleshooting a link between two Cisco Catalyst 9300 switches that are connected via a 10GBASE-SR SFP+ module on each end over OM3 multimode fiber. The link is up, but the interface counters show a high number of CRC errors and runts. The engineer runs 'show interfaces Gi1/0/1' and 'show interfaces Gi1/0/1 transceiver details'. What is the most likely cause of the errors?

Accepted Answer

The receive optical power is too low, indicating a fiber or connector issue.. The high CRC errors and runts on a 10GBASE-SR link over OM3 fiber, combined with the 'show interfaces transceiver details' command, point to a physical-layer issue. Low receive optical power (below the receiver sensitivity threshold) causes bit errors that manifest as CRC errors and runts, even though the link is up. This is the most common cause when the fiber and transceivers are otherwise compatible.

Answer

The SFP+ module is faulty and needs replacement.

Answer

The fiber patch cables are too long, exceeding the 300-meter distance limit for 10GBASE-SR over OM3 fiber.

Answer

The interface speed is mismatched; the switch interface shows 1000Mb/s but the SFP+ is 10GBASE-SR.

Question 10

A network engineer notices that a critical link between two Cisco Catalyst 9300 switches is flapping every few minutes. The link uses a 10GBASE-SR SFP+ module on one end and a 10GBASE-LR SFP+ module on the other. The interface logs show 'Link error recovery - will restart'. The distance between the switches is 500 meters. Which command output best confirms the root cause of the flapping?

Accepted Answer

show interfaces transceiver. The correct answer is B because the 'show interfaces transceiver' command displays the optical parameters (e.g., transmit power, receive power, temperature) of the SFP+ modules. The mismatch between a 10GBASE-SR (multimode, 300m max) and a 10GBASE-LR (single-mode, 10km max) over 500 meters causes excessive attenuation and signal loss, triggering the 'Link error recovery - will restart' flapping. This command confirms the root cause by showing abnormal receive power levels or a missing/different transceiver type.

Answer

show interfaces status

Answer

show interfaces gigabitethernet1/0/1

Answer

show logging

Question 11

A network engineer is troubleshooting a link between two Cisco Catalyst 9300 switches that are connected via a single-mode fiber optic cable. The link is up, but the interface counters show a high number of CRC errors and frame check sequence (FCS) errors. The interface is configured for 1000 Mbps and full duplex on both ends. What is the most likely cause of these errors?

Accepted Answer

Faulty or dirty fiber optic cable or connectors. CRC and FCS errors indicate corruption at the data-link layer, typically caused by physical-layer issues such as signal degradation. Since the link is up and both ends are configured for 1000 Mbps full duplex, a speed/duplex mismatch is ruled out. Dirty or faulty single-mode fiber connectors or the cable itself can introduce optical signal loss or reflections, leading to bit errors that manifest as CRC/FCS errors.

Answer

A speed or duplex mismatch between the two switches

Answer

Incorrect SFP+ module type inserted in the switch

Answer

Excessive cable length beyond the distance limit

Question 12

A network engineer is automating the configuration of a new branch office router. The engineer needs a protocol that uses a YANG data model, supports both configuration and operational state retrieval, and operates over SSH for secure transport. Which protocol should the engineer use?

Accepted Answer

NETCONF. NETCONF (Network Configuration Protocol) is the correct choice because it uses YANG data models for configuration and operational state retrieval, and it operates over SSH (RFC 6242) for secure transport. Unlike SNMP, NETCONF provides transactional configuration changes and separates configuration from operational state data, making it ideal for automated router configuration.

Answer

SNMP

Answer

RESTCONF

Answer

CLI scripting

Question 13

A network technician is troubleshooting a newly installed fiber link between two Cisco Catalyst 9300 switches. The link is up, but the interface shows excessive CRC errors and input errors. The technician runs 'show interfaces' and 'show interfaces transceiver details' on the suspect interface. Based on the output, what is the most likely cause of the errors?

Accepted Answer

The receive power is too low, likely due to a dirty or damaged fiber connector or excessive attenuation.. The output from 'show interfaces transceiver details' would show the receive power level. A receive power that is too low (e.g., below the receiver sensitivity threshold) indicates excessive signal loss, often due to dirty or damaged fiber connectors, poor splices, or excessive cable attenuation. This causes bit errors that manifest as CRC and input errors, even though the link is physically up. Option D correctly identifies this as the most likely cause.

Answer

The interface is configured for full duplex but the switchport is set to auto-negotiation, causing a duplex mismatch.

Answer

The SFP transceiver is faulty because the transmit power is too low at -3.5 dBm.

Answer

The fiber cable is too long for the SX SFP, exceeding the distance limit.

Question 14

A network administrator is troubleshooting a connectivity issue between two hosts on different subnets. The administrator captures packets on the source host and notices that the frames contain the correct source and destination MAC addresses but the encapsulated packets have incorrect source and destination IP addresses. According to the OSI model, which layer is most likely responsible for this issue?

Accepted Answer

Network Layer (Layer 3). The Network Layer (Layer 3) is responsible for logical addressing (IP addresses) and routing packets between different subnets. Since the captured frames have correct MAC addresses (Layer 2) but incorrect source and destination IP addresses, the issue lies in how the IP headers are being constructed or assigned, which is a Layer 3 function. This could be caused by misconfigured IP addresses, subnet masks, or default gateways on the source host.

Answer

Physical Layer (Layer 1)

Answer

Data Link Layer (Layer 2)

Answer

Transport Layer (Layer 4)

Question 15

A network technician is troubleshooting a connectivity issue where a user's email client cannot send messages, but the client can receive emails. The technician uses a protocol analyzer and sees that the client is successfully resolving the mail server's domain name to an IP address and establishing a TCP connection, but the server responds with an application-layer error. At which layers of the OSI model are the problem and the successful operations occurring, respectively?

Accepted Answer

The problem is at the Application layer (Layer 7); successful operations are at the Application layer (Layer 7) and Transport layer (Layer 4).. The problem is at the Application layer (Layer 7) because the email client can resolve the domain name (DNS, Layer 7), establish a TCP connection (Transport layer, Layer 4), but the mail server returns an application-layer error (e.g., SMTP 550 or 554), indicating the issue lies in the email protocol itself (e.g., authentication failure, mailbox full, or rejected sender). Successful operations include DNS resolution (Application layer) and TCP three-way handshake (Transport layer), confirming layers 7 and 4 are functioning correctly.

Answer

The problem is at the Transport layer (Layer 4); successful operations are at the Application layer (Layer 7) only.

Answer

The problem is at the Network layer (Layer 3); successful operations are at the Data Link layer (Layer 2) and Physical layer (Layer 1).

Answer

The problem is at the Presentation layer (Layer 6); successful operations are at the Session layer (Layer 5) and Transport layer (Layer 4).

Question 16

Which TWO statements about fiber optic cable types and SFP transceivers are correct?

Accepted Answer

Multimode fiber is commonly used in campus and data center environments for distances up to several hundred meters.. Multimode fiber (MMF) has a larger core (typically 50/125 µm or 62.5/125 µm) and is used for short-reach, cost-effective connections up to a few hundred meters, making option B correct. Single-mode fiber (SMF) uses a much smaller core (~9 µm) and laser-based optics to achieve distances of 10 km or more, so option D is correct. Option A is wrong because it reverses the core size characteristic: SMF has a smaller core, and the given dimensions (62.5/125 µm) refer to multimode. Option C is wrong because SFP+ is a 10 Gbps form factor and is not inherently backward compatible with 1 Gbps SFP modules unless the switch port explicitly supports dual-rate operation. Option E is incorrect because fiber optic cables are inherently immune to electromagnetic interference (EMI) and therefore never require EMI shielding in any environment; the false statement claims they need shielding.

Answer

Single-mode fiber uses a larger core (typically 62.5/125 µm) and supports longer distances than multimode fiber.

Answer

SFP+ transceivers support data rates up to 1 Gbps and are backward compatible with standard SFP modules.

Answer

Fiber optic cables must be run with EMI shielding when deployed in environments with high electromagnetic interference.

Question 17

Which TWO statements accurately describe the responsibilities of the OSI model's Transport layer?

Accepted Answer

It segments data from the upper layers and manages end-to-end flow control.. Option B is correct because the Transport layer (Layer 4) segments data from upper layers and manages end-to-end flow control using mechanisms like TCP's sliding window to prevent overwhelming a slow receiver. Option D is correct because the Transport layer provides either reliable delivery (TCP) or unreliable delivery (UDP) between applications on different hosts, ensuring data reaches the appropriate application via port numbers. Option A is incorrect because logical addressing and routing are functions of the Network layer (Layer 3). Option C is incorrect because converting data into electrical signals is the responsibility of the Physical layer (Layer 1). Option E is incorrect because encapsulating data into frames with MAC addresses is a function of the Data Link layer (Layer 2).

Answer

It provides logical addressing and routing to determine the best path for data.

Answer

It converts data into electrical signals for transmission over the physical medium.

Answer

It encapsulates data into frames and adds source and destination MAC addresses.

Question 18

Which TWO statements correctly describe the encapsulation process at the OSI model Transport layer?

Accepted Answer

It breaks data into smaller units called segments (for TCP) or datagrams (for UDP).. At the Transport layer (Layer 4), TCP segments data into segments and UDP segments data into datagrams. This segmentation allows efficient transmission and reassembly at the destination. The Transport layer header includes source and destination port numbers to identify the communicating applications, not IP or MAC addresses.

Answer

It adds source and destination IP addresses to the data.

Answer

It adds a header that includes source and destination MAC addresses.

Answer

It converts data into bits for transmission over the physical medium.

Question 19

Which TWO statements are true about IPv6 link-local addresses?

Accepted Answer

They are automatically configured on all IPv6-enabled interfaces.. Option A is correct because IPv6 link-local addresses (fe80::/10) are automatically generated on every IPv6-enabled interface using Stateless Address Autoconfiguration (SLAAC) as defined in RFC 4862. This ensures that each interface has a unique local address for neighbor discovery and other link-local operations without requiring manual configuration or a DHCPv6 server.

Answer

They are routable across the entire IPv6 internet.

Answer

They always use the EUI-64 format for the interface ID.

Answer

They are used as the default gateway address for IPv6 hosts.

Question 20

A network engineer notices that users on VLAN 100 are experiencing intermittent connectivity to the server farm. The switch connecting these users shows no errors on the uplink interface, but the server farm switch reports a high number of input errors on its connected interface. The engineer runs 'show controllers' on the server farm switch. What is the most likely cause of the issue?

Accepted Answer

The SFP module is faulty or incompatible with the cable type.. The 'show controllers' command on the server farm switch reveals physical-layer issues such as framing errors, CRC errors, or alignment errors, which are often caused by faulty or incompatible SFP modules. Since the uplink interface on the user switch shows no errors, the problem is isolated to the server farm switch's interface, and a faulty SFP can introduce signal degradation or electrical issues without necessarily causing complete link failure. Option B is correct because SFP incompatibility or defects commonly produce input errors at the physical layer, even when the link appears up.

Answer

The interface is configured with the wrong duplex setting.

Answer

The cable is too long, causing attenuation.

Answer

Auto-negotiation is disabled, causing a speed mismatch.

CCNA Mock Exam 75 — 25 Questions

Exhibit

CCNA Mock Exam 75 — 25 Questions

Exhibit