CCNA Mock Exam 75 — 25 Questions

Question 1

Drag and drop the following steps into the correct order to describe the router's routing table lookup process for a destination IP address, including best-path selection using longest prefix match, administrative distance, and metric.

Accepted Answer

1. Perform longest prefix match on the destination IP address against all routes in the routing table.
2. If multiple routes match, compare administrative distances; choose the route with the lowest AD.
3. If multiple routes have the same AD, compare metrics; choose the route with the lowest metric.
4. Forward the packet using the selected route.. The order follows the router's decision process: longest prefix match first, then administrative distance, then metric, leading to the forwarding decision.

Answer

1. Compare administrative distances of all routes; choose the route with the lowest AD.
2. Perform longest prefix match on the destination IP address against the remaining routes.
3. If multiple routes have the same AD, compare metrics; choose the route with the lowest metric.
4. Forward the packet using the selected route.

Answer

1. Perform longest prefix match on the destination IP address against all routes in the routing table.
2. If multiple routes match, compare metrics; choose the route with the lowest metric.
3. If multiple routes have the same metric, compare administrative distances; choose the route with the lowest AD.
4. Forward the packet using the selected route.

Answer

1. Compare metrics of all routes; choose the route with the lowest metric.
2. Perform longest prefix match on the destination IP address against the remaining routes.
3. If multiple routes have the same metric, compare administrative distances; choose the route with the lowest AD.
4. Forward the packet using the selected route.

Question 2

PCs in VLAN 40 are not receiving addresses from the centralized DHCP server at 172.16.1.10. What should be configured on the VLAN 40 default gateway interface?

Accepted Answer

ip helper-address 172.16.1.10. When DHCP clients and the DHCP server are on different subnets, the router interface serving the client subnet must relay broadcasts to the server with the ip helper-address command.

Answer

ip dhcp excluded-address 10.40.40.1 10.40.40.10

Answer

service dhcp

Answer

ip default-gateway 172.16.1.10

Question 3

Which four of the following are characteristics of Dynamic Trunking Protocol (DTP) and VLAN Trunking Protocol (VTP) used in Cisco switching? (Choose four.)

Accepted Answer

A switch configured with 'switchport mode dynamic desirable' actively attempts to form a trunk using DTP.. The four correct statements are: (1) DTP is a Cisco proprietary protocol for negotiating trunk links; (2) VTP synchronizes VLAN information across switches in the same VTP domain; (3) 'switchport mode dynamic desirable' actively sends DTP frames to form a trunk; (4) VTP pruning reduces unnecessary broadcast traffic by limiting flooded traffic to only switches that need the VLAN. The two incorrect statements: VTP transparent mode forwards VTP advertisements but does **not** modify its VLAN database based on received updates—it only passes them through. DTP **cannot** form a trunk when both ends are configured with 'switchport nonegotiate' because that command disables DTP frame transmission entirely, preventing trunk negotiation.

Answer

VTP transparent mode stores and forwards VTP advertisements but also modifies the VLAN database based on received updates.

Answer

DTP can form a trunk regardless of whether both ends are configured with 'switchport nonegotiate'.

Question 4

You are connected to R1. The network administrator wants to permit only HTTPS traffic (TCP port 443) from the 192.0.2.0/24 network to the 203.0.113.0/24 network, while denying all other IP traffic. Currently, an ACL applied inbound on G0/1 is blocking all traffic, including HTTPS. Identify the issue and correct the ACL configuration so that only HTTPS traffic is permitted.

Accepted Answer

Remove the existing ACL, then create an extended ACL with a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443, and apply it inbound on G0/1.. The ACL BLOCK_IN currently has a single deny ip any any entry, which blocks all traffic inbound on G0/1. The correct solution is to first remove the existing ACL, then create a new extended ACL that permits TCP 443 from source network 192.0.2.0/24 to destination network 203.0.113.0/24, and apply it inbound on G0/1. The implicit deny at the end of the ACL will then block all other traffic, achieving the desired policy.

Answer

Add a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443 before the existing deny ip any any entry in the ACL.

Answer

Remove the existing ACL and create a standard ACL with permit 192.0.2.0 0.0.0.255, then apply it inbound on G0/1.

Answer

Remove the existing ACL and create an extended ACL with a permit statement for tcp any any eq 443, then apply it inbound on G0/1.

Question 5

Exhibit: A company wants to export traffic statistics from routers to a collector for visibility into top talkers and application usage. Which two statements are accurate?

Accepted Answer

NetFlow can export flow data to a collector. NetFlow exports flow records to a collector and is useful for traffic analysis and accounting visibility, enabling identification of top talkers and application usage (options A and B are correct). Syslog reports events and messages, but does not replace flow records for conversation-level traffic statistics, so option C is incorrect. NetFlow does not replace routing protocols for path selection; it is a traffic monitoring tool, not a routing mechanism, so option D is incorrect. NetFlow works on routers and Layer 3 switches, not only Layer 2 switches, so option E is incorrect.

Answer

Syslog and NetFlow are the same feature with different names

Answer

NetFlow replaces routing protocols for path selection

Answer

NetFlow only works on Layer 2 switches and never on routers

Question 6

Which three of the following are characteristics of Layer 2 Ethernet switches that improve network performance? (Choose three.)

Accepted Answer

They can perform cut-through switching to reduce latency.. Layer 2 Ethernet switches improve network performance by creating separate collision domains per port, eliminating collisions between devices on different ports. They forward frames based on the destination MAC address, enabling efficient hardware-based switching. Cut-through switching reduces latency by starting to forward as soon as the destination MAC address is read. The other options are incorrect: switches do not reduce broadcast domains (broadcasts are forwarded to all ports in the same VLAN unless a router or VLAN segmentation is used); switches operate at Layer 2 using MAC addresses, not IP addresses; and unknown unicast frames are flooded out all ports except the incoming port, not automatically blocked, to ensure connectivity if the destination is unknown.

Answer

They use IP addresses to make forwarding decisions.

Answer

They automatically block all unknown unicast frames.

Answer

They reduce the number of broadcast domains.

Question 7

What is the best explanation for why a router chooses the OSPF route to 10.50.0.0/16 instead of the RIP route?

Accepted Answer

Because OSPF has a lower administrative distance than RIP for the same prefix.. The router chooses the OSPF route because when the prefix length is the same, source preference is considered, and OSPF has a lower administrative distance than RIP. In practical terms, both routes describe the same destination size, so longest-prefix match does not separate them. The router then trusts the OSPF source more than RIP by default.

This is a classic administrative-distance comparison question and a very important route-selection concept.

Answer

Because RIP routes are never installed when OSPF is running.

Answer

Because OSPF always has a longer prefix than RIP.

Answer

Because the RIP metric is lower than the OSPF metric.

Question 8

R1 and R2 are directly connected and running OSPF. They can ping each other, the area matches, and the timers match, but they still do not become neighbors. What is the most likely cause?

Accepted Answer

The OSPF authentication keys do not match.. The most likely cause is a mismatch in OSPF authentication keys. Even though the routers have IP connectivity, matching area IDs, and identical timers, OSPF adjacency requires that authentication parameters also match. If authentication is enabled on both sides but the keys differ, OSPF packets are silently rejected, preventing neighbor formation.

Answer

The subnet mask is too small for OSPF to operate.

Answer

The routers must use different process IDs.

Answer

The interfaces must be configured as switch trunks.

Question 9

Which TWO statements correctly describe the configuration and verification of IPv4 and IPv6 parameters for host connectivity, including default gateway, DNS, and subnet masks?

Accepted Answer

The default gateway must be on the same subnet as the host's IP address.. A host's default gateway must be on the same subnet to be reachable at Layer 2; otherwise, a circular dependency occurs. Option D is correct because the 'ipconfig /all' command displays both IPv4 and IPv6 configuration details, including IP address, subnet mask, default gateway, and DNS servers. Option A is wrong because the subnet mask determines the network and host portions of an IP address, not the DNS server address. Option C is wrong because IPv6 hosts can obtain their IP address via SLAAC, DHCPv6, or static configuration; the phrase 'can only' makes it incorrect. Option E is wrong because the default gateway must be reachable (on the same subnet) and configured with an IP address that belongs to a router interface on that subnet, not just any IP address.

Answer

The subnet mask determines the DNS server address used by the host.

Answer

IPv6 hosts can only obtain their IP address via DHCPv6.

Answer

A host can reach any remote network if its default gateway is configured with any IP address.

Question 10

SW1 is the root bridge for VLAN 10. A user switch receives a BPDU on an access port connected to a desk-side unmanaged switch. What should happen if BPDU Guard is enabled on that port?

Accepted Answer

The port is moved to err-disabled state. BPDU Guard is designed to protect edge ports. If a BPDU is received on a PortFast access port, the switch places the interface into the err-disabled state to stop a potential Layer 2 loop or rogue switch.

Answer

The port transitions to forwarding more quickly

Answer

The switch elects a new root bridge

Answer

The port becomes a trunk automatically

Question 11

An engineer wants all devices to send logs to 10.10.10.50 and also stamp those logs with consistent time from 10.10.10.60. Which two configurations are required on a Cisco device?

Accepted Answer

logging host 10.10.10.50. One configuration points the device to the syslog collector, and the other points it to the NTP server. The requirement is about centralized logging and accurate timestamps, so both services must be configured. Option E, 'service timestamps log localtime', is a valid command but it only sets the timestamp format to local time; without an NTP server, timestamps will not be consistent across devices.

Answer

ip helper-address 10.10.10.50

Answer

snmp-server host 10.10.10.60

Answer

service timestamps log localtime

Question 12

Two switches are connected using four Gigabit Ethernet interfaces configured as an EtherChannel with LACP. The network administrator notices that only two of the four interfaces are active in the port-channel, and the other two are in a suspended state. Upon further investigation, the administrator finds that the two inactive interfaces correspond to remote interfaces that are configured with the 'on' mode, while the active ones correspond to remote interfaces configured with LACP active/passive. The administrator also verifies that all local interfaces have the same speed, duplex, and VLAN. What is the most likely cause of the suspended interfaces?

Accepted Answer

The remote switch interfaces corresponding to the suspended local interfaces are configured with the 'on' mode instead of 'active' or 'passive' for LACP.. LACP requires both ends of a link to be configured in either 'active' or 'passive' mode to negotiate an EtherChannel. If some remote interfaces are set to 'on' mode (static EtherChannel), LACP negotiation fails on those links, causing the corresponding local LACP-enabled interfaces to remain in a suspended state. The local switch detects that LACP PDUs are not received on those interfaces and suspends them to prevent misconfiguration. The other two interfaces with correctly configured remote peers form the EtherChannel successfully.

Answer

The interfaces are in err-disabled state due to a spanning-tree loop.

Answer

The port-channel interface is shutdown.

Answer

There is a mismatch in the allowed VLANs on the member interfaces.

Question 13

The SVI for VLAN 20 has `ip nat outside` and the WAN interface has `ip nat inside`. Hosts in VLAN 20 must reach the internet through PAT, but users report no external connectivity. Which configuration issue best explains the problem?

Accepted Answer

The interfaces are marked with inside and outside in the wrong places. NAT overload works only when the inside and outside interfaces are identified correctly. Here the roles are reversed, so translations are not built in the right direction.

Answer

The ACL should deny 192.168.20.0/24 instead of permit it

Answer

PAT cannot be used with a /30 WAN link

Answer

NAT overload requires a route-map instead of an ACL

Question 14

You are connected to R1 via console. The network consists of R1, R2, and a multilayer switch MLS1. R1's GigabitEthernet0/0 connects to MLS1's GigabitEthernet1/0/1 (VLAN 10), and MLS1's GigabitEthernet1/0/2 connects to R2's GigabitEthernet0/0. The goal is to enable IPv6 communication between R1 and R2 across the layer-3 switch. Currently, R1 and R2 cannot ping each other's IPv6 addresses. Configure R1's G0/0 with the IPv6 prefix 2001:db8:1:10::/64 using EUI-64, and R2's G0/0 with static IPv6 address 2001:db8:1:10::2/64. Also ensure MLS1 has IPv6 routing enabled and an IPv6 address on VLAN 10 (2001:db8:1:10::3/64). Troubleshoot and fix any layer-2 or layer-3 issues preventing connectivity.

Accepted Answer

Configure 'ipv6 address 2001:db8:1:10::/64 eui-64' on R1's G0/0 interface.. R1 has no IPv6 address configured on G0/0. The required prefix is 2001:db8:1:10::/64 using EUI-64, which generates the interface ID from the MAC address. The command 'ipv6 address 2001:db8:1:10::/64 eui-64' must be entered in interface configuration mode. Additionally, MLS1 has IPv6 routing enabled (as seen by the connected route), but R1's interface is missing the IPv6 address. After configuration, R1 will be able to ping R2 and MLS1. No other changes are needed because R2 and MLS1 are correctly configured.

Answer

Enable IPv6 routing on R1 with 'ipv6 unicast-routing'.

Answer

Configure 'ipv6 address 2001:db8:1:10::1/64' on R1's G0/0 interface (without EUI-64).

Answer

Change the VLAN on MLS1's G1/0/1 to match R1's VLAN.

Question 15

Why is administratively shutting down unused switch ports considered a useful hardening measure?

Accepted Answer

It reduces the attack surface by removing unnecessary network entry points.. Unused active ports create unnecessary opportunity for unauthorized connection. Disabling them reduces the attack surface and makes opportunistic access much harder. Option B is incorrect because administratively shutting down a port does not increase backplane bandwidth; bandwidth is a fixed hardware characteristic. Option C is incorrect because shutting down ports does not enable 802.1Q trunking; trunking is configured separately. Option D is incorrect because port security must be explicitly enabled; it is not activated automatically by shutting down ports.

Answer

It increases available bandwidth on the switch backplane.

Answer

It enables 802.1Q trunking on all remaining ports.

Answer

It forces port security to activate automatically.

Question 16

A non-root switch has two uplinks toward the root bridge. One path has a lower total STP cost than the other. What role will the lower-cost uplink have?

Accepted Answer

Root port. On a non-root switch, the port with the lowest path cost toward the root bridge becomes the root port. The higher-cost uplink would become an alternate (blocked) port. A designated port is found on the upstream switch toward this switch, not on the non-root switch itself. A disabled port is administratively shut down, which does not apply here.

Answer

Alternate port

Answer

Designated port

Answer

Disabled port

Question 17

Match each automation transport or interaction term to its most accurate description.

Accepted Answer

RESTCONF: A stateless, HTTP-based protocol that uses RESTful APIs and supports both XML and JSON data encoding.. Options A and B are correct. RESTCONF is a stateless, HTTP-based protocol that supports both XML and JSON encoding. NETCONF is a stateful, RPC-based protocol that uses XML encoding and operates over SSH or TLS. Option C is incorrect because gRPC is an RPC framework that can support both stateless and stateful interactions, but it is not stateless; it uses HTTP/2 and Protocol Buffers. Option D is incorrect because SSH is a stateful protocol that establishes an encrypted session for secure remote access and file transfers.

Answer

gRPC: A stateless, HTTP/2-based protocol that uses Protocol Buffers for data serialization.

Answer

SSH: A stateless, secure shell protocol used for remote CLI access and file transfers.

Question 18

A branch LAN requires 50 usable IPv4 host addresses. What is the most efficient subnet mask that provides at least 50 usable hosts?

Accepted Answer

/26. A /26 provides 64 total addresses and 62 usable host addresses, which is the smallest subnet mask (largest prefix length) that fits 50 hosts, making it the most efficient choice.

Answer

/27

Answer

/25

Answer

/24

Question 19

An administrator wants to permit HTTP and HTTPS from 10.1.10.0/24 to a web server at 198.51.100.20 and deny everything else from that subnet. Which ACL type is required?

Accepted Answer

Extended ACL. A standard ACL can match only the source address. To permit specific protocols and ports such as TCP 80 and 443 to a specific destination, the administrator must use an extended ACL.

Answer

Named standard ACL

Answer

Prefix list

Answer

MAC access-list

Question 20

Which TWO of the following are essential IPv4 host parameters that must be correctly configured for a host to communicate with devices on remote networks?

Accepted Answer

Default gateway. The default gateway is the IP address of the router interface on the local subnet; when a host needs to communicate with a device on a remote network, it must forward packets to the default gateway because the destination is not reachable locally. The subnet mask is equally essential because the host uses it (along with its own IP address) to determine whether a destination IP address is on the same local network or a remote network; without a correctly configured subnet mask, the host cannot make this determination and may misroute traffic. DNS server address is only for name resolution and is not required for IP-level connectivity, MAC address is a Layer 2 address already present on the NIC, and hostname is a local identifier irrelevant to routing.

Answer

DNS server address

Answer

MAC address

Answer

Host name