CCNA Mock Exam 76 — 25 Questions

Question 1

You are connected to R1 via console. R1 and R2 are connected via two serial links: Serial0/0/0 (10.0.0.1/30) and Serial0/0/1 (10.0.0.5/30). OSPF is configured on both links. However, the OSPF neighbor adjacency is stuck in EXSTART/EXCHANGE state. You suspect a mismatch in OSPF parameters. You need to identify and fix the issue.

Accepted Answer

Check and adjust the MTU on the serial interfaces to match.. The adjacency stuck in EXSTART/EXCHANGE is often due to an MTU mismatch. If one interface has a lower MTU, the DBD packets may be fragmented or rejected, preventing the exchange of LSAs. Setting the same MTU on both sides resolves the issue.

Answer

Check and adjust the OSPF hello and dead timers to match.

Answer

Check and adjust the OSPF network type on the interfaces to match.

Answer

Check and adjust the OSPF area ID on the interfaces to match.

Question 2

Which TWO statements correctly describe the behavior of the passive-interface command in single-area OSPFv2?

Accepted Answer

It prevents the router from sending Hello packets on the specified interface.. The passive-interface command in OSPFv2 suppresses all OSPF protocol packets (Hello, DD, LSR, LSU, LSAck) on the specified interface, preventing neighbor adjacency formation. However, the network prefix of that interface is still included in the router LSA and advertised through active interfaces to the OSPF domain. Option A is correct because Hello packets are suppressed. Option C is correct because the prefix is still advertised in LSAs. Option B is incorrect after rewording: it states that the network is not advertised, which is false. Option D is incorrect because passive-interface does not affect data traffic forwarding. Option E is incorrect because the network remains in the OSPF routing table.

Answer

It prevents the router from advertising the network in OSPF LSAs.

Answer

It disables the interface for any OSPF traffic, including data traffic.

Answer

It removes the network from the OSPF routing table.

Question 3

Two switches are connected by an 802.1Q trunk. Hosts in VLAN 30 cannot communicate across the link, but VLAN 10 works. What is the most likely cause?

Accepted Answer

VLAN 30 is missing from the allowed VLAN list on SW2. When one VLAN works across a trunk but another does not, the most likely cause is that the failing VLAN is missing from the allowed VLAN list on one or both switches. This is often confirmed by a 'show interfaces trunk' command. Option B is incorrect because removing VLAN 10 would break an already working VLAN and does not address VLAN 30. Option C is incorrect because both ISL and 802.1Q carry multiple VLANs; the issue is not the encapsulation protocol. Option D is incorrect because changing a trunk port to access mode would disable the trunk entirely, preventing all VLAN traffic.

Answer

VLAN 10 must be removed for VLAN 30 to pass

Answer

The trunk should use ISL instead of 802.1Q

Answer

The port on SW1 should be changed to access mode

Question 4

A switch port configured with PortFast and BPDU Guard receives a BPDU and transitions to an error-disabled state. Which statement best explains why this is considered useful protection?

Accepted Answer

It prevents a port expected to be an edge port from accidentally becoming part of the switching topology and causing loops.. PortFast is used on edge ports to bypass STP listening/learning, but if a BPDU is received, the assumption that the port is an edge port is violated. BPDU Guard then error-disables the port to prevent potential loops or topology disruptions. This protects the network when an edge port unexpectedly connects to another switch, which could cause a bridging loop. The other options describe unrelated features or incorrect mechanisms.

Answer

It increases the port's bandwidth by combining multiple links.

Answer

It automatically enables VLAN trunking on the port.

Answer

It forces the port to use Rapid Spanning Tree Protocol for faster convergence.

Question 5

You are connected to R1. The network has two routers (R1 and R2) connected via a serial link (S0/0/0). R1's GigabitEthernet0/0 connects to the 192.168.1.0/24 LAN. An extended ACL must be configured on R1 to permit only HTTPS traffic (TCP port 443) from host 192.168.1.10 to server 203.0.113.5 (reachable via R2), and deny all other traffic from the LAN to the server. Currently, the ACL is applied inbound on G0/0 but valid HTTPS traffic is being blocked. Troubleshoot and fix the configuration.

Accepted Answer

The ACL is missing an explicit permit statement for HTTPS traffic from host 192.168.1.10 to server 203.0.113.5, and the current permit ip any any allows all traffic, including HTTP, which violates the requirement to deny HTTP.. Valid HTTPS is blocked because the current ACL does not have an effective ACE permitting TCP/443 from 192.168.1.10 to 203.0.113.5; the implicit deny at the end drops that traffic. A reachable `permit ip any any` would allow HTTPS, so if such an ACE appears in the configuration it is not the effective match for this flow. The correct fix adds an explicit permit for TCP 443 from the host to the server, denies HTTP and all other IP traffic from the LAN to the server, and then permits all other IP traffic.

Answer

The ACL is applied inbound on G0/0, but it should be applied outbound on G0/0 to filter traffic leaving the LAN.

Answer

The ACL should be applied to the serial interface S0/0/0 instead of G0/0 to filter traffic going to R2.

Answer

The ACL is missing a deny statement for all other traffic from the LAN to the server, and the permit ip any any allows everything, including unwanted traffic.

Question 6

Drag and drop the cable/transceiver types on the left to the correct distance and speed descriptions on the right.

Accepted Answer

Cat5e UTP: 100 meters, 1 Gbps. Option A is correct: Cat5e UTP supports 1000BASE-T at 100 m and 1 Gbps. Option B is incorrect: Cat6 supports 10GBASE-T only up to 55 m; it requires Cat6A for 100 m at 10 Gbps. Option C is correct: 1000BASE-LX over single-mode fiber has a standard reach of 5 km at 1 Gbps. Option D is correct: 1000BASE-SX over 50 µm multimode fiber has a standard reach of 550 m at 1 Gbps.

Answer

Cat6 UTP: 100 meters, 10 Gbps

Question 7

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits web traffic from the 10.1.1.0/24 network to the server 192.168.2.10 while blocking all other traffic inbound on GigabitEthernet0/1.

Accepted Answer

Step 1: Define the ACL with permit and deny statements. Step 2: Apply the ACL inbound on GigabitEthernet0/1. Step 3: Verify the ACL configuration.. ACL configuration requires defining permit/deny statements first, then applying to the interface inbound, and finally verification.

Answer

Step 1: Apply the ACL inbound on GigabitEthernet0/1. Step 2: Define the ACL with permit and deny statements. Step 3: Verify the ACL configuration.

Answer

Step 1: Define the ACL with permit and deny statements. Step 2: Verify the ACL configuration. Step 3: Apply the ACL inbound on GigabitEthernet0/1.

Answer

Step 1: Apply the ACL inbound on GigabitEthernet0/1. Step 2: Verify the ACL configuration. Step 3: Define the ACL with permit and deny statements.

Question 8

Drag and drop the following steps into the correct order to describe the router's routing table lookup process for a destination IP address, including best-path selection using longest prefix match, administrative distance, and metric.

Accepted Answer

1. Perform longest prefix match on the destination IP address against all routes in the routing table.
2. If multiple routes match, compare administrative distances; choose the route with the lowest AD.
3. If multiple routes have the same AD, compare metrics; choose the route with the lowest metric.
4. Forward the packet using the selected route.. The order follows the router's decision process: longest prefix match first, then administrative distance, then metric, leading to the forwarding decision.

Answer

1. Compare administrative distances of all routes; choose the route with the lowest AD.
2. Perform longest prefix match on the destination IP address against the remaining routes.
3. If multiple routes have the same AD, compare metrics; choose the route with the lowest metric.
4. Forward the packet using the selected route.

Answer

1. Perform longest prefix match on the destination IP address against all routes in the routing table.
2. If multiple routes match, compare metrics; choose the route with the lowest metric.
3. If multiple routes have the same metric, compare administrative distances; choose the route with the lowest AD.
4. Forward the packet using the selected route.

Answer

1. Compare metrics of all routes; choose the route with the lowest metric.
2. Perform longest prefix match on the destination IP address against the remaining routes.
3. If multiple routes have the same metric, compare administrative distances; choose the route with the lowest AD.
4. Forward the packet using the selected route.

Question 9

Drag and drop the following steps into the correct order to troubleshoot a suspected duplex mismatch and CRC errors on a Cisco switch interface.

Accepted Answer

Enter privileged EXEC mode using the 'enable' command.. The correct troubleshooting sequence starts with entering privileged EXEC mode (step A) because 'show' and 'configure' commands require it. Next, use the 'show interfaces' command (step B) to check for CRC errors and duplex mismatch on the interface. Then, enter global configuration mode (step D) to access interface configuration. Finally, configure the interface with the 'duplex full' command (step C) to fix the mismatch. Placing step C before step D would be invalid because you must be in global configuration mode before you can configure an interface.

Question 10

PCs in VLAN 40 are not receiving addresses from the centralized DHCP server at 172.16.1.10. What should be configured on the VLAN 40 default gateway interface?

Accepted Answer

ip helper-address 172.16.1.10. When DHCP clients and the DHCP server are on different subnets, the router interface serving the client subnet must relay broadcasts to the server with the ip helper-address command.

Answer

ip dhcp excluded-address 10.40.40.1 10.40.40.10

Answer

service dhcp

Answer

ip default-gateway 172.16.1.10

Question 11

Which four of the following are characteristics of Dynamic Trunking Protocol (DTP) and VLAN Trunking Protocol (VTP) used in Cisco switching? (Choose four.)

Accepted Answer

A switch configured with 'switchport mode dynamic desirable' actively attempts to form a trunk using DTP.. The four correct statements are: (1) DTP is a Cisco proprietary protocol for negotiating trunk links; (2) VTP synchronizes VLAN information across switches in the same VTP domain; (3) 'switchport mode dynamic desirable' actively sends DTP frames to form a trunk; (4) VTP pruning reduces unnecessary broadcast traffic by limiting flooded traffic to only switches that need the VLAN. The two incorrect statements: VTP transparent mode forwards VTP advertisements but does **not** modify its VLAN database based on received updates—it only passes them through. DTP **cannot** form a trunk when both ends are configured with 'switchport nonegotiate' because that command disables DTP frame transmission entirely, preventing trunk negotiation.

Answer

VTP transparent mode stores and forwards VTP advertisements but also modifies the VLAN database based on received updates.

Answer

DTP can form a trunk regardless of whether both ends are configured with 'switchport nonegotiate'.

Question 12

You are connected to SW1 via the console. SW1 is a Layer 2 switch. Ports G0/1 and G0/2 are connected to two PCs that should be in VLAN 10 (Sales). Port G0/3 is a trunk link to another switch. The PCs are currently unable to communicate because the ports are in VLAN 1. Configure the switch to place the ports in the correct VLAN and ensure the trunk is properly configured with 802.1Q encapsulation and native VLAN 99.

Accepted Answer

Create VLAN 10, assign G0/1 and G0/2 as access ports in VLAN 10, configure G0/3 as trunk with encapsulation dot1q and native VLAN 99.. VLAN 10 must be created and the access ports must be explicitly set to access mode with 'switchport mode access' before assigning them to VLAN 10. Assigning the access ports to VLAN 10 places the PCs in the correct broadcast domain. The trunk needed explicit 802.1Q encapsulation and a native VLAN change to 99 for security and consistency.

Answer

Create VLAN 10, assign G0/1 and G0/2 as access ports in VLAN 10, configure G0/3 as trunk with encapsulation isl and native VLAN 99.

Answer

Create VLAN 10, assign G0/1 and G0/2 as trunk ports in VLAN 10, configure G0/3 as trunk with encapsulation dot1q and native VLAN 99.

Answer

Create VLAN 10, assign G0/1 and G0/2 as access ports in VLAN 10, configure G0/3 as trunk with encapsulation dot1q and native VLAN 1.

Question 13

You are connected to R1. The network administrator wants to permit only HTTPS traffic (TCP port 443) from the 192.0.2.0/24 network to the 203.0.113.0/24 network, while denying all other IP traffic. Currently, an ACL applied inbound on G0/1 is blocking all traffic, including HTTPS. Identify the issue and correct the ACL configuration so that only HTTPS traffic is permitted.

Accepted Answer

Remove the existing ACL, then create an extended ACL with a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443, and apply it inbound on G0/1.. The ACL BLOCK_IN currently has a single deny ip any any entry, which blocks all traffic inbound on G0/1. The correct solution is to first remove the existing ACL, then create a new extended ACL that permits TCP 443 from source network 192.0.2.0/24 to destination network 203.0.113.0/24, and apply it inbound on G0/1. The implicit deny at the end of the ACL will then block all other traffic, achieving the desired policy.

Answer

Add a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443 before the existing deny ip any any entry in the ACL.

Answer

Remove the existing ACL and create a standard ACL with permit 192.0.2.0 0.0.0.255, then apply it inbound on G0/1.

Answer

Remove the existing ACL and create an extended ACL with a permit statement for tcp any any eq 443, then apply it inbound on G0/1.

Question 14

Exhibit: A company wants to export traffic statistics from routers to a collector for visibility into top talkers and application usage. Which two statements are accurate?

Accepted Answer

NetFlow can export flow data to a collector. NetFlow exports flow records to a collector and is useful for traffic analysis and accounting visibility, enabling identification of top talkers and application usage (options A and B are correct). Syslog reports events and messages, but does not replace flow records for conversation-level traffic statistics, so option C is incorrect. NetFlow does not replace routing protocols for path selection; it is a traffic monitoring tool, not a routing mechanism, so option D is incorrect. NetFlow works on routers and Layer 3 switches, not only Layer 2 switches, so option E is incorrect.

Answer

Syslog and NetFlow are the same feature with different names

Answer

NetFlow replaces routing protocols for path selection

Answer

NetFlow only works on Layer 2 switches and never on routers

Question 15

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to a PC on port G0/1. The network administrator wants to secure the port by allowing only two MAC addresses and enabling sticky MAC learning. Additionally, if a violation occurs, the port should be put into error-disabled state. Configure port security on G0/1 with maximum MAC addresses of 2, sticky learning, and shutdown violation mode.

Accepted Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation shutdown. Port security restricts access based on MAC addresses. The first command, `switchport port-security`, enables port security on the interface. With sticky, learned MACs are saved to the running config; `shutdown` violation mode places the port in error-disable state, requiring manual recovery. Option A includes all required commands in the correct order. Option B uses `restrict`, which drops traffic but does not errdisable. Option C uses `protect`, which drops silently without logging. Option D manually configures a specific MAC instead of enabling sticky learning, so it does not meet the requirement for sticky.

Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation restrict

Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation protect

Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address 0000.1111.2222
SW1(config-if)# switchport port-security violation shutdown

Question 16

Which three of the following are characteristics of Layer 2 Ethernet switches that improve network performance? (Choose three.)

Accepted Answer

They forward frames based on the destination MAC address.. Layer 2 Ethernet switches improve network performance by creating separate collision domains per port, eliminating collisions between devices on different ports. They forward frames based on the destination MAC address, enabling efficient hardware-based switching. Cut-through switching reduces latency by starting to forward as soon as the destination MAC address is read. The other options are incorrect: switches do not reduce broadcast domains (broadcasts are forwarded to all ports in the same VLAN unless a router or VLAN segmentation is used); switches operate at Layer 2 using MAC addresses, not IP addresses; and unknown unicast frames are flooded out all ports except the incoming port, not automatically blocked, to ensure connectivity if the destination is unknown.

Answer

They automatically block all unknown unicast frames.

Answer

They reduce the number of broadcast domains.

Answer

They use IP addresses to make forwarding decisions.

Question 17

What is the best explanation for why a router chooses the OSPF route to 10.50.0.0/16 instead of the RIP route?

Accepted Answer

Because OSPF has a lower administrative distance than RIP for the same prefix.. The router chooses the OSPF route because when the prefix length is the same, source preference is considered, and OSPF has a lower administrative distance than RIP. In practical terms, both routes describe the same destination size, so longest-prefix match does not separate them. The router then trusts the OSPF source more than RIP by default.

This is a classic administrative-distance comparison question and a very important route-selection concept.

Answer

Because RIP routes are never installed when OSPF is running.

Answer

Because OSPF always has a longer prefix than RIP.

Answer

Because the RIP metric is lower than the OSPF metric.

Question 18

R1 and R2 are directly connected and running OSPF. They can ping each other, the area matches, and the timers match, but they still do not become neighbors. What is the most likely cause?

Accepted Answer

The OSPF authentication keys do not match.. The most likely cause is a mismatch in OSPF authentication keys. Even though the routers have IP connectivity, matching area IDs, and identical timers, OSPF adjacency requires that authentication parameters also match. If authentication is enabled on both sides but the keys differ, OSPF packets are silently rejected, preventing neighbor formation.

Answer

The subnet mask is too small for OSPF to operate.

Answer

The routers must use different process IDs.

Answer

The interfaces must be configured as switch trunks.

Question 19

Which TWO statements correctly describe the configuration and verification of IPv4 and IPv6 parameters for host connectivity, including default gateway, DNS, and subnet masks?

Accepted Answer

The default gateway must be on the same subnet as the host's IP address.. A host's default gateway must be on the same subnet to be reachable at Layer 2; otherwise, a circular dependency occurs. Option D is correct because the 'ipconfig /all' command displays both IPv4 and IPv6 configuration details, including IP address, subnet mask, default gateway, and DNS servers. Option A is wrong because the subnet mask determines the network and host portions of an IP address, not the DNS server address. Option C is wrong because IPv6 hosts can obtain their IP address via SLAAC, DHCPv6, or static configuration; the phrase 'can only' makes it incorrect. Option E is wrong because the default gateway must be reachable (on the same subnet) and configured with an IP address that belongs to a router interface on that subnet, not just any IP address.

Answer

The subnet mask determines the DNS server address used by the host.

Answer

IPv6 hosts can only obtain their IP address via DHCPv6.

Answer

A host can reach any remote network if its default gateway is configured with any IP address.

Question 20

SW1 is the root bridge for VLAN 10. A user switch receives a BPDU on an access port connected to a desk-side unmanaged switch. What should happen if BPDU Guard is enabled on that port?

Accepted Answer

The port is moved to err-disabled state. BPDU Guard is designed to protect edge ports. If a BPDU is received on a PortFast access port, the switch places the interface into the err-disabled state to stop a potential Layer 2 loop or rogue switch.

Answer

The port transitions to forwarding more quickly

Answer

The switch elects a new root bridge

Answer

The port becomes a trunk automatically