CCNA Mock Exam 78 — 25 Questions

Question 1

You are connected to SW1 via the console. SW1 is a Layer 2 switch with an access port G0/1 connected to a server. The network administrator has noticed that the server is sending BPDUs, which could cause network instability. You need to configure PortFast and BPDU Guard on port G0/1 to prevent BPDU-related issues and ensure the port transitions to forwarding state immediately.

Accepted Answer

interface G0/1
spanning-tree portfast
spanning-tree bpduguard enable. PortFast allows an access port to bypass STP listening/learning states, providing immediate connectivity. BPDU Guard protects the network by shutting down the port if a BPDU is received, preventing potential loops from unauthorized switches.

Answer

interface G0/1
spanning-tree portfast
spanning-tree guard root

Answer

interface G0/1
spanning-tree portfast
spanning-tree bpdufilter enable

Answer

interface G0/1
spanning-tree portfast
spanning-tree bpduguard default

Question 2

You are connected to R1. The inside network 192.168.1.0/24 must be able to access the internet using PAT (NAT overload) with the outside interface G0/1 IP 203.0.113.1. Additionally, the internal server at 192.168.1.10 must be reachable from the internet via static NAT to 203.0.113.10. The current configuration is incomplete and contains errors. Identify and fix all issues so that both PAT and static NAT work correctly.

Accepted Answer

Swap ip nat inside/outside on interfaces, add 'overload' to the dynamic NAT rule, and correct ACL 1 to permit 192.168.1.0/24.. The configuration had multiple faults: 1) Inside/outside interfaces were swapped – G0/0 (LAN) should be inside, G0/1 (WAN) should be outside. 2) The PAT command was missing the 'overload' keyword. 3) ACL 1 permitted the wrong subnet (192.168.2.0/24 instead of 192.168.1.0/24). 4) The static NAT configuration was correct, but the interface misconfiguration prevented it from working. Fixes: swap ip nat inside/outside on the interfaces, add 'overload' to the dynamic NAT rule, and correct ACL 1 to permit 192.168.1.0/24.

Answer

Change the static NAT inside address to 192.168.1.1 and add 'overload' to the dynamic NAT rule.

Answer

Remove the static NAT configuration and rely solely on PAT for the server.

Answer

Add the 'overload' keyword to the dynamic NAT rule and correct ACL 1 to permit 192.168.1.0/24.

Question 3

You are connected to a multilayer switch MLS1. Configure a static default route for IPv4 that points to next-hop 192.0.2.2, but also configure a floating static default route with an administrative distance of 10 that uses next-hop 198.51.100.2. Additionally, configure a static host route for IPv6 host 2001:db8:1::10/128 via next-hop 2001:db8:1::1. The current configuration has a recursive routing failure for the IPv4 default route because the next-hop 192.0.2.2 is not reachable; you must first fix that by adding a directly connected static route. Ensure the floating route becomes active only when the primary route fails.

Accepted Answer

ip route 0.0.0.0 0.0.0.0 192.0.2.2
ip route 0.0.0.0 0.0.0.0 198.51.100.2 10
ip route 192.0.2.0 255.255.255.252 GigabitEthernet0/0 192.0.2.2
ipv6 route 2001:db8:1::10/128 2001:db8:1::1. The IPv4 primary default route fails because next-hop 192.0.2.2 is not directly connected and no recursive route exists to it. The floating static route with next-hop 198.51.100.2 is in the directly connected Vlan20 subnet (198.51.100.1/30), so it installs without issue. To fix the primary default route, add a directly connected static route for the network containing 192.0.2.2, e.g., ip route 192.0.2.0 255.255.255.252 GigabitEthernet0/0 192.0.2.2. The IPv6 host route is correct if next-hop 2001:db8:1::1 is reachable.

Answer

ip route 0.0.0.0 0.0.0.0 192.0.2.2
ip route 0.0.0.0 0.0.0.0 198.51.100.2 10
ip route 192.0.2.0 255.255.255.0 GigabitEthernet0/0
ipv6 route 2001:db8:1::10/128 2001:db8:1::1

Answer

ip route 0.0.0.0 0.0.0.0 192.0.2.2
ip route 0.0.0.0 0.0.0.0 198.51.100.2 10
ip route 192.0.2.2 255.255.255.255 GigabitEthernet0/0
ipv6 route 2001:db8:1::10/128 2001:db8:1::1

Answer

ip route 0.0.0.0 0.0.0.0 192.0.2.2
ip route 0.0.0.0 0.0.0.0 198.51.100.2 10
ip route 192.0.2.0 255.255.255.252 198.51.100.2
ipv6 route 2001:db8:1::10/128 2001:db8:1::1

Question 4

You are connected to R1. Configure R1 as a DHCP server for VLAN 20 clients (192.168.20.0/24) with DNS server 203.0.113.10 and default gateway 192.168.20.1. On switch SW1, enable DHCP snooping globally and on VLAN 20, configure the uplink to R1 as trusted, and ensure that the DHCP server is reachable via ip helper-address on the VLAN 20 SVI. Currently, clients are not receiving IP addresses because of misconfigurations: the excluded-address range on R1 is too large (excluding the entire subnet), the helper-address on SW1 points to a wrong IP (192.0.2.99), and a rogue DHCP server is connected to port Fa0/3 on SW1. Fix all issues so that clients can get addresses securely.

Accepted Answer

On R1, change the excluded-address range to 192.168.20.1 192.168.20.1; on SW1, configure ip helper-address 10.0.0.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.. The DHCP server had an excluded-address range covering the entire subnet (192.168.20.0–255), which prevented any IP from being assigned. Fix: change the excluded range to only include the gateway (192.168.20.1) and optionally other reserved addresses. The helper-address on SW1 pointed to 192.0.2.99 (nonexistent) instead of the DHCP server at 10.0.0.1; correct it. DHCP snooping was disabled; enable it globally and on VLAN 20, then configure the uplink to R1 (port connecting to R1) as trusted and the port connecting the rogue server (Fa0/3) as untrusted (or simply leave it untrusted by default, but the rogue server will be blocked).

Answer

On R1, remove the excluded-address range entirely; on SW1, configure ip helper-address 192.168.20.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.

Answer

On R1, change the excluded-address range to 192.168.20.1 192.168.20.254; on SW1, configure ip helper-address 192.0.2.99 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, and configure the uplink to R1 as trusted.

Answer

On R1, change the excluded-address range to 192.168.20.1 192.168.20.1; on SW1, configure ip helper-address 10.0.0.1 under interface Vlan20; enable DHCP snooping globally and on VLAN 20, but do not configure any trusted ports.

Question 5

Drag and drop the following steps into the correct order to trace the DNS resolution process from a client query to receiving an A-record response.

Accepted Answer

Client sends DNS query to recursive resolver. The DNS resolution process begins with the client sending a query to a recursive resolver. The resolver then queries a root name server to find the TLD server, followed by querying the TLD server to obtain the authoritative name server, and finally queries the authoritative server for the A-record. Each step depends on the previous because higher-level servers delegate to lower levels.

Question 6

Drag and drop the following commands into the correct order to configure OSPFv3 for IPv6 on a Cisco IOS-XE router.

Accepted Answer

ipv6 unicast-routing. The correct sequence for configuring OSPFv3 on a Cisco IOS-XE router is: first enable IPv6 routing globally with `ipv6 unicast-routing` (A), then create the OSPFv3 process with `router ospfv3 1` (B), then enter interface configuration mode for the desired interface with `interface GigabitEthernet0/0` (C), and finally enable OSPFv3 on that interface using `ipv6 ospf 1 area 0` (D). This order ensures IPv6 is enabled before configuring OSPFv3, the OSPFv3 process exists before it is assigned to an interface, and the interface is selected before applying the OSPFv3 configuration.

Question 7

A subnet requires 200 usable host addresses. Which prefix is the smallest that meets the requirement?

Accepted Answer

/24. A /24 is the smallest valid choice. In plain language, the subnet needs enough total addresses so that after the network and broadcast addresses are reserved, 200 hosts still remain. A /25 is too small because it provides only 126 usable hosts. A /24 provides 254 usable hosts, which satisfies the requirement while being the next logical prefix size up.

This is a standard host-capacity planning question. The key is to work from usable hosts, not just total addresses, and then choose the smallest prefix that actually works.

Answer

/25

Answer

/26

Answer

/27

Question 8

A routing table contains these entries for the same destination space: 10.1.0.0/16, 10.1.10.0/24, and 0.0.0.0/0. Which route is used for traffic to 10.1.10.44?

Accepted Answer

10.1.10.0/24. The 10.1.10.0/24 route is used because it is the most specific matching prefix. In plain language, even though the /16 route and the default route could also match, the /24 route describes the destination range more precisely. Longest-prefix match therefore selects the /24 entry.

This is a foundational route-selection rule. The default route remains important as a fallback, but it is not used when more specific routes exist. Likewise, the /16 route is less specific than the /24, so it loses for this destination.

Answer

10.1.0.0/16

Answer

0.0.0.0/0

Answer

No route, because the entries overlap

Question 9

Drag and drop the following steps into the correct order to configure an LACP EtherChannel on two Cisco switches.

Accepted Answer

Enter global configuration mode on both switches.. To configure LACP EtherChannel on two Cisco switches, the correct order is: first, enter global configuration mode on both switches (A). Next, create the port-channel interface using the 'interface port-channel' command (B). Finally, assign the physical interfaces to the port-channel using the 'channel-group' command with LACP active mode (D). Step C ('Set the LACP mode to active on the physical interfaces') is not a separate step because the mode is configured as part of the channel-group command. Therefore, the proper sequence is A, B, D.

Answer

Set the LACP mode to 'active' on the physical interfaces.

Question 10

You are connected to the console of R1. The network uses IPv6 with EUI-64. R1's GigabitEthernet0/0 interface has MAC address 0011.2233.4455. You must configure the interface to generate an IPv6 link-local address using the 'ipv6 enable' command, and also assign a global unicast address 2001:db8:1::/64 using EUI-64. The interface is currently administratively down.

Accepted Answer

R1(config-if)# ipv6 enable
R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64
R1(config-if)# no shutdown. The ipv6 enable command explicitly creates a link-local address as required by the scenario. The global unicast address with the eui-64 keyword automatically derives the interface ID from the MAC address. Option B is incorrect because it tries to manually configure a link-local address with eui-64, which is unnecessary and invalid. Option C omits the ipv6 enable command, failing the explicit requirement. Option D assigns a static host portion instead of using eui-64.

Answer

R1(config-if)# ipv6 address fe80::/10 eui-64
R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 enable
R1(config-if)# ipv6 address 2001:db8:1::1/64
R1(config-if)# no shutdown

Question 11

Two switches should form an EtherChannel with LACP. One side is set to active and the other is set to passive. If the remaining interface settings match, what is the expected result?

Accepted Answer

The EtherChannel should form successfully.. The EtherChannel should form successfully. In practical terms, active mode initiates LACP negotiation and passive mode listens and responds. Because one side is actively starting the negotiation, the bundle can come up if the interfaces also match in operational settings such as speed, duplex, switchport mode, and VLAN characteristics.

This is a classic LACP pairing question. Active/passive works. Passive/passive is the combination that usually fails to start the bundle.

Answer

The EtherChannel fails because both sides must be active.

Answer

The interfaces automatically become routed ports.

Answer

The switches delete the port-channel automatically.

Question 12

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to two other switches (SW2 and SW3) via redundant links. All switches run IEEE 802.1D Spanning Tree Protocol. The network administrator wants SW1 to become the root bridge for VLAN 1. Currently, the root bridge is SW2. Configure SW1 to achieve this and ensure that port G0/1, which connects to an end device, immediately transitions to forwarding state upon link up and is protected from BPDU attacks.

Accepted Answer

Configure 'spanning-tree vlan 1 root primary' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'.. The 'spanning-tree vlan 1 root primary' command reduces the bridge priority to 24576 (or lower) to ensure SW1 becomes root for VLAN 1. PortFast on G0/1 speeds up access port convergence, and BPDU Guard protects against rogue switches by disabling the port upon BPDU reception.

Answer

Configure 'spanning-tree vlan 1 priority 4096' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree guard root'.

Answer

Configure 'spanning-tree vlan 1 root secondary' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'.

Answer

Configure 'spanning-tree vlan 1 priority 32768' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpdufilter enable'.

Question 13

A network administrator is troubleshooting a Cisco switch that is experiencing high CPU utilization. The administrator suspects a Layer 2 loop. Which command can be used to verify if Spanning Tree Protocol (STP) has blocked any ports due to a loop?

Accepted Answer

show spanning-tree. The show spanning-tree command is the correct tool to verify STP port states, including blocking. It shows the root bridge, port roles, and states for each VLAN, allowing the administrator to confirm if STP has blocked a port to prevent a loop.

Answer

show interfaces status

Answer

show ip interface brief

Answer

show mac address-table

Question 14

Match each WLAN term to its correct description.

Accepted Answer

WLAN. A WLAN (Wireless Local Area Network) enables wireless device connectivity. A Mobility Group is a logical grouping of wireless LAN controllers that facilitate seamless roaming across access points. Roaming refers to the movement of a wireless client from one access point to another without losing connectivity. Fast Roaming implements the 802.11r standard to minimize authentication delays during roaming transitions.

Question 15

You are connected to R1. Configure IPv4 and IPv6 static routes, default routes, and floating static routes so that R1 can reach the Internet via R2 (IPv4 and IPv6). The primary route to the Internet should use next-hop 203.0.113.2 (IPv4) and 2001:db8:203:0:113::2 (IPv6). A backup floating static route with administrative distance 200 must exist for IPv4 only, using next-hop 198.51.100.2. Ensure the default routes are correctly configured and troubleshoot any recursive routing failure. Note: R1 currently has an incorrect IPv6 default route pointing to 2001:db8:198:51:100::2 that must be removed.

Accepted Answer

Remove the incorrect IPv6 default route: no ipv6 route ::/0 2001:db8:198:51:100::2; configure the primary default route: ip route 0.0.0.0 0.0.0.0 203.0.113.2; the floating route is already configured with AD 200; add IPv6 default route: ipv6 route ::/0 2001:db8:203:0:113::2. The IPv4 floating route is already correctly pre-configured with AD 200 to serve as a backup. To meet the requirements, you must add the primary IPv4 default route with default AD 1, remove the existing incorrect IPv6 default route, and add the correct IPv6 default route. Option A correctly identifies these steps, while other options either omit the removal, assign a wrong AD to the primary route, or neglect IPv6 entirely.

Answer

Configure the primary default route: ip route 0.0.0.0 0.0.0.0 203.0.113.2; change the floating route AD to 1; add IPv6 default route: ipv6 route ::/0 2001:db8:203:0:113::2

Answer

Configure the primary default route: ip route 0.0.0.0 0.0.0.0 203.0.113.2 200; the floating route is already configured with AD 200; add IPv6 default route: ipv6 route ::/0 2001:db8:203:0:113::2

Answer

Configure the primary default route: ip route 0.0.0.0 0.0.0.0 203.0.113.2; the floating route is already configured with AD 200; no IPv6 route is needed because IPv6 is not required.

Question 16

Refer to the exhibit. An administrator has configured NAT on router R1 to allow hosts on the 192.168.1.0/24 LAN to access the Internet. However, users report that they cannot reach external websites. The administrator runs the show ip nat translations command. What is the most likely reason for the problem?

Accepted Answer

The ip nat inside command is missing from the LAN-facing interface.. The output of 'show ip nat translations' shows no translations, which indicates that NAT is not being applied to traffic from the LAN. The most common cause is that the 'ip nat inside' command is missing from the LAN-facing interface (e.g., GigabitEthernet0/0). Without this command, the router does not identify the interface as the inside NAT domain, so it never translates the source addresses of packets arriving from the 192.168.1.0/24 subnet.

Answer

The access list used for dynamic NAT does not match the LAN subnet.

Answer

The ip nat outside command is missing from the WAN interface.

Answer

The ip nat inside source static commands have incorrect IP addresses.

Question 17

Match each HTTP method to the most common API action.

Accepted Answer

GET: Retrieve a resource. The correct answer is the ordered matching D, C, A, B: DELETE pairs with Remove, PUT pairs with Update, GET pairs with Retrieve, and POST pairs with Create. Treat the options as one matching sequence, not as four independently correct statements.

Question 18

A network team wants an ACL that permits HTTPS from 10.1.50.0/24 to a web server at 203.0.113.10 and denies all Telnet traffic from that subnet to any destination. Which two ACEs are required?

Accepted Answer

permit tcp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443. To meet the requirement, one ACE must explicitly permit TCP destination port 443 to the web server, and another must deny TCP destination port 23 to any destination. Option C is wrong because HTTPS (port 443) uses TCP, not UDP. Option D reverses source and destination; the deny should apply from 10.1.50.0/24 to any, not from any to that subnet. Option E permits all IP traffic, which would override the deny for Telnet, making it ineffective.

Answer

permit udp 10.1.50.0 0.0.0.255 host 203.0.113.10 eq 443

Answer

deny tcp any 10.1.50.0 0.0.0.255 eq 23

Answer

permit ip any any

Question 19

A router has a static route and a RIP route for the same destination prefix. What is the primary reason the static route is preferred over the RIP route?

Accepted Answer

Because the static route has a lower administrative distance for the same prefix.. The static route is preferred because both routes describe the same destination prefix and the static route has the lower administrative distance. In practical terms, longest-prefix match does not break the tie because the prefixes are equal. The router then compares source trust, and static routing wins over RIP by default.

This is a core route-selection concept and a very exam-relevant comparison.

Answer

Because RIP can never be installed when static routing is configured anywhere.

Answer

Because RIP is valid only for host routes.

Answer

Because static routes are always more specific than RIP routes.

Question 20

Drag and drop the syslog and NTP items on the left to the correct descriptions on the right.

Accepted Answer

Syslog facility: Identifies the type of system or process that generated the log message. Each item is correctly paired with its description: A identifies the syslog facility (the source of the log), B indicates syslog severity (urgency level), C correctly describes an NTP server (time source), and D correctly describes an NTP client (time requester). These are foundational definitions for syslog and NTP operations.