CCNA Practice Test 8 — 10 Questions

Question 1

A multilayer switch must route traffic between VLAN 10 and VLAN 20. Which condition is required for that to happen?

Accepted Answer

SVIs for the VLANs plus Layer 3 routing enabled on the switch. Inter-VLAN routing on a multilayer switch depends on having functional Layer 3 gateway interfaces for the VLANs and routing enabled on the switch. In plain language, the switch needs a routed brain for each VLAN, usually in the form of SVIs, and it must actually be operating as a Layer 3 device rather than only as a pure Layer 2 switch. Without those conditions, traffic may switch inside a VLAN but cannot be routed between different VLANs.

This is a core CCNA design idea because people often assume creating VLANs alone automatically gives them inter-VLAN communication. In reality, VLANs create separation, and routing is what reconnects them under controlled conditions. A trunk between switches can carry VLAN traffic, but it does not itself perform Layer 3 routing between the VLANs. The correct answer is the requirement that makes the switch act as the gateway between VLANs.

Answer

All ports in both VLANs configured as trunks

Answer

A separate OSPF process on every access port

Answer

Port security disabled on every edge port

Question 2

Two switches are connected via an IEEE 802.1Q trunk. Hosts in VLAN 30 on opposite sides cannot communicate, yet hosts in VLAN 10 communicate normally. Both switches have VLAN 30 in their VLAN database, and the trunk link is operational. What is the most likely cause?

Accepted Answer

VLAN 30 is pruned or not allowed on one side of the trunk. If a VLAN is not allowed on one side of the trunk, frames for that VLAN are dropped even though other VLANs continue to work. Option A correctly identifies that VLAN 30 is either pruned or missing from the allowed list on one end. Option B is wrong because the native VLAN only affects untagged frames and would not cause the filtering of a tagged VLAN like VLAN 30. Option C is incorrect because STP can block individual VLANs per port, but it does not block all VLANs on a trunk due to a single VLAN’s issue—only the affected VLAN would be blocked. Option D is invalid because converting the trunk to access mode would break all VLAN trunking, including the working VLAN 10.

Answer

The native VLAN must be set to 30

Answer

STP blocks all VLANs on the trunk when one VLAN fails

Answer

The trunk must be changed to access mode for VLAN 30

Question 3

Based on the exhibit, what is the most likely reason the PPP link is failing to authenticate?

Accepted Answer

The PPP authentication credentials do not match between the two sides.. The most likely reason is a credentials mismatch between the two sides of the PPP authentication setup. In practical terms, PPP authentication requires the peers to agree on the relevant identity and secret information. If those values do not align, the link may come up physically but authentication fails and the logical connection does not establish properly.

This is a very exam-relevant WAN troubleshooting scenario because it focuses on a realistic failure after the transport is already present.

Answer

The interfaces must use HDLC instead of PPP before authentication can work.

Answer

CHAP requires the routers to be in different IPv4 subnets.

Answer

PPP authentication works only over GRE tunnels.

Question 4

Drag and drop the following steps into the correct order to describe how data is encapsulated as it travels down the OSI model layers.

Accepted Answer

Application data is generated by the upper layers.. Data originates at the application layer as user data. The transport layer then encapsulates this data by adding a header (e.g., TCP or UDP) to create a segment. The network layer further adds an IP header to the segment, forming a packet. Next, the data link layer appends a frame header and trailer to the packet, resulting in a frame. Finally, the physical layer converts the entire frame into bits for electrical, optical, or radio transmission. This sequence follows the standard top-down encapsulation process in network communication.

Question 5

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a VLAN 10 subnet and enable DHCP relay for a remote client on VLAN 20.

Accepted Answer

1. Exclude addresses from the pool. 2. Configure the DHCP pool for VLAN 10 with network, default-router, and DNS. 3. Enable DHCP relay on the VLAN 20 interface. 4. Verify DHCP operations.. The correct sequence is to globally exclude IP addresses first, preventing the DHCP server from assigning reserved addresses. Then define the DHCP pool for VLAN 10 with network parameters, enable DHCP relay on the VLAN 20 interface so it forwards requests to the server, and finally verify the service is functioning. Options that place relay before pool or exclusions after pool misorder these essential configuration steps and deviate from recommended practice.

Answer

1. Enable DHCP relay on the VLAN 20 interface. 2. Configure the DHCP pool for VLAN 10. 3. Exclude addresses from the pool. 4. Verify DHCP operations.

Answer

1. Exclude addresses from the pool. 2. Enable DHCP relay on the VLAN 20 interface. 3. Configure the DHCP pool for VLAN 10. 4. Verify DHCP operations.

Answer

1. Configure the DHCP pool for VLAN 10. 2. Enable DHCP relay on the VLAN 20 interface. 3. Exclude addresses from the pool. 4. Verify DHCP operations.

Question 6

Which THREE statements correctly describe the configuration and verification of NAT, PAT, and static NAT?

Accepted Answer

To configure static NAT, use the command 'ip nat inside source static

'.. The 'ip nat inside source static' command creates a one-to-one permanent NAT mapping. Option B is correct because PAT is configured by adding the 'overload' keyword to a dynamic NAT statement that references an ACL and an interface, allowing many private addresses to share a single public IP with different port numbers. Option D is correct: dynamic NAT requires a NAT pool defined with 'ip nat pool' and an access list to identify the inside traffic to be translated. Option C is incorrect because 'show ip nat statistics' only displays counters and summary information, not the active translation entries; those are shown with 'show ip nat translations'. Option E is incorrect because 'show ip interface brief' does not show NAT translation mappings; verification of static NAT requires 'show ip nat translations'.

Answer

The command 'show ip nat statistics' displays the current active translations including inside and outside addresses.

Answer

To verify that static NAT is working, you should check the output of 'show ip interface brief' and look for the translated IP.

Question 7

Exhibit: An access switch shows Gi1/0/10 as err-disabled shortly after an IP phone and a workstation are connected through the same wall jack. What is the most likely cause?

Accepted Answer

The port security maximum is too low for the connected devices. With a phone and a PC on the same access port, the switch may legitimately see two MAC addresses. Port security set to a maximum of 1 causes a violation and can place the interface into err-disabled state.

Answer

The native VLAN is missing

Answer

BPDU Guard blocked the port because a workstation was attached

Answer

DHCP snooping denied the voice VLAN

Question 8

A host is configured with IP address 192.168.70.18/30. Which addresses belong to the same subnet block?

Accepted Answer

192.168.70.16 through 192.168.70.19. A /30 subnet has a block size of 4. In practical terms, the relevant blocks in the last octet are 0–3, 4–7, 8–11, 12–15, 16–19, and so on. Because 18 falls inside the 16–19 block, the subnet includes network address .16, usable hosts .17 and .18, and broadcast .19.

This question checks whether you can identify the correct /30 block and understand all addresses that fall inside it.

Answer

192.168.70.18 through 192.168.70.21

Answer

192.168.70.12 through 192.168.70.15

Answer

192.168.70.20 through 192.168.70.23

Question 9

A REST API call uses the GET method against a device inventory endpoint. What is the most likely intent of the call?

Accepted Answer

To retrieve information from the endpoint.. The most likely intent is to retrieve information, not to create or delete it. In practical terms, GET is commonly used when a client wants to read state or inventory data from an API endpoint. This is one of the most basic REST-style concepts in network automation.

The key is to associate method semantics with likely operational intent.

Answer

To delete the endpoint from the controller.

Answer

To replace the endpoint with a new resource.

Answer

To force the device into PPP mode.

Question 10

Exhibit: A host on VLAN 10 can ping the local SVI but not a server in VLAN 20. The Layer 3 switch has both VLAN interfaces up. What is the next item to verify first?

Accepted Answer

Whether the server in VLAN 20 has the correct default gateway. If the source host can reach its own default gateway, the local VLAN and access port are probably fine. The next practical check is whether the server in VLAN 20 has the correct IP address, mask, and default gateway configured.

Answer

Whether the switch should disable IP routing

Answer

Whether VLAN 10 should be the native VLAN

Answer

Whether the host should use a /8 mask instead of /24