CCNA Mock Exam 81 — 25 Questions

Question 1

Drag and drop the following steps into the correct order to configure OSPFv3 for IPv6 on a Cisco router and verify basic neighbor relationships.

Accepted Answer

Enable IPv6 routing globally with the 'ipv6 unicast-routing' command.. IPv6 unicast routing must be enabled first, as OSPFv3 relies on the router being IPv6 aware. Next, the OSPFv3 process is created globally. The interface must then be IPv6-enabled to auto-generate the link-local address used by OSPFv3 for forming adjacencies. After that, the interface is added to OSPFv3 Area 0. Finally, the 'show ospfv3 neighbor' command is used to verify that an adjacency has formed.

Question 2

You are connected to SW1, a Cisco switch that is experiencing intermittent connectivity issues. The network administrator suspects a duplex mismatch between SW1 and the connected router R1. Use CDP to verify the status and check interface statistics.

Accepted Answer

The switch port is set to half duplex, and the router is set to full duplex, causing CRC errors and late collisions.. The switch port is manually set to half duplex while the router likely negotiates to full duplex, causing a mismatch. CDP output from the switch will show the router's duplex as full. Interface statistics will show increasing CRC errors and late collisions. The solution is to set the switch port to auto-negotiation or match the duplex setting with the router.

Answer

The switch port is set to full duplex, and the router is set to half duplex, causing runts and FCS errors.

Answer

The switch port and router are both set to half duplex, but the cable is faulty, causing CRC errors.

Answer

The switch port is set to auto-negotiation, and the router is set to half duplex, causing late collisions.

Question 3

Refer to the exhibit. A network administrator runs the show vlan brief command on SW2. Interface GigabitEthernet0/2 is intended to be an access port in VLAN 10, but it does not appear in the output. What is the most likely cause?

Accepted Answer

The interface is configured as a trunk port and therefore does not appear under any VLAN in show vlan brief.. The `show vlan brief` command displays only access ports and their assigned VLANs. Trunk ports, which carry multiple VLANs, are not listed in this output. If GigabitEthernet0/2 is configured as a trunk port (e.g., with `switchport mode trunk` or dynamically via DTP), it will not appear under any VLAN in the `show vlan brief` output, even if it is intended to be an access port in VLAN 10.

Answer

The interface is configured with switchport mode dynamic auto and no trunk has been negotiated, causing it to be hidden.

Answer

The interface is administratively shut down, and down ports are excluded from the show vlan brief output.

Answer

VLAN 10 is not active, so the port assigned to it is not displayed in the listing.

Question 4

A DHCP client on VLAN 30 is not receiving an IP address from a DHCP server (10.99.99.20) on another subnet. The SVI for VLAN 30 is configured with an IP address and is up, but the DHCP relay command is missing. Which command should be added to the SVI configuration?

Accepted Answer

ip helper-address 10.99.99.20. DHCP Discover messages are broadcasts and do not cross routers by default. On an SVI or routed interface facing the clients, an ip helper-address relays those broadcasts to the DHCP server on another subnet.

Answer

ip directed-broadcast

Answer

service dhcp-server 10.99.99.20

Answer

default-router 10.99.99.20

Question 5

Which TWO statements correctly describe IPv4 and IPv6 host configuration?

Accepted Answer

APIPA assigns an IPv4 address in the 169.254.0.0/16 range when a DHCP server is unavailable.. APIPA (Automatic Private IP Addressing) automatically assigns an IPv4 address from the 169.254.0.0/16 range when a DHCP server is unavailable, enabling local subnet communication without manual configuration. Option E is correct because the ipconfig command on Windows displays both IPv4 and IPv6 addresses, subnet masks, default gateways, and DNS servers. Option B is incorrect because while IPv6 link-local addresses start with FE80::/10, they are not always assigned using EUI-64; they can also be randomly generated (privacy extensions) or manually configured. Option C is incorrect because EUI-64 generates the interface identifier (host portion) of an IPv6 address from the MAC address, not the network prefix — the prefix is provided via SLAAC, DHCPv6, or manual configuration. Option D is incorrect because a host can have multiple default gateways configured for redundancy, though only one is active at a time per routing table; additionally, IPv4 and IPv6 default gateways are independent and can coexist.

Answer

IPv6 link-local addresses are always assigned using EUI-64 and start with FE80::/10.

Answer

EUI-64 is used to generate the network prefix of an IPv6 address from the interface's MAC address.

Answer

A host can have only one default gateway configured at a time for both IPv4 and IPv6.

Question 6

A network administrator is troubleshooting a connectivity issue between two hosts on different subnets. The administrator captures packets on the source host and notices that the frames contain the correct source and destination MAC addresses but the encapsulated packets have incorrect source and destination IP addresses. According to the OSI model, which layer is most likely responsible for this issue?

Accepted Answer

Network Layer (Layer 3). The Network Layer (Layer 3) is responsible for logical addressing (IP addresses) and routing packets between different subnets. Since the captured frames have correct MAC addresses (Layer 2) but incorrect source and destination IP addresses, the issue lies in how the IP headers are being constructed or assigned, which is a Layer 3 function. This could be caused by misconfigured IP addresses, subnet masks, or default gateways on the source host.

Answer

Physical Layer (Layer 1)

Answer

Data Link Layer (Layer 2)

Answer

Transport Layer (Layer 4)

Question 7

Two switches are connected by a trunk. VLAN 50 exists on both switches, but traffic still fails across the link. The allowed VLAN list is correct. Which additional item should be checked next?

Accepted Answer

Check for a trunk mismatch such as native VLAN inconsistency or other trunk-parameter problems.. After confirming that the VLAN exists on both switches and is allowed on the trunk, another important item to verify is whether the trunk itself is actually operational with the expected encapsulation and whether there is a native VLAN or other trunk inconsistency. In plain language, just because the VLAN is listed does not guarantee the trunk is healthy in every relevant way. Trunking problems can still occur because of broader configuration mismatches.

This question is about disciplined troubleshooting. Once the obvious allowed-list issue is ruled out, the next step is to keep checking other trunk-related characteristics rather than jumping immediately to unrelated routing or service features. The correct answer is the one that stays grounded in trunk-specific verification.

Answer

Reset OSPF process IDs on both switches.

Answer

Add ip helper-address under every access interface.

Answer

Disable the MAC address table.

Question 8

Refer to the exhibit. A network engineer notices that traffic from R1 to the 10.1.0.0/16 network is taking a longer path than expected despite OSPF being the only routing protocol. The engineer examines the OSPF LSDB on R1 to investigate. Based on the output, what is the most likely cause of the suboptimal routing?

Accepted Answer

The ABR is configured with the 'area 1 range 10.1.0.0 255.255.0.0 cost 1000' command.. The OSPF LSDB output shows that the route to 10.1.0.0/16 has a metric of 1000, which is unusually high for an intra-area or inter-area route. The 'area 1 range 10.1.0.0 255.255.0.0 cost 1000' command on the ABR sets a fixed cost for the summarized route, overriding the default OSPF cost calculation. This causes R1 to see a higher metric for the summarized route, leading to suboptimal routing if a lower-cost path exists via another area or router.

Answer

The reference bandwidth has been misconfigured on R1, causing the OSPF cost calculation to be inflated for some links.

Answer

The ABR is filtering the 10.1.0.0/16 route from Area 1 into Area 0, causing the router to recalculate the metric higher.

Answer

The metric-type for OSPF external routes has been set to type 2, causing the metric to be inflated to 1000 for the 10.1.0.0/16 prefix.

Question 9

A user reports that websites can be opened by IP address but not by hostname. Which service is the strongest suspect?

Accepted Answer

DNS. DNS is the strongest suspect because the network path clearly works at the IP layer. In practical terms, if the user can reach the site by numeric address, then routing and basic connectivity are functioning. The missing piece is name resolution, and that is exactly what DNS provides.

This is one of the clearest troubleshooting patterns in networking. If names fail but IP works, start with DNS.

Answer

STP

Answer

PAT

Answer

Port security

Question 10

Which port-security violation mode drops frames from unauthorized MAC addresses but keeps the interface up and does not send an SNMP trap or syslog message?

Accepted Answer

protect. Protect silently drops frames from unauthorized sources while leaving the interface up. Restrict also drops frames but increments the violation counter and can generate notifications.

Answer

restrict

Answer

shutdown

Answer

shutdown vlan

Question 11

Which three options are true regarding the operation of Dynamic ARP Inspection (DAI) on a Cisco switch? (Choose three.)

Accepted Answer

DAI validates ARP packets based on the DHCP snooping binding database.. Dynamic ARP Inspection (DAI) validates ARP packets by intercepting them on untrusted ports and checking the MAC-to-IP address binding against the DHCP snooping binding database. If the binding is invalid or missing, DAI drops the packet, preventing ARP spoofing attacks. This is why all three statements are correct: DAI relies on the DHCP snooping database, drops invalid bindings, and is enabled on untrusted ports facing end hosts.

Answer

DAI prevents rogue DHCP server attacks by inspecting DHCP offers.

Answer

DAI encrypts ARP replies to prevent eavesdropping.

Answer

DAI relies on the MAC address table to validate ARP requests.

Question 12

Drag and drop the following steps into the correct order to describe the router's routing table lookup process from receiving a packet with a destination IP address to making the forwarding decision, including best-path selection criteria.

Accepted Answer

Packet arrival, longest prefix match, tie-breaking using administrative distance and metric, forwarding decision. The process starts with packet arrival, then longest prefix match, followed by tie-breaking using administrative distance and metric, culminating in forwarding.

Answer

Packet arrival, tie-breaking using administrative distance and metric, longest prefix match, forwarding decision

Answer

Packet arrival, longest prefix match, forwarding decision, tie-breaking using administrative distance and metric

Answer

Packet arrival, tie-breaking using administrative distance and metric, forwarding decision, longest prefix match

Question 13

You are connected to SW1 via console. SW1 is a Layer 2 switch connected to two other switches (SW2 and SW3) via trunk links. The network administrator wants to ensure that SW1 becomes the root bridge for VLAN 10 and VLAN 20. Currently, SW2 is the root for both VLANs. Configure SW1 to become the root bridge for these VLANs using the Cisco-recommended macro STP commands.

Accepted Answer

spanning-tree vlan 10 root primary; spanning-tree vlan 20 root primary. The 'spanning-tree vlan <vlan> root primary' command is the Cisco-recommended macro that sets the bridge priority to 24576, which is lower than the default 32768, making SW1 the root bridge for those VLANs. Option A correctly uses this macro. Option C, while it could achieve the same goal by setting priority to 4096, is not the macro command and would be considered a static configuration; the question specifically asks for the appropriate macro commands. Option B sets priority to 28672 as a secondary root, and Option D is invalid syntax.

Answer

spanning-tree vlan 10 root secondary; spanning-tree vlan 20 root secondary

Answer

spanning-tree vlan 10 priority 4096; spanning-tree vlan 20 priority 4096

Answer

spanning-tree vlan 10 root; spanning-tree vlan 20 root

Question 14

Which command output would be the best next step to verify whether the port-channel is operational after configuration changes?

Accepted Answer

show etherchannel summary. The best next step is to check EtherChannel status directly. In practical terms, after fixing the member-link configuration, the quickest verification is to inspect the summary output that shows whether the bundle exists and whether the member ports are actively participating. That is more direct than checking unrelated switching or routing tables.

This is a simulation-style 'what do you verify next' question, which is important for realistic CCNA prep.

Answer

show ip ospf neighbor

Answer

show ip route

Answer

show access-lists

Question 15

An API call returns HTTP status code 401. What does that usually mean?

Accepted Answer

Authentication is required or the credentials are invalid. A 401 response means the request lacks valid authentication credentials. The token may be missing, expired, or invalid.

Answer

The resource was moved permanently

Answer

The request was successful but no content was returned

Answer

The server cannot parse JSON

Question 16

Drag and drop the following steps into the correct order to configure BPDU Guard, Loop Guard, and Root Guard on a Cisco switch.

Accepted Answer

Enter global configuration mode using the configure terminal command.. The correct order starts by entering global configuration mode, then globally enabling PortFast on all access ports to allow immediate transition to forwarding state. BPDU Guard is then enabled globally on all PortFast-enabled ports to protect against unauthorized switches. Next, Loop Guard is enabled globally to prevent loops from unidirectional links. Afterwards, the specific uplink interface is selected and Root Guard is applied to prevent a rogue switch from becoming the root bridge. This sequence follows Cisco best practices: apply fast convergence first, then protect the edge with BPDU Guard, apply loop prevention globally, and finally secure core links with Root Guard.

Question 17

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two VLANs: VLAN 10 (Sales) and VLAN 20 (Engineering). Port G0/1 is connected to a sales PC, and port G0/2 is connected to an engineering PC. You need to ensure that each PC is in the correct VLAN. However, the sales PC is currently unable to ping the engineering PC because they are in different VLANs. You have a router R1 connected to SW1 via port G0/3. Configure inter-VLAN routing using Router-on-a-Stick on R1, and ensure SW1's port G0/3 is properly configured as a trunk.

Accepted Answer

Configure subinterfaces on R1 with encapsulation dot1Q and assign IP addresses in VLAN 10 and VLAN 20. Configure SW1 interface G0/3 as a trunk port.. Router-on-a-Stick requires the router's physical interface to be divided into subinterfaces, each tagged with 802.1Q encapsulation for a specific VLAN and assigned an IP address that serves as that VLAN's default gateway. The switch port facing the router must be configured as a trunk so it can carry tagged frames for both VLAN 10 and VLAN 20. This combination lets R1 route between the two VLANs while SW1 remains a Layer 2 device.

Answer

Configure a routed port on SW1 G0/3 and assign an IP address. Then configure static routes on R1 to reach each VLAN.

Answer

Configure SW1 interface G0/3 as an access port in VLAN 10. Then configure R1 with a single IP address in VLAN 10 and enable proxy ARP.

Answer

Configure SW1 interface G0/3 as a trunk port. Then configure R1 with a single IP address on the physical interface and enable VLAN routing using the 'vlan' command.

Question 18

A host is configured with 172.16.10.62/27. Which address is the broadcast address for that subnet?

Accepted Answer

172.16.10.63. A /27 uses blocks of 32 addresses. In plain language, the last-octet ranges are 0–31, 32–63, 64–95, and so on. Since the host address ends in 62, it belongs to the 32–63 block. The last address in that block is the broadcast address, so the broadcast is 172.16.10.63.

This is a classic subnetting question because it requires you to place the host inside the correct block and then identify the last address in that block rather than guessing based on the host value alone.

Answer

172.16.10.31

Answer

172.16.10.32

Answer

172.16.10.64

Question 19

A network engineer configures a primary default route via Gi0/0 (next-hop 192.168.12.2) and a floating static default route via Gi0/1 (next-hop 192.168.12.6) with AD 200. To test failover, the engineer issues the shutdown command on Gi0/0. After this, the router does not have a default route in the routing table. Which problem explains this behavior?

Accepted Answer

The backup interface Gi0/1 is administratively down, making the next-hop unreachable.. A floating static route only installs in the routing table when its administrative distance is higher than the primary route's and the primary route is removed. When Gi0/0 is shut down, the primary static default route is withdrawn, but the floating static via Gi0/1 cannot be installed because Gi0/1 itself is administratively down, so its next-hop 192.168.12.6 is unreachable. A static route requires a valid, reachable outgoing interface (and for non-point-to-point, a resolvable next-hop) before it can be placed in the RIB.

Answer

The floating static route uses an administrative distance of 200, which is too low to replace the primary route.

Answer

The primary default route remains in the routing table because shutting down Gi0/0 does not remove the static route.

Answer

The floating static route is missing a track object, so the router cannot detect the primary path failure.

Question 20

You are connected to R1 via the console. R1 is a router that connects to the internet via GigabitEthernet0/0 (198.51.100.1/30) and to the internal network via GigabitEthernet0/1 (10.1.1.1/24). You need to implement a security policy that permits HTTP traffic (port 80) from the internal network to a web server at 10.1.1.100, and denies all other traffic from internal hosts to the internet. The ACL should be named 'INTERNET-FILTER' and applied inbound on GigabitEthernet0/1.

Accepted Answer

ip access-list extended INTERNET-FILTER
 permit tcp 10.1.1.0 0.0.0.255 host 10.1.1.100 eq 80
 deny ip 10.1.1.0 0.0.0.255 any
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in. The named extended ACL filters traffic based on source, destination, and protocol. The permit allows HTTP from internal to the web server. The deny blocks all other internal-to-internet traffic. Applying it inbound on the internal interface filters traffic as it enters the router.

Answer

ip access-list standard INTERNET-FILTER
 permit 10.1.1.0 0.0.0.255
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in

Answer

ip access-list extended INTERNET-FILTER
 permit tcp host 10.1.1.100 10.1.1.0 0.0.0.255 eq 80
 deny ip any any
!
interface GigabitEthernet0/1
 ip access-group INTERNET-FILTER in

Answer

ip access-list extended INTERNET-FILTER
 permit tcp 10.1.1.0 0.0.0.255 host 10.1.1.100 eq 80
 deny ip any any
!
interface GigabitEthernet0/0
 ip access-group INTERNET-FILTER in