CCNA Mock Exam 87 — 25 Questions

Question 1

Drag and drop the following steps into the correct order to configure Root Guard on designated ports, Loop Guard on non-designated ports, and BPDU Guard on PortFast ports, and then recover a port that enters err-disabled state.

Accepted Answer

1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Enable errdisable recovery globally. 5. Re-enable the err-disabled port manually.. The correct sequence applies STP protections to their proper port roles: Root Guard on designated ports to prevent unexpected superior BPDUs, Loop Guard on non-designated ports to prevent unidirectional link failure from causing loops, and BPDU Guard on PortFast ports to block rogue switches. Distractors B and D are wrong because they mismatch the guard types to port roles (e.g., B puts Loop Guard on designated, Root Guard on non-designated; D does the opposite). Distractor C incorrectly reverses the recovery steps by re-enabling the port before enabling errdisable recovery globally, and it also reorders protection configuration without logical benefit.

Question 2

Drag and drop the following steps into the correct order to configure HSRP on a Cisco IOS-XE router, including priority, preempt, virtual IP, and then verify the active/standby election and failover process.

Accepted Answer

1. Configure the interface with an IP address. 2. Set the HSRP virtual IP address. 3. Configure the HSRP priority. 4. Enable HSRP preempt. 5. Verify HSRP status. 6. Test failover.. First, the interface is configured. Then the virtual IP is set, followed by priority and preempt. Verification confirms the election, and failover testing demonstrates the preempt mechanism works.

Answer

1. Configure the interface with an IP address. 2. Set the HSRP virtual IP address. 3. Enable HSRP preempt. 4. Configure the HSRP priority. 5. Verify HSRP status. 6. Test failover.

Answer

1. Configure the interface with an IP address. 2. Configure the HSRP priority. 3. Set the HSRP virtual IP address. 4. Enable HSRP preempt. 5. Verify HSRP status. 6. Test failover.

Answer

1. Configure the HSRP virtual IP address. 2. Configure the interface with an IP address. 3. Configure the HSRP priority. 4. Enable HSRP preempt. 5. Verify HSRP status. 6. Test failover.

Question 3

Drag and drop the following steps into the correct order to send a RESTCONF GET request to retrieve interface configuration from a Cisco IOS-XE device and apply a configuration change based on the response.

Accepted Answer

Send GET request to retrieve current interface configuration. The correct workflow is to first retrieve the current configuration with a GET request, then analyze the response to understand what changes are needed, create the updated payload in JSON or XML, and finally apply the change using PUT or PATCH.

Question 4

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router.

Accepted Answer

Enter global configuration mode, define inside and outside interfaces, create a NAT pool with the public IP address range, and enable overload on the pool.. The correct sequence is: enter global configuration mode, designate inside and outside interfaces, create the NAT pool, and then enable overload on the pool. Interfaces must be designated first so that NAT translation can identify which interfaces are inside/outside. The pool must exist before you apply overload to it; otherwise the overload command will refer to an undefined pool. The other options incorrectly place the pool creation or overload instruction before interface designation or in an impossible order.

Question 5

Drag and drop the following steps into the correct order to configure OSPFv3 for IPv6 on a Cisco IOS-XE router and verify the OSPFv3 neighbor adjacency and route installation.

Accepted Answer

Enable IPv6 routing globally. The correct sequence ensures IPv6 routing is enabled first, then the OSPFv3 process is created, applied to the interface, and finally verified for adjacency and route installation.

Answer

Configure OSPFv3 process and router ID

Answer

Enable OSPFv3 on the interface

Answer

Verify OSPFv3 neighbor adjacency and route installation

Question 6

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

1. Enter global configuration mode. 2. Configure RADIUS server host and key. 3. Enable AAA globally. 4. Define an authentication method list for 802.1X. 5. Enter interface configuration mode. 6. Enable 802.1X port authentication. 7. Apply the authentication method list to the interface. 8. Verify configuration.. The correct order begins by entering global configuration mode, then configuring the RADIUS server host and key before enabling AAA globally. Although AAA can be enabled without a RADIUS server, Cisco recommends defining the server before creating the authentication method list that references it to avoid configuration errors. After enabling AAA, define the authentication method list for 802.1X, then enter interface configuration mode, enable 802.1X port authentication, apply the method list to the interface, and finally verify the configuration.

Question 7

Drag and drop the following steps into the correct order to configure RSTP and enable PortFast with BPDU Guard on a switch port, then verify the state transitions.

Accepted Answer

Configure RSTP mode globally, then enable PortFast on the interface, then enable BPDU Guard on the interface, then verify the port state transitions.. Correct order: First configure RSTP globally because interface commands like PortFast and BPDU Guard depend on the spanning-tree mode being set. Next enable PortFast on the interface to immediately transition to forwarding. Then enable BPDU Guard as a protective feature for PortFast ports. Finally verify state transitions. Other orders are incorrect: enabling PortFast or BPDU Guard before setting RSTP mode may cause the commands to be rejected or not take effect; enabling BPDU Guard before PortFast is not typical because BPDU Guard is designed to protect PortFast ports.

Question 8

Drag and drop the following steps into the correct order to plan, configure, and apply an extended ACL that permits web traffic from the 10.1.1.0/24 network to the server 192.168.2.10 while blocking all other traffic inbound on GigabitEthernet0/1.

Accepted Answer

Step 1: Define the ACL with permit and deny statements. Step 2: Apply the ACL inbound on GigabitEthernet0/1. Step 3: Verify the ACL configuration.. ACL configuration requires defining permit/deny statements first, then applying to the interface inbound, and finally verification.

Answer

Step 1: Apply the ACL inbound on GigabitEthernet0/1. Step 2: Define the ACL with permit and deny statements. Step 3: Verify the ACL configuration.

Answer

Step 1: Define the ACL with permit and deny statements. Step 2: Verify the ACL configuration. Step 3: Apply the ACL inbound on GigabitEthernet0/1.

Answer

Step 1: Apply the ACL inbound on GigabitEthernet0/1. Step 2: Verify the ACL configuration. Step 3: Define the ACL with permit and deny statements.

Question 9

Drag and drop the following steps into the correct order to install a new fiber optic cable and SFP module on a Cisco switch, then verify the interface status.

Accepted Answer

Insert the SFP module into the port while the switch is powered on. The correct procedure for installing a fiber optic cable and SFP module on a modern Cisco switch is to insert the SFP module into the port while the switch is powered on, as most Cisco switches support hot-swapping of SFP modules to minimize network downtime. Then, connect the fiber optic cable to the SFP module, ensuring proper alignment and locking. Finally, verify the interface status using 'show interfaces status' to confirm the link is up and operational. Powering down the switch is unnecessary and contradicts hot-swappable design, while connecting the cable before inserting the SFP or skipping the SFP module entirely are incorrect because the switch port requires an SFP to convert electrical signals to optical.

Question 10

Drag and drop the following steps into the correct order for the router's routing table lookup process when forwarding a packet to a destination IP address, including the best-path selection logic.

Accepted Answer

1. Match the destination IP address with the longest prefix in the routing table. 2. If multiple routes match, select the route with the lowest administrative distance. 3. If still multiple routes, select the route with the lowest metric.. The routing table lookup first matches the destination with the longest prefix, then applies tie-breakers: lowest administrative distance, then lowest metric, to determine the best path for forwarding.

Answer

1. Match the destination IP address with the longest prefix in the routing table. 2. If multiple routes match, select the route with the lowest metric. 3. If still multiple routes, select the route with the lowest administrative distance.

Answer

1. Match the destination IP address with any prefix in the routing table (first match). 2. If multiple routes match, select the route with the lowest administrative distance. 3. If still multiple routes, select the route with the lowest metric.

Answer

1. Match the destination IP address with the longest prefix in the routing table. 2. If multiple routes match, select the route with the lowest metric. 3. If still multiple routes, select the route with the highest administrative distance.

Question 11

Drag and drop the following steps into the correct order to configure a single-area OSPFv2 network on two Cisco routers (R1 and R2) and observe the neighbor state transitions from Down to Full.

Accepted Answer

Configure OSPF process and router-id on R1, then add the network; repeat on R2; ensure interfaces are up; finally verify neighbor states.. First configure OSPF process and router-id on R1, then add the network; repeat on R2; ensure interfaces are up; finally verify neighbor states to see the full transition sequence.

Answer

Configure OSPF process and router-id on R1, then ensure interfaces are up; repeat on R2; add the network; finally verify neighbor states.

Answer

Ensure interfaces are up on both routers, then configure OSPF process and router-id on R1; add the network; repeat on R2; finally verify neighbor states.

Answer

Configure OSPF process and router-id on R1, then add the network; ensure interfaces are up; repeat on R2; finally verify neighbor states.

Question 12

Drag and drop the following steps into the correct order to configure PortFast and BPDU Guard on a switch interface, then verify and recover after a BPDU guard error-disable event.

Accepted Answer

Enter global configuration mode, then interface configuration mode, enable PortFast, enable BPDU Guard, verify with 'show spanning-tree interface <int> detail', and recover by issuing 'shutdown' followed by 'no shutdown'.. The order is global config, interface, PortFast, BPDU Guard, then verification; recovery after a BPDU guard event requires clearing the error-disable state by cycling the interface.

Question 13

Drag and drop the following steps into the correct order to configure PAT (Port Address Translation) on a Cisco IOS-XE router for outbound traffic, including ACL creation, NAT statement, interface marking, and the translation process for an outbound packet.

Accepted Answer

Enter global configuration mode, mark inside and outside interfaces, create an ACL to match internal traffic, apply NAT with overload using the outside interface.. The correct sequence is: enter global configuration mode, mark the inside and outside interfaces with 'ip nat inside' and 'ip nat outside', then create an ACL to match internal traffic, and finally apply the NAT overload statement using the outside interface. This order ensures the NAT process knows which interfaces are designated as inside/outside before matching and translating traffic. Option B follows this standard recommended order.

Answer

Enter global configuration mode, create an ACL to match internal traffic, apply NAT with overload using the outside interface, mark inside and outside interfaces.

Question 14

Drag and drop the following steps into the correct order to sequence the DNS resolution process from a client query to receiving an A-record response, including the use of nslookup and dig for diagnosis.

Accepted Answer

Client sends DNS query to configured recursive resolver (e.g., ISP or public DNS). DNS resolution starts with the client query, then recursive server lookups, authoritative response, caching and reply, and finally diagnostic tools like nslookup or dig to verify.

Question 15

Drag and drop the following steps into the correct order to sequence NTP stratum hierarchy and configure an IOS-XE NTP client with syslog message processing from event to log server.

Accepted Answer

Stratum 0 (atomic clock) → Stratum 1 (primary server) → Stratum 2 (secondary server) → Configure NTP client with 'ntp server' command → Enable logging with 'logging buffered' or 'logging host' → Syslog messages timestamped with NTP time. NTP time flows from lower stratum numbers (most accurate) to higher stratum numbers. The correct order is Stratum 0 (atomic clock) → Stratum 1 (primary server) → Stratum 2 (secondary server). After configuring the NTP client and enabling logging, syslog messages are accurately timestamped with the synchronized time.

Question 16

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and 802.1X port authentication on an IOS-XE switch.

Accepted Answer

Configure RADIUS server, enable AAA globally, create an authentication list for 802.1X, apply 802.1X to the port. First configure the RADIUS server, then enable AAA, create an authentication list for 802.1X, and finally apply 802.1X to the port.

Answer

Enable AAA globally, configure RADIUS server, apply 802.1X to the port, create an authentication list for 802.1X

Answer

Configure RADIUS server, create an authentication list for 802.1X, enable AAA globally, apply 802.1X to the port

Answer

Apply 802.1X to the port, configure RADIUS server, enable AAA globally, create an authentication list for 802.1X

Question 17

You are connected to R1 via console. R1 and R2 are directly connected via their GigabitEthernet0/0 interfaces. Configure OSPFv3 for IPv6 on both routers so that the loopback0 interface on R2 (with IPv6 address 2001:db8:acad:2::1/64) is reachable from R1. Enable IPv6 unicast routing, enable OSPFv3 on the appropriate interfaces, and verify the neighbor adjacency and routing table. (Note: R2 already has OSPFv3 configured and is waiting for R1 to complete its configuration.)

Accepted Answer

Enable IPv6 unicast routing, configure OSPFv3 process with router-id, enable OSPFv3 on GigabitEthernet0/0 in area 0, and verify neighbor and route.. The issue is that OSPFv3 process is not enabled on R1. To fix, first ensure IPv6 unicast routing is enabled (already done). Then configure OSPFv3 routing process with a process ID (e.g., 1) and router-id using the `ipv6 router ospf 1` command and `router-id` command. Then enable OSPFv3 on the GigabitEthernet0/0 interface with `ipv6 ospf 1 area 0`. Finally, verify with `show ospfv3 neighbor` to see R2's router ID (e.g., 2.2.2.2) and `show ipv6 route ospf` to see the route to 2001:db8:acad:2::/64.

Answer

Enable IPv6 unicast routing, configure OSPFv2 process with router-id, enable OSPFv2 on GigabitEthernet0/0 in area 0, and verify neighbor and route.

Answer

Enable IPv6 unicast routing, configure OSPFv3 process without a router-id, enable OSPFv3 on GigabitEthernet0/0 in area 0, and verify neighbor and route.

Answer

Enable IPv6 unicast routing, configure OSPFv3 process with router-id, enable OSPFv3 on GigabitEthernet0/0 in area 0, but do not verify neighbor or route.

Question 18

Drag and drop the following steps into the correct order to configure single-area OSPFv2 on a router and verify the neighbor state transitions from Down to Full.

Accepted Answer

1. Enter global configuration mode. 2. Enable OSPF with router ospf [process-id]. 3. Configure network statements with network [network] [wildcard-mask] area [area-id]. 4. Clear OSPF process with clear ip ospf process. 5. Verify neighbor states with show ip ospf neighbor.. After configuring OSPF, clearing the process triggers neighbor state transitions from Down to Full, which can then be verified with the neighbor command.

Note: Clearing the OSPF process is a disruptive action that resets all adjacencies. In production, use 'clear ip ospf process' only when necessary. For normal configuration verification, 'show ip ospf neighbor' is sufficient without clearing.

Question 19

Which THREE statements accurately describe the characteristics of NETCONF and RESTCONF for programmatic network configuration?

Accepted Answer

NETCONF uses XML-encoded RPCs over a secure transport such as SSH or TLS.. NETCONF uses XML-encoded Remote Procedure Calls (RPCs) over a secure transport such as SSH or TLS, making option B correct. RESTCONF supports both XML and JSON encoding and uses standard HTTP methods (GET, POST, PUT, PATCH, DELETE), so option C is correct. Both NETCONF and RESTCONF rely on YANG data models to define the structure of configuration and operational data, confirming option D. Option A is incorrect because NETCONF does not use HTTP methods; that is a characteristic of RESTCONF. Option E is wrong because RESTCONF does not use a separate commit operation; changes are applied immediately with each HTTP request, unlike NETCONF's candidate config and commit model.

Answer

NETCONF uses HTTP methods such as GET, POST, PUT, and DELETE to manipulate configuration data.

Answer

NETCONF uses a separate commit operation to apply changes, while RESTCONF uses a similar commit mechanism.

Question 20

Which THREE statements correctly describe the configuration and verification of NAT, PAT, and static NAT?

Accepted Answer

To configure static NAT, use the command 'ip nat inside source static

'.. Option A is correct because the 'ip nat inside source static' command creates a one-to-one permanent NAT mapping. Option B is correct because PAT is configured by adding the 'overload' keyword to a dynamic NAT statement that references an ACL and an interface, allowing many private addresses to share a single public IP with different port numbers. Option D is correct: dynamic NAT requires a NAT pool defined with 'ip nat pool' and an access list to identify the inside traffic to be translated. Option C is incorrect because 'show ip nat statistics' only displays counters and summary information, not the active translation entries; those are shown with 'show ip nat translations'. Option E is incorrect because 'show ip interface brief' does not show NAT translation mappings; verification of static NAT requires 'show ip nat translations'.

Answer

The command 'show ip nat statistics' displays the current active translations including inside and outside addresses.

Answer

To verify that static NAT is working, you should check the output of 'show ip interface brief' and look for the translated IP.