CCNA Mock Exam 89 — 25 Questions

Question 1

Drag and drop the following steps into the correct order to configure an IOS-XE device as an NTP client and ensure its syslog messages are sent to a remote server with correct timestamps.

Accepted Answer

Enter global configuration mode, configure the NTP server, configure the logging host and source interface, then verify with show commands.. First, enter global config, then set the NTP server, configure syslog destination and source interface, and finally verify both services.

Question 2

Users complain that log timestamps from several routers do not line up with one another. Which two actions are most appropriate?

Accepted Answer

Configure NTP on the network devices. When timestamps disagree, the first fix is time synchronization. NTP should be configured consistently, and devices should have correct timezone or clock settings so syslog messages can be correlated across the network.

Answer

Increase the syslog severity threshold to debugging

Answer

Disable console logging

Answer

Clear the logging buffer on all devices

Question 3

R1 is not forming an OSPF adjacency with R2 on GigabitEthernet0/1. Which mismatch below is the most likely cause?

Accepted Answer

The routers are using different IP subnet masks on the shared link. For OSPF neighbors to form, key settings on a shared segment must match. A subnet mask mismatch on a broadcast network often prevents proper neighbor formation because the routers do not agree on the local network.

Answer

OSPF cannot run on GigabitEthernet interfaces

Answer

Both routers are in area 0

Answer

The router IDs must match for adjacency to form

Question 4

A switch port configured with PortFast and BPDU Guard receives a BPDU and transitions to an error-disabled state. Which statement best explains why this is considered useful protection?

Accepted Answer

It prevents a port expected to be an edge port from accidentally becoming part of the switching topology and causing loops.. PortFast is used on edge ports to bypass STP listening/learning, but if a BPDU is received, the assumption that the port is an edge port is violated. BPDU Guard then error-disables the port to prevent potential loops or topology disruptions. This protects the network when an edge port unexpectedly connects to another switch, which could cause a bridging loop. The other options describe unrelated features or incorrect mechanisms.

Answer

It increases the port's bandwidth by combining multiple links.

Answer

It automatically enables VLAN trunking on the port.

Answer

It forces the port to use Rapid Spanning Tree Protocol for faster convergence.

Question 5

Which three options correctly describe the behavior or configuration of EtherChannel? (Choose three.)

Accepted Answer

EtherChannel can bundle up to 8 active physical links of the same type.. EtherChannel allows bundling up to 8 active physical links of the same type (e.g., all FastEthernet or all GigabitEthernet) to increase bandwidth and provide redundancy. All interfaces in the bundle must have consistent VLAN allowed lists and trunk mode configurations (or, for access ports, the same access VLAN) to avoid traffic misdirection or loops. Load balancing uses a hash algorithm that can be based on source MAC, destination MAC, source/destination IP, or TCP/UDP port numbers, with the default typically being source MAC on Cisco switches.

Answer

EtherChannel provides redundancy by forwarding traffic out all active links simultaneously.

Answer

PAgP is an industry-standard protocol for forming EtherChannels.

Answer

EtherChannel interfaces are configured as individual switch ports in the running-config.

Question 6

Which TWO statements correctly describe the behavior of Root Guard, Loop Guard, and BPDU Guard in a Rapid PVST+ environment?

Accepted Answer

Root Guard is applied to a port that should never become a root port; if a superior BPDU is received, the port is placed into a root-inconsistent state.. Option A is correct because Root Guard, applied to a port that should never become a root port, places that port into a root-inconsistent state upon receiving a superior BPDU, blocking traffic to prevent an unauthorized root bridge. Option C is correct because BPDU Guard is typically configured on access ports and error-disables the port if any BPDU is received, protecting against rogue switch connections. Option B is incorrect: when BPDUs stop on a port with Loop Guard, the port is placed into a loop-inconsistent state (blocked), not immediately forwarded, to prevent loops. Option D is incorrect because Root Guard and BPDU Guard are mutually exclusive and cannot be enabled simultaneously on the same port due to conflicting protective behaviors. Option E is incorrect because Loop Guard is effective on any port that is expected to receive BPDUs, including root ports and alternate/backup ports; it is not limited to ports already in a blocking state, and the statement's use of 'only' makes it false.

Answer

Loop Guard is used on root ports to monitor BPDU reception; if BPDUs stop, the port is immediately placed into forwarding mode to maintain connectivity.

Answer

Root Guard and BPDU Guard can be enabled simultaneously on the same port to provide both root protection and BPDU filtering.

Answer

Loop Guard is only effective when configured on ports that are in a blocking state; it prevents them from transitioning to forwarding if BPDUs are not received.

Question 7

What is a main operational benefit of a controller-based networking architecture?

Accepted Answer

It centralizes policy and can simplify network-wide changes. Controller-based architectures centralize the control plane, enabling network-wide policy management and simplifying changes. This is the correct answer because it accurately describes the primary operational benefit. Option A is wrong because controller-based architectures still require IP addressing for management and communication. Option C is wrong because the data plane on switches remains operational for local forwarding; only the control plane may be centralized. Option D is wrong because dynamic routing protocols can still be used, and routes are not forced to be static.

Answer

It removes the need for IP addressing

Answer

It eliminates the data plane on switches

Answer

It forces all routes to become static

Question 8

Match each automation-related term to the description that best fits it.

Accepted Answer

Idempotent: An operation that can be applied multiple times without changing the result beyond the initial application.. JSON is a lightweight structured data format commonly used in REST APIs for data interchange, so it matches 'Structured data format'. YANG is a data-modeling language used to define the structure of configuration and state data in NETCONF/YANG models. A token is an access-related value (e.g., API token) used by a client to authenticate and authorize requests. HTTPS (HTTP over TLS) provides secure, encrypted transport for API communication. The other terms listed in the original explanation (idempotent, declarative, etc.) are unrelated to these specific pairings; they describe different automation concepts.

Question 9

Drag and drop the following steps into the correct order to capture and analyze traffic on IOS-XE using the embedded packet capture feature, and in Wireshark to isolate a Layer 2 or Layer 3 fault.

Accepted Answer

Configure the capture point, define the capture buffer, start the capture, stop the capture, export the capture. The correct order for embedded packet capture on IOS-XE is: configure the capture point first (to define the traffic filter), then define the capture buffer, start the capture, stop the capture, and finally export the capture. Starting the capture after configuring both the point and buffer ensures that traffic is captured correctly. Exporting before stopping may result in incomplete data.

Question 10

You are connected to R1. The network administrator reports that the link between R1 and R2 is flapping and performance is poor. Examine the provided show interface output on R1, identify the root cause of the issue, and apply the necessary configuration fix to resolve the problem permanently.

Accepted Answer

Configure the interface with the 'duplex full' command.. The show interface output on R1 indicates the interface is operating in half-duplex with high CRC errors and input errors, classic symptoms of a duplex mismatch when the remote side (R2) is set to full-duplex. The root cause is that R1’s duplex setting does not match R2’s, causing collisions and flapping. Configuring 'duplex full' on R1’s GigabitEthernet0/1 forces full-duplex, which resolves the mismatch if the remote side is already forced full. Option B (speed 100) only configures speed—it does not change duplex, so the mismatch persists. Option C (no shutdown) is irrelevant because the interface is administratively up (the issue is operational). Option D (duplex auto) would set R1 to autonegotiate, but if R2 is forced full, autonegotiation fails and defaults to half-duplex, recreating the mismatch. Therefore, only 'duplex full' permanently fixes the issue.

Answer

Configure the interface with the 'speed 100' command.

Answer

Configure the interface with the 'no shutdown' command.

Answer

Configure the interface with the 'duplex auto' command.

Question 11

A switch port was configured for sticky MAC learning. Which two statements accurately describe how the feature behaves?

Accepted Answer

The switch can dynamically learn MAC addresses and add them to the running configuration as secure MAC addresses.. Sticky MAC learning is Cisco’s way of letting a port learn device MAC addresses automatically, while still treating them as secure addresses under port security. In everyday language, it saves the administrator from typing each allowed MAC address by hand. As devices connect, the switch can learn their MAC addresses and place them into the running configuration as sticky secure MACs. If the administrator later saves the configuration, those learned entries can also be written into startup-config and survive a reboot. The feature does not replace port security; it works as part of port security. It also does not change the port into a trunk or disable the maximum address count. So the two correct ideas are dynamic secure learning and the ability to preserve those learned MACs by saving the configuration.

Answer

Sticky learning removes the need to enable port security on the interface.

Answer

Sticky learning automatically converts the interface into a trunk port.

Answer

Sticky learning prevents the maximum secure MAC limit from being enforced.

Question 12

Which TWO symptoms are most likely to appear in the output of 'show interfaces' when a duplex mismatch exists between a switch port and a connected host?

Accepted Answer

Excessive collisions and CRC errors on the interface. A duplex mismatch causes collisions on the half-duplex side, resulting in excessive collisions and CRC errors (option A). On the full-duplex side, the host receives truncated frames from the half-duplex side's collisions, leading to runts and frame errors (option B). Option C is incorrect because 'Auto-negotiation failed' would appear only if negotiation itself failed, not from a mismatch after successful negotiation. Option D is wrong because a duplex mismatch typically reduces throughput and causes errors, not a high input rate. Option E is incorrect because the line protocol remains up; duplex mismatch does not bring the line protocol down.

Answer

Auto-negotiation failed message in the interface output

Answer

High input rate on the interface

Answer

Line protocol is down

Question 13

A router is configured with an access list intended to block Telnet from 192.168.10.0/24 to 10.1.1.10, but Telnet still works. What is the most likely reason?

Accepted Answer

The ACL is applied in the wrong place or direction. Option B is correct because the most common reason an ACL fails to block traffic is incorrect application—either it is applied to the wrong interface or in the wrong direction. For Telnet traffic from 192.168.10.0/24 to 10.1.1.10, the ACL must be applied inbound on the interface closest to the source or outbound on the interface closest to the destination. Option A is incorrect because the wildcard mask 0.0.0.255 is correct for matching the 192.168.10.0/24 network; 255.255.255.0 is a subnet mask, not a wildcard mask. Option C is false—standard ACLs can only filter by source IP and cannot match the destination port (Telnet), so an extended ACL is actually required. Option D is unrelated; PAT (Port Address Translation) has no bearing on whether an ACL can filter Telnet traffic.

Answer

The ACL must use wildcard mask 255.255.255.0 instead of 0.0.0.255

Answer

Standard ACLs should always be used for Telnet filtering

Answer

The router must run PAT before ACLs can filter Telnet

Question 14

What is the main purpose of this configuration?

ipv6 route 2001:db8:100::/64 GigabitEthernet0/0

Accepted Answer

It creates a specific IPv6 static route to 2001:db8:100::/64 out GigabitEthernet0/0.. This configuration creates an IPv6 static route to a specific destination prefix through the named outgoing interface. In practical terms, the router is being told exactly how to reach that remote IPv6 network. This is not a default route and not a dynamic-routing statement. It is a manually defined path to one destination prefix.

The key concept is recognizing the difference between a specific static route and a default route.

Answer

It enables OSPFv3 on GigabitEthernet0/0.

Answer

It creates an IPv6 default route.

Answer

It converts the interface into a tunnel.

Question 15

Which four of the following are considered best practices for securing switch ports and preventing Layer 2 attacks? (Choose all that apply. There are four correct answers.)

Accepted Answer

Configure dynamic ARP inspection (DAI) to prevent ARP spoofing.. Disabling unused ports and placing them in a shutdown state (A) prevents unauthorized physical access and stops Layer 2 attacks like rogue device connections or VLAN hopping. Enabling PortFast and BPDU guard on ports connecting to end devices (B) speeds up STP convergence and protects against rogue switch loops. DHCP snooping (D) prevents rogue DHCP server attacks by filtering untrusted DHCP messages. Dynamic ARP inspection (E) uses DHCP snooping bindings to validate ARP packets and prevent ARP spoofing. Setting the native VLAN to a higher number (F) is not a best practice; the recommended approach is to change the native VLAN to an unused VLAN on both ends of the trunk and explicitly tag it. MAC address filtering as the sole measure (C) is easily bypassed and must be combined with port security or 802.1X.

Answer

Use MAC address filtering as the sole security measure to prevent unauthorized access.

Answer

Set the native VLAN to a higher number than the default VLAN 1 on trunk links.

Question 16

A network administrator is troubleshooting a Windows 10 client that cannot access a web server at 192.168.1.100. The client has an IP address of 192.168.1.50/24 and can ping its default gateway (192.168.1.1) successfully, but ping to 192.168.1.100 fails. Which command should the administrator run next to verify the client's current network connections and identify potential issues with active sessions?

Accepted Answer

netstat -a. The `netstat -a` command displays all active TCP/UDP connections and listening ports, which is the most direct way to verify current network sessions and identify issues such as blocked ports, half-open connections, or failed connection attempts. While ping failure could result from network-layer filtering (e.g., ACLs blocking ICMP), `netstat -a` reveals whether the client has initiated a TCP connection to 192.168.1.100 and its current state (e.g., SYN_SENT, ESTABLISHED, TIME_WAIT), helping to isolate transport-layer or application-layer problems.

Answer

ipconfig /all

Answer

tracert 192.168.1.100

Answer

ping -t 192.168.1.100

Question 17

You are connected to R1. The network consists of three routers: R1, R2, and R3. R1 must reach the loopback network 203.0.113.0/24 on R3 via two paths: a primary static route through R2's G0/0 (192.0.2.2) and a floating static route through R2's G0/1 (198.51.100.2) with an administrative distance of 150. Additionally, R1 already has a default route pointing to 192.0.2.2. Configure the two static routes to 203.0.113.0/24 on R1 as described. The default route does not need to be changed. Verify that the primary route is active and the floating route is used only if the primary fails.

Accepted Answer

Configure ip route 203.0.113.0 255.255.255.0 192.0.2.2 and ip route 203.0.113.0 255.255.255.0 198.51.100.2 150. The default route is already configured. No further changes needed.. The correct answer is option A because it correctly configures the primary static route to 203.0.113.0/24 via 192.0.2.2 (default AD 1) and the floating static route via 198.51.100.2 with AD 150, ensuring the primary route is preferred. The default route to 192.0.2.2 is already configured and does not need modification. Options B, C, and D are incorrect: B wrongly adds a higher AD to the default route, C inverts the ADs on the two routes, and D omits the required AD on the floating route, causing both routes to have equal AD and potential load balancing or conflict.

Answer

Configure ip route 203.0.113.0 255.255.255.0 192.0.2.2 and ip route 203.0.113.0 255.255.255.0 198.51.100.2 150. Also, remove the existing default route and re-add it with a higher administrative distance.

Answer

Configure ip route 203.0.113.0 255.255.255.0 192.0.2.2 150 and ip route 203.0.113.0 255.255.255.0 198.51.100.2. The default route is already configured.

Answer

Configure ip route 203.0.113.0 255.255.255.0 192.0.2.2 and ip route 203.0.113.0 255.255.255.0 198.51.100.2. The default route is already configured. No administrative distance is needed because the router will automatically prefer the route with the lower metric.

Question 18

A network engineer is troubleshooting a connectivity issue between two hosts on different subnets. The sending host has constructed a packet with a destination IP address of 192.168.2.10. As the packet travels down the OSI model layers on the sending host, which Protocol Data Unit (PDU) name is assigned to the data at the Transport layer after TCP segments are created, and at which layer does the IP address get encapsulated?

Accepted Answer

PDU is a segment; IP address is added at the Network layer.. At the Transport layer, TCP divides data into segments, so the PDU is called a segment, making B correct. The destination IP address (192.168.2.10) is added at the Network layer, where the IP header encapsulates the segment into a packet. Option A is wrong because a frame is a Data Link layer PDU, and IP addresses are not added at that layer. Option C is wrong because the PDU at the Transport layer is a segment, not a packet, and IP addresses are added at the Network layer, not the Transport layer. Option D is wrong because 'datagram' typically refers to UDP’s Transport layer PDU (not TCP), and IP addresses are not added at the Transport layer.

Answer

PDU is a frame; IP address is added at the Data Link layer.

Answer

PDU is a packet; IP address is added at the Transport layer.

Answer

PDU is a datagram; IP address is added at the Transport layer.

Question 19

Which TWO of the following statements about Spanning Tree Protocol (STP) and Rapid PVST+ are true?

Accepted Answer

The root bridge in STP is elected based on the lowest bridge ID.. Option A is correct because the root bridge in STP is elected based on the numerically smallest bridge ID (priority + MAC address). Option D is correct because BPDU Guard, when enabled on a PortFast-enabled port, immediately error-disables the port if a BPDU is received, protecting against accidental loops. Option B is incorrect because the root bridge is chosen by the lowest bridge ID, not the highest. Option C is incorrect because PortFast and BPDU Guard are independent features; PortFast does not automatically enable BPDU Guard. Option E is incorrect because both traditional STP (802.1D) and Rapid PVST+ (RSTP-based) use the same root bridge election process—lowest bridge ID.

Answer

The root bridge in STP is elected based on the highest bridge ID.

Answer

PortFast automatically enables BPDU Guard on an interface.

Answer

Rapid PVST+ uses a different root bridge election process than traditional STP.

Question 20

A network administrator notices that the NTP server on Router R1 is not synchronizing with the upstream NTP server at 192.0.2.1. The router is configured as an NTP client, but show ntp status indicates the clock is unsynchronized and the stratum is 16. There is no firewall between R1 and 192.0.2.1. What is the most likely cause of this issue?

Accepted Answer

Router R1 does not have a route to reach 192.0.2.1.. The most likely cause is that Router R1 lacks a route to the upstream NTP server at 192.0.2.1. Without a valid IP route, NTP packets cannot reach the server, so the client remains unsynchronized with stratum 16. The other options are incorrect: A is not required for client operation, C is irrelevant because NTP version negotiation works across versions, and D is ruled out by the absence of a firewall.

Answer

The NTP server at 192.0.2.1 is not configured as a peer on R1.

Answer

The NTP server at 192.0.2.1 is not using NTP version 4.

Answer

The NTP server at 192.0.2.1 has a firewall blocking NTP traffic.