CCNA Mock Exam 91 — 25 Questions

Question 1

Based on the exhibit, why is traffic to host 198.51.100.70 using the OSPF route instead of the static route?

Accepted Answer

Because the OSPF /26 route is more specific than the static /24 route.. The traffic uses the OSPF route because it is the more specific match. In practical terms, the router evaluates destination-prefix specificity before comparing route source preference. The static route points to a broader /24, while the OSPF entry points to a narrower /26 that still contains the destination. Because longest-prefix match comes first, the /26 route wins.

This is a good reminder that static routes do not automatically beat dynamic routes when the prefixes are different. Specificity matters first, then source preference only when the prefix length is the same.

Answer

Because OSPF always overrides static routing, regardless of prefix length.

Answer

Because the static route must have an administrative distance of 255 to be considered.

Answer

Because the destination 198.51.100.70 is outside both listed routes.

Question 2

Users receive addresses from the correct subnet and can reach destinations by IP address, but they cannot browse by hostname.

Accepted Answer

DNS server option. If clients get an IP address and default gateway but cannot resolve names, the usual problem is the DNS server information handed out by DHCP. Without that, hostname lookups fail even though IP connectivity may still exist.

Answer

Default-router option

Answer

Lease time option

Answer

TFTP server option

Question 3

Drag and drop the following steps into the correct order to describe the general workflow for AI-assisted network configuration automation: receive intent, decompose into sub-tasks, call tools, validate output, and apply closed-loop remediation.

Accepted Answer

receive intent, decompose into sub-tasks, call tools, validate output, apply closed-loop remediation. The general AI workflow in network automation begins with receiving the high-level intent, then breaking it down into executable sub-tasks, calling the appropriate tools (e.g., APIs or scripts), validating the output to ensure correctness, and finally applying closed-loop remediation to correct any deviations. This order reflects a logical progression from planning to action to verification and correction, which aligns with foundational AI/ML concepts covered in the CCNA.

Question 4

Match each basic IPv4 concept to its most accurate role.

Accepted Answer

IP address: Unique identifier for a device on an IP network. The subnet mask is a 32-bit value that distinguishes the network portion from the host portion of an IPv4 address, enabling devices to determine their subnet membership. The default gateway is the IP address of the local router, which serves as the next hop for traffic destined to subnets outside the local network. The broadcast address, typically the highest address in a subnet, is used to send a single packet to all hosts within the same broadcast domain. A host address is a unique IP assigned to a single device's interface within a subnet, allowing it to be identified individually.

Question 5

A network administrator is troubleshooting an IPv6 connectivity issue on a newly deployed router. The router's G0/0/0 interface is configured with an IPv6 address using EUI-64, but hosts on that subnet cannot reach the router's link-local address. The administrator runs 'show ipv6 interface g0/0/0' and sees that the interface is up/up but the IPv6 address is not in the expected format. What is the most likely cause of the problem?

Accepted Answer

The IPv6 address was not configured correctly; the 'ipv6 address' command was likely omitted or misconfigured.. The router's G0/0/0 interface is up/up, but the IPv6 address is not in the expected EUI-64 format. This indicates that the 'ipv6 address' command was likely omitted entirely, because if it were simply misconfigured (e.g., without the `eui-64` keyword), the router would still automatically generate a link-local address, and hosts would be able to reach it. Since hosts cannot reach the link-local address, IPv6 is not enabled on the interface at all. The correct configuration requires the `ipv6 address` command with the appropriate prefix and the `eui-64` keyword.

Answer

The interface is administratively down.

Answer

The MAC address of the interface is invalid, preventing EUI-64 from generating a proper address.

Answer

The router is not sending Router Advertisements, so hosts cannot autoconfigure.

Question 6

Which TWO statements about IPv4 and IPv6 static routing are correct?

Accepted Answer

A floating static route is configured with a higher administrative distance than the primary route.. Option B is correct because a floating static route is configured with a higher administrative distance to serve as a backup when the primary route fails. Option D is correct because an IPv6 default static route uses the prefix ::/0 to match all destinations. Option A is incorrect because a default static route can be used independently of whether dynamic routing protocols are configured; it is simply a route with destination 0.0.0.0/0. Option C is incorrect because a floating static route must have a higher AD, not lower, than the primary route. Option E is incorrect because an IPv6 static route cannot specify an IPv4 address as the next-hop; it must use an IPv6 address or an outgoing interface.

Answer

A default static route is used when no dynamic routing protocols are configured.

Answer

A floating static route must have a lower administrative distance than the primary route.

Answer

An IPv6 static route can specify an IPv4 address as the next-hop.

Question 7

Which THREE statements accurately describe the role of AI agents in closed-loop remediation workflows for network automation?

Accepted Answer

AI agents can autonomously analyze network telemetry and decide on remediation actions.. B is correct because AI agents in closed-loop remediation workflows autonomously analyze network telemetry (e.g., gRPC, NETCONF) and decide on remediation actions without manual intervention, enabling rapid response. D is correct because tool-calling allows the AI agent to invoke external automation tools like Ansible or Python scripts to execute the chosen remediation steps. E is correct because a key part of the closed-loop is that the AI agent monitors the network after action to confirm the issue is resolved and adjusts if needed, ensuring the loop is closed. A is wrong because closed-loop automation implies autonomous execution based on predefined policies, not requiring manual approval for every action. C is wrong because AI agents use dynamic telemetry and learned patterns, not just static baseline configurations, to detect anomalies. F is wrong because AI agents augment, not eliminate, human oversight; human intervention remains for policy exceptions and oversight.

Answer

AI agents require manual approval before executing any remediation action in a closed-loop workflow.

Answer

AI agents rely solely on static baseline configurations to detect anomalies.

Answer

AI agents eliminate the need for human oversight in network operations.

Question 8

You are connected to R1. The network administrator wants to permit only HTTPS traffic (TCP port 443) from the 192.0.2.0/24 network to the 203.0.113.0/24 network, while denying all other IP traffic. Currently, an ACL applied inbound on G0/1 is blocking all traffic, including HTTPS. Identify the issue and correct the ACL configuration so that only HTTPS traffic is permitted.

Accepted Answer

Remove the existing ACL, then create an extended ACL with a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443, and apply it inbound on G0/1.. The ACL BLOCK_IN currently has a single deny ip any any entry, which blocks all traffic inbound on G0/1. The correct solution is to first remove the existing ACL, then create a new extended ACL that permits TCP 443 from source network 192.0.2.0/24 to destination network 203.0.113.0/24, and apply it inbound on G0/1. The implicit deny at the end of the ACL will then block all other traffic, achieving the desired policy.

Answer

Add a permit statement for tcp 192.0.2.0 0.0.0.255 203.0.113.0 0.0.0.255 eq 443 before the existing deny ip any any entry in the ACL.

Answer

Remove the existing ACL and create a standard ACL with permit 192.0.2.0 0.0.0.255, then apply it inbound on G0/1.

Answer

Remove the existing ACL and create an extended ACL with a permit statement for tcp any any eq 443, then apply it inbound on G0/1.

Question 9

Which three of the following correctly describe how a Layer 2 switch handles frames? (Choose three.)

Accepted Answer

The switch dynamically learns MAC addresses by examining the source MAC address of incoming frames on each port.. A Layer 2 switch forwards known unicasts only to the associated port (A), floods broadcasts out all ports except the incoming port (B), and dynamically learns MAC addresses from source MACs of frames (D). Unknown unicasts are flooded, not dropped (C is wrong). MAC address table learning relies on source MAC inspection, not CDP (E is wrong). If source and destination MAC are identical, the frame is not forwarded; it is typically dropped (F is wrong).

Answer

If the source MAC address in a frame matches the destination MAC address, the switch forwards the frame to all ports.

Answer

The switch updates the MAC address table every 30 seconds by default using CDP advertisements.

Answer

If the destination MAC address is unknown (not in the MAC address table), the switch drops the frame to prevent loops.

Question 10

An engineer wants all devices to send logs to 10.10.10.50 and also stamp those logs with consistent time from 10.10.10.60. Which two configurations are required on a Cisco device?

Accepted Answer

logging host 10.10.10.50. One configuration points the device to the syslog collector, and the other points it to the NTP server. The requirement is about centralized logging and accurate timestamps, so both services must be configured. Option E, 'service timestamps log localtime', is a valid command but it only sets the timestamp format to local time; without an NTP server, timestamps will not be consistent across devices.

Answer

ip helper-address 10.10.10.50

Answer

snmp-server host 10.10.10.60

Answer

service timestamps log localtime

Question 11

Drag and drop the OSPFv2 neighbor states on the left to the correct descriptions on the right.

Accepted Answer

Down: No Hello packets received from the neighbor.. OSPF neighbor states progress: Down (no Hello), Init (Hello seen), 2-Way (bidirectional), ExStart (master/slave election), Exchange (DBD packets), Loading (requesting missing LSAs via LSR/LSU), Full (LSDB synchronized). These states ensure proper adjacency formation and reliable database exchange.

Answer

Init: Hello packets received, but neighbor's Router ID not seen in Hello.

Answer

2-Way: Bidirectional communication established; both routers see each other in Hello packets.

Answer

ExStart: Master/slave election occurs; first DD packets exchanged.

Question 12

Which three options best describe how machine learning models are trained for network anomaly detection? (Choose three.)

Accepted Answer

Applying unsupervised clustering to identify deviations without predefined labels. Machine learning models for network anomaly detection are effectively trained using historical baseline traffic data to learn normal behavior patterns, which allows the model to identify deviations that may indicate anomalies. Labeled datasets with known attack signatures enable supervised learning, where the model learns to classify traffic as normal or malicious based on examples. Unsupervised clustering techniques, such as k-means or DBSCAN, can identify deviations without predefined labels by grouping similar data points and flagging outliers as potential anomalies. The three incorrect options—manual threshold configuration, training exclusively on synthetic data, and reliance on SNMP polling—are not characteristic of ML training methods. Manual threshold configuration is a rule‑based approach that does not involve learning from data. Training exclusively on synthetic data is not representative of real‑world traffic patterns and would not generalize well. Relying solely on SNMP polling intervals is a traditional monitoring method, not a machine learning technique.

Answer

Relying solely on SNMP polling intervals to detect anomalies

Answer

Requiring manual threshold configuration for every monitored metric

Answer

Training exclusively on synthetic data generated by simulation tools

Question 13

You are connected to R1, a branch router. Configure an extended ACL named BRANCH_IN that permits only HTTP (TCP port 80) traffic from the internal network 192.168.1.0/24 to the web server at 203.0.113.10, and permits ICMP echo-reply from any source to any destination. Apply the ACL inbound on the interface facing the internal network. Then verify that only the specified traffic is allowed.

Accepted Answer

ip access-list extended BRANCH_IN
 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
 permit icmp any any echo-reply
!
interface GigabitEthernet0/0
 ip access-group BRANCH_IN in. Option A is correct because it creates an extended ACL that permits TCP port 80 from the internal 192.168.1.0/24 to the web server 203.0.113.10 and permits only ICMP echo-reply, then applies it inbound on the internal interface G0/0, matching the requirement. Option B is wrong because the ACL is applied outbound on G0/0, but traffic from internal hosts to the web server exits via the WAN interface (G0/1), not G0/0. Option C is wrong because it permits all ICMP (any any) instead of only echo-reply, allowing unnecessary ICMP traffic. Option D is wrong because it applies the ACL inbound on both G0/0 and G0/1; applying it on G0/1 would incorrectly filter inbound traffic from the ISP, potentially blocking the web server's responses.

Answer

ip access-list extended BRANCH_IN
 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
 permit icmp any any echo-reply
!
interface GigabitEthernet0/0
 ip access-group BRANCH_IN out

Answer

ip access-list extended BRANCH_IN
 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
 permit icmp any any
!
interface GigabitEthernet0/0
 ip access-group BRANCH_IN in

Answer

ip access-list extended BRANCH_IN
 permit tcp 192.168.1.0 0.0.0.255 host 203.0.113.10 eq 80
 permit icmp any any echo-reply
!
interface GigabitEthernet0/0
 ip access-group BRANCH_IN in
!
interface GigabitEthernet0/1
 ip access-group BRANCH_IN in

Question 14

What is the best explanation for why a router chooses the OSPF route to 10.50.0.0/16 instead of the RIP route?

Accepted Answer

Because OSPF has a lower administrative distance than RIP for the same prefix.. The router chooses the OSPF route because when the prefix length is the same, source preference is considered, and OSPF has a lower administrative distance than RIP. In practical terms, both routes describe the same destination size, so longest-prefix match does not separate them. The router then trusts the OSPF source more than RIP by default.

This is a classic administrative-distance comparison question and a very important route-selection concept.

Answer

Because RIP routes are never installed when OSPF is running.

Answer

Because OSPF always has a longer prefix than RIP.

Answer

Because the RIP metric is lower than the OSPF metric.

Question 15

A port connected to an end-user PC should not send or expect VLAN tags from the endpoint. Which interface type is appropriate on the switch?

Accepted Answer

Access port. The appropriate interface type is an access port. In plain language, a normal user PC is expected to connect to one VLAN and send ordinary untagged Ethernet frames. The switch associates that traffic with the configured access VLAN. This is different from a trunk, which is designed to carry multiple VLANs and commonly uses tagging to preserve VLAN identity across the link. Routed ports are Layer 3 interfaces used for routing between VLANs, not for attaching a single end-user PC. Port-channel interfaces aggregate multiple physical links for redundancy and bandwidth, but they do not determine whether VLAN tagging is used; the underlying port mode (access or trunk) still applies. Therefore, access port is the only correct choice for an untagged, single-VLAN end-device connection.

Answer

Trunk port

Answer

Routed port

Answer

Port-channel interface

Question 16

A switch unexpectedly blocks a link toward the distribution layer. Gi1/0/24 shows a path cost of 4 while Gi1/0/23 shows a path cost of 19. Why did interface Gi1/0/24 become the root port instead of Gi1/0/23?

Accepted Answer

has a lower root path cost to the root bridge. Spanning Tree chooses a root port by looking for the best path toward the root bridge. In this case, Gi1/0/24 shows a cost of 4, while Gi1/0/23 shows a cost of 19. Lower cost is better, so Gi1/0/24 is selected as the root port and moves into forwarding. Gi1/0/23 becomes an alternate port and is placed into a blocking state to prevent a loop. STP compares root path cost first; only if the cost is tied does it move on to tie-breakers like sender bridge ID and port ID. The lower cost on Gi1/0/24 explains why that port won the root-port election.

Answer

Gi1/0/24 has a lower port number, so STP always prefers it first.

Answer

STP prefers interfaces with the highest path cost to reduce loops.

Answer

Gi1/0/23 is blocked because alternate ports are always chosen over root ports.

Question 17

You are connected to SW1 via the console. SW1 is a Layer 2 switch. Ports G0/1 and G0/2 are connected to two PCs that should be in VLAN 10 (Sales). Port G0/3 is a trunk link to another switch. The PCs are currently unable to communicate because the ports are in VLAN 1. Configure the switch to place the ports in the correct VLAN and ensure the trunk is properly configured with 802.1Q encapsulation and native VLAN 99.

Accepted Answer

Create VLAN 10, assign G0/1 and G0/2 as access ports in VLAN 10, configure G0/3 as trunk with encapsulation dot1q and native VLAN 99.. VLAN 10 must be created and the access ports must be explicitly set to access mode with 'switchport mode access' before assigning them to VLAN 10. Assigning the access ports to VLAN 10 places the PCs in the correct broadcast domain. The trunk needed explicit 802.1Q encapsulation and a native VLAN change to 99 for security and consistency.

Answer

Create VLAN 10, assign G0/1 and G0/2 as access ports in VLAN 10, configure G0/3 as trunk with encapsulation isl and native VLAN 99.

Answer

Create VLAN 10, assign G0/1 and G0/2 as trunk ports in VLAN 10, configure G0/3 as trunk with encapsulation dot1q and native VLAN 99.

Answer

Create VLAN 10, assign G0/1 and G0/2 as access ports in VLAN 10, configure G0/3 as trunk with encapsulation dot1q and native VLAN 1.

Question 18

Which TWO of the following are valid interpretations of errors seen in the output of the 'show interface' command?

Accepted Answer

CRC errors indicate that frames were received with an invalid checksum, often due to cabling issues.. CRC errors (option A) indicate frames with an invalid checksum, often due to cabling issues, which is correct. Option D is also correct: 'Input errors' is a cumulative counter that includes runts, giants, CRC errors, and frame errors. Option B is wrong because runts are frames smaller than 64 bytes, not larger. Option C is wrong because giants are frames larger than the maximum allowed size (typically 1518 bytes), not smaller than 64 bytes. Option E is wrong because 'flaps' refer to an interface going up and down repeatedly, not necessarily physically disconnected; it could be due to duplex mismatch or other reasons.

Answer

Runts are frames that are larger than the maximum allowed size.

Answer

Giants are frames that are smaller than 64 bytes.

Answer

Flaps indicate that the interface is physically disconnected.

Question 19

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to a PC on port G0/1. The network administrator wants to secure the port by allowing only two MAC addresses and enabling sticky MAC learning. Additionally, if a violation occurs, the port should be put into error-disabled state. Configure port security on G0/1 with maximum MAC addresses of 2, sticky learning, and shutdown violation mode.

Accepted Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation shutdown. Port security restricts access based on MAC addresses. The first command, `switchport port-security`, enables port security on the interface. With sticky, learned MACs are saved to the running config; `shutdown` violation mode places the port in error-disable state, requiring manual recovery. Option A includes all required commands in the correct order. Option B uses `restrict`, which drops traffic but does not errdisable. Option C uses `protect`, which drops silently without logging. Option D manually configures a specific MAC instead of enabling sticky learning, so it does not meet the requirement for sticky.

Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation restrict

Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address sticky
SW1(config-if)# switchport port-security violation protect

Answer

SW1(config-if)# switchport port-security
SW1(config-if)# switchport port-security maximum 2
SW1(config-if)# switchport port-security mac-address 0000.1111.2222
SW1(config-if)# switchport port-security violation shutdown

Question 20

Which two statements accurately describe DNS in everyday network use?

Accepted Answer

DNS helps resolve hostnames into IP-related information.. DNS translates human-friendly hostnames into IP-related information, making network services more accessible by name rather than numeric addresses. Option A is correct because DNS resolves names to IP addresses. Option B is correct because using names improves usability and allows underlying IP changes without user disruption. Option C is incorrect because IP address assignment is a DHCP function, not DNS. Option D is incorrect because subnet masks are part of IP addressing and routing, unrelated to DNS name resolution. Option E is incorrect because STP (Spanning Tree Protocol) elects a root bridge for loop-free topology, which is unrelated to DNS.

Answer

DNS automatically assigns IP addresses to hosts.

Answer

DNS replaces the need for subnet masks.

Answer

DNS elects the STP root bridge.

CCNA Mock Exam 91 — 25 Questions

Exhibit

CCNA Mock Exam 91 — 25 Questions

Exhibit