CCNA Mock Exam 93 — 25 Questions

Question 1

Exhibit: Consider the following ACL applied inbound on interface G0/0:

access-list 100 deny ip host 10.10.10.10 any
access-list 100 deny tcp any host 10.10.10.10 eq 23
access-list 100 permit ip any any

The intent is to block only Telnet (TCP port 23) to server 10.10.10.10 while permitting everything else. However, users cannot reach any service on that server. Why?

Accepted Answer

The deny ip statement blocks all traffic to the host before the Telnet-specific line is evaluated. ACLs are processed top-down, and the first match is applied. The first line denies all IP traffic to the host (any protocol, any port). This matches all packets destined for 10.10.10.10 before the Telnet-specific line is ever reached, effectively blocking every service, not just Telnet.

Answer

The ACL must be applied outbound, not inbound

Answer

Extended ACLs cannot match TCP port 23

Answer

Telnet uses UDP, so the ACE should reference udp

Question 2

Which four of the following are common use cases or features of AI and Machine Learning in network operations? (Choose all that apply.)

Accepted Answer

Dynamic optimization of traffic routing based on real-time patterns. Anomaly detection for security threats uses ML to identify deviations from normal traffic patterns, enabling proactive threat identification. Automated root cause analysis leverages AI to correlate events and faults across the network to quickly pinpoint the source of issues. Predictive maintenance applies ML models to historical hardware data (e.g., error logs, temperature) to forecast failures before they occur. Dynamic traffic routing uses reinforcement learning or other AI techniques to adapt routing decisions in real time based on changing network conditions. The two incorrect options are not AI/ML use cases: manual VLAN configuration is a static, rule-based task that does not involve learning or adaptation, and replacing all network engineers with fully autonomous AI is an unrealistic, futuristic concept not representative of current AI/ML applications in network operations.

Answer

Replacing all network engineers with fully autonomous AI

Answer

Manual configuration of static VLANs on access switches

Question 3

You are connected to the Cisco WLC (WLC-1) via its management IP 192.168.1.10. The wireless network 'CorpNet' is configured but clients cannot associate. Troubleshoot and resolve the issue: clients report 'Association failed' and the SSID is not visible in site surveys. Ensure that after your fix, the SSID is broadcast, WPA3 is used, and the WLAN is mapped to VLAN 20. Also, verify the WLC management interface is accessible over HTTPS.

Accepted Answer

Enable the WLAN, set Broadcast SSID to Enabled, create a dynamic interface for VLAN 20 and map the WLAN to it, and enable the HTTPS server.. The WLAN was disabled, the SSID was hidden (Broadcast SSID Disabled), and it was incorrectly mapped to the management interface instead of a user VLAN. Additionally, HTTPS access was disabled. The solution: enable the WLAN, enable SSID broadcast, change the interface to a VLAN 20 interface (e.g., create a dynamic interface 'vlan20' with VLAN 20), and enable the HTTPS server for management access. Note: On an AireOS WLC, the correct commands use `config wlan enable `, `config wlan broadcast-ssid enable `, and `config network secureweb enable` for HTTPS.

Answer

Enable the WLAN, set Broadcast SSID to Enabled, change the interface to the management interface, and enable the HTTPS server.

Answer

Enable the WLAN, keep Broadcast SSID Disabled for security, create a dynamic interface for VLAN 20 and map the WLAN to it, and enable the HTTPS server.

Answer

Enable the WLAN, set Broadcast SSID to Enabled, create a dynamic interface for VLAN 20 and map the WLAN to it, but leave HTTPS disabled for security.

Question 4

Drag and drop the following steps into the recommended order (best practice) to configure IPv4 and IPv6 static routes, a default route, and a floating static route with higher AD as a backup for the default route, then verify with show ip route and show ipv6 route.

Accepted Answer

Configure IPv4 and IPv6 static routes, then configure a default route, then configure a floating static route with higher AD, then verify with show ip route and show ipv6 route.. The recommended best-practice order is to configure specific static routes first, then the default route, and finally the floating static route with a higher AD (e.g., 200) so it acts as a backup for the default route. Verification using show ip route and show ipv6 route confirms the routing table. Options that place the default route before specific routes or the floating route before the default are still operational but may cause temporary routing issues or violate the typical progression from specific to general.

Question 5

SW1 is the root bridge for VLAN 10. A user switch receives a BPDU on an access port connected to a desk-side unmanaged switch. What should happen if BPDU Guard is enabled on that port?

Accepted Answer

The port is moved to err-disabled state. BPDU Guard is designed to protect edge ports. If a BPDU is received on a PortFast access port, the switch places the interface into the err-disabled state to stop a potential Layer 2 loop or rogue switch.

Answer

The port transitions to forwarding more quickly

Answer

The switch elects a new root bridge

Answer

The port becomes a trunk automatically

Question 6

Match each operations or assurance technology to its most accurate purpose.

Accepted Answer

NetFlow - Flow analysis; SNMP - Device management; Syslog - Logging; IP SLA - Performance measurement; SPAN - Local traffic mirroring; RSPAN - Remote traffic mirroring. Each technology serves a specific assurance purpose: Syslog provides centralized event and message reporting, SNMP enables monitoring and management information exchange, NetFlow offers visibility into traffic flows and conversations, and NTP ensures clock synchronization for consistent timing across network devices.

Answer

NetFlow - Device management; SNMP - Flow analysis; Syslog - Performance measurement; IP SLA - Logging; SPAN - Remote traffic mirroring; RSPAN - Local traffic mirroring

Answer

NetFlow - Logging; SNMP - Performance measurement; Syslog - Flow analysis; IP SLA - Device management; SPAN - Remote traffic mirroring; RSPAN - Local traffic mirroring

Answer

NetFlow - Performance measurement; SNMP - Logging; Syslog - Device management; IP SLA - Flow analysis; SPAN - Local traffic mirroring; RSPAN - Remote traffic mirroring

Question 7

Which TWO statements correctly describe the configuration and effect of Root Guard and BPDU Guard on a Cisco switch?

Accepted Answer

Root Guard is configured on a per-port basis and causes the port to become root-inconsistent if a superior BPDU is received.. Option A is correct because Root Guard is configured per interface using the 'spanning-tree guard root' command. When a port with Root Guard enabled receives a superior BPDU (one that would cause the switch to become a non-root bridge), the port is placed into a root-inconsistent state, effectively blocking traffic on that port and preventing the switch from accepting a new root bridge from that direction. This protects the spanning-tree topology from unauthorized or misconfigured switches attempting to become the root bridge. Option D is correct because BPDU Guard is commonly enabled on ports with PortFast (typically access ports connected to end devices). When a BPDU is received on such a port, BPDU Guard places the port into errdisable state, preventing potential bridging loops that could result from an unauthorized switch connecting to the network. Option B is incorrect because BPDU Guard does not prevent loops by disabling a trunk port; it is typically used on access ports (often with PortFast) and disables the port upon receiving any BPDU, not just on trunk ports. Option C is incorrect because Root Guard places the port into root-inconsistent state (not errdisable) when a superior BPDU is received; BPDU Guard uses errdisable. Option E is incorrect because neither Root Guard nor BPDU Guard filters BPDUs; Root Guard reacts to superior BPDUs by blocking the port, and BPDU Guard reacts to any BPDU by disabling the port. Both features allow BPDUs to be processed but then take action based on the received BPDUs.

Answer

BPDU Guard prevents loops by disabling a trunk port that receives a BPDU from an unauthorized switch.

Answer

Root Guard places a port in errdisable state when a superior BPDU is received.

Answer

Both Root Guard and BPDU Guard filter BPDUs to prevent them from being processed by the switch CPU.

Question 8

Which TWO statements correctly describe the configuration and verification of IPv4 and IPv6 parameters for host connectivity, including default gateway, DNS, and subnet masks?

Accepted Answer

The default gateway must be on the same subnet as the host's IP address.. Option B is correct because a host's default gateway must be on the same subnet to be reachable at Layer 2; otherwise, a circular dependency occurs. Option D is correct because the 'ipconfig /all' command displays both IPv4 and IPv6 configuration details, including IP address, subnet mask, default gateway, and DNS servers. Option A is wrong because the subnet mask determines the network and host portions of an IP address, not the DNS server address. Option C is wrong because IPv6 hosts can obtain their IP address via SLAAC, DHCPv6, or static configuration; the phrase 'can only' makes it incorrect. Option E is wrong because the default gateway must be reachable (on the same subnet) and configured with an IP address that belongs to a router interface on that subnet, not just any IP address.

Answer

The subnet mask determines the DNS server address used by the host.

Answer

IPv6 hosts can only obtain their IP address via DHCPv6.

Answer

A host can reach any remote network if its default gateway is configured with any IP address.

Question 9

A network engineer queries a REST API and receives data in JSON format. Which statement about JSON is correct?

Accepted Answer

JSON stores data as key-value pairs and arrays. JSON is a lightweight data-interchange format that represents data as key-value pairs and arrays. Option A is incorrect because JSON is not a transport protocol; it is a data format exchanged over HTTPS. Option C is incorrect because JSON is platform-agnostic and used by many APIs, not limited to Cisco DNA Center. Option D is incorrect because JSON uses a flexible syntax with colons and brackets, not XML tags.

Answer

JSON is a transport protocol that replaces HTTPS

Answer

JSON can be used only with Cisco DNA Center

Answer

JSON requires XML tags around each object

Question 10

Drag and drop the following steps into the correct order to configure Root Guard on designated ports, Loop Guard on non-designated ports, and BPDU Guard on PortFast ports, including the recovery steps when a port enters err-disabled.

Accepted Answer

1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. Enable errdisable recovery globally. 5. Manually re-enable the err-disabled port.. The correct order is Option A because: 1) Root Guard is applied to designated ports to protect the root bridge election; 2) Loop Guard is applied to non-designated ports to prevent loops caused by unidirectional links; 3) BPDU Guard is applied to PortFast-enabled ports to shut down ports that receive BPDUs unexpectedly. Options B, C, and D incorrectly assign these guards to the wrong port roles (e.g., Option B places BPDU Guard on designated ports and Root Guard on non-designated ports, which violates the intended protection). Steps 4 and 5 apply only to BPDU Guard, as it transitions the port to err-disabled state upon BPDU reception; Root Guard and Loop Guard cause blocking states (root-inconsistent or loop-inconsistent), not err-disabled. Therefore, the recovery steps (errdisable recovery and manual re-enable) are only relevant for ports configured with BPDU Guard.

Question 11

A network technician is troubleshooting connectivity between two directly connected Cisco switches. Hosts on VLAN 10 connected to SwitchA cannot ping the default gateway on SwitchB. The interface on SwitchB shows up/up, but the interface on SwitchA shows up/down. The technician examines the interface configuration and status on SwitchA. What is the most likely cause of this issue?

Accepted Answer

Configure both interfaces with the same duplex and speed settings, either both auto or both manually set to full-duplex and 1000 Mbps.. The interface on SwitchA shows up/down, meaning Layer 1 is active but the line protocol is down. This is commonly caused by a speed mismatch between the two ends. A duplex mismatch, in contrast, typically results in both interfaces showing up/up with CRC errors. Therefore, the most likely cause is that the speed settings differ—for example, one interface is set to auto-negotiate while the other is hard-coded to a specific speed. Configuring both interfaces with identical speed and duplex settings, either both auto or both manually configured, resolves the issue.

Answer

Replace the Ethernet cable because it is faulty.

Answer

Issue the 'shutdown' and 'no shutdown' commands on the interface to recover from err-disabled state.

Answer

Check the VLAN configuration on SwitchA because the interface is administratively down.

Question 12

You are troubleshooting a client connectivity issue on VLAN 10. The client PC1 is connected to switch SW1, which is connected to router R1 acting as the default gateway. PC1 can ping its own IP and the default gateway (10.1.10.1) but cannot reach the internet. From the provided router outputs, identify the fault and apply the necessary fix on R1.

Accepted Answer

Configure a default route on R1: ip route 0.0.0.0 0.0.0.0 10.1.10.254. PC1 can ping its own IP and the gateway (10.1.10.1) but not the internet (8.8.8.8). The router R1 has no default route to forward traffic to the internet. The fix is to configure a default route on R1 pointing to the next-hop IP address of the upstream router (e.g., 10.1.10.254) or an exit interface. After adding the default route, R1 will be able to forward traffic outside the local subnet.

Answer

Configure a static route on R1: ip route 8.8.8.8 255.255.255.255 10.1.10.254

Answer

Configure a default route on R1: ip route 0.0.0.0 0.0.0.0 10.1.10.1

Answer

Configure a default route on R1: ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0

Question 13

You are connected to R1. The network has two routers: R1 (192.168.1.0/24 LAN) and R2 (Internet gateway). R1's inside LAN (192.168.1.0/24) must be translated to the public IP 203.0.113.1 using PAT (NAT overload) for Internet access. Additionally, the server at 192.168.1.100 must be reachable from the Internet via static NAT to 203.0.113.5. The current configuration is broken. Identify and fix the issues so that both PAT and static NAT work correctly.

Accepted Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and ensure the PAT command includes 'overload'.. The configuration had three issues: 1) ACL 10 permitted 10.0.0.0/8 instead of the actual inside subnet 192.168.1.0/24, so no traffic matched PAT. 2) The PAT command was missing the 'overload' keyword, which is required for Port Address Translation; without it, the device attempts one-to-one dynamic NAT. 3) The interface facing the public network (G0/1) was incorrectly configured as 'ip nat inside' instead of 'ip nat outside'. The fix is to correct the ACL to permit 192.168.1.0 0.0.0.255, ensure the PAT command includes 'overload', and change G0/1 to 'ip nat outside'.

Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and ensure the PAT command includes 'overload'.

Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat outside', and remove the 'overload' keyword from the PAT command.

Answer

Change ACL 10 to permit 192.168.1.0 0.0.0.255, change G0/1 to 'ip nat inside', and remove the 'overload' keyword from the PAT command.

Question 14

Drag and drop the cable types and transceivers on the left to their corresponding distance limits or interface diagnostics on the right.

Accepted Answer

Cat5e: 100 meters. Each cable type or transceiver has a specified maximum distance based on IEEE standards and fiber-optic characteristics. Cat5e UTP supporting 1000BASE-T is limited to 100 meters due to signal attenuation and the 1000BASE-T standard. Multimode fiber OM3 with 1000BASE-SX (short wavelength) reaches up to 550 meters because of modal dispersion and the SX transceiver's power budget. Singlemode fiber with 1000BASE-LX (long wavelength) can transmit up to 5 kilometers due to lower attenuation and reduced dispersion in single-mode fiber. The SFP-10G-SR (short-reach 10 Gigabit) transceiver over OM3 multimode fiber has a maximum distance of 300 meters per the 10GBASE-SR standard. The 'show interfaces' command displays critical interface diagnostics such as input/output errors, speed, duplex settings, and CRC errors, which are essential for troubleshooting link issues.

Question 15

Why is R1 not installing the floating static default route into the routing table?

Accepted Answer

Because the OSPF default route has a lower administrative distance than the floating static route.. The floating static default route is not installed because the primary default route is already present and has a lower administrative distance. In practical terms, a floating static route is meant to sit in reserve and appear only when the preferred route is unavailable. Since the OSPF default route is active and has a better administrative distance, the backup route is not used yet.

This is a classic route-preference question. The key idea is not just that a static route exists, but that a higher-distance static route is intentionally designed to lose until the primary path disappears.

Answer

Because static default routes can never be used when OSPF is enabled.

Answer

Because the static default route must use a /24 mask instead of 0.0.0.0.

Answer

Because the next hop of a floating route must be a loopback address.

Question 16

A device administrator can log in securely over SSH, but the organization still insists on restricting source IP ranges and keeping detailed logs. Which statement best explains that decision?

Accepted Answer

Because secure transport alone does not remove the need for source restriction and accountability controls.. The decision reflects defense in depth. SSH encrypts the session and authenticates users, but it does not limit which source IPs can connect or provide audit trails. Source IP restriction reduces the attack surface by allowing only trusted hosts, and logging provides accountability and forensic evidence. Option B is incorrect because SSH is more secure than Telnet, not less. Option C is incorrect because logs record events but do not enforce ACLs. Option D is incorrect because source IP restriction complements authentication rather than replacing it.

Answer

Because SSH is less secure than Telnet and must be compensated for.

Answer

Because logs automatically enforce ACL policy.

Answer

Because source IP restriction replaces the need for authentication.

Question 17

You are connected to R1. Configure IPv4 and IPv6 static routes so that R1 can reach the loopback networks on R2 and R3 (203.0.113.0/24 and 2001:db8:1::/48) with proper failover. Ensure that the primary link (G0/0 to R2) is preferred over the backup link (G0/1 to R3) using a floating static route with an appropriate administrative distance. Additionally, configure a default route on R1 for IPv4 and IPv6 so that traffic to unknown destinations is forwarded via the primary link. Troubleshoot the existing configuration to identify and fix a recursive routing failure caused by a wrong next-hop address in one of the static routes.

Accepted Answer

The recursive routing failure is caused by a missing route to the next-hop network; correct by changing the static route to use an exit interface: `ip route 203.0.113.0 255.255.255.0 GigabitEthernet0/0 10.0.0.2`. The recursive routing failure occurs because the static route `ip route 203.0.113.0 255.255.255.0 10.0.0.2` requires R1 to have a route to the next-hop network (10.0.0.0/30) in its routing table. Since 10.0.0.0/30 is directly connected via G0/0, the route should install, but if the interface is down or misconfigured, recursion fails. The fix is to specify both the exit interface and next-hop: `ip route 203.0.113.0 255.255.255.0 GigabitEthernet0/0 10.0.0.2`, which avoids recursive lookup. Option B is wrong because an administrative distance of 1 would make the floating static route equal to the default AD of the primary static route, defeating failover; the floating route should have a higher AD (e.g., 200). Option C is wrong because using R1's own interface address (2001:db8:0:1::1) as next-hop would point the route back to itself, not to R2; the correct next-hop is R2's link-local or global address on G0/0. Option D is wrong because the default route for IPv4 should have the default AD of 1 to be preferred over the floating static route; setting it to 200 would make it equally preferred and could cause routing loops.

Answer

The floating static route for IPv4 should have an administrative distance of 1 to ensure it is preferred over the primary route.

Answer

The IPv6 static route to 2001:db8:1::/48 should use a next-hop of 2001:db8:0:1::1 (R1's own interface) to ensure reachability.

Answer

The default route for IPv4 should be configured with an administrative distance of 200 to match the floating static route.

Question 18

Which TWO statements accurately describe characteristics of copper and fiber optic cabling used in modern Ethernet networks?

Accepted Answer

Fiber optic cables are immune to electromagnetic interference (EMI).. Option B is correct because fiber optic cables transmit data as light pulses through glass or plastic cores, which are completely unaffected by electromagnetic interference (EMI), unlike copper cables that rely on electrical signals and are susceptible to EMI. Option D is correct because single-mode fiber uses a narrow core (typically 9 microns) and laser transmitters to support long-distance transmission (up to tens of kilometers) with low signal loss. Option A is wrong because copper UTP cables are limited to 100 meters without a repeater, not 500 meters. Option C is wrong because multi-mode fiber typically uses LED or VCSEL transmitters for short-range communication, while laser-based transmitters are used with single-mode fiber. Option E is wrong because fiber optic cabling is generally more expensive per meter than copper cabling, though installation and equipment costs may differ.

Answer

Copper UTP cables can reliably transmit data up to 500 meters without a repeater.

Answer

Multi-mode fiber typically uses laser-based transmitters for short-range communication.

Answer

Fiber optic cabling is generally less expensive per meter than copper cabling.

Question 19

You are connected to R1 via the console. R1 is configured as an NTP client that should synchronize with the NTP server at 203.0.113.1. You need to verify that R1 is synchronizing correctly and also ensure that the system clock is updated. Additionally, configure R1 to act as an NTP server for downstream devices on the internal network 192.168.1.0/24.

Accepted Answer

Use 'show ntp status' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp master' and 'ntp broadcast' on the interface facing 192.168.1.0/24.. The correct verification command is 'show ntp status' because it displays the synchronization state and stratum level. 'show ntp associations' shows configured peers but not the sync state. After NTP sync is established, the system clock is automatically updated; 'clock set' is not typically required but remains a valid command to manually adjust the clock. 'clock update' is not a valid IOS command. To make R1 an NTP server for downstream devices, use the global command 'ntp master 4', not 'ntp server' (which makes the router a client). Then, on the interface facing 192.168.1.0/24 (G0/0), apply 'ntp broadcast' to send NTP broadcasts so clients can synchronize without polling. Option A correctly combines these steps while other options mix incorrect commands or verification methods.

Answer

Use 'show ntp associations' to verify synchronization, 'clock update' to update the system clock, and configure 'ntp server' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Answer

Use 'show ntp status' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp server' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Answer

Use 'show ntp associations' to verify synchronization, 'clock set' to update the system clock, and configure 'ntp master' and 'ntp broadcast' on the interface facing 192.168.1.0/24.

Question 20

Which TWO statements correctly describe the behavior of Rapid PVST+ in a Layer 2 network?

Accepted Answer

Rapid PVST+ runs a separate instance of RSTP for each VLAN.. Rapid PVST+ runs a separate instance of RSTP (802.1w) for each VLAN, enabling per-VLAN rapid convergence and load balancing. Option D is correct because PortFast allows access ports to transition to forwarding immediately, while BPDU Guard prevents loops by disabling a port that receives a BPDU. Option B is incorrect because Rapid PVST+ uses RSTP's handshake mechanism, not timer-based convergence like 802.1D. Option C is wrong: Rapid PVST+ is based on 802.1w, not 802.1D. Option E is false because Rapid PVST+ does not use 802.1Q to reduce instances; it maintains a separate spanning-tree instance per VLAN.

Answer

Rapid PVST+ is an enhancement of PVST+ and uses the same timer-based convergence as standard 802.1D.

Answer

Rapid PVST+ uses the 802.1D standard to compute the spanning tree for each VLAN.

Answer

Rapid PVST+ uses the 802.1Q trunking protocol to reduce the number of spanning-tree instances.