CCNA Mock Exam 95 — 25 Questions

Question 1

Two directly connected routers running OSPFv3 do not form an adjacency. Both interfaces have valid IPv6 addresses and can ping each other using link-local addresses. What is the most likely cause?

Accepted Answer

The interfaces are assigned to different OSPFv3 areas.. The most likely cause is an OSPFv3 area mismatch on the interface. In practical terms, OSPFv3 still requires neighbors on the same link to agree on the area assignment, just as OSPF for IPv4 does. Link-local reachability alone is not enough to form an adjacency. The protocol parameters still have to match.

This is an important IPv6 routing point because people sometimes assume that successful IPv6 ping means the routing protocol should automatically work. It does not. Adjacency depends on protocol alignment, not just basic connectivity.

Answer

The routers need global unicast addresses before OSPFv3 can run.

Answer

The router IDs must be identical before adjacency can form.

Answer

The link-local addresses must be learned from DHCPv6.

Question 2

A network technician connects a new Cisco switch to an existing access switch using a Category 5e copper patch cable. The link fails to come up, and the interface status shows 'err-disabled'. The technician checks the interface diagnostics and the running configuration. What action should the technician take to resolve the problem?

Accepted Answer

Configure the interface as a trunk port and disable spanning-tree BPDU guard.. The most likely reason for the err-disabled state is a spanning-tree BPDU guard violation on the access switch's port configured with PortFast. When another switch is connected, it sends BPDUs, triggering BPDU guard to error-disable the port. Configuring the interface as a trunk port and disabling BPDU guard (option B) resolves the issue by allowing BPDUs without triggering the protection. Option A is unnecessary because Category 5e supports Gigabit Ethernet. Option C is irrelevant since the problem is not distance-related. Option D is risky because auto-negotiation is preferred and manual settings can cause mismatches.

Answer

Replace the Category 5e cable with a Category 6 cable to support Gigabit Ethernet.

Answer

Replace the copper SFP with a fiber SFP to increase the distance.

Answer

Manually set the speed and duplex to 1000 Mbps and full duplex on both switches.

Question 3

A router has a static route and a RIP route for the same destination prefix. What is the primary reason the static route is preferred over the RIP route?

Accepted Answer

Because the static route has a lower administrative distance for the same prefix.. The static route is preferred because both routes describe the same destination prefix and the static route has the lower administrative distance. In practical terms, longest-prefix match does not break the tie because the prefixes are equal. The router then compares source trust, and static routing wins over RIP by default.

This is a core route-selection concept and a very exam-relevant comparison.

Answer

Because RIP can never be installed when static routing is configured anywhere.

Answer

Because RIP is valid only for host routes.

Answer

Because static routes are always more specific than RIP routes.

Question 4

Why is a northbound API especially useful in a controller-based network architecture?

Accepted Answer

It allows external software to interact programmatically with the controller.. A northbound API is especially useful because it gives external applications and automation tools a defined way to communicate with the controller. In plain language, it allows software above the controller to request information, apply policies, or trigger changes without manual per-device interaction. That is one of the main reasons controller-based networking fits well with orchestration and automation. Option C is incorrect because a northbound API does not replace authentication and authorization; it is an interface that uses existing security mechanisms. Option D is incorrect because VLAN tagging is a data‑plane function unaffected by the northbound API; the API does not eliminate the need for VLANs. The controller is the centralized system, and the northbound API is the software-facing interface that exposes it. The correct answer is the one centered on application integration rather than on physical connectivity or device forwarding.

Answer

It is the cable standard used to connect access points.

Answer

It replaces all need for authentication and authorization.

Answer

It makes VLAN tagging unnecessary.

Question 5

Which TWO statements correctly describe IPv4 and IPv6 host configuration?

Accepted Answer

APIPA assigns an IPv4 address in the 169.254.0.0/16 range when a DHCP server is unavailable.. Option A is correct because APIPA (Automatic Private IP Addressing) automatically assigns an IPv4 address from the 169.254.0.0/16 range when a DHCP server is unavailable, enabling local subnet communication without manual configuration. Option E is correct because the ipconfig command on Windows displays both IPv4 and IPv6 addresses, subnet masks, default gateways, and DNS servers. Option B is incorrect because while IPv6 link-local addresses start with FE80::/10, they are not always assigned using EUI-64; they can also be randomly generated (privacy extensions) or manually configured. Option C is incorrect because EUI-64 generates the interface identifier (host portion) of an IPv6 address from the MAC address, not the network prefix — the prefix is provided via SLAAC, DHCPv6, or manual configuration. Option D is incorrect because a host can have multiple default gateways configured for redundancy, though only one is active at a time per routing table; additionally, IPv4 and IPv6 default gateways are independent and can coexist.

Answer

IPv6 link-local addresses are always assigned using EUI-64 and start with FE80::/10.

Answer

EUI-64 is used to generate the network prefix of an IPv6 address from the interface's MAC address.

Answer

A host can have only one default gateway configured at a time for both IPv4 and IPv6.

Question 6

A network administrator has configured a Cisco switch as a DHCP server for the 192.168.1.0/24 subnet. Hosts in VLAN 10 are unable to obtain IP addresses via DHCP. The switch's SVI for VLAN 10 is up/up. What is the most likely cause of the problem?

Accepted Answer

The DHCP server is including the network and broadcast addresses in the pool, causing conflicts. Use the 'ip dhcp excluded-address' command to exclude them.. Option B is correct. The most likely cause is that the DHCP server pool includes the network (192.168.1.0) and broadcast (192.168.1.255) addresses, which are reserved and cannot be leased. When a host requests an IP, the server may attempt to assign one of these addresses, causing a conflict and preventing successful DHCP lease completion. Using the 'ip dhcp excluded-address' command to exclude these addresses from the pool resolves the issue. Option A is not the best answer because the SVI for VLAN 10 is up/up and must already have an IP address in the 192.168.1.0/24 subnet for the DHCP server to offer addresses to that subnet; if it were missing, DHCP would fail completely, but the symptom would likely be no offers at all, not address conflicts. The problem described is consistent with the pool including reserved addresses, which is a common misconfiguration.

Answer

The VLAN 10 SVI is not configured with an IP address in the 192.168.1.0/24 subnet.

Answer

DHCP snooping is blocking DHCP messages on the switch port connected to the hosts.

Answer

The DHCP pool is not bound to VLAN 10. Use the 'vlan' command under the pool configuration.

Question 7

Which two statements accurately describe controller-based networking at the CCNA level?

Accepted Answer

A controller can centralize management and policy logic.. Option A is correct because a software-defined networking (SDN) controller centralizes management, policy logic, and network intelligence, reducing manual per-device configuration. Option B is correct because northbound APIs (e.g., REST APIs) allow external applications, orchestration tools, and automation scripts to interact with the controller for dynamic network control. Option C is wrong because controllers do not eliminate switches and routers; these devices still forward packets based on instructions from the controller. Option D is wrong because controllers are fundamental to network automation—they provide programmable interfaces and centralized logic that enable automated provisioning and policy enforcement. Option E is wrong because modern controllers use secure communication channels such as HTTPS, SSH, or TLS, not Telnet (which is insecure and rarely used in controller architectures).

Answer

Controllers eliminate all need for switches and routers.

Answer

Controllers are unrelated to automation.

Answer

Controllers require Telnet for all communication.

Question 8

You are connected to R1 via console. R1 is a router-on-a-stick connecting VLAN 10 and VLAN 20 on a single link to switch SW1. Currently, hosts in VLAN 10 cannot ping hosts in VLAN 20, and some VLAN 10 hosts report intermittent connectivity. Examine the provided configuration and output, then fix all issues to restore full inter-VLAN routing and stable trunk operation.

Accepted Answer

On R1, configure 'ip routing', add subinterface G0/0.99 with 'encapsulation dot1Q 99 native' and an IP address, and ensure G0/0 is not shutdown.. Three issues prevent inter-VLAN routing and cause intermittent connectivity. First, R1 lacks a subinterface configured for the native VLAN (VLAN 99) with the 'encapsulation dot1Q 99 native' command; this subinterface is needed because SW1 expects the native VLAN to be tagged on the router side for consistency. Second, the global command 'ip routing' is missing, which disables routing between VLANs. Third, the physical interface GigabitEthernet0/0 might be administratively down; ensure 'no shutdown' is applied. Option A correctly fixes all issues: it adds the native VLAN subinterface, enables routing, and ensures the interface is up. The other options fail because they either misconfigure the native VLAN encapsulation on the wrong subinterface or apply an IP address to the physical interface (which does not support routing on a router-on-a-stick).

Answer

On R1, configure 'ip routing' and change the encapsulation on the VLAN 10 subinterface to 'encapsulation dot1Q 10 native'.

Answer

On R1, configure 'ip routing' and add an IP address to the physical interface GigabitEthernet0/0.

Answer

On R1, configure 'ip routing' and change the encapsulation on the VLAN 20 subinterface to 'encapsulation dot1Q 20 native'.

Question 9

Hosts on the inside network can reach the internet, but return traffic is failing after a new router was installed. The router's configuration shows that the LAN-facing interface has been configured with 'ip nat outside' and the WAN-facing interface with 'ip nat inside'. What configuration mistake is the most likely cause?

Accepted Answer

The NAT inside and outside interface roles are reversed.. NAT overload requires the LAN-facing interface to be marked as ip nat inside and the WAN-facing interface as ip nat outside. The exhibit shows those roles reversed, so translations will not occur correctly. The ACL itself is fine for matching the inside subnet.

Answer

The ACL must deny RFC1918 traffic before NAT can work.

Answer

PAT cannot use an interface address for overload.

Answer

The inside subnet must be configured as /24 on both interfaces.

Question 10

Which four of the following correctly describe characteristics or best practices for VLAN trunking and Layer 2 switch configuration? (Choose four.)

Accepted Answer

When connecting two switches, it is recommended to manually set the trunk mode to avoid DTP negotiation errors and security risks.. 802.1Q trunking defines a native VLAN that carries untagged traffic; both ends must agree on the native VLAN to prevent misdirection and security issues. DTP can negotiate trunking between Cisco switches when ports are set to dynamic desirable or trunk mode, allowing automatic trunk establishment. VTP in transparent mode forwards VTP advertisements to other switches but does not synchronize its VLAN database, making it safe for maintaining local VLAN control. Manually setting trunk mode is a best practice to avoid DTP negotiation errors and security risks, as DTP can be exploited. Option 3 is incorrect because using VLAN 1 for user traffic is a security vulnerability; it is recommended to change the native VLAN and prune VLAN 1. Option 4 is incorrect because an access port belongs to only one VLAN; VLAN pruning is used on trunk links to restrict VLAN traffic, not to allow an access port to carry multiple VLANs.

Answer

A switchport configured as an access port can belong to multiple VLANs simultaneously if using VLAN pruning.

Answer

VLAN 1 is the default native VLAN on Cisco switches and is considered a best practice to use for all user traffic to simplify management.

Question 11

An AP broadcasts the correct SSID, but many clients on one floor experience poor performance while the same SSID works well on another floor. Which category of issue is most strongly suggested first?

Accepted Answer

A radio-frequency or local wireless environment issue on that floor. The issue is location-specific, with performance problems only on one floor. This strongly suggests a local radio frequency (RF) or wireless environment issue such as interference, signal attenuation, or channel congestion on that floor. The SSID is correctly broadcast because clients on other floors connect successfully, so option B (misspelling) is not plausible. Options C and D are unrelated to wireless performance: BGP is a routing protocol not used in basic WLAN deployments, and IPv6 loopback addressing does not affect client connectivity or throughput. Therefore, the most direct and likely first suspect is an RF or environmental issue on that specific floor.

Answer

The SSID name must be misspelled only on that floor

Answer

BGP autonomous system mismatch

Answer

IPv6 loopback addressing on the clients

Question 12

Which TWO statements correctly describe differences between 802.11ac (Wi-Fi 5) and 802.11ax (Wi-Fi 6)?

Accepted Answer

802.11ax supports 1024-QAM modulation, whereas 802.11ac supports up to 256-QAM.. Options B and D are correct. 802.11ax (Wi-Fi 6) introduces 1024-QAM for higher data rates (B), while 802.11ac maxes at 256-QAM. Additionally, 802.11ax supports both 2.4 GHz and 5 GHz bands, whereas 802.11ac is limited to 5 GHz only (D). Option A is incorrect because it reverses the roles: 802.11ac uses OFDM, and 802.11ax uses OFDMA. Option C is incorrect because 802.11ax also operates in 2.4 GHz. Option E is incorrect because Target Wake Time (TWT) is introduced in 802.11ax, not 802.11ac.

Answer

802.11ac uses OFDMA, while 802.11ax uses only OFDM.

Answer

Both 802.11ac and 802.11ax operate exclusively in the 5 GHz band.

Answer

802.11ac introduces target wake time (TWT) for improved power saving, but 802.11ax does not support it.

Question 13

A subnet must support at least 62 usable IPv4 host addresses. Which prefix is the most restrictive that meets the requirement?

Accepted Answer

/26. A /26 is the smallest valid answer. In practical terms, a /26 provides 64 total addresses and 62 usable host addresses after subtracting the network and broadcast addresses. A /27 would be too small because it provides only 30 usable hosts.

This is a standard minimum-prefix question because it checks whether you can work backward from the host requirement and choose the smallest subnet that fits.

Answer

/27

Answer

/25

Answer

/24

Question 14

A non-root switch has two uplinks toward the root bridge. One path has a lower total STP cost than the other. What role will the lower-cost uplink have?

Accepted Answer

Root port. On a non-root switch, the port with the lowest path cost toward the root bridge becomes the root port. The higher-cost uplink would become an alternate (blocked) port. A designated port is found on the upstream switch toward this switch, not on the non-root switch itself. A disabled port is administratively shut down, which does not apply here.

Answer

Alternate port

Answer

Designated port

Answer

Disabled port

Question 15

Which two statements accurately describe common uses of NTP in network operations?

Accepted Answer

It helps align device clocks across the network.. NTP is widely used to keep device clocks aligned, which improves the reliability of event timelines and log correlation because timestamps from different systems can be compared meaningfully. NTP does not replace Syslog, assign IP addresses (DHCP), or provide WLAN encryption; those are separate functions. Its sole purpose is time synchronization.

Answer

It replaces the need for Syslog.

Answer

It assigns IP addresses to hosts.

Answer

It provides WLAN encryption.

Question 16

Which three statements accurately describe the role of Cisco's AI-powered security features (such as Cisco AI Network Analytics, Stealthwatch, or DNA Center's AI-Enhanced Analytics) in network security operations? (Choose three.)

Accepted Answer

AI models can detect zero-day exploits by analyzing behavioral anomalies. Cisco's AI-powered security features detect zero-day exploits by analyzing behavioral anomalies and deviations from learned baselines, without relying on signatures. These systems correlate logs from multiple Cisco products (e.g., firewalls, endpoints, cloud) to uncover multi-step attack chains. AI can also automate responses such as blocking malicious IPs via Cisco security controls, reducing mean time to respond (MTTR). However, AI complements but does not replace traditional security tools like firewall rules or ACLs, and it requires ongoing human oversight for validation and tuning.

Answer

AI eliminates the need for firewall rules and access control lists

Answer

AI is only effective against known, signature-based threats

Answer

AI security models require no human oversight once deployed

Question 17

An engineer is comparing data serialization formats used by controllers and automation tools. Which two statements correctly describe JSON?

Accepted Answer

It represents data as key-value pairs and arrays. Option A is correct because JSON structures data using key-value pairs (objects) and ordered lists (arrays), which are fundamental to its syntax. Option B is correct as JSON is the standard payload format for REST API requests and responses due to its lightweight nature and ease of parsing. Option C is incorrect because JSON does not use closing tags; instead, it relies on curly braces {} for objects and square brackets [] for arrays. Option D is incorrect because JSON supports multiple data types beyond numeric values, including strings, booleans, null, arrays, and nested objects.

Answer

It requires closing tags like XML

Answer

It can only represent numeric values

Question 18

Drag and drop the interface error types on the left to the corresponding descriptions on the right.

Accepted Answer

CRC errors. CRC errors occur when a frame fails the cyclic redundancy check (checksum mismatch) due to noise or faulty cabling. Runts are frames smaller than 64 bytes, typically caused by collisions. Giants are frames exceeding the maximum frame size, often from a faulty NIC. Flaps are repeated link up/down transitions, usually from loose cables or hardware issues. Input errors is a catch-all counter for all receive-side errors including CRC, runts, giants, and framing errors. Each match is correct because the description aligns with the standard definition; for example, CRC errors specifically involve checksum failure, not frame size or link flapping.

Answer

Runts

Answer

Giants

Answer

Late collisions

Question 19

Which three statements accurately describe the role of AI in software-defined networking (SDN) and intent-based networking (IBN)? (Choose three.)

Accepted Answer

AI can assist in translating high-level business policies into low-level device configurations. AI enhances SDN and IBN by analyzing network state to suggest or enforce configuration changes that align with business intent, verifying that the current state matches the desired intent, and translating high-level policies into low-level device configurations. These capabilities enable automation, continuous validation, and policy-driven operations. The incorrect options are wrong because: (1) SDN controllers do not replace AI; AI can augment decision-making beyond basic controller logic. (2) AI in SDN is used for security, compliance, and many other areas, not just traffic engineering. (3) Intent-based networking relies on monitoring and feedback loops to maintain alignment with intent; it does not eliminate them.

Answer

SDN controllers replace AI for all decision-making, making AI unnecessary in IBN

Answer

AI in SDN is only used for traffic engineering, not for security or compliance

Answer

Intent-based networking eliminates the need for any monitoring or feedback loops

Question 20

A network engineer needs a floating static route to back up an OSPF-learned route. Which two configurations are necessary for the static route to remain unused until OSPF fails?

Accepted Answer

Configure the static route with an administrative distance higher than 110. A floating static route requires an administrative distance higher than OSPF's default of 110 (option A) so that the static route is less preferred and remains inactive while OSPF is available. Additionally, the static route must point to a valid next-hop IP or exit interface (option B); without a valid next-hop, the route cannot be installed in the routing table and would never serve as a backup. Option C is incorrect because Cisco routers compare administrative distance before metric when routes come from different sources, so a lower metric cannot override the AD difference. Option D is wrong because a directly connected route (with no next-hop) would be treated as a connected route, not a static route, and would be preferred over OSPF due to its AD of 0, defeating the purpose of a floating backup.

Answer

Set the static route metric lower than the OSPF cost

Answer

Configure the route as directly connected with no next-hop information

CCNA Mock Exam 95 — 25 Questions

Exhibit

CCNA Mock Exam 95 — 25 Questions

Exhibit