CCNA Mock Exam 96 — 25 Questions

Question 1

Drag and drop the following steps into the correct order to configure VLANs, assign access ports, set up 802.1Q trunks with a native VLAN, and verify the configuration using show commands.

Accepted Answer

1. Create VLANs using the 'vlan' command in global config mode. 2. Assign access ports to VLANs using 'switchport access vlan'. 3. Configure trunk ports with 'switchport mode trunk' and set native VLAN with 'switchport trunk native vlan'. 4. Verify with 'show vlan brief', 'show interfaces trunk', and 'show interfaces switchport'.. The correct sequence ensures VLANs exist before any port assignment or trunk configuration. Creating VLANs first is essential because both access and trunk ports depend on VLANs being present. Access port assignment and trunk configuration are independent steps that can occur in either order after VLANs are created. Verification using 'show vlan brief', 'show interfaces trunk', and 'show interfaces switchport' is always the final step to confirm the setup.

Question 2

An administrator wants to permit HTTP and HTTPS from 10.1.10.0/24 to a web server at 198.51.100.20 and deny everything else from that subnet. Which ACL type is required?

Accepted Answer

Extended ACL. A standard ACL can match only the source address. To permit specific protocols and ports such as TCP 80 and 443 to a specific destination, the administrator must use an extended ACL.

Answer

Named standard ACL

Answer

Prefix list

Answer

MAC access-list

Question 3

Which TWO statements correctly describe the OSI model layers and their corresponding PDU names during encapsulation?

Accepted Answer

The Transport layer encapsulates data into segments.. Both A and B are correct. During encapsulation, the Transport layer (Layer 4) adds a header to upper-layer data to form segments, and the Network layer (Layer 3) encapsulates those segments into packets by adding a network-layer header (e.g., IP). Option C is incorrect because the Data Link layer encapsulates packets into frames, not bits; bits are the raw transmission unit at the Physical layer. Option D is incorrect because the Session layer manages sessions but does not produce a PDU called 'sessions'; encapsulation of segments only occurs at Layers 4 and below. Option E is incorrect because the Physical layer transmits frames as bits but does not perform encapsulation; encapsulation ends at the Data Link layer.

Answer

The Data Link layer encapsulates packets into bits.

Answer

The Session layer encapsulates segments into sessions.

Answer

The Physical layer encapsulates frames into bits.

Question 4

A switch port connected to an end host is configured with both PortFast and BPDU Guard. What is the most likely outcome if a small switch is connected there and starts sending BPDUs?

Accepted Answer

The port is error-disabled by BPDU Guard.. BPDU Guard places the port into an error-disabled state upon receiving a BPDU, because PortFast defines the port as an edge port that should never receive BPDUs. Option B is incorrect because receiving a BPDU does not automatically make a port a root port; root port selection depends on bridge ID and path cost, and BPDU Guard prevents further STP processing by disabling the port. Option C is incorrect because a port cannot convert to a trunk solely by receiving a BPDU; trunking requires manual configuration or Dynamic Trunking Protocol (DTP). Option D is incorrect because PortFast does not disable STP entirely; it only speeds up initial convergence, and BPDU Guard actively responds to BPDUs by error-disabling the port.

Answer

The port automatically becomes the root port.

Answer

The port converts into a trunk for the attached switch.

Answer

The port ignores the BPDU because PortFast disables STP entirely.

Question 5

Drag and drop the following steps into the correct order to configure an LACP EtherChannel on two Cisco switches.

Accepted Answer

Enter global configuration mode, select the interfaces to be part of the EtherChannel, set the channel-group mode to active on both switches, and verify the configuration.. Start in global config, select interfaces, set channel-group mode to active on each interface (at least one side must be active; the other can be active or passive), then verify. This order ensures consistent negotiation and correct channel formation.

Question 6

Which three options are valid ways to secure administrative access to a Cisco IOS device? (Choose three.)

Accepted Answer

Use the 'enable secret' command to set a privileged EXEC password.. All three correct options are valid methods to secure administrative access. Creating a local username/password with the 'username name secret password' command provides authentication for login (e.g., via SSH, console, or VTY). Configuring an ACL on VTY lines restricts which source IP addresses can initiate administrative sessions, adding a layer of network-based access control. Using 'enable secret' protects privileged EXEC mode with a strong hashed password. The three wrong options do not directly secure administrative access: 'shutdown' disables ports (port security, not administrative access), 'service password-encryption' only encrypts passwords in the running configuration (not in transit), and CDP is a neighbor discovery protocol unrelated to authentication.

Answer

Configure CDP globally to verify neighbor devices before login.

Answer

Set the 'service password-encryption' command to encrypt all passwords in transit.

Answer

Disable all unused ports using the 'shutdown' command.

Question 7

You are connected to R1, a multilayer switch acting as the STP root for VLAN 10. Configure Root Guard on port GigabitEthernet0/1 (designated port) to protect against superior BPDUs from an unauthorized switch, Loop Guard on uplink GigabitEthernet0/2 to prevent forwarding loops on unidirectional links, and BPDU Guard on PortFast-enabled GigabitEthernet0/3 to shut down the port if a BPDU is received. After configuration, troubleshoot the scenario: a superior BPDU is received on G0/1, causing it to be blocked by Root Guard, and an unauthorized switch sends a BPDU to G0/3, placing it in err-disable state. Verify the final configuration and state.

Accepted Answer

[CORRECT] Root Guard on G0/1 is correctly configured; when a superior BPDU is received, the port is placed into a root-inconsistent state (BKN* in show spanning-tree) to prevent the switch from becoming root. Loop Guard on G0/2 prevents loops if BPDUs stop arriving due to a unidirectional link. BPDU Guard on G0/3, combined with PortFast, err-disables the port upon receiving any BPDU, as shown by the err-disabled status. To recover, the administrator must manually re-enable the interface after removing the offending device. No additional configuration is required; the existing commands are correct and produce the expected behavior.. The scenario demonstrates three STP protection mechanisms. Root Guard on G0/1 is correctly configured; when a superior BPDU is received, the port is placed into a root-inconsistent state (BKN* in show spanning-tree) to prevent the switch from becoming root. Loop Guard on G0/2 prevents loops if BPDUs stop arriving due to a unidirectional link. BPDU Guard on G0/3, combined with PortFast, err-disables the port upon receiving any BPDU, as shown by the err-disabled status. To recover, the administrator must manually re-enable the interface after removing the offending device. No additional configuration is required; the existing commands are correct and produce the expected behavior.

Answer

Root Guard on G0/1 is incorrectly configured; it should be configured on the root port, not the designated port. Loop Guard on G0/2 is correctly configured. BPDU Guard on G0/3 is correctly configured, but the port should automatically recover from err-disable state after a timeout.

Answer

Root Guard on G0/1 is correctly configured. Loop Guard on G0/2 is incorrectly configured because Loop Guard should be applied to root ports, not uplink ports. BPDU Guard on G0/3 is correctly configured, but the port should be in a blocking state, not err-disabled.

Answer

Root Guard on G0/1 is correctly configured. Loop Guard on G0/2 is correctly configured. BPDU Guard on G0/3 is incorrectly configured because BPDU Guard should be applied to trunk ports, not access ports, and the port should be placed in a root-inconsistent state.

Question 8

On a broadcast multiaccess segment, R3 has an OSPF priority of 255, but it is in the DROTHER state. Which explanation best fits OSPF behavior?

Accepted Answer

DR election is nonpreemptive on broadcast networks. On broadcast networks, OSPF DR and BDR election is not preemptive. If a DR is already elected, giving another router a higher priority later does not force a new election unless the current DR goes down or OSPF is reset on the segment.

Answer

A router cannot become DR if it uses a loopback router ID

Answer

OSPF priority works only on point-to-point links

Answer

R3's priority is lower than the current DR's priority

Question 9

Match each service to its primary function.

Accepted Answer

DNS: Translates domain names to IP addresses. DNS translates domain names into IP addresses, enabling clients to reach servers by name. DHCP automates the assignment of IP addresses, subnet masks, default gateways, and other parameters to clients. NTP synchronizes the clocks of network devices to a common time source. Syslog collects and exports log messages from network devices to a centralized server for monitoring and troubleshooting.

Answer

DNS: Automates the assignment of IP addresses to devices

Answer

DNS: Serves web pages to clients

Answer

DNS: Manages network devices via a management information base

Question 10

A switchport connected to another switch is configured as an access port by mistake. Which symptom is most likely in a multi-VLAN design?

Accepted Answer

Only one VLAN is likely to pass correctly, while other VLAN traffic across the link fails. The most likely symptom is that only one VLAN’s traffic works correctly across the link while traffic for other VLANs fails. In plain language, an access port belongs to one VLAN in normal switching behavior. If an inter-switch link that should carry multiple VLANs is accidentally configured as an access port, the network loses the ability to transport the other VLANs.

The physical link may stay up, which can make the problem seem subtle, but the logical role of the port is wrong.

Answer

The link negotiates as a trunk but drops all VLAN traffic

Answer

The switch generates excessive broadcasts on all VLANs

Answer

The switch stops learning MAC addresses entirely

Question 11

Which TWO statements are true regarding HSRP active/standby election, priority, and preemption?

Accepted Answer

The router with the highest priority becomes the active router.. In HSRP, the router with the highest priority wins the election to become the active router (A correct). If preemption is enabled, a router with a higher priority can take over the active role from a lower-priority active router (E correct). Option B is incorrect: when priorities are equal, the router with the highest IP address in the standby group is chosen, not the lowest. Option C is incorrect: HSRP priority ranges from 0 to 255, not 0 to 100. Option D is incorrect: preemption is disabled by default on all HSRP interfaces. Option F is incorrect: a priority of 0 is used to indicate that the router will not participate in the election or will immediately give up the active role, but it does not mean it will never become active; in fact, it can be configured to force a new election.

Answer

The router with the lowest IP address in the standby group becomes the active router.

Answer

HSRP priority can be configured from 0 to 100, with 100 being the highest.

Answer

Preemption is enabled by default on all HSRP interfaces.

Answer

The standby router uses a priority of 0 to indicate it will never become active.

Question 12

Which TWO statements accurately describe the behavior and configuration of floating static routes?

Accepted Answer

A floating static route uses an administrative distance greater than that of the primary dynamic route.. A floating static route serves as a backup by being configured with an administrative distance (AD) greater than that of the primary dynamic route, making it less preferred (option B). It remains inactive until the primary route is removed from the routing table, at which point the floating static route is installed (option D). Option A is wrong because it reverses the AD logic—a floating static route uses a higher, not lower, AD. Option C is incorrect because the AD of a floating static route is typically a value between 1 and 255, not necessarily less than 1. Option E is false because the AD of a floating static route is a fixed configured value and does not change automatically based on network conditions.

Answer

A floating static route is configured with a lower administrative distance than the primary dynamic route.

Answer

The administrative distance of a floating static route must be less than 1.

Answer

Floating static routes automatically adjust their administrative distance based on network conditions.

Question 13

Match each IP service to the transport protocol and default port it commonly uses in a basic CCNA context.

Accepted Answer

HTTP/HTTPS: TCP 80/443; FTP control: TCP 21; SSH: TCP 22; Telnet: TCP 23; DNS: UDP 53. DNS primarily uses UDP port 53 for standard queries due to low overhead; TCP 53 is used for zone transfers but not in basic CCNA context. DHCPv4 server uses UDP port 67 because the protocol relies on broadcasts and does not require a connection-oriented transport. NTP uses UDP port 123 to keep time synchronization lightweight and efficient. Syslog uses UDP port 514 to send system messages without requiring a session, prioritizing speed over reliability.

Answer

HTTP/HTTPS: TCP 80/443; FTP control: TCP 20; SSH: TCP 22; Telnet: TCP 23; DNS: TCP 53

Answer

HTTP/HTTPS: UDP 80/443; FTP control: TCP 21; SSH: TCP 22; Telnet: TCP 23; DNS: UDP 53

Answer

HTTP/HTTPS: TCP 80/443; FTP control: TCP 21; SSH: TCP 22; Telnet: TCP 23; DNS: TCP 53

Question 14

You are connected to R1, a multilayer switch acting as an HSRP active gateway for VLAN 100. The network requires R1 to be the active router with a virtual IP of 192.168.100.1. Currently, both R1 and the peer router R2 show as active in 'show standby brief', and the virtual IP is misconfigured. Configure HSRP on R1 to fix these issues: set priority to 110, enable preempt, correct the virtual IP, and track interface GigabitEthernet0/1 (decrement priority by 20 if it goes down).

Accepted Answer

interface Vlan100
 standby 100 ip 192.168.100.1
 standby 100 priority 110
 standby 100 preempt
 standby 100 track GigabitEthernet0/1 20. The problem had multiple issues: the virtual IP was wrong (192.168.100.254 instead of 192.168.100.1), preempt was not enabled (both routers could claim active), and priority was default (100). Additionally, interface tracking was missing to decrement priority if the upstream link failed. The solution consists of four commands: 'standby 100 ip 192.168.100.1' to set the correct virtual IP, 'standby 100 priority 110' to make R1 the active router, 'standby 100 preempt' to allow R1 to reclaim active role after recovery, and 'standby 100 track GigabitEthernet0/1 20' to reduce priority by 20 if that interface goes down.

Answer

interface Vlan100
 standby 100 ip 192.168.100.254
 standby 100 priority 110
 standby 100 preempt
 standby 100 track GigabitEthernet0/1 20

Answer

interface Vlan100
 standby 100 ip 192.168.100.1
 standby 100 priority 100
 standby 100 preempt
 standby 100 track GigabitEthernet0/1 20

Answer

interface Vlan100
 standby 100 ip 192.168.100.1
 standby 100 priority 110
 standby 100 track GigabitEthernet0/1 20

Question 15

Which TWO of the following are essential IPv4 host parameters that must be correctly configured for a host to communicate with devices on remote networks?

Accepted Answer

Default gateway. The default gateway is the IP address of the router interface on the local subnet; when a host needs to communicate with a device on a remote network, it must forward packets to the default gateway because the destination is not reachable locally. The subnet mask is equally essential because the host uses it (along with its own IP address) to determine whether a destination IP address is on the same local network or a remote network; without a correctly configured subnet mask, the host cannot make this determination and may misroute traffic. DNS server address is only for name resolution and is not required for IP-level connectivity, MAC address is a Layer 2 address already present on the NIC, and hostname is a local identifier irrelevant to routing.

Answer

DNS server address

Answer

MAC address

Answer

Host name

Question 16

A company wants private IPv4 addressing that can be routed internally but not on the public Internet. Which range meets that requirement?

Accepted Answer

172.20.0.0/16. RFC 1918 defines private IPv4 ranges for internal routing: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. 172.20.0.0/16 falls within the 172.16.0.0/12 block, making it a valid private address. 198.51.100.0/24 is reserved for documentation (TEST-NET-2) and should not be used internally. 169.254.0.0/16 is link-local (APIPA), used only for automatic addressing on a single link. 224.0.0.0/4 is multicast, not routable as unicast and not private.

Answer

198.51.100.0/24

Answer

169.254.0.0/16

Answer

224.0.0.0/4

Question 17

Which two statements accurately describe floating static routes?

Accepted Answer

They are static routes configured with higher administrative distance so they act as backups.. The two correct statements describe floating static routes as backup routes with higher administrative distance that activate when the preferred route is lost. Option C is wrong because floating static routes have a higher administrative distance, so they do not override dynamic routes immediately; they only activate if the dynamic route is lost. Option D is wrong because floating static routes are for backup, not equal-cost load balancing. Option E is wrong because floating static routes are entries in the routing table that provide backup, not a replacement for it.

Answer

They always override dynamic routes immediately.

Answer

They are identical to equal-cost load balancing.

Answer

They remove the need for routing tables.

Question 18

Users on VLAN 20 are not receiving IPv4 addresses from the centralized DHCP server at 10.50.0.10. Users in other VLANs are working normally. Based on the exhibit, which change should fix the issue for VLAN 20 clients?

Accepted Answer

Change the helper address on interface Vlan20 to 10.50.0.10.. The SVI for VLAN 20 is forwarding DHCP requests to the wrong helper address. DHCP relay depends on the Layer 3 interface for that VLAN sending client broadcasts to the correct server. Trunks, access ports, and the DHCP pool name on the server are not the first issue shown here. DHCP snooping can filter DHCP server replies on untrusted ports, but since other VLANs are working and no trust misconfiguration is indicated, the root cause is the incorrect ip helper-address on Vlan20.

Answer

Convert the VLAN 20 user ports to trunk mode.

Answer

Configure a default gateway on the user PCs manually.

Answer

Disable DHCP snooping on VLAN 20.

Question 19

You are connected to SW1 via console. SW1 is a multilayer switch with SVIs for VLAN 10 (192.168.10.1/24) and VLAN 20 (192.168.20.1/24). Hosts in VLAN 10 and VLAN 20 need to communicate with each other. Currently, inter-VLAN routing is not working. You need to enable routing on SW1 and verify that the SVIs are operational.

Accepted Answer

Enable IP routing using the 'ip routing' global configuration command.. The 'ip routing' command enables Layer 3 routing on the multilayer switch, allowing SVIs to route between VLAN 10 and VLAN 20. Option B is unnecessary because directly connected SVIs do not require a routing protocol; routing protocols are only needed for routes learned from other routers, and 'ip routing' must still be enabled. Option C would require converting the physical interfaces to routed ports, which would break the existing Layer 2 VLAN topology and is not the intended solution. Option D provides an external router-on-a-stick solution but does not enable routing on SW1 itself, which is the required task. Therefore, only option A correctly enables inter-VLAN routing on SW1.

Answer

Configure a routing protocol such as OSPF or EIGRP on the SVIs.

Answer

Assign IP addresses to the physical interfaces connected to the hosts.

Answer

Create a trunk port and connect a router to perform router-on-a-stick.

Question 20

Match each route-selection concept to the description that best fits it.

Accepted Answer

Longest prefix match: Router selects route with the most specific subnet mask. Longest-prefix match selects the most specific matching route. Administrative distance compares trust between route sources. Metric compares candidate paths within a protocol or route source. Default route serves as a fallback when no more specific route exists.