CCNA Mock Exam 98 — 25 Questions

Question 1

An administrator deploys a new WLAN on a Cisco 9800 WLC using WPA3-Personal (SAE) with AES encryption. A single 802.11ax laptop running Windows 10 fails to connect, displaying an authentication timeout despite entering the correct passphrase. Other clients, including legacy 802.11ac devices, connect without issue.

Accepted Answer

The laptop’s wireless adapter does not support Protected Management Frames, which are mandatory for WPA3-Personal.. WPA3-Personal (SAE) mandates the use of Protected Management Frames (PMF) as defined in IEEE 802.11w. If the laptop's wireless adapter or driver does not support PMF, it cannot complete the SAE handshake, resulting in an authentication timeout. Legacy 802.11ac clients can connect because they are using WPA2, which does not require PMF.

Answer

The WLC’s WLAN is misconfigured for WPA3-Enterprise, and the laptop lacks a supplicant for 802.1X authentication.

Answer

The WLC has disabled 802.11ax OFDMA on the 5 GHz band, preventing the 802.11ax laptop from associating.

Answer

The laptop’s driver is configured for 160 MHz channel width, which is incompatible with the WLC’s channel plan, causing authentication to fail.

Question 2

A network engineer replaces a failed 1000BASE-LX SFP on a core switch with a new transceiver of the same type. After connecting the single-mode fiber, the link remains down and a 'show interfaces gig1/0/49 transceiver' reveals an Rx power of –30 dBm, while the far-end SFP is transmitting at –3 dBm over a 2 km span. The fiber patch cord shows no visible damage.

Accepted Answer

Excessive attenuation due to a dirty or damaged fiber connector is preventing the link from coming up.. Option C is correct because the measured Rx power of –30 dBm is far below the receive sensitivity threshold for 1000BASE-LX (typically –19 to –22 dBm), even though the transmitter is outputting a healthy –3 dBm over only 2 km. This indicates excessive loss in the optical path, most commonly caused by a dirty or damaged fiber connector. Cleaning the connector ends with an appropriate fiber cleaning tool and inspecting with a microscope would likely resolve the issue.

Answer

The new SFP is a counterfeit Cisco transceiver that cannot establish a stable link.

Answer

The SFP is not fully seated in the switch port, causing an intermittent optical connection.

Answer

The single-mode fiber distance exceeds the 10 km maximum for 1000BASE-LX, leading to severe signal dispersion.

Question 3

A network administrator captures traffic on Server B and finds that ICMP echo requests from Host A arrive, and the server generates corresponding echo replies, but these replies never appear on the wire. The server's routing table has a valid default gateway, and no ACLs are blocking the traffic. What is the most likely cause?

Accepted Answer

The server's ARP cache contains an incorrect MAC address for the destination host.. The ICMP echo requests arrive at Server B, and the server generates replies, but they never appear on the wire. This indicates the server cannot deliver the frames to the next hop. Since the server has a valid default gateway and no ACLs are blocking, the most likely cause is an incorrect MAC address in the ARP cache for the destination (either the host or the default gateway). The server will encapsulate the IP packet into a frame using the wrong MAC, causing the switch to drop the frame or send it to the wrong device, so the reply never reaches the wire correctly.

Answer

The server's TCP stack is corrupt.

Answer

The server's routing table is missing a route to the source network.

Answer

The switch port connecting Server B has port security enabled and has learned a different MAC.

Question 4

A network engineer notices that users in VLAN 10 report intermittent connectivity and slow file transfers to a server on the same switch. The engineer issues the show interfaces fa0/1 command on the switch port connected to the server and observes a high number of runts, input errors, and CRC errors, while output errors are minimal. The interface configuration shows speed 100 and duplex full.

Accepted Answer

The server NIC is auto-negotiating to 100 Mbps half-duplex, resulting in a duplex mismatch.. Option B is correct because the symptoms—high runts, input errors, and CRC errors with minimal output errors—are classic indicators of a duplex mismatch. When the switch port is hardcoded to 100 Mbps full-duplex and the server NIC auto-negotiates to 100 Mbps half-duplex (a common fallback when one side is manually set), collisions occur on the full-duplex side, corrupting frames and causing input errors. The speed matches (both 100 Mbps), so the issue is purely duplex-related.

Answer

The server NIC is set to 10 Mbps half-duplex, causing a speed mismatch.

Answer

The cable connecting the server to the switch is faulty, introducing excessive noise.

Answer

The switch port is configured with an incorrect native VLAN, causing duplex negotiation issues.

Question 5

A network administrator has recently upgraded the corporate wireless LAN to support 802.11ax (Wi-Fi 6) and is using WPA3-Enterprise with a central WLC. Several users with new 802.11ax laptops report that they can connect to the SSID, but after a few minutes their connections drop and then re-establish, while legacy 802.11ac clients work without issues. Which action will resolve this problem?

Accepted Answer

Enable Protected Management Frames (PMF) as Required on the WLAN.. WPA3-Enterprise requires Protected Management Frames (PMF) to be set to 'Required' on the WLC. When PMF is not enabled or set to 'Optional', 802.11ax clients using WPA3 may experience intermittent disconnects because management frame protection is mandatory for WPA3 operation. Legacy 802.11ac clients using WPA2 do not require PMF, so they remain unaffected.

Answer

Downgrade the WLAN security to WPA2-Enterprise for backward compatibility.

Answer

Disable OFDMA and MU-MIMO on the WLC for the affected APs.

Answer

Adjust the 5 GHz channel width from 80 MHz to 40 MHz to avoid interference.

Question 6

A user reports that they cannot access a remote server at IP address 10.10.20.50. The user's PC has IP address 192.168.1.25/24, and the default gateway is 192.168.1.1. The user can successfully ping the default gateway and other hosts on the local subnet. However, pings to 10.10.20.50 fail, and a traceroute shows only the first hop (192.168.1.1) followed by timeouts. Which of the following is the most likely cause?

Accepted Answer

The default gateway lacks a route to the 10.10.20.0/24 network.. The user can reach local hosts and the default gateway, confirming that the PC's IP configuration and local switching are functional. The traceroute stopping at 192.168.1.1 with subsequent timeouts indicates that the default gateway receives the packets but does not know how to forward them to the 10.10.20.0/24 network. Therefore, the most likely cause is that the default gateway lacks a route to that remote subnet.

Answer

The user's PC has an incorrect subnet mask.

Answer

The remote server at 10.10.20.50 is powered off.

Answer

The user's DNS server is unreachable.

Question 7

An enterprise network uses an IPv6 dual-stack design. Router R1 has a primary default route ::/0 via 2001:db8:1::1 with AD 1 and a floating default route with AD 10 via link-local address fe80::2. After the primary link fails, the floating route fails to install, and R1 loses all external connectivity. The administrator confirms the backup interface is up/up.

Accepted Answer

The floating static route uses a link-local next-hop but does not specify an exit interface, making the route incomplete.. Option B is correct because a floating static route using a link-local next-hop (fe80::2) must also specify an exit interface (e.g., GigabitEthernet0/1) to be considered complete. Without the exit interface, the router cannot determine which interface to use for neighbor discovery, leaving the route incomplete and unable to be installed into the routing table. This is a common requirement for IPv6 static routes with link-local addresses, as the next-hop is not globally unique.

Answer

The administrative distance of the backup route is 10, so it is not installed while the primary route still exists.

Answer

The floating static route will be installed only if the primary link is administratively shut down, not after a physical failure.

Answer

The next-hop fe80::2 is unreachable because IPv6 neighbor discovery is disabled on the backup interface.

Question 8

An administrator has just configured OSPF in a single area between router R1 and router R2, which are directly connected via their Gi0/0 interfaces with IP addresses 10.0.0.1/30 and 10.0.0.2/30. On R1, the command show ip ospf neighbor shows no entries, and a further check on R2 with show ip ospf interface gi0/0 indicates that the interface is passive. Which configuration error is most likely causing the adjacency failure?

Accepted Answer

R2 has the passive-interface default command but no no passive-interface command for Gi0/0.. The output on R2 shows the Gi0/0 interface is passive, meaning OSPF will not send or receive hello packets on that interface, preventing neighbor discovery. The passive-interface default command makes all interfaces passive by default, and without a no passive-interface Gi0/0 command, the interface remains passive, blocking adjacency formation. This directly explains why R1's show ip ospf neighbor shows no entries.

Answer

The network command on R1 does not cover the 10.0.0.0/30 subnet.

Answer

The OSPF process IDs on R1 and R2 are mismatched.

Answer

The hello and dead intervals on R1 and R2 are not the same.

Question 9

A network engineer notices that traffic from the router to server 192.168.10.5 is being sent over a slow backup link, even though the primary high-speed link is up. The routing table has an OSPF route for 192.168.10.0/24 via the primary link and a static host route to 192.168.10.5/32 via the backup link. Why is the backup link used for traffic to the server?

Accepted Answer

The static /32 route is a more specific match than the OSPF /24 route, so it is selected regardless of administrative distance.. The router uses the most specific matching route in the routing table to forward traffic. The static host route to 192.168.10.5/32 has a longer prefix length (32 bits) than the OSPF route for 192.168.10.0/24 (24 bits), making it a more specific match. Even though OSPF has a higher administrative distance, the longest prefix match rule takes precedence over administrative distance when both routes are present in the routing table.

Answer

The static route has an administrative distance of 1, which is lower than OSPF's 110, so it is always preferred.

Answer

The router is load-balancing between the two routes, and traffic is being hashed to the backup link for this particular flow.

Answer

The OSPF route is not installed in the routing table because the static route has a better AD.

Question 10

A network administrator has configured HSRP between RouterA and RouterB for VLAN 10. End hosts using the virtual IP 192.168.1.1 as their default gateway experience intermittent connectivity losses, and pings to 192.168.1.1 often fail. The output of 'show standby brief' on both routers shows the state as Active. What is the most likely cause?

Accepted Answer

The routers are configured with mismatched HSRP authentication methods.. When both routers show the HSRP state as Active, a 'dual-active' scenario exists, which causes intermittent connectivity because both routers forward traffic for the virtual IP. Mismatched HSRP authentication methods (e.g., one router using plain-text authentication and the other using MD5) prevent the routers from exchanging proper Hello messages, so they fail to negotiate a single Active router. This is the most likely cause because authentication mismatches break the HSRP adjacency, leading to both routers assuming the Active role.

Answer

The virtual IP address is configured on only one router.

Answer

The HSRP group number on one router is set to 0.

Answer

The priority on both routers is configured to the same value.

Question 11

Which TWO statements about SFP transceivers and their associated cable types are correct?

Accepted Answer

SFP-10G-LR transceivers use 1310 nm wavelength and can reach up to 10 km over single-mode fiber.. Option B is correct because the SFP-10G-LR transceiver operates at a 1310 nm wavelength and is designed for single-mode fiber, supporting distances up to 10 km. This is a standard specification defined by IEEE 802.3ae for 10GBASE-LR, making it the accurate description of this transceiver's capabilities.

Answer

SFP-10G-SR transceivers require single-mode fiber.

Answer

SFP-10G-LR transceivers can only be used with multimode fiber.

Answer

SFP-10G-LR transceivers support distances up to 40 km over single-mode fiber.

Question 12

A technician is troubleshooting a dual-stack network where an IPv6-only host cannot reach an IPv4 resource. The technician issues the show ipv6 interface brief command on the local router and notices the interface facing the host has a link-local address but no global unicast address. The technician then checks the running configuration and finds that the command ipv6 unicast-routing is missing. What is the most likely cause?

Accepted Answer

IPv6 unicast routing has not been enabled on the router.. The missing `ipv6 unicast-routing` command means the router is not acting as an IPv6 router, so it does not send Router Advertisement (RA) messages. Without RAs, the host cannot autoconfigure a global unicast address or learn a default gateway, breaking IPv6 connectivity to any IPv4 resource even if NAT64 is present.

Answer

An IPv6 access list on the router is blocking Router Advertisement messages.

Answer

The IPv4 resource is not configured for NAT64 translation.

Answer

The host has an incorrect default gateway for IPv6.

Question 13

An administrator notices that hosts in VLAN 30 on SW1 cannot communicate with hosts in VLAN 30 on SW2, even though both switches are connected via an 802.1Q trunk. Traffic for VLANs 10 and 20 passes without issues across the same trunk. The trunk is configured to allow all VLANs, and the allowed VLAN list explicitly includes VLAN 30. What is the most likely cause of the problem?

Accepted Answer

The native VLAN is mismatched between SW1 and SW2, and VLAN 30 is the native VLAN on one side.. The most likely cause is a native VLAN mismatch. When the native VLAN is mismatched on an 802.1Q trunk, traffic for the native VLAN is not tagged, so frames from VLAN 30 on one switch are received as untagged frames on the other switch and placed into the switch's configured native VLAN. If the native VLAN on one side is VLAN 30 and on the other side is a different VLAN (e.g., VLAN 1), the hosts in VLAN 30 cannot communicate because the frames are interpreted as belonging to different VLANs. Traffic for VLANs 10 and 20 passes because they are not the native VLAN and are properly tagged.

Answer

The trunk encapsulation is set to ISL on one switch and 802.1Q on the other.

Answer

Spanning Tree Protocol has placed VLAN 30 in a blocking state on the trunk link.

Answer

The switched virtual interface (SVI) for VLAN 30 on SW1 is administratively down.

Question 14

A network engineer has implemented DHCP snooping on a Cisco switch to prevent unauthorized DHCP servers. The switch's VLAN 100 SVI is configured with ip helper-address to relay DHCP requests to a legitimate server in VLAN 200. Clients in VLAN 100 cannot obtain IP leases, even though the DHCP server is reachable from the switch and has available addresses.

Accepted Answer

The switch port that connects to the DHCP server's VLAN is not configured as a trusted DHCP snooping port.. DHCP snooping treats all switch ports as untrusted by default, which blocks DHCP server messages (OFFER, ACK) from entering the switch. Even though the switch itself can reach the DHCP server, the relayed reply from the server arrives on a port that is not trusted, so DHCP snooping drops the packet before it can be forwarded to the client. Configuring the port connecting to the DHCP server as a trusted port allows the server's responses to pass through the switch, resolving the issue.

Answer

The ip helper-address command has been incorrectly applied to VLAN 100 instead of VLAN 200.

Answer

DHCP snooping must be disabled globally because it conflicts with the configured DHCP relay agent.

Answer

The DHCP server lacks a valid default gateway, preventing replies from reaching the relay agent's SVI subnet.

Question 15

A network administrator notices that syslog messages from a core router are arriving at the syslog server with timestamps that are hours behind other devices. The router’s NetFlow exports also show incorrect start and end times for flows, making traffic analysis unreliable. The administrator verifies that all router interfaces are up and that the SNMP community strings on the router match the NMS.

Accepted Answer

The router’s NTP client is configured with an incorrect authentication key.. The router's timestamps are incorrect for both syslog messages and NetFlow exports, which points to a system-wide time synchronization issue. NTP (Network Time Protocol) is responsible for maintaining accurate time on network devices, and if the NTP client is configured with an incorrect authentication key, it will fail to synchronize with the NTP server, causing the router's clock to drift. This explains why all time-stamped data (syslog and NetFlow) is consistently behind.

Answer

The logging trap level is set to informational, so only high-severity messages are sent with correct timestamps.

Answer

The SNMP v3 user’s privacy password is incorrect, causing the NMS to reject syslog traps.

Answer

The IP flow cache timeout is set too low, causing NetFlow timestamps to appear skewed.

Question 16

A network engineer has enabled DHCP snooping on a Catalyst switch to prevent rogue DHCP servers. All access ports in VLAN 10 are untrusted. A router attached to a trunk port on the switch acts as the default gateway for VLAN 10 and is configured with the ip helper-address 10.1.2.5, which points to a remote DHCP server. After enabling DHCP snooping, hosts in VLAN 10 cannot obtain IP addresses; packet captures show DHCPDISCOVER messages are sent, but no DHCPOFFER is received. What is the most likely cause?

Accepted Answer

The switch port connecting to the router is not configured as a trusted port for DHCP snooping.. DHCP snooping treats all ports as untrusted by default. When a router acting as a DHCP relay is connected to an untrusted trunk port, the switch drops DHCPOFFER messages received from the router because they originate from an untrusted interface. Configuring the trunk port as trusted allows DHCP server responses (OFFER, ACK) to pass through to clients.

Answer

The router's ip helper-address command is pointing to an incorrect DHCP server IP address.

Answer

The DHCP server is on a different subnet, so the switch needs a switched virtual interface (SVI) in VLAN 10 with an IP address for Layer 3 connectivity.

Answer

DHCP snooping is dropping DHCPDISCOVER messages because the client access ports are untrusted.

Question 17

A network administrator implements a set of spanning-tree enhancements to secure the switching infrastructure. Later, a help desk ticket reports that a user in a remote office cannot connect to any network resources. While investigating, the administrator notices that the switch port connecting the remote office switch to the distribution switch is in a 'root-inconsistent' state and is blocking traffic. Which protection feature, if misapplied, most likely caused this issue?

Accepted Answer

Root Guard. Root Guard is the correct answer because it forces an interface to be a designated port. If a switch receives a superior BPDU (indicating a root bridge with a lower bridge ID) on a Root Guard-enabled port, the port is placed into a 'root-inconsistent' state and blocks traffic to prevent the attached switch from becoming the root bridge. This matches the symptom described: a port in 'root-inconsistent' state blocking traffic after spanning-tree enhancements were applied.

Answer

Loop Guard

Answer

BPDU Guard

Answer

BPDU Filter

Question 18

A network administrator configures PAT on a router to allow internal hosts in the 10.10.10.0/24 subnet to access the Internet. Afterward, users report that they can ping public IP addresses but cannot access any websites. The administrator verifies that the access list for NAT matches the correct subnet, and the 'ip nat inside source list 1 interface GigabitEthernet0/1 overload' command is applied. What is the most likely cause of this issue?

Accepted Answer

The PAT translation table is full, causing new TCP connection requests to be dropped.. The ability to ping public IP addresses confirms that IP routing and PAT translation are working for ICMP traffic. However, the failure to access websites (HTTP/HTTPS) while ping succeeds indicates that the PAT translation table is likely exhausted, preventing the router from creating new translations for TCP connections. The 'overload' keyword is correctly configured, so the issue is not a missing keyword but rather resource exhaustion in the NAT table.

Answer

The router's DNS proxy is misconfigured, preventing resolution of website names.

Answer

The 'overload' keyword was omitted, causing the router to use dynamic NAT with a single-address pool.

Answer

A static NAT entry for a web server is using the same public IP address as the PAT overload.

Question 19

A network engineer configures an EtherChannel between two switches. Switch A's interface is set with channel-group 1 mode active, while Switch B's identical interface is set with channel-group 1 mode auto. When verifying with show etherchannel summary, the engineer observes that the port-channel interface is down and the physical interfaces are not bundled. What is the most likely cause of the problem?

Accepted Answer

The mode 'auto' is a PAgP negotiation mode that is incompatible with the LACP active mode.. Option B is correct because 'active' is an LACP mode that initiates negotiations, while 'auto' is a PAgP mode that passively waits for PAgP packets. Since LACP and PAgP are incompatible protocols, the interfaces will never negotiate a bundle, leaving the port-channel down. The engineer must use matching protocol modes (e.g., both LACP active/passive or both PAgP desirable/auto) for EtherChannel to form.

Answer

The LACP system priority on the active side must be lower than the auto side.

Answer

LACP requires one side to be active and the other passive; two active interfaces will not bundle.

Answer

The physical interfaces must be shut down and then re-enabled after configuring LACP for the bundle to form.

Question 20

A host cannot communicate with its default gateway. The technician uses the show arp command on the host and sees that the ARP entry for the gateway IP is incomplete. The technician has already verified that the Ethernet cable is securely connected and the switch port is active. What should the technician do next?

Accepted Answer

Check the switch port’s VLAN configuration and ensure the host and router interface are in the same VLAN.. An incomplete ARP entry for the default gateway indicates that the host sent an ARP request but never received a reply. Since the physical layer (cable and switch port) is verified as operational, the most likely cause is a Layer 2 mismatch: the host and the router interface are in different VLANs, preventing the ARP reply from reaching the host. Checking the switch port's VLAN configuration ensures both devices are in the same broadcast domain, which is required for ARP to function.

Answer

Replace the Ethernet cable between the host and the switch.

Answer

Clear the ARP cache on the host and attempt to ping the gateway again.

Answer

Check the router’s routing table for a route to the host’s subnet.