CCNA Drag & Drop — 40 Questions

Question 1

Drag and drop the following steps into the correct order to configure a Cisco switch as a DHCP relay agent with DHCP snooping, where the DHCP server is located on a remote router.

Accepted Answer

Configure a DHCP pool with network, default gateway, and lease parameters on the router acting as the DHCP server.. First, the DHCP server must be properly configured on the router. Next, DHCP snooping is enabled globally on the switch to protect against rogue servers. Then, the specific client VLANs must be added to the snooping database. After that, the uplink interface to the DHCP server must be trusted to allow legitimate server responses. Finally, the ip helper-address command is placed on the client's SVI to forward DHCP broadcasts to the remote server.

Question 2

Drag and drop the following steps into the correct order to configure a switch port for data and voice traffic.

Accepted Answer

Enter interface configuration mode for the desired switch port.. The correct order is: 1) Enter interface configuration mode, because all port-specific commands must be applied under the interface. 2) Set the port as an access port with 'switchport mode access'—a voice VLAN can only be assigned on an access port. 3) Assign the data VLAN with 'switchport access vlan' to ensure proper Layer 2 forwarding for data traffic. 4) Assign the voice VLAN with 'switchport voice vlan' so the IP phone's voice frames are tagged with the voice VLAN. 5) Enable PortFast with 'spanning-tree portfast' to immediately transition the port to forwarding, preventing DHCP timeouts for the phone and host.

Question 3

Drag and drop the following steps into the correct order to describe how data is encapsulated as it travels down the OSI model layers.

Accepted Answer

Application data is generated by the upper layers.. Data originates at the application layer as user data. The transport layer then encapsulates this data by adding a header (e.g., TCP or UDP) to create a segment. The network layer further adds an IP header to the segment, forming a packet. Next, the data link layer appends a frame header and trailer to the packet, resulting in a frame. Finally, the physical layer converts the entire frame into bits for electrical, optical, or radio transmission. This sequence follows the standard top-down encapsulation process in network communication.

Question 4

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a VLAN 10 subnet and enable DHCP relay for a remote client on VLAN 20.

Accepted Answer

1. Exclude addresses from the pool. 2. Configure the DHCP pool for VLAN 10 with network, default-router, and DNS. 3. Enable DHCP relay on the VLAN 20 interface. 4. Verify DHCP operations.. The correct sequence is to globally exclude IP addresses first, preventing the DHCP server from assigning reserved addresses. Then define the DHCP pool for VLAN 10 with network parameters, enable DHCP relay on the VLAN 20 interface so it forwards requests to the server, and finally verify the service is functioning. Options that place relay before pool or exclusions after pool misorder these essential configuration steps and deviate from recommended practice.

Answer

1. Enable DHCP relay on the VLAN 20 interface. 2. Configure the DHCP pool for VLAN 10. 3. Exclude addresses from the pool. 4. Verify DHCP operations.

Answer

1. Exclude addresses from the pool. 2. Enable DHCP relay on the VLAN 20 interface. 3. Configure the DHCP pool for VLAN 10. 4. Verify DHCP operations.

Answer

1. Configure the DHCP pool for VLAN 10. 2. Enable DHCP relay on the VLAN 20 interface. 3. Exclude addresses from the pool. 4. Verify DHCP operations.

Question 5

Drag and drop the following phases into the correct order to configure gRPC streaming telemetry subscription setup and then the NetFlow data path sequence.

Accepted Answer

1. Configure gRPC telemetry subscription
2. Configure NetFlow export destination
3. Define flow monitor
4. Apply flow monitor to interface. First configure telemetry, then set up NetFlow export, define the flow monitor, and finally apply it to an interface.

Answer

1. Define flow monitor
2. Apply flow monitor to interface
3. Configure gRPC telemetry subscription
4. Configure NetFlow export destination

Answer

1. Configure NetFlow export destination
2. Define flow monitor
3. Apply flow monitor to interface
4. Configure gRPC telemetry subscription

Answer

1. Apply flow monitor to interface
2. Configure gRPC telemetry subscription
3. Define flow monitor
4. Configure NetFlow export destination

Question 6

Drag and drop the following steps into the correct order to configure a Cisco switch as a DHCP relay agent with DHCP snooping, where the DHCP server is located on a remote router.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

1. Configure Root Guard on designated ports. 2. Configure Loop Guard on non-designated ports. 3. Configure BPDU Guard on PortFast ports. 4. To recover a port that enters err-disabled due to BPDU Guard violation, manually shut and no shut the interface.. Root Guard on designated, Loop Guard on non-designated, then BPDU Guard on PortFast; recovery requires interface reset after violation.

Answer

1. Configure BPDU Guard on PortFast ports. 2. Configure Loop Guard on non-designated ports. 3. Configure Root Guard on designated ports. 4. To recover a port that enters err-disabled due to BPDU Guard violation, re-enable BPDU Guard on the port.

Answer

1. Configure Loop Guard on non-designated ports. 2. Configure Root Guard on designated ports. 3. Configure BPDU Guard on PortFast ports. 4. To recover a port that enters err-disabled due to BPDU Guard violation, configure errdisable recovery cause bpduguard.

Answer

1. Configure Root Guard on designated ports. 2. Configure BPDU Guard on PortFast ports. 3. Configure Loop Guard on non-designated ports. 4. To recover a port that enters err-disabled due to BPDU Guard violation, remove BPDU Guard from the port.

Question 7

Drag and drop the following steps into the correct order to configure a Cisco switch as a DHCP relay agent with DHCP snooping, where the DHCP server is located on a remote router.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then permit ip any any, then enter the interface facing the source and apply the ACL inbound.. First, global config, then create ACL with deny and permit statements (order matters: deny first), then enter the source-facing interface and apply inbound; applying before creating ACL would fail.

Answer

Enter the interface facing the source, apply the ACL inbound, then enter global configuration mode and create the ACL with deny and permit statements.

Answer

Enter global configuration mode, create the ACL with permit ip any any first, then deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound.

Answer

Enter global configuration mode, create the ACL with deny tcp 192.168.1.0 0.0.0.255 10.0.0.0 0.0.0.255 eq telnet, then enter the interface facing the source and apply the ACL inbound, without adding a permit statement.

Question 8

Drag and drop the following steps into the correct order to configure and apply an extended IPv4 ACL on a Cisco router to block Telnet traffic from subnet 192.168.1.0/24 to host 10.0.0.1 and permit all other IP traffic.

Accepted Answer

Identify the traffic to filter (deny Telnet from 192.168.1.0/24 to 10.0.0.1) and determine that the ACL should be applied inbound on interface GigabitEthernet0/1.. Correct order: 1) Identify the traffic to filter and the interface/direction because this planning determines all subsequent configuration choices. 2) Enter global configuration mode to access ACL definition. 3) Configure the deny statement first — ACLs are processed top-down, so the specific deny must precede the general permit to actually block the unwanted traffic. 4) Add the permit statement after the deny to allow everything else. 5) Enter interface configuration mode to attach the ACL to a specific port. 6) Apply the ACL with the correct direction (inbound) using the ip access-group command, which activates the filtering. 7) Verify the ACL is correctly applied to confirm the configuration is functioning as intended.

Question 9

Drag and drop the following steps into the correct order to capture and analyze traffic on IOS-XE using the embedded packet capture feature, then export to Wireshark to isolate a Layer 2 or Layer 3 fault.

Accepted Answer

Enter privileged EXEC mode, define the capture buffer, specify the interface and direction, start the capture, stop the capture, export the capture to a .pcap file, transfer the file, and analyze in Wireshark.. First enter privileged mode, then define the capture buffer, specify the interface and direction, start the capture, stop it after collecting data, export to a .pcap file, then transfer and analyze in Wireshark.

Answer

Enter global configuration mode, define the capture buffer, specify the interface and direction, start the capture, stop the capture, export the capture to a .pcap file, transfer the file, and analyze in Wireshark.

Answer

Enter privileged EXEC mode, specify the interface and direction, define the capture buffer, start the capture, stop the capture, export the capture to a .pcap file, transfer the file, and analyze in Wireshark.

Answer

Enter privileged EXEC mode, define the capture buffer, specify the interface and direction, start the capture, export the capture to a .pcap file, stop the capture, transfer the file, and analyze in Wireshark.

Question 10

Drag and drop the following steps into the correct order to configure a Cisco switch as a DHCP relay agent with DHCP snooping, where the DHCP server is located on a remote router.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

1. Perform longest prefix match on destination IP address
2. If multiple routes match, compare administrative distance
3. If AD is equal, compare metric
4. Forward packet using the best route. The router applies longest prefix match first, then administrative distance, then metric, in that order, to select the best path and forward the packet.

Answer

1. Compare administrative distance of all routes
2. Compare metric of routes with lowest AD
3. Perform longest prefix match on remaining routes
4. Forward packet using the best route

Answer

1. Compare metric of all routes
2. Compare administrative distance of routes with lowest metric
3. Perform longest prefix match on remaining routes
4. Forward packet using the best route

Answer

1. Perform longest prefix match on destination IP address
2. If multiple routes match, compare metric
3. If metric is equal, compare administrative distance
4. Forward packet using the best route

Question 11

Which of the following sequences correctly orders the steps to plan, configure, and apply an extended ACL that permits HTTP traffic from the 192.168.1.0/24 subnet to the server at 10.0.0.1, and deny all other IP traffic, applied inbound on interface GigabitEthernet0/1?

Accepted Answer

Enter global configuration mode, create ACL with permit statement for HTTP from 192.168.1.0/24 to 10.0.0.1, add deny ip any any, enter interface configuration mode for GigabitEthernet0/1, apply ACL inbound.. First enter global config, then create ACL with permit statement, then deny all, then enter interface, then apply ACL inbound.

Answer

Enter interface configuration mode, apply ACL inbound, then create ACL with permit statement, add deny ip any any, exit to global config.

Answer

Enter global configuration mode, create ACL with deny ip any any first, then permit statement for HTTP, enter interface, apply ACL inbound.

Answer

Enter global configuration mode, create ACL with permit statement for HTTP, add deny ip any any, apply ACL outbound on interface GigabitEthernet0/1.

Question 12

Drag and drop the following steps into the correct order to create VLANs, assign access ports, configure 802.1Q trunks, set the native VLAN, and verify with 'show vlan brief' and 'show interfaces trunk'.

Accepted Answer

Create VLANs, assign access ports, configure 802.1Q trunks, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'. VLANs must be created before assigning ports; trunking is configured after access ports; verification is the final step.

Answer

Assign access ports, create VLANs, configure 802.1Q trunks, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'

Answer

Create VLANs, assign access ports, set native VLAN, configure 802.1Q trunks, verify with 'show vlan brief' and 'show interfaces trunk'

Answer

Assign access ports, configure 802.1Q trunks, create VLANs, set native VLAN, verify with 'show vlan brief' and 'show interfaces trunk'

Question 13

Drag and drop the following steps into the correct order for the router's routing table lookup process when forwarding a packet to a destination IP address, including the best-path selection logic.

Accepted Answer

1. Match the destination IP address with the longest prefix in the routing table. 2. If multiple routes match, select the route with the lowest administrative distance. 3. If still multiple routes, select the route with the lowest metric.. The routing table lookup first matches the destination with the longest prefix, then applies tie-breakers: lowest administrative distance, then lowest metric, to determine the best path for forwarding.

Answer

1. Match the destination IP address with the longest prefix in the routing table. 2. If multiple routes match, select the route with the lowest metric. 3. If still multiple routes, select the route with the lowest administrative distance.

Answer

1. Match the destination IP address with any prefix in the routing table (first match). 2. If multiple routes match, select the route with the lowest administrative distance. 3. If still multiple routes, select the route with the lowest metric.

Answer

1. Match the destination IP address with the longest prefix in the routing table. 2. If multiple routes match, select the route with the lowest metric. 3. If still multiple routes, select the route with the highest administrative distance.

Question 14

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on an IOS-XE switch.

Accepted Answer

Enter global configuration mode, configure RADIUS server, configure AAA authentication, enable 802.1X globally, apply 802.1X per interface. First enter global config, then define RADIUS server, then configure AAA authentication, then enable 802.1X globally, then apply per-interface 802.1X settings.

Answer

Enter global configuration mode, enable 802.1X globally, configure RADIUS server, configure AAA authentication, apply 802.1X per interface

Answer

Enter global configuration mode, configure AAA authentication, configure RADIUS server, enable 802.1X globally, apply 802.1X per interface

Answer

Enter global configuration mode, configure RADIUS server, enable 802.1X globally, configure AAA authentication, apply 802.1X per interface

Question 15

Drag and drop the following steps into the correct order to configure AAA with a RADIUS server and enable 802.1X port authentication on a Cisco IOS-XE switch.

Accepted Answer

Enter global configuration mode, define the RADIUS server, configure AAA authentication, enable 802.1X globally, apply per-interface 802.1X settings.. First enter global config, then define the RADIUS server, then configure AAA authentication, then enable 802.1X globally, and finally apply per-interface 802.1X settings.

Answer

Enter global configuration mode, enable 802.1X globally, define the RADIUS server, configure AAA authentication, apply per-interface 802.1X settings.

Answer

Enter global configuration mode, configure AAA authentication, define the RADIUS server, enable 802.1X globally, apply per-interface 802.1X settings.

Answer

Enter global configuration mode, define the RADIUS server, enable 802.1X globally, configure AAA authentication, apply per-interface 802.1X settings.

Question 16

Drag and drop the following steps into the correct order to isolate and resolve interface CRC errors, duplex mismatches, and flapping on a Cisco IOS-XE switch.

Accepted Answer

Check interface statistics for CRC errors, runts, or giants; verify duplex and speed settings; replace faulty cables or transceivers; monitor interface to confirm resolution.. Start with checking statistics to identify issues, then verify duplex and cable, replace hardware if needed, and finally confirm resolution.

Answer

Replace the cable immediately; then check interface statistics; if errors persist, adjust duplex settings; finally, monitor the interface.

Answer

Verify duplex and speed settings; then replace the cable; check interface statistics; finally, monitor the interface.

Answer

Monitor the interface for errors; then replace the cable; if errors continue, adjust duplex settings; finally, check interface statistics.

Question 17

Which of the following correctly describes the sequence of the TCP three-way handshake between a client and a server?

Accepted Answer

Client sends SYN, Server responds with SYN-ACK, Client sends ACK. The TCP three-way handshake establishes a reliable connection in three steps: the client sends a SYN, the server replies with SYN-ACK, and the client acknowledges with an ACK. Option A correctly depicts this. Option B omits the server's SYN, leaving synchronization incomplete. Option C reverses the roles by having the server initiate, which never occurs in a standard handshake. Option D begins with a SYN-ACK, which is not a valid initial packet; the handshake must start with a SYN.

Answer

Client sends SYN, Server responds with ACK, Client sends SYN-ACK

Answer

Server sends SYN, Client responds with SYN-ACK, Server sends ACK

Answer

Client sends SYN-ACK, Server responds with SYN, Client sends ACK

Question 18

Drag and drop the following steps into the correct order to configure and recover from a BPDU guard violation on a PortFast-enabled access port in RSTP.

Accepted Answer

Configure PortFast and BPDU guard on the interface.. Configure PortFast and BPDU guard on the access port. Then trigger a violation by connecting an unauthorized switch, which causes the port to error-disable. Diagnose by checking the error-disabled status. To recover, first remove the offending device, then cycle the port with shutdown and no shutdown; otherwise the port will immediately go error-disabled again.

Question 19

Drag and drop the following steps into the correct order to configure an LACP EtherChannel on two Cisco switches using active mode.

Accepted Answer

Enter interface configuration mode for the physical ports (interface range gigabitethernet 0/1-2).. To configure an LACP EtherChannel in active mode, you must first enter interface configuration mode on the physical interfaces (e.g., using interface range). Next, assign those interfaces to a channel group using the channel-group command with the mode active keyword; this enables LACP negotiation and ensures the switch actively attempts to form a bundle. After the member ports are configured, you can optionally set parameters on the Port-Channel interface (such as switchport mode trunk). Finally, verify the EtherChannel is operational with show etherchannel summary. Using mode passive, on, or desirable would not enable LACP active negotiation or would use a different protocol (PAgP), which does not meet the requirement.

Question 20

Drag and drop the following steps into the correct order to configure Rapid PVST+ with a designated root bridge, PortFast, and BPDU Guard on access ports.

Accepted Answer

Set the spanning-tree mode to Rapid PVST+. 1. Set the spanning-tree mode to Rapid PVST+: This enables Rapid PVST+ globally, a prerequisite for the root primary command to function correctly. 2. Configure the switch as the root bridge for VLAN 1: Lowers the bridge priority to guarantee this switch becomes the root, defining the STP topology. 3. Enter interface configuration mode for the access ports: Prepares the specific ports where PortFast and BPDU Guard are applied. 4. Enable PortFast on the interfaces: Allows immediate transition to forwarding state, bypassing listening/learning phases. 5. Enable BPDU Guard on the interfaces: Protects the network by err-disabling the port if a BPDU is received, which should occur only after PortFast is enabled on access ports.