CCNA Hard Questions — 25 Difficult Questions

Question 1

Refer to the exhibit. A network engineer configured an EtherChannel between SW1 and SW2 using LACP. After the configuration is applied, the Port-channel 1 interface remains in a down state and does not pass traffic. The engineer runs the show etherchannel detail command on SW1. Based on the output, what is the most likely cause of the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The interface Gi0/1 is administratively down.. An EtherChannel requires all member ports to have consistent VLAN configurations. However, if one port (Gi0/2) has a native VLAN mismatch, only that port is suspended/excluded from the channel. The port-channel can still become active using other valid members. In this scenario, the port-channel remains down because Gi0/1 is administratively down, leaving no valid member ports to form the channel. The show etherchannel detail output would indicate Gi0/1 in an administratively down state and Gi0/2 in a suspended state due to the native VLAN mismatch.

Answer

The native VLAN is mismatched on member interface Gi0/2.

Answer

The load-balancing method on the port-channel is set incorrectly to src-dst-ip.

Answer

Spanning Tree Protocol has placed the port-channel in a blocking state due to a loop.

Question 2

A network engineer notices that internal hosts (192.168.1.0/24) can reach external servers on the internet, but replies from external servers never reach the internal hosts. The router R1 is configured with dynamic NAT to translate the internal subnet to a pool of public IPs (203.0.113.10-203.0.113.20). The engineer runs 'show ip nat translations' and sees only a few stale translations. What is the most likely cause of the issue?

Accepted Answer

The outside interface (GigabitEthernet0/0) is missing the 'ip nat outside' command.. The 'ip nat outside' command must be applied to the interface facing the external network (GigabitEthernet0/0) for the router to translate return traffic. Without it, the router does not perform NAT on packets arriving on that interface, so replies from external servers are forwarded without translation back to the inside local IPs, which are not routable on the internet. The stale translations indicate that outbound translations were created but never used for return traffic, confirming the missing outside interface command.

Answer

The access list 'NAT' is incorrect; it should permit only specific hosts, not the entire subnet.

Answer

The NAT configuration lacks the 'overload' keyword, so the pool is exhausted quickly.

Answer

The NAT pool 'POOL' has too few addresses; it should be expanded to a /24 subnet.

Question 3

A network administrator is troubleshooting a wireless connectivity issue in a large office. Users on the 5 GHz band report intermittent disconnections and slow performance, while 2.4 GHz clients are unaffected. The office uses a Cisco 9800 WLC with APs that support 802.11ac Wave 2. The administrator checks the WLC's RF profile and notices a high number of channel utilization reports on channel 36. What is the most likely cause of the problem?

Accepted Answer

Change some APs to use channels 40, 44, or 48 to reduce co-channel interference.. Channel 36 is a 20 MHz channel in the 5 GHz band. When many APs use the same channel (channel 36), they share the same medium, leading to co-channel interference (CCI). This causes intermittent disconnections and slow performance for 5 GHz clients because they must contend for airtime. Spreading APs across non-overlapping channels like 40, 44, or 48 reduces CCI and improves performance.

Answer

Enable DFS channels to avoid radar interference.

Answer

Increase the channel width to 160 MHz to improve throughput.

Answer

Disable the 2.4 GHz radios to force all clients to 5 GHz.

Question 4

A network administrator configures PAT on a router to allow internal hosts in the 10.10.10.0/24 subnet to access the Internet. Afterward, users report that they can ping public IP addresses but cannot access any websites. The administrator verifies that the access list for NAT matches the correct subnet, and the 'ip nat inside source list 1 interface GigabitEthernet0/1 overload' command is applied. What is the most likely cause of this issue?

Accepted Answer

The router's DNS proxy is misconfigured, preventing resolution of website names.. The ability to ping public IP addresses confirms that IP routing and PAT are working for ICMP traffic. However, the failure to access websites by name while ping works indicates a DNS resolution problem. If the PAT translation table were full, new ICMP echo requests would also be dropped because they require new NAT translations. Therefore, the most likely cause is a misconfigured DNS proxy or DNS server, preventing name resolution for HTTP/HTTPS sessions.

Answer

The PAT translation table is full, causing new TCP connection requests to be dropped.

Answer

The 'overload' keyword was omitted, causing the router to use dynamic NAT with a single-address pool.

Answer

A static NAT entry for a web server is using the same public IP address as the PAT overload.

Question 5

A network administrator is troubleshooting an IPv6 connectivity issue on a newly deployed router. The router's G0/0/0 interface is configured with an IPv6 address using EUI-64, but hosts on that subnet cannot reach the router's link-local address. The administrator runs 'show ipv6 interface g0/0/0' and sees that the interface is up/up but the IPv6 address is not in the expected format. What is the most likely cause of the problem?

Accepted Answer

The IPv6 address was not configured correctly; the 'ipv6 address' command was likely omitted or misconfigured.. The router's G0/0/0 interface is up/up, but the IPv6 address is not in the expected EUI-64 format. This indicates that the 'ipv6 address' command was likely omitted entirely, because if it were simply misconfigured (e.g., without the `eui-64` keyword), the router would still automatically generate a link-local address, and hosts would be able to reach it. Since hosts cannot reach the link-local address, IPv6 is not enabled on the interface at all. The correct configuration requires the `ipv6 address` command with the appropriate prefix and the `eui-64` keyword.

Answer

The interface is administratively down.

Answer

The MAC address of the interface is invalid, preventing EUI-64 from generating a proper address.

Answer

The router is not sending Router Advertisements, so hosts cannot autoconfigure.

Question 6

What action should be taken to resolve the err-disabled state?

Accepted Answer

Disable BPDU Guard on the distribution switch interface. The distribution switch interface entered err-disabled because it received a BPDU while BPDU Guard was enabled. BPDU Guard is not automatically enabled with PortFast; it must be explicitly turned on, and the scenario assumes it is active. When a BPDU arrives on a BPDU Guard–enabled port, the switch err-disables it to prevent loops. Disabling BPDU Guard on that interface resolves the condition. Disabling Root Guard (option A) would not stop the BPDU Guard trigger; removing PortFast (option C) would not disable the already-enabled BPDU Guard; and changing the port to access mode (option D) is irrelevant to BPDU Guard behavior.

Answer

Disable Root Guard on the distribution switch interface

Answer

Remove PortFast from the new access switch uplink interface

Answer

Configure the interface as an access port instead of trunk

Question 7

A network administrator is troubleshooting connectivity issues in a switched network. Users on VLAN 10 report intermittent connectivity to the server farm. The network uses Rapid PVST+ as the spanning-tree protocol. The administrator examines the switch that is the root bridge for VLAN 10 and notices that one of the uplink interfaces to an access switch is in a blocking state. What is the most likely cause of this issue?

Accepted Answer

Check the spanning-tree priority on other switches to ensure the intended root bridge has the lowest priority for VLAN 10.. In Rapid PVST+, the root bridge for a VLAN should have all its ports in a forwarding state. If an uplink interface on the root bridge is blocking, it indicates that another switch is being elected as the root bridge for VLAN 10, likely because it has a lower spanning-tree priority. By checking and adjusting the priority on other switches, the administrator can ensure the intended switch becomes the root bridge, resolving the intermittent connectivity caused by suboptimal path selection.

Answer

Change the port type of Gi0/3 to trunk to allow multiple VLANs.

Answer

Configure spanning-tree portfast on Gi0/3 to speed up convergence.

Answer

Enable BPDU guard on Gi0/3 to prevent unauthorized switches from affecting the network.

Question 8

A user reports that their computer cannot access the network. The technician checks the computer's IP configuration and finds an APIPA address (169.254.x.x). The computer is connected to a switch port on VLAN 20. The DHCP server is located on VLAN 1. The technician then examines the router's interfaces using 'show ip interface brief' and sees that all interfaces shown are up/up. What should the technician do next?

Accepted Answer

Verify that the ip helper-address command is configured on the router's VLAN 20 interface.. The APIPA address (169.254.x.x) indicates the host failed to obtain a DHCP lease. Since the DHCP server is on VLAN 1 and the host is on VLAN 20, a DHCP relay (ip helper-address) must be configured on the router's VLAN 20 interface to forward DHCP broadcast messages to the server. The 'show ip interface brief' shows all interfaces are up/up, so the next logical step is to verify the relay configuration.

Answer

Check the DHCP server logs to see if it is receiving Discover messages.

Answer

Attempt to ping the DHCP server's IP address from the host's APIPA address.

Answer

Restart the DHCP service on the server and recheck the host.

Question 9

Two routers, R1 and R2, have been configured with HSRP for VLAN 10 to provide default gateway redundancy to hosts. The virtual IP address is 192.168.10.1. After configuration, end hosts report inconsistent connectivity to the gateway, and a failover test reveals that when the active router is shut down, connectivity is lost. The network administrator checks the HSRP status on both routers. R1 shows HSRP group 10 as Active with no standby router, and R2 shows HSRP group 20 as Active with no standby router. What is the most likely cause of the redundancy failure?

Accepted Answer

The HSRP group number is mismatched between R1 and R2.. HSRP requires all routers participating in the same virtual router to use the same group number. Because R1 is active for group 10 and R2 is active for group 20, neither router has a standby for its group. If the active router for a group fails, no standby router can take over, causing loss of connectivity. Authentication mismatch or HSRP version mismatch would typically prevent routers from forming a neighbor relationship, but the provided status showing each router active in a different group points specifically to a group mismatch.

Answer

R2 has a lower HSRP priority than R1, so it cannot become standby.

Answer

The HSRP authentication strings do not match.

Answer

HSRP version 1 is used on R1 while version 2 is used on R2.

Question 10

Based on the exhibit, why are clients in VLAN 70 failing to resolve hostnames even though they can reach remote IP addresses?

Accepted Answer

The clients are missing valid DNS server information.. The strongest explanation is that the clients are missing valid DNS server information. In practical terms, successful reachability to remote IP addresses proves that Layer 3 forwarding is working. The failure occurs only when a hostname is used, which points to a naming service problem rather than a general connectivity problem. The DHCP scope shown provides an address and default gateway, but no DNS server option is defined.

This is a very realistic IP-services troubleshooting pattern because the network path works while application usability still fails.

Answer

The default gateway must be removed from the DHCP scope.

Answer

The clients must use PPP before DNS works.

Answer

The VLAN must be converted to the native VLAN on all trunks.

Question 11

A network administrator is troubleshooting a connectivity issue between two remote sites connected via a WAN link. Hosts on VLAN 10 at Site A (192.168.10.0/24) cannot ping the server at Site B (10.10.20.100). The router at Site A has a default route configured with the next-hop IP address 10.10.10.2. The administrator checks the routing table on Router A and notices that the default route is not installed. What is the most likely cause of the problem?

Accepted Answer

The next-hop router 10.10.10.2 is unreachable.. The default route uses a next-hop IP (10.10.10.2) and will only be installed in the routing table if that next-hop is reachable. Since the router’s routing table shows no default route, the most likely cause is that the next-hop 10.10.10.2 is unreachable, preventing the static route from being used. This explains why traffic fails despite the configuration.

Answer

The static route for 10.10.20.0/24 is missing from the routing table.

Answer

The GigabitEthernet0/0 interface is administratively down.

Answer

The default route is not configured; the gateway of last resort is missing.

Question 12

Which statement best describes why a token might be used in an API request instead of sending a username and password with every request?

Accepted Answer

A token can provide a controlled way to authenticate or authorize API access without sending raw credentials every time.. A token can be used because it provides a more controlled and often more practical way to authorize or authenticate repeated API access without exposing raw credentials in every interaction. In plain language, the system can issue a token that the client presents on later requests, which can simplify automation workflows and improve security handling. This does not mean tokens remove the need for security; they are part of how secure API access is often managed.

This is increasingly common in controller and automation environments. The correct answer is the one that recognizes tokens as an access-control mechanism for API interaction rather than as a routing or VLAN concept.

Answer

A token is the IPv4 subnet mask for controller traffic.

Answer

A token is the STP root bridge identifier.

Answer

A token forces the API to use Telnet.

Question 13

Based on the exhibit, which action is most likely required to allow AP-22 to join the controller successfully?

Accepted Answer

Correct the AP's default gateway so it matches the AP's actual subnet and reachability needs.. The correct action is to fix the AP's default gateway so it can reach the controller's subnet. Option B is wrong because APs use Ethernet, not PPP encapsulation, which is used for serial WAN links. Option C is wrong because CAPWAP does not assign IP addresses; DHCP does, but the AP already has a static IP, and removing it would cause it to fall back to DHCP, which may not fix the gateway issue. Option D is wrong because disabling DHCP on the controller would affect all APs and prevent new APs from obtaining addresses, which is not a targeted fix.

Answer

Change the AP from Ethernet to PPP encapsulation.

Answer

Remove the AP IP address so it can obtain an IP address automatically via DHCP.

Answer

Disable DHCP on the controller for all APs.

Question 14

Based on the exhibit, why is traffic to host 198.51.100.70 using the OSPF route instead of the static route?

Accepted Answer

Because the OSPF /26 route is more specific than the static /24 route.. The traffic uses the OSPF route because it is the more specific match. In practical terms, the router evaluates destination-prefix specificity before comparing route source preference. The static route points to a broader /24, while the OSPF entry points to a narrower /26 that still contains the destination. Because longest-prefix match comes first, the /26 route wins.

This is a good reminder that static routes do not automatically beat dynamic routes when the prefixes are different. Specificity matters first, then source preference only when the prefix length is the same.

Answer

Because OSPF always overrides static routing, regardless of prefix length.

Answer

Because the static route must have an administrative distance of 255 to be considered.

Answer

Because the destination 198.51.100.70 is outside both listed routes.

Question 15

A router has the following routes in its table: 172.16.0.0/16, 172.16.20.0/24, and 172.16.20.128/25. Which route is used for traffic to 172.16.20.200?

Accepted Answer

172.16.20.128/25. The /25 route is used because it is the most specific match. In plain language, the router looks for the narrowest route that still contains the destination address. Since 172.16.20.200 falls inside 172.16.20.128/25, that route wins over the broader /24 and /16 entries.

This is a direct longest-prefix-match question. It is meant to reinforce that specificity comes first in routing-table lookup. Broader routes remain useful, but they are not chosen when a more precise matching entry exists.

Answer

172.16.0.0/16

Answer

172.16.20.0/24

Answer

The default route

Question 16

A switch trunk must carry VLANs 10, 20, and 30, but traffic for VLAN 20 is failing. The trunk allowed list on one side is `10,30`. What is the most likely cause?

Accepted Answer

VLAN 20 is missing from the allowed VLAN list on one side of the trunk.. The most likely cause is that VLAN 20 is not in the allowed VLAN list on one side of the trunk. Option B is incorrect because converting the trunk to an access port would block all other VLANs, not just fix VLAN 20. Option C is incorrect because there is no requirement that VLAN 20 must be the native VLAN; native VLAN is unrelated to allowed list filtration. Option D is incorrect because ISL vs 802.1Q does not affect per-VLAN filtering; the allowed list is a separate configuration independent of the encapsulation type.

Answer

The trunk must be converted to an access port for VLAN 20 to work.

Answer

VLAN 20 must always be the native VLAN.

Answer

The switches must both use ISL instead of 802.1Q.

Question 17

A router has both an OSPF route and a static route to the same destination. The static route has an administrative distance of 200. What is the expected behavior while the OSPF route remains available?

Accepted Answer

The static route remains a backup and is used only if the OSPF route is lost.. The static route with an administrative distance of 200 behaves as a floating backup. In plain language, the router keeps it in reserve and prefers the OSPF route while OSPF is healthy, because OSPF’s default administrative distance of 110 is lower and therefore more trusted. The static route does not disappear from the configuration, but it stays out of the active routing table unless the better route is lost.

This is a very common CCNA concept because it shows how routing preference works between different route sources. The higher-distance static route is not useless; it is intentionally configured so that it becomes active only during a failure. That design provides backup routing without interfering with the normal dynamic path. The correct answer is the one describing the static route as a standby or floating route rather than as the preferred path.

Answer

The static route overrides OSPF immediately because static routes always win.

Answer

Both routes must be installed simultaneously because they point to the same destination.

Answer

The router removes the OSPF route because the static route has a manually configured distance.

Question 18

A router has learned route 172.16.50.0/24 from OSPF with cost 20 and also has a static route to the same prefix with administrative distance 5. Which two statements are correct about route selection?

Accepted Answer

The static route is installed because it has the lower administrative distance. When the same prefix is learned from different routing sources, the router first compares administrative distance (AD). The static route with AD 5 wins over OSPF with AD 110, so option A is correct. Option C is correct because if the static route is removed, the OSPF route becomes the next best candidate and is installed. Option B is wrong since AD is compared before metrics like OSPF cost; a lower cost does not override a lower AD. Option D is wrong because only one route is installed per destination based on AD, not both.

Answer

The OSPF route is installed because cost 20 is lower than metric 0

Answer

Both routes are installed as equal-cost paths automatically

Question 19

A trunk link between two switches is operational, but one side shows a native VLAN mismatch warning. What is the main concern with that condition?

Accepted Answer

Untagged traffic may be associated with different VLANs on each end of the trunk. A native VLAN mismatch can cause untagged traffic to be interpreted as belonging to different VLANs on each end of the trunk. In plain language, the two switches disagree about where untagged frames belong. That can lead to confusing traffic behavior, reachability problems for certain flows, and operational warnings. It is not always a total outage, but it is a design inconsistency that should be corrected.

This matters because trunks carry multiple VLANs, and the native VLAN defines how untagged traffic is handled. If both ends do not agree, the logical treatment of those frames becomes inconsistent. The correct answer is the one that focuses on misclassification of untagged traffic, not on unrelated routing behavior.

Answer

All tagged VLAN traffic is automatically converted to routed traffic

Answer

The mismatch forces OSPF adjacency reset on all routers

Answer

The trunk can carry only one VLAN until the mismatch is cleared

Question 20

After a hub was connected to interface Gi0/10, the interface immediately entered errdisable state. The following syslog message was generated: '%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred on interface Gi0/10.' What is the strongest explanation for why Gi0/10 shut down?

Accepted Answer

Port security detected more MAC addresses than allowed on the interface.. The strongest explanation is a port-security violation caused by the switch seeing more secure MAC addresses than the interface allows. In practical terms, a hub or unmanaged device can cause multiple end hosts to appear behind one access port. If the interface is configured with a maximum of one secure MAC address, additional learned MACs trigger the violation action.

This is a realistic access-layer security scenario because the port does not fail randomly. It fails because the observed behavior violates the configured policy.

Answer

The interface received a superior BPDU and became the root port.

Answer

The hub forced the interface to become a routed port.

Answer

DHCP snooping always shuts a port when a hub is attached.