CCNA Hard Questions — 25 Difficult Questions

Question 1

A network engineer notices that internal hosts (192.168.1.0/24) can reach external servers on the internet, but replies from external servers never reach the internal hosts. The router R1 is configured with dynamic NAT to translate the internal subnet to a pool of public IPs (203.0.113.10-203.0.113.20). The engineer runs 'show ip nat translations' and sees only a few stale translations. What is the most likely cause of the issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The outside interface (GigabitEthernet0/0) is missing the 'ip nat outside' command.. The 'ip nat outside' command must be applied to the interface facing the external network (GigabitEthernet0/0) for the router to translate return traffic. Without it, the router does not perform NAT on packets arriving on that interface, so replies from external servers are forwarded without translation back to the inside local IPs, which are not routable on the internet. The stale translations indicate that outbound translations were created but never used for return traffic, confirming the missing outside interface command.

Answer

The access list 'NAT' is incorrect; it should permit only specific hosts, not the entire subnet.

Answer

The NAT configuration lacks the 'overload' keyword, so the pool is exhausted quickly.

Answer

The NAT pool 'POOL' has too few addresses; it should be expanded to a /24 subnet.

Question 2

A network administrator is troubleshooting a wireless connectivity issue in a large office. Users on the 5 GHz band report intermittent disconnections and slow performance, while 2.4 GHz clients are unaffected. The office uses a Cisco 9800 WLC with APs that support 802.11ac Wave 2. The administrator checks the WLC's RF profile and notices a high number of channel utilization reports on channel 36. What is the most likely cause of the problem?

Accepted Answer

Change some APs to use channels 40, 44, or 48 to reduce co-channel interference.. Channel 36 is a 20 MHz channel in the 5 GHz band. When many APs use the same channel (channel 36), they share the same medium, leading to co-channel interference (CCI). This causes intermittent disconnections and slow performance for 5 GHz clients because they must contend for airtime. Spreading APs across non-overlapping channels like 40, 44, or 48 reduces CCI and improves performance.

Answer

Enable DFS channels to avoid radar interference.

Answer

Increase the channel width to 160 MHz to improve throughput.

Answer

Disable the 2.4 GHz radios to force all clients to 5 GHz.

Question 3

A network administrator is troubleshooting an IPv6 connectivity issue on a newly deployed router. The router's G0/0/0 interface is configured with an IPv6 address using EUI-64, but hosts on that subnet cannot reach the router's link-local address. The administrator runs 'show ipv6 interface g0/0/0' and sees that the interface is up/up but the IPv6 address is not in the expected format. What is the most likely cause of the problem?

Accepted Answer

The IPv6 address was not configured correctly; the 'ipv6 address' command was likely omitted or misconfigured.. The router's G0/0/0 interface is up/up, but the IPv6 address is not in the expected EUI-64 format. This indicates that the 'ipv6 address' command was likely omitted entirely, because if it were simply misconfigured (e.g., without the `eui-64` keyword), the router would still automatically generate a link-local address, and hosts would be able to reach it. Since hosts cannot reach the link-local address, IPv6 is not enabled on the interface at all. The correct configuration requires the `ipv6 address` command with the appropriate prefix and the `eui-64` keyword.

Answer

The interface is administratively down.

Answer

The MAC address of the interface is invalid, preventing EUI-64 from generating a proper address.

Answer

The router is not sending Router Advertisements, so hosts cannot autoconfigure.

Question 4

What action should be taken to resolve the err-disabled state?

Accepted Answer

Disable BPDU Guard on the distribution switch interface. The distribution switch interface entered err-disabled because it received a BPDU while BPDU Guard was enabled. BPDU Guard is not automatically enabled with PortFast; it must be explicitly turned on, and the scenario assumes it is active. When a BPDU arrives on a BPDU Guard–enabled port, the switch err-disables it to prevent loops. Disabling BPDU Guard on that interface resolves the condition. Disabling Root Guard (option A) would not stop the BPDU Guard trigger; removing PortFast (option C) would not disable the already-enabled BPDU Guard; and changing the port to access mode (option D) is irrelevant to BPDU Guard behavior.

Answer

Disable Root Guard on the distribution switch interface

Answer

Remove PortFast from the new access switch uplink interface

Answer

Configure the interface as an access port instead of trunk

Question 5

A network administrator is troubleshooting connectivity issues in a switched network. Users on VLAN 10 report intermittent connectivity to the server farm. The network uses Rapid PVST+ as the spanning-tree protocol. The administrator examines the switch that is the root bridge for VLAN 10 and notices that one of the uplink interfaces to an access switch is in a blocking state. What is the most likely cause of this issue?

Accepted Answer

Check the spanning-tree priority on other switches to ensure the intended root bridge has the lowest priority for VLAN 10.. In Rapid PVST+, the root bridge for a VLAN should have all its ports in a forwarding state. If an uplink interface on the root bridge is blocking, it indicates that another switch is being elected as the root bridge for VLAN 10, likely because it has a lower spanning-tree priority. By checking and adjusting the priority on other switches, the administrator can ensure the intended switch becomes the root bridge, resolving the intermittent connectivity caused by suboptimal path selection.

Answer

Change the port type of Gi0/3 to trunk to allow multiple VLANs.

Answer

Configure spanning-tree portfast on Gi0/3 to speed up convergence.

Answer

Enable BPDU guard on Gi0/3 to prevent unauthorized switches from affecting the network.

Question 6

A user reports that their computer cannot access the network. The technician checks the computer's IP configuration and finds an APIPA address (169.254.x.x). The computer is connected to a switch port on VLAN 20. The DHCP server is located on VLAN 1. The technician then examines the router's interfaces using 'show ip interface brief' and sees that all interfaces shown are up/up. What should the technician do next?

Accepted Answer

Verify that the ip helper-address command is configured on the router's VLAN 20 interface.. The APIPA address (169.254.x.x) indicates the host failed to obtain a DHCP lease. Since the DHCP server is on VLAN 1 and the host is on VLAN 20, a DHCP relay (ip helper-address) must be configured on the router's VLAN 20 interface to forward DHCP broadcast messages to the server. The 'show ip interface brief' shows all interfaces are up/up, so the next logical step is to verify the relay configuration.

Answer

Check the DHCP server logs to see if it is receiving Discover messages.

Answer

Attempt to ping the DHCP server's IP address from the host's APIPA address.

Answer

Restart the DHCP service on the server and recheck the host.

Question 7

Based on the exhibit, why are clients in VLAN 70 failing to resolve hostnames even though they can reach remote IP addresses?

Accepted Answer

The clients are missing valid DNS server information.. The strongest explanation is that the clients are missing valid DNS server information. In practical terms, successful reachability to remote IP addresses proves that Layer 3 forwarding is working. The failure occurs only when a hostname is used, which points to a naming service problem rather than a general connectivity problem. The DHCP scope shown provides an address and default gateway, but no DNS server option is defined.

This is a very realistic IP-services troubleshooting pattern because the network path works while application usability still fails.

Answer

The default gateway must be removed from the DHCP scope.

Answer

The clients must use PPP before DNS works.

Answer

The VLAN must be converted to the native VLAN on all trunks.

Question 8

A network administrator is troubleshooting a connectivity issue between two remote sites connected via a WAN link. Hosts on VLAN 10 at Site A (192.168.10.0/24) cannot ping the server at Site B (10.10.20.100). The router at Site A has a default route configured with the next-hop IP address 10.10.10.2. The administrator checks the routing table on Router A and notices that the default route is not installed. What is the most likely cause of the problem?

Accepted Answer

The next-hop router 10.10.10.2 is unreachable.. The default route uses a next-hop IP (10.10.10.2) and will only be installed in the routing table if that next-hop is reachable. Since the router’s routing table shows no default route, the most likely cause is that the next-hop 10.10.10.2 is unreachable, preventing the static route from being used. This explains why traffic fails despite the configuration.

Answer

The static route for 10.10.20.0/24 is missing from the routing table.

Answer

The GigabitEthernet0/0 interface is administratively down.

Answer

The default route is not configured; the gateway of last resort is missing.

Question 9

Which statement best describes why a token might be used in an API request instead of sending a username and password with every request?

Accepted Answer

A token can provide a controlled way to authenticate or authorize API access without sending raw credentials every time.. A token can be used because it provides a more controlled and often more practical way to authorize or authenticate repeated API access without exposing raw credentials in every interaction. In plain language, the system can issue a token that the client presents on later requests, which can simplify automation workflows and improve security handling. This does not mean tokens remove the need for security; they are part of how secure API access is often managed.

This is increasingly common in controller and automation environments. The correct answer is the one that recognizes tokens as an access-control mechanism for API interaction rather than as a routing or VLAN concept.

Answer

A token is the IPv4 subnet mask for controller traffic.

Answer

A token is the STP root bridge identifier.

Answer

A token forces the API to use Telnet.

Question 10

Based on the exhibit, which action is most likely required to allow AP-22 to join the controller successfully?

Accepted Answer

Correct the AP's default gateway so it matches the AP's actual subnet and reachability needs.. The correct action is to fix the AP's default gateway so it can reach the controller's subnet. Option B is wrong because APs use Ethernet, not PPP encapsulation, which is used for serial WAN links. Option C is wrong because CAPWAP does not assign IP addresses; DHCP does, but the AP already has a static IP, and removing it would cause it to fall back to DHCP, which may not fix the gateway issue. Option D is wrong because disabling DHCP on the controller would affect all APs and prevent new APs from obtaining addresses, which is not a targeted fix.

Answer

Change the AP from Ethernet to PPP encapsulation.

Answer

Remove the AP IP address so it can obtain an IP address automatically via DHCP.

Answer

Disable DHCP on the controller for all APs.

Question 11

Based on the exhibit, why is traffic to host 198.51.100.70 using the OSPF route instead of the static route?

Accepted Answer

Because the OSPF /26 route is more specific than the static /24 route.. The traffic uses the OSPF route because it is the more specific match. In practical terms, the router evaluates destination-prefix specificity before comparing route source preference. The static route points to a broader /24, while the OSPF entry points to a narrower /26 that still contains the destination. Because longest-prefix match comes first, the /26 route wins.

This is a good reminder that static routes do not automatically beat dynamic routes when the prefixes are different. Specificity matters first, then source preference only when the prefix length is the same.

Answer

Because OSPF always overrides static routing, regardless of prefix length.

Answer

Because the static route must have an administrative distance of 255 to be considered.

Answer

Because the destination 198.51.100.70 is outside both listed routes.

Question 12

A router has the following routes in its table: 172.16.0.0/16, 172.16.20.0/24, and 172.16.20.128/25. Which route is used for traffic to 172.16.20.200?

Accepted Answer

172.16.20.128/25. The /25 route is used because it is the most specific match. In plain language, the router looks for the narrowest route that still contains the destination address. Since 172.16.20.200 falls inside 172.16.20.128/25, that route wins over the broader /24 and /16 entries.

This is a direct longest-prefix-match question. It is meant to reinforce that specificity comes first in routing-table lookup. Broader routes remain useful, but they are not chosen when a more precise matching entry exists.

Answer

172.16.0.0/16

Answer

172.16.20.0/24

Answer

The default route

Question 13

A switch trunk must carry VLANs 10, 20, and 30, but traffic for VLAN 20 is failing. The trunk allowed list on one side is `10,30`. What is the most likely cause?

Accepted Answer

VLAN 20 is missing from the allowed VLAN list on one side of the trunk.. The most likely cause is that VLAN 20 is not in the allowed VLAN list on one side of the trunk. Option B is incorrect because converting the trunk to an access port would block all other VLANs, not just fix VLAN 20. Option C is incorrect because there is no requirement that VLAN 20 must be the native VLAN; native VLAN is unrelated to allowed list filtration. Option D is incorrect because ISL vs 802.1Q does not affect per-VLAN filtering; the allowed list is a separate configuration independent of the encapsulation type.

Answer

The trunk must be converted to an access port for VLAN 20 to work.

Answer

VLAN 20 must always be the native VLAN.

Answer

The switches must both use ISL instead of 802.1Q.

Question 14

A router has both an OSPF route and a static route to the same destination. The static route has an administrative distance of 200. What is the expected behavior while the OSPF route remains available?

Accepted Answer

The static route remains a backup and is used only if the OSPF route is lost.. The static route with an administrative distance of 200 behaves as a floating backup. In plain language, the router keeps it in reserve and prefers the OSPF route while OSPF is healthy, because OSPF’s default administrative distance of 110 is lower and therefore more trusted. The static route does not disappear from the configuration, but it stays out of the active routing table unless the better route is lost.

This is a very common CCNA concept because it shows how routing preference works between different route sources. The higher-distance static route is not useless; it is intentionally configured so that it becomes active only during a failure. That design provides backup routing without interfering with the normal dynamic path. The correct answer is the one describing the static route as a standby or floating route rather than as the preferred path.

Answer

The static route overrides OSPF immediately because static routes always win.

Answer

Both routes must be installed simultaneously because they point to the same destination.

Answer

The router removes the OSPF route because the static route has a manually configured distance.

Question 15

A subnet must support at least 62 usable IPv4 host addresses. Which prefix is the most restrictive that meets the requirement?

Accepted Answer

/26. A /26 is the smallest valid answer. In practical terms, a /26 provides 64 total addresses and 62 usable host addresses after subtracting the network and broadcast addresses. A /27 would be too small because it provides only 30 usable hosts.

This is a standard minimum-prefix question because it checks whether you can work backward from the host requirement and choose the smallest subnet that fits.

Answer

/27

Answer

/25

Answer

/24

Question 16

A router has learned route 172.16.50.0/24 from OSPF with cost 20 and also has a static route to the same prefix with administrative distance 5. Which two statements are correct about route selection?

Accepted Answer

The static route is installed because it has the lower administrative distance. When the same prefix is learned from different routing sources, the router first compares administrative distance (AD). The static route with AD 5 wins over OSPF with AD 110, so option A is correct. Option C is correct because if the static route is removed, the OSPF route becomes the next best candidate and is installed. Option B is wrong since AD is compared before metrics like OSPF cost; a lower cost does not override a lower AD. Option D is wrong because only one route is installed per destination based on AD, not both.

Answer

The OSPF route is installed because cost 20 is lower than metric 0

Answer

Both routes are installed as equal-cost paths automatically

Question 17

A trunk link between two switches is operational, but one side shows a native VLAN mismatch warning. What is the main concern with that condition?

Accepted Answer

Untagged traffic may be associated with different VLANs on each end of the trunk. A native VLAN mismatch can cause untagged traffic to be interpreted as belonging to different VLANs on each end of the trunk. In plain language, the two switches disagree about where untagged frames belong. That can lead to confusing traffic behavior, reachability problems for certain flows, and operational warnings. It is not always a total outage, but it is a design inconsistency that should be corrected.

This matters because trunks carry multiple VLANs, and the native VLAN defines how untagged traffic is handled. If both ends do not agree, the logical treatment of those frames becomes inconsistent. The correct answer is the one that focuses on misclassification of untagged traffic, not on unrelated routing behavior.

Answer

All tagged VLAN traffic is automatically converted to routed traffic

Answer

The mismatch forces OSPF adjacency reset on all routers

Answer

The trunk can carry only one VLAN until the mismatch is cleared

Question 18

After a hub was connected to interface Gi0/10, the interface immediately entered errdisable state. The following syslog message was generated: '%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred on interface Gi0/10.' What is the strongest explanation for why Gi0/10 shut down?

Accepted Answer

Port security detected more MAC addresses than allowed on the interface.. The strongest explanation is a port-security violation caused by the switch seeing more secure MAC addresses than the interface allows. In practical terms, a hub or unmanaged device can cause multiple end hosts to appear behind one access port. If the interface is configured with a maximum of one secure MAC address, additional learned MACs trigger the violation action.

This is a realistic access-layer security scenario because the port does not fail randomly. It fails because the observed behavior violates the configured policy.

Answer

The interface received a superior BPDU and became the root port.

Answer

The hub forced the interface to become a routed port.

Answer

DHCP snooping always shuts a port when a hub is attached.

Question 19

A network administrator notices that a workstation connected to a Cisco switch port cannot communicate with other devices on the same VLAN. The switch port is up/up, but the workstation reports slow performance and intermittent connectivity. What is the most likely cause of this issue?

Accepted Answer

A duplex mismatch between the switch port and the workstation.. A duplex mismatch occurs when one end of the link is set to full-duplex and the other to half-duplex. The half-duplex end detects collisions and the full-duplex end does not, causing late collisions, CRC errors, and retransmissions. This results in slow performance and intermittent connectivity even though the port is operationally up.

Answer

Replace the faulty Ethernet cable between the switch and the workstation.

Answer

Assign the switch port to the correct VLAN.

Answer

Disable spanning-tree on the port to prevent frequent topology changes.

Question 20

A switch trunk is carrying several VLANs, but VLAN 99 traffic is failing. The trunk allowed list includes VLAN 99 on both sides. Which statement best explains why a VLAN can still fail even when it is allowed?

Accepted Answer

Because the VLAN may still be absent, inactive, or otherwise not operational locally even if it is allowed on the trunk. A VLAN can still fail across a trunk even when it is allowed because the allowed list is only one part of the overall design. In plain language, a switch may permit the VLAN on the link, but if the VLAN does not actually exist locally, is not active, or if some other trunk characteristic is inconsistent, traffic can still fail. This is an important CCNA troubleshooting principle: one correct line of configuration does not guarantee the full end-to-end condition is correct.

Candidates often stop at the allowed VLAN list because it is visible in common show commands. However, VLAN presence, local status, and other trunk parameters still matter. The best answer is the one recognizing that permission on the trunk does not automatically prove the entire VLAN path is healthy.

Answer

Because allowing a VLAN on a trunk automatically disables it

Answer

Because VLANs can cross trunks only when PAT is enabled

Answer

Because VLAN 99 must always be the native VLAN