CCNA Network Infrastructure and Connectivity Practice Test 23 — 15 Questions

Question 1

You are connected to WLC-1 via SSH. A new SSID 'CorpSecure' must be configured for 5 GHz clients using WPA3-Personal. However, after creation, clients can see the SSID but fail to associate. Review the WLC configuration and fix the issue so that clients can successfully associate and obtain an IP address from VLAN 100 (subnet 10.0.100.0/24).

Accepted Answer

Change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, set the radio policy to 5 GHz, and ensure the WLAN is mapped to the dynamic interface for VLAN 100.. The SSID was configured with WPA2 instead of WPA3. The WLC also had no radio policy set for 5 GHz only. To fix, change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, and set the radio policy to 5 GHz. Additionally, ensure the WLAN is mapped to the appropriate dynamic interface for VLAN 100, not the management interface, and that client VLAN 100 is reachable. The commands to modify the WLAN are: config wlan security wpa3 1 enable, config wlan security wpa3 psk ascii CorpSecurePass123 1, config wlan radio policy 802.11a-only 1, and config wlan enable 1.

Answer

Change the WLAN security to WPA2-Personal, enable TKIP encryption, and set the radio policy to 5 GHz.

Answer

Change the WLAN security to WPA3-Personal, enable AES-CCMP, but leave the radio policy as 'All' (both 2.4 GHz and 5 GHz).

Answer

Change the WLAN security to WPA3-Personal, enable AES-CCMP, set the radio policy to 5 GHz, but do not enable the WLAN after changes.

Question 2

You are connected to the Cisco WLC (WLC-1) via its management IP 192.168.1.10. The wireless network 'CorpNet' is configured but clients cannot associate. Troubleshoot and resolve the issue: clients report 'Association failed' and the SSID is not visible in site surveys. Ensure that after your fix, the SSID is broadcast, WPA3 is used, and the WLAN is mapped to VLAN 20. Also, verify the WLC management interface is accessible over HTTPS.

Accepted Answer

Enable the WLAN, set Broadcast SSID to Enabled, create a dynamic interface for VLAN 20 and map the WLAN to it, and enable the HTTPS server.. The WLAN was disabled, the SSID was hidden (Broadcast SSID Disabled), and it was incorrectly mapped to the management interface instead of a user VLAN. Additionally, HTTPS access was disabled. The solution: enable the WLAN, enable SSID broadcast, change the interface to a VLAN 20 interface (e.g., create a dynamic interface 'vlan20' with VLAN 20), and enable the HTTPS server for management access. Note: On an AireOS WLC, the correct commands use `config wlan enable `, `config wlan broadcast-ssid enable `, and `config network secureweb enable` for HTTPS.

Answer

Enable the WLAN, set Broadcast SSID to Enabled, change the interface to the management interface, and enable the HTTPS server.

Answer

Enable the WLAN, keep Broadcast SSID Disabled for security, create a dynamic interface for VLAN 20 and map the WLAN to it, and enable the HTTPS server.

Answer

Enable the WLAN, set Broadcast SSID to Enabled, create a dynamic interface for VLAN 20 and map the WLAN to it, but leave HTTPS disabled for security.

Question 3

You are connected to a Cisco 9800 WLC (WLC1) via its management interface. A wireless client reports association failures with SSID 'CorpNet'. The client uses WPA3-Personal, but the WLAN is configured for WPA2. Additionally, the SSID is hidden and the client is on the wrong VLAN (VLAN 20 instead of VLAN 100). Fix these issues so the client can associate successfully with WPA3, on VLAN 100, and with the SSID broadcast enabled.

Accepted Answer

Enable SSID broadcast, change security to WPA3-Personal, and assign VLAN 100 in the policy tag.. The WLAN was configured for WPA2-PSK with a hidden SSID, and the policy tag assigned VLAN 20 instead of VLAN 100. To fix: (1) Enable SSID broadcast with 'broadcast-ssid'. (2) Change security to WPA3-Personal by removing WPA2 and enabling WPA3 with 'security wpa wpa3' and 'security wpa psk set-ccmp'. (3) Assign VLAN 100 in the policy tag with 'vlan 100'. The client should then associate.

Answer

Enable SSID broadcast, change security to WPA2-PSK, and assign VLAN 20 in the policy tag.

Answer

Disable SSID broadcast, change security to WPA3-Personal, and assign VLAN 100 in the policy tag.

Answer

Enable SSID broadcast, change security to WPA3-Enterprise, and assign VLAN 100 in the policy tag.

Question 4

You are troubleshooting a client connectivity issue on PC1, which is connected to switch SW1. PC1 reports that it cannot access the internet, but it can ping its default gateway (192.168.1.1). The network uses VLAN 10 for the client subnet. Examine the following show outputs: On PC1, ipconfig shows IP 192.168.1.10, default gateway 192.168.1.1, DNS server 192.168.1.1. On SW1, show running-config includes 'interface Vlan10' with IP 192.168.1.1 255.255.255.0, but no 'ip dns server' and no 'ip name-server' commands. SW1's show ip route displays a default route via 203.0.113.1. Identify the root cause. Configure the necessary fix on the appropriate device to restore full connectivity.

Accepted Answer

Configure 'ip dns server' and 'ip name-server 8.8.8.8' on SW1.. PC1 is configured with DNS server 192.168.1.1, which is the switch SW1. However, SW1 lacks DNS forwarding capability. To enable DNS relay on the switch, both the 'ip dns server' command (to activate the DNS forwarder) and 'ip name-server 8.8.8.8' (to point to an upstream resolver) are required. Option A provides the necessary configuration to restore DNS resolution and internet connectivity.

Answer

Configure 'ip default-gateway 192.168.1.1' on SW1.

Answer

Configure 'ip route 0.0.0.0 0.0.0.0 203.0.113.1' on SW1.

Answer

Configure 'ip domain-lookup' on SW1.

Question 5

You are troubleshooting connectivity for a wireless client connected to the home network shown below. The client has obtained an APIPA address (169.254.x.x), indicating DHCP failure. Verify the DHCP server configuration on R1 and correct the issue so that the client receives a valid IP address from the 192.168.1.0/24 subnet.

Accepted Answer

Enable the DHCP service globally using the 'service dhcp' command on R1.. The client obtained an APIPA address (169.254.x.x) because DHCP was not assigning addresses. The DHCP pool is correctly configured, but the global DHCP service must be enabled with the 'service dhcp' command on R1. The excluded-address range (192.168.1.1–192.168.1.10) uses only a small fraction of the /24 subnet, so it is not the issue. Enabling 'service dhcp' allows the router to process DHCP requests and assign addresses from the pool.

Answer

Remove the 'ip dhcp excluded-address 192.168.1.1 192.168.1.10' command because it excludes too many addresses.

Answer

Change the DHCP pool network to 192.168.1.0/24 and add the default-router 192.168.1.1 command.

Answer

Configure the 'ip helper-address' command on the client's VLAN interface to forward DHCP requests to the server.

Question 6

You are troubleshooting a PC (PC-A) connected to switch SW1, which is connected to router R1. PC-A has an APIPA address (169.254.23.45) and cannot reach the internet (203.0.113.1). You confirm that R1 has a correctly configured DHCP pool for the 192.168.10.0/24 subnet, but the DHCP service is not enabled. The network uses VLAN 10 with subnet 192.168.10.0/24. Verify and correct the configuration on PC-A, SW1, and R1 to restore full connectivity.

Accepted Answer

Enable the DHCP service on R1 with the 'service dhcp' command.. The APIPA address (169.254.x.x) indicates that PC-A failed to obtain a DHCP lease. The correct solution is to enable the DHCP service on R1 with 'service dhcp', which is not running despite the configured pool. Option B is incorrect because setting a default gateway on PC-A with a static IP would still require a valid address in the subnet; the APIPA address cannot communicate with 192.168.10.1. Option C is wrong because the PC-A interface on SW1 is correctly assigned to VLAN 10. Option D is unnecessary since R1 is directly connected to the same subnet, so 'ip helper-address' is only used to forward DHCP broadcasts across router boundaries.

Answer

Configure a default gateway on PC-A with the IP address 192.168.10.1.

Answer

Change the VLAN on SW1's interface connected to PC-A from VLAN 10 to VLAN 1.

Answer

Add the 'ip helper-address' command on R1's interface connected to SW1.

Question 7

You are connected to R1 via the console. The network administrator reports that PC1 (connected to R1's GigabitEthernet0/1) cannot reach the internet. Troubleshoot the issue step by step. The current configuration and show outputs are provided.

Accepted Answer

routing or NAT issue beyond the local network. The issue is that PC1 cannot reach the internet despite having correct IP, gateway, and DNS. PC1 can ping the default gateway and even the next-hop router (203.0.113.2), but fails to ping 8.8.8.8. This indicates that the problem is beyond the local network — likely a routing or NAT issue on the ISP side. However, the task requires troubleshooting client connectivity; the provided outputs show no misconfiguration on PC1 or R1. The fault is external (ISP not routing or no NAT), but the candidate must verify that client configuration is correct and then escalate or check the ISP link. For the PBQ, the candidate should confirm that PC1's IP, subnet mask, gateway, and DNS are correct, and that R1 has a default route and can reach the next hop. No configuration changes are needed on R1 or PC1; the problem is outside the scope of the local network.

Answer

PC1 has an incorrect default gateway configured.

Answer

R1 is missing a default route to the ISP.

Answer

PC1 has a DNS resolution issue.

Question 8

You are connected to R1 via console. PC1 is connected to R1's GigabitEthernet0/1 interface and is configured with a static IP address. PC1 cannot reach the internet (203.0.113.1). Identify and resolve the connectivity issue. Configure R1 to restore full connectivity for PC1.

Accepted Answer

Configure NAT overload on R1: define ACL 1 to permit 192.168.1.0 0.0.0.255, set GigabitEthernet0/0 as outside and GigabitEthernet0/1 as inside, and apply ip nat inside source list 1 interface GigabitEthernet0/0 overload.. PC1 has a default gateway of 192.168.1.1, which is correct, but R1 is not performing NAT. R1 can reach the internet (203.0.113.1) but PC1 cannot because R1 drops packets from PC1 destined to the internet without source NAT. The fix is to configure NAT overload (PAT) on R1: define an ACL to match PC1's subnet, configure the inside and outside interfaces, and enable NAT on the outside interface. This will translate PC1's private IP to R1's public IP.

Answer

Configure a static route on R1: ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 203.0.113.1.

Answer

Change PC1's default gateway to 203.0.113.1.

Answer

Enable IP routing on R1 and configure OSPF.

Question 9

You are troubleshooting a PC connected to switch SW1. The PC cannot access the internet. SW1 is connected to router R1 via port G0/1. R1 provides default gateway and DHCP services. Analyze the provided show output and fix the connectivity issue so that the PC can ping 8.8.8.8. === Show output from R1 ===

R1# show ip interface brief
Interface             IP-Address      OK? Method Status                Protocol
GigabitEthernet0/0    unassigned      YES manual administratively down down
GigabitEthernet0/1    10.0.0.1        YES NVRAM  up                    up

=== Show output from PC ===

C:\> ipconfig
Ethernet adapter Ethernet0:
   Connection-specific DNS Suffix  . :
   IPv4 Address. . . . . . . . . . : 169.254.123.45
   Subnet Mask . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . :

=== Show output from SW1 ===

SW1# show vlan brief
VLAN Name                             Status    Ports
---- -------------------------------- --------- -------------------------------
1    default                          active    Gi0/1, Gi0/2, Gi0/3

Accepted Answer

Configure R1's interface G0/0 with IP address 192.168.1.1/24 and ensure the interface is not administratively down.. The PC's APIPA address (169.254.x.x) indicates DHCP failure. The router's DHCP pool is correctly configured and has a lease, but the show output reveals that R1's interface G0/0 is administratively down and has no IP address. Without a working IP on G0/0, the router cannot serve DHCP or route traffic for VLAN 1, even though both the PC and the router are in the same VLAN. Option A fixes the root cause by assigning the correct subnet IP and bringing the interface up. Option B is incorrect because moving the PC to a different VLAN or creating subinterfaces does nothing to enable the router's physical interface where DHCP and routing must run. Option C is wrong because DHCP snooping or trust configurations are irrelevant when the router's own interface is down/unaddressed. Option D is a workaround that only masks the problem; the scenario requires a working DHCP service, and a static IP would not restore the intended design.

Answer

Change the VLAN on SW1's port G0/2 to VLAN 10 and configure R1's subinterface G0/0.10 with IP 192.168.1.1/24.

Answer

Enable DHCP snooping on SW1 and configure the port G0/2 as a trusted port.

Answer

Configure a static IP address of 192.168.1.10/24 on the PC with default gateway 192.168.1.1.

Question 10

You are connected to R1 via console. R1's GigabitEthernet0/1 interface connects to a remote site switch over a 2 km fiber link. The current configuration shows speed and duplex set to 1000 Mbps and full, but the interface is down/down due to an SFP mismatch. Review the exhibit, identify the problem, and correct it so that the interface comes up and communicates at the correct speed and duplex. Additionally, ensure the interface is configured to auto-negotiate properly for future cable replacements.

Accepted Answer

Replace the SFP with a 1000BASE-LX module, remove the manual speed and duplex settings, and issue the no shutdown command.. The interface was administratively shut down (shutdown command) and had hard-coded speed 1000 and duplex full, which is incompatible with the 2 km fiber link requiring a long-haul SFP (e.g., 1000BASE-LX). The correct fix is to remove the manual speed/duplex settings, enable auto-negotiation (which is default but overridden), and then no shutdown. For a 2 km link, a 1000BASE-LX SFP is required; the existing SFP (likely 1000BASE-SX, max 550 m) caused the link to be down. After replacing with the correct SFP, the interface should come up. Commands: interface Gi0/1, no speed, no duplex, no shutdown.

Answer

Replace the SFP with a 1000BASE-SX module, keep the manual speed 1000 and duplex full, and issue the no shutdown command.

Answer

Keep the existing SFP, change the speed to 100 and duplex to half, and issue the no shutdown command.

Answer

Replace the SFP with a 1000BASE-LX module, keep the manual speed 1000 and duplex full, and issue the no shutdown command.

Question 11

You are connected to R1 via the console. R1 and R2 are directly connected via their GigabitEthernet0/0 interfaces. The link between them is down. Your task is to diagnose and fix the issue: R1's interface is configured for 100 Mbps full-duplex, but R2 is using auto-negotiation. Additionally, the link requires a Gigabit Ethernet connection over a distance of 5 km. Configure R1's interface to match R2's settings (auto-negotiation) and then select and install the correct SFP module to support the 5 km distance requirement.

Accepted Answer

Configure R1 with 'no speed', 'no duplex', and 'negotiation auto' on GigabitEthernet0/0, then replace the SFP module with a 1000BASE-LX SFP.. The link is down because R1 is forcing speed 100 and full-duplex while R2 is using auto-negotiation. When one side is hard-coded and the other is set to auto, auto-negotiation fails and the link does not come up. The fix is to enable auto-negotiation on R1 by removing the manual speed and duplex settings with the 'no speed' and 'no duplex' commands, and then using 'negotiation auto'. For the 5 km distance, a standard 1000BASE-SX SFP (550 m) is insufficient; a 1000BASE-LX SFP (up to 10 km) is required. The candidate must also replace the SFP module with a compatible LX SFP.

Answer

Configure R1 with 'speed 1000' and 'duplex full' on GigabitEthernet0/0, then replace the SFP module with a 1000BASE-SX SFP.

Answer

Configure R1 with 'no speed', 'no duplex', and 'negotiation auto' on GigabitEthernet0/0, then replace the SFP module with a 1000BASE-SX SFP.

Answer

Configure R1 with 'speed 100' and 'duplex full' on GigabitEthernet0/0, then replace the SFP module with a 1000BASE-LX SFP.

Question 12

You are connected to R1 via the console. R1 and R2 are connected via a fiber link using SFPs. The link is not coming up. Configure the correct SFP type on R1's interface GigabitEthernet0/0 to support the required 2 km distance, and fix any auto-negotiation or speed/duplex misconfiguration so that the link becomes operational.

Accepted Answer

Replace SFP with 1000BASE-LX, configure 'no negotiation auto' on GigabitEthernet0/0, and remove 'speed 1000' and 'duplex full'.. For a 2 km fiber link, a 1000BASE-LX SFP is required (supports up to 10 km). Fiber SFPs like 1000BASE-LX typically do not support auto-negotiation; speed and duplex are fixed. Therefore, the interface should have 'no negotiation auto' configured and no explicit speed/duplex commands. Option A implements these changes. Option B uses 1000BASE-SX, which is suitable only for up to 550 m. Option C leaves auto-negotiation enabled, which is unsupported. Option D sets speed to 100, which is incompatible with a GigabitEthernet interface.

Answer

Replace SFP with 1000BASE-SX, configure 'negotiation auto' on GigabitEthernet0/0, and keep 'speed 1000' and 'duplex full'.

Answer

Replace SFP with 1000BASE-LX, configure 'negotiation auto' on GigabitEthernet0/0, and keep 'speed 1000' and 'duplex full'.

Answer

Replace SFP with 1000BASE-LX, configure 'no negotiation auto' on GigabitEthernet0/0, and configure 'speed 100' and 'duplex full'.

Question 13

You are troubleshooting a link between R1 (G0/0) and R2 (G0/0). The link is up but experiencing packet loss. You suspect an interface speed/duplex mismatch or SFP issue. Configure R1's interface to match the correct speed and duplex, and replace the SFP module if necessary to support a required distance of 40 km over single-mode fiber.

Accepted Answer

Remove manual speed/duplex settings, enable auto-negotiation, and replace the SFP with a long-reach module (e.g., 1000BASE-ZX) that supports 40 km over single-mode fiber.. The link is experiencing packet loss, likely due to a speed/duplex mismatch between the manually configured interface and the peer (which may use auto-negotiation) and/or an SFP module that cannot support the required 40 km distance over single-mode fiber. To resolve both potential issues, remove any manual speed and duplex settings to restore default auto-negotiation (using 'no speed' and 'no duplex'), and replace the SFP with a module rated for 40 km or more on SMF, such as a 1000BASE-ZX (or 1000BASE-EX) transceiver. Standard 1000BASE-LX/LH only reaches up to 10 km on SMF, so it is insufficient for this scenario.

Answer

Change the duplex to full and speed to 1000 Mbps manually, and keep the existing SFP.

Answer

Keep the manual speed/duplex settings but replace the SFP with a 1000BASE-SX module.

Answer

Enable auto-negotiation on both ends but keep the existing SFP.

Question 14

You are connected to R1 via console. R1 is directly connected to R2 over a 1000BASE-T link that is failing to come up. Configure interface GigabitEthernet0/0 on R1 with the correct speed and duplex settings to match R2's configuration, and then verify the link is operational. Additionally, determine the appropriate SFP type for a new 40 km fiber link between R1 and R2.

Accepted Answer

Configure interface GigabitEthernet0/0 with 'speed 1000' and 'duplex full'. For the new fiber link, use a 1000BASE-ZX SFP.. The link is down because R1 is set to auto-negotiate speed and duplex while R2 is hardcoded to 1000 Mbps full duplex. This mismatch causes the link to fail. To fix, configure R1's GigabitEthernet0/0 with 'speed 1000' and 'duplex full'. For the new 40 km fiber link, a 1000BASE-ZX SFP is required as it supports distances up to 70 km. (1000BASE-LX supports only up to 10 km and is insufficient for 40 km.) Verify with 'show interfaces GigabitEthernet0/0' to see the link state change to up/up.

Answer

Configure interface GigabitEthernet0/0 with 'speed auto' and 'duplex auto'. For the new fiber link, use a 1000BASE-SX SFP.

Answer

Configure interface GigabitEthernet0/0 with 'speed 1000' and 'duplex half'. For the new fiber link, use a 1000BASE-LX SFP.

Answer

Configure interface GigabitEthernet0/0 with 'speed 100' and 'duplex full'. For the new fiber link, use a 1000BASE-EX SFP.

Question 15

You are connected to R1. The link between R1's GigabitEthernet0/0 and R2's GigabitEthernet0/0 should operate at 1 Gbps full duplex, but the interface is showing errors and only negotiating at 100 Mbps half duplex. Diagnose and fix the fault, then verify the link is stable at the correct speed and duplex.

Accepted Answer

Remove the manual speed and duplex settings on R1's GigabitEthernet0/0 with 'no speed' and 'no duplex' to allow auto-negotiation.. The interface was manually configured with 'duplex half' and 'speed 100', which forced the link to 100 Mbps half duplex, causing CRC errors due to duplex mismatch. The correct fix is to remove these manual settings and allow auto-negotiation, or explicitly set both sides to 'speed 1000' and 'duplex full'. Since the remote side (R2) is set to auto (default), the simplest correction is to use 'no duplex' and 'no speed' on R1 to re-enable auto-negotiation. After the commands are applied, the interface should show 'Full-duplex, 1000Mb/s' and CRC errors should stop incrementing.

Answer

Change the duplex setting to 'full' and speed to '1000' on R1's GigabitEthernet0/0.

Answer

Replace the cable between R1 and R2 with a crossover cable.

Answer

Configure R2's GigabitEthernet0/0 with 'speed 100' and 'duplex half' to match R1's settings.

CCNA Network Infrastructure and Connectivity Practice Test 23 — 15 Questions

Exhibit

CCNA Network Infrastructure and Connectivity Practice Test 23 — 15 Questions

Exhibit