CCNA Network Infrastructure and Connectivity Practice Test 23 — 15 Questions

Question 1

You are connected to the console of R1. The network team wants to secure remote access. R1 currently has no SSH configuration. The domain name is 'example.com' and you need to generate an RSA key pair of 2048 bits and enable SSH version 2 on vty lines.

Accepted Answer

Configure IP domain name, generate RSA key pair with 2048 bits, set SSH version 2, and configure vty lines to use SSH.. SSH requires a hostname and domain name to generate RSA keys. Use 'ip domain-name example.com' then 'crypto key generate rsa general-keys modulus 2048' (the 'general-keys' keyword is required to avoid interactive prompts). Set SSH version 2 with 'ip ssh version 2' and restrict vty lines to SSH only with 'line vty 0 4' and 'transport input ssh'. Answer A includes all required steps correctly. Option B misses the domain name. Option C omits vty line configuration. Option D uses the wrong key size.

Answer

Generate RSA key pair with 2048 bits, set SSH version 2, and configure vty lines to use SSH. Domain name is optional.

Answer

Configure IP domain name, generate RSA key pair with 2048 bits, and set SSH version 2. No need to configure vty lines.

Answer

Configure IP domain name, generate RSA key pair with 1024 bits, set SSH version 2, and configure vty lines to use SSH.

Question 2

You are connected to the console of R1. R1 is a new router that needs to be configured for remote management. The network administrator wants to enable SSH for secure access with a local user 'admin' and password 'cisco123'. The router already has an IP address 192.168.1.1/24 on GigabitEthernet0/0 and the interface is up.

Accepted Answer

Enable SSH by configuring a hostname, domain name, generating RSA keys, creating local user 'admin' with password 'cisco123', and configuring VTY lines with 'login local' and 'transport input ssh'. No further configuration is needed.. To enable SSH with local authentication, the router requires a unique hostname, an IP domain name, RSA keys, a local username/password, and VTY lines configured with both 'transport input ssh' and 'login local'. Option D correctly includes all these elements, while the others omit critical steps like 'login local' or the domain name, or use Telnet instead of SSH.

Answer

Enable SSH by configuring a hostname, domain name, generating RSA keys, creating local user 'admin' with password 'cisco123', and configuring VTY lines for SSH transport.

Answer

Enable SSH by configuring a hostname, generating RSA keys, creating local user 'admin' with password 'cisco123', and configuring VTY lines for SSH transport. No domain name is needed.

Answer

Enable SSH by configuring a hostname, domain name, generating RSA keys, creating local user 'admin' with password 'cisco123', and configuring VTY lines for Telnet transport.

Question 3

You are connected to the console of R1. The network uses IPv6 with EUI-64. R1's GigabitEthernet0/0 interface has MAC address 0011.2233.4455. You must configure the interface to generate an IPv6 link-local address using the 'ipv6 enable' command, and also assign a global unicast address 2001:db8:1::/64 using EUI-64. The interface is currently administratively down.

Accepted Answer

R1(config-if)# ipv6 enable
R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64
R1(config-if)# no shutdown. The ipv6 enable command explicitly creates a link-local address as required by the scenario. The global unicast address with the eui-64 keyword automatically derives the interface ID from the MAC address. Option B is incorrect because it tries to manually configure a link-local address with eui-64, which is unnecessary and invalid. Option C omits the ipv6 enable command, failing the explicit requirement. Option D assigns a static host portion instead of using eui-64.

Answer

R1(config-if)# ipv6 address fe80::/10 eui-64
R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 enable
R1(config-if)# ipv6 address 2001:db8:1::1/64
R1(config-if)# no shutdown

Question 4

You are connected to the console of R1. The network administrator reports that users cannot communicate with the server at 192.168.2.10. R1 is connected to R2 via a serial link (S0/0/0) with IP 10.0.0.1/30 on R1 and 10.0.0.2/30 on R2. The network uses OSPF for routing. You suspect an interface issue on the serial link.

Accepted Answer

Use the show interfaces serial0/0/0 command to verify the interface status and check for encapsulation mismatch.. The serial interface may be administratively down or have incorrect encapsulation. Setting the clock rate on the DCE side and ensuring PPP encapsulation matches the neighbor resolves the issue.

Answer

Use the show ip route command to verify that the route to 192.168.2.0/24 is present in the routing table.

Answer

Use the ping 10.0.0.2 command to test Layer 3 connectivity to the neighbor router.

Answer

Use the show running-config interface serial0/0/0 command to check the configuration of the serial interface.

Question 5

You are connected to the console of R1. The network administrator reports that R1 cannot discover neighboring devices via CDP. R1 is connected to SW1 via GigabitEthernet0/0. You suspect CDP is disabled globally or on the interface. Your task is to enable CDP and verify neighbor discovery.

Accepted Answer

Enter global configuration mode, issue 'cdp run', then enter interface configuration mode for GigabitEthernet0/0 and issue 'cdp enable'.. CDP was disabled globally and on the interface. Enabling CDP globally and then on the interface allows R1 to discover directly connected Cisco devices.

Answer

Enter global configuration mode, issue 'cdp enable', then enter interface configuration mode for GigabitEthernet0/0 and issue 'cdp run'.

Answer

Enter global configuration mode, issue 'cdp run', then enter interface configuration mode for GigabitEthernet0/0 and issue 'no cdp disable'.

Answer

Enter global configuration mode, issue 'cdp enable', then enter interface configuration mode for GigabitEthernet0/0 and issue 'no cdp disable'.

Question 6

You are connected to the console of R1. The network uses IPv6 with EUI-64. R1's GigabitEthernet0/0 has MAC address 0011.2233.4455. You need to configure an IPv6 global unicast address on this interface using EUI-64 format, based on the prefix 2001:db8:acad:1::/64. The interface is currently configured with an IPv4 address only.

Accepted Answer

R1(config-if)# ipv6 address 2001:db8:acad:1:0211:22ff:fe33:4455/64. The EUI-64 process inserts FF:FE in the middle of the MAC and flips the U/L bit. The command configures the IPv6 address automatically based on the prefix and the interface MAC.

Answer

R1(config-if)# ipv6 address 2001:db8:acad:1:0011:22ff:fe33:4455/64

Answer

R1(config-if)# ipv6 address 2001:db8:acad:1:0211:2233:4455:5566/64

Answer

R1(config-if)# ipv6 address 2001:db8:acad:1::/64 eui-64

Question 7

You are connected to the console of R1. The output of 'show interfaces serial0/0/0' displays that the interface is administratively down (status: administratively down, line protocol is down). The network administrator reports that the serial link between R1 and R2 was recently configured but is not working. You need to troubleshoot and restore connectivity. The serial interface on R1 is Serial0/0/0, and the link is a point-to-point HDLC connection.

Accepted Answer

Enter interface configuration mode for Serial0/0/0 and issue the 'no shutdown' command.. The interface status 'administratively down' indicates the interface has been manually shut down with the 'shutdown' command. Issuing 'no shutdown' in interface configuration mode re-enables it, bringing the line protocol up and restoring connectivity. Option B is incorrect because clock rate configuration is necessary only if R1 is the DCE and clocking is missing; the issue here is the administrative state, not clocking. Option C is incorrect because changing the encapsulation to PPP would not resolve an administratively down state and could create a mismatch. Option D is wrong because 'clear interface' only resets counters and does not change the interface's administrative status.

Answer

Enter global configuration mode and issue the 'clock rate 64000' command.

Answer

Enter interface configuration mode for Serial0/0/0 and issue the 'encapsulation ppp' command.

Answer

Enter privileged EXEC mode and issue the 'clear interface serial0/0/0' command.

Question 8

You are connected to the console of SW1. The network administrator reports that a workstation connected to interface FastEthernet0/1 cannot communicate with the rest of the network. The workstation is configured for VLAN 10, but the interface is in VLAN 1.

Accepted Answer

Configure the interface as an access port and assign it to VLAN 10.. The port was in VLAN 1 instead of VLAN 10. By configuring 'switchport access vlan 10', the workstation is now in the correct VLAN and can communicate with the rest of the network.

Answer

Configure the interface as a trunk port.

Answer

Configure the interface as a trunk port and allow VLAN 10.

Answer

Configure the interface as a dynamic desirable port.

Question 9

You are connected to the console of R1. The network uses IPv6 with EUI-64. R1's GigabitEthernet0/0 interface has MAC address 001e.4a7b.9c0d. You need to configure an IPv6 address on this interface using EUI-64, with the subnet 2001:db8:abcd:1::/64.

Accepted Answer

ipv6 address 2001:db8:abcd:1::/64 eui-64. The 'ipv6 address 2001:db8:abcd:1::/64 eui-64' command configures the IPv6 address using EUI-64, which generates the interface ID from the MAC address. This command alone enables IPv6 on the interface and assigns the global address; the 'ipv6 enable' command is not strictly necessary and is only required if a link-local address is needed without a global address. Option B would configure a static interface ID, not EUI-64. Option C incorrectly uses the 'link-local' keyword, which is not valid in this context. Option D only enables IPv6 for link-local addressing without assigning a global unicast address.

Answer

ipv6 address 2001:db8:abcd:1::/64

Answer

ipv6 address 2001:db8:abcd:1::/64 link-local

Answer

ipv6 enable

Question 10

You are connected via the console to R1, a Cisco ISR 4331 router. The network administrator reports that the link between R1's GigabitEthernet0/0 and a switch is experiencing high error rates and intermittent connectivity. Upon inspection, you notice that the interface is configured with speed 1000 and duplex full. The switch port is set to auto-negotiate. Your task is to resolve the duplex mismatch by configuring the router interface to match the switch's settings.

Accepted Answer

Configure the router interface with 'no speed' and 'no duplex' to restore defaults, then set 'speed auto' and 'duplex auto'.. The duplex mismatch was caused by manually forcing speed and duplex on the router while the switch was set to auto-negotiate. Changing the router to auto-negotiate allows both sides to negotiate the best duplex (full duplex) and speed, eliminating errors.

Answer

Configure the router interface with 'speed 1000' and 'duplex full'.

Answer

Configure the router interface with 'no speed' and 'no duplex' to restore defaults, then set 'speed 1000' and 'duplex full'.

Answer

Configure the router interface with 'no speed' and 'no duplex' to restore defaults, then set 'speed 1000' and 'duplex half'.

Question 11

You are connected via the console to R1, a new Cisco ISR 4321 router. The network team requires that all routers be reachable via SSH for management. R1's management interface is GigabitEthernet0/0 with IP 192.168.1.1/24. You need to configure SSH on R1, including a hostname, domain name, RSA key pair of 1024 bits, local user 'admin' with secret 'cisco123', and enable SSH version 2. Additionally, configure the vty lines to accept only SSH connections and use local authentication.

Accepted Answer

R1(config)# hostname R1
R1(config)# ip domain-name example.com
R1(config)# crypto key generate rsa modulus 1024
R1(config)# username admin secret cisco123
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# transport input ssh
R1(config-line)# login local. SSH configuration requires a hostname, domain name, RSA key pair, local username, and vty line settings. The command sequence ensures SSH version 2 is used and only SSH connections are accepted on the vty lines.

Answer

R1(config)# hostname R1
R1(config)# ip domain-name example.com
R1(config)# crypto key generate rsa general-keys modulus 1024
R1(config)# username admin password cisco123
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# transport input ssh telnet
R1(config-line)# login local

Answer

R1(config)# hostname R1
R1(config)# ip domain-name example.com
R1(config)# crypto key generate rsa modulus 1024
R1(config)# username admin secret cisco123
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# transport input all
R1(config-line)# login local

Answer

R1(config)# hostname R1
R1(config)# ip domain-name example.com
R1(config)# crypto key generate rsa modulus 1024
R1(config)# username admin secret cisco123
R1(config)# ip ssh version 2
R1(config)# line vty 0 4
R1(config-line)# transport input ssh
R1(config-line)# password cisco123
R1(config-line)# login

Question 12

You are connected via the console to SW1, a Cisco Catalyst 2960 switch. The network administrator reports that users in VLAN 10 (Sales) cannot ping the default gateway 192.168.10.1, which is on R1's GigabitEthernet0/1 interface. SW1's interface GigabitEthernet0/1 connects to R1 and is configured as an access port in VLAN 10. R1's interface GigabitEthernet0/1 is configured with IP 192.168.10.1/24 and no shutdown. However, the link between them is up but the line protocol is down on both sides.

Accepted Answer

Configure the switchport to use the same speed and duplex settings as the router interface.. The line protocol down indicates a Layer 1 or Layer 2 issue. The switch was likely set to auto-negotiate while the router defaulted to auto, but mismatch can occur. Setting both sides to 100 Mbps full duplex resolves the issue.

Answer

Change the switchport mode to trunk to allow VLAN 10 traffic to pass to the router.

Answer

Assign the IP address 192.168.10.1 to the switch's VLAN 10 interface.

Answer

Enable CDP on both devices to verify neighbor information.

Question 13

You are connected via the console to R1, a Cisco ISR 4331 router. The network uses IPv6. R1's GigabitEthernet0/0 interface has the MAC address 00:1C:0F:9A:7B:32. You need to configure the interface to use EUI-64 to form a global unicast address from the prefix 2001:DB8:CAFE:1::/64. Additionally, ensure that the interface is enabled for IPv6.

Accepted Answer

R1(config-if)# ipv6 address 2001:DB8:CAFE:1:021C:0FFF:FE9A:7B32/64 eui-64
R1(config-if)# no shutdown. The EUI-64 process inserts FF:FE in the middle of the MAC address and inverts the 7th bit. Configuring the IPv6 address with the eui-64 keyword automatically generates the interface ID from the MAC address.

Answer

R1(config-if)# ipv6 address 2001:DB8:CAFE:1::/64 eui-64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 address 2001:DB8:CAFE:1:021C:0FFF:FE9A:7B32/64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 address 2001:DB8:CAFE:1:001C:0FFF:FE9A:7B32/64 eui-64
R1(config-if)# no shutdown

Question 14

Which three of the following are characteristics of Layer 2 Ethernet switches that improve network performance? (Choose three.)

Accepted Answer

They forward frames based on the destination MAC address.. Layer 2 Ethernet switches improve network performance by creating separate collision domains per port, eliminating collisions between devices on different ports. They forward frames based on the destination MAC address, enabling efficient hardware-based switching. Cut-through switching reduces latency by starting to forward as soon as the destination MAC address is read. The other options are incorrect: switches do not reduce broadcast domains (broadcasts are forwarded to all ports in the same VLAN unless a router or VLAN segmentation is used); switches operate at Layer 2 using MAC addresses, not IP addresses; and unknown unicast frames are flooded out all ports except the incoming port, not automatically blocked, to ensure connectivity if the destination is unknown.

Answer

They automatically block all unknown unicast frames.

Answer

They use IP addresses to make forwarding decisions.

Answer

They reduce the number of broadcast domains.

Question 15

Which three options are valid steps for configuring a router-on-a-stick inter-VLAN routing setup? (Choose three.)

Accepted Answer

Enable IP routing on the router with the 'ip routing' command.. In a router-on-a-stick configuration, the router uses subinterfaces to connect to multiple VLANs over a single physical interface. Each subinterface must be assigned an IP address that serves as the default gateway for its respective VLAN, and the router must have IP routing enabled (via the 'ip routing' command) to forward traffic between these subinterfaces. The three incorrect options fail because: configuring switch ports as access ports in a single VLAN would restrict connectivity to only that VLAN, breaking inter-VLAN routing; setting the native VLAN on the trunk to match the management VLAN is not required and is unrelated to router-on-a-stick functionality; and using 'switchport mode access' on the router-facing switch port would turn the link into a non-trunk access link, preventing multiple VLANs from reaching the router.

Answer

Configure the switch ports that connect to the router as access ports in a single VLAN.

Answer

Use the 'switchport mode access' command on the router-facing switch port.

Answer

Set the native VLAN on the trunk to match the management VLAN on the switch.