CCNA Network Infrastructure and Connectivity Practice Test 27 — 15 Questions

Question 1

An administrator deploys a new WLAN on a Cisco 9800 WLC using WPA3-Personal (SAE) with AES encryption. A single 802.11ax laptop running Windows 10 fails to connect, displaying an authentication timeout despite entering the correct passphrase. Other clients, including legacy 802.11ac devices, connect without issue.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The laptop’s wireless adapter does not support Protected Management Frames, which are mandatory for WPA3-Personal.. WPA3-Personal (SAE) mandates the use of Protected Management Frames (PMF) as defined in IEEE 802.11w. If the laptop's wireless adapter or driver does not support PMF, it cannot complete the SAE handshake, resulting in an authentication timeout. Legacy 802.11ac clients can connect because they are using WPA2, which does not require PMF.

Answer

The WLC’s WLAN is misconfigured for WPA3-Enterprise, and the laptop lacks a supplicant for 802.1X authentication.

Answer

The WLC has disabled 802.11ax OFDMA on the 5 GHz band, preventing the 802.11ax laptop from associating.

Answer

The laptop’s driver is configured for 160 MHz channel width, which is incompatible with the WLC’s channel plan, causing authentication to fail.

Question 2

A user reports they cannot access any network resources. A network administrator runs ipconfig on the user's Windows PC and sees an IPv4 address of 169.254.45.3/16. The administrator then pings the default gateway 10.0.0.1, which fails, and uses traceroute to 10.0.0.1, which shows only '1 * * * Request timed out.' What is the most likely cause of the problem?

Accepted Answer

The DHCP server is unreachable.. The 169.254.45.3/16 address is an Automatic Private IP Addressing (APIPA) address, assigned by Windows when a DHCP discovery fails. The failed ping and traceroute to the default gateway confirm that the PC has no IP connectivity to the network. Since the PC has an APIPA address, it was unable to reach a DHCP server to obtain a valid IPv4 address; the most likely cause is that the DHCP server is unreachable. The presence of an APIPA address also indicates the PC's NIC has a working physical and data-link connection, ruling out a disconnected cable or disabled switch port.

Answer

The PC's DNS server address is incorrect.

Answer

The switch port is in an administratively down state.

Answer

The Ethernet cable is unplugged from the PC.

Question 3

A network engineer replaces a failed 1000BASE-LX SFP on a core switch with a new transceiver of the same type. After connecting the single-mode fiber, the link remains down and a 'show interfaces gig1/0/49 transceiver' reveals an Rx power of –30 dBm, while the far-end SFP is transmitting at –3 dBm over a 2 km span. The fiber patch cord shows no visible damage.

Accepted Answer

Excessive attenuation due to a dirty or damaged fiber connector is preventing the link from coming up.. The measured Rx power of –30 dBm is far below the receive sensitivity threshold for 1000BASE-LX (typically –19 to –22 dBm), even though the transmitter is outputting a healthy –3 dBm over only 2 km. This indicates excessive loss in the optical path, most commonly caused by a dirty or damaged fiber connector. Cleaning the connector ends with an appropriate fiber cleaning tool and inspecting with a microscope would likely resolve the issue.

Answer

The new SFP is a counterfeit Cisco transceiver that cannot establish a stable link.

Answer

The SFP is not fully seated in the switch port, causing an intermittent optical connection.

Answer

The single-mode fiber distance exceeds the 10 km maximum for 1000BASE-LX, leading to severe signal dispersion.

Question 4

A network engineer notices that users in VLAN 10 report intermittent connectivity and slow file transfers to a server on the same switch. The engineer issues the show interfaces fa0/1 command on the switch port connected to the server and observes a high number of runts, input errors, and CRC errors, while output errors are minimal. The interface configuration shows speed 100 and duplex full.

Accepted Answer

The server NIC is auto-negotiating to 100 Mbps half-duplex, resulting in a duplex mismatch.. The symptoms—high runts, input errors, and CRC errors with minimal output errors—are classic indicators of a duplex mismatch. When the switch port is hardcoded to 100 Mbps full-duplex and the server NIC auto-negotiates to 100 Mbps half-duplex (a common fallback when one side is manually set), the half-duplex side experiences collisions while the full-duplex side does not sense the collision. These collisions cause the half-duplex side to truncate frames, resulting in runts and CRC errors on the full-duplex switch port. The speed matches (both 100 Mbps), so the issue is purely duplex-related.

Answer

The server NIC is set to 10 Mbps half-duplex, causing a speed mismatch.

Answer

The cable connecting the server to the switch is faulty, introducing excessive noise.

Answer

The switch port is configured with an incorrect native VLAN, causing duplex negotiation issues.

Question 5

A network administrator has recently upgraded the corporate wireless LAN to support 802.11ax (Wi-Fi 6) and is using WPA3-Enterprise with a central WLC. Several users with new 802.11ax laptops report that they can connect to the SSID, but after a few minutes their connections drop and then re-establish, while legacy 802.11ac clients work without issues. Which action will resolve this problem?

Accepted Answer

Enable Protected Management Frames (PMF) as Required on the WLAN.. WPA3-Enterprise requires Protected Management Frames (PMF) to be set to 'Required' on the WLC. When PMF is not enabled or set to 'Optional', 802.11ax clients using WPA3 may experience intermittent disconnects because management frame protection is mandatory for WPA3 operation. Legacy 802.11ac clients using WPA2 do not require PMF, so they remain unaffected.

Answer

Downgrade the WLAN security to WPA2-Enterprise for backward compatibility.

Answer

Disable OFDMA and MU-MIMO on the WLC for the affected APs.

Answer

Adjust the 5 GHz channel width from 80 MHz to 40 MHz to avoid interference.

Question 6

A user reports that they cannot access a remote server at IP address 10.10.20.50. The user's PC has IP address 192.168.1.25/24, and the default gateway is 192.168.1.1. The user can successfully ping the default gateway and other hosts on the local subnet. However, pings to 10.10.20.50 fail, and a traceroute shows only the first hop (192.168.1.1) followed by timeouts. Which of the following is the most likely cause?

Accepted Answer

The default gateway lacks a route to the 10.10.20.0/24 network.. The user can reach local hosts and the default gateway, confirming that the PC's IP configuration and local switching are functional. The traceroute stopping at 192.168.1.1 with subsequent timeouts indicates that the default gateway receives the packets but does not know how to forward them to the 10.10.20.0/24 network. Therefore, the most likely cause is that the default gateway lacks a route to that remote subnet.

Answer

The user's PC has an incorrect subnet mask.

Answer

The remote server at 10.10.20.50 is powered off.

Answer

The user's DNS server is unreachable.

Question 7

Which TWO statements about SFP transceivers and their associated cable types are correct?

Accepted Answer

SFP-10G-LR transceivers use 1310 nm wavelength and can reach up to 10 km over single-mode fiber.. Option B is correct because the SFP-10G-LR (Long Reach) standard operates at a 1310 nm wavelength and supports distances up to 10 km over single-mode fiber (SMF), typically using LC connectors. Option D is correct because the SFP-10G-SR (Short Reach) standard uses an 850 nm vertical-cavity surface-emitting laser (VCSEL) over multimode fiber (MMF), reaching up to roughly 300-400 m depending on the fiber grade (OM3/OM4). Option A is wrong because SFP-10G-SR is designed for multimode fiber, not single-mode fiber. Option C is wrong because SFP-10G-LR is intended for single-mode fiber, not multimode fiber. Option E is wrong because 40 km over single-mode fiber corresponds to the 10G-ER (Extended Reach) standard, not 10G-LR.

Answer

SFP-10G-SR transceivers require single-mode fiber.

Answer

SFP-10G-LR transceivers can only be used with multimode fiber.

Answer

SFP-10G-LR transceivers support distances up to 40 km over single-mode fiber.

Question 8

Which TWO statements are correct regarding Protocol Data Units (PDUs) and data encapsulation in the OSI model?

Accepted Answer

Data is encapsulated with a TCP header at the Transport layer to form a segment.. Option B is correct because at the Transport layer, application data is encapsulated with a TCP header (or UDP header) to form a segment, which is the Transport-layer PDU. Option C is correct because the Network layer PDU is the packet, formed by adding an IP header to the segment, providing logical addressing and routing information. Option A is incorrect because a frame is the Data Link layer PDU, not the Transport layer PDU. Option D is incorrect because the Data Link layer adds a header and trailer to create a frame, not a bit; bits are the Physical layer PDU. Option E is incorrect because encapsulation occurs as data moves down the OSI layers from Application to Physical, not upward.

Answer

The PDU at the Transport layer is called a frame.

Answer

The Data Link layer adds a header and trailer to create a bit.

Answer

Encapsulation occurs as data moves up the OSI layers from Physical to Application.

Question 9

A network engineer notices that the router interface GigabitEthernet0/1 is in an 'administratively down' state in the output of the show ip interface brief command, preventing connectivity to the subnet connected to that interface. What is the most likely cause?

Accepted Answer

The shutdown command is configured on the interface.. The 'administratively down' state in the output of 'show ip interface brief' indicates that the interface has been manually disabled using the 'shutdown' command. This is a Layer 1/2 administrative state, not a protocol or connectivity issue. To bring the interface up, the 'no shutdown' command must be applied in interface configuration mode.

Answer

The interface does not have an IP address assigned.

Answer

The interface is configured with an incorrect subnet mask.

Answer

An access list is blocking traffic on the interface.

Question 10

A host cannot communicate with its default gateway. The technician uses the show arp command on the host and sees that the ARP entry for the gateway IP is incomplete. The technician has already verified that the Ethernet cable is securely connected and the switch port is active. What should the technician do next?

Accepted Answer

Check the switch port’s VLAN configuration and ensure the host and router interface are in the same VLAN.. An incomplete ARP entry for the default gateway indicates that the host sent an ARP request but never received a reply. Since the physical layer (cable and switch port) is verified as operational, the most likely cause is a Layer 2 mismatch: the host and the router interface are in different VLANs, preventing the ARP reply from reaching the host. Checking the switch port's VLAN configuration ensures both devices are in the same broadcast domain, which is required for ARP to function.

Answer

Replace the Ethernet cable between the host and the switch.

Answer

Clear the ARP cache on the host and attempt to ping the gateway again.

Answer

Check the router’s routing table for a route to the host’s subnet.

Question 11

Refer to the exhibit. A network engineer is investigating intermittent connectivity complaints on a gigabit uplink between two distribution switches. The engineer runs the show interfaces GigabitEthernet0/0 command on one of the switches. Based on the output, what is the most likely cause of the errors?

Accepted Answer

A damaged or faulty cable is causing excessive CRC errors.. The output shows a high number of CRC errors and runts, which typically indicate a Layer 1 physical-layer issue such as a damaged or faulty cable. CRC errors occur when frames fail the cyclic redundancy check due to signal degradation, noise, or physical damage to the cabling. On a gigabit uplink, this is the most likely cause of intermittent connectivity.

Answer

The interface is configured with an incorrect encapsulation type.

Answer

A duplex mismatch exists between the connected devices.

Answer

The interface is assigned to the wrong VLAN.

Question 12

A user reports that their computer cannot access the network. The technician checks the computer's IP configuration and finds an APIPA address (169.254.x.x). The computer is connected to a switch port on VLAN 20. The DHCP server is located on VLAN 1. The technician then examines the router's interfaces using 'show ip interface brief' and sees that all interfaces shown are up/up. What should the technician do next?

Accepted Answer

Verify that the ip helper-address command is configured on the router's VLAN 20 interface.. The APIPA address (169.254.x.x) indicates the host failed to obtain a DHCP lease. Since the DHCP server is on VLAN 1 and the host is on VLAN 20, a DHCP relay (ip helper-address) must be configured on the router's VLAN 20 interface to forward DHCP broadcast messages to the server. The 'show ip interface brief' shows all interfaces are up/up, so the next logical step is to verify the relay configuration.

Answer

Check the DHCP server logs to see if it is receiving Discover messages.

Answer

Attempt to ping the DHCP server's IP address from the host's APIPA address.

Answer

Restart the DHCP service on the server and recheck the host.

Question 13

Refer to the exhibit. A network engineer is troubleshooting a connectivity issue between two routers connected via a serial link. The engineer runs the show interfaces Serial0/0/0 command on R1. Based on the output, what is the most likely cause of the problem?

Accepted Answer

The DCE end of the serial link is missing a clock rate configuration.. The output shows that the interface is up (line protocol is down), and the serial cable is physically connected. The absence of a clock rate on the DCE end of a serial link causes the line protocol to remain down because the receiving router cannot synchronize bit timing. Option D is correct because the DCE device must provide a clock signal for the serial link to establish Layer 2 connectivity.

Answer

The interface is configured with the wrong encapsulation type.

Answer

The interface is administratively shut down.

Answer

The serial cable is disconnected or has a physical fault.

Question 14

A technician is troubleshooting a connectivity issue where a workstation connected to a Cisco switch port cannot ping other hosts that are in the same VLAN 10 segment. The technician runs the show mac address-table command and notices that the workstation's MAC address is listed on VLAN 1, not VLAN 10. What is the most likely cause?

Accepted Answer

The switch port is not configured with the switchport access vlan 10 command.. The workstation's MAC address appears in VLAN 1 instead of VLAN 10 because the switch port is operating in the default VLAN (VLAN 1). The most likely cause is that the port has not been explicitly assigned to VLAN 10 using the `switchport access vlan 10` command. Without this command, the port remains in its default access VLAN (VLAN 1), so all frames from the workstation are associated with VLAN 1, preventing communication with hosts in VLAN 10.

Answer

The switch port is configured as a trunk with native VLAN 1.

Answer

The MAC address table contains a stale entry that must be cleared.

Answer

Spanning Tree Protocol has placed the port in a blocking state.

Question 15

A network engineer notices that a switch port connected to a legacy server is experiencing late collisions and the server reports excessive retransmissions. The switch port is configured for auto-negotiation and shows a negotiated speed of 100 Mbps and duplex full. The server's NIC is manually set to 100 Mbps and half-duplex. What is the most likely cause?

Accepted Answer

A duplex mismatch exists between the switch port and the server NIC.. The switch port is auto-negotiating to full-duplex while the server's NIC is manually set to half-duplex. This creates a duplex mismatch: the switch transmits expecting no collisions (full-duplex), but the server, operating in half-duplex, detects collisions when the switch sends frames while the server is transmitting. Late collisions occur because the collision is detected after the first 64 bytes of the frame, and the server's half-duplex CSMA/CD logic forces retransmissions, matching the symptoms described.

Answer

The switch port is incorrectly configured for auto-negotiation and should be manually set to match the server's NIC.

Answer

The server's NIC is failing, causing cyclic redundancy check (CRC) errors and forcing retransmissions.

Answer

The switch port is overloaded by a broadcast storm, causing an excessive number of collisions.