CCNA Network Infrastructure and Connectivity Practice Test 7 — 15 Questions

Question 1

You are connected to the console of R1. R1 is a new router that needs to be configured for remote management. The network administrator wants to enable SSH for secure access with a local user 'admin' and password 'cisco123'. The router already has an IP address 192.168.1.1/24 on GigabitEthernet0/0 and the interface is up.

Accepted Answer

Enable SSH by configuring a hostname, domain name, generating RSA keys, creating local user 'admin' with password 'cisco123', and configuring VTY lines with 'login local' and 'transport input ssh'. No further configuration is needed.. To enable SSH with local authentication, the router requires a unique hostname, an IP domain name, RSA keys, a local username/password, and VTY lines configured with both 'transport input ssh' and 'login local'. Option D correctly includes all these elements. Option A is incorrect because it only mentions 'SSH transport' but does not explicitly include the 'login local' command on the VTY lines, which is necessary to use the local username database for authentication. Option B is missing the domain name, which is required for RSA key generation. Option C uses Telnet transport, which is unsecure and not SSH. Therefore, D is the correct answer.

Answer

Enable SSH by configuring a hostname, domain name, generating RSA keys, creating local user 'admin' with password 'cisco123', and configuring VTY lines for SSH transport.

Answer

Enable SSH by configuring a hostname, generating RSA keys, creating local user 'admin' with password 'cisco123', and configuring VTY lines for SSH transport. No domain name is needed.

Answer

Enable SSH by configuring a hostname, domain name, generating RSA keys, creating local user 'admin' with password 'cisco123', and configuring VTY lines for Telnet transport.

Question 2

You are connected to the console of R1. The network uses IPv6 with EUI-64. R1's GigabitEthernet0/0 has MAC address 0011.2233.4455. You need to configure an IPv6 global unicast address on this interface using EUI-64 format, based on the prefix 2001:db8:acad:1::/64. The interface is currently configured with an IPv4 address only.

Accepted Answer

R1(config-if)# ipv6 address 2001:db8:acad:1:0211:22ff:fe33:4455/64. The EUI-64 process splits the MAC address 0011.2233.4455 into two halves: 0011.22 and 33.4455. It inserts FFFE in between to get 0011.22FFFE33.4455, then flips the seventh bit (U/L bit) of the first byte from 00 to 02, resulting in 0211.22FF.FE33.4455. The full IPv6 address is 2001:db8:acad:1:0211:22ff:fe33:4455/64. Option A correctly uses this manually computed address. Options B and C have incorrect interface IDs. Option D uses the 'eui-64' keyword which automatically derives the interface ID from the MAC, but the question expects the static address, as indicated by the provided options. Therefore, option A is the correct answer.

Answer

R1(config-if)# ipv6 address 2001:db8:acad:1:0011:22ff:fe33:4455/64

Answer

R1(config-if)# ipv6 address 2001:db8:acad:1:0211:2233:4455:5566/64

Answer

R1(config-if)# ipv6 address 2001:db8:acad:1::/64 eui-64

Question 3

You are connected via the console to R1, a Cisco ISR 4331 router. The network uses IPv6. R1's GigabitEthernet0/0 interface has the MAC address 00:1C:0F:9A:7B:32. You need to configure the interface to use EUI-64 to form a global unicast address from the prefix 2001:DB8:CAFE:1::/64. Additionally, ensure that the interface is enabled for IPv6.

Accepted Answer

R1(config-if)# ipv6 address 2001:DB8:CAFE:1::/64 eui-64
R1(config-if)# no shutdown. The correct command to configure an EUI-64 address is 'ipv6 address prefix/length eui-64'. The prefix must be specified with the :: abbreviation to leave the interface ID unspecified. Option B correctly uses the prefix 2001:DB8:CAFE:1::/64 and the eui-64 keyword, and includes 'no shutdown' to enable the interface. Option A incorrectly includes a full interface ID in the command, which is not allowed with the eui-64 keyword. Option C does not include the eui-64 keyword, so it configures a static address. Option D uses an incorrect interface ID (missing the bit inversion). Therefore, the correct answer is B.

Answer

R1(config-if)# ipv6 address 2001:DB8:CAFE:1:021C:0FFF:FE9A:7B32/64 eui-64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 address 2001:DB8:CAFE:1:021C:0FFF:FE9A:7B32/64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 address 2001:DB8:CAFE:1:001C:0FFF:FE9A:7B32/64 eui-64
R1(config-if)# no shutdown

Question 4

Which three options are valid steps for configuring a router-on-a-stick inter-VLAN routing setup? (Choose three.)

Accepted Answer

Assign an IP address to each subinterface that matches the VLAN’s default gateway.. In a router-on-a-stick configuration, the router uses subinterfaces to connect to multiple VLANs over a single physical interface. Each subinterface must be assigned an IP address that serves as the default gateway for its respective VLAN, and the router must have IP routing enabled (via the 'ip routing' command) to forward traffic between these subinterfaces. The three incorrect options fail because: configuring switch ports as access ports in a single VLAN would restrict connectivity to only that VLAN, breaking inter-VLAN routing; setting the native VLAN on the trunk to match the management VLAN is not required and is unrelated to router-on-a-stick functionality; and using 'switchport mode access' on the router-facing switch port would turn the link into a non-trunk access link, preventing multiple VLANs from reaching the router.

Answer

Configure the switch ports that connect to the router as access ports in a single VLAN.

Answer

Use the 'switchport mode access' command on the router-facing switch port.

Answer

Set the native VLAN on the trunk to match the management VLAN on the switch.

Question 5

Which three of the following correctly describe the behavior of EtherChannel? (Choose three.)

Accepted Answer

It requires that all member ports have the same speed and duplex settings.. EtherChannel aggregates multiple physical links into a single logical link, increasing bandwidth and providing redundancy. It uses a hash algorithm (based on source/destination MAC, IP, or TCP/UDP ports) to distribute traffic across member links. All member ports must have identical speed and duplex settings and be on the same switch (or stack). The statement that EtherChannel allows multiple VLANs only if configured as an access port is false because EtherChannel links can operate as trunks to carry multiple VLANs.

Answer

It requires that member ports be on different switches to form a single channel.

Answer

It allows multiple VLANs on the same link only if configured as an access port.

Answer

It increases the total number of STP instances in the network.

Question 6

Which three of the following are required to implement inter-VLAN routing on a Cisco switch using a router-on-a-stick configuration? (Choose three.)

Accepted Answer

The switchport mode trunk command on the switch port connecting to the router.. In a router-on-a-stick configuration, inter-VLAN routing is achieved by connecting a single router to a switch via a trunk link. The trunk carries multiple VLANs (using 802.1Q tagging), and the router uses subinterfaces—each configured with an IP address in the respective VLAN subnet—to route traffic between VLANs. The switch port connecting to the router must be configured as a trunk (e.g., with the `switchport mode trunk` command) to allow all VLAN traffic to reach the router.

Answer

A Layer 3 switch with routed ports.

Answer

IP routing enabled on the switch.

Answer

A separate physical router interface for each VLAN.

Question 7

Which four of the following correctly describe characteristics or best practices for VLAN trunking and Layer 2 switch configuration? (Choose four.)

Accepted Answer

When connecting two switches, it is recommended to manually set the trunk mode to avoid DTP negotiation errors and security risks.. 802.1Q trunking defines a native VLAN that carries untagged traffic; both ends must agree on the native VLAN to prevent misdirection and security issues. DTP can negotiate trunking between Cisco switches when ports are set to dynamic desirable or trunk mode, allowing automatic trunk establishment. VTP in transparent mode forwards VTP advertisements to other switches but does not synchronize its VLAN database, making it safe for maintaining local VLAN control. Manually setting trunk mode is a best practice to avoid DTP negotiation errors and security risks, as DTP can be exploited. Option 1 is incorrect because using VLAN 1 for user traffic is a security vulnerability; it is recommended to change the native VLAN and prune VLAN 1. Option 3 is incorrect because an access port belongs to only one VLAN; VLAN pruning is used on trunk links to restrict VLAN traffic, not to allow an access port to carry multiple VLANs.

Answer

VLAN 1 is the default native VLAN on Cisco switches and is considered a best practice to use for all user traffic to simplify management.

Answer

A switchport configured as an access port can belong to multiple VLANs simultaneously if using VLAN pruning.

Question 8

Drag and drop the following steps into the correct order to troubleshoot a fiber optic link that is down on a Cisco switch using SFP transceiver diagnostics and interface commands.

Accepted Answer

Physically verify the fiber cable connectors are clean, undamaged, and correctly mated with the SFP transceiver.. First verify the fiber cable and connectors, then confirm the SFP is compatible and fully inserted. Use 'show interface' to check status and basic errors. Use 'show interfaces transceiver' to inspect optical transmit/receive power; this is meaningful even when the link is down (e.g., low receive power), as long as the SFP is recognized and supports DOM. Finally, examine error counters for CRC, runts, and giants.

Question 9

Which TWO statements accurately describe cabling and SFP transceiver diagnostics?

Accepted Answer

The 'show interfaces transceiver' command displays optical power levels for both Tx and Rx on fiber SFPs.. The 'show interfaces transceiver' command on Cisco IOS devices displays detailed operational data for SFP modules, including optical power levels for both transmit (Tx) and receive (Rx) on fiber SFPs. This output is critical for verifying that the optical signal is within the specified thresholds. Additionally, multimode fiber SFP modules with LC connectors are commonly used for short-reach connections, supporting distances up to 550 meters (e.g., 1000BASE-SX over OM2 fiber).

Answer

Copper SFP modules require Cat6a cabling to achieve a 100-meter reach.

Answer

Fiber SFP modules are typically identified by the 'GLC-T' or 'SFP-GE-T' product IDs.

Answer

The 'show cable-diagnostics tdr interface' command can measure the distance to a break in a fiber optic cable.

Question 10

Which TWO statements accurately describe the use of ipconfig, ping, and tracert when troubleshooting a client that cannot reach a remote server?

Accepted Answer

A successful ping to 127.0.0.1 confirms that the TCP/IP stack on the local host is functional.. Pinging the loopback address 127.0.0.1 tests the local TCP/IP stack without sending any frames onto the network. A successful reply confirms that the IP protocol, routing table, and network interface driver are functioning correctly on the local host. This is a foundational step in troubleshooting, as it isolates the problem to the local machine if the ping fails. Additionally, an IPv4 address in the 169.254.x.x range (APIPA) indicates the DHCP client failed to obtain a lease and automatically configured an address from the link-local range. This confirms the interface is enabled but without valid DHCP-configured addressing, which is a common cause of no remote connectivity.

Answer

If ping to the default gateway fails, the issue is certainly caused by a faulty Ethernet cable.

Answer

A tracert that shows 'Request timed out' for the very first hop proves the local default gateway router is down or unreachable.

Answer

Running ipconfig /release followed by ipconfig /renew will always restore connectivity if the Ethernet cable is unplugged and re-plugged.

Question 11

Which TWO statements about SFP transceivers and interface diagnostics are true?

Accepted Answer

SFP modules are hot-swappable, meaning they can be inserted or removed without powering off the switch.. SFP (Small Form-factor Pluggable) modules are designed to be hot-swappable, allowing insertion or removal without powering down the switch. This capability is essential for maintaining network uptime during maintenance or upgrades, as the switch can dynamically detect and configure the module without a reboot. Additionally, the 'show interfaces transceiver' command on Cisco switches provides diagnostic details such as temperature, voltage, and optical power levels, which are critical for monitoring the health of fiber or copper SFP modules and troubleshooting link issues.

Answer

Copper 1000BASE-T SFP modules can transmit data up to 10 km over Category 5e cabling.

Answer

Multi-mode fiber uses a smaller core diameter, about 9 microns, compared to single-mode fiber.

Answer

Any SFP transceiver, regardless of vendor, will operate in a Cisco switch by default.

Question 12

A user reports they cannot access any network resources. A network administrator runs ipconfig on the user's Windows PC and sees an IPv4 address of 169.254.45.3/16. The administrator then pings the default gateway 10.0.0.1, which fails, and uses traceroute to 10.0.0.1, which shows only '1 * * * Request timed out.' What is the most likely cause of the problem?

Accepted Answer

The DHCP server is unreachable.. The 169.254.45.3/16 address is an Automatic Private IP Addressing (APIPA) address, assigned by Windows when a DHCP discovery fails. The failed ping and traceroute to the default gateway confirm that the PC has no IP connectivity to the network. Since the PC has an APIPA address, it was unable to reach a DHCP server to obtain a valid IPv4 address; the most likely cause is that the DHCP server is unreachable. The presence of an APIPA address also indicates the PC's NIC has a working physical and data-link connection, ruling out a disconnected cable or disabled switch port.

Answer

The PC's DNS server address is incorrect.

Answer

The switch port is in an administratively down state.

Answer

The Ethernet cable is unplugged from the PC.

Question 13

A network administrator captures traffic on Server B and finds that ICMP echo requests from Host A arrive, and the server generates corresponding echo replies, but these replies never appear on the wire. The server's routing table has a valid default gateway, and no ACLs are blocking the traffic. What is the most likely cause?

Accepted Answer

The switch port connecting Server B has port security enabled and has learned a different MAC.. The ICMP echo requests arrive at Server B, and the server generates replies, but they never appear on the wire. This indicates the server's frames are being dropped before reaching the network. Since the server has a valid default gateway and no ACLs are blocking, the most likely cause is that the switch port connecting Server B has port security enabled, and the allowed MAC address does not match the server's MAC. As a result, the switch drops the server's frames on ingress, preventing the replies from ever appearing on the wire. An incorrect ARP cache entry would still result in frames being transmitted on the wire, just with a wrong destination MAC, so it would not explain the complete absence of the replies.

Answer

The server's TCP stack is corrupt.

Answer

The server's ARP cache contains an incorrect MAC address for the destination host.

Answer

The server's routing table is missing a route to the source network.

Question 14

A network engineer notices that users in VLAN 10 report intermittent connectivity and slow file transfers to a server on the same switch. The engineer issues the show interfaces fa0/1 command on the switch port connected to the server and observes a high number of runts, input errors, and CRC errors, while output errors are minimal. The interface configuration shows speed 100 and duplex full.

Accepted Answer

The server NIC is auto-negotiating to 100 Mbps half-duplex, resulting in a duplex mismatch.. The symptoms—high runts, input errors, and CRC errors with minimal output errors—are classic indicators of a duplex mismatch. When the switch port is hardcoded to 100 Mbps full-duplex and the server NIC auto-negotiates to 100 Mbps half-duplex (a common fallback when one side is manually set), the half-duplex side experiences collisions while the full-duplex side does not sense the collision. These collisions cause the half-duplex side to truncate frames, resulting in runts and CRC errors on the full-duplex switch port. The speed matches (both 100 Mbps), so the issue is purely duplex-related.

Answer

The server NIC is set to 10 Mbps half-duplex, causing a speed mismatch.

Answer

The cable connecting the server to the switch is faulty, introducing excessive noise.

Answer

The switch port is configured with an incorrect native VLAN, causing duplex negotiation issues.

Question 15

Which TWO statements about SFP transceivers and their associated cable types are correct?

Accepted Answer

SFP-10G-LR transceivers use 1310 nm wavelength and can reach up to 10 km over single-mode fiber.. SFP-10G-LR transceivers operate at 1310 nm and are designed for single-mode fiber, reaching up to 10 km. SFP-10G-SR transceivers operate at 850 nm and are designed for multimode fiber, typically supporting distances up to 300-400 m. Therefore, B and D are correct.

Answer

SFP-10G-SR transceivers require single-mode fiber.

Answer

SFP-10G-LR transceivers can only be used with multimode fiber.

Answer

SFP-10G-LR transceivers support distances up to 40 km over single-mode fiber.