CCNA Network Services and Security Practice Test 18 — 15 Questions

Question 1

Match each user or host symptom to the service most directly suggested first.

Accepted Answer

Cannot access any websites. DNS translates domain names to IP addresses; when a device reaches sites by IP but not by name, the most direct cause is DNS failure. DHCP automatically assigns IP configurations; a host not receiving an IP configuration automatically points directly to a DHCP issue. NTP synchronizes clocks across devices; event timelines from multiple devices not aligning indicates an NTP problem. Syslog centralizes device logs; administrators cannot see centralized events suggests Syslog is misconfigured or unreachable.

Answer

Cannot access specific websites

Answer

Intermittent connectivity loss

Answer

Duplicate IP address error

Question 2

What is the strongest explanation for why hosts in VLAN 40 are receiving addresses from the wrong DHCP scope?

Accepted Answer

The relay path is sending requests to the wrong DHCP scope or server target.. Option A is correct because the DHCP relay agent (typically configured on the VLAN 40 SVI with the 'ip helper-address' command) is forwarding client broadcast requests to a DHCP server that either has no scope for VLAN 40 or has a scope configured for a different subnet. This causes the server to assign an address from the wrong scope, as the relay agent does not filter by scope—it simply forwards the packet to the configured server IP.

Answer

The VLAN 40 SVI must be changed to a trunk port.

Answer

DHCP can provide only one scope in the entire network.

Answer

The clients must use static addresses before DHCP relay can work.

Question 3

Two switches are connected by an 802.1Q trunk. CDP reports a native VLAN mismatch. Which issue is most likely to appear because of this?

Accepted Answer

Untagged traffic may be placed into different VLANs on each switch.. A native VLAN mismatch can cause untagged traffic sent on one side to be placed into a different VLAN on the other side. That leads to confusing connectivity issues and can also create security concerns. It does not automatically disable the trunk.

Answer

All tagged traffic on the trunk is dropped immediately.

Answer

STP is disabled on the trunk link.

Answer

The trunk automatically converts to an access port.

Question 4

Match each REST API method to the action it most closely represents in a typical network automation workflow.

Accepted Answer

GET retrieves data, POST creates new resources, PUT updates/replaces, PATCH partially updates, DELETE removes, and OPTIONS queries available methods.. GET retrieves data, POST creates new resources, PUT updates/replaces, PATCH partially updates, DELETE removes, and OPTIONS queries available methods. These correspond to common network automation workflows.

Answer

GET retrieves data, POST creates new resources, PUT partially updates, PATCH updates/replaces, DELETE removes, and OPTIONS queries available methods.

Answer

GET retrieves data, POST updates/replaces, PUT creates new resources, PATCH partially updates, DELETE removes, and OPTIONS queries available methods.

Answer

GET retrieves data, POST creates new resources, PUT partially updates, PATCH updates/replaces, DELETE removes, and OPTIONS queries available methods.

Question 5

R1 has the following routes installed:

O    10.10.10.0/24 via 192.0.2.2
S    10.10.10.128/25 via 198.51.100.2
S*   0.0.0.0/0 via 203.0.113.1

A packet destined for 10.10.10.200 arrives at R1. Which route is used?

Accepted Answer

The static route to 10.10.10.128/25 via 198.51.100.2. Routers forward using longest prefix match first. Even though the OSPF /24 exists, the static /25 is more specific and covers 10.10.10.200, so the packet is sent via 198.51.100.2. The default route is used only when nothing more specific matches.

Answer

The OSPF route to 10.10.10.0/24 via 192.0.2.2

Answer

The default route via 203.0.113.1

Answer

The packet is dropped because OSPF routes cannot overlap with static routes.

Question 6

A branch router has only one WAN link connected to an Ethernet handoff from the provider. Which static default route is generally the better choice?

Accepted Answer

ip route 0.0.0.0 0.0.0.0 198.51.100.1. On multiaccess Ethernet, pointing the default route to a next-hop IP address is usually cleaner because the router can resolve the next hop with ARP. Using only the exit interface on Ethernet can make the router treat many destinations as directly connected and trigger unnecessary ARP behavior.

Answer

ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0

Answer

ip route 255.255.255.255 255.255.255.255 198.51.100.1

Answer

No static default route should ever be used on Ethernet.

Question 7

Match each DHCPv4 message in the DORA process to its role.

Accepted Answer

Discover: Client broadcasts to locate DHCP servers. The DORA process includes Discover (client broadcast), Offer (server response), Request (client accepts), and Ack (server confirms). Additional messages like NAK and Decline handle errors.

Answer

Discover: Server responds with an IP lease offer

Answer

Discover: Client requests the offered IP address

Answer

Discover: Server acknowledges the lease

Question 8

An engineer successfully authenticates to a controller and receives a token. What is the usual reason for including that token in later API requests?

Accepted Answer

To identify and authorize the client without resending full login credentials each time. The token proves the client has already authenticated and is authorized to continue interacting with the API for the lifetime of that token or session. It is commonly sent in an HTTP header such as Authorization. It does not replace the need for IP routing or DNS resolution.

Answer

To convert HTTP requests into SNMP traps

Answer

To elect the active controller in the cluster

Answer

To compress JSON payloads before transport

Question 9

A user reports that their desk port stopped working immediately after they connected a small switch. The interface shows err-disabled, and the log mentions BPDU Guard. What most likely happened?

Accepted Answer

The port received a BPDU and BPDU Guard shut it down.. BPDU Guard is commonly enabled on PortFast access ports to protect the topology. If the port receives a BPDU, the switch assumes another switch may have been connected and places the port into err-disabled state. That is exactly the protective behavior you want at the edge.

Answer

DHCP snooping blocked the user's ARP requests.

Answer

Port security moved the port to protect mode.

Answer

The trunk native VLAN matched incorrectly.

Question 10

On a user access port, port security is configured with a maximum of 2 MAC addresses and violation mode restrict. A third unauthorized device is connected through a small unmanaged switch. What happens?

Accepted Answer

Traffic from the unauthorized MAC is dropped, but the interface stays up.. In restrict mode, frames from unknown MAC addresses are dropped, the violation counter increments, and logging or SNMP traps can be generated. Unlike shutdown mode, the interface does not go err-disabled.

Answer

The port goes err-disabled immediately.

Answer

The switch learns the third MAC after aging out the first one instantly.

Answer

All traffic from the port is flooded to the VLAN for analysis.

Question 11

An ACL entry reads:

access-list 25 permit 192.168.8.0 0.0.0.15

Which address range does this statement match?

Accepted Answer

192.168.8.0 through 192.168.8.15. A wildcard of 0.0.0.15 means the last 4 bits can vary, which corresponds to a block size of 16 addresses. Starting at 192.168.8.0, the range is 192.168.8.0 through 192.168.8.15.

Answer

192.168.8.0 through 192.168.8.31

Answer

192.168.8.0 through 192.168.8.7

Answer

Only host 192.168.8.15

Question 12

R1 has these static routes configured. When the primary WAN path is up, which route will be installed in the routing table for traffic to 172.16.50.0/24?

Accepted Answer

The route via 10.1.1.2. The route with the lowest administrative distance wins when multiple routes to the same prefix exist. The route via 10.1.1.2 has AD 1, so it is preferred over the floating static route with AD 5. The default route is less specific and does not beat an exact /24 match.

Answer

The route via 10.2.2.2

Answer

The default route via 10.3.3.2

Answer

Both routes load-balance automatically because the prefix is identical.

Question 13

SW2 receives the following STP details for VLAN 10: The root bridge ID is 32768:0001.0001.0001 (SW1), and SW2's bridge ID is 32768:0002.0002.0002. Its interface Gi0/1 has a path cost of 4 to the root, while Gi0/2 has a path cost of 19. Based on this information, which statement is correct?

Accepted Answer

Gi0/1 on SW2 is the root port.. The root bridge has the lowest bridge ID. SW1 is the root because its bridge ID is lower than SW2's local bridge ID. On a non-root switch, the port with the best path toward the root becomes the root port, so Gi0/1 is the root port here.

Answer

SW2 is the root bridge for VLAN 10.

Answer

All SW2 ports in VLAN 10 must be designated ports.

Answer

STP is disabled because the priorities are equal.

Question 14

R1 and R2 should form an OSPF adjacency on their shared GigabitEthernet link, but they remain stuck in EXSTART. What is the most likely cause?

Accepted Answer

The interface MTU values do not match.. The MTU values do not match. OSPF neighbors can discover each other and even move through earlier states, but an MTU mismatch commonly leaves them stuck in EXSTART or EXCHANGE because the routers do not agree on database description packet sizing. Area mismatch, network mismatch, and passive-interface issues usually prevent a much earlier stage of adjacency formation.

Answer

The routers are using different OSPF areas.

Answer

One side is configured as passive-interface.

Answer

The subnet mask on the link is incorrect.

Question 15

R1 learns three OSPF routes to different destinations:

O 10.10.10.0/24
O IA 10.20.20.0/24
O E2 10.30.30.0/24

Which statement is correct about these route types?

Accepted Answer

O E2 is an OSPF external type 2 route.. An O route is intra-area, O IA is interarea, and O E2 is an external type 2 route redistributed into OSPF. The codes describe route origin, not just preference. CCNA expects you to identify them quickly when reading the routing table.

Answer

O IA is an external route redistributed from another routing protocol.

Answer

O means the route was learned through EIGRP.

Answer

All three routes were learned from the same OSPF area type.