CCNA Network Services and Security Practice Test 24 — 15 Questions

Question 1

A wireless site reports that users can connect to the SSID, but performance drops sharply around the conference area whenever the room fills up. Based on the exhibit, what is the most likely cause?

Accepted Answer

Adjacent-channel interference caused by overlapping 2.4 GHz channels. The 2.4 GHz radios are using overlapping channels. In 2.4 GHz, the standard non-overlapping channels are 1, 6, and 11 in many regulatory domains. Using channels 1, 3, and 6 creates adjacent-channel interference, which hurts throughput especially in dense client areas.

Answer

A DHCP exhaustion problem on the WLAN

Answer

An authentication mismatch between the APs and clients

Answer

A missing default route on the wireless controller

Question 2

Hosts on the inside network can reach the internet, but return traffic is failing after a new router was installed. The router's configuration shows that the LAN-facing interface has been configured with 'ip nat outside' and the WAN-facing interface with 'ip nat inside'. What configuration mistake is the most likely cause?

Accepted Answer

The NAT inside and outside interface roles are reversed.. NAT overload requires the LAN-facing interface to be marked as ip nat inside and the WAN-facing interface as ip nat outside. The exhibit shows those roles reversed, so translations will not occur correctly. The ACL itself is fine for matching the inside subnet.

Answer

The ACL must deny RFC1918 traffic before NAT can work.

Answer

PAT cannot use an interface address for overload.

Answer

The inside subnet must be configured as /24 on both interfaces.

Question 3

An ACL on R1 contains only these entries:
access-list 101 permit tcp 10.10.10.0 0.0.0.255 any eq 443
access-list 101 permit icmp any any

What happens to an HTTP packet sourced from 10.10.10.25 and destined for 198.51.100.10 if ACL 101 is applied in the traffic path?

Accepted Answer

It is denied by the implicit deny.. HTTP uses TCP port 80, not 443. Because the ACL does not include a permit for that traffic, it is dropped by the implicit deny at the end of the ACL. The ICMP entry is irrelevant because the packet is TCP.

Answer

It is permitted because the source subnet is allowed.

Answer

It is translated by NAT before the ACL is checked.

Answer

It is converted to HTTPS automatically.

Question 4

Users on VLAN 20 are not receiving IPv4 addresses from the centralized DHCP server at 10.50.0.10. Users in other VLANs are working normally. Based on the exhibit, which change should fix the issue for VLAN 20 clients?

Accepted Answer

Change the helper address on interface Vlan20 to 10.50.0.10.. The SVI for VLAN 20 is forwarding DHCP requests to the wrong helper address. DHCP relay depends on the Layer 3 interface for that VLAN sending client broadcasts to the correct server. Trunks, access ports, and the DHCP pool name on the server are not the first issue shown here. DHCP snooping can filter DHCP server replies on untrusted ports, but since other VLANs are working and no trust misconfiguration is indicated, the root cause is the incorrect ip helper-address on Vlan20.

Answer

Convert the VLAN 20 user ports to trunk mode.

Answer

Configure a default gateway on the user PCs manually.

Answer

Disable DHCP snooping on VLAN 20.

Question 5

Two switches are configured to form an EtherChannel, but the bundle never comes up. Which explanation best describes this scenario?

Accepted Answer

LACP active on one side is incompatible with mode on on the other side.. One side is using LACP active mode and the other side is forcing a static channel-group with mode on. Those modes are not compatible. LACP needs active or passive on both sides, while PAgP uses desirable or auto, and static mode on expects a manual bundle on the other side.

Answer

The switches are using different native VLANs.

Answer

Both sides must use PAgP desirable mode.

Answer

The interfaces must be configured as routed ports first.

Question 6

Which OSPF neighbor state indicates that the routers have already exchanged full link-state databases?

Accepted Answer

FULL. FULL means the adjacency is complete and database synchronization has finished. States such as INIT, 2-WAY, EXSTART, and EXCHANGE all occur earlier in the process.

Answer

2-WAY

Answer

EXSTART

Answer

INIT

Question 7

A switch interface connected to a Cisco IP phone with a PC behind it must carry voice and data correctly. Which two switchport commands are appropriate on that access port?

Accepted Answer

switchport access vlan 10. The access VLAN carries the workstation data traffic, and the voice VLAN carries tagged voice traffic for the IP phone. That is the standard campus switchport design for a phone with a PC behind it. The port itself remains an access port, but the two most directly relevant commands here are the access VLAN and voice VLAN assignments.

Answer

switchport mode trunk

Answer

channel-group 1 mode active

Answer

spanning-tree cost 1

Question 8

An automation script needs to send a bearer token when calling a controller REST API over HTTPS. Where is that token most commonly included?

Accepted Answer

In the HTTP Authorization header. Bearer tokens are typically sent in the HTTP Authorization header. Query parameters or request bodies may carry credentials in some custom APIs, but the normal REST pattern is an Authorization header such as 'Authorization: Bearer <token>'.

Answer

In the Ethernet trailer

Answer

In the DNS response section

Answer

In the TCP checksum field

Question 9

A switch stack is running PVST+. Users on VLAN 40 lose connectivity for roughly 30 seconds every time the uplink on SW2 flaps. Based on the exhibit, which change would most directly improve convergence for this VLAN?

Accepted Answer

Configure spanning-tree mode rapid-pvst.. The output shows VLAN 40 is still using the legacy IEEE STP process, which converges much more slowly than Rapid PVST+. Moving the switch to rapid-pvst mode gives VLAN 40 the faster proposal/agreement behavior that typically cuts convergence time from tens of seconds to a few seconds.

Answer

Increase the bridge priority on SW2 for VLAN 40.

Answer

Disable PortFast on all access ports.

Answer

Convert the uplink to a routed port.

Question 10

Two static routes exist for the 203.0.113.0/24 network: one pointing to ISP-A with an administrative distance of 10, and another pointing to ISP-B with an administrative distance of 5. Packets for that subnet are leaving through ISP-B. What explains this behavior?

Accepted Answer

The ISP-B route has a lower administrative distance.. The route via ISP-B has a lower administrative distance, so it wins for the identical /24 prefix. For routes to the same destination and mask, the router compares AD before considering anything else between different route sources.

Answer

Static routes with a higher next-hop IP are preferred.

Answer

The router always prefers the route configured last.

Answer

The route names force policy-based routing.

Question 11

A controller-based WLAN uses 5 GHz in an open office. Clients keep disconnecting when users roam between APs, but signal strength remains strong. Based on the exhibit, what is the most likely problem?

Accepted Answer

A transmit power mismatch is creating asymmetric coverage around AP-3.. The APs are transmitting at much higher power than the clients, creating a coverage imbalance. Clients may hear the AP well enough to stay associated too long, while the AP cannot reliably hear the weaker client at the same cell edge. That leads to sticky-client and roaming issues even when RSSI looks strong.

Answer

The SSID must use 2.4 GHz only for roaming to work.

Answer

WPA2 cannot support roaming between APs.

Answer

The WLAN needs a different DHCP scope on each AP.

Question 12

Which two statements about standard and extended IPv4 ACLs are correct?

Accepted Answer

A standard ACL matches only the source IPv4 address.. Standard ACLs match only the source IPv4 address, while extended ACLs can match protocol and source and destination details including ports. Because standard ACLs are less granular, they are usually placed closer to the destination. Extended ACLs are usually placed closer to the source.

Answer

A standard ACL is normally placed as close to the source as possible.

Answer

An extended ACL cannot filter ICMP traffic.

Answer

Both ACL types require named ACL syntax to match traffic.

Question 13

Clients on a network can browse the internet by IP address but fail when using hostnames. What is the most likely problem?

Accepted Answer

The client is using the wrong DNS server address.. The client can browse by IP address but not by hostname, which indicates that IP connectivity and routing are functional, but name resolution is failing. Since DNS translates hostnames to IP addresses, the most likely fault is that the client is configured with an incorrect DNS server address, preventing it from resolving domain names.

Answer

The default gateway on the PC is incorrect.

Answer

NAT overload is failing on the edge router.

Answer

The switchport must be converted to a routed port.

Question 14

A switch should automatically disable any access port that receives a BPDU from an attached device. Which feature directly provides that behavior?

Accepted Answer

BPDU Guard. BPDU Guard is designed for edge ports that should never see BPDUs. If a BPDU arrives, the port is placed into an err-disabled state to protect the topology. Root Guard and Loop Guard solve different STP problems.

Answer

Root Guard

Answer

Loop Guard

Answer

PortFast

Question 15

A network administrator is configuring a Layer 2 EtherChannel between two switches. Switch A uses 'channel-group 1 mode active', and Switch B uses 'channel-group 1 mode desirable'. All member interfaces are trunk ports with identical allowed VLANs. The EtherChannel fails to form. What is the most likely cause?

Accepted Answer

The switches are using different EtherChannel negotiation protocols.. The two switches are using different negotiation protocols: LACP (active) on one side and PAgP (desirable) on the other. EtherChannel requires both sides to use the same protocol, so this protocol mismatch prevents the bundle from forming. The other settings—trunking, VLAN configuration, and channel-group number—are correctly configured and do not cause the failure.

Answer

A Layer 2 EtherChannel cannot carry trunk links.

Answer

The channel-group number must be different on each switch.

Answer

The member interfaces must be in access mode before the bundle can form.