CCNA Network Services and Security Practice Test 26 — 15 Questions

Question 1

A switch stack is running PVST+. Users on VLAN 40 lose connectivity for roughly 30 seconds every time the uplink on SW2 flaps. Based on the exhibit, which change would most directly improve convergence for this VLAN?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure spanning-tree mode rapid-pvst.. The output shows VLAN 40 is still using the legacy IEEE STP process, which converges much more slowly than Rapid PVST+. Moving the switch to rapid-pvst mode gives VLAN 40 the faster proposal/agreement behavior that typically cuts convergence time from tens of seconds to a few seconds.

Answer

Increase the bridge priority on SW2 for VLAN 40.

Answer

Disable PortFast on all access ports.

Answer

Convert the uplink to a routed port.

Question 2

Two static routes exist for the 203.0.113.0/24 network: one pointing to ISP-A with an administrative distance of 10, and another pointing to ISP-B with an administrative distance of 5. Packets for that subnet are leaving through ISP-B. What explains this behavior?

Accepted Answer

The ISP-B route has a lower administrative distance.. The route via ISP-B has a lower administrative distance, so it wins for the identical /24 prefix. For routes to the same destination and mask, the router compares AD before considering anything else between different route sources.

Answer

Static routes with a higher next-hop IP are preferred.

Answer

The router always prefers the route configured last.

Answer

The route names force policy-based routing.

Question 3

A controller-based WLAN uses 5 GHz in an open office. Clients keep disconnecting when users roam between APs, but signal strength remains strong. Based on the exhibit, what is the most likely problem?

Accepted Answer

A transmit power mismatch is creating asymmetric coverage around AP-3.. The APs are transmitting at much higher power than the clients, creating a coverage imbalance. Clients may hear the AP well enough to stay associated too long, while the AP cannot reliably hear the weaker client at the same cell edge. That leads to sticky-client and roaming issues even when RSSI looks strong.

Answer

The SSID must use 2.4 GHz only for roaming to work.

Answer

WPA2 cannot support roaming between APs.

Answer

The WLAN needs a different DHCP scope on each AP.

Question 4

Which two statements about standard and extended IPv4 ACLs are correct?

Accepted Answer

A standard ACL matches only the source IPv4 address.. Standard ACLs match only the source IPv4 address, while extended ACLs can match protocol and source and destination details including ports. Because standard ACLs are less granular, they are usually placed closer to the destination. Extended ACLs are usually placed closer to the source.

Answer

A standard ACL is normally placed as close to the source as possible.

Answer

An extended ACL cannot filter ICMP traffic.

Answer

Both ACL types require named ACL syntax to match traffic.

Question 5

Clients on a network can browse the internet by IP address but fail when using hostnames. What is the most likely problem?

Accepted Answer

The client is using the wrong DNS server address.. The client can browse by IP address but not by hostname, which indicates that IP connectivity and routing are functional, but name resolution is failing. Since DNS translates hostnames to IP addresses, the most likely fault is that the client is configured with an incorrect DNS server address, preventing it from resolving domain names.

Answer

The default gateway on the PC is incorrect.

Answer

NAT overload is failing on the edge router.

Answer

The switchport must be converted to a routed port.

Question 6

A switch should automatically disable any access port that receives a BPDU from an attached device. Which feature directly provides that behavior?

Accepted Answer

BPDU Guard. BPDU Guard is designed for edge ports that should never see BPDUs. If a BPDU arrives, the port is placed into an err-disabled state to protect the topology. Root Guard and Loop Guard solve different STP problems.

Answer

Root Guard

Answer

Loop Guard

Answer

PortFast

Question 7

A network administrator is configuring a Layer 2 EtherChannel between two switches. Switch A uses 'channel-group 1 mode active', and Switch B uses 'channel-group 1 mode desirable'. All member interfaces are trunk ports with identical allowed VLANs. The EtherChannel fails to form. What is the most likely cause?

Accepted Answer

The switches are using different EtherChannel negotiation protocols.. The two switches are using different negotiation protocols: LACP (active) on one side and PAgP (desirable) on the other. EtherChannel requires both sides to use the same protocol, so this protocol mismatch prevents the bundle from forming. The other settings—trunking, VLAN configuration, and channel-group number—are correctly configured and do not cause the failure.

Answer

A Layer 2 EtherChannel cannot carry trunk links.

Answer

The channel-group number must be different on each switch.

Answer

The member interfaces must be in access mode before the bundle can form.

Question 8

An engineer applies this command on an access interface connected to a user PC: switchport port-security violation restrict. What happens if a second unauthorized MAC address appears on the port?

Accepted Answer

Frames from the unauthorized MAC are dropped and the violation is counted while the port stays up.. With restrict mode, the switch drops frames from the violating MAC, increments the violation counter, and can generate notifications. Unlike shutdown mode, the interface stays up. Unlike protect mode, the switch records the violation.

Answer

The port immediately goes err-disabled.

Answer

The switch forwards the traffic but logs a warning.

Answer

The port transitions to listening and learning states.

Question 9

Match each HTTP method to its common REST API action.

Accepted Answer

GET - Retrieve data. GET retrieves data; POST creates; PUT replaces; PATCH partially updates; DELETE removes; OPTIONS queries available methods.

Answer

GET - Create data

Answer

POST - Retrieve data

Answer

PUT - Partially update data

Question 10

R1 receives an OSPF route to 10.55.0.0/16 and already has a static route to 10.55.10.0/24. Which route will be used for traffic sent to 10.55.10.25?

Accepted Answer

The static /24 route, because it is the longest-prefix match.. The static /24 route is more specific than the OSPF /16 route, so longest-prefix match wins. Administrative distance is only compared among routes to the same prefix length.

Answer

The OSPF /16 route, because dynamic routes override static routes learned later.

Answer

Both routes equally, because they point to the same major network.

Answer

Neither route, because overlapping routes are invalid.

Question 11

Which STP role identifies the port on a non-root switch that has the best path back to the root bridge?

Accepted Answer

Root port. The root port is the single port on a non-root switch that provides the lowest-cost path toward the root bridge. Designated ports forward away from the root for a segment, and alternate ports are backup paths.

Answer

Designated port

Answer

Alternate port

Answer

Disabled port

Question 12

Users on a new access switch can reach devices in their own VLAN but cannot reach the default gateway on the distribution switch. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 30 is missing from the allowed VLAN list on the trunk.. The trunk allows only VLANs 10 and 20, so VLAN 30 traffic never crosses the uplink. Local switching inside VLAN 30 on the access switch can still work, which is why same-VLAN communication succeeds. Adding VLAN 30 to the allowed list is the direct fix.

Answer

The user ports should be configured as trunks.

Answer

The SVI for VLAN 30 must be shutdown for inter-VLAN routing to work.

Answer

The trunk native VLAN must be changed to VLAN 30.

Question 13

PCs in VLAN 40 are not receiving addresses from the centralized DHCP server at 172.16.1.10. What should be configured on the VLAN 40 default gateway interface?

Accepted Answer

ip helper-address 172.16.1.10. When DHCP clients and the DHCP server are on different subnets, the router interface serving the client subnet must relay broadcasts to the server with the ip helper-address command.

Answer

ip dhcp excluded-address 10.40.40.1 10.40.40.10

Answer

service dhcp

Answer

ip default-gateway 172.16.1.10

Question 14

An administrator wants an access-layer interface to shut down immediately if another switch is connected accidentally. Which feature best meets that requirement?

Accepted Answer

BPDU Guard. BPDU Guard is designed for edge ports. If the port receives a BPDU, the switch treats that as a sign that another switch has been connected and places the interface into an err-disabled state to protect the spanning-tree topology.

Answer

Root Guard

Answer

PortFast

Answer

Loop Guard

Question 15

An engineer configures NAT overload on a router for inside users. Which resource is primarily used to let many internal hosts share one public IPv4 address?

Accepted Answer

TCP and UDP port numbers. PAT distinguishes sessions by using Layer 4 port numbers. That is what allows many inside devices to use the same outside IP address at the same time without conflicting with each other.

Answer

IPv6 extension headers

Answer

Different source MAC addresses on the WAN

Answer

Separate routing tables per client