CCNA CLI Questions — 50 Questions

Question 1

You are connected to R1. Configure IPv4 and IPv6 addressing on R1's interfaces and verify reachability to R2. The current configuration has a wrong subnet mask on G0/0, missing default gateway for IPv4, and R1's IPv6 address is configured using EUI-64 while R2 uses a static IPv6 address. Fix these issues so that R1 can ping both R2's IPv4 and IPv6 addresses.

Accepted Answer

Change R1 G0/0 subnet mask to /30, add a default route via 192.0.2.2, and configure a static IPv6 address 2001:db8:1::1/64 on G0/0.. The problem had three issues: (1) R1's G0/0 subnet mask was /24 (255.255.255.0) but R2's G0/0 was /30 (255.255.255.252), causing an IP subnet mismatch. (2) R1 lacked a default gateway for IPv4; the static route pointed to 192.0.2.254 which is not reachable. (3) R1's IPv6 EUI-64 configuration on G0/0 generates an interface ID from the MAC, but R2 expects a static address 2001:db8:1::2/64, so R1 must use a static IPv6 address on the same subnet. The fix: change R1's G0/0 mask to /30, add a default route via R2's G0/0 IP (192.0.2.2), and configure a static IPv6 address (e.g., 2001:db8:1::1/64) on R1's G0/0.

Answer

Change R1 G0/0 subnet mask to /30, add a default route via 192.0.2.254, and keep the EUI-64 IPv6 address on G0/0.

Answer

Change R1 G0/0 subnet mask to /24, add a default route via 192.0.2.2, and configure a static IPv6 address 2001:db8:1::1/64 on G0/0.

Answer

Change R1 G0/0 subnet mask to /30, add a default route via 192.0.2.2, and keep the EUI-64 IPv6 address on G0/0.

Question 2

You are connected to R1 in a small office network. Configure PAT (NAT overload) so that hosts on the 192.168.1.0/24 LAN can access the Internet via the public IP 203.0.113.1 (the IP assigned to interface G0/0). Also configure a static NAT for the internal web server at 192.168.1.10 to the public IP 203.0.113.6. The current configuration has errors: the inside/outside interface assignments are swapped, the ACL for PAT does not match the inside subnet, and the PAT rule points to the wrong ACL. Fix all issues so that both PAT and static NAT work correctly.

Accepted Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 1 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6. The main issues: (1) Interfaces were swapped — G0/0 (public) was inside and G0/1 (private) was outside. They should be reversed: G0/0 outside, G0/1 inside. (2) ACL 1 (used in the PAT command) permitted 192.168.2.0/24 instead of 192.168.1.0/24. (3) The PAT command for G0/0 used ACL 2, which was correct for the subnet but the interface was wrong. After fixing interface assignments and correcting ACL 1 to permit the inside subnet, the PAT command must use ACL 1 and the correct outside interface. The static NAT was correctly configured but needed the correct inside interface. The PAT translation uses the IP address of the outside interface (interface overload), so after fixing the configuration, inside hosts will be translated to 203.0.113.1, the primary IP of G0/0, not 203.0.113.5.

Answer

Configure G0/0 as inside, G0/1 as outside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 1 interface G0/1 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.2.0 0.0.0.255; apply ip nat inside source list 1 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 2 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Question 3

You are connected to R1 via the console. R1's GigabitEthernet0/0 (10.0.0.1/30) connects to an ISP router at 10.0.0.2/30. The internal network has a web server at 192.168.1.10 and a mail server at 192.168.1.20. You need to configure NAT so that internal hosts can access the internet (PAT overload) and external users can reach the web server via public IP 203.0.113.10 and the mail server via public IP 203.0.113.11. The inside interface is GigabitEthernet0/1 (192.168.1.1/24) and the outside interface is GigabitEthernet0/0.

Accepted Answer

ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside
ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80 extendable
ip nat inside source static tcp 192.168.1.20 25 203.0.113.11 25 extendable. The named standard ACL PERMIT_INTERNAL permits all internal hosts in 192.168.1.0/24. The 'ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload' command enables PAT, translating internal addresses to the outside interface's IP. Static NAT entries map web and mail servers to public IPs with the 'extendable' keyword to allow both PAT and static NAT. Proper interface NAT direction (inside/outside) is crucial.

Answer

ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/1
 ip nat outside
interface GigabitEthernet0/0
 ip nat inside
ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload
ip nat inside source static tcp 192.168.1.10 80 203.0.113.10 80
ip nat inside source static tcp 192.168.1.20 25 203.0.113.11 25

Answer

ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside
ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload
ip nat inside source static 192.168.1.10 203.0.113.10
ip nat inside source static 192.168.1.20 203.0.113.11

Answer

ip access-list standard PERMIT_INTERNAL permit 192.168.1.0 0.0.0.255
interface GigabitEthernet0/1
 ip nat inside
interface GigabitEthernet0/0
 ip nat outside
ip nat inside source list PERMIT_INTERNAL interface GigabitEthernet0/0 overload
ip nat outside source static tcp 203.0.113.10 80 192.168.1.10 80
ip nat outside source static tcp 203.0.113.11 25 192.168.1.20 25

Question 4

You are connected to R1 via console. The network has a primary link to the ISP via R2 and a backup link via R3. Configure IPv4 and IPv6 floating static default routes on R1 so that the primary path goes through R2 (AD 1) and the backup through R3 (AD 10). Additionally, configure a static route on R1 for the internal LAN 192.168.10.0/24 via R2 (AD 1). The current configuration includes a static default route ip route 0.0.0.0 0.0.0.0 10.0.0.3, which causes a recursive routing failure because 10.0.0.3 is not a valid next-hop address. Identify and fix the issue, then apply the floating static routes.

Accepted Answer

Remove the existing incorrect IPv4 static default route and reconfigure the primary IPv4 default route with the correct next-hop address (10.0.0.2) and AD 1. Add the backup IPv4 default route via 10.0.0.6 with AD 10. Then add IPv6 static default routes: ipv6 route ::/0 2001:DB8:1:1::2 1 and ipv6 route ::/0 2001:DB8:2:1::2 10. Also add the static route for 192.168.10.0/24 via 10.0.0.2 with AD 1.. The IPv4 default route currently uses next-hop 10.0.0.3, which is not a valid address on any directly connected interface, causing a recursive lookup failure. Option A fixes this by removing the incorrect route and correctly adding the primary (10.0.0.2 with AD 1) and backup (10.0.0.6 with AD 10) default routes, fulfilling the floating static requirement. It also adds both IPv6 floating default routes and the LAN static route. Option B is wrong because adding a route to 10.0.0.0/30 via R3 does not fix the next-hop 10.0.0.3 failure for the default route. Option C incorrectly reverses the administrative distances, making the backup path the primary. Option D erroneously uses an exit interface instead of the correct next-hop IP, which is not suitable for multi-access or point-to-point networks without additional configuration and does not resolve the original misconfigured next-hop.

Answer

Add a static route to 10.0.0.0/30 via the backup link to R3, then the default route to 10.0.0.2 will work. Then configure IPv6 default routes with AD 1 and 10 as described.

Answer

Change the administrative distance of the IPv4 default route to 10 and the backup to 1, so the backup becomes primary. Then configure IPv6 default routes with AD 10 and 1 respectively.

Answer

Remove the existing IPv4 static default route and configure it with the next-hop as the exit interface (e.g., GigabitEthernet0/0) instead of the IP address. Then add IPv6 default routes using the exit interface as well.

Question 5

You are connected to the console of R1. The network uses IPv6 with EUI-64. R1's GigabitEthernet0/0 interface has MAC address 0011.2233.4455. You must configure the interface to generate an IPv6 link-local address using the 'ipv6 enable' command, and also assign a global unicast address 2001:db8:1::/64 using EUI-64. The interface is currently administratively down.

Accepted Answer

R1(config-if)# ipv6 enable
R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64
R1(config-if)# no shutdown. The ipv6 enable command explicitly creates a link-local address as required by the scenario. The global unicast address with the eui-64 keyword automatically derives the interface ID from the MAC address. Option B is incorrect because it tries to manually configure a link-local address with eui-64, which is unnecessary and invalid. Option C omits the ipv6 enable command, failing the explicit requirement. Option D assigns a static host portion instead of using eui-64.

Answer

R1(config-if)# ipv6 address fe80::/10 eui-64
R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64
R1(config-if)# no shutdown

Answer

R1(config-if)# ipv6 enable
R1(config-if)# ipv6 address 2001:db8:1::1/64
R1(config-if)# no shutdown

Question 6

You are connected to R1. The network uses a router-on-a-stick design with a single switch (SW1) and two VLANs (10 and 20). Currently, hosts in VLAN 10 cannot ping hosts in VLAN 20, and the trunk between R1 and SW1 shows a native VLAN mismatch. Examine the provided configuration and output, then apply the necessary corrections to R1 so that inter-VLAN routing works correctly.

Accepted Answer

Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.20 to dot1Q 20, and enable IP routing globally.. The configuration has three issues: 1) The native VLAN on the trunk is VLAN 1, but the switch expects VLAN 99 (common mismatch scenario). 2) Subinterface G0/0.20 uses encapsulation dot1Q 10 instead of 20, causing VLAN 20 traffic to be mis-tagged. 3) The 'ip routing' command is missing globally, so R1 cannot route between subinterfaces. To fix, configure the main interface G0/0 with 'encapsulation dot1Q 99 native' to set the native VLAN to 99, correct the encapsulation on G0/0.20 to 'dot1Q 20', and enable IP routing with 'ip routing'.

Answer

Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.20 to dot1Q 20, but do not enable IP routing because it is enabled by default.

Answer

Change the native VLAN on R1's trunk interface to 1, correct the encapsulation on G0/0.20 to dot1Q 20, and enable IP routing globally.

Answer

Change the native VLAN on R1's trunk interface to 99, correct the encapsulation on G0/0.10 to dot1Q 10, and enable IP routing globally.

Question 7

You are connected to WLC-1 via SSH. A new SSID 'CorpSecure' must be configured for 5 GHz clients using WPA3-Personal. However, after creation, clients can see the SSID but fail to associate. Review the WLC configuration and fix the issue so that clients can successfully associate and obtain an IP address from VLAN 100 (subnet 10.0.100.0/24).

Accepted Answer

Change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, set the radio policy to 5 GHz, and ensure the WLAN is mapped to the dynamic interface for VLAN 100.. The SSID was configured with WPA2 instead of WPA3. The WLC also had no radio policy set for 5 GHz only. To fix, change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, and set the radio policy to 5 GHz. Additionally, ensure the WLAN is mapped to the appropriate dynamic interface for VLAN 100, not the management interface, and that client VLAN 100 is reachable. The commands to modify the WLAN are: config wlan security wpa3 1 enable, config wlan security wpa3 psk ascii CorpSecurePass123 1, config wlan radio policy 802.11a-only 1, and config wlan enable 1.

Answer

Change the WLAN security to WPA2-Personal, enable TKIP encryption, and set the radio policy to 5 GHz.

Answer

Change the WLAN security to WPA3-Personal, enable AES-CCMP, but leave the radio policy as 'All' (both 2.4 GHz and 5 GHz).

Answer

Change the WLAN security to WPA3-Personal, enable AES-CCMP, set the radio policy to 5 GHz, but do not enable the WLAN after changes.

Question 8

You are connected to R1. The link between R1 and R2 is down. The output of 'show interfaces gigabitEthernet0/0' on R1 shows: 'GigabitEthernet0/0 is administratively down, line protocol is down (disabled)', with IP address 203.0.113.1/30, MTU 1500, and no input/output errors. Determine the root cause and configure the necessary fix to bring the interface up and restore connectivity.

Accepted Answer

Enter interface configuration mode for GigabitEthernet0/0 and issue the 'no shutdown' command.. The interface status 'administratively down' means the interface was manually shut down using the 'shutdown' command. To bring it up, you must enter interface configuration mode and issue 'no shutdown', which administratively enables the interface. The other options are incorrect: setting speed to 100 Mbps or forcing full-duplex will not fix an administratively down state, and disabling keepalives is unrelated to the interface being disabled.

Answer

Enter interface configuration mode and issue the 'speed 100' command to match the remote interface speed.

Answer

Enter interface configuration mode and issue the 'duplex full' command to force full-duplex operation.

Answer

Enter interface configuration mode and issue the 'no keepalive' command to disable keepalives.

Question 9

You are connected to R1 via the console. R1 is a new router that connects to three subnets: 192.168.1.0/24 (connected to GigabitEthernet0/0), 192.168.2.0/24 (connected to GigabitEthernet0/1), and 192.168.3.0/24 (connected to GigabitEthernet0/2). R1 must be able to ping the loopback0 interface of R2 (192.168.100.1/32) which is reachable via R2's Serial0/0/0 interface (10.0.0.2/30). The link between R1 and R2 is 10.0.0.0/30, with R1's interface being 10.0.0.1/30. No dynamic routing protocols are configured. Configure R1 to reach the loopback address of R2 using a host-specific static route (not a default route).

Accepted Answer

ip route 192.168.100.1 255.255.255.255 10.0.0.2. Option A is correct because it configures a host route (mask /32) to destination 192.168.100.1 with next-hop 10.0.0.2, directly matching the loopback address and providing exact reachability. Option B is incorrect because it uses a /24 mask, which does not match the /32 loopback and would cause routing issues. Option C is incorrect because it uses next-hop 192.168.1.1, which is not the directly connected neighbor; packets would be forwarded to a local interface, not across the serial link. Option D is incorrect because it creates a default route (0.0.0.0/0) rather than the required host-specific route, failing to meet the specific task requirement.

Answer

ip route 192.168.100.0 255.255.255.0 10.0.0.2

Answer

ip route 192.168.100.1 255.255.255.255 192.168.1.1

Answer

ip route 0.0.0.0 0.0.0.0 10.0.0.2

Question 10

You are connected to R1, a multilayer switch acting as a DNS client for internal name resolution. The network uses a private DNS server at 192.168.1.100. Users report that resolving the hostname 'server01.courseiva.local' fails intermittently. Diagnose and fix the DNS resolution issue by examining the current configuration and using appropriate show commands to verify.

Accepted Answer

Re-enter the 'ip name-server 192.168.1.100' command and verify with 'show ip dns'.. The 'ip name-server' command was missing from the configuration, causing the switch to use broadcast DNS queries (to 255.255.255.255) instead of a specific server. Broadcast queries may occasionally succeed if a DNS server on the network answers them, producing the reported intermittent failures. Re-entering the 'ip name-server 192.168.1.100' command forces directed queries, ensuring reliable resolution. After configuration, a 'ping server01.courseiva.local' will trigger DNS and confirm success if the server is reachable.

Answer

Configure 'ip domain lookup' to enable DNS resolution on the switch.

Answer

Change the 'ip domain name' to 'courseiva.local' to match the hostname being resolved.

Answer

Use 'debug ip dns' to monitor DNS queries and identify the problem.

Question 11

You are troubleshooting a link between R1 (G0/0) and R2 (G0/0). The link is up but experiencing packet loss. You suspect an interface speed/duplex mismatch or SFP issue. Configure R1's interface to match the correct speed and duplex, and replace the SFP module if necessary to support a required distance of 40 km over single-mode fiber.

Accepted Answer

Remove manual speed/duplex settings, enable auto-negotiation, and replace the SFP with a long-reach module (e.g., 1000BASE-ZX) that supports 40 km over single-mode fiber.. The link is experiencing packet loss, likely due to a speed/duplex mismatch between the manually configured interface and the peer (which may use auto-negotiation) and/or an SFP module that cannot support the required 40 km distance over single-mode fiber. To resolve both potential issues, remove any manual speed and duplex settings to restore default auto-negotiation (using 'no speed' and 'no duplex'), and replace the SFP with a module rated for 40 km or more on SMF, such as a 1000BASE-ZX (or 1000BASE-EX) transceiver. Standard 1000BASE-LX/LH only reaches up to 10 km on SMF, so it is insufficient for this scenario.

Answer

Change the duplex to full and speed to 1000 Mbps manually, and keep the existing SFP.

Answer

Keep the manual speed/duplex settings but replace the SFP with a 1000BASE-SX module.

Answer

Enable auto-negotiation on both ends but keep the existing SFP.

Question 12

You are troubleshooting a network connectivity issue on R1. The network 192.168.10.0/24 behind R2 must be reachable from R1 via the primary path through R2 (192.0.2.2). A backup path via R3 (198.51.100.2) should automatically take over if the primary fails. Currently, traffic to 192.168.10.0/24 is incorrectly using the backup path even though the primary path is operational. Analyze the routing table and configuration, then fix the issue so that the primary path is preferred when available.

Accepted Answer

Remove the static route to 192.168.10.0/24 via 198.51.100.2 and add a floating static route via 198.51.100.2 with AD 200. Ensure the primary route via 192.0.2.2 uses default AD 1.. The routing table shows a static route to 192.168.10.0/24 via 198.51.100.2 with Administrative Distance (AD) 1, which is the default for static routes. The intended primary path via 192.0.2.2 was configured with AD 200 (floating static), but because the default AD (1) is lower than 200, the backup route is preferred. The fix is to reconfigure the primary path with the default AD (1) and the backup path with a higher AD (e.g., 200). This ensures the primary path is used when available and the backup takes over only if the primary fails.

Answer

Change the AD of the static route via 192.0.2.2 to 200 and the AD of the route via 198.51.100.2 to 1.

Answer

Add a static route to 192.168.10.0/24 via 192.0.2.2 with AD 1 and remove the existing route via 198.51.100.2.

Answer

Configure a policy-based route to prefer the next-hop 192.0.2.2 for traffic to 192.168.10.0/24.

Question 13

You are connected to the console of R1, a Cisco IOS-XE router. The network operations team needs to automate the backup of the running configuration to a TFTP server using a Python netmiko script. However, the script is failing. Your task is to write the correct netmiko commands to connect to R1 and save the configuration to the TFTP server at 192.168.1.100.

Accepted Answer

from netmiko import ConnectHandler

connection = ConnectHandler(device_type='cisco_ios', ip='192.168.1.1', username='admin', password='cisco')
connection.send_command('copy running-config tftp://192.168.1.100/r1-config', expect_string=r'$$confirm$$')
connection.send_command('\n')
connection.disconnect(). The 'copy running-config tftp://...' command in Cisco IOS prompts with '[confirm]'. To handle this interactively in netmiko, the expect_string must use a regular expression that matches the literal characters '[' and ']', which requires escaping them as '$$' and '$$'. The corrected script uses r'$$confirm$$' and then sends a newline to confirm, ensuring the backup completes. Options B and D fail to expect the prompt, and C uses an incorrect prompt match (expect_string=r'#' would only wait for the privileged EXEC prompt, missing the confirmation).

Answer

from netmiko import ConnectHandler

connection = ConnectHandler(device_type='cisco_ios', ip='192.168.1.1', username='admin', password='cisco')
connection.send_command('copy running-config tftp://192.168.1.100/r1-config')
connection.disconnect()

Answer

from netmiko import ConnectHandler

connection = ConnectHandler(device_type='cisco_ios', ip='192.168.1.1', username='admin', password='cisco')
connection.send_command('copy running-config tftp://192.168.1.100/r1-config', expect_string=r'#')

Answer

from netmiko import ConnectHandler

connection = ConnectHandler(device_type='cisco_ios', ip='192.168.1.1', username='admin', password='cisco')
connection.send_command('copy running-config tftp://192.168.1.100/r1-config
')
connection.disconnect()

Question 14

You are connected to SW1. The current configurations of interfaces GigabitEthernet0/1 and GigabitEthernet0/2 are as follows:

Gi0/1: speed 100, duplex half, switchport access vlan 10
Gi0/2: speed 1000, duplex full, switchport access vlan 20

The port-channel interface 1 does not exist. Configure a LACP EtherChannel between SW1 and SW2 using these two interfaces, with port-channel 1 and mode active on both sides. Ensure the channel forms by resolving any speed/duplex or VLAN mismatches. After configuration, verify with 'show etherchannel summary'.

Accepted Answer

The EtherChannel will not form because the physical interfaces have mismatched speed/duplex and VLAN assignments. You must configure both interfaces with the same speed (1000), duplex (full), and access VLAN (10), then apply channel-group 1 mode active on each.. The EtherChannel fails because member interfaces have mismatched speed/duplex (Gi0/1 is 100/half, Gi0/2 is 1000/full) and different VLANs (VLAN 10 vs 20). Additionally, the port-channel interface and physical interfaces must have matching VLAN assignments. To fix, unify both physical interfaces to the same speed (1000), duplex (full), and access VLAN (10). Then set channel-group mode active on each physical interface. Finally, ensure the port-channel interface also uses VLAN 10. Verify with 'show etherchannel summary' which should show the port-channel as SU (in use).

Answer

The EtherChannel will form successfully because LACP active mode negotiates the channel regardless of speed/duplex or VLAN differences.

Answer

The EtherChannel will not form because the port-channel interface must be configured with the same VLAN as the physical interfaces, but the physical interfaces can have different speeds.

Answer

The EtherChannel will form successfully because the port-channel interface inherits the VLAN from the first physical interface added, so no additional configuration is needed.

Question 15

You are connected to R1 via the console. R1 is the DHCP server for the 192.168.50.0/24 LAN. Configure DHCP on R1 to assign addresses from 192.168.50.10 to 192.168.50.200, with default gateway 192.168.50.1 and DNS server 8.8.8.8. Also, configure R1 to act as a DHCP relay agent for the 10.0.0.0/30 link to reach a remote DHCP server at 203.0.113.10. Then, troubleshoot and fix a misconfiguration that causes clients on VLAN 50 to not receive IP addresses.

Accepted Answer

[CORRECT] The DHCP pool is misconfigured: the excluded-address range covers most of the pool (192.168.50.1 through 192.168.50.200), but leaves 192.168.50.201-254 assignable, violating the requirement. The correct configuration should exclude 192.168.50.1-9 (gateway) and 192.168.50.201-254 (upper end). The 'ip helper-address' on GigabitEthernet0/0 is unnecessary because R1 itself is the DHCP server for that subnet; it should be removed. The relay agent configuration is missing on the interface facing the remote DHCP server—'ip helper-address 203.0.113.10' should be added to GigabitEthernet0/1.. The DHCP pool is misconfigured: the excluded-address range of 192.168.50.1 through 192.168.50.200 covers most of the pool, but leaves addresses 192.168.50.201 to 192.168.50.254 assignable, which violates the requirement to assign addresses only from 192.168.50.10 to 192.168.50.200. To meet the requirement, you must exclude both the lower range (192.168.50.1 to 192.168.50.9, reserving the gateway) and the upper range (192.168.50.201 to 192.168.50.254). Additionally, the 'ip helper-address' on GigabitEthernet0/0 is unnecessary because R1 itself is the DHCP server for that subnet; it should be removed. The relay agent configuration is missing on the interface facing the remote DHCP server—'ip helper-address 203.0.113.10' should be added to GigabitEthernet0/1 so that broadcasts from the 10.0.0.0/30 subnet are forwarded.

Answer

The DHCP pool is misconfigured: the excluded-address range should be 192.168.50.1 192.168.50.9, but the helper-address on GigabitEthernet0/0 is correct because it forwards DHCP requests to the remote server. The relay agent configuration is missing on GigabitEthernet0/1.

Answer

The DHCP pool is correctly configured with excluded-address 192.168.50.1 192.168.50.9. The issue is that the 'ip helper-address' on GigabitEthernet0/1 is missing; it should be added to forward requests to the remote server. Additionally, the 'ip helper-address' on GigabitEthernet0/0 is correct because it forwards requests from VLAN 50 to the remote server.

Answer

The DHCP pool is misconfigured: the excluded-address range should be 192.168.50.1 192.168.50.9. The 'ip helper-address' on GigabitEthernet0/0 should be removed. The relay agent configuration is correct because 'ip helper-address 203.0.113.10' is already configured on GigabitEthernet0/1.

Question 16

You are connected to R1, a Cisco IOS-XE router. Configure SNMP v2c with read-only community 'NetOpsRO' and SNMP v3 with user 'AdminUser' using SHA authentication (password: AuthPass1) and AES-128 encryption (password: PrivPass2). Also enable SNMP traps to the NMS at 192.0.2.10 with community 'TrapComm'. Additionally, configure NetFlow export to 192.0.2.20 using version 9, and ensure the flow exporter is applied to GigabitEthernet0/0. Verify your configuration using 'show snmp' and 'show ip cache flow'.

Accepted Answer

snmp-server community NetOpsRO ro
snmp-server group AdminGroup v3 priv
snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2
snmp-server enable traps
snmp-server host 192.0.2.10 TrapComm
flow exporter EXPORTER
destination 192.0.2.20
version 9
!
flow monitor FLOW-MONITOR
exporter EXPORTER
record netflow ipv4 original-input
!
interface GigabitEthernet0/0
ip flow monitor FLOW-MONITOR input. Option A is the only complete configuration. It defines the SNMPv3 group and user, enables traps, sets up the flow exporter, and crucially defines a flow monitor globally before applying it to the interface. Without the global `flow monitor` definition, the `ip flow monitor ... input` command on the interface would be rejected. Option B omits the SNMP group and uses the deprecated `ip flow export` instead of the modern flow monitor method. Option C is missing the flow monitor definition, and its `snmp-server host` version syntax is unnecessary but not harmful; the real flaw is the absent monitor. Option D attempts to add the flow monitor but incorrectly places the global definition commands inside the interface configuration, which would cause a syntax error.

Answer

snmp-server community NetOpsRO ro
snmp-server user AdminUser v3 auth sha AuthPass1 priv aes 128 PrivPass2
snmp-server enable traps
snmp-server host 192.0.2.10 TrapComm
flow exporter EXPORTER
destination 192.0.2.20
version 9
!
interface GigabitEthernet0/0
ip flow export EXPORTER

Answer

snmp-server community NetOpsRO ro
snmp-server group AdminGroup v3 priv
snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2
snmp-server enable traps
snmp-server host 192.0.2.10 version 2c TrapComm
flow exporter EXPORTER
destination 192.0.2.20
version 9
!
interface GigabitEthernet0/0
ip flow monitor FLOW-MONITOR input

Answer

snmp-server community NetOpsRO ro
snmp-server group AdminGroup v3 priv
snmp-server user AdminUser AdminGroup v3 auth sha AuthPass1 priv aes 128 PrivPass2
snmp-server enable traps
snmp-server host 192.0.2.10 TrapComm
flow exporter EXPORTER
destination 192.0.2.20
version 9
!
interface GigabitEthernet0/0
ip flow monitor FLOW-MONITOR input
flow monitor FLOW-MONITOR
exporter EXPORTER

Question 17

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two links to SW2: G0/1 and G0/2. The administrator wants to combine these two links into an EtherChannel using LACP. Configure an EtherChannel on SW1 for these ports and verify.

Accepted Answer

interface range g0/1-2
channel-group 1 mode active. The correct answer is A because it applies the LACP 'active' mode to both interfaces in the range, which will dynamically negotiate an EtherChannel with the peer. Option B uses PAgP 'desirable' mode, which is Cisco proprietary and not LACP, failing the requirement for LACP. Option C mixes LACP modes (active on one interface and passive on the other); both member ports must use the same mode (either active/active or passive/passive) to form a channel. Option D attempts to configure the 'channel-group' command on the port-channel interface itself, but this command must be applied to the physical interfaces, not the logical port-channel.

Answer

interface range g0/1-2
channel-group 1 mode desirable

Answer

interface g0/1
channel-group 1 mode active
interface g0/2
channel-group 1 mode passive

Answer

interface port-channel 1
channel-group 1 mode active

Question 18

You are connected to R1, a router acting as a network access server for 802.1X authentication on interface GigabitEthernet0/1. Configure AAA with a RADIUS server at 192.0.2.10 (key 'cisco123') so that the default login authentication uses RADIUS first, then local fallback. Additionally, troubleshoot why a connected supplicant on G0/1 remains in the unauthorized state even though RADIUS is reachable and the supplicant credentials are correct.

Accepted Answer

Enable AAA with 'aaa new-model', configure RADIUS server 'RADIUS_SERVER' with key 'cisco123', and apply 'aaa authentication login default group radius local'.. The problem is that AAA is not enabled (no aaa new-model) and no RADIUS server is configured; thus the 802.1X authentication fails because the router does not know how to communicate with the RADIUS server. The fix requires enabling AAA with 'aaa new-model', configuring the RADIUS server with 'radius server RADIUS_SERVER' and its key, then applying a default authentication list that uses RADIUS with local fallback via 'aaa authentication login default group radius local'. After these commands, the port should transition to authorized state for valid credentials.

Answer

Configure 'aaa authentication login default local' and add the RADIUS server with 'radius-server host 192.0.2.10 key cisco123'.

Answer

Enable AAA with 'aaa new-model' and configure 'aaa authentication login default group radius' without local fallback.

Answer

Configure 'aaa new-model', then apply 'dot1x system-auth-control' and 'aaa authentication dot1x default group radius'.

Question 19

You are connected to R1, a Cisco ISR 4331 router running IOS-XE. Your task is to enable SNMP v2c with community string 'public' (read-only) and 'private' (read-write), and configure SNMP v3 with a user 'admin' using SHA authentication (password 'Cisco123') and AES 128 encryption (password 'Cisco456'). Additionally, configure SNMP traps to be sent to a management server at 203.0.113.10 for both v2c and v3. Finally, enable NetFlow export to a collector at 203.0.113.20, using version 9. Verify your configuration using 'show snmp' and 'show ip cache flow'.

Accepted Answer

snmp-server community public RO
snmp-server community private RW
snmp-server user admin v3group v3 auth sha Cisco123 priv aes 128 Cisco456
snmp-server enable traps
snmp-server host 203.0.113.10 version 2c public
snmp-server host 203.0.113.10 version 3 auth admin
ip flow-export destination 203.0.113.20 2055
ip flow-export version 9. The router lacks SNMP and NetFlow configuration. For SNMP v2c, you must define community strings with 'snmp-server community public RO' and 'snmp-server community private RW'. For SNMP v3, you create a user within a group; the command requires a group name, e.g., 'snmp-server user admin v3group v3 auth sha Cisco123 priv aes 128 Cisco456'. Traps are enabled and sent to 203.0.113.10 via v2c with the public community and v3 with the admin user. NetFlow export uses version 9 to collector 203.0.113.20. Verification commands show SNMP details and flow cache export settings.

Answer

snmp-server community public
snmp-server community private
snmp-server user admin v3 auth md5 Cisco123 priv des56 Cisco456
snmp-server enable traps
snmp-server host 203.0.113.10 version 2c public
snmp-server host 203.0.113.10 version 3 auth admin
ip flow-export destination 203.0.113.20 2055
ip flow-export version 9

Answer

snmp-server community public RO
snmp-server community private RW
snmp-server user admin v3 auth sha Cisco123 priv aes 128 Cisco456
snmp-server enable traps
snmp-server host 203.0.113.10 version 2c private
snmp-server host 203.0.113.10 version 3 auth admin
ip flow-export destination 203.0.113.20 2055
ip flow-export version 9

Answer

snmp-server community public RO
snmp-server community private RW
snmp-server user admin v3 auth sha Cisco123 priv aes 128 Cisco456
snmp-server enable traps
snmp-server host 203.0.113.10 version 2c public
snmp-server host 203.0.113.10 version 3 auth admin
ip flow-export destination 203.0.113.20 2055
ip flow-export version 5

Question 20

You are connected to R1 via the console. SNMP v2c community strings (public RO, private RW) are already configured. The network has a management server at 10.1.1.100 and a NetFlow collector at 10.1.1.200. Configure SNMP traps to the management server for link status changes. Also configure NetFlow on interface GigabitEthernet0/0 to export version 9 to the collector, with a source interface of Loopback0 (10.255.255.1/32).

Accepted Answer

snmp-server host 10.1.1.100 version 2c public
snmp-server enable traps snmp linkdown linkup
ip flow-export destination 10.1.1.200 2055
ip flow-export version 9
ip flow-export source Loopback0
interface GigabitEthernet0/0
 ip flow ingress. The current configuration has SNMP community strings but lacks trap destinations and NetFlow export. To fix, you must configure snmp-server host 10.1.1.100 version 2c public to send traps, and snmp-server enable traps snmp linkdown linkup is required to send link status changes. For NetFlow, you need ip flow-export destination 10.1.1.200 2055 and then ip flow-export version 9 to set the export version. Also configure ip flow-export source Loopback0 and apply ip flow ingress on GigabitEthernet0/0. Verification commands confirm the settings.

Answer

snmp-server host 10.1.1.200 version 2c private
snmp-server enable traps
ip flow-export destination 10.1.1.100 2055 version 9
ip flow-export source Loopback0
interface GigabitEthernet0/0
 ip flow egress

Answer

snmp-server host 10.1.1.100 version 2c private
snmp-server enable traps
ip flow-export destination 10.1.1.200 2055 version 9
ip flow-export source Loopback0
interface GigabitEthernet0/0
 ip flow ingress

Answer

snmp-server host 10.1.1.100 version 2c public
snmp-server enable traps snmp linkdown linkup
ip flow-export destination 10.1.1.200 2055 version 5
ip flow-export source Loopback0
interface GigabitEthernet0/0
 ip flow ingress

CCNA CLI Questions — 50 Questions

Exhibit

CCNA CLI Questions — 50 Questions

Exhibit