CCNA Timed Practice Test 3 — 10 Questions

Question 1

A network engineer is implementing AIOps to improve network reliability. Which four of the following are core capabilities that AIOps platforms typically provide? (Choose four.)

Accepted Answer

Correlation of alerts from multiple network devices to reduce noise. Correlation of alerts from multiple network devices is a core AIOps capability because it uses machine learning to analyze and group related alerts, reducing noise and helping engineers focus on root causes rather than individual symptoms. Self-healing by automatically reverting problematic configuration changes is a key feature, as AIOps can detect anomalies caused by changes and roll back to a stable state to minimize downtime. Predictive maintenance identifies devices likely to fail by analyzing historical performance data and telemetry, enabling proactive replacement or repair before failures occur. Baseline learning of normal traffic patterns allows AIOps to detect deviations that indicate potential issues. The incorrect options are not core AIOps capabilities: Direct manipulation of physical layer hardware is beyond the scope of AIOps, which focuses on software-based analysis and automation; guaranteed elimination of all false positives is unrealistic because no system can achieve 100% accuracy in alarm filtering.

Answer

Direct manipulation of physical layer hardware to replace faulty optics

Answer

Guaranteed elimination of all false positive alarms in the network

Question 2

A network administrator wants to secure remote CLI access to a Cisco router, moving beyond simple username/password authentication. Which approach best achieves this goal?

Accepted Answer

Use stronger or additional authentication controls to improve remote administrative access security. The goal is to strengthen authentication beyond a simple password. Cisco AAA (Authentication, Authorization, and Accounting) using TACACS+ or RADIUS provides stronger, centralized authentication. Secure Shell (SSH) with key-based or two-factor authentication also enhances security. Option A correctly describes this concept, while the other options either weaken security (B, D) or address access control via ACLs, which does not improve the authentication factor itself (C).

Answer

Replace SSH with Telnet to simplify troubleshooting

Answer

Configure an extended ACL to limit remote access to specific source IP addresses

Answer

Disable password authentication and rely solely on device location in the network

Question 3

Which IPv6 address type is automatically created on an interface and used for link-local communication?

Accepted Answer

Link-local. IPv6 interfaces automatically generate a link-local address in FE80::/10 for local-segment functions such as neighbor discovery.

Answer

Unique local

Answer

Global unicast

Answer

Anycast

Question 4

A network administrator notices that a switchport in access mode with PortFast enabled has transitioned to an err-disabled state. What is the most likely cause?

Accepted Answer

BPDU Guard disabled the PortFast-enabled access port after it received a BPDU.. The strongest reason is a BPDU Guard violation on a PortFast-enabled access port. In practical terms, the port was expected to face an end host, not a switching device that emits BPDUs. When BPDUs appeared, the switch treated that as a topology-policy violation and error-disabled the interface to protect the network.

This is one of the most classic access-layer protection patterns on the CCNA exam.

Answer

Port security shut down the port because the VLAN was wrong.

Answer

DHCP snooping disabled the interface because a host requested an address.

Answer

EtherChannel suspended the interface because the bundle was incomplete.

Question 5

An engineer configures 802.1X port-based authentication on a Cisco IOS-XE switch for a voice VLAN deployment. After applying the configuration, IP phones on interface GigabitEthernet1/0/1 fail to receive a voice VLAN and remain in an unauthenticated state. The switchport is configured as an access port with voice VLAN 10. What is the most likely cause of the failure?

Accepted Answer

Configure 'authentication host-mode multi-domain' on the interface. The correct answer is B because in a voice VLAN deployment with 802.1X, the switchport must be configured with 'authentication host-mode multi-domain' to allow both a data device (phone) and a voice device (PC behind the phone) to authenticate separately. Without this mode, the port defaults to single-host mode, which prevents the phone from receiving the voice VLAN and keeps it in an unauthenticated state.

Answer

Re-authenticate the phone using 'dot1x reauthenticate interface Gi1/0/1'

Answer

Add 'switchport voice vlan 10' under the interface

Answer

Change the port to 'authentication port-control force-authorized'

Question 6

Drag and drop the following steps into the correct order to configure an SSID on a WLC and complete a WPA3-Personal client association with DHCP address assignment.

Accepted Answer

Configure DHCP scope, create an SSID profile, enable the SSID, configure WPA3-Personal security, client associates and obtains IP address.. The correct sequence is to first create the SSID profile, then configure WPA3-Personal security to ensure the WLAN is protected before it becomes active, then enable the SSID, set up the DHCP scope for address assignment, and finally allow the client to associate and obtain an IP address. Option A enables the SSID before setting security, exposing the network to unauthorized access during that window. Option B incorrectly starts with DHCP configuration before the SSID even exists. Option D also enables the SSID before security, leading to the same vulnerability as option A. Only option C follows the secure configuration order recommended by Cisco.

Answer

Create an SSID profile, enable the SSID, configure WPA3-Personal security, configure DHCP scope, client associates and obtains IP address.

Question 7

Drag and drop the following steps into the correct order to configure a Cisco IOS-XE router as a DHCP server for a client VLAN and then enable a DHCP relay agent on a different interface to forward client requests to a remote server.

Accepted Answer

Enter global configuration mode, enable DHCP relay on the required interface, create the DHCP pool, configure the network and default gateway, exclude addresses, and verify.. The correct order is to first exclude addresses to prevent the DHCP server from leasing reserved or gateway IPs, then create and configure the DHCP pool (network, default gateway), next enable DHCP relay on the required interface, and finally verify. Option D follows this Cisco best practice. Option A risks assigning excluded addresses because the pool is created before exclusions. Options B and C place relay setup before the pool is fully configured, which is incorrect.

Answer

Enter global configuration mode, create the DHCP pool, configure the network and default gateway, exclude addresses, enable DHCP relay on the required interface, and verify.

Question 8

You are connected to R1 in a small office network. Configure PAT (NAT overload) so that hosts on the 192.168.1.0/24 LAN can access the Internet via the public IP 203.0.113.1 (the IP assigned to interface G0/0). Also configure a static NAT for the internal web server at 192.168.1.10 to the public IP 203.0.113.6. The current configuration has errors: the inside/outside interface assignments are swapped, the ACL for PAT does not match the inside subnet, and the PAT rule points to the wrong ACL. Fix all issues so that both PAT and static NAT work correctly.

Accepted Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 1 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6. The main issues: (1) Interfaces were swapped — G0/0 (public) was inside and G0/1 (private) was outside. They should be reversed: G0/0 outside, G0/1 inside. (2) ACL 1 (used in the PAT command) permitted 192.168.2.0/24 instead of 192.168.1.0/24. (3) The PAT command for G0/0 used ACL 2, which was correct for the subnet but the interface was wrong. After fixing interface assignments and correcting ACL 1 to permit the inside subnet, the PAT command must use ACL 1 and the correct outside interface. The static NAT was correctly configured but needed the correct inside interface. The PAT translation uses the IP address of the outside interface (interface overload), so after fixing the configuration, inside hosts will be translated to 203.0.113.1, the primary IP of G0/0, not 203.0.113.5.

Answer

Configure G0/0 as inside, G0/1 as outside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 1 interface G0/1 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.2.0 0.0.0.255; apply ip nat inside source list 1 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Answer

Configure G0/0 as outside, G0/1 as inside; modify ACL 1 to permit 192.168.1.0 0.0.0.255; apply ip nat inside source list 2 interface G0/0 overload; keep ip nat inside source static 192.168.1.10 203.0.113.6

Question 9

A router has routes for 10.10.0.0/16, 10.10.20.0/24, and a default route. Which route is used for destination 10.10.20.55?

Accepted Answer

The 10.10.20.0/24 route. The destination matches multiple routes, but the /24 is the most specific match and wins by longest prefix match.

Answer

The 10.10.0.0/16 route

Answer

The default route

Answer

The router load-balances across all matching routes

Question 10

Why is NTP especially useful when devices send logs to a centralized Syslog server?

Accepted Answer

It helps align device clocks so centralized log timestamps can be correlated more accurately.. NTP is especially useful because synchronized clocks make the log timestamps more meaningful and easier to correlate. In plain language, if each device thinks the current time is different, the sequence of events in the centralized log becomes confusing. NTP helps align time across devices so the logs tell a more accurate story.

This is an operational best practice. Syslog collects the messages, and NTP makes their timing consistent. The correct answer is the one focused on timestamp correlation.

Answer

It assigns the Syslog server an IP address.

Answer

It replaces the need for a Syslog server.

Answer

It encrypts every Syslog message automatically.