CCNA Network Assurance Questions

MCQhard

A network administrator is deploying a new QoS policy to prioritize voice traffic across a WAN link. The policy must ensure that voice packets are not dropped even during congestion, and that bandwidth is guaranteed for voice. Which queuing mechanism should be used for the voice class?

A.Weighted Random Early Detection (WRED)

B.Low Latency Queuing (LLQ)

C.Class-Based Weighted Fair Queuing (CBWFQ)

D.First-In, First-Out (FIFO) queuing

AnswerB

LLQ provides strict priority queuing for real-time traffic like voice.

Why this answer

LLQ is the correct choice because it combines strict priority queuing with CBWFQ, ensuring that voice traffic is placed into a strict priority queue that is serviced before any other queues. This guarantees low latency and prevents voice packet drops during congestion by allowing the priority queue to be policed to a configured bandwidth limit, while still providing bandwidth guarantees for the voice class.

Exam trap

Cisco often tests the distinction between CBWFQ and LLQ, where candidates mistakenly choose CBWFQ because it offers bandwidth guarantees, but fail to recognize that only LLQ provides the strict priority queuing required for real-time voice traffic to avoid drops and delay.

How to eliminate wrong answers

Option A is wrong because WRED is a congestion avoidance mechanism that drops packets proactively based on queue depth, not a queuing mechanism that guarantees bandwidth or provides strict priority; it would drop voice packets during congestion, violating the requirement. Option C is wrong because CBWFQ provides bandwidth guarantees and fair queuing for classes but does not include a strict priority queue, so voice traffic would experience delay and jitter during congestion, leading to potential drops. Option D is wrong because FIFO queuing offers no differentiation or priority, causing voice packets to be treated the same as all other traffic, resulting in drops and delay during congestion.

Practice this question →

MCQhard

A network engineer is designing a multicast network for IPTV. Which protocol is used by routers to discover which multicast groups are of interest to directly connected hosts?

A.Rendezvous Point (RP)

B.Internet Group Management Protocol (IGMP)

C.Protocol Independent Multicast (PIM)

D.Multicast Source Discovery Protocol (MSDP)

AnswerB

Internet Group Management Protocol (IGMP) is the correct protocol. It allows hosts to signal their interest in multicast groups to their directly connected router.

Why this answer

IGMP is the protocol used between hosts and their directly connected routers to signal membership in multicast groups. When a host wants to receive traffic for a specific IPTV multicast stream, it sends an IGMP membership report, and the router uses this information to build its multicast forwarding state for that subnet. Without IGMP, the router would have no way of knowing which groups are of interest to local hosts.

Exam trap

Cisco often tests the distinction between host-to-router signaling (IGMP) and router-to-router multicast routing (PIM), so candidates mistakenly choose PIM when the question explicitly asks about discovering groups of interest to directly connected hosts.

How to eliminate wrong answers

Option A is wrong because a Rendezvous Point (RP) is a router in a PIM-SM domain that acts as a meeting point for multicast sources and receivers, not a protocol for discovering host group interest. Option C is wrong because PIM is a multicast routing protocol used between routers to build distribution trees, not a protocol for hosts to report group membership to their first-hop router. Option D is wrong because MSDP is used to exchange active source information between different PIM-SM domains (e.g., between RPs), not for host-to-router group discovery.

Practice this question →

MCQmedium

A network administrator is troubleshooting a BGP routing issue where routes from an eBGP neighbor are not being installed in the routing table. The 'show ip bgp' output shows the routes are received but not valid. What is the most likely cause?

A.The AS-path contains the local AS number.

B.The next-hop IP address is not reachable.

C.BGP synchronization is enabled.

D.The maximum-prefix limit has been exceeded.

AnswerB

Correct. For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but be marked as not valid.

Why this answer

For a BGP route to be considered valid and installed in the routing table, the next-hop IP address must be reachable via an IGP or a static route. If the next hop is not reachable, the route will appear in the 'show ip bgp' output but will be marked as not valid (often with a 'r' for received but not valid). This is the most common cause when routes are received from an eBGP neighbor but not installed.

Exam trap

Cisco often tests the distinction between routes being received in the BGP table versus being installed in the routing table, and the trap here is that candidates confuse synchronization (a deprecated feature) with the next-hop reachability requirement, which is the immediate cause of the 'not valid' status.

How to eliminate wrong answers

Option A is wrong because if the AS-path contains the local AS number, BGP would reject the route due to loop prevention (the route would be marked as invalid or not received at all), but the question states routes are received. Option C is wrong because BGP synchronization is disabled by default in modern IOS versions and, even if enabled, it would affect the route's validity only if the prefix is not present in the IGP, but the next-hop reachability check is more fundamental. Option D is wrong because exceeding the maximum-prefix limit would cause the BGP session to be torn down or the neighbor to be shut down, not simply mark routes as not valid while keeping them in the BGP table.

Practice this question →

Multi-Selectmedium

Which TWO STP features are used to improve convergence time after a topology change?

Select 2 answers

A.UplinkFast

B.BackboneFast

C.Root Guard

D.BPDU Guard

E.PortFast

AnswersA, B

UplinkFast accelerates convergence after a direct link failure.

Why this answer

UplinkFast is correct because it enables a switch to immediately use an alternate root port when its current root port fails, bypassing the usual 30-second listening and learning delay. This is achieved by artificially lowering the bridge priority of the switch to trigger a topology change notification, allowing the backup port to transition directly to forwarding. BackboneFast is correct because it reduces convergence time by detecting indirect link failures in the backbone and allowing a switch to expire its Max Age timer (default 20 seconds) immediately, rather than waiting for the full timer to expire, thus speeding up the transition to a new root port.

Exam trap

Cisco often tests the distinction between features that improve convergence (UplinkFast, BackboneFast) versus features that provide security or edge-port behavior (Root Guard, BPDU Guard, PortFast), leading candidates to mistakenly select PortFast because it also speeds up initial port transition, but it does not react to topology changes.

Practice this question →

Drag & Dropmedium

Drag and drop the steps for the DHCP DORA process in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

DHCP uses Discover, Offer, Request, Acknowledge (DORA) for dynamic address assignment.

Practice this question →

Multi-Selectmedium

Which TWO statements are true about IP SLA? (Choose two.)

Select 2 answers

A.IP SLA is only supported on ASR routers.

B.IP SLA can be used with tracking objects to trigger route changes.

C.IP SLA can measure jitter between two devices.

D.IP SLA uses actual user traffic for measurements.

E.IP SLA can only measure round-trip time, not one-way delay.

AnswersB, C

IP SLA can be combined with tracking objects; when an SLA probe fails, the tracked object changes state, allowing dynamic route changes via static routes or PBR.

Why this answer

IP SLA can be combined with tracking objects and the 'track' command to influence routing decisions. When an IP SLA probe fails or falls below a threshold, the tracked object changes state, which can trigger a route change (e.g., via a static route with a higher administrative distance or a PBR policy). This allows the network to react to network performance or reachability issues automatically.

Exam trap

Cisco often tests the misconception that IP SLA uses real user traffic (Option D) or that it is limited to RTT (Option E), when in fact it generates synthetic probes and can measure one-way delay with proper time synchronization.

Practice this question →

Multi-Selectmedium

Which TWO statements about Cisco DNA Center's Assurance capabilities are correct?

Select 2 answers

A.It uses streaming telemetry to collect data for real-time analytics.

B.It supports only wired networks and not wireless.

C.It is a fully cloud-based solution with no on-premises components.

D.It only displays network device health scores and does not provide path tracing.

E.It can proactively detect potential issues based on historical trends.

AnswersA, E

Correct.

Why this answer

Cisco DNA Center uses model-driven telemetry (e.g., gRPC, NETCONF/YANG, or UDP-based push) to stream real-time data from network devices, enabling sub-second analytics and faster troubleshooting compared to traditional polling methods like SNMP.

Exam trap

The trap here is that candidates often assume DNA Center is purely cloud-based or only supports wired networks, but Cisco deliberately tests the hybrid deployment model and the unified wired/wireless assurance scope.

Practice this question →

MCQmedium

A network engineer is troubleshooting intermittent connectivity issues between two switches connected via a trunk link. The engineer notices that the port counters show a high number of CRC errors and runts on one side. Which action should the engineer take first?

A.Check the cable and connectors for damage or loose connections.

B.Increase the MTU size on the interface.

C.Configure the interface with a different duplex setting.

D.Disable Dynamic Trunking Protocol (DTP) on the interface.

AnswerA

CRC errors and runts often indicate physical layer issues like faulty cabling.

Why this answer

CRC errors and runts on a trunk link typically indicate a Layer 1 physical-layer issue, such as faulty cabling, damaged connectors, or poor termination. The first and most logical step is to inspect and test the physical cable and connectors, as this is the most common root cause and the easiest to verify before making configuration changes.

Exam trap

Cisco often tests the principle that Layer 1 issues must be resolved first before considering Layer 2 or Layer 3 changes, and the trap here is that candidates jump to configuration changes (like duplex or DTP) instead of verifying the physical medium.

How to eliminate wrong answers

Option B is wrong because increasing the MTU size would not resolve CRC errors or runts; it could actually exacerbate the problem by allowing larger frames that are more susceptible to corruption on a faulty physical link. Option C is wrong because duplex mismatch usually causes alignment errors, late collisions, or FCS errors, not specifically CRC errors and runts; moreover, modern switches with auto-negotiation rarely have duplex issues unless manually misconfigured. Option D is wrong because disabling DTP addresses trunk negotiation and VLAN tagging issues, not physical-layer errors like CRC and runts.

Practice this question →

MCQhard

A company has a core network running OSPF in a single area (area 0). The network consists of four routers: R1, R2, R3, and R4. R1 is connected to R2 and R3. R2 is also connected to R4. R3 is also connected to R4. All links are GigabitEthernet with OSPF cost based on bandwidth (reference bandwidth 100 Gbps). The network engineer notices that traffic from R1 to a subnet behind R4 is taking a suboptimal path: R1 -> R2 -> R4, instead of R1 -> R3 -> R4 which has lower cost. Upon checking OSPF neighbor states, all adjacencies are full. The engineer verifies that the cost on the R1-R3 link is 10 and the cost on the R3-R4 link is 10, while the R1-R2 link cost is 20 and the R2-R4 link cost is 20. The total cost via R2 is 40, via R3 is 20. However, the routing table on R1 shows the next-hop as R2 for the subnet behind R4. What is the most likely cause?

A.OSPF is load balancing across both paths equally.

B.The OSPF network type on R1-R3 is broadcast, causing DR/BDR election issues.

C.The subnet behind R4 is an external route (type 5 LSA) and the cost to the ASBR via R2 is lower than via R3 due to a mismatched reference bandwidth or manual cost setting.

D.The R1-R3 link is flapping, causing OSPF to prefer the stable path via R2.

AnswerC

External routes are evaluated based on cost to ASBR plus external cost; if the cost to ASBR via R2 is lower (e.g., due to different reference bandwidth), the path via R2 may be preferred.

Why this answer

The subnet behind R4 is likely redistributed into OSPF as an external route (type 5 LSA). The cost to reach the ASBR (R4) via R2 is 40, while via R3 it is 20, but if the external route's advertised cost is lower via R2 (e.g., due to a mismatched reference bandwidth or manual cost setting on R4's redistribution), OSPF will prefer the path with the lower total cost (intra-area cost to ASBR + external cost). In this scenario, the external cost via R2 could be 0 or very low, making the total cost via R2 (40 + low) lower than via R3 (20 + high), overriding the intra-area cost advantage.

Exam trap

Cisco often tests the misconception that OSPF always uses the lowest intra-area cost, but external route types (E1 vs E2) and their metric handling can override intra-area path selection, causing candidates to overlook redistribution and metric-type behavior.

How to eliminate wrong answers

Option A is wrong because OSPF does not load balance across unequal-cost paths without explicit configuration (e.g., 'maximum-paths' with equal-cost paths), and the costs are clearly unequal (40 vs 20). Option B is wrong because the OSPF network type on a point-to-point GigabitEthernet link (default broadcast) does not cause suboptimal path selection; DR/BDR election affects LSA flooding but not the cost-based SPF calculation, and all adjacencies are full. Option D is wrong because if the R1-R3 link were flapping, OSPF would detect the adjacency down and remove the route, not prefer a stable path with higher cost; the routing table would show only the R2 path, not a suboptimal choice based on stability.

Practice this question →

MCQhard

A company has a network with multiple VLANs connected via a Layer 3 switch acting as the gateway for all VLANs. The network uses Rapid PVST+ for spanning tree. Recently, the network team added a new access switch to VLAN 100. After the switch was connected, users in VLAN 100 experienced intermittent connectivity, and the Layer 3 switch logs show 'SPANTREE-2-ROOTGUARD_BLOCK' messages for the port connected to the new switch. The new switch is intended to provide additional access ports for VLAN 100. The network team ensured that the new switch's configuration is correct for VLAN 100 access. What is the most likely cause of the issue, and what action should be taken to resolve it?

A.Change the port configuration on the new switch to access mode for VLAN 100.

B.Disable Root Guard on the Layer 3 switch port connected to the new switch.

C.Configure the new switch with a higher bridge priority (e.g., 28672) to prevent it from becoming the root bridge.

D.Remove the new switch from the network because it is causing a BPDU attack.

AnswerC

Setting a higher bridge priority ensures the new switch does not attempt to become root, resolving the root guard blocking.

Why this answer

The issue is that the new switch, intended as an access switch, has a lower bridge priority (or default priority of 32768) than the existing root bridge for VLAN 100. When connected, it becomes the new root bridge, causing topology changes and intermittent connectivity. Root Guard on the Layer 3 switch port detects this superior BPDU and blocks the port to protect the root bridge position.

Configuring the new switch with a higher bridge priority (e.g., 28672) ensures it cannot become the root bridge, resolving the Root Guard blocks.

Exam trap

Cisco often tests the misconception that Root Guard is the problem and should be disabled, when in fact the root cause is the new switch's bridge priority being too low, and the correct fix is to adjust the priority on the new switch.

How to eliminate wrong answers

Option A is wrong because the port is already configured as an access port for VLAN 100 (the team verified correct configuration), and changing it again would not address the root bridge election issue. Option B is wrong because disabling Root Guard would allow the new switch to become the root bridge, causing the same intermittent connectivity and potential instability; Root Guard is a protective feature, not the cause. Option D is wrong because the new switch is not causing a BPDU attack; it is simply sending superior BPDUs due to its default bridge priority, which is a normal behavior that Root Guard is designed to protect against.

Practice this question →

Matchingmedium

Match each wireless standard to its frequency band and maximum data rate.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

5 GHz, up to 6.9 Gbps

2.4/5 GHz, up to 9.6 Gbps

2.4/5 GHz, up to 600 Mbps

2.4 GHz, up to 54 Mbps

5 GHz, up to 54 Mbps

Why these pairings

The correct matches are: 802.11b with 2.4 GHz / 11 Mbps; 802.11g with 2.4 GHz / 54 Mbps; 802.11n with 2.4/5 GHz / 600 Mbps; 802.11ac with 5 GHz / 1.3 Gbps. Common confusions arise from mixing up data rates or frequency bands across generations.

Practice this question →

MCQhard

Refer to the exhibit. A network engineer is troubleshooting a routing issue. The route for 10.0.0.0/8 is learned via EIGRP with metric 2560512. Which change would most likely cause the metric to increase?

A.Increase the bandwidth on GigabitEthernet0/0.

B.Add a redistribute static command under EIGRP.

C.Change the administrative distance to 90.

D.Increase the delay on GigabitEthernet0/0.

AnswerD

Correct.

Why this answer

The EIGRP metric is calculated using the formula: metric = (K1 * bandwidth + (K2 * bandwidth) / (256 - load) + K3 * delay) * 256, with default K values (K1=1, K3=1, others=0). Increasing the delay on the outgoing interface (GigabitEthernet0/0) directly increases the delay component in the composite metric, causing the overall metric to increase. Option D is correct because delay is a key variable in the EIGRP metric calculation.

Exam trap

Cisco often tests the misconception that increasing bandwidth increases the EIGRP metric, but the trap is that bandwidth is inversely proportional in the formula, so increasing bandwidth actually decreases the metric, while increasing delay directly increases it.

How to eliminate wrong answers

Option A is wrong because increasing bandwidth on GigabitEthernet0/0 would decrease the bandwidth component (since bandwidth is inversely proportional in the formula), thus decreasing the metric, not increasing it. Option B is wrong because adding a redistribute static command under EIGRP does not affect the metric of an already learned EIGRP route; it only influences redistribution of static routes into EIGRP, which is unrelated to the existing route's metric. Option C is wrong because changing the administrative distance to 90 (which is the default for EIGRP internal routes) does not alter the metric; administrative distance is a trustworthiness value used for route selection between different protocols, not a component of the EIGRP metric calculation.

Practice this question →

MCQeasy

A network administrator is troubleshooting a performance issue in a large enterprise campus network. The network consists of Cisco Catalyst 9300 switches acting as access switches and Cisco Catalyst 9500 switches as distribution. Users on VLAN 10 report intermittent slow file transfers to a server on VLAN 20. The administrator has verified that there are no errors on the links, CPU utilization is normal, and STP topology is stable. The administrator suspects a possible QoS issue. Upon checking the QoS configuration on the access switch, the administrator finds that the default QoS configuration is in place, which trusts the CoS value at the port level. The connected devices are IP phones and PCs; the IP phones mark voice traffic with CoS 5. The server on VLAN 20 is connected to a distribution switch. Which action should the administrator take to most likely resolve the issue?

A.Apply a policy map that polices voice traffic to 128 kbps to free bandwidth for data.

B.Disable QoS entirely on all switches to eliminate any potential QoS-related drops.

C.Configure auto QoS for VoIP on the access ports to ensure proper classification and queuing.

D.Configure trust DSCP on the access ports to prioritize all traffic based on DSCP values.

AnswerC

Correct.

Why this answer

Auto QoS for VoIP automatically configures the necessary class maps, policy maps, and trust settings to properly classify and queue voice traffic (CoS 5) while ensuring data traffic is not starved. The default QoS configuration trusts CoS at the port level, but without proper queuing and scheduling, voice and data may compete for buffers, causing intermittent slow file transfers. Auto QoS sets up strict priority queuing for voice and allocates bandwidth for data, resolving the performance issue without manual misconfiguration.

Exam trap

Cisco often tests the misconception that simply trusting CoS or DSCP values is sufficient to prioritize traffic, when in fact trust alone does not configure the egress queuing and scheduling policies needed to prevent congestion and ensure bandwidth allocation.

How to eliminate wrong answers

Option A is wrong because policing voice traffic to 128 kbps would drop voice packets that exceed this rate, degrading voice quality, and does not address the root cause of data traffic being starved due to improper queuing. Option B is wrong because disabling QoS entirely removes all prioritization, which can cause both voice and data to be treated equally, potentially worsening the performance issue for file transfers during congestion. Option D is wrong because configuring trust DSCP on access ports would trust DSCP markings from PCs and IP phones, but the default QoS configuration already trusts CoS; changing to DSCP trust may not align with the existing CoS markings from IP phones and could lead to misclassification, while still lacking proper queuing policies.

Practice this question →