CCNA Infrastructure Questions

1

MCQeasy

An engineer needs to configure a switchport to carry traffic for multiple VLANs to a router using a single physical link. Which configuration should be applied on the switchport?

A.Configure the port as a dynamic desirable port.

B.Configure the port as a trunk port.

C.Configure the port as a routed port.

D.Configure the port as an access port.

AnswerB

Trunk ports carry multiple VLANs.

Why this answer

A trunk port is specifically designed to carry traffic for multiple VLANs over a single physical link using IEEE 802.1Q encapsulation. This allows the switch to tag frames with VLAN IDs, enabling the router (often configured as a router-on-a-stick) to route between VLANs.

Exam trap

The trap here is that candidates often confuse Dynamic Desirable (a DTP negotiation mode) with a trunk port configuration, thinking negotiation automatically results in trunking, but the question asks for the configuration that directly enables multi-VLAN traffic, not a negotiation protocol.

How to eliminate wrong answers

Option A is wrong because Dynamic Desirable is a Dynamic Trunking Protocol (DTP) mode that negotiates trunking with the remote device, but it does not directly configure the port to carry multiple VLANs; it is a negotiation state, not the final configuration. Option C is wrong because a routed port is a Layer 3 interface that operates like a router port, stripping all Layer 2 switching and VLAN tagging, so it cannot carry multiple VLANs on a single link. Option D is wrong because an access port belongs to only one VLAN and strips any VLAN tags from frames, making it unsuitable for carrying multiple VLANs.

Practice this question →

2

MCQeasy

A network administrator needs to allow SSH access to a router from the management network 192.168.1.0/24. Which configuration should be applied?

A.Apply an extended ACL to the vty lines.

B.Apply a named ACL to the interface.

C.Apply an ACL to the console line.

D.Apply a standard ACL to the vty lines.

AnswerD

Standard ACL can filter by source IP.

Why this answer

A standard ACL applied to the vty lines is the proper method to restrict SSH access to a router from a specific source network. Standard ACLs filter based on source IP address, and when applied to the vty lines with the 'access-class' command, they control which management hosts can initiate inbound SSH sessions to the router.

Exam trap

Cisco often tests the distinction between filtering traffic destined to the router (vty access-class) versus traffic passing through the router (interface ACL), leading candidates to incorrectly apply an ACL to an interface instead of the vty lines.

How to eliminate wrong answers

Option A is wrong because an extended ACL can filter on source and destination IP addresses and ports, but applying it to the vty lines is not supported; vty lines only accept standard ACLs via the 'access-class' command. Option B is wrong because applying a named ACL to an interface filters traffic passing through the router, not traffic destined to the router itself (such as SSH management access). Option C is wrong because the console line is used for local out-of-band management and does not support SSH access; ACLs applied to the console line would not affect remote SSH sessions.

Practice this question →

3

MCQhard

Based on the exhibit, which traffic will be permitted outbound on GigabitEthernet0/0?

A.HTTP and HTTPS traffic from 192.168.1.0/24

B.ICMP traffic from any source

C.FTP traffic from 192.168.1.0/24

D.SSH traffic from 192.168.1.0/24

AnswerA

The ACL permits www and https.

Why this answer

The exhibit shows an access control list (ACL) applied outbound on GigabitEthernet0/0. The ACL permits TCP traffic from source 192.168.1.0/24 to any destination with a destination port of 80 (HTTP) or 443 (HTTPS). Therefore, only HTTP and HTTPS traffic from the 192.168.1.0/24 network is permitted outbound.

Exam trap

Cisco often tests the implicit deny any at the end of an ACL, leading candidates to assume that traffic not explicitly denied is permitted, when in fact only explicitly permitted traffic is allowed.

How to eliminate wrong answers

Option B is wrong because ICMP traffic is not TCP and does not match the permit statement for TCP ports 80 and 443; ICMP would be implicitly denied by the ACL's implicit deny any at the end. Option C is wrong because FTP traffic uses TCP ports 20 and 21, which are not permitted by the ACL's permit statement for ports 80 and 443. Option D is wrong because SSH traffic uses TCP port 22, which is not permitted by the ACL's permit statement for ports 80 and 443.

Practice this question →

4

Drag & Dropmedium

Drag and drop the steps to configure VLAN Trunking Protocol (VTP) on a Cisco switch in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

VTP requires setting mode and domain before trunking works; verification confirms operation.

Practice this question →

5

Multi-Selecteasy

Which TWO methods can be used to prevent unauthorized access to the privileged EXEC mode on a Cisco router? (Choose two.)

Select 2 answers

A.Enable AAA authentication.

B.Configure the enable secret password.

C.Use the service password-encryption command.

D.Configure the enable password.

E.Configure login local on the console line.

AnswersB, D

Provides encrypted access.

Why this answer

The privileged EXEC mode (enable mode) is protected by either the `enable password` or `enable secret` command. The `enable secret` command uses a stronger MD5-based hash (or SHA-256 in newer IOS versions) to store the password, making it the recommended method. Both commands restrict access to privileged EXEC mode by requiring a password before executing `enable`.

Exam trap

Cisco often tests the distinction between commands that protect privileged EXEC mode (enable password/secret) versus commands that protect user EXEC mode (login local) or merely obscure passwords (service password-encryption), leading candidates to select options that do not actually control access to the enable prompt.

Practice this question →

6

Matchingmedium

Match each Cisco IOS command to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Displays the routing table

Displays interface status and statistics

Displays VLAN information

Displays the current configuration

Enables OSPF event debugging

Why these pairings

The correct matches are: show ip route displays the routing table, show ip interface brief summarizes interface status, ping tests connectivity, and traceroute traces the path. Common confusions arise from swapping the functions of show ip route and ping.

Practice this question →

7

Matchingmedium

Match each EIGRP term to its definition.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Best metric to a destination

Metric advertised by neighbor

Backup route without loops

Primary route with lowest metric

Ensures loop-free backup routes

Why these pairings

EIGRP uses Feasible Distance (FD) as the best metric to a destination, Reported Distance (RD) as a neighbor's metric, and the Feasible Condition (RD < FD) to ensure loop-free paths. Successor is the next-hop router with the lowest FD.

Practice this question →