Cisco CCNA 200-301 · Current exam topics · Updated 2026
Free Cisco CCNA Practice Exam (2026)
Full-length CCNA mock exams with a realistic number of questions and the real exam time. Subnetting, switching, OSPF, security and automation questions across all 6 domains, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
100 questions · 2 hours · same as the real exam
You have an unfinished attempt on this set.
Your score by topic
Questions 1–10Page 1 of 10
🏆
Question 1Network Fundamentals
A network engineer at Harlow Logistics is sizing the IPv4 subnet for a new warehouse VLAN. It must hold 460 wireless scanners and 30 printers on one subnet, and the engineer wants to waste as few addresses as possible. Which prefix length should be used?
Correct answer: C. /23
The VLAN needs 490 host addresses. A /23 leaves 9 host bits, which gives 2^9 - 2 = 510 usable addresses, the smallest block that fits. A /24 gives only 254 usable addresses, and a /22 (1022 usable) would waste more than half the block.
The VLAN needs 490 host addresses. A /23 leaves 9 host bits, which gives 2^9 - 2 = 510 usable addresses, the smallest block that fits. A /24 gives only 254 usable addresses, and a /22 (1022 usable) would waste more than half the block.
Question 2Network Access
At Brightline Dental, an engineer is connecting Cisco IP phones to access ports on a Catalyst switch. Each phone has a PC plugged into its built-in switch port. The PCs must use VLAN 40 and the phones must use VLAN 140. Which interface configuration meets this requirement?
Correct answer: B. switchport mode access, switchport access vlan 40, switchport voice vlan 140
The access VLAN carries the untagged PC traffic, and the voice VLAN tells the phone, through CDP, to tag its own traffic with VLAN 140. Swapping the two values would put the PCs in the voice VLAN. A trunk allowed list has no effect on a port in access mode.
The access VLAN carries the untagged PC traffic, and the voice VLAN tells the phone, through CDP, to tag its own traffic with VLAN 140. Swapping the two values would put the PCs in the voice VLAN. A trunk allowed list has no effect on a port in access mode.
Question 3Security Fundamentals
A security analyst at Brightline Freight finds that a public-facing web server runs a software version with a published flaw that allows remote code execution. No attacker has used it yet. In security terms, what is the unpatched software flaw?
Correct answer: D. A vulnerability
A vulnerability is a weakness in a system that could be used to compromise it, such as an unpatched software flaw. An exploit is the tool or method that takes advantage of that weakness, and none has been used here yet.
A vulnerability is a weakness in a system that could be used to compromise it, such as an unpatched software flaw. An exploit is the tool or method that takes advantage of that weakness, and none has been used here yet.
Question 4IP Connectivity
A network engineer at Harbor Freightlines connects two branch routers over a GigabitEthernet link in area 0, but neither router lists the other in show ip ospf neighbor. On R1, show ip ospf interface reports Hello 10, Dead 40, while R2 reports Hello 5, Dead 20. Both interfaces are in 10.4.4.0/30 and no authentication is used. What is the cause?
Correct answer: A. The hello and dead intervals differ, so each router ignores the other's hellos
OSPF routers compare the hello and dead intervals carried in each hello, and both values must match before a neighbor relationship can form. Matching only the dead interval is not enough, because a hello interval mismatch also causes the hello to be ignored.
OSPF routers compare the hello and dead intervals carried in each hello, and both values must match before a neighbor relationship can form. Matching only the dead interval is not enough, because a hello interval mismatch also causes the hello to be ignored.
Question 5IP Connectivity
A network engineer at Harborline Logistics runs show ip route on a branch router and sees O 10.20.0.0/16 [110/30] via 172.16.1.2, 00:05:12, GigabitEthernet0/1. What does the value 30 represent in this entry?
Correct answer: B. The total OSPF cost to reach 10.20.0.0/16 through 172.16.1.2
In a routing table entry, the brackets show [administrative distance/metric], so 110 is the AD and 30 is the OSPF cost. OSPF uses cost, not hop count, as its metric, and the age of the route appears separately as 00:05:12.
In a routing table entry, the brackets show [administrative distance/metric], so 110 is the AD and 30 is the OSPF cost. OSPF uses cost, not hop count, as its metric, and the age of the route appears separately as 00:05:12.
Question 6IP Services
A network engineer at Harbor Logistics configures PAT on the edge router. Inside host 10.20.1.15 opens a session to a web server at 198.51.100.80, and the router rewrites the source to its outside interface address 203.0.113.5. In NAT terminology, what is 203.0.113.5?
Correct answer: A. Inside global address
The inside global address is the public address that represents an inside host to the outside world, which is the role 203.0.113.5 plays here. The inside local address is the private address 10.20.1.15 that is actually assigned to the host, not the translated one.
The inside global address is the public address that represents an inside host to the outside world, which is the role 203.0.113.5 plays here. The inside local address is the private address 10.20.1.15 that is actually assigned to the host, not the translated one.
Question 7Automation & Programmability
The network team at Bluefin Logistics used to log in to each of its 400 switches to make changes by hand. They now keep standard configuration templates in a Git repository and push changes with an automation tool. What is the MOST important operational benefit of this new approach?
Correct answer: D. Each change is versioned, reviewed and applied consistently
Treating configuration as code gives the team version history, peer review and the same deployment on every device, which also makes rollback easy. Automation does not make errors impossible, because a bad template can push the same mistake to every switch at once.
Treating configuration as code gives the team version history, peer review and the same deployment on every device, which also makes rollback easy. Automation does not make errors impossible, because a bad template can push the same mistake to every switch at once.
Question 8Network Access
Router R1 at Kestrel Logistics routes for VLANs 10 and 20 using router-on-a-stick on G0/0. Hosts in VLAN 10 reach their gateway, but hosts in VLAN 20 cannot. The config for G0/0.20 shows encapsulation dot1Q 30 and ip address 10.20.0.1 255.255.255.0. What is the best fix?
Correct answer: A. Change the subinterface to use encapsulation dot1Q 20
The VLAN tag a subinterface uses comes from the encapsulation dot1Q command, not from the subinterface number. With dot1Q 30, R1 ignores frames tagged for VLAN 20, so changing the VLAN ID to 20 fixes the problem. Allowing VLAN 30 on the trunk does not help because the hosts are in VLAN 20.
The VLAN tag a subinterface uses comes from the encapsulation dot1Q command, not from the subinterface number. With dot1Q 30, R1 ignores frames tagged for VLAN 20, so changing the VLAN ID to 20 fixes the problem. Allowing VLAN 30 on the trunk does not help because the hosts are in VLAN 20.
Question 9Network Fundamentals
A technician at Corbin Dental is reviewing a packet capture and sees host 172.16.45.130 with a /27 mask. To confirm a directed broadcast filter is correct, the technician needs the broadcast address of that host's subnet. What is it?
Correct answer: C. 172.16.45.159
A /27 mask (255.255.255.224) creates blocks of 32 in the fourth octet: .96, .128, .160 and so on. Host .130 falls in the 172.16.45.128 subnet, so the broadcast is the last address before .160, which is 172.16.45.159. The value .191 is the broadcast for a /26, not a /27.
A /27 mask (255.255.255.224) creates blocks of 32 in the fourth octet: .96, .128, .160 and so on. Host .130 falls in the 172.16.45.128 subnet, so the broadcast is the last address before .160, which is 172.16.45.159. The value .191 is the broadcast for a /26, not a /27.
Question 10Security Fundamentals
At Ridgeway Clinics, auditors watched an unauthorized visitor walk into the data center by following an employee through a badge-controlled door. Which physical access control BEST prevents this tailgating?
Correct answer: A. An access control vestibule (mantrap)
An access control vestibule, often called a mantrap, uses two doors so only one authenticated person passes at a time, which stops tailgating. Cameras help investigate after the fact but do not physically stop someone from following an employee in.
An access control vestibule, often called a mantrap, uses two doors so only one authenticated person passes at a time, which stops tailgating. Cameras help investigate after the fact but do not physically stop someone from following an employee in.
Question 11IP Connectivity
At Pinecrest Medical, R1 and R2 share an Ethernet segment in area 0. On R1, show ip ospf neighbor lists R2 in the EXSTART state, and it never moves to FULL even after several minutes. The hello timers, area ID and subnet match on both routers. What is the MOST likely cause?
Correct answer: D. The interface MTU values differ, so the DBD packets are rejected
In ExStart and Exchange, routers trade DBD packets that carry the interface MTU, and a router rejects DBDs that advertise a larger MTU than its own, so the adjacency stalls. An authentication or timer mismatch stops the hellos themselves, so the routers would never reach ExStart at all.
In ExStart and Exchange, routers trade DBD packets that carry the interface MTU, and a router rejects DBDs that advertise a larger MTU than its own, so the adjacency stalls. An authentication or timer mismatch stops the hellos themselves, so the routers would never reach ExStart at all.
Question 12IP Connectivity
A router at Pinecrest Foods has these routes: S 10.10.0.0/16 [1/0] via 192.168.1.1, O 10.10.32.0/20 [110/40] via 192.168.2.1, D 10.10.40.0/22 [90/3328] via 192.168.3.1, and R 10.10.42.0/24 [120/2] via 192.168.4.1. A packet arrives for 10.10.41.5. Which next hop will the router use?
Correct answer: B. 192.168.3.1
The router picks the longest matching prefix first. 10.10.40.0/22 covers 10.10.40.0 through 10.10.43.255, so it matches and is more specific than the /20 and the /16. The /24 covers only 10.10.42.0 through 10.10.42.255, and the static route's lower AD does not matter because prefix length is checked before AD.
The router picks the longest matching prefix first. 10.10.40.0/22 covers 10.10.40.0 through 10.10.43.255, so it matches and is more specific than the /20 and the /16. The /24 covers only 10.10.42.0 through 10.10.42.255, and the static route's lower AD does not matter because prefix length is checked before AD.
Question 13Network Fundamentals
An engineer at Pinecrest Clinic must split 192.168.50.0/24 with VLSM into one subnet for 100 hosts, one for 50 hosts and one for 20 hosts. The engineer allocates from the start of the block, largest subnet first, with no gaps. Which subnet is assigned to the 20-host LAN?
Correct answer: C. 192.168.50.192/27
The 100-host LAN needs a /25 (126 hosts), so it takes .0 to .127. The 50-host LAN needs a /26 (62 hosts) and takes .128 to .191. The next free block starts at .192, and a /27 gives 30 usable hosts, so the answer is 192.168.50.192/27. Choosing .160/27 would overlap the /26 that runs to .191.
The 100-host LAN needs a /25 (126 hosts), so it takes .0 to .127. The 50-host LAN needs a /26 (62 hosts) and takes .128 to .191. The next free block starts at .192, and a /27 gives 30 usable hosts, so the answer is 192.168.50.192/27. Choosing .160/27 would overlap the /26 that runs to .191.
Question 14Network Access
Two switches at Harbor Point Clinic are connected by an 802.1Q trunk. SW1 repeatedly logs %CDP-4-NATIVE_VLAN_MISMATCH for that link, and users report traffic showing up in the wrong VLAN. What is the cause?
Correct answer: B. The native VLAN differs between the two trunk ports
CDP advertises the native VLAN of each port, and the switch logs this message when the two ends disagree. Untagged frames sent in one native VLAN are then placed into a different VLAN on the other side. Mismatched allowed VLAN lists do not produce this CDP message.
CDP advertises the native VLAN of each port, and the switch logs this message when the two ends disagree. Untagged frames sent in one native VLAN are then placed into a different VLAN on the other side. Mismatched allowed VLAN lists do not produce this CDP message.
Question 15IP Services
Ridgeway Dental wants about 40 users to share the single public address 203.0.113.9. The router has ip nat pool PUB 203.0.113.9 203.0.113.9 netmask 255.255.255.0 and ip nat inside source list 1 pool PUB, and access list 1 matches the user subnet. One user browses fine, but the others fail until that user's translation times out. What change fixes the problem?
Correct answer: D. Append the overload keyword to the ip nat inside source command
Without the overload keyword, dynamic NAT maps one inside host to each pool address, so a one-address pool serves only one user at a time. Adding overload enables PAT, which uses unique port numbers so many hosts can share the address. Changing the netmask does not change the one-to-one behavior.
Without the overload keyword, dynamic NAT maps one inside host to each pool address, so a one-address pool serves only one user at a time. Adding overload enables PAT, which uses unique port numbers so many hosts can share the address. Changing the netmask does not change the one-to-one behavior.
Question 16Automation & Programmability
Which statement BEST describes a key difference between traditional networking and controller-based networking?
Correct answer: B. A controller holds a network-wide view and policy, while traditional devices are managed one by one
In traditional networking each device runs its own control plane and is configured individually through its CLI. A controller-based design centralizes the network view, policy and configuration, and it still relies on standard protocols such as Ethernet and IP to move traffic.
In traditional networking each device runs its own control plane and is configured individually through its CLI. A controller-based design centralizes the network view, policy and configuration, and it still relies on standard protocols such as Ethernet and IP to move traffic.
Question 17Security Fundamentals
A router at Kestrel Logistics has both enable password Cisco1 and enable secret Cisco2 in its configuration. A technician types Cisco1 at the enable prompt and is rejected. Why?
Correct answer: C. The enable secret overrides the enable password when both exist
When both commands exist, IOS ignores the enable password and only accepts the enable secret, which is stored as a hash. The service password-encryption command only obscures stored passwords and does not change which one IOS checks.
When both commands exist, IOS ignores the enable password and only accepts the enable secret, which is stored as a hash. The service password-encryption command only obscures stored passwords and does not change which one IOS checks.
Question 18Network Fundamentals
An engineer at Velo Outfitters is auditing an addressing plan that must use only RFC 1918 private space. Which subnet in the plan breaks that rule?
Correct answer: A. 172.32.10.0/24
The RFC 1918 block 172.16.0.0/12 covers only 172.16.0.0 through 172.31.255.255, so 172.32.10.0/24 is public space. The 172.31.250.0/24 subnet looks close to the edge but is still inside the /12. The 10.0.0.0/8 and 192.168.0.0/16 blocks are also private.
The RFC 1918 block 172.16.0.0/12 covers only 172.16.0.0 through 172.31.255.255, so 172.32.10.0/24 is public space. The 172.31.250.0/24 subnet looks close to the edge but is still inside the /12. The 10.0.0.0/8 and 192.168.0.0/16 blocks are also private.
Question 19Network Access
At Corvid Media, trunk G1/0/24 has switchport trunk allowed vlan 10,20 configured. An engineer must carry the new VLAN 30 across this trunk without disrupting VLANs 10 and 20. Which interface command should be used?
Correct answer: D. switchport trunk allowed vlan add 30
The add keyword appends VLAN 30 to the existing allowed list. Entering the list without add replaces it, so the trunk would carry only VLAN 30 and traffic for VLANs 10 and 20 would stop.
The add keyword appends VLAN 30 to the existing allowed list. Entering the list without add replaces it, so the trunk would carry only VLAN 30 and traffic for VLANs 10 and 20 would stop.
Question 20IP Connectivity
Four routers on the same VLAN at Lumen Logistics start OSPF at the same moment. R1 has priority 1 and router ID 10.0.0.9, R2 has priority 10 and router ID 10.0.0.2, R3 has priority 10 and router ID 10.0.0.5, and R4 has priority 0 and router ID 10.0.0.99. Which routers become the DR and the BDR?
Correct answer: A. R3 becomes the DR and R2 becomes the BDR
The highest priority wins, and the highest router ID breaks a priority tie, so R3 with 10.0.0.5 beats R2 with 10.0.0.2 for DR and R2 becomes the BDR. R4 has the highest router ID, but priority 0 makes it ineligible for either role.
The highest priority wins, and the highest router ID breaks a priority tie, so R3 with 10.0.0.5 beats R2 with 10.0.0.2 for DR and R2 becomes the BDR. R4 has the highest router ID, but priority 0 makes it ineligible for either role.
Question 21IP Connectivity
A router at Westbrook Credit Union receives 172.31.8.0/24 from an OSPF neighbor with a cost of 65. It also receives the same prefix from an EIGRP neighbor as an external route with a metric of 2816. Both protocols use default settings. Which route is installed in the routing table?
Correct answer: C. The OSPF route, because its AD of 110 beats the EIGRP external AD of 170
When the prefix length is identical, the router compares administrative distance before metric. External EIGRP routes have an AD of 170, so OSPF at 110 wins. The value 90 applies only to internal EIGRP routes, and metrics from different protocols are never compared.
When the prefix length is identical, the router compares administrative distance before metric. External EIGRP routes have an AD of 170, so OSPF at 110 wins. The value 90 applies only to internal EIGRP routes, and metrics from different protocols are never compared.
Question 22Network Fundamentals
An engineer at Ridgeway Bank enters ipv6 enable on a router interface but does not configure a global address. The interface still shows one IPv6 address. Which address block does that address come from?
Correct answer: D. FE80::/10
The ipv6 enable command turns on IPv6 and builds only a link-local address, which always comes from FE80::/10. Link-local addresses are used for neighbor discovery and routing protocol next hops on that segment. FC00::/7 is unique local space, which must be configured and is not created automatically.
The ipv6 enable command turns on IPv6 and builds only a link-local address, which always comes from FE80::/10. Link-local addresses are used for neighbor discovery and routing protocol next hops on that segment. FC00::/7 is unique local space, which must be configured and is not created automatically.
Question 23Network Access
An engineer at Ridgeway School connects two new Catalyst switches and leaves the connecting ports at their default mode, which on these models is dynamic auto. Users in VLAN 50 on one switch cannot reach VLAN 50 users on the other switch. What is the reason?
Correct answer: D. Neither port initiates trunking, so the link stays in access mode
A dynamic auto port becomes a trunk only when the neighbor actively asks, as a dynamic desirable or trunk port does. With auto on both ends, neither side initiates and the link operates as an access link in VLAN 1. VLANs are not pruned by default, so pruning is not the cause.
A dynamic auto port becomes a trunk only when the neighbor actively asks, as a dynamic desirable or trunk port does. With auto on both ends, neither side initiates and the link operates as an access link in VLAN 1. VLANs are not pruned by default, so pruning is not the cause.
Question 24Security Fundamentals
A security policy at Northgate Bank requires that idle SSH sessions to switches close after 5 minutes. Which configuration meets this requirement?
Correct answer: B. exec-timeout 5 0 under line vty 0 15
The exec-timeout command takes minutes first and then seconds, so exec-timeout 5 0 on the vty lines disconnects an idle session after 5 minutes. The value 0 5 would close sessions after only 5 seconds, and ip ssh time-out only limits how long SSH negotiation can take.
The exec-timeout command takes minutes first and then seconds, so exec-timeout 5 0 on the vty lines disconnects an idle session after 5 minutes. The value 0 5 would close sessions after only 5 seconds, and ip ssh time-out only limits how long SSH negotiation can take.
Question 25IP Services
A router at Coastal Credit Union is configured with ntp server 192.0.2.10. The show ntp associations output shows that this server is stratum 2 and that the router is synchronized to it. What stratum will the router report to devices that use it as their NTP server?
Correct answer: C. Stratum 3
An NTP client sets its own stratum one level higher than the server it synchronizes to, so a router learning time from a stratum 2 server becomes stratum 3. It does not copy the server's stratum 2, because each hop away from the reference clock adds one level.
An NTP client sets its own stratum one level higher than the server it synchronizes to, so a router learning time from a stratum 2 server becomes stratum 3. It does not copy the server's stratum 2, because each hop away from the reference clock adds one level.
Question 26Automation & Programmability
A developer at Tallgrass Foods writes a Python script that sends HTTPS requests to the Catalyst Center REST API. The script pulls a list of all managed devices into an inventory spreadsheet. Which interface is the script using?
Correct answer: D. The northbound API of the controller
Northbound APIs face applications and scripts, letting them request data or submit intent to the controller, and Catalyst Center exposes them as REST over HTTPS. The southbound side is how the controller talks down to network devices, using protocols such as NETCONF, SSH or SNMP.
Northbound APIs face applications and scripts, letting them request data or submit intent to the controller, and Catalyst Center exposes them as REST over HTTPS. The southbound side is how the controller talks down to network devices, using protocols such as NETCONF, SSH or SNMP.
Question 27IP Connectivity
At Copperline Bank, R1 is the DR and R2 is the BDR on a shared Ethernet segment, and both use the default priority. An engineer adds R5 to the segment with ip ospf priority 200 configured before its interface comes up. What happens after R5 forms its adjacencies?
Correct answer: C. R1 remains the DR, R2 remains the BDR, and R5 becomes a DROTHER
The OSPF DR and BDR election is not preemptive, so a higher priority router that joins later does not replace the existing DR or BDR. R5 stays a DROTHER until the DR or BDR fails or the OSPF process is reset.
The OSPF DR and BDR election is not preemptive, so a higher priority router that joins later does not replace the existing DR or BDR. R5 stays a DROTHER until the DR or BDR fails or the OSPF process is reset.
Question 28Network Fundamentals
A router interface at Oakmont Freight has MAC address 001a.2b3c.4d5e. The engineer configures ipv6 address 2001:db8:ac:10::/64 eui-64 on it. Which global unicast address will the interface use?
Correct answer: B. 2001:DB8:AC:10:21A:2BFF:FE3C:4D5E
Modified EUI-64 splits the MAC in half and inserts FFFE in the middle, giving 001A:2BFF:FE3C:4D5E. It then flips the seventh bit of the first byte, so 00 becomes 02 and the interface ID is 021A:2BFF:FE3C:4D5E. Forgetting the bit flip leaves 1A in that hextet, which is the most common mistake.
Modified EUI-64 splits the MAC in half and inserts FFFE in the middle, giving 001A:2BFF:FE3C:4D5E. It then flips the seventh bit of the first byte, so 00 becomes 02 and the interface ID is 021A:2BFF:FE3C:4D5E. Forgetting the bit flip leaves 1A in that hextet, which is the most common mistake.
Question 29Network Access
Security policy at Vantage Credit Union says the edge router must not send CDP advertisements out its internet-facing interface G0/1. CDP must keep running on all internal links for troubleshooting. What should the engineer configure?
Correct answer: C. no cdp enable under interface G0/1
The interface command no cdp enable stops CDP on that one port and leaves it running everywhere else. The global command no cdp run would disable CDP on every interface, which breaks the internal troubleshooting requirement.
The interface command no cdp enable stops CDP on that one port and leaves it running everywhere else. The global command no cdp run would disable CDP on every interface, which breaks the internal troubleshooting requirement.
Question 30IP Connectivity
The edge router at Northgate Clinic learns a default route through OSPF from its primary provider router. The engineer must add a backup default route through 203.0.113.9 that is used only if the OSPF default route disappears. Which command meets this requirement?
Correct answer: A. ip route 0.0.0.0 0.0.0.0 203.0.113.9 115
A floating static route needs an administrative distance higher than the primary route, and 115 is higher than the OSPF AD of 110. An AD of 100 would beat OSPF and make the backup path active all the time. Leaving the distance off gives the default AD of 1, which causes the same problem.
A floating static route needs an administrative distance higher than the primary route, and 115 is higher than the OSPF AD of 110. An AD of 100 would beat OSPF and make the backup path active all the time. Leaving the distance off gives the default AD of 1, which causes the same problem.
Question 31Security Fundamentals
Sutter Retail wants remote VPN logins to require multifactor authentication. Which login method meets that requirement?
Correct answer: B. A password and a one-time code from an app
Multifactor authentication combines factors from different categories, such as something you know (a password) and something you have (a phone that generates codes). A security question or a second password is still something you know, so it is only single factor.
Multifactor authentication combines factors from different categories, such as something you know (a password) and something you have (a phone that generates codes). A security question or a second password is still something you know, so it is only single factor.
Question 32Network Fundamentals
During neighbor discovery troubleshooting, an engineer needs to know which multicast group a host with address 2001:db8:5::a:1b2c:3d4e joins so other nodes can resolve its MAC address. Which group is it?
Correct answer: A. FF02::1:FF2C:3D4E
A solicited-node multicast address is FF02::1:FF00:0/104 plus the last 24 bits of the unicast address. The last 24 bits of 1b2c:3d4e are 2C:3D4E, so the group is FF02::1:FF2C:3D4E. Taking the 24 bits that start at 1B is wrong because the bits always come from the end of the address.
A solicited-node multicast address is FF02::1:FF00:0/104 plus the last 24 bits of the unicast address. The last 24 bits of 1b2c:3d4e are 2C:3D4E, so the group is FF02::1:FF2C:3D4E. Taking the 24 bits that start at 1B is wrong because the bits always come from the end of the address.
Question 33Network Access
Orchard Foods replaces an access switch with a third-party model that supports only LLDP. On the Cisco distribution switch, show lldp neighbors returns % LLDP is not enabled. Which configuration fixes this?
Correct answer: C. lldp run in global configuration mode
LLDP is disabled by default on most Cisco IOS switches and is turned on globally with lldp run. CDP is Cisco proprietary, so enabling it does not help with a device that speaks only LLDP.
LLDP is disabled by default on most Cisco IOS switches and is turned on globally with lldp run. CDP is Cisco proprietary, so enabling it does not help with a device that speaks only LLDP.
Question 34IP Connectivity
An engineer at Tidewater Foods starts OSPF on a router that has no router-id command. The router has Loopback0 at 172.16.1.1, Loopback1 at 192.168.50.1, G0/0 at 203.0.113.9 and G0/1 at 10.255.255.254, and all interfaces are up. Which router ID does OSPF select?
Correct answer: D. 192.168.50.1
Without a router-id command, OSPF uses the highest IPv4 address on an up loopback interface, which is 192.168.50.1. The highest physical interface address, 203.0.113.9 here, is used only when no loopback interface is up.
Without a router-id command, OSPF uses the highest IPv4 address on an up loopback interface, which is 192.168.50.1. The highest physical interface address, 203.0.113.9 here, is used only when no loopback interface is up.
Question 35IP Services
At Pinecrest Clinic, PCs on VLAN 30 cannot get IP addresses. The VLAN 30 SVI on the Layer 3 switch is 10.30.0.1, and the DHCP server is 10.99.0.20 in the data center. The engineer placed ip helper-address 10.99.0.20 on the routed uplink that faces the data center. What should the engineer do?
Correct answer: D. Move the ip helper-address command to the VLAN 30 SVI
The relay must be configured on the interface that receives the client broadcasts, which is the VLAN 30 SVI, so it can forward them as unicast to 10.99.0.20. A helper on the uplink never sees the DHCP Discover broadcasts, because routers do not forward broadcasts between subnets.
The relay must be configured on the interface that receives the client broadcasts, which is the VLAN 30 SVI, so it can forward them as unicast to 10.99.0.20. A helper on the uplink never sees the DHCP Discover broadcasts, because routers do not forward broadcasts between subnets.
Question 36Automation & Programmability
Maplecrest Schools deploys an SD-Access fabric. The physical switches run IS-IS to provide IP reachability between loopbacks, and VXLAN tunnels between fabric edge nodes carry user traffic for each virtual network. What do the VXLAN tunnels represent in this design?
Correct answer: A. The overlay network built on top of the underlay
The overlay is the logical network of tunnels, such as VXLAN, that rides on top of the physical network. The underlay is the routed physical network, here running IS-IS, and its only job is to provide IP reachability between the tunnel endpoints.
The overlay is the logical network of tunnels, such as VXLAN, that rides on top of the physical network. The underlay is the routed physical network, here running IS-IS, and its only job is to provide IP reachability between the tunnel endpoints.
Question 37Security Fundamentals
Harbor Point Foods wants its branch office LAN to reach the headquarters LAN securely over the internet. Branch PCs must not need any VPN software. Which solution fits BEST?
Correct answer: B. A site-to-site IPsec VPN between the edge routers
A site-to-site VPN is built between network devices such as routers or firewalls, so hosts on each LAN send normal traffic and the devices encrypt it. A remote access VPN is meant for individual users and requires client software or a browser session on each device.
A site-to-site VPN is built between network devices such as routers or firewalls, so hosts on each LAN send normal traffic and the devices encrypt it. A remote access VPN is meant for individual users and requires client software or a browser session on each device.
Question 38Network Fundamentals
An engineer must enter the address 2001:0DB8:0000:0000:0000:0A00:0000:0015 in a configuration using the shortest valid notation. Which entry is correct?
Correct answer: D. 2001:DB8::A00:0:15
Leading zeros can be dropped in each hextet, and one run of all-zero hextets can be replaced with a double colon. The longest zero run is the three hextets after DB8, so the result is 2001:DB8::A00:0:15. Writing A instead of A00 removes trailing zeros, which changes the value, and two double colons in one address are never valid.
Leading zeros can be dropped in each hextet, and one run of all-zero hextets can be replaced with a double colon. The longest zero run is the three hextets after DB8, so the result is 2001:DB8::A00:0:15. Writing A instead of A00 removes trailing zeros, which changes the value, and two double colons in one address are never valid.
Question 39Network Access
At Silverline Bank, ports G1/0/1 and G1/0/2 on SW1 are configured with channel-group 5 mode passive. The connected ports on SW2 also use channel-group 5 mode passive. Show etherchannel summary lists the ports as stand-alone. What change will form the bundle?
Correct answer: C. Change one side to channel-group 5 mode active
LACP passive ports answer LACP packets but never start negotiation, so two passive ends never bundle. Setting at least one side to active starts the negotiation. Desirable is a PAgP mode and cannot form a bundle with an LACP passive port.
LACP passive ports answer LACP packets but never start negotiation, so two passive ends never bundle. Setting at least one side to active starts the negotiation. Desirable is a PAgP mode and cannot form a bundle with an LACP passive port.
Question 40IP Connectivity
At Ridgeview Labs, traffic to the monitoring server 10.5.5.10 must go through next hop 172.16.0.2. The rest of the 10.5.5.0/24 subnet must keep following the path learned through OSPF. Which command should the engineer configure?
Correct answer: B. ip route 10.5.5.10 255.255.255.255 172.16.0.2
A host route uses a 255.255.255.255 mask, so it matches only 10.5.5.10 and wins over the OSPF /24 by longest prefix match. The 255.255.255.0 version would send the whole subnet to 172.16.0.2. IOS static routes take a subnet mask, not a wildcard mask such as 0.0.0.0.
A host route uses a 255.255.255.255 mask, so it matches only 10.5.5.10 and wins over the OSPF /24 by longest prefix match. The 255.255.255.0 version would send the whole subnet to 172.16.0.2. IOS static routes take a subnet mask, not a wildcard mask such as 0.0.0.0.
Question 41IP Connectivity
At Redwood Clinics, R1 has G0/0 at 10.20.30.70/27 and G0/1 at 10.20.30.100/27. The engineer must enable OSPF area 0 on G0/0 only, using one network statement that covers the entire G0/0 subnet. Which command meets the requirement?
Correct answer: C. network 10.20.30.64 0.0.0.31 area 0
The address 10.20.30.70/27 belongs to subnet 10.20.30.64, and the wildcard 0.0.0.31 matches .64 through .95, which excludes G0/1 at .100. The 10.20.30.96 statement matches G0/1 instead, and the 0.0.0.127 wildcard matches both interfaces.
The address 10.20.30.70/27 belongs to subnet 10.20.30.64, and the wildcard 0.0.0.31 matches .64 through .95, which excludes G0/1 at .100. The 10.20.30.96 statement matches G0/1 instead, and the 0.0.0.127 wildcard matches both interfaces.
Question 42Network Fundamentals
Users at Maple Accounting report slow transfers across a link between two switches. On one switch, show interfaces reports Half-duplex, 100Mb/s and a rising count of late collisions. The neighboring port is hard-coded to full duplex. What is the most likely cause?
Correct answer: A. A duplex mismatch between the two ends of the link
Late collisions on the half-duplex side are the classic sign of a duplex mismatch, because the full-duplex side transmits whenever it wants. The half-duplex side sees that traffic as a collision after the first 64 bytes. A speed mismatch would normally keep the link from coming up at all instead of causing late collisions.
Late collisions on the half-duplex side are the classic sign of a duplex mismatch, because the full-duplex side transmits whenever it wants. The half-duplex side sees that traffic as a collision after the first 64 bytes. A speed mismatch would normally keep the link from coming up at all instead of causing late collisions.
Question 43Network Access
An engineer at Northgate Hospital bundles four ports into Port-channel 2 with LACP. Show etherchannel summary shows three ports bundled and G1/0/4 flagged as suspended. G1/0/4 turns out to be an access port in VLAN 1, while the other three are trunks. What is happening?
Correct answer: B. Its settings differ from the other members, so it was suspended
Every member of an EtherChannel must share the same switchport mode, allowed VLANs, speed, and duplex. When one member differs, the switch suspends it from the bundle. STP treats the port channel as one logical port, so it does not block single members.
Every member of an EtherChannel must share the same switchport mode, allowed VLANs, speed, and duplex. When one member differs, the switch suspends it from the bundle. STP treats the port channel as one logical port, so it does not block single members.
Question 44Security Fundamentals
An engineer at Lakeside Schools must stop the student subnet 10.20.0.0/16 from reaching the finance subnet 10.50.5.0/24, while students still reach every other network. The engineer will use a standard ACL. Where should it be applied?
Correct answer: A. Outbound on the router interface connected to the finance subnet
A standard ACL matches only the source address, so it should be placed as close to the destination as possible. Applying it inbound near the students would block them from every network, not just finance.
A standard ACL matches only the source address, so it should be placed as close to the destination as possible. Applying it inbound near the students would block them from every network, not just finance.
Question 45IP Services
The monitoring team at Vantage Freight finds that some SNMP alerts from branch routers never reach the NMS when the WAN is congested. They want each router to resend a notification until the manager confirms it was received. Which SNMP option meets this need?
Correct answer: C. Send informs, which the manager must acknowledge
An inform is a notification that the manager must acknowledge, and the agent resends it if no acknowledgment arrives. A trap is sent once with no acknowledgment, so a trap lost to congestion is simply gone. Get and GetBulk are manager polls, not agent notifications.
An inform is a notification that the manager must acknowledge, and the agent resends it if no acknowledgment arrives. A trap is sent once with no acknowledgment, so a trap lost to congestion is simply gone. Get and GetBulk are manager polls, not agent notifications.
Question 46Automation & Programmability
Copperline Credit Union enables an analytics platform that studies 18 months of WAN utilization data. The platform reports that the link at its Elm Street branch will likely exceed 90 percent utilization within four months. Which capability produced this result?
Correct answer: B. Predictive AI using machine learning to forecast trends
Predictive AI applies machine learning to historical data to forecast future conditions, such as when a link will run out of capacity. A static threshold alarm only reacts after utilization actually crosses the limit, so it cannot warn about a problem months ahead.
Predictive AI applies machine learning to historical data to forecast future conditions, such as when a link will run out of capacity. A static threshold alarm only reacts after utilization actually crosses the limit, so it cannot warn about a problem months ahead.
Question 47IP Connectivity
An engineer at Larkspur Media needs an IPv6 default route on a branch router. All IPv6 traffic without a more specific route must go to the provider at 2001:db8:acad:1::1. Which command should the engineer use?
Correct answer: D. ipv6 route ::/0 2001:db8:acad:1::1
The IPv6 default route is written as ::/0, which matches every IPv6 destination, and it is configured with the ipv6 route command. The prefix ::/128 matches only the unspecified address, and the ip route command does not accept IPv6 prefixes.
The IPv6 default route is written as ::/0, which matches every IPv6 destination, and it is configured with the ipv6 route command. The prefix ::/128 matches only the unspecified address, and the ip route command does not accept IPv6 prefixes.
Question 48Network Fundamentals
An engineer at Northgate Freight sees the input error and CRC counters climbing on a switch port connected to a printer. Both sides auto-negotiated 1000 Mb/s full duplex and there are no collisions. The cable runs alongside a large industrial motor. What is the most likely cause?
Correct answer: A. Electrical noise or a damaged cable corrupting frames
CRC errors mean frames arrived with a frame check sequence that does not match their contents, which points to physical layer problems such as EMI, bad terminations or a damaged cable. Both sides report full duplex and there are no collisions, so a duplex mismatch is unlikely. Frames dropped by an ACL are not counted as CRC errors.
CRC errors mean frames arrived with a frame check sequence that does not match their contents, which points to physical layer problems such as EMI, bad terminations or a damaged cable. Both sides report full duplex and there are no collisions, so a duplex mismatch is unlikely. Frames dropped by an ACL are not counted as CRC errors.
Question 49Network Access
At Pinecrest Labs, two multilayer switches need a routed Layer 3 EtherChannel over G1/0/1 and G1/0/2, with the address 10.1.1.1/30 on SW1. Which approach is correct on SW1?
Correct answer: B. Make members routed with no switchport and put the IP on the port channel
A Layer 3 EtherChannel needs routed member ports, created with no switchport, and the IP address goes on the logical Port-channel interface. Leaving the members as switchports while the port channel is routed creates a mismatch, so the members will not bundle.
A Layer 3 EtherChannel needs routed member ports, created with no switchport, and the IP address goes on the logical Port-channel interface. Leaving the members as switchports while the port channel is routed creates a mismatch, so the members will not bundle.
Question 50IP Connectivity
At Summit Credit Union, G0/2 on R1 connects to a user VLAN that has no other routers. The security team wants R1 to stop sending OSPF hellos on that VLAN, but the user subnet must remain reachable from the rest of area 0. Which action meets both goals?
Correct answer: D. Configure passive-interface GigabitEthernet0/2 under router ospf
A passive interface stops sending and processing OSPF hellos, but OSPF still advertises the subnet of that interface to other routers. Priority 0 only removes the router from DR and BDR elections, and the interface keeps sending hellos.
A passive interface stops sending and processing OSPF hellos, but OSPF still advertises the subnet of that interface to other routers. Priority 0 only removes the router from DR and BDR elections, and the interface keeps sending hellos.
Question 51Security Fundamentals
A standard ACL entry must match every host in 172.16.32.0/20 and nothing else. Which entry is correct?
Correct answer: D. permit 172.16.32.0 0.0.15.255
A /20 mask is 255.255.240.0, and subtracting each octet from 255 gives the wildcard 0.0.15.255, which covers 172.16.32.0 through 172.16.47.255. The 0.0.31.255 wildcard would also match 172.16.48.0 through 172.16.63.255, which is outside the /20.
A /20 mask is 255.255.240.0, and subtracting each octet from 255 gives the wildcard 0.0.15.255, which covers 172.16.32.0 through 172.16.47.255. The 0.0.31.255 wildcard would also match 172.16.48.0 through 172.16.63.255, which is outside the /20.
Question 52Network Fundamentals
Kestrel Mining needs to connect two buildings that are 9 km apart with a 10 Gbps link over its own fiber. Which cabling and optics choice is appropriate?
Correct answer: A. Single-mode fiber with 10GBASE-LR optics
Single-mode fiber uses a narrow core and laser light, which supports long runs, and 10GBASE-LR is rated for about 10 km. Multimode fiber with SR optics reaches only a few hundred meters at 10 Gbps, even on OM4. Category 6a copper is limited to 100 meters.
Single-mode fiber uses a narrow core and laser light, which supports long runs, and 10GBASE-LR is rated for about 10 km. Multimode fiber with SR optics reaches only a few hundred meters at 10 Gbps, even on OM4. Category 6a copper is limited to 100 meters.
Question 53Network Access
Three switches at Lakeshore Mall run Rapid PVST+ with default settings, so each shows priority 32778 in VLAN 10. Their MAC addresses are SW1 0019.aa11.1111, SW2 0019.aa11.0f00, and SW3 0019.aa12.0000. Which switch becomes the root bridge for VLAN 10?
Correct answer: C. SW2, because its MAC address is the lowest
The bridge ID is the priority, 32768 plus VLAN ID 10, followed by the MAC address. With equal priorities, the lowest MAC address wins, which is SW2. The highest MAC address would never win the election.
The bridge ID is the priority, 32768 plus VLAN ID 10, followed by the MAC address. With equal priorities, the lowest MAC address wins, which is SW2. The highest MAC address would never win the election.
Question 54IP Connectivity
Router R3 at Summit Freight has connected routes and several OSPF routes inside 10.0.0.0/8, and show ip route reports Gateway of last resort is not set. A host sends a packet through R3 to 198.51.100.25. What will R3 do with the packet?
Correct answer: A. Drop it and send an ICMP unreachable message back to the source
With no matching route and no default route, the router cannot forward the packet, so it drops it and normally returns an ICMP unreachable message to the sender. A router never guesses a path through its lowest-cost OSPF neighbor, because forwarding requires a matching prefix or a gateway of last resort.
With no matching route and no default route, the router cannot forward the packet, so it drops it and normally returns an ICMP unreachable message to the sender. A router never guesses a path through its lowest-cost OSPF neighbor, because forwarding requires a matching prefix or a gateway of last resort.
Question 55IP Services
An engineer at Delmar Foods enters logging host 10.5.5.50 and logging trap warnings on a core switch. Which syslog messages will the switch send to 10.5.5.50?
Correct answer: B. Severity 0 through 4 messages
The logging trap command sends the named level plus every more severe level, and more severe means a lower number. Warnings is level 4, so levels 0 through 4 (emergencies, alerts, critical, errors and warnings) are sent. Severity 4 through 7 reverses the logic and would include notifications, informational and debugging messages.
The logging trap command sends the named level plus every more severe level, and more severe means a lower number. Warnings is level 4, so levels 0 through 4 (emergencies, alerts, critical, errors and warnings) are sent. Severity 4 through 7 reverses the logic and would include notifications, informational and debugging messages.
Question 56Automation & Programmability
An automation script at Driftwood Hotels must change only the description of one interface through a REST API. The team does not want to send the full interface object, because that could overwrite other settings. Which request fits this requirement BEST?
Correct answer: B. PATCH to the interface URI with only the description field
PATCH performs a partial update, so only the fields included in the request body change. PUT replaces the whole resource with what is sent, so a PUT that contains only the description could reset or remove the other interface settings.
PATCH performs a partial update, so only the fields included in the request body change. PUT replaces the whole resource with what is sent, so a PUT that contains only the description could reset or remove the other interface settings.
Question 57Security Fundamentals
Users in 192.168.40.0/24 at Copperline Media must reach the web server 10.1.1.80 over HTTPS only. Which extended ACL entry permits exactly that traffic?
Correct answer: C. access-list 110 permit tcp 192.168.40.0 0.0.0.255 host 10.1.1.80 eq 443
Extended ACL entries list protocol, source, destination, and then the destination port, so TCP from 192.168.40.0 0.0.0.255 to host 10.1.1.80 eq 443 matches HTTPS requests. Placing eq 443 after the source address would match the source port instead, which client requests do not use.
Extended ACL entries list protocol, source, destination, and then the destination port, so TCP from 192.168.40.0 0.0.0.255 to host 10.1.1.80 eq 443 matches HTTPS requests. Placing eq 443 after the source address would match the source port instead, which client requests do not use.
Question 58Network Fundamentals
A voice engineer at Brightfield Insurance is asked why the IP phones send RTP voice streams over UDP rather than TCP. Which reason is correct?
Correct answer: B. Late retransmitted voice packets would be useless
Voice is real time, so a lost packet that is resent arrives after the moment it was needed, and TCP retransmissions only add delay and jitter. UDP has low overhead with no acknowledgments or retransmissions, which suits real-time media. UDP does not guarantee ordering, so RTP uses its own sequence numbers for that.
Voice is real time, so a lost packet that is resent arrives after the moment it was needed, and TCP retransmissions only add delay and jitter. UDP has low overhead with no acknowledgments or retransmissions, which suits real-time media. UDP does not guarantee ordering, so RTP uses its own sequence numbers for that.
Question 59Network Access
In VLAN 1 at Granite Works, non-root switch SW3 can reach the root through G0/1, a direct 100 Mbps link, or through G0/2, a 1 Gbps link to SW2, which has its own 1 Gbps link to the root. All switches use default short path costs. Which port becomes the root port on SW3?
Correct answer: D. G0/2, because its total path cost of 8 beats 19
Root port selection uses the lowest total root path cost. With short costs, 100 Mbps is 19 and 1 Gbps is 4, so the path through SW2 costs 4 plus 4, or 8, which beats 19. STP does not consider hop count.
Root port selection uses the lowest total root path cost. With short costs, 100 Mbps is 19 and 1 Gbps is 4, so the path through SW2 costs 4 plus 4, or 8, which beats 19. STP does not consider hop count.
Question 60IP Connectivity
At Crestview Data, OSPF load-balances traffic across a 1 Gbps path and a 10 Gbps path between the same two sites, because every link on both paths shows a cost of 1. All routers use default OSPF settings. What should the engineer configure so that OSPF prefers the 10 Gbps path?
Correct answer: A. auto-cost reference-bandwidth 10000 on every OSPF router
With the default 100 Mbps reference bandwidth, every link of 100 Mbps or faster gets a cost of 1. Raising the reference to 10000 Mbps on all routers gives a 1 Gbps link a cost of 10 and a 10 Gbps link a cost of 1. The bandwidth command does not help, because the 10 Gbps link already exceeds the default reference.
With the default 100 Mbps reference bandwidth, every link of 100 Mbps or faster gets a cost of 1. Raising the reference to 10000 Mbps on all routers gives a 1 Gbps link a cost of 10 and a 10 Gbps link a cost of 1. The bandwidth command does not help, because the 10 Gbps link already exceeds the default reference.
Question 61IP Connectivity
An engineer at Copperline Energy runs traceroute from R1 to 10.77.1.10. The output shows hop 1 10.0.12.2, hop 2 10.0.23.3, hop 3 10.0.23.2, hop 4 10.0.23.3, and the last two addresses keep alternating until the maximum TTL is reached. What is the most likely cause?
Correct answer: C. A routing loop between the routers at 10.0.23.2 and 10.0.23.3
The probes bounce between the same two routers, which shows that each router points to the other as the next hop for 10.77.1.10. If R3 simply had no route, the trace would stop with unreachable or timeout results instead of returning to R2.
The probes bounce between the same two routers, which shows that each router points to the other as the next hop for 10.77.1.10. If R3 simply had no route, the trace would stop with unreachable or timeout results instead of returning to R2.
Question 62Network Fundamentals
A data center architect at Orion Analytics is building a spine-leaf fabric so that traffic between any two servers on different leaves crosses the same number of hops. How must the switches be connected?
Correct answer: A. Each leaf links to every spine, and leaves never interconnect
In a spine-leaf design, every leaf has an uplink to every spine, so leaf-to-leaf traffic always goes leaf, spine, leaf. That keeps latency predictable and lets the fabric use equal-cost paths. Spines do not connect to each other, and a leaf with a single uplink would lose both redundancy and the consistent hop count.
In a spine-leaf design, every leaf has an uplink to every spine, so leaf-to-leaf traffic always goes leaf, spine, leaf. That keeps latency predictable and lets the fabric use equal-cost paths. Spines do not connect to each other, and a leaf with a single uplink would lose both redundancy and the consistent hop count.
Question 63Network Access
At Copperleaf Hotel, access port G1/0/12 has spanning-tree portfast and spanning-tree bpduguard enable. A staff member plugs a spare Cisco switch into that wall jack. The port stops passing traffic, and show interfaces status lists it as err-disabled. What caused this?
Correct answer: D. BPDU guard shut the port after it received a BPDU
BPDU guard expects no BPDUs on an edge port, so it err-disables the port as soon as the added switch sends one. Root guard reacts differently, by blocking the port in a root-inconsistent state rather than err-disabling it.
BPDU guard expects no BPDUs on an edge port, so it err-disables the port as soon as the added switch sends one. Root guard reacts differently, by blocking the port in a root-inconsistent state rather than err-disabling it.
Question 64Security Fundamentals
Clients in VLAN 30 at Tidewater Hotels keep getting addresses from an unauthorized DHCP server plugged into an access port. The engineer enables DHCP snooping for VLAN 30. Which port should be set as trusted?
Correct answer: A. The uplink toward the legitimate DHCP server
With DHCP snooping, all ports are untrusted by default and DHCP server messages such as OFFER and ACK are dropped on untrusted ports. Only the port that leads to the legitimate server, usually the uplink, should be trusted so its replies reach clients.
With DHCP snooping, all ports are untrusted by default and DHCP server messages such as OFFER and ACK are dropped on untrusted ports. Only the port that leads to the legitimate server, usually the uplink, should be trusted so its replies reach clients.
Question 65IP Services
Mesa Insurance is moving its phones to VoIP over a private WAN. The engineer must set QoS targets so that calls stay clear. Which set of targets matches common Cisco guidance for voice traffic?
Correct answer: C. One-way delay under 150 ms, jitter under 30 ms, loss under 1%
Voice is sensitive to delay, jitter and loss, so common guidance is one-way delay of about 150 ms or less, jitter of 30 ms or less and loss of 1% or less. Values like 400 ms of delay and 5% loss cause noticeable gaps and talk-over during a call.
Voice is sensitive to delay, jitter and loss, so common guidance is one-way delay of about 150 ms or less, jitter of 30 ms or less and loss of 1% or less. Values like 400 ms of delay and 5% loss cause noticeable gaps and talk-over during a call.
Question 66Automation & Programmability
A script at Larkspur Insurance gets a token from the controller at 8:00 AM and reuses it for every API call. At 9:15 AM, every request starts returning HTTP 401 Unauthorized, although the same calls worked earlier. What should the script do FIRST?
Correct answer: D. Request a new authentication token and retry the call
A 401 means the request lacks valid authentication, and a token that worked earlier but now fails has most likely expired. Asking for more privileges fits a 403 Forbidden response, where the server knows who the client is but refuses access to the resource.
A 401 means the request lacks valid authentication, and a token that worked earlier but now fails has most likely expired. Asking for more privileges fits a 403 Forbidden response, where the server knows who the client is but refuses access to the resource.
Question 67IP Connectivity
Edge router R1 at Bayview Logistics has ip route 0.0.0.0 0.0.0.0 198.51.100.1 pointing to its ISP. The internal OSPF routers in area 0 have no route to the internet. Which command on R1 will advertise a default route to its OSPF neighbors?
Correct answer: D. default-information originate under router ospf 1
The default-information originate command makes R1 advertise a default route into OSPF while R1 itself has one, and neighbors see it as an O*E2 route. Redistributing static routes does not inject 0.0.0.0/0 into OSPF, and the all-ones wildcard network statement only enables OSPF on every interface.
The default-information originate command makes R1 advertise a default route into OSPF while R1 itself has one, and neighbors see it as an O*E2 route. Redistributing static routes does not inject 0.0.0.0/0 into OSPF, and the all-ones wildcard network statement only enables OSPF on every interface.
Question 68Network Fundamentals
Sunfield Hotel is replacing 40 standalone access points with lightweight APs. The engineer wants one device to push configuration, manage RF channels and power, and handle client roaming for all of the APs. Which device fills that role?
Correct answer: B. A wireless LAN controller
Lightweight APs build CAPWAP tunnels to a wireless LAN controller, which centrally handles their configuration, RF management and roaming. A RADIUS server can authenticate wireless users, but it does not manage AP channels or power. A Layer 3 switch routes traffic and can supply PoE, but it does not control the APs.
Lightweight APs build CAPWAP tunnels to a wireless LAN controller, which centrally handles their configuration, RF management and roaming. A RADIUS server can authenticate wireless users, but it does not manage AP channels or power. A Layer 3 switch routes traffic and can supply PoE, but it does not control the APs.
Question 69Network Access
At Meridian Port Authority, SW1 is the root bridge for all VLANs. The engineer wants the downstream ports on the access switches to keep exchanging BPDUs with other switches, but no device connected through those ports may ever become root. Which feature meets this goal?
Correct answer: C. Root guard on the downstream designated ports
Root guard lets a port process normal BPDUs, but if a superior BPDU arrives it blocks the port as root-inconsistent, so the root cannot move. BPDU guard would err-disable the port on any BPDU, which breaks the requirement to keep exchanging BPDUs.
Root guard lets a port process normal BPDUs, but if a superior BPDU arrives it blocks the port as root-inconsistent, so the root cannot move. BPDU guard would err-disable the port on any BPDU, which breaks the requirement to keep exchanging BPDUs.
Question 70Security Fundamentals
After enabling dynamic ARP inspection on VLAN 50, an engineer at Granite Labs finds that printers with static IP addresses lose connectivity, while DHCP clients work fine. What is the MOST likely cause?
Correct answer: B. Static hosts have no DHCP snooping binding for DAI to match
Dynamic ARP inspection validates ARP messages on untrusted ports against the DHCP snooping binding table. Hosts with static addresses never create a binding, so their ARP traffic is dropped unless an ARP ACL permits them or their port is trusted.
Dynamic ARP inspection validates ARP messages on untrusted ports against the DHCP snooping binding table. Hosts with static addresses never create a binding, so their ARP traffic is dropped unless an ARP ACL permits them or their port is trusted.
Question 71IP Connectivity
From router R2, an engineer at Bayside Dental pings 172.18.40.9. The output shows U.U.U with a success rate of 0 percent. What does this result indicate?
Correct answer: C. A router in the path is returning ICMP unreachable messages
In IOS ping output, U means an ICMP destination unreachable message came back, often because a router has no route to the target. The dots in between appear because IOS rate-limits unreachable messages. A timeout with no reply at all shows only dots, not U.
In IOS ping output, U means an ICMP destination unreachable message came back, often because a router has no route to the target. The dots in between appear because IOS rate-limits unreachable messages. A timeout with no reply at all shows only dots, not U.
Question 72Network Fundamentals
The security team at Larkspur Media wants to block a file-sharing application that hops ports and hides inside HTTPS, while still allowing normal web browsing on TCP 443. The current stateful firewall cannot tell the two apart. Which next-generation firewall capability solves this?
Correct answer: B. Application visibility and control
A next-generation firewall identifies applications from traffic behavior and content, not just port numbers, so it can block one app on TCP 443 while allowing others. Stateful inspection only tracks sessions and ports, so both applications look like ordinary HTTPS. An extended ACL matching port 443 would block or allow all web traffic together.
A next-generation firewall identifies applications from traffic behavior and content, not just port numbers, so it can block one app on TCP 443 while allowing others. Stateful inspection only tracks sessions and ports, so both applications look like ordinary HTTPS. An extended ACL matching port 443 would block or allow all web traffic together.
Question 73Network Access
Sunrise Pharmacy has 60 small stores, each with two lightweight APs and a WAN link to a WLC at the head office. If the WAN fails, store clients must stay connected and keep reaching the local point-of-sale server. Which AP mode should the engineer use?
Correct answer: C. FlexConnect, so traffic can be switched locally at each store
FlexConnect is built for branches that reach a central WLC over a WAN. It can switch client traffic locally and keep serving clients when the controller is unreachable. Local mode tunnels all data to the WLC, so a WAN outage would drop the clients.
FlexConnect is built for branches that reach a central WLC over a WAN. It can switch client traffic locally and keep serving clients when the controller is unreachable. Local mode tunnels all data to the WLC, so a WAN outage would drop the clients.
Question 74IP Connectivity
Five routers run OSPF on one switched segment at Northgate Insurance. On R4, show ip ospf neighbor lists R5 as 2WAY/DROTHER, while the DR and BDR both show FULL. R4 and R5 are both DROTHERs. What should the engineer conclude?
Correct answer: A. This is expected, since DROTHERs reach FULL only with the DR and BDR
On a broadcast segment, DROTHERs form full adjacencies only with the DR and BDR and remain in 2-Way with each other, which is normal. An MTU mismatch would leave the routers stuck in ExStart or Exchange, and a timer mismatch would prevent them from becoming neighbors at all.
On a broadcast segment, DROTHERs form full adjacencies only with the DR and BDR and remain in 2-Way with each other, which is normal. An MTU mismatch would leave the routers stuck in ExStart or Exchange, and a timer mismatch would prevent them from becoming neighbors at all.
Question 75IP Services
A QoS design at Northgate University marks voice bearer packets at the access layer so that every router in the path places them in the priority queue. Which marking follows the standard recommendation for voice payload?
Correct answer: D. DSCP 46, Expedited Forwarding (EF)
Expedited Forwarding, decimal 46, is the standard DSCP marking for voice payload and is normally mapped to the priority queue. AF41 is typically used for interactive video, CS3 for call signaling and CS6 for routing protocol traffic.
Expedited Forwarding, decimal 46, is the standard DSCP marking for voice payload and is normally mapped to the priority queue. AF41 is typically used for interactive video, CS3 for call signaling and CS6 for routing protocol traffic.
Question 76Automation & Programmability
Granite Peak Energy wants to automate the configuration of its routers and switches. Security policy forbids installing extra software on network devices, and the team wants to describe tasks in human-readable YAML files. Which tool fits these requirements BEST?
Correct answer: A. Ansible
Ansible is agentless. It connects to devices over SSH and pushes tasks defined in YAML playbooks. Puppet and Chef traditionally rely on an agent running on each managed node, which breaks the no-extra-software rule.
Ansible is agentless. It connects to devices over SSH and pushes tasks defined in YAML playbooks. Puppet and Chef traditionally rely on an agent running on each managed node, which breaks the no-extra-software rule.
Question 77Security Fundamentals
An engineer at Pinecrest Health wants a port security violation to drop frames from unknown MAC addresses, send a syslog message, and increment the violation counter, while keeping the port up. Which violation mode should be configured?
Correct answer: C. restrict
Restrict mode drops frames from unauthorized MACs, logs the event, sends SNMP traps if configured, and increments the violation counter while the port stays up. Protect mode also drops the frames but does not log or increment the counter, so the violations go unnoticed.
Restrict mode drops frames from unauthorized MACs, logs the event, sends SNMP traps if configured, and increments the violation counter while the port stays up. Protect mode also drops the frames but does not log or increment the counter, so the violations go unnoticed.
Question 78Network Fundamentals
An engineer at Hollis School connects a new 802.3at access point that draws about 25 W to an access switch, and the AP powers up. Two IP phones plugged into the same switch afterward do not power on, and show power inline reports almost no power remaining. What is the most likely cause?
Correct answer: D. The switch PoE power budget has been used up
A PoE switch has a fixed total power budget, and it denies power to new devices once that budget is used up. The show power inline output with almost no power remaining confirms the budget is the issue. Cable type and VLAN assignment do not affect whether a switch can supply power to a port.
A PoE switch has a fixed total power budget, and it denies power to new devices once that budget is used up. The show power inline output with almost no power remaining confirms the budget is the issue. Cable type and VLAN assignment do not affect whether a switch can supply power to a port.
Question 79Network Access
An engineer at Fairview College is installing a lightweight AP in local mode. The AP will serve three WLANs that map to VLANs 10, 20, and 30 on the WLC. How should the switch port connected to the AP be configured?
Correct answer: D. As an access port in the AP management VLAN
In local mode, the AP tunnels all client traffic to the WLC inside CAPWAP, so the client VLANs only need to exist on the WLC side. The AP needs just one VLAN for its own management address, so an access port is correct. A trunk is only needed when the AP switches client VLANs locally.
In local mode, the AP tunnels all client traffic to the WLC inside CAPWAP, so the client VLANs only need to exist on the WLC side. The AP needs just one VLAN for its own management address, so an access port is correct. A trunk is only needed when the AP switches client VLANs locally.
Question 80IP Connectivity
Two routers at Elmhurst College run HSRP group 10 on VLAN 30 using HSRP version 1, the IOS default. Hosts send ARP requests for the group's virtual IP address. Which virtual MAC address does the active router return?
Correct answer: B. 0000.0c07.ac0a
HSRP version 1 uses the virtual MAC 0000.0c07.acXX, where XX is the group number in hexadecimal, and group 10 is 0a. The value ac10 wrongly uses the decimal group number, 0000.0c9f.fXXX belongs to HSRP version 2, and 0000.5e00.01XX belongs to VRRP.
HSRP version 1 uses the virtual MAC 0000.0c07.acXX, where XX is the group number in hexadecimal, and group 10 is 0a. The value ac10 wrongly uses the decimal group number, 0000.0c9f.fXXX belongs to HSRP version 2, and 0000.5e00.01XX belongs to VRRP.
Question 81IP Connectivity
An engineer at Alder Analytics has enabled ipv6 unicast-routing and created ipv6 router ospf 5 with router-id 5.5.5.5. Interface G0/1 has an IPv6 global unicast address, but OSPFv3 is not running on it. Which interface command enables OSPFv3 in area 0 on G0/1?
Correct answer: B. ipv6 ospf 5 area 0
OSPFv3 is enabled per interface with ipv6 ospf followed by the process ID and area, because it does not use network statements. The ip ospf 5 area 0 command enables OSPFv2 for IPv4 instead.
OSPFv3 is enabled per interface with ipv6 ospf followed by the process ID and area, because it does not use network statements. The ip ospf 5 area 0 command enables OSPFv2 for IPv4 instead.
Question 82Network Fundamentals
A wireless engineer at Cobalt Coffee is placing three neighboring 2.4 GHz access points in a busy store in North America and wants no channel overlap between them. Which channel set should be used?
Correct answer: D. 1, 6 and 11
In the 2.4 GHz band, channels are only 5 MHz apart but each signal is about 22 MHz wide, so only 1, 6 and 11 avoid overlap in North America. A set like 3, 6 and 9 leaves neighboring channels overlapping and causes adjacent-channel interference. Channel 12 is also not available for normal use in North America.
In the 2.4 GHz band, channels are only 5 MHz apart but each signal is about 22 MHz wide, so only 1, 6 and 11 avoid overlap in North America. A set like 3, 6 and 9 leaves neighboring channels overlapping and causes adjacent-channel interference. Channel 12 is also not available for normal use in North America.
Question 83Network Access
The WLC at Bayview Stadium runs AireOS and has LAG enabled on its four distribution ports, which connect to one Catalyst switch. The engineer must configure the switch ports so all four links carry traffic. Which configuration is correct?
Correct answer: C. Bundle the ports with channel-group 1 mode on
An AireOS WLC supports LAG only as a static bundle and does not negotiate with LACP or PAgP, so the switch ports must use mode on. With mode active, the switch would wait for LACP packets that the WLC never sends, and the bundle would not form.
An AireOS WLC supports LAG only as a static bundle and does not negotiate with LACP or PAgP, so the switch ports must use mode on. With mode active, the switch would wait for LACP packets that the WLC never sends, and the bundle would not form.
Question 84Security Fundamentals
An engineer at Ashford Legal configures switchport port-security mac-address sticky on access ports. A week later the switch reloads and the learned MAC addresses are gone. What step was missed?
Correct answer: B. Saving the running configuration to the startup configuration
Sticky learning adds dynamically learned MAC addresses to the running configuration as sticky entries. They survive a reload only if the running configuration is saved, for example with copy running-config startup-config.
Sticky learning adds dynamically learned MAC addresses to the running configuration as sticky entries. They survive a reload only if the running configuration is saved, for example with copy running-config startup-config.
Question 85IP Services
An engineer at Ironside Legal sets the hostname BR1-RTR, creates a local user with a secret, and then enters crypto key generate rsa modulus 2048. The router displays an error and creates no keys. What must be configured before the keys can be generated?
Correct answer: C. ip domain name ironside.local
IOS builds the RSA key name from the hostname and the domain name, so key generation fails until a domain name such as ironside.local is set. The ip ssh version 2 command does not meet this requirement, and SSH stays disabled until RSA keys exist.
IOS builds the RSA key name from the hostname and the domain name, so key generation fails until a domain name such as ironside.local is set. The ip ssh version 2 command does not meet this requirement, and SSH stays disabled until RSA keys exist.
Question 86Automation & Programmability
A REST call returns this JSON: {"hostname": "EDGE-1", "managed": "true", "uptime": 42, "online": false}. Which key holds a Boolean value?
Correct answer: A. online
JSON Booleans are the bare literals true and false without quotation marks, so the online key holds a Boolean. The managed key looks like a Boolean, but its value is wrapped in quotes, which makes it a string.
JSON Booleans are the bare literals true and false without quotation marks, so the online key holds a Boolean. The managed key looks like a Boolean, but its value is wrapped in quotes, which makes it a string.
Question 87IP Connectivity
At Granite Peak Bank, R1 has HSRP priority 120 and R2 uses the default priority of 100 in group 1. R1 reloaded, R2 became active, and R2 is still active now that R1 is back online. Which change makes R1 automatically take back the active role?
Correct answer: B. Configure standby 1 preempt on the LAN interface of R1
HSRP preemption is disabled by default, so a higher-priority router does not take over from a working active router unless preempt is configured on that higher-priority router. Changing priorities alone does not trigger a takeover, and preempt on R2 does nothing because R2 has the lower priority.
HSRP preemption is disabled by default, so a higher-priority router does not take over from a working active router unless preempt is configured on that higher-priority router. Changing priorities alone does not trigger a takeover, and preempt on R2 does nothing because R2 has the lower priority.
Question 88Network Fundamentals
A support engineer at Tidewater Labs is helping a developer on an Ubuntu Linux laptop confirm the IPv4 address and prefix length on the wireless interface. Which command shows this information?
Correct answer: A. ip address show
On modern Linux systems, ip address show lists each interface with its IPv4 and IPv6 addresses in CIDR form, such as 192.168.1.20/24. The ipconfig /all command is for Windows, and show ip interface brief is a Cisco IOS command. The netstat -r command displays the routing table, not interface addresses.
On modern Linux systems, ip address show lists each interface with its IPv4 and IPv6 addresses in CIDR form, such as 192.168.1.20/24. The ipconfig /all command is for Windows, and show ip interface brief is a Cisco IOS command. The netstat -r command displays the routing table, not interface addresses.
Question 89Network Access
An engineer at Corbin Freight configures interface vlan 99 with IP 10.99.0.5/24 on a Layer 2 access switch and enables SSH. Admins in VLAN 99 can reach the switch, but admins on other subnets cannot, even though routing between subnets works for user traffic. What is missing on the switch?
Correct answer: C. ip default-gateway 10.99.0.1
A Layer 2 switch needs a default gateway to send its management replies to hosts on other subnets, so ip default-gateway pointing to the VLAN 99 router address is required. Enabling ip routing would turn it into a router and is not how a Layer 2 switch is managed.
A Layer 2 switch needs a default gateway to send its management replies to hosts on other subnets, so ip default-gateway pointing to the VLAN 99 router address is required. Enabling ip routing would turn it into a router and is not how a Layer 2 switch is managed.
Question 90IP Connectivity
Two routers at Granite Freight connect directly with one Ethernet cable, and no other device will ever join that link. The engineer wants the routers to skip the DR and BDR election and the wait time it adds before the adjacency forms. Which configuration achieves this?
Correct answer: D. Set ip ospf network point-to-point on each interface
The point-to-point network type has no DR or BDR, so the routers move straight toward a full adjacency without the election wait. Setting priority 0 on both sides leaves the segment with no DR at all, so the routers stay in 2-Way and never become fully adjacent.
The point-to-point network type has no DR or BDR, so the routers move straight toward a full adjacency without the election wait. Setting priority 0 on both sides leaves the segment with no DR at all, so the routers stay in 2-Way and never become fully adjacent.
Question 91Security Fundamentals
Fairview Energy needs its routers to talk to an AAA server for administrator logins. The protocol must encrypt the entire packet body and support per-command authorization. Which protocol fits BEST?
Correct answer: D. TACACS+, which uses TCP port 49
TACACS+ runs over TCP port 49, encrypts the whole payload, and separates authentication, authorization, and accounting, which allows per-command authorization for device administration. RADIUS uses UDP 1812 and 1813, encrypts only the password, and is mainly used for network access such as 802.1X.
TACACS+ runs over TCP port 49, encrypts the whole payload, and separates authentication, authorization, and accounting, which allows per-command authorization for device administration. RADIUS uses UDP 1812 and 1813, encrypts only the password, and is mainly used for network access such as 802.1X.
Question 92Network Fundamentals
Ashford Managed Services connects two customers to the same router. Both customers use 10.1.1.0/24 internally, and their traffic must stay completely separate. Which feature lets the router support both overlapping networks?
Correct answer: A. Virtual routing and forwarding instances
VRFs split one physical router into multiple virtual routers, each with its own routing table, so the same prefix can exist in each VRF without conflict. Separate VLANs alone still feed one global routing table, where two 10.1.1.0/24 networks would overlap. Secondary addresses cannot place the same subnet on two interfaces in one table.
VRFs split one physical router into multiple virtual routers, each with its own routing table, so the same prefix can exist in each VRF without conflict. Separate VLANs alone still feed one global routing table, where two 10.1.1.0/24 networks would overlap. Secondary addresses cannot place the same subnet on two interfaces in one table.
Question 93Network Access
A university security team wants one of its lightweight APs to stop serving clients and instead scan all channels full time to detect rogue access points and interference. The AP is joined to a Cisco WLC. Which AP mode should be configured?
Correct answer: B. Monitor mode
Monitor mode turns the AP into a dedicated sensor that scans every channel for rogue APs, intrusion signatures and RF problems, and it does not serve clients. Local mode serves clients and only scans other channels briefly between client traffic.
Monitor mode turns the AP into a dedicated sensor that scans every channel for rogue APs, intrusion signatures and RF problems, and it does not serve clients. Local mode serves clients and only scans other channels briefly between client traffic.
Question 94IP Services
An engineer at Larkspur Media is choosing a protocol to copy IOS images and configuration files to network devices. Which statement correctly compares TFTP with FTP?
Correct answer: D. TFTP runs over UDP with no login, while FTP uses TCP with a login
TFTP is a simple protocol on UDP port 69 with no authentication and only basic get and put operations. FTP uses TCP ports 20 and 21, requires a login and supports directory listing and file management. Neither protocol encrypts data, so encryption is not a difference between them.
TFTP is a simple protocol on UDP port 69 with no authentication and only basic get and put operations. FTP uses TCP ports 20 and 21, requires a login and supports directory listing and file management. Neither protocol encrypts data, so encryption is not a difference between them.
Question 95Automation & Programmability
An engineer hand-edits a JSON payload before sending it to an API, and the server rejects one version as malformed. Which of these JSON fragments is NOT valid?
Correct answer: C. {"vlan": 30, 'name': 'VOICE'}
JSON requires double quotation marks around keys and string values, so single quotes make the payload invalid. Values such as null, true, arrays and nested objects are all legal JSON.
JSON requires double quotation marks around keys and string values, so single quotes make the payload invalid. Values such as null, true, arrays and nested objects are all legal JSON.
Question 96IP Connectivity
The network team at Oakridge Hospital wants both distribution routers to forward traffic from the same VLAN at the same time. All hosts must keep one default gateway address, and the team wants load balancing without creating extra groups. Which first hop redundancy protocol fits this requirement?
Correct answer: A. GLBP
GLBP gives every host the same virtual IP but answers ARP requests with different virtual MAC addresses, so several routers forward traffic at once. HSRP and VRRP use one active or master router per group, so load sharing with them needs multiple groups and different gateway settings on the hosts.
GLBP gives every host the same virtual IP but answers ARP requests with different virtual MAC addresses, so several routers forward traffic at once. HSRP and VRRP use one active or master router per group, so load sharing with them needs multiple groups and different gateway settings on the hosts.
Question 97IP Connectivity
An engineer at Wexford Mills enters ip route 0.0.0.0 0.0.0.0 203.0.113.1 on R1, but show ip route still says Gateway of last resort is not set. The interface toward the ISP is administratively down. What is the MOST likely reason the default route is missing?
Correct answer: C. The next hop is unreachable, so the route is not installed
A static route with a next-hop address is installed only if the router can resolve that next hop through a connected or other route. With the ISP interface down, 203.0.113.1 is unreachable, so the default route stays out of the table. Default-information originate only advertises a default into OSPF.
A static route with a next-hop address is installed only if the router can resolve that next hop through a connected or other route. With the ISP interface down, 203.0.113.1 is unreachable, so the default route stays out of the table. Default-information originate only advertises a default into OSPF.
Question 98Security Fundamentals
An engineer at Coral Bay Resorts is creating a guest WLAN on a Cisco WLC that must use WPA2 Personal. On the WLAN Security tab, after selecting WPA+WPA2 with AES, which Authentication Key Management setting is required?
Correct answer: A. PSK, then enter the passphrase in ASCII format
WPA2 Personal uses a pre-shared key, so the PSK option under Authentication Key Management must be enabled and the passphrase entered, usually in ASCII format. Choosing 802.1X would make it WPA2 Enterprise, which requires a RADIUS server and per-user credentials.
WPA2 Personal uses a pre-shared key, so the PSK option under Authentication Key Management must be enabled and the passphrase entered, usually in ASCII format. Choosing 802.1X would make it WPA2 Enterprise, which requires a RADIUS server and per-user credentials.
Question 99Network Fundamentals
A new switch at Elm Street Pharmacy has an empty MAC address table. PC1 on Gi0/1 sends a unicast frame to PC2 on Gi0/5, and both ports are in VLAN 10. What does the switch do with the frame?
Correct answer: B. Records PC1 on Gi0/1, then floods out other VLAN 10 ports
A switch always learns the source MAC address on the ingress port, so PC1 is added on Gi0/1. Because PC2 is not yet in the table, the frame is an unknown unicast and is flooded out every port in VLAN 10 except the one it arrived on. Switches do not send ARP requests to find hosts, and they never flood a frame back out its ingress port.
A switch always learns the source MAC address on the ingress port, so PC1 is added on Gi0/1. Because PC2 is not yet in the table, the frame is an unknown unicast and is flooded out every port in VLAN 10 except the one it arrived on. Switches do not send ARP requests to find hosts, and they never flood a frame back out its ingress port.
Question 100Network Access
Cobalt Health is creating a WLAN in the WLC GUI for Wi-Fi voice handsets. Calls on this WLAN must receive the highest wireless priority. Which QoS profile should the engineer select on the WLAN QoS tab?
Correct answer: A. Platinum, the profile intended for voice traffic
On a Cisco WLC, Platinum is the voice profile and gives the highest priority. Gold is intended for video, Silver is the best effort default, and Bronze is for background traffic.
On a Cisco WLC, Platinum is the voice profile and gives the highest priority. Gold is intended for video, Silver is the best effort default, and Bronze is for background traffic.
The real CCNA exam at a glance
100questions
2htime limit
MCQmultiple choice
80%+aim for here
Score 80% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Networking practice tests
See all 36 free practice tests →Original practice questions written by CertOcean in the style of the CCNA exam. They are not real exam questions. CCNA and Cisco are trademarks of their owners. Real exam format: around 100 questions · 120 minutes · Cisco does not publish the passing score · the real exam also has lab items.