Cisco CCNA 200-301 · Current exam topics · Updated 2026
Free Cisco CCNA Practice Exam (2026)
Full-length CCNA mock exams with a realistic number of questions and the real exam time. Subnetting, switching, OSPF, security and automation questions across all 6 domains, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
100 questions · 2 hours · same as the real exam
You have an unfinished attempt on this set.
Your score by topic
Questions 1–10Page 1 of 10
🏆
Question 1Network Fundamentals
The network team at Granite Health owns 172.20.0.0/16 and decides to split it into equal /22 subnets for its clinics. How many subnets will they have, and how many usable hosts will each one support?
Correct answer: A. 64 subnets with 1022 hosts each
Going from /16 to /22 borrows 6 bits, so there are 2^6 = 64 subnets. Each /22 keeps 10 host bits, giving 2^10 - 2 = 1022 usable addresses. The answer with 1024 forgets to subtract the network and broadcast addresses.
Going from /16 to /22 borrows 6 bits, so there are 2^6 = 64 subnets. Each /22 keeps 10 host bits, giving 2^10 - 2 = 1022 usable addresses. The answer with 1024 forgets to subtract the network and broadcast addresses.
Question 2Network Access
At Elmstead Insurance, a Catalyst multilayer switch has SVIs for VLAN 10 and VLAN 20, and both are up/up. Hosts can ping their own gateway but cannot reach hosts in the other VLAN. On the switch, show ip route displays only Default gateway is not set. What is the most likely cause?
Correct answer: C. IP routing is not enabled globally on the switch
SVIs give the switch an address in each VLAN, but it routes between them only after the global ip routing command is entered, and without it show ip route shows only the default gateway line. Encapsulation dot1Q is a router subinterface command and is not used on SVIs.
SVIs give the switch an address in each VLAN, but it routes between them only after the global ip routing command is entered, and without it show ip route shows only the default gateway line. Encapsulation dot1Q is a router subinterface command and is not used on SVIs.
Question 3Security Fundamentals
Cisco publishes an advisory for a flaw in the IOS web management server on a router model used at Westbrook Supply. A patched image will not be available for two weeks, and the team manages routers only through SSH. What is the BEST immediate mitigation?
Correct answer: D. Disable the unused HTTP and HTTPS server features
Turning off a vulnerable service that is not needed removes the attack surface until a patch can be installed. A vty access-class protects SSH and Telnet access but does nothing for the separate web server process.
Turning off a vulnerable service that is not needed removes the attack surface until a patch can be installed. A vty access-class protects SSH and Telnet access but does nothing for the separate web server process.
Question 4IP Connectivity
At Riverside Utilities, R1 G0/0 (10.9.9.1/30) is configured with network 10.9.9.0 0.0.0.3 area 0, and R2 G0/0 (10.9.9.2/30) is configured with network 10.9.9.0 0.0.0.3 area 1. Timers, MTU and authentication settings match. What is the result?
Correct answer: D. No adjacency forms, because the area ID in the hellos does not match
The area ID is carried in every OSPF hello, and both ends of a link must be in the same area for the hellos to be accepted. Because the hellos are rejected, the routers never become neighbors, so no routes of any type are exchanged over this link.
The area ID is carried in every OSPF hello, and both ends of a link must be in the same area for the hellos to be accepted. Because the hellos are rejected, the routers never become neighbors, so no routes of any type are exchanged over this link.
Question 5IP Connectivity
An engineer at Meridian Supply runs show ip route on R4 and sees C 192.168.10.0/24 is directly connected, GigabitEthernet0/0 and L 192.168.10.1/32 is directly connected, GigabitEthernet0/0. What does the L entry represent?
Correct answer: B. The IPv4 address that is configured on the Gi0/0 interface of R4
IOS adds a local route with code L and a /32 mask for each IPv4 address configured on an interface, so the router can recognize traffic addressed to itself. ARP entries are kept in the ARP table, not the routing table, and static routes appear with code S.
IOS adds a local route with code L and a /32 mask for each IPv4 address configured on an interface, so the router can recognize traffic addressed to itself. ARP entries are kept in the ARP table, not the routing table, and static routes appear with code S.
Question 6IP Services
Bayview Clinic hosts a patient portal on inside server 10.10.5.20. Internet users must always reach it at public address 203.0.113.20, even before the server has started any outbound session. Which command meets this requirement?
Correct answer: B. ip nat inside source static 10.10.5.20 203.0.113.20
Static inside source NAT creates a permanent one-to-one mapping, and the syntax lists the inside local address first and the inside global address second. Reversing the two addresses maps the wrong direction, and dynamic PAT with a pool only creates entries after an inside host starts a session.
Static inside source NAT creates a permanent one-to-one mapping, and the syntax lists the inside local address first and the inside global address second. Reversing the two addresses maps the wrong direction, and dynamic PAT with a pool only creates entries after an inside host starts a session.
Question 7Automation & Programmability
Fernway Clinics is evaluating an SDN design in which a central controller computes forwarding decisions and installs them on the switches. Which function remains on each switch in this design?
Correct answer: D. Forwarding packets using entries the controller installs
SDN separates the control plane from the data plane. The controller makes forwarding decisions, while each switch keeps the data plane job of moving packets using the entries it receives. Path computation and the northbound API live on the controller, not on individual switches.
SDN separates the control plane from the data plane. The controller makes forwarding decisions, while each switch keeps the data plane job of moving packets using the entries it receives. Path computation and the northbound API live on the controller, not on individual switches.
Question 8Network Access
A junior engineer at Westbrook Library tries to remove VLAN 1 from a Catalyst switch with no vlan 1, and the switch rejects the command. Which statement explains this?
Correct answer: C. VLAN 1 is the default VLAN and cannot be deleted
VLAN 1 is the factory default VLAN for every port, and IOS does not allow it to be deleted or renamed. VLAN 1 can be removed from a trunk allowed list, but that still does not allow the VLAN itself to be deleted.
VLAN 1 is the factory default VLAN for every port, and IOS does not allow it to be deleted or renamed. VLAN 1 can be removed from a trunk allowed list, but that still does not allow the VLAN itself to be deleted.
Question 9Network Fundamentals
A server at Lakeview College is configured as 172.18.37.10/20. An engineer must give a new printer an address in the same subnet without changing the mask. Which address works?
Correct answer: B. 172.18.47.200
A /20 mask (255.255.240.0) creates blocks of 16 in the third octet, so 172.18.37.10 belongs to 172.18.32.0/20. That subnet runs from 172.18.32.1 to 172.18.47.254, which includes 172.18.47.200. The address 172.18.48.20 falls in the next block, 172.18.48.0/20.
A /20 mask (255.255.240.0) creates blocks of 16 in the third octet, so 172.18.37.10 belongs to 172.18.32.0/20. That subnet runs from 172.18.32.1 to 172.18.47.254, which includes 172.18.47.200. The address 172.18.48.20 falls in the next block, 172.18.48.0/20.
Question 10Security Fundamentals
Millbrook Insurance sends fake phishing emails to its own staff each month and shows a short notice to anyone who clicks the link. Which security program element does this activity represent?
Correct answer: C. User awareness
User awareness programs keep employees alert to threats, and simulated phishing campaigns are a common way to test and reinforce that awareness. Physical access control, by contrast, limits who can enter buildings and equipment rooms and does not address email threats.
User awareness programs keep employees alert to threats, and simulated phishing campaigns are a common way to test and reinforce that awareness. Physical access control, by contrast, limits who can enter buildings and equipment rooms and does not address email threats.
Question 11IP Connectivity
An engineer at Silverline Media copied the same OSPF template to R7 and R8, which connect over G0/0 in area 0. The neighbor never comes up correctly, and R7 logs a message about a duplicate router ID. Timers, MTU and area settings match. What is the cause?
Correct answer: A. Both routers use the same router ID, which must be unique in OSPF
OSPF identifies each router by its router ID, so two neighbors with the same router ID cannot build a proper adjacency, and IOS logs a duplicate router ID message. The process ID is only locally significant, so neighbors can use the same or different process IDs.
OSPF identifies each router by its router ID, so two neighbors with the same router ID cannot build a proper adjacency, and IOS logs a duplicate router ID message. The process ID is only locally significant, so neighbors can use the same or different process IDs.
Question 12IP Connectivity
R5 at Tidewater Shipping learns 10.40.0.0/16 through OSPF from two neighbors, 10.0.15.1 and 10.0.25.1. Both paths have a total cost of 20, and no other source advertises that prefix. How will R5 handle traffic to 10.40.0.0/16?
Correct answer: B. It installs both paths and load-shares across the two next hops
When the prefix and administrative distance are equal and the metrics tie, IOS installs multiple equal-cost paths, up to four for OSPF by default, and shares traffic across them. The router ID identifies OSPF routers and is not used to choose between equal-cost routes.
When the prefix and administrative distance are equal and the metrics tie, IOS installs multiple equal-cost paths, up to four for OSPF by default, and shares traffic across them. The router ID identifies OSPF routers and is not used to choose between equal-cost routes.
Question 13Network Fundamentals
Fenwick Robotics wants IPv6 addresses for a multi-subnet lab that will never be routed on the internet, similar to how it uses RFC 1918 space for IPv4. Which address type should the engineer use?
Correct answer: A. Unique local addresses from FC00::/7
Unique local addresses come from FC00::/7 (in practice FD00::/8) and are meant for internal use, much like RFC 1918 space. Link-local addresses work only on a single segment, so they cannot address a routed lab with several subnets. Site-local FEC0::/10 was deprecated and should not be used.
Unique local addresses come from FC00::/7 (in practice FD00::/8) and are meant for internal use, much like RFC 1918 space. Link-local addresses work only on a single segment, so they cannot address a routed lab with several subnets. Site-local FEC0::/10 was deprecated and should not be used.
Question 14Network Access
By default, how does an 802.1Q trunk port handle frames that belong to its native VLAN?
Correct answer: C. It sends them without adding a VLAN tag
By default, 802.1Q sends native VLAN frames untagged, and untagged frames received on a trunk are placed in the native VLAN. Native traffic is tagged only if vlan dot1q tag native is configured globally.
By default, 802.1Q sends native VLAN frames untagged, and untagged frames received on a trunk are placed in the native VLAN. Native traffic is tagged only if vlan dot1q tag native is configured globally.
Question 15IP Services
At Summit Brewing, PAT is set up with ip nat inside source list 1 interface g0/0 overload, and g0/0 connects to the ISP. Users cannot reach the internet, and show ip nat translations is empty. The running config shows ip nat inside on g0/0 and ip nat outside on g0/1, the LAN interface. What is the most likely cause?
Correct answer: D. The inside and outside interface roles are reversed
Inside source NAT only translates packets that arrive on an ip nat inside interface and leave through an ip nat outside interface. With the roles swapped, user traffic enters an outside interface, so no translation is ever built. Using the interface keyword with overload is the normal way to configure PAT on the outside address.
Inside source NAT only translates packets that arrive on an ip nat inside interface and leave through an ip nat outside interface. With the roles swapped, user traffic enters an outside interface, so no translation is ever built. Using the interface keyword with overload is the normal way to configure PAT on the outside address.
Question 16Automation & Programmability
Pinewood Retail has 60 small stores and no data center. It buys cloud-managed switches and access points that register with a vendor-hosted dashboard when plugged in, and head office manages them from a web browser. Which statement about this model is accurate?
Correct answer: D. Management runs in the cloud, while user traffic is still forwarded locally
In cloud-managed networking the vendor hosts the management, monitoring and configuration functions, and devices reach the dashboard over the internet. User traffic is still switched and routed locally, so it does not have to pass through the cloud.
In cloud-managed networking the vendor hosts the management, monitoring and configuration functions, and devices reach the dashboard over the internet. User traffic is still switched and routed locally, so it does not have to pass through the cloud.
Question 17Security Fundamentals
A switch at Elmwood Dental shows password Admin123 in clear text under line console 0 in the running configuration. The engineer enters service password-encryption. What is the result?
Correct answer: A. The password is stored with weak type 7 encryption that can be reversed
The service password-encryption command applies type 7 encryption to clear text passwords such as line and enable passwords, which only stops casual viewing because type 7 is easily reversed. Strong hashing such as type 5, 8, or 9 comes from the secret keyword, not from this command.
The service password-encryption command applies type 7 encryption to clear text passwords such as line and enable passwords, which only stops casual viewing because type 7 is easily reversed. Strong hashing such as type 5, 8, or 9 comes from the secret keyword, not from this command.
Question 18Network Fundamentals
Pellham Media configures the same IPv6 address on DNS servers in three data centers so that each client reaches whichever server is closest in routing terms. What type of IPv6 address is this?
Correct answer: B. Anycast
An anycast address is a unicast address assigned to several devices, and routing delivers each packet to the nearest one. A multicast address delivers a packet to every member of a group, not just the closest. IPv6 has no broadcast addresses at all.
An anycast address is a unicast address assigned to several devices, and routing delivers each packet to the nearest one. A multicast address delivers a packet to every member of a group, not just the closest. IPv6 has no broadcast addresses at all.
Question 19Network Access
A security audit at Sterling Mutual finds that the core switch trunk ports are sending DTP frames. The ports are already set with switchport mode trunk. Which interface command stops the DTP frames while keeping the links as trunks?
Correct answer: D. switchport nonegotiate
With switchport mode trunk configured, switchport nonegotiate disables DTP, so the port stops sending DTP frames and stays a static trunk. Dynamic auto still uses DTP and could even leave the link as an access port.
With switchport mode trunk configured, switchport nonegotiate disables DTP, so the port stops sending DTP frames and stays a static trunk. Dynamic auto still uses DTP and could even leave the link as an access port.
Question 20IP Connectivity
At Oakmont Legal, R1 has ip ospf authentication message-digest and ip ospf message-digest-key 1 md5 Secr3t configured on G0/0. R2's G0/0 is in the same subnet and area but has no OSPF authentication configured. What will the engineer observe?
Correct answer: C. No neighbor relationship forms, since R2's hellos fail authentication
OSPF checks authentication on every packet, including hellos, so a mismatch stops the routers from ever becoming neighbors. IOS does not fall back to null authentication when a neighbor sends unauthenticated packets.
OSPF checks authentication on every packet, including hellos, so a mismatch stops the routers from ever becoming neighbors. IOS does not fall back to null authentication when a neighbor sends unauthenticated packets.
Question 21IP Connectivity
At Cobaltview Media, an engineer configures ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 on the edge router. Gi0/0 connects to a provider Ethernet segment where the provider router is 198.51.100.1. What is the main concern with this configuration?
Correct answer: A. The router must ARP for every destination and relies on proxy ARP
A static route that points only to a multiaccess Ethernet interface makes the router treat every destination as directly connected, so it ARPs for each address and depends on the provider router answering with proxy ARP. IOS accepts the command, but adding the next hop 198.51.100.1 is the better practice.
A static route that points only to a multiaccess Ethernet interface makes the router treat every destination as directly connected, so it ARPs for each address and depends on the provider router answering with proxy ARP. IOS accepts the command, but adding the next hop 198.51.100.1 is the better practice.
Question 22Network Fundamentals
An ISP assigns Whitmore Logistics the IPv6 prefix 2001:db8:4a00::/48. The engineer plans to use standard /64 subnets for every VLAN. How many /64 subnets are available?
Correct answer: C. 65,536
Moving from a /48 to /64 subnets leaves 64 - 48 = 16 bits for subnetting. That gives 2^16 = 65,536 subnets, each with a full 64-bit interface ID. The answer of 256 would be correct only for a /56 assignment.
Moving from a /48 to /64 subnets leaves 64 - 48 = 16 bits for subnetting. That gives 2^16 = 65,536 subnets, each with a full 64-bit interface ID. The answer of 256 would be correct only for a /56 assignment.
Question 23Network Access
An engineer at Fernwood Cable is connected to SW4 and needs the management IP address and IOS version of the neighbor on G1/0/48. CDP is running on both switches. Which command shows both details?
Correct answer: A. show cdp neighbors detail
The detail keyword lists each neighbor's IP address, platform, and full software version. Plain show cdp neighbors, even when filtered to one interface, shows the device ID, ports, and platform but not the IP address or IOS version.
The detail keyword lists each neighbor's IP address, platform, and full software version. Plain show cdp neighbors, even when filtered to one interface, shows the device ID, ports, and platform but not the IP address or IOS version.
Question 24Security Fundamentals
An engineer at Oakridge Transit creates local accounts with username commands so each admin logs in with a personal name and password. Remote vty logins still ask only for the shared line password. Which command under line vty 0 15 makes the vty lines use the local accounts?
Correct answer: B. login local
The login local command tells the vty lines to authenticate against the local username database. The plain login command uses the line password instead, which is exactly the shared password behavior the engineer wants to remove.
The login local command tells the vty lines to authenticate against the local username database. The plain login command uses the line password instead, which is exactly the shared password behavior the engineer wants to remove.
Question 25IP Services
The isolated lab network at Cobalt Engineering has no internet access, but all of its switches must agree on the time. The engineer wants the core router to act as the NTP source using its own internal clock. Which command should be entered on the core router?
Correct answer: A. ntp master 3
The ntp master command makes the router an authoritative NTP server based on its internal clock, here at stratum 3, and the switches can then point to it with ntp server. The clock set command only changes the local time and does not let the router serve time to clients.
The ntp master command makes the router an authoritative NTP server based on its internal clock, here at stratum 3, and the switches can then point to it with ntp server. The clock set command only changes the local time and does not let the router serve time to clients.
Question 26Automation & Programmability
An engineer at Corvid Analytics asks a generative AI assistant to write an ACL that blocks Telnet to the core switches. The output looks correct and is neatly formatted. What should the engineer do BEFORE deploying it to production?
Correct answer: C. Validate it in a lab, because AI output can be wrong
Generative AI can produce configs that look right but contain a wrong wildcard mask, a missing permit statement or commands the platform does not support, so a human must review and test them first. Asking the same assistant to confirm its own answer is not independent validation.
Generative AI can produce configs that look right but contain a wrong wildcard mask, a missing permit statement or commands the platform does not support, so a human must review and test them first. Asking the same assistant to confirm its own answer is not independent validation.
Question 27IP Connectivity
Two routers at Fernhill Logistics connect to the same Ethernet VLAN. R1 G0/0 is 172.16.10.1/24 and R2 G0/0 is 172.16.10.2/25. Both interfaces are in area 0 with default timers and the default network type. Why do they fail to form an OSPF adjacency?
Correct answer: B. On a broadcast network, the subnet mask in the hellos must match
On broadcast networks, OSPF hellos carry the interface subnet mask, and a router ignores hellos whose mask does not match its own. Reachability is not the issue, because 172.16.10.1 falls inside 172.16.10.0/25.
On broadcast networks, OSPF hellos carry the interface subnet mask, and a router ignores hellos whose mask does not match its own. Reachability is not the issue, because 172.16.10.1 falls inside 172.16.10.0/25.
Question 28Network Fundamentals
An engineer at Quarry Point Bank hard-codes speed 100 on a copper switch port, while the connected router port is hard-coded to speed 1000. What will the engineer most likely see on the switch port?
Correct answer: D. The link stays down and the port shows notconnect
When both ends are hard-coded to different speeds, they cannot agree on signaling and the link does not come up, so the port shows down/down or notconnect. Late collisions are a duplex mismatch symptom, which requires the link to be up first. Autonegotiation cannot fix the problem because it is disabled on both sides.
When both ends are hard-coded to different speeds, they cannot agree on signaling and the link does not come up, so the port shows down/down or notconnect. Late collisions are a duplex mismatch symptom, which requires the link to be up first. Autonegotiation cannot fix the problem because it is disabled on both sides.
Question 29Network Access
At Amber Grove Utilities, LLDP is enabled globally. Port G1/0/5 faces a monitoring appliance, and the switch must learn about the appliance through LLDP but must not advertise its own details out that port. Which interface command meets this requirement?
Correct answer: A. no lldp transmit
The interface command no lldp transmit stops the port from sending LLDP frames while it still receives and processes them. The no lldp receive command would do the opposite, and no lldp run would disable LLDP on the whole switch.
The interface command no lldp transmit stops the port from sending LLDP frames while it still receives and processes them. The no lldp receive command would do the opposite, and no lldp run would disable LLDP on the whole switch.
Question 30IP Connectivity
An engineer at Quarry Hill Systems must route 2001:db8:50::/48 toward a neighbor whose only address on the shared link is fe80::2. The local router reaches that neighbor through GigabitEthernet0/1. Which command is valid?
Correct answer: B. ipv6 route 2001:db8:50::/48 GigabitEthernet0/1 fe80::2
A link-local address is unique only on one link, so a static route with a link-local next hop must also name the exit interface. Without GigabitEthernet0/1, IOS cannot tell which link fe80::2 is on, and the ip route command does not accept IPv6 prefixes.
A link-local address is unique only on one link, so a static route with a link-local next hop must also name the exit interface. Without GigabitEthernet0/1, IOS cannot tell which link fe80::2 is on, and the ip route command does not accept IPv6 prefixes.
Question 31Security Fundamentals
Delta Ridge Manufacturing wants laptops to authenticate to the network using digital certificates instead of passwords. Which statement about this approach is correct?
Correct answer: A. A trusted CA signs the certificate, and the laptop proves it owns the private key
Certificate-based authentication relies on a certificate authority that vouches for the identity bound to a public key, and the device proves its identity by using the matching private key. Sending the private key to a server would defeat the purpose because the private key must never leave the device.
Certificate-based authentication relies on a certificate authority that vouches for the identity bound to a public key, and the device proves its identity by using the matching private key. Sending the private key to a server would defeat the purpose because the private key must never leave the device.
Question 32Network Fundamentals
Brookfield Arena needs a 1 Gbps link between a switch in the press box and a switch 160 meters away in the same building. The current Category 6 cable run shows heavy errors and frequent link drops. What is the best fix?
Correct answer: D. Use multimode fiber with 1000BASE-SX optics
Twisted-pair Ethernet, including Category 6 and 6a, is limited to 100 meters per segment, so a 160 meter run will see errors and drops. Multimode fiber with 1000BASE-SX optics supports runs of several hundred meters at 1 Gbps. Category 6a improves 10 Gbps support but has the same 100 meter limit.
Twisted-pair Ethernet, including Category 6 and 6a, is limited to 100 meters per segment, so a 160 meter run will see errors and drops. Multimode fiber with 1000BASE-SX optics supports runs of several hundred meters at 1 Gbps. Category 6a improves 10 Gbps support but has the same 100 meter limit.
Question 33Network Access
An engineer at Ironbridge Data Center adds 10 ports to a single LACP EtherChannel between two Catalyst switches. Show etherchannel summary shows eight ports bundled and two ports flagged as hot-standby. What explains this?
Correct answer: A. LACP allows only 8 active members, and the rest wait as standby
LACP can place up to 16 ports in a bundle, but only 8 are active at one time. The extra ports wait in hot-standby and take over if an active member fails. A speed mismatch would suspend a port rather than put it in standby.
LACP can place up to 16 ports in a bundle, but only 8 are active at one time. The extra ports wait in hot-standby and take over if an active member fails. A speed mismatch would suspend a port rather than put it in standby.
Question 34IP Connectivity
At Westbrook Retail, a small branch router with a limited CPU shares a VLAN with three core routers. The engineer must guarantee that the branch router is never elected DR or BDR on that VLAN, while it still exchanges routes with the core. Which interface command should be applied?
Correct answer: C. ip ospf priority 0
A priority of 0 makes the router ineligible for the DR and BDR roles, but it still forms full adjacencies with the DR and BDR and exchanges routes. A priority of 255 does the opposite and makes the router the most preferred candidate.
A priority of 0 makes the router ineligible for the DR and BDR roles, but it still forms full adjacencies with the DR and BDR and exchanges routes. A priority of 255 does the opposite and makes the router the most preferred candidate.
Question 35IP Services
A small office router at Maple Street Bakery connects to a cable modem, and the ISP hands out addresses dynamically. The engineer needs the router's g0/1 interface to lease its address from the ISP. Which interface command does this?
Correct answer: A. ip address dhcp
The ip address dhcp interface command makes the router a DHCP client, so it requests an address, mask and default gateway from the ISP. The ip address negotiated command is used on PPP links, where IPCP assigns the address, not on a plain Ethernet handoff.
The ip address dhcp interface command makes the router a DHCP client, so it requests an address, mask and default gateway from the ISP. The ip address negotiated command is used on PPP links, where IPCP assigns the address, not on a plain Ethernet handoff.
Question 36Automation & Programmability
Brightwater Media's network analytics tool raises an alert that client onboarding times at one site are three times higher than usual for a Tuesday morning. Nobody had configured a threshold for onboarding time. How did the tool MOST likely detect this issue?
Correct answer: D. Machine learning built a baseline of normal behavior and flagged the deviation
ML-based anomaly detection learns what is normal for each site and time period, then flags behavior that strays from that baseline without a manually set threshold. A fixed threshold cannot account for what is usual on a Tuesday morning, and nobody had configured one here.
ML-based anomaly detection learns what is normal for each site and time period, then flags behavior that strays from that baseline without a manually set threshold. A fixed threshold cannot account for what is usual on a Tuesday morning, and nobody had configured one here.
Question 37Security Fundamentals
Sales staff at Bluewater Travel work from hotels and airports and need encrypted access to internal applications from their laptops. Which solution is the BEST fit?
Correct answer: B. A remote access VPN using a client such as Cisco Secure Client
A remote access VPN is designed for individual users on untrusted networks, using client software such as Cisco Secure Client (formerly AnyConnect) to build an encrypted tunnel to the company. A site-to-site VPN needs a VPN device at each site, and the company does not control hotel or airport routers.
A remote access VPN is designed for individual users on untrusted networks, using client software such as Cisco Secure Client (formerly AnyConnect) to build an encrypted tunnel to the company. A site-to-site VPN needs a VPN device at each site, and the company does not control hotel or airport routers.
Question 38Network Fundamentals
A server at Sterling Analytics sends large backups to a storage host that sometimes falls behind. The storage host then advertises a smaller value in its TCP headers, and the server slows down. Which TCP mechanism is at work?
Correct answer: C. Windowing for flow control
The receiver uses the TCP window size field to tell the sender how much data it can send before waiting for an acknowledgment, which is flow control. Shrinking the window slows the sender. Sequence numbers let the receiver reorder segments and detect gaps, but they do not control the sending rate.
The receiver uses the TCP window size field to tell the sender how much data it can send before waiting for an acknowledgment, which is flow control. Shrinking the window slows the sender. Sequence numbers let the receiver reorder segments and detect gaps, but they do not control the sending rate.
Question 39Network Access
At Quarry Hill Hospital, a backup server connects to a NAS through a four-link LACP EtherChannel. During a nightly backup session between only these two devices, one member link shows heavy traffic while the others are almost idle. What explains this?
Correct answer: B. EtherChannel hashes each flow onto one member link
EtherChannel does not split a single conversation across links. It hashes fields such as MAC or IP addresses to choose a member link, so one source and destination pair always uses the same link. The other links are active and carry other flows.
EtherChannel does not split a single conversation across links. It hashes fields such as MAC or IP addresses to choose a member link, so one source and destination pair always uses the same link. The other links are active and carry other flows.
Question 40IP Connectivity
The HQ router at Brightwater Farms must reach branch LANs 172.20.0.0/24, 172.20.1.0/24, 172.20.2.0/24 and 172.20.3.0/24, all through next hop 10.9.9.2. The engineer wants one static route that covers exactly these four subnets. Which command should be used?
Correct answer: D. ip route 172.20.0.0 255.255.252.0 10.9.9.2
Four contiguous /24 networks starting at 172.20.0.0 summarize to 172.20.0.0/22, which uses the mask 255.255.252.0 and covers 172.20.0.0 through 172.20.3.255. The 255.255.248.0 mask is a /21 that also includes 172.20.4.0 through 172.20.7.255, so it covers more than required.
Four contiguous /24 networks starting at 172.20.0.0 summarize to 172.20.0.0/22, which uses the mask 255.255.252.0 and covers 172.20.0.0 through 172.20.3.255. The 255.255.248.0 mask is a /21 that also includes 172.20.4.0 through 172.20.7.255, so it covers more than required.
Question 41IP Connectivity
At Clearwater Energy, show ip ospf neighbor on R1 lists R2 in the INIT state, and the state never changes. R2 shows no OSPF neighbor entry for R1 at all. An inbound ACL was recently applied to G0/0 on R2. What is the MOST likely cause?
Correct answer: B. The ACL drops R1's hellos, so R2's hellos never list R1's router ID
A router moves from Init to 2-Way only when it sees its own router ID listed in the neighbor's hello. Because the ACL on R2 drops R1's hellos, R2 never learns R1's router ID, so R1 stays in Init. An MTU mismatch would appear later, in ExStart or Exchange.
A router moves from Init to 2-Way only when it sees its own router ID listed in the neighbor's hello. Because the ACL on R2 drops R1's hellos, R2 never learns R1's router ID, so R1 stays in Init. An MTU mismatch would appear later, in ExStart or Exchange.
Question 42Network Fundamentals
Bramble Ridge Credit Union has one campus building with six access switches. To save cost, the architect wants to combine the core and distribution functions into a single pair of switches. What is this design called?
Correct answer: C. Two-tier collapsed core
A two-tier, or collapsed core, design merges the core and distribution layers into one layer that connects to the access switches. It suits smaller campuses where a separate core would add cost without much benefit. A three-tier design keeps a dedicated core layer, which is usually justified only in large campuses with several distribution blocks.
A two-tier, or collapsed core, design merges the core and distribution layers into one layer that connects to the access switches. It suits smaller campuses where a separate core would add cost without much benefit. A three-tier design keeps a dedicated core layer, which is usually justified only in large campuses with several distribution blocks.
Question 43Network Access
Which list shows the port states used by Rapid PVST+?
Correct answer: A. Discarding, learning, and forwarding
Rapid PVST+ uses the 802.1w states of discarding, learning, and forwarding. Blocking and listening belong to legacy 802.1D STP and are merged into the discarding state in rapid spanning tree.
Rapid PVST+ uses the 802.1w states of discarding, learning, and forwarding. Blocking and listening belong to legacy 802.1D STP and are merged into the discarding state in rapid spanning tree.
Question 44Security Fundamentals
A named standard ACL called MGMT has entries with sequence numbers 10 and 20. The engineer must add a deny for host 10.5.5.9 so it is checked between those two entries. Which commands achieve this?
Correct answer: D. ip access-list standard MGMT, then 15 deny host 10.5.5.9
In named ACL configuration mode, prefixing an entry with a sequence number such as 15 places it between existing entries 10 and 20. Without a sequence number, IOS adds the entry at the end, after entry 20.
In named ACL configuration mode, prefixing an entry with a sequence number such as 15 places it between existing entries 10 and 20. Without a sequence number, IOS adds the entry at the end, after entry 20.
Question 45IP Services
At Quarry Hill Dental, PCs lease addresses from a DHCP pool on the branch router that includes network 10.8.0.0 255.255.255.0 and default-router 10.8.0.1. Users can reach websites by IP address but not by name. The company DNS server is 10.1.1.53. What is the best fix?
Correct answer: A. Add dns-server 10.1.1.53 under the DHCP pool
DHCP gives clients their addressing and also tells them which DNS server to use, and the dns-server pool command supplies that option. Without it, clients have no resolver to turn names into addresses. The ip name-server command only lets the router itself resolve names and does not reach the clients.
DHCP gives clients their addressing and also tells them which DNS server to use, and the dns-server pool command supplies that option. Without it, clients have no resolver to turn names into addresses. The ip name-server command only lets the router itself resolve names and does not reach the clients.
Question 46Automation & Programmability
A script at Halcyon Air must add a brand new site record to its network controller through a REST API. The controller assigns the site ID after the record is created. Which request should the script send?
Correct answer: C. POST to the sites collection URI
POST maps to Create in CRUD and is used when the server assigns the identifier for the new resource, and a successful create usually returns 201 Created. PUT replaces a resource at a URI the client already knows, so it does not fit when the controller chooses the ID.
POST maps to Create in CRUD and is used when the server assigns the identifier for the new resource, and a successful create usually returns 201 Created. PUT replaces a resource at a URI the client already knows, so it does not fit when the controller chooses the ID.
Question 47IP Connectivity
A traceroute from a PC at Fenwick Partners to 10.88.4.20 shows hop 1 10.1.1.1, hop 2 10.1.2.2 and hop 3 10.1.3.3, followed by only asterisks until the trace ends. A ping to 10.88.4.20 also fails. Where should the engineer begin troubleshooting?
Correct answer: D. On the router at hop 3, checking its route and next hop for 10.88.4.20
Every hop up to 10.1.3.3 answered, so the path works at least that far and the trouble starts at that router or just beyond it. Checking its routing table and the link to its next hop is the logical first step. Asterisks only mean no reply arrived before the timeout, which can come from a missing route, a down link or filtering.
Every hop up to 10.1.3.3 answered, so the path works at least that far and the trouble starts at that router or just beyond it. Checking its routing table and the link to its next hop is the logical first step. Asterisks only mean no reply arrived before the timeout, which can come from a missing route, a down link or filtering.
Question 48Network Fundamentals
Harbor Point Foods wants a full-mesh WAN between its 6 sites so that every site has a direct link to every other site. How many point-to-point links are needed?
Correct answer: D. 15
A full mesh needs n(n-1)/2 links, so 6 sites need 6 x 5 / 2 = 15 links. The value 30 counts each link twice, once from each end. A hub-and-spoke design would need only 5 links, but it would not give every site a direct path.
A full mesh needs n(n-1)/2 links, so 6 sites need 6 x 5 / 2 = 15 links. The value 30 counts each link twice, once from each end. A hub-and-spoke design would need only 5 links, but it would not give every site a direct path.
Question 49Network Access
In VLAN 30 at Cedar Valley Foods, access switch SW5 has two uplinks. G0/1 to DS1 is the root port, and G0/2 to DS2 receives better BPDUs from DS2 than SW5 would send on that link. Rapid PVST+ is running. Which role does G0/2 take?
Correct answer: B. Alternate, a discarding port with another path to the root
An alternate port receives a better BPDU from another switch and offers a second path to the root, so it stays discarding until the root port fails. A backup port appears only when a switch has two ports on the same segment, and it backs up that switch's own designated port.
An alternate port receives a better BPDU from another switch and offers a second path to the root, so it stays discarding until the root port fails. A backup port appears only when a switch has two ports on the same segment, and it backs up that switch's own designated port.
Question 50IP Connectivity
An engineer at Brightpath Telecom adds router-id 9.9.9.9 under router ospf 1 on a router that has run OSPF for weeks with router ID 10.1.1.1. IOS accepts the command, but show ip ospf still reports 10.1.1.1. What must the engineer do for the new router ID to take effect?
Correct answer: C. Run clear ip ospf process, or reload the router
When the router ID changes on a running OSPF process, IOS keeps the old ID until the process restarts through clear ip ospf process or a reload. A loopback is not needed, because a configured router-id already takes priority over every interface address.
When the router ID changes on a running OSPF process, IOS keeps the old ID until the process restarts through clear ip ospf process or a reload. A loopback is not needed, because a configured router-id already takes priority over every interface address.
Question 51Security Fundamentals
An engineer at Redfield Packaging enters access-list 150 permit 10.8.0.0 0.0.255.255 to build a simple source-only filter, and IOS rejects the command. What is the cause?
Correct answer: D. ACL 150 is extended, so it needs a protocol and a destination
Standard numbered ACLs use 1 to 99 and 1300 to 1999, while 100 to 199 and 2000 to 2699 are extended and require a protocol, source, and destination. The wildcard 0.0.255.255 is correct for a /16, so the mask is not the problem.
Standard numbered ACLs use 1 to 99 and 1300 to 1999, while 100 to 199 and 2000 to 2699 are extended and require a protocol, source, and destination. The wildcard 0.0.255.255 is correct for a /16, so the mask is not the problem.
Question 52Network Fundamentals
Saltmarsh Retail sees website traffic triple during holiday sales and then drop back. Leadership does not want to buy servers that sit idle most of the year. Which cloud characteristic best addresses this?
Correct answer: C. Rapid elasticity with pay-per-use billing
Cloud services can scale resources up for a spike and back down afterward, and the company pays only for what it uses. With on-premises hardware, the company must buy enough servers for the peak, and they sit idle the rest of the year. Reserving fixed capacity in advance has the same waste problem.
Cloud services can scale resources up for a spike and back down afterward, and the company pays only for what it uses. With on-premises hardware, the company must buy enough servers for the peak, and they sit idle the rest of the year. Reserving fixed capacity in advance has the same waste problem.
Question 53Network Access
An engineer at Redwood Analytics wants SW1 to win the root election for VLAN 20 and enters spanning-tree vlan 20 priority 5000. The switch rejects the command. What is the reason?
Correct answer: B. The priority must be a multiple of 4096
With the extended system ID, the configurable priority must be a multiple of 4096, from 0 to 61440. The switch adds the VLAN ID on its own, so the engineer should not include it in the configured value.
With the extended system ID, the configurable priority must be a multiple of 4096, from 0 to 61440. The switch adds the VLAN ID on its own, so the engineer should not include it in the configured value.
Question 54IP Connectivity
From R1 at Ashford Legal, a standard ping to server 10.60.1.10 succeeds. Users on the R1 LAN 192.168.30.0/24 cannot reach the server, and an extended ping from R1 sourced from its LAN interface 192.168.30.1 fails. What is the most likely cause?
Correct answer: C. The remote router has no return route to 192.168.30.0/24
A standard ping uses the exit interface address as its source, while the extended ping uses 192.168.30.1, so only the second test depends on a return path to the LAN subnet. The first ping proves that R1 has a route to the server and that the server can reply off its own subnet, which points to a missing return route for 192.168.30.0/24.
A standard ping uses the exit interface address as its source, while the extended ping uses 192.168.30.1, so only the second test depends on a return path to the LAN subnet. The first ping proves that R1 has a route to the server and that the server can reply off its own subnet, which points to a missing return route for 192.168.30.0/24.
Question 55IP Services
The security team at Granite Ridge Bank requires that SNMP messages from routers be authenticated and that their contents be encrypted. Community strings alone are not allowed. Which configuration meets this requirement?
Correct answer: A. SNMPv3 at the authPriv security level
SNMPv3 authPriv uses user-based authentication and also encrypts the payload, which meets both requirements. The authNoPriv level authenticates messages but still sends their contents in clear text. SNMPv2c relies on community strings and offers no encryption.
SNMPv3 authPriv uses user-based authentication and also encrypts the payload, which meets both requirements. The authNoPriv level authenticates messages but still sends their contents in clear text. SNMPv2c relies on community strings and offers no encryption.
Question 56Automation & Programmability
A script at Quarry Lane Bank sends a GET to https://controller.example.com/api/v1/network-device/7f3a-01 with a valid token and receives HTTP 404. Other device IDs work with the same script and token. What is the MOST likely cause?
Correct answer: B. No device with that ID exists at the requested URI
A 404 Not Found means the server could not find a resource at that URI, so the device ID is wrong or the device was removed. An expired token would return 401, and the same token still works for other device IDs.
A 404 Not Found means the server could not find a resource at that URI, so the device ID is wrong or the device was removed. An expired token would return 401, and the same token still works for other device IDs.
Question 57Security Fundamentals
At Summit Freight, extended ACL 120 denies traffic from the LAN 10.30.0.0/24 to a server and ends with permit ip any any. It is applied with ip access-group 120 out on G0/0, the router interface that connects to that LAN. LAN hosts can still reach the server. Why?
Correct answer: A. Traffic from the LAN enters G0/0, so the ACL should be applied inbound
Packets from the LAN arrive on G0/0, so an ACL applied outbound there only sees traffic leaving toward the LAN and never matches the LAN as a source. Applying it with ip access-group 120 in on G0/0 filters the traffic as it enters, which also fits the rule of placing extended ACLs near the source.
Packets from the LAN arrive on G0/0, so an ACL applied outbound there only sees traffic leaving toward the LAN and never matches the LAN as a source. Applying it with ip access-group 120 in on G0/0 filters the traffic as it enters, which also fits the rule of placing extended ACLs near the source.
Question 58Network Fundamentals
Dunmore Library wants to move its staff Wi-Fi off WPA2-Personal because an attacker can capture the handshake and run offline dictionary attacks against the passphrase. Which WPA3 feature addresses this weakness?
Correct answer: C. Simultaneous Authentication of Equals
WPA3-Personal replaces the WPA2 pre-shared key exchange with SAE, which resists offline dictionary attacks even when the handshake is captured. WPA2-Personal with AES-CCMP still uses a four-way handshake that attackers can capture and attack offline. TKIP and WEP are older and weaker.
WPA3-Personal replaces the WPA2 pre-shared key exchange with SAE, which resists offline dictionary attacks even when the handshake is captured. WPA2-Personal with AES-CCMP still uses a four-way handshake that attackers can capture and attack offline. TKIP and WEP are older and weaker.
Question 59Network Access
Non-root switches SW2 and SW3 at Bluewater Port connect to each other on G0/3, and both have a root path cost of 4. SW2 has bridge ID 32769.0011.2222.3333 and SW3 has bridge ID 32769.0011.2222.4444. Which port becomes the designated port on the link between them?
Correct answer: D. SW2 G0/3, because SW2 has the lower bridge ID
When both switches advertise the same root path cost onto a segment, the switch with the lower bridge ID provides the designated port. SW3's port receives the better BPDU and becomes a discarding alternate port. Two designated ports on one link would create a loop, so STP never allows it.
When both switches advertise the same root path cost onto a segment, the switch with the lower bridge ID provides the designated port. SW3's port receives the better BPDU and becomes a discarding alternate port. Two designated ports on one link would create a loop, so STP never allows it.
Question 60IP Connectivity
An engineer at Sagebrush Health wants OSPF process 10 to run in area 0 on G0/1 only, without writing any network statements. The router ospf 10 process already exists. Which configuration accomplishes this?
Correct answer: D. ip ospf 10 area 0 under interface GigabitEthernet0/1
The interface command ip ospf followed by the process ID and area enables OSPF directly on that interface, with no network statement needed. The command must include the process ID, so ip ospf area 0 by itself is not valid.
The interface command ip ospf followed by the process ID and area enables OSPF directly on that interface, with no network statement needed. The command must include the process ID, so ip ospf area 0 by itself is not valid.
Question 61IP Connectivity
An engineer at Lindenwood Insurance enters ip route 10.50.0.0 255.255.0.0 172.16.9.2 on R1. R1 has interfaces in 172.16.8.0/24 and 10.1.1.0/24, no default route, and no routing protocol advertises 172.16.9.0. Why does the static route not appear in show ip route?
Correct answer: A. R1 cannot resolve the next hop 172.16.9.2 through any existing route
IOS installs a next-hop static route only when it can reach the next hop through another route, and 172.16.9.2 is outside 172.16.8.0/24. Static routes do appear in the routing table with code S, and the permanent keyword only keeps a route installed when its interface goes down.
IOS installs a next-hop static route only when it can reach the next hop through another route, and 172.16.9.2 is outside 172.16.8.0/24. Static routes do appear in the routing table with code S, and the permanent keyword only keeps a route installed when its interface goes down.
Question 62Network Fundamentals
A wireless engineer at Elmwood Hospital moves most clients from 2.4 GHz to 5 GHz to gain more non-overlapping channels. Which trade-off should the engineer plan for?
Correct answer: B. Smaller cell size, so more APs may be needed
Higher-frequency 5 GHz signals lose more strength over distance and through walls than 2.4 GHz signals at the same power. That means smaller cells, so a 5 GHz design often needs more APs. The 5 GHz band offers many more non-overlapping channels than the three available in 2.4 GHz.
Higher-frequency 5 GHz signals lose more strength over distance and through walls than 2.4 GHz signals at the same power. That means smaller cells, so a 5 GHz design often needs more APs. The 5 GHz band offers many more non-overlapping channels than the three available in 2.4 GHz.
Question 63Network Access
At Juniper Ridge School, an engineer applies spanning-tree bpdufilter enable directly to access port G1/0/9. Later, a teacher connects a small switch to G1/0/9 and also cables that switch to another wall jack on the same access switch, and a broadcast storm starts. Why did STP fail to block the loop?
Correct answer: D. The port neither sends nor processes BPDUs, so STP is off there
With BPDU filter enabled on an interface, the port stops sending BPDUs and ignores any it receives, which disables STP on that port, so the loop is never detected. BPDU guard, not BPDU filter, is the feature that would have err-disabled the port.
With BPDU filter enabled on an interface, the port stops sending BPDUs and ignores any it receives, which disables STP on that port, so the loop is never detected. BPDU guard, not BPDU filter, is the feature that would have err-disabled the port.
Question 64Security Fundamentals
An inbound extended ACL on a branch LAN interface at Crestview Realty contains only access-list 130 permit tcp 10.40.0.0 0.0.0.255 any eq 443. Users can open websites by IP address but not by name. What is the cause?
Correct answer: C. DNS uses UDP port 53, which hits the implicit deny
Every ACL ends with an implicit deny, so any traffic not explicitly permitted, including DNS queries on UDP port 53, is dropped. Return HTTPS traffic leaves the LAN interface outbound, so an inbound ACL there does not need an entry for it.
Every ACL ends with an implicit deny, so any traffic not explicitly permitted, including DNS queries on UDP port 53, is dropped. Return HTTPS traffic leaves the LAN interface outbound, so an inbound ACL there does not need an entry for it.
Question 65IP Services
While reviewing logs at Elmwood Hospital, an engineer sees %LINEPROTO-5-UPDOWN: Line protocol on Interface Gi0/2, changed state to down. What severity name matches the number in this message?
Correct answer: B. Notifications
The number between the facility and the mnemonic is the severity, and level 5 is notifications, meaning a normal but significant condition. Informational is level 6, which is one step less severe.
The number between the facility and the mnemonic is the severity, and level 5 is notifications, meaning a normal but significant condition. Informational is level 6, which is one step less severe.
Question 66Automation & Programmability
Tidewater Freight wants to define its cloud VPCs, subnets and firewall rules in files that describe the desired end state. Before each change, the tool should compare those files with a record of what it already built and show a plan of the exact changes. Which tool fits BEST?
Correct answer: C. Terraform
Terraform is a declarative infrastructure as code tool that keeps a state file of what it manages, compares it with the desired configuration and shows a plan before applying changes. Ansible can also provision cloud resources, but it runs ordered tasks from playbooks and does not keep a state file of what it built.
Terraform is a declarative infrastructure as code tool that keeps a state file of what it manages, compares it with the desired configuration and shows a plan before applying changes. Ansible can also provision cloud resources, but it runs ordered tasks from playbooks and does not keep a state file of what it built.
Question 67IP Connectivity
R1 at Ironwood Mining reaches 192.168.70.0/24 on the 1 Gbps G0/2 LAN of R3. Path A runs from R1 to R2 over a 100 Mbps link, then from R2 to R3 over a 10 Mbps link. Path B runs directly from R1 to R3 over a 1.544 Mbps serial link. All routers use the default reference bandwidth and no manual costs. Which route does R1 install?
Correct answer: A. A cost of 12 through R2
OSPF adds the cost of each outgoing interface on the path, using 100 Mbps divided by the interface bandwidth. Path A costs 1 + 10 + 1 = 12, including the LAN interface on R3, while Path B costs 64 + 1 = 65. A cost of 11 forgets to add the cost of the destination LAN interface.
OSPF adds the cost of each outgoing interface on the path, using 100 Mbps divided by the interface bandwidth. Path A costs 1 + 10 + 1 = 12, including the LAN interface on R3, while Path B costs 64 + 1 = 65. A cost of 11 forgets to add the cost of the destination LAN interface.
Question 68Network Fundamentals
A user at Fairhaven Legal cannot reach any network resources. Running ipconfig on the Windows laptop shows IPv4 address 169.254.88.14 with mask 255.255.0.0. What does this most likely indicate?
Correct answer: B. No DHCP server answered the laptop's request
Windows assigns itself an APIPA address from 169.254.0.0/16 when it cannot get a lease from a DHCP server. That points to a DHCP server, relay or connectivity problem. A wrong DNS server would break name resolution, but the laptop would still have a normal DHCP-assigned address.
Windows assigns itself an APIPA address from 169.254.0.0/16 when it cannot get a lease from a DHCP server. That points to a DHCP server, relay or connectivity problem. A wrong DNS server would break name resolution, but the laptop would still have a normal DHCP-assigned address.
Question 69Network Access
At Stonebridge Steel, a fiber link fault lets SW2 keep sending to SW1, but SW2 no longer receives BPDUs from SW1. SW2's port on that link was an alternate port. The engineer wants such a port to stay blocked instead of moving to forwarding when BPDUs stop. Which feature should be enabled?
Correct answer: A. Loop guard, which puts the port in loop-inconsistent state
Loop guard watches root and alternate ports, and if expected BPDUs stop arriving, it blocks the port as loop-inconsistent instead of letting it become designated. Root guard reacts to superior BPDUs, not missing ones, so it would not catch this failure.
Loop guard watches root and alternate ports, and if expected BPDUs stop arriving, it blocks the port as loop-inconsistent instead of letting it become designated. Root guard reacts to superior BPDUs, not missing ones, so it would not catch this failure.
Question 70Security Fundamentals
Only hosts in the admin subnet 10.99.1.0/24 at Larkspur Media may open SSH sessions to a router. The engineer created standard ACL 15 permitting that subnet. Which command applies it correctly?
Correct answer: C. access-class 15 in under line vty 0 15
The access-class command filters connections to the vty lines, and the in keyword checks the source address of incoming sessions. The ip access-group command applies an ACL to interfaces, not lines, and on interfaces it would filter all traffic, not just management sessions.
The access-class command filters connections to the vty lines, and the in keyword checks the source address of incoming sessions. The ip access-group command applies an ACL to interfaces, not lines, and on interfaces it would filter all traffic, not just management sessions.
Question 71IP Connectivity
At Crescent Hotels, R1 (10.1.1.2) and R2 (10.1.1.3) run HSRP group 5 with virtual IP 10.1.1.1. Both routers keep the default priority, neither has preempt configured, and they come online at the same time. Which router becomes active?
Correct answer: B. R2, because it has the higher interface IP address
When HSRP priorities are equal, the router with the highest IP address on the HSRP interface becomes active. Lowest-value tie-breakers apply to other protocols such as STP bridge IDs, and HSRP never makes two routers active in the same group.
When HSRP priorities are equal, the router with the highest IP address on the HSRP interface becomes active. Lowest-value tie-breakers apply to other protocols such as STP bridge IDs, and HSRP never makes two routers active in the same group.
Question 72Network Fundamentals
A development team at Brightwater Software wants to run dozens of microservices on one server. Compared with virtual machines, why are containers lighter and faster to start?
Correct answer: D. Containers share the host operating system kernel
Containers package an application and its dependencies but share the host OS kernel, so they avoid booting a separate operating system. Virtual machines each run a full guest OS on a hypervisor, which uses more memory and takes longer to start. A container engine runs on a host OS, not directly on a Type 1 hypervisor.
Containers package an application and its dependencies but share the host OS kernel, so they avoid booting a separate operating system. Virtual machines each run a full guest OS on a hypervisor, which uses more memory and takes longer to start. A container engine runs on a host OS, not directly on a Type 1 hypervisor.
Question 73Network Access
A wireless engineer at Hollis Aerospace needs to capture all 802.11 frames on channel 36 in one area and send them to a laptop running Wireshark. Which mode should the lightweight AP in that area use?
Correct answer: A. Sniffer, which sends captured frames to a remote analyzer
Sniffer mode captures 802.11 frames on a chosen channel and forwards them to a remote device running a tool such as Wireshark. Monitor mode also stops serving clients, but it scans for rogues and intrusions instead of streaming captures to an analyzer.
Sniffer mode captures 802.11 frames on a chosen channel and forwards them to a remote device running a tool such as Wireshark. Monitor mode also stops serving clients, but it scans for rogues and intrusions instead of streaming captures to an analyzer.
Question 74IP Connectivity
On R2 at Lakeshore Transit, show ip ospf neighbor includes the line 3.3.3.3 1 FULL/BDR 00:00:36 10.0.23.3 GigabitEthernet0/1. Which statement is correct?
Correct answer: B. 3.3.3.3 is the neighbor's router ID and 10.0.23.3 is its interface address
The Neighbor ID column shows the neighbor's router ID, and the Address column shows the IP address of the neighbor's interface on the shared link. FULL/BDR describes the neighbor's role, so 3.3.3.3 is the BDR, and 00:00:36 is the dead timer counting down, not the adjacency uptime.
The Neighbor ID column shows the neighbor's router ID, and the Address column shows the IP address of the neighbor's interface on the shared link. FULL/BDR describes the neighbor's role, so 3.3.3.3 is the BDR, and 00:00:36 is the dead timer counting down, not the adjacency uptime.
Question 75IP Services
Tidewater Shipping buys a 50 Mbps CIR delivered on a 1 Gbps Ethernet handoff, and the provider drops anything above 50 Mbps. The engineer wants the customer router to hold bursts and send them within the contract rate instead of losing them at the provider. What should be configured?
Correct answer: D. Shaping on the router's outbound WAN interface
Shaping buffers traffic that exceeds the configured rate and sends it later, which smooths bursts to fit the CIR. Policing drops or re-marks excess traffic right away, so policing on the customer side would cause the same loss the provider causes. Shaping is applied outbound on the interface toward the provider.
Shaping buffers traffic that exceeds the configured rate and sends it later, which smooths bursts to fit the CIR. Policing drops or re-marks excess traffic right away, so policing on the customer side would cause the same loss the provider causes. Shaping is applied outbound on the interface toward the provider.
Question 76Automation & Programmability
Which statement BEST describes how Puppet and Chef typically manage nodes?
Correct answer: D. An agent on each node checks in with a server and pulls its configuration
Puppet and Chef traditionally use an agent on each managed node that periodically contacts a central server and pulls the configuration it should enforce. Pushing tasks over SSH with no installed software describes the agentless model that Ansible uses.
Puppet and Chef traditionally use an agent on each managed node that periodically contacts a central server and pulls the configuration it should enforce. Pushing tasks over SSH with no installed software describes the agentless model that Ansible uses.
Question 77Security Fundamentals
An engineer at Fernhill Grocers enters ip dhcp snooping globally and ip dhcp snooping trust on the uplink. Clients in VLAN 20 still receive offers from a rogue DHCP server on an access port. What was missed?
Correct answer: A. ip dhcp snooping vlan 20 in global configuration
DHCP snooping does nothing until it is enabled for specific VLANs with ip dhcp snooping vlan, even if the global command and trusted ports are configured. Dynamic ARP inspection is a separate feature that relies on snooping but does not filter DHCP messages itself.
DHCP snooping does nothing until it is enabled for specific VLANs with ip dhcp snooping vlan, even if the global command and trusted ports are configured. Dynamic ARP inspection is a separate feature that relies on snooping but does not filter DHCP messages itself.
Question 78Network Fundamentals
At Coral Bay Marine, PC1 and PC2 connect to a small hub, and the hub connects to switch port Fa0/3. The switch has already learned both PCs on Fa0/3. When PC1 sends a unicast frame to PC2, what does the switch do?
Correct answer: C. Discards it, since PC2 is on the same port
When the destination MAC is mapped to the same port the frame arrived on, the switch filters the frame and does not forward it. PC2 already received the frame through the hub, so sending it back would only duplicate it. Flooding happens only for unknown unicast, broadcast and multicast frames.
When the destination MAC is mapped to the same port the frame arrived on, the switch filters the frame and does not forward it. PC2 already received the frame through the hub, so sending it back would only duplicate it. Flooding happens only for unknown unicast, broadcast and multicast frames.
Question 79Network Access
Tandem Coffee is opening 45 small cafes and wants to manage every AP from a web dashboard. It does not want to install a WLC at headquarters or in any cafe. Which wireless architecture fits this requirement?
Correct answer: A. Cloud-managed APs that are configured from an online dashboard
Cloud-managed APs, such as Cisco Meraki, are configured and monitored from a cloud dashboard, so no WLC is needed on site or at headquarters. Autonomous APs also avoid a WLC, but each one is managed individually, so there is no central dashboard.
Cloud-managed APs, such as Cisco Meraki, are configured and monitored from a cloud dashboard, so no WLC is needed on site or at headquarters. Autonomous APs also avoid a WLC, but each one is managed individually, so there is no central dashboard.
Question 80IP Connectivity
Ironbridge Retail runs Cisco routers at headquarters and another vendor's routers at its branches. The team needs gateway redundancy on a branch user VLAN using an open standard protocol that both vendors support. Which protocol should they choose?
Correct answer: B. VRRP
VRRP is an IETF standard, so routers from different vendors can share one virtual gateway address. HSRP in both versions and GLBP are Cisco proprietary, so they will not work with another vendor's routers.
VRRP is an IETF standard, so routers from different vendors can share one virtual gateway address. HSRP in both versions and GLBP are Cisco proprietary, so they will not work with another vendor's routers.
Question 81IP Connectivity
An engineer at Juniper Ridge Labs builds an IPv6-only router with no IPv4 addresses on any interface. ipv6 unicast-routing is enabled, ipv6 router ospf 1 exists, and ipv6 ospf 1 area 0 is applied to the interfaces, but OSPFv3 does not start. What is the fix?
Correct answer: B. Set a 32-bit router-id, such as 1.1.1.1, under ipv6 router ospf 1
OSPFv3 still uses a 32-bit router ID in dotted decimal format, and it can only choose one automatically from an IPv4 address. On a router with no IPv4 addresses, the router ID must be set manually under ipv6 router ospf 1. An IPv6 loopback does not help, because OSPFv3 never uses a 128-bit router ID.
OSPFv3 still uses a 32-bit router ID in dotted decimal format, and it can only choose one automatically from an IPv4 address. On a router with no IPv4 addresses, the router ID must be set manually under ipv6 router ospf 1. An IPv6 loopback does not help, because OSPFv3 never uses a 128-bit router ID.
Question 82Network Fundamentals
A printer at Westbrook Realty sends no traffic for 10 minutes. The access switch uses the default Cisco IOS MAC aging time. What happens to the printer's dynamic MAC address table entry?
Correct answer: C. It ages out after the default 300 seconds
Cisco IOS removes a dynamic MAC entry when no frames with that source address arrive within the aging time, which defaults to 300 seconds. After 10 minutes of silence the entry is gone, so frames sent to the printer are flooded until it transmits again. Aging is enabled by default for dynamic entries, and only static entries stay until removed.
Cisco IOS removes a dynamic MAC entry when no frames with that source address arrive within the aging time, which defaults to 300 seconds. After 10 minutes of silence the entry is gone, so frames sent to the printer are flooded until it transmits again. Aging is enabled by default for dynamic entries, and only static entries stay until removed.
Question 83Network Access
Ashford Legal allows its core switch to be managed through the web GUI, but the security team requires every GUI session to be encrypted. Which pair of global commands meets this requirement?
Correct answer: B. ip http secure-server and no ip http server
The ip http secure-server command enables HTTPS, and no ip http server turns off plain HTTP, so only encrypted GUI sessions are possible. The transport input ssh command applies only to VTY lines and has no effect on the web server.
The ip http secure-server command enables HTTPS, and no ip http server turns off plain HTTP, so only encrypted GUI sessions are possible. The transport input ssh command applies only to VTY lines and has no effect on the web server.
Question 84Security Fundamentals
Port G1/0/12 at Brookside Pharmacy is in the err-disabled state after a port security violation in the default mode. The unauthorized device has been removed. What is the manual way to restore the port?
Correct answer: D. Enter shutdown and then no shutdown on the interface
Shutdown mode, the default, puts the port in err-disabled state, and it stays there until an administrator enters shutdown followed by no shutdown or errdisable recovery is configured. Automatic recovery is disabled by default, so waiting alone will not bring the port back.
Shutdown mode, the default, puts the port in err-disabled state, and it stays there until an administrator enters shutdown followed by no shutdown or errdisable recovery is configured. Automatic recovery is disabled by default, so waiting alone will not bring the port back.
Question 85IP Services
At Orchard Valley Schools, calls break up whenever nightly backups saturate the WAN link, even though voice packets are already marked EF. The engineer wants voice sent ahead of all other traffic without letting it starve the other classes. Which queuing method fits best?
Correct answer: A. LLQ, a strict priority queue with a policed bandwidth limit
Low latency queuing adds a strict priority queue to CBWFQ, so voice is always serviced first, and the priority rate is policed during congestion to protect other classes. CBWFQ alone guarantees bandwidth, but voice still waits its turn behind other queues, which adds delay and jitter.
Low latency queuing adds a strict priority queue to CBWFQ, so voice is always serviced first, and the priority rate is policed during congestion to protect other classes. CBWFQ alone guarantees bandwidth, but voice still waits its turn behind other queues, which adds delay and jitter.
Question 86Automation & Programmability
A controller API returns this JSON: {"site": "HQ", "interfaces": [{"name": "Gi1/0/1", "up": true}, {"name": "Gi1/0/2", "up": false}]}. How is the value of the interfaces key structured?
Correct answer: C. An array that contains two objects
Square brackets mark an array, and each item inside it is an object enclosed in curly braces with its own key-value pairs. So interfaces is an array holding two interface objects, not an object holding arrays.
Square brackets mark an array, and each item inside it is an object enclosed in curly braces with its own key-value pairs. So interfaces is an array holding two interface objects, not an object holding arrays.
Question 87IP Connectivity
Hosts on a VLAN at Silverline Accounting use 10.30.0.1 on router R1 as their only default gateway. A second router, R2, is connected to the same VLAN, but when R1 fails the hosts lose access to other networks. What is the BEST way to fix this?
Correct answer: A. Run an FHRP such as HSRP so R1 and R2 share a virtual gateway IP
An FHRP gives the hosts one virtual gateway address that moves to the standby router when the active router fails, with no change on the hosts. Extra gateway entries are not reliably used for failover by most host operating systems, and running a routing protocol on hosts is not a practical design.
An FHRP gives the hosts one virtual gateway address that moves to the standby router when the active router fails, with no change on the hosts. Extra gateway entries are not reliably used for failover by most host operating systems, and running a routing protocol on hosts is not a practical design.
Question 88Network Fundamentals
Bayside Packaging has 12 VLANs on its campus and wants inter-VLAN routing at wire speed without sending traffic to an external router. Which device and feature should the engineer use?
Correct answer: D. A Layer 3 switch with SVIs for each VLAN
A Layer 3 switch routes between VLANs using switched virtual interfaces, and it does so in hardware at wire speed. A Layer 2 switch with a trunk can carry the VLANs, but something else must still route between them, such as a router on a stick. A WLC maps SSIDs to VLANs but is not a campus router.
A Layer 3 switch routes between VLANs using switched virtual interfaces, and it does so in hardware at wire speed. A Layer 2 switch with a trunk can carry the VLANs, but something else must still route between them, such as a router on a stick. A WLC maps SSIDs to VLANs but is not a campus router.
Question 89Network Access
Lakemont Farms needs wireless connectivity between its main barn and a storage building 300 meters away, where running cable is not practical. It already has Cisco lightweight APs managed by a WLC. Which AP mode supports building a wireless link between the two buildings?
Correct answer: A. Bridge mode
Bridge mode (mesh) lets lightweight APs form point-to-point or point-to-multipoint wireless links between sites, which carries traffic between buildings. Sniffer mode only captures wireless frames and forwards them to a packet analyzer.
Bridge mode (mesh) lets lightweight APs form point-to-point or point-to-multipoint wireless links between sites, which carries traffic between buildings. Sniffer mode only captures wireless frames and forwards them to a packet analyzer.
Question 90IP Connectivity
At Kestrel Airlines, R6 is a DROTHER on a shared Ethernet VLAN with a DR and a BDR. R6 detects that one of its links has failed and must send a link-state update. To which destination address does R6 send that update?
Correct answer: C. 224.0.0.6, the address the DR and BDR listen on
A DROTHER sends updates to 224.0.0.6, the AllDRRouters address, so only the DR and BDR receive them. The DR then floods the update to 224.0.0.5, which every OSPF router on the segment listens to.
A DROTHER sends updates to 224.0.0.6, the AllDRRouters address, so only the DR and BDR receive them. The DR then floods the update to 224.0.0.5, which every OSPF router on the segment listens to.
Question 91Security Fundamentals
After an outage at Juniper Grove Bank, the security team needs a record of which administrator logged in to a core switch and which commands each one entered. Which AAA function provides this information?
Correct answer: D. Accounting
Accounting records what users do, such as login times and the commands they enter, and sends those records to the AAA server. Authorization decides which commands a user is allowed to run, but it does not keep a record of what was actually done.
Accounting records what users do, such as login times and the commands they enter, and sends those records to the AAA server. Authorization decides which commands a user is allowed to run, but it does not keep a record of what was actually done.
Question 92Network Fundamentals
Glenmoor Energy is deploying an intrusion prevention system that must drop packets matching known attack signatures before they reach its servers. Where must the IPS sit?
Correct answer: D. Inline in the path of the traffic
An IPS must sit inline so every packet passes through it and malicious packets can be dropped before they reach the target. A sensor on a SPAN port sees only copies of traffic, so it can alert like an IDS but cannot block the original packets. Out-of-band and log-based tools react after the traffic has already passed.
An IPS must sit inline so every packet passes through it and malicious packets can be dropped before they reach the target. A sensor on a SPAN port sees only copies of traffic, so it can alert like an IDS but cannot block the original packets. Out-of-band and log-based tools react after the traffic has already passed.
Question 93Network Access
An engineer at Larkspur University creates a WLAN in the WLC GUI with Layer 2 security set to WPA2 and Auth Key Mgmt set to 802.1X. Clients fail to authenticate, and the RADIUS server logs show no requests from the WLC. What is the most likely missing step?
Correct answer: B. Add the RADIUS server to the WLC and select it for the WLAN
With 802.1X, the WLC relays client authentication to a RADIUS server, so the server must be defined under Security, AAA, RADIUS and chosen on the WLAN's AAA Servers tab. A pre-shared key is used only when Auth Key Mgmt is set to PSK.
With 802.1X, the WLC relays client authentication to a RADIUS server, so the server must be defined under Security, AAA, RADIUS and chosen on the WLAN's AAA Servers tab. A pre-shared key is used only when Auth Key Mgmt is set to PSK.
Question 94IP Services
An engineer at Fairhaven Logistics enabled SSH on a switch, and SSH logins work. A security scan shows that the switch still accepts Telnet sessions. Which command, entered under line vty 0 15, limits remote access to SSH only?
Correct answer: C. transport input ssh
The transport input ssh command sets which protocols the vty lines accept, so Telnet connections are refused. The transport output command controls connections that users start from the switch to other devices, not inbound sessions.
The transport input ssh command sets which protocols the vty lines accept, so Telnet connections are refused. The transport output command controls connections that users start from the switch to other devices, not inbound sessions.
Question 95Automation & Programmability
A script at Ridgeback Retail calls a REST API that can return either XML or JSON. The developer wants every response in JSON so the script can parse it into Python dictionaries. What should the script include in its requests?
Correct answer: B. An Accept header set to application/json
The Accept header tells the server which media type the client wants back, so application/json asks for JSON responses. Content-Type describes the format of the body the client is sending, which matters for POST, PUT and PATCH but does not choose the response format.
The Accept header tells the server which media type the client wants back, so application/json asks for JSON responses. Content-Type describes the format of the body the client is sending, which matters for POST, PUT and PATCH but does not choose the response format.
Question 96IP Connectivity
An engineer at Northwind Studios configures IPv6 addresses on two LAN interfaces of R7 and adds a static route with the ipv6 route command. Hosts can ping their own R7 interface, but R7 does not forward IPv6 packets between the two LANs. Which command is missing?
Correct answer: C. ipv6 unicast-routing
An IOS router does not forward IPv6 packets until ipv6 unicast-routing is enabled in global configuration, even when its interfaces have IPv6 addresses. The ip routing command controls IPv4 only, and ipv6 enable just creates a link-local address on an interface.
An IOS router does not forward IPv6 packets until ipv6 unicast-routing is enabled in global configuration, even when its interfaces have IPv6 addresses. The ip routing command controls IPv4 only, and ipv6 enable just creates a link-local address on an interface.
Question 97IP Connectivity
At Northwind Shipping, show ipv6 route ospf on R1 lists 2001:db8:40::/64 via FE80::2, GigabitEthernet0/0, even though G0/0 on R2 also has the global address 2001:db8:12::2. Why does the next hop show a link-local address?
Correct answer: B. OSPFv3 uses link-local source addresses, so they become next hops
OSPFv3 sends its packets from the interface link-local address, so neighbors learn each other's link-local addresses and install them as next hops. This is normal behavior and does not mean the global address is misconfigured.
OSPFv3 sends its packets from the interface link-local address, so neighbors learn each other's link-local addresses and install them as next hops. This is normal behavior and does not mean the global address is misconfigured.
Question 98Security Fundamentals
Auditors at Penrose Health say administrator logins to network devices rely only on passwords, which can be phished or reused. The CISO wants a control that still protects the devices if a password is stolen. Which control BEST meets this goal?
Correct answer: C. Multifactor authentication for admin logins
Multifactor authentication requires a second factor, such as a token or certificate, so a stolen password alone is not enough to log in. Longer or frequently changed passwords can still be phished, and type 7 encoding is easily reversed.
Multifactor authentication requires a second factor, such as a token or certificate, so a stolen password alone is not enough to log in. Longer or frequently changed passwords can still be phished, and type 7 encoding is easily reversed.
Question 99Network Fundamentals
A technician at Lindale Middle School connects two Cisco switches with a straight-through copper cable, expecting to need a crossover cable. The link comes up normally. Which feature made this possible?
Correct answer: A. Auto-MDIX
Auto-MDIX detects the cable type and swaps the transmit and receive pairs in the port, so a straight-through cable works between like devices. Without it, switch-to-switch copper links need a crossover cable. Autonegotiation settles speed and duplex but does not swap the wire pairs.
Auto-MDIX detects the cable type and swaps the transmit and receive pairs in the port, so a straight-through cable works between like devices. Without it, switch-to-switch copper links need a crossover cable. Autonegotiation settles speed and duplex but does not swap the wire pairs.
Question 100Network Access
Oakmont Farms needs network access in a barn 400 meters from the main office without running a data cable. An AP at the office is wired to the network, and an outdoor AP at the barn has power only. Both are managed by the same WLC. Which AP mode lets them form a wireless backhaul link?
Correct answer: D. Bridge, which builds wireless point-to-point or mesh links
Bridge mode lets lightweight APs form point-to-point, point-to-multipoint, or mesh links that carry traffic between buildings without cable. FlexConnect is meant for branch sites with a wired WAN link to the WLC and does not build a wireless backhaul.
Bridge mode lets lightweight APs form point-to-point, point-to-multipoint, or mesh links that carry traffic between buildings without cable. FlexConnect is meant for branch sites with a wired WAN link to the WLC and does not build a wireless backhaul.
The real CCNA exam at a glance
100questions
2htime limit
MCQmultiple choice
80%+aim for here
Score 80% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free Networking practice tests
See all 36 free practice tests →Original practice questions written by CertOcean in the style of the CCNA exam. They are not real exam questions. CCNA and Cisco are trademarks of their owners. Real exam format: around 100 questions · 120 minutes · Cisco does not publish the passing score · the real exam also has lab items.