Step2Study

Cisco CCNA (200-301) practice questions

254 free questions with answers and explanations.

Practice test
  1. 1.A network engineer configures VRRP on two routers serving as the default gateway for VLAN 20. R1 is configured with priority 150 and R2 with the default priority. Which statement correctly describes the resulting VRRP behavior?IP Connectivity
  2. 2.A network uses EIGRP (AD 90) as its primary routing protocol. An administrator wants to configure a static backup route to the 172.20.0.0/16 network via 198.51.100.1 that is only used if the EIGRP route disappears from the routing table. Which command correctly creates this floating static route?IP Connectivity
  3. 3.A technician boots up a new laptop and connects it to a switch port, but the DHCP server on the network is unreachable. The laptop's NIC shows an IP address of 169.254.45.12. What does this address indicate?Network Fundamentals
  4. 4.An OSPF network uses the default reference bandwidth. R1 connects to R2 via a Fast Ethernet interface (100 Mbps) and R2 connects to R3 via a serial T1 interface (1544 kbps). What is the total OSPF cost from R1 to R3 across both links (rounded to the nearest whole number, using cost = reference bandwidth / interface bandwidth)?IP Connectivity
  5. 5.A technician tests a REST API call using curl to retrieve device inventory from a controller. The response returns HTTP status code 401. What does this status code indicate?Automation and Programmability
  6. 6.A network administrator configures a firewall to allow outbound HTTP requests from internal hosts but does not create any explicit inbound rule for the return traffic. Users can still browse external websites successfully. Which firewall characteristic explains this behavior?Network Fundamentals
  7. 7.R1 and R2 are connected via a serial interface configured as OSPF network type 'point-to-point' on R1's side, but R2's corresponding interface remains at the default OSPF network type for that media. The link never forms an OSPF adjacency beyond the EXSTART state. What is the most likely explanation?IP Connectivity
  8. 8.SW1's Gi0/1 trunk is configured with 'switchport trunk allowed vlan 10,20,30'. The administrator wants VLAN 40 to also be permitted across the trunk without removing VLANs 10, 20, or 30. Which command accomplishes this?Network Access
  9. 9.A network engineer wants to configure a single summary static route on a core router to represent the four contiguous subnets 192.168.32.0/24, 192.168.33.0/24, 192.168.34.0/24, and 192.168.35.0/24. Which summary route correctly covers exactly these four networks with no additional address space?Network Fundamentals
  10. 10.A network administrator needs to configure a default route on an IPv4 router so that any traffic without a more specific match is forwarded to next-hop address 203.0.113.1. Which command accomplishes this?IP Connectivity
  11. 11.A switch shows the following partial 'show etherchannel summary' output for Port-channel1 using LACP: Po1(SU) LACP Gi0/1(P) Gi0/2(P) Gi0/3(D) Gi0/1 and Gi0/2 are actively passing traffic in the bundle, but Gi0/3 shows flag 'D' and is not forwarding as part of the channel. What most likely explains Gi0/3's status?Network Access
  12. 12.An administrator has enabled port security on interface GigabitEthernet0/5 with 'switchport port-security' and set the maximum to 1. The administrator wants the switch to dynamically learn the connected device's MAC address and automatically add it to the running configuration so it survives a reload if the config is saved. Which command accomplishes this?Security Fundamentals
  13. 13.A service provider deploys an AI/ML-based network operations platform that continuously analyzes historical bandwidth utilization trends across WAN links. The platform proactively alerts engineers weeks in advance that a specific link is projected to exceed 90% utilization, allowing capacity to be upgraded before congestion occurs. Which AIOps capability does this scenario best illustrate?Automation and Programmability
  14. 14.A network administrator is designing an IPsec VPN and must choose a security protocol that provides both encryption and authentication of the packet payload, as opposed to a protocol that only provides authentication and integrity without encryption. Which IPsec protocol should be selected?Security Fundamentals
  15. 15.A network administrator receives documentation stating a subnet mask of /21 for a newly assigned network. Which subnet mask in dotted-decimal notation corresponds to this CIDR value?Network Fundamentals
  16. 16.A router is configured with 'router ospf 1', 'network 192.168.5.0 0.0.0.255 area 0', and 'passive-interface GigabitEthernet0/1', where Gi0/1 is in the 192.168.5.0/24 subnet. What is the effect of the passive-interface command on this interface?IP Connectivity
  17. 17.A network engineer must add a switch that is a mix of Cisco and third-party (non-Cisco) equipment and wants to view neighbor device information (platform, port ID, capabilities) from the non-Cisco devices as well as the Cisco ones. Which protocol should be enabled to accomplish this on the non-Cisco devices?Network Access
  18. 18.R1 and R2 are directly connected via a serial link running OSPF. Their neighbor state is stuck in EXSTART/EXCHANGE and never progresses to FULL. A technician checks the interfaces and finds R1's serial interface MTU is 1500 bytes while R2's is set to 1400 bytes. What is the most likely cause of the stuck adjacency, and how can it be resolved?IP Connectivity
  19. 19.A company wants to run multiple isolated operating systems directly on server hardware for maximum performance, without installing a host operating system first. Which virtualization approach should be used?Network Fundamentals
  20. 20.During the AP join process to a WLC, the lightweight access point must establish a CAPWAP tunnel to send control messages and another to send encapsulated client data. Which UDP port numbers does CAPWAP use for the control and data channels, respectively?Network Access
  21. 21.A campus network designer wants every core switch to have a direct physical connection to every other core switch, maximizing redundancy so a single link failure cannot isolate any device. Which topology describes this design?Network Fundamentals
  22. 22.On a multi-access OSPF segment, R3 shows a neighbor state of '2WAY/DROTHER' for R4. Both routers are non-DR/BDR neighbors on the same broadcast network. What does this indicate about the network?IP Connectivity
  23. 23.A network technician needs to connect two Cisco switches directly using a standard Gigabit Ethernet copper cable without relying on Auto-MDIX. Which cable type should the technician use to guarantee connectivity?Network Fundamentals
  24. 24.A router is configured with the following under the VTY lines: aaa authentication login VTY_AUTH group TACACS+ local line vty 0 4 login authentication VTY_AUTH If all configured TACACS+ servers become unreachable, what will happen when an administrator attempts to log in via SSH?Security Fundamentals
  25. 25.Three Rapid PVST+ switches (SW1, SW2, SW3) form a triangle for VLAN 10. SW1 is elected root. SW2 and SW3 each connect directly to SW1 and also to each other. After convergence, the port on SW3 facing SW2 has a higher root path cost than the port on SW2 facing SW3. Which RSTP role and port state will the SW3-to-SW2 port settle into?Network Access
  26. 26.A data center architect is designing a new fabric and wants every leaf switch to be exactly two hops from every other leaf switch, ensuring predictable and consistent latency across the fabric. Which topology should be implemented?Network Fundamentals
  27. 27.A network administrator is installing a wireless access point that requires up to 25.5 W of power delivered over its Ethernet cable. Which PoE standard provides sufficient power for this device?Network Fundamentals
  28. 28.A wireless engineer configures an access point to use 40 MHz channel bonding in the 5 GHz band to increase throughput. What is a direct consequence of this configuration?Network Fundamentals
  29. 29.A router's routing table contains the following entries: 10.1.0.0/16, 10.1.1.0/24, and 10.1.1.128/25, each via a different next hop. A packet arrives destined for 10.1.1.130. Which route will the router use to forward this packet?IP Connectivity
  30. 30.A developer examines a JSON payload returned from a controller API and sees the following field: "vlan_ids": [10, 20, 30] What JSON data type is used to represent "vlan_ids"?Automation and Programmability
  31. 31.An automation engineer is writing a script that calls a REST API to update the description field on an existing interface object without replacing the entire resource. Which HTTP method is most appropriate for a partial update?Automation and Programmability
  32. 32.A network engineer wants a switch to remember which DHCP-assigned IP-to-MAC-to-VLAN-to-interface mappings are valid so that Dynamic ARP Inspection can validate future ARP packets. Where is this dynamically-learned information stored?Security Fundamentals
  33. 33.An engineer configures 'enable secret Cisco123' on a router that already has 'enable password Cisco123' configured. A colleague later runs 'show running-config' and notices the enable password line is still readable in plaintext even though 'service password-encryption' is enabled. Which statement explains this scenario?Security Fundamentals
  34. 34.Two routers, R1 and R2, run HSRP for the 10.10.10.0/24 VLAN. R1 has priority 150 and is currently Active. R2 has priority 100 with default preempt settings. R1 experiences an interface failure and recovers a few minutes later. What will happen to the Active role after R1 recovers?IP Connectivity
  35. 35.A company wants to automate configuration of 200 switches using a tool that does not require installing any agent software on the managed devices and instead connects over SSH to push changes. Which automation tool best fits this description?Automation and Programmability
  36. 36.An engineer runs an Ansible playbook containing the following task against Cisco IOS switches: - name: Create VLAN 10 cisco.ios.ios_vlans: config: - vlan_id: 10 name: SALES state: merged What is the effect of setting 'state: merged' in this task?Automation and Programmability
  37. 37.A security team is comparing AAA protocols for network device administration. They require an option that encrypts the entire packet payload (not just the password) and uses TCP for reliable delivery. Which protocol meets this requirement?Security Fundamentals
  38. 38.A switch port is configured with 'switchport port-security violation restrict' and a maximum of 2 MAC addresses. A third unauthorized device sends traffic on the port. What is the result?Security Fundamentals
  39. 39.A syslog message '%CDP-4-NATIVE_VLAN_MISMATCH' appears on SW1's Gi0/1 trunk to SW2. CDP shows SW1's native VLAN as 1 while SW2's native VLAN on the matching port is 99. The trunk remains up and passes tagged traffic normally. What is the primary security/operational risk this mismatch creates?Network Access
  40. 40.Employees frequently travel and need secure encrypted access to internal company resources from any internet-connected location using a software client installed on their laptops. A permanent tunnel between fixed sites is not required. Which VPN type best meets this requirement?Security Fundamentals
  41. 41.A host has the MAC address 00:1A:2B:3C:4D:5E and receives the IPv6 prefix 2001:DB8:ACAD:1::/64 via SLAAC. Using the EUI-64 process, what is the resulting IPv6 address?Network Fundamentals
  42. 42.A network administrator configures a router so that multiple internal hosts share a single public IPv4 address for internet access, with each session distinguished by a unique source port number. Which technique is being used?Network Fundamentals
  43. 43.An administrator has enabled Dynamic ARP Inspection (DAI) on all access switches, using DHCP snooping bindings for validation. Several servers use statically configured IP addresses and never send DHCP requests, so their legitimate ARP replies are now being dropped by DAI. What should the administrator configure to permit these servers' ARP traffic while keeping DAI enforced for all DHCP clients?Security Fundamentals
  44. 44.A company implements GLBP for the 172.16.30.0/24 VLAN using four member routers. Which statement accurately describes how GLBP differs from HSRP and VRRP in this deployment?IP Connectivity
  45. 45.A router's routing table shows two entries for destination network 192.168.50.0/24: one static route with administrative distance 1 and one OSPF-learned route with administrative distance 110. A separate OSPF route also exists for 192.168.50.0/25 learned via a different path. Which route does the router use to forward a packet destined for 192.168.50.10?IP Connectivity
  46. 46.A router's routing table contains two routes learned via OSPF for the same destination network 10.20.0.0/16: one as an intra-area route (O) with metric 20, and another as an external Type 2 route (O E2) with metric 15 redistributed from another protocol. Which route will the router install and use for forwarding?IP Connectivity
  47. 47.A branch office has a single lightweight AP whose CAPWAP control connection to the central WLC traverses an unreliable WAN link. The design requirement is that wireless clients must still authenticate and pass traffic locally even if the WAN link to the WLC fails. Which AP mode meets this requirement?Network Access
  48. 48.Which extended ACL statement correctly permits only HTTPS traffic from any source to the server at 10.10.20.50?Security Fundamentals
  49. 49.A technician runs 'show ip route' on a branch router and sees the following output: C 10.1.1.0/24 is directly connected, GigabitEthernet0/1 L 10.1.1.1/32 is directly connected, GigabitEthernet0/1 O 10.2.2.0/24 [110/2] via 10.1.1.2, 00:01:12, GigabitEthernet0/1 S 0.0.0.0/0 [1/0] via 10.1.1.254 Which line represents a manually configured default route?IP Connectivity
  50. 50.A small ISP currently configures each of its 50 routers individually via console or SSH, resulting in inconsistent configurations. Management wants to adopt a controller-based architecture. What is the PRIMARY benefit this migration provides?Automation and Programmability