20 free Cisco CCNA (200-301 v2.0) practice questions

Correct answer: B · Set the PC's network card back to autonegotiation

Cisco's Ethernet autonegotiation guidance says both sides of a link must have autonegotiation on, or both must have it off, and it recommends leaving it on for compliant devices. Once the PC's card is hard-coded, it stops negotiating, so the switch port cannot learn its duplex; under the IEEE 802.3 fallback the port runs half duplex while the PC sends at full duplex. Cisco notes that in a duplex mismatch the late collisions appear on the half-duplex side, which is the switch port here. Setting the card back to autonegotiation, or hard-coding both ends identically, fixes it. A crossover cable does not change duplex, and most current ports detect the cable type themselves. Forcing the switch port to half duplex keeps the mismatch. PortFast only skips spanning-tree states when a port comes up.

Look for this next time: Rising late collisions usually point to a duplex mismatch; autonegotiate on both ends, or hard-code both ends identically.

Correct answer: D · 172.16.5.193

A /27 mask is 255.255.255.224, which leaves 5 host bits, so each subnet is a block of 2^5 = 32 addresses in the last octet: .0, .32, .64, .96, .128, .160, .192, and .224. The host's .200 falls in the block that starts at .192, so its subnet is 172.16.5.192/27. The broadcast address is .192 + 32 − 1 = .223, and the usable host range is .193 to .222. The first usable address, and so the gateway, is 172.16.5.193. The address 172.16.5.1 belongs to a different subnet, 172.16.5.0/27, so it is not on the host's segment and cannot serve as its gateway. The .223 address is this subnet's broadcast address, and .224 is the network address of the next subnet.

Look for this next time: Find the block size (256 minus the mask's last octet), locate the host's block, then use network plus one as the first usable address.

Correct answer: A · 2001:db8:acad:20:e3e:91ff:fe7a:5b2

RFC 4291 (Appendix A) builds a modified EUI-64 interface ID in two steps. First, split the 48-bit MAC in half and insert FFFE in the middle: 0C3E91 + FFFE + 7A05B2 gives 0C3E:91FF:FE7A:05B2. Second, invert the universal/local bit, the seventh bit of the first byte: 0x0C is 0000 1100, and flipping that bit gives 0000 1110, which is 0x0E. The interface ID is 0E3E:91FF:FE7A:05B2, written without leading zeros as e3e:91ff:fe7a:5b2 after the /64 prefix. The address with c3e skips the bit flip. The address with 91fe:ff7a inserts the two bytes as FEFF instead of FFFE. The address ending 917a:fffe:5b2 inserts FFFE after the fourth byte instead of the third, splitting the MAC in the wrong place.

Look for this next time: Modified EUI-64: insert FFFE between the MAC's two halves, then flip the seventh bit of the first byte.

Correct answer: C · Channels 1, 6, and 11, one per access point

Cisco's wireless design guidance names 1, 6, and 11 as the only nonoverlapping 2.4 GHz channels in the United States, and its RF channel guidance says to use those three for neighboring access points. Giving each AP a different one of channels 1, 6, and 11 avoids both kinds of interference. Channel centers in this band are only 5 MHz apart, while each channel is about 20 MHz wide. Channels 1, 2, and 3 therefore overlap heavily, and channels 1 and 4, only 15 MHz apart, overlap too, which causes adjacent-channel interference. Putting all three APs on channel 6 avoids overlap but creates co-channel interference: the APs and their clients must take turns using the same channel.

Look for this next time: In the U.S. 2.4 GHz band, put neighboring access points on channels 1, 6, and 11; other combinations overlap.

Correct answer: B · Configure ip helper-address 10.99.0.10 on the VLAN 30 SVI

A DHCP client starts with a broadcast DHCPDISCOVER, and routers do not forward broadcasts, so a client in VLAN 30 can reach a server on another subnet only through a relay agent on its own gateway interface. On Cisco IOS, ip helper-address on the VLAN 30 SVI relays the broadcast to 10.99.0.10 as unicast and fills in the relay field (giaddr) with 10.30.0.1, which the server uses to pick the 10.30.0.0/24 scope. VLAN 20 works, which suggests its SVI already has a helper, and the 169.254.x.x addresses show that VLAN 30 clients get no reply. A helper on the data-center interface is on the wrong side, because client broadcasts never reach it. The scope already exists, so a second one adds nothing. Lease time matters only after a client has an address.

Look for this next time: Configure the DHCP relay (ip helper-address) on the interface where client broadcasts arrive, pointing to the server's address.

Correct answer: A · Add VLAN 20 to the trunk's existing allowed VLAN list

A trunk carries only the VLANs on its allowed list, so VLAN 20 frames from SW1 never cross the link, while VLANs 10 and 30, which are listed, work. Adding VLAN 20 to the list fixes it; on Cisco IOS, the add keyword of the trunk allowed VLAN command appends a VLAN without removing the others. Setting the list to VLAN 20 alone replaces it, so VLANs 10 and 30 would lose connectivity across the trunk. Changing the native VLAN only changes which VLAN is sent untagged, and VLAN 20 would still be missing from the allowed list. Turning the link into an access port in VLAN 20 would carry VLAN 20 alone and cut off every other VLAN between the switches.

Look for this next time: A trunk forwards only allowed VLANs; add a missing VLAN to the list rather than replacing the whole list.

Correct answer: D · Set at least one side to LACP active mode

Cisco's EtherChannel configuration guide says an LACP port in active mode starts negotiations, while a passive port only responds to LACP packets it receives. Two passive ports cannot form an EtherChannel, because neither side starts. An active port forms a channel with a partner in active or passive mode, so setting at least one side to active fixes it. Setting both sides to PAgP desirable would build a PAgP channel, Cisco's own protocol, not the LACP channel the design calls for. Mode on bundles the ports without sending any negotiation packets, so it cannot negotiate with a passive LACP partner; on should be paired only with on. Shutting down links does not change the modes and only removes bandwidth.

Look for this next time: LACP forms with active–active or active–passive; passive–passive never forms, because neither side starts negotiation.

Correct answer: C · BPDU guard

Cisco's spanning-tree configuration guide says that when BPDU guard is enabled on a PortFast port and a BPDU arrives, the switch puts the port in the error-disabled state, because a PortFast edge port should never receive BPDUs; the port stays down until it is recovered. Root guard acts only on superior BPDUs that would make the port a root port, and it holds the port in a root-inconsistent blocked state instead of err-disabling it. Loop guard protects root and alternate ports when the BPDUs they expect stop arriving, which is the opposite situation. Port security limits which and how many MAC addresses can use a port; it does not look for BPDUs, so it is not the feature that reacts to spanning-tree frames.

Look for this next time: Pair PortFast with BPDU guard on edge ports: any BPDU received there err-disables the port.

Correct answer: A · LLDP, which both devices can run

Link Layer Discovery Protocol (LLDP) is the vendor-neutral IEEE 802.1AB protocol. Each device advertises information such as its system name and the ID of the port it is sending from, so the switch can confirm which firewall port is really on Gi1/0/48; on some switches LLDP must be enabled first. CDP gives similar information, but it is Cisco's proprietary protocol, and this firewall does not run it, so the switch would learn nothing about it. Spanning-tree BPDUs carry bridge and port information for loop prevention, but a firewall that does not run spanning tree sends none, and BPDUs are not a documentation tool. ARP maps an IP address to a MAC address; it does not report a device name or the port it is connected through.

Look for this next time: Use CDP between Cisco devices and LLDP, the IEEE 802.1AB standard, when a neighbor comes from another vendor.

Correct answer: B · As an access port in VLAN 50 with voice VLAN 150

On Cisco switches, an access port can carry one data VLAN plus one voice VLAN. With access VLAN 50 and voice VLAN 150, the phone learns the voice VLAN, typically through CDP or LLDP-MED, and tags its own voice frames with 802.1Q VLAN 150, while the PC's untagged frames land in VLAN 50. A trunk with native VLAN 150 would put the PC's untagged frames in the voice VLAN, and it is the full trunk the requirement rules out. An access port in VLAN 150 with no voice VLAN would place the PC in the voice VLAN and leave voice and data unseparated. An access port belongs to only one data VLAN, so an access port in two VLANs at once is not a valid configuration.

Look for this next time: An IP phone with a PC behind it uses an access port with one data VLAN plus one voice VLAN.

Correct answer: D · The OSPF /22 route, the longest prefix that matches

A router forwards by longest prefix match first; administrative distance only chooses between routes to the same prefix, and the metric only between routes to the same prefix from the same source. Check each route against 192.168.21.77. The /16 covers 192.168.0.0 to 192.168.255.255, so it matches. The /20 covers a block of 16 in the third octet, 192.168.16.0 to 192.168.31.255, so it matches. The /22 covers a block of 4, 192.168.20.0 to 192.168.23.255, and 21 is inside it, so it matches too. The /22 is the longest match, so the OSPF route wins even though a static route with AD 1 also matches. The default route, 0.0.0.0/0, is used only when nothing more specific matches.

Look for this next time: Longest prefix match decides first; administrative distance and metric only break ties between routes to the same prefix.

Correct answer: C · 115, higher than OSPF's 110

Cisco's administrative distance document describes a floating static route as a backup configured with a higher distance than the primary route, installed only when no route with a lower distance exists for the same prefix. OSPF's default administrative distance is 110, so a static route with 115 stays out of the routing table while the OSPF route exists and is installed when that route is withdrawn. With the default distance of 1, the static route would beat OSPF and send traffic over LTE all the time. A distance of 100 is still lower than 110, so it would also win. The same document says a route with distance 255 is not considered reliable, so the router never installs it, and it could not take over when OSPF fails.

Look for this next time: A floating static route needs an administrative distance above the primary route's, such as above 110 for OSPF, but below 255.

Correct answer: B · R4 is DR and R2 is BDR

RFC 2328, the OSPFv2 standard, elects the designated router on a broadcast network by the highest router priority, with the highest router ID breaking ties, and a router with priority 0 is never eligible. R3 has the highest router ID, 10.0.0.9, but its priority of 0 takes it out of the election. R1, R2, and R4 all have priority 1, so router ID decides: R4 (10.0.0.4) is highest and becomes DR, and R2 (10.0.0.2) is next and becomes BDR. Choosing R1 reverses the tie-break, because the lowest router ID does not win. With three eligible routers, a BDR is always elected. Because the election is not preemptive, this result assumes all routers start together, as the question states.

Look for this next time: OSPF DR election: highest priority wins, highest router ID breaks ties, and priority 0 never becomes DR or BDR.

Correct answer: A · R2 becomes active and answers for 10.10.10.1 and the virtual MAC

HSRP gives hosts a virtual IP address and a virtual MAC address to use as their gateway. When the active router fails, the standby router stops hearing its hellos and takes over the active role, answering for the same virtual IP and MAC, so hosts keep their gateway settings and need no DHCP renewal or manual change. That is the purpose of a first hop redundancy protocol. A Cisco HSRP document shows that without the preempt option, the current active router keeps the role until it fails, resigns, or another event forces a new election, so R1 does not take the active role back when it boots, even with its higher priority. R2 stays active until preemption is configured or R2 itself fails.

Look for this next time: With HSRP, the standby router takes over the same virtual IP and MAC; without preemption, the recovered router stays standby.

Correct answer: C · PAT (NAT overload) using the outside interface address

Port Address Translation, called NAT overload on Cisco routers, translates many inside local addresses to one inside global address and tells the sessions apart by their transport-layer port numbers, the NAPT method described in RFC 3022. With one public address on the outside interface, overloading that address lets all 60 hosts reach the internet at once. Static NAT is a one-to-one mapping, so one public address can serve only one inside host. Dynamic NAT without overload is also one-to-one, so a pool with a single address lets only one host out at a time. RFC 1918 private addresses such as 192.168.1.0/24 are not routed on the public internet, so the office needs translation.

Look for this next time: PAT (NAT overload) lets many private hosts share one public address by tracking port numbers; static and dynamic NAT map one-to-one.

Correct answer: D · 192.168.4.0 0.0.3.255

The range 192.168.4.0 to 192.168.7.255 is four consecutive /24 networks starting on a multiple of 4, which is 192.168.4.0/22. A /22 mask is 255.255.252.0, and the wildcard is its inverse: 255.255.255.255 − 255.255.252.0 = 0.0.3.255, so the last 2 bits of the third octet and the whole fourth octet can be anything. The 0.0.7.255 wildcard ignores 3 bits of the third octet, so it matches 192.168.0.0 through 192.168.7.255, twice the range. The 255.255.252.0 value is a subnet mask; read as a wildcard, it ignores the first 22 bits and matches far more than intended. The 0.0.4.255 wildcard ignores a single bit of the third octet, so it matches only 192.168.0.x and 192.168.4.x.

Look for this next time: Wildcard mask = 255.255.255.255 minus the subnet mask; a /22 block such as 192.168.4.0 uses 0.0.3.255.

Correct answer: A · DHCP snooping, with only the uplink set as trusted

DHCP snooping sorts switch ports into trusted and untrusted, and ports are untrusted by default. Cisco's Catalyst configuration guides say the switch drops DHCP server messages, such as DHCPOFFER and DHCPACK, that arrive on untrusted ports, so a rogue server on a desk port can no longer answer clients. Only the uplink toward the legitimate server should be trusted. Dynamic ARP inspection validates ARP packets, usually against the DHCP snooping binding table; it builds on snooping rather than replacing it, and it does not stop rogue DHCP offers. BPDU guard reacts to spanning-tree BPDUs, which a consumer router typically does not send. Storm control limits floods of broadcast traffic, but a rogue server's few offers stay far below any storm threshold.

Look for this next time: DHCP snooping drops server replies arriving on untrusted ports; trust only the ports that lead to legitimate DHCP servers.

Correct answer: B · TACACS+ over TCP port 49

Cisco's comparison of TACACS+ and RADIUS says TACACS+ uses TCP, separates authentication, authorization, and accounting, protects the entire packet body behind a standard header, and can authorize router commands per user or per group. RFC 8907 assigns TCP port 49 to TACACS+ and calls its body protection obfuscation, warning that it does not meet modern security requirements on its own, so TACACS+ traffic should still travel over a protected management network. RADIUS uses UDP, combines authentication and authorization, and hides only the password in the access request, and Cisco notes it does not let administrators control which router commands can be run. SNMPv2c carries monitoring and management data, not administrator login AAA. Local usernames on each device are not central at all.

Look for this next time: For device administration with per-command authorization, TACACS+ (TCP 49) fits; RADIUS (UDP) hides only the password and lacks command authorization.

Correct answer: D · Levels 0 through 4, emergencies through warnings

Syslog severities run from 0, the most severe, to 7, the least: 0 emergencies, 1 alerts, 2 critical, 3 errors, 4 warnings, 5 notifications, 6 informational, and 7 debugging, on the same 0–7 scale that RFC 5424 defines. Setting the logging level on a Cisco device sends the chosen level and every more severe level, which means every numerically lower one. With the level set to warnings (4), the router sends levels 0 through 4 and holds back 5, 6, and 7, which is why error-level messages arrive and notification and informational messages do not. Levels 4 through 7 reverses the direction. The setting is a threshold, not a single level. Levels 5 and 6 are exactly the ones this threshold holds back.

Look for this next time: A syslog severity setting is a threshold: the device sends that level and every lower-numbered, more severe level.

Correct answer: C · Mask the secrets, state the reviewer role and task, and request a findings table

CCNA v2.0 exam topic 5.2 lists the prompt components to weigh when prompting a generative AI system for network operations: data classification, output format, persona, and instructions. Masking passwords, keys, and community strings before sending the configuration respects the data classification policy. Giving the assistant a reviewer persona and a clear task, and asking for a table of findings, makes the output specific and easy to check, and the engineer should still verify each finding before changing the router. Pasting the full configuration sends confidential data outside the company, and asking it to fix everything invites changes no one has reviewed. Telling the assistant to keep secrets private does not undo sending them. A prompt with no configuration gives the assistant nothing specific to analyze.

Look for this next time: Good network prompts respect data classification, set a persona and clear instructions, and name the output format; verify answers before acting.