CCNA Practice Test

Answer: D
When OSPF priorities are tied, the router with the highest router ID (derived from a configured loopback, or the highest active IP address if none is set) is elected DR. Process ID is locally significant and not used in DR election, boot order alone doesn't decide the election outcome once priorities tie, and interface count plays no role.

Answer: A
The governing rule is that S marks a static route, the asterisk flags it as a gateway-of-last-resort candidate, and the all-zeros 0.0.0.0/0 prefix matches any destination lacking a more specific route, forwarding it to 198.51.100.1. B is wrong because the entry's prefix is 0.0.0.0/0, not a /32, so it matches every destination rather than one host address. C is wrong because a null-routed blackhole names Null0 as the outgoing interface, not a next-hop IP address the way this entry does. D is wrong because the S code identifies a static route; a dynamically learned OSPF route would instead show the code O and the distance 110 in brackets.

Answer: B
Dual-active, often called split brain, arises when the transport between peers breaks: hellos stop arriving, the standby declares the active dead, and both answer for the virtual address; the failed pings between the routers confirm the broken path. Equal HSRP priorities are settled by comparing IP addresses rather than forcing dual-active operation, a version 1 and version 2 mismatch prevents the pair from recognizing each other's hellos rather than merging their roles, and HSRP version 1 supports group numbers well past 5.

Answer: A
The governing rule is that DR election chooses the highest priority first, breaking ties with the highest router ID, so at a shared priority of 100, Cedar-R4's router ID of 4.4.4.4 defeats Cedar-R3's 3.3.3.3. B is wrong because priority 0 marks a router that refuses DR candidacy entirely, not the most trusted router. C is wrong because Cedar-R1's nonzero priority of 1 is still lower than the tied priority of 100 held by Cedar-R3 and Cedar-R4, so it loses the election outright. D is wrong because the tiebreaker favors the higher router ID, not the lower one, so Cedar-R3 loses to Cedar-R4.

Answer: C
The routing table shows what the device will actually forward, and testing from a host in the affected subnet validates the entire end-to-end path rather than just one device's local view. A is wrong because counters not incrementing only shows a lack of traffic, not whether the destination is actually reachable. B is wrong because a clean configuration file does not guarantee the resulting routing table or forwarding path is correct. D is wrong because an unchanged uptime only confirms no reload occurred; it says nothing about whether the change broke reachability.

Answer: D
The governing rule is that OSPF router ID selection prefers an explicitly configured value first, then the highest loopback address, then the highest physical interface address, and with loopbacks present the physical addresses are never even considered. A is wrong because interface boot order plays no part in router ID selection. B is wrong because the highest overall address across all interfaces only applies when no loopback interfaces exist at all. C is wrong because the rule picks the highest loopback address, not the lowest, so 10.0.0.9 loses to 172.16.0.4.

Answer: D
The governing rule is that a trailing number on a static route sets its administrative distance, and at 250 it loses to the primary default route's distance of 1, so the floating static stays out of the table until the primary is withdrawn. A is wrong because static routes carry no bandwidth statement, and this route is not an EIGRP route at all. B is wrong because static routes do not carry a protocol metric the way this choice describes; the value only affects distance, and a losing floating static is completely absent from the table rather than merely less attractive. C is wrong because static routes carry no session-count limit; that concept belongs to NAT or firewall state tables, not route configuration.

Answer: A
The governing rule is that forwarding always compares the destination against every route and selects the most specific match, and 10.16.32.200 falls inside 10.16.32.128/25, whose 25-bit prefix beats both the /19 and /12. B is wrong because dynamic routes never automatically outrank static routes in forwarding; the decision is made by prefix length here, not by route source. C is wrong because EIGRP's administrative distance of 90 only matters when comparing sources for the identical prefix, and it is irrelevant once a more specific /25 exists. D is wrong because overlapping routes at different prefix lengths are normal and resolved cleanly by longest-prefix match, not treated as ambiguous.

Answer: B
The governing rule is that a static route lives in the table only while its next hop resolves; when the sole interface toward 10.31.7.2 fails, resolution breaks immediately and the route is withdrawn until the interface recovers. A is wrong because there is no 90 second grace period; a static route is pulled as soon as its resolving interface goes down. C is wrong because static routes absolutely track interface state despite being manually configured, so they are removed rather than persisting permanently. D is wrong because no automatic distance change or conversion occurs; the route is simply withdrawn, not transformed into a different kind of entry.

Answer: C
OSPF selects its router ID once at process initialization and deliberately keeps it stable; new candidate addresses are considered only when the process restarts or the ID is cleared, because changing the ID forces every adjacency to rebuild. No maintenance-window flag mechanism exists for router IDs, a loopback does not need to be advertised into OSPF to be eligible as a router ID candidate, and saving the configuration to NVRAM has no effect on which router ID the running process is using.

Answer: A
When two routing sources offer a route to the same destination, the router installs the one with the lowest administrative distance, and a static route's default AD of 1 beats OSPF's default AD of 110, so the static route is installed — this matches choice A. Choice B is wrong because being a link-state protocol has no bearing on route selection here; administrative distance, not the underlying routing algorithm, decides which source wins. Choice C is wrong because a router does not load-balance across routes from different sources with different administrative distances to the same prefix; only the lowest-AD route is installed. Choice D is wrong because both listed routes are valid non-connected sources to 10.0.0.0/24, so the router does not fall back to using only directly connected routes.

Answer: D
The governing rule is that directly connected networks install at administrative distance 0, the most trusted value possible, so the connected route always wins over any learned advertisement of the same prefix. A is wrong because a connected route and a learned duplicate are never split or load-shared; the connected entry alone is installed. B is wrong because a connected/learned conflict resolves cleanly through administrative distance rather than removing the prefix from the table. C is wrong because freshness of information plays no role in route selection; distance value alone decides the winner.

Answer: C
VRRP is the standards-track first-hop redundancy protocol implemented across vendors, and its master election preempts by default, the opposite of HSRP's conservative default. LACP aggregates parallel links between two devices and provides no gateway redundancy at all, HSRP never became an open standard in any version, and GLBP is Cisco proprietary exactly like HSRP rather than a standards-based option.

Answer: B
The governing rule is that on multi-access media, an interface-only static route makes the router treat every destination in the prefix as directly attached, so it must ARP for each remote host and depend on the downstream device's proxy ARP replies, which scales poorly and bloats the ARP table. A is wrong because this static route syntax needs no subinterface at all; it installs against the physical Gi0/3 interface as configured. C is wrong because the route still covers the full 255.255.255.0 mask that was explicitly configured, not merely the first 254 addresses of some other implied mask. D is wrong because this syntax creates an ARP scaling problem, not a forwarding loop, and split horizon is unrelated to how static routes resolve next hops.

Answer: D
The governing rule is that every OSPF router runs Dijkstra's shortest path first algorithm over the shared link-state database, rooting the tree at itself and deriving least-cost paths to every destination. A is wrong because Bellman-Ford with periodic hop-count updates describes RIP's distance-vector approach, not OSPF's link-state computation. B is wrong because electing a root bridge is a Layer 2 Spanning Tree Protocol concept for loop prevention in a VLAN, unrelated to OSPF's Layer 3 path computation. C is wrong because the diffusing update algorithm and feasible successors are EIGRP-specific concepts; OSPF recomputes the full shortest-path tree rather than tracking feasible successors.

Answer: D
The multicast group 224.0.0.102 and the 0000.0c9f.fxxx virtual MAC format are signatures of HSRP version 2, whose group number appears in the MAC's final digits. GLBP hands out up to four virtual MACs per group but does not use this multicast address or MAC range, VRRP advertises to 224.0.0.18 with its own distinct 0000.5e00.01xx MAC family, and proxy ARP is a router behavior with no periodic hello packets of any kind.

Answer: C
The virtual address must be an address unused by any router in the subnet that both routers answer for through the protocol; putting it on Slate-R2's interface creates a duplicate address conflict, broken ARP behavior, and unpredictable failover. The HSRP group number is configured independently of any IP address and does not change automatically, no platform silently converts a conflicting address into a loopback interface, and standard HSRP does not permit a router's own real address to double as the virtual IP.

Answer: B
Multiple access points sharing one SSID over a common distribution system form an extended service set, which is what lets clients roam without reassociating to a new network name. An independent basic service set is an ad hoc, AP-free topology, mesh describes APs relaying traffic wirelessly rather than through wired LAN, and a wireless bridge joins two wired segments rather than serving roaming clients.

Answer: D
Unique local addresses from fc00::/7 are the IPv6 counterpart of private addressing: routable inside an organization, never routed on the public internet, and built with a random 40-bit global ID that makes collisions unlikely if labs later merge, making B correct. A is wrong because multicast addresses from ff00::/8 identify groups of receivers, not individually addressable lab hosts. B is wrong because link-local addresses from fe80::/10 cannot cross even a single router. C is wrong because global unicast addresses from 2000::/3 are publicly routable, the opposite of what an internal-only lab requires.

Answer: A
The well-known multicast group ff02::1 reaches every IPv6 node on the local link and ff02::2 reaches every router on the link, filling the role IPv4 broadcasts once played, making D correct. B is wrong because the loopback and unspecified addresses are ::1 and ::, not ff02::1 and ff02::2. C is wrong because the solicited-node group takes the form ff02::1:ffxx:xxxx and DHCPv6 servers use ff02::1:2. D is wrong because anycast addresses are assigned from ordinary unicast address space, not from the ff02:: multicast range.

Answer: D
Adding a sequence number and destination port is a transport layer function, and the transport layer's protocol data unit is called a segment, making B correct. A is wrong because a packet is formed one layer down, when the network layer adds the IP header. B is wrong because a frame is formed at the data link layer, when MAC addressing and a trailer are added. C is wrong because a bit stream is the physical layer's representation of data on the wire, two layers below the transport layer.

Answer: A
A /27 mask leaves 5 host bits (2^5-2=30 usable hosts), exactly meeting the requirement with minimal waste. A /28 gives only 14 usable hosts (too few), while /26 and /25 provide far more addresses per subnet than needed, wasting IP space.

Answer: B
Newer access points requiring 802.3at or 802.3bt power levels will fail to boot on a switch port that only supplies the lower 802.3af wattage budget, even with a cable that tests clean, making D correct. A is wrong because trunk configuration on a switch port has no relationship to whether PoE is delivered. C is wrong because PoE passes through standard structured cabling and patch panels without issue. D is wrong because modern switch and AP ports negotiate pair usage automatically via auto-MDIX, so a crossover cable is not required.

Answer: C
The four-layer TCP/IP model folds the OSI application, presentation, and session layers into a single application layer, so formatting, encryption, and dialog management all live there, making C correct. A is wrong because the internet layer only maps to OSI Layer 3, handling addressing and routing. B is wrong because the network access layer covers OSI Layers 1 and 2, the physical and data link functions. D is wrong because the transport layer maps to OSI Layer 4, providing segmentation and delivery, not presentation or session services.

Answer: C
With a /21 mask the block containing 172.19.200.77 runs from 172.19.200.0 through 172.19.207.255, and the gateway 172.19.196.1 falls in the previous /21 block, so the host can never ARP for a gateway outside its own subnet, making C correct. A is wrong because the gateway and host are actually in different /21 blocks, so the root cause is logical, not a duplex mismatch. B is wrong because 255.255.248.0 is a perfectly legal contiguous /21 mask. D is wrong because nothing reserves .77 in a /21 network; the reserved addresses in this block are .200.0 and .207.255.

Answer: D
The 5 GHz band devotes far more spectrum to nonoverlapping channels than 2.4 GHz, so many APs can sit close together on distinct frequencies without contending for the same airtime, which is exactly what a dense office needs. Choice A is wrong because DFS-certified channels must actively detect and yield to radar rather than depending on it for interference avoidance. Choice B is wrong because bonding into 80 MHz blocks shrinks the number of distinct nonoverlapping channels available, working against dense AP placement rather than enabling it. Choice C is wrong because higher frequencies attenuate more through walls and floors than 2.4 GHz, reducing penetration rather than extending it.

Answer: B
A successful ping proves Layers 1 through 3 work, and a completed three-way handshake proves the transport layer works end to end, so an HTTP 500 response, a server-side application error, places the fault at the application layer, making C correct. A is wrong because the network layer is already proven functional by the successful ping. C is wrong because a data link layer fault would prevent the ping itself from succeeding. D is wrong because the transport layer is proven functional by the completed three-way handshake in the capture.

Answer: B
Addresses in the fe80::/10 range are link-local, automatically assigned to every IPv6 interface and used only for on-link functions such as neighbor discovery and next-hop routing, never routed beyond the local segment — this matches choice B. Choice A is wrong because global unicast addresses come from the 2000::/3 range, not fe80::/10, and fe80 addresses are never forwarded onto the internet. Choice C is wrong because IPv6 multicast addresses come from the ff00::/8 range (all-routers is ff02::2), not the fe80 link-local range. Choice D is wrong because unique local addresses use the fc00::/7 range for private site routing, a distinct prefix from fe80::/10, and neither ULA nor link-local addresses are meant for WAN routing.

Answer: A
Containers package applications with their libraries but execute on the shared kernel of the host, which is why they start quickly and consume little memory compared with virtual machines that boot entire guest operating systems. Booting a dedicated kernel is precisely what containers avoid, they are managed by a container engine rather than a hypervisor, and container networking readily assigns individual addresses.

Answer: C
Before activating a tentative address, a host sends a neighbor solicitation targeted at its own address as duplicate address detection; if any node answers, the address is already in use and must not be activated, making D correct. A is wrong because prefix delegation is a separate DHCPv6-PD exchange initiated toward a delegating router. B is wrong because routers build their neighbor table from ordinary traffic they observe, not from a registration message. D is wrong because switches learn MAC addresses from the source address of frames, not from a targeted neighbor solicitation.

Answer: A
TCP treats loss as a congestion signal and reduces its transmission window, then grows it again gradually, so throughput dips after drops; UDP has no such feedback loop and keeps blasting at the application's rate. The urgent pointer only marks priority bytes within the stream, checksums are computed once per segment, and the push flag asks for prompt delivery rather than pausing the sender.

Answer: A
An interface showing up/down means the port detects a usable physical signal, but the data link protocol itself is not operating, pointing to a Layer 2 problem such as a keepalive or encapsulation mismatch, making B correct. B is wrong because an administrative shutdown reports as administratively down, not up/down. C is wrong because a cable unplugged at the far end would show down/down, since the physical layer itself would not detect a signal. D is wrong because failed interface hardware would typically also report the physical layer as down, not up.

Answer: B
Fiber carries light instead of electrical signals, so it is immune to the plant's electromagnetic interference and comfortably spans 320 meters, well within multimode fiber's typical reach, making A correct. A is wrong because Category 6 copper is limited to 100 meters per segment and remains susceptible to strong interference. C is wrong because shielded twisted-pair copper is still capped at the same 100 meter Ethernet segment limit despite its shielding. D is wrong because coaxial cable is neither a standard modern Ethernet LAN medium nor rated for 320 meters in this design.

Answer: C
Rising CRC and input errors with zero output errors mean inbound frames are arriving corrupted, which points to physical-path damage such as a bad cable, connector, or failing transceiver, making D correct. A is wrong because an MTU mismatch produces giant or oversized-frame drops, not checksum failures. B is wrong because a hard speed mismatch usually prevents the link from coming up at all. D is wrong because a duplex mismatch typically shows up as late collisions and transmission deferrals, not pure CRC growth with zero output errors.

Answer: C
The root election compares bridge IDs, which combine priority and MAC address; with priorities tied at the default, the lowest MAC address produces the lowest bridge ID and wins. Uptime never enters the election, designated roles on each segment are decided by path cost to the root rather than granted wholesale, and no bridge is excluded from candidacy.

Answer: C
LACP is standardized as part of IEEE link aggregation, so it interoperates between different vendors' equipment, making it the right choice for a mixed environment. PAgP is Cisco proprietary and unavailable on other vendors, DTP negotiates trunking rather than aggregation, and UDLD detects unidirectional links but does not form bundles.

Answer: C
A native VLAN mismatch means untagged frames sent from one switch's native VLAN are received and interpreted as belonging to the other switch's different native VLAN, so traffic can leak between the two VLANs; Cisco switches detect this via CDP and typically log a warning, and STP can also flag it — this matches choice C. Choice A is wrong because the trunk link itself typically stays up and continues passing tagged VLAN traffic normally; only the native, untagged VLAN is affected. Choice B is wrong because voice VLAN is a separate, explicitly configured VLAN and is not automatically the native VLAN, so the mismatch is not limited to voice traffic. Choice D is wrong because DTP negotiates trunking encapsulation and mode (access/trunk), not the native VLAN number, so it cannot resolve a native VLAN mismatch.

Answer: B
The active list is the intersection of the allowed list with VLANs that actually exist and are active in the VLAN database, so a permitted but missing VLAN drops out of that section. Rate limiting does not alter trunk listings, the native VLAN still appears among active VLANs when it exists, and 802.1Q supports VLAN IDs up to 4094, so 150 is well within range.

Answer: D
The governing rule is that sniffer mode pulls an AP entirely out of client service so it can capture every frame on its assigned channel and stream them to a specified analyzer address for decoding, which is exactly the roaming troubleshooting task described. A is wrong because bridge mode joins two wired segments over a wireless hop; it does not feed captured frames to an analyzer. B is wrong because local mode is the standard client-serving mode, offering only summary statistics rather than raw frame capture. C is wrong because FlexConnect concerns local traffic switching during WAN outages, not packet capture for a protocol analyzer.

Answer: B
The governing rule is that a workgroup bridge is an AP acting as a wireless client: wired devices plug into it and it associates to the existing WLAN on their behalf, extending connectivity where cabling cannot reach. A is wrong because an SSID, however it is secured, cannot connect hardware that has no radio at all; the printers still need a physical bridge device. C is wrong because monitor mode stops serving any client traffic and a console port is for device management, not for carrying printer data onto the network. D is wrong because FlexConnect is an AP operating mode, not a feature a wired printer's own interface can enable.

Answer: C
The governing rule is that FlexConnect lets a remote AP switch client traffic locally on the store LAN and keep authenticating clients when the WAN link to the controller is down, then resume centralized control once it returns. A is wrong because sniffer mode abandons client service completely to capture and forward frames for analysis, which would leave the store offline rather than resilient. B is wrong because rogue detector mode watches for unauthorized devices via wired MAC comparison; it never carries client traffic at all. D is wrong because monitor mode also serves no clients, dedicating both radios to scanning, which is the opposite of keeping store users connected during an outage.

Answer: A
Active and passive are both LACP modes; an active end sends LACPDUs and a passive end answers them, so the bundle negotiates successfully. Passive ports do process received LACP frames, PAgP uses the desirable and auto keywords rather than these, and a protocol-free static bundle would require mode on at both ends.

Answer: B
In Rapid PVST+, a port that receives a superior BPDU but loses the election for root or designated port becomes an alternate port and sits in the discarding state, providing a loop-free standby path without forwarding traffic — this matches choice B. Choice A is wrong because a root port reaches the forwarding state once the topology is stable, but this port is explicitly not the root port, so labeling it 'Root port, Forwarding' misassigns its role. Choice D is wrong because designated ports also forward once stable, and Learning is only a brief transitional state on the way to forwarding, not the steady blocking state described here. Choice C is wrong because a backup port is a role that arises on a shared-media segment where a switch has two connections to the same collision domain, a different scenario from this one, and backup ports also sit in discarding, not forwarding.

Answer: D
An EtherChannel bundles the physical links into one logical interface, so spanning tree sees and treats the bundle as a single port with no member individually blocked, making the full aggregate bandwidth available — this matches choice D. Choice A is wrong because PortFast is meant for access ports connecting end hosts, skipping the listening/learning delay; it does not bundle multiple links into one logical interface or prevent STP from blocking a redundant link. Choice C is wrong because putting each link in a separate VLAN does not stop spanning tree from blocking a redundant path within a VLAN, and it does not create one logical link. Choice B is wrong because BPDU guard err-disables a port that unexpectedly receives a BPDU, typically to protect against a rogue switch; it would disable one of the redundant links rather than bundle them into an active logical interface.

Answer: D
PAgP is a Cisco-proprietary protocol for negotiating EtherChannel bundles, whereas LACP (IEEE 802.3ad) is the open standard supported across vendors. STP prevents loops and is unrelated to channel negotiation, and VTP synchronizes VLAN databases, also unrelated to link aggregation negotiation.

Answer: B
PortFast assumes a single end host and forwards frames immediately without the normal listening and learning wait, so an accidentally attached switch could complete a physical loop before topology detection would otherwise catch it; BPDU guard closes that gap by errdisabling the port the instant any BPDU is heard on it. The claim about flooding all VLANs and needing storm control to change the port mode is wrong because storm control throttles excessive traffic rates, it does not rewrite switchport modes. The claim about the server losing its VLAN and root guard fixing it is wrong because VLAN membership is unaffected by what device plugs in, and root guard protects root placement rather than restoring VLAN assignments. The claim that PortFast self-disables when a switch connects is wrong because PortFast keeps forwarding blindly unless a separate feature like BPDU guard intervenes.

Answer: B
Unlike IP packets with a TTL that decrements at every hop, Ethernet frames carry no hop count, so in a loop each broadcast is reflooded forever while new broadcasts keep joining, growing exponentially until every link and CPU saturates; this is exactly the failure mode spanning tree exists to prevent. The claim about MAC table capacity doubling is wrong because a physical loop does not change how many entries a table can hold. The claim about broadcasts converting to multicast is wrong because a broadcast frame keeps its all-ones destination address regardless of how many times it loops. The claim about reversed frame check sequences is wrong because FCS values only validate frame integrity on receipt; they play no role in triggering retransmission.

Answer: C
Deterministic root placement comes from lowering Core-West's bridge priority below every other switch's, since the bridge ID comparison always favors the lowest priority before it ever looks at MAC address; the root primary macro applies exactly this kind of adjustment. The claim about raising the hello timer is wrong because hello timers control BPDU advertisement cadence, not which switch wins the root election. The claim about matching every other switch's priority is wrong because tied priorities push the decision back to the MAC address tiebreaker, reintroducing the unpredictability the engineer wants to eliminate. The claim about assigning the highest priority value is wrong because a higher priority number makes a bridge less likely to become root, the opposite of the desired outcome.

Answer: C
An access port is configured for a single untagged VLAN and does not process 802.1Q tags, so a tagged frame arriving on it does not match the expected format and is discarded — this matches choice C. Choice A is wrong because forwarding a tagged frame into its tagged VLAN is trunk-port behavior, not how an access port handles an unexpected tag. Choice B is wrong because switches do not strip and re-tag frames to silently correct a VLAN mismatch on an access port; the frame is simply dropped. Choice D is wrong because unknown-unicast flooding applies to frames with an unrecognized destination MAC within a single VLAN, not to malformed tagged frames received on an access port.

Answer: D
Classic 802.1D moves a newly up port through the listening and learning states, each held for the fifteen-second forward delay timer, totaling roughly thirty seconds before the port reaches forwarding; PortFast and similar edge-port features exist specifically to skip this wait on host-facing ports. The claim about DHCP intentionally delaying offers is wrong because a DHCP server responds to a discover message as soon as it arrives, with no built-in thirty-second hold. The claim about thirty seconds of speed negotiation is wrong because Ethernet auto-negotiation completes in a fraction of a second. The claim about duplicate address detection is wrong because that is an IPv6 host procedure measured in a couple of seconds, and it plays no role in this delay.

Answer: B
The roughly thirty-second delay comes from spanning tree's listening (15 seconds) and learning (15 seconds) states before a port reaches forwarding; PortFast skips straight to forwarding for ports where a switch, and therefore a loop, cannot appear, and is normally paired with BPDU guard so the port err-disables if a switch is connected anyway — this matches choice B. Choice A is wrong because globally disabling spanning tree removes loop protection network-wide, a dangerous approach that risks broadcast storms, not a targeted fix for one access port. Choice C is wrong because configuring a port as a trunk changes its VLAN tagging behavior, not the STP forward-delay timers, and trunk ports still go through the normal STP states. Choice D is wrong because the forward-delay timers, 15 seconds each by default, are fixed STP values independent of interface speed; raising the link speed does not shorten them.

Answer: B
A /22 subnet mask is 255.255.252.0, and an ACL wildcard mask is the bitwise inverse of a subnet mask, giving 0.0.3.255 for a /22 — this matches choice B. Choice A is wrong because 0.0.255.255 is the wildcard mask for a /16 network, a much broader range than the /22 in the question. Choice C is wrong because 255.255.252.0 is the subnet mask itself, not its inverse; using a subnet mask directly in an access-list wildcard field is one of the most common configuration mistakes and matches the opposite of every bit that should be ignored. Choice D is wrong because 0.0.0.255 is the wildcard mask for a /24 network, which is more specific than the /22 range the ACL needs to match.

Answer: C
Authentication verifies who the engineer is, authorization determines the privilege level that identity receives, and accounting records what was done -- matching the AAA framework's actual order and exactly the three policy requirements described. Distractor A is wrong because it assigns identity-proving to accounting and privilege-limiting to authentication, backwards from their real definitions -- accounting only logs activity after the fact and never verifies identity. Distractor B is wrong because it assigns identity-proving to authorization and command-recording to authentication, when authorization actually governs privilege and authentication has no logging function at all. Distractor D is wrong because collapsing all three requirements into authentication ignores that proving identity says nothing about what privileges that identity receives or what gets logged, which are authorization's and accounting's separate jobs.

Answer: C
A standard ACL can match only the source address, so applying it near the source would deny that source's traffic to every destination rather than just the intended one; placing it close to the destination instead ensures only traffic actually headed to the protected destination is filtered — this matches choice C. Choice A is wrong because placing a filter close to the source to discard traffic early is the correct placement rule for extended ACLs, which can match destination too, not standard ACLs. Choice B is wrong because Cisco does not require standard ACLs to be duplicated on every router in the path; a single, correctly placed ACL is sufficient and duplicating it elsewhere is unnecessary and error-prone. Choice D is wrong because placement absolutely matters for a standard ACL; filtering by source address only produces very different results depending on how close to the source or destination it is applied.

Answer: A
Protecting vty lines means restricting which source addresses may connect with an access class, requiring encrypted SSH instead of clear-text Telnet, and timing out idle sessions automatically. B is wrong because leaving every line open with no access class maximizes exposure instead of reducing it. C is wrong because a shared account destroys individual attribution, making it impossible to tell which administrator performed an action. D is wrong because disabling session and command logging removes the record needed to investigate a session, rather than protecting it.

Answer: A
DHCP snooping marks ports as trusted or untrusted, allowing DHCP server responses (OFFER/ACK) only from trusted ports, and it builds a binding table of IP-to-MAC-to-port mappings used by related features like Dynamic ARP Inspection, preventing rogue or unauthorized DHCP servers from handing out malicious configurations — this matches choice A. Choice B is wrong because DHCP snooping does not encrypt any traffic; it is a filtering and tracking feature, not a cryptographic one, and switches have no such onboard AES engine for DHCP. Choice C is wrong because DHCP snooping does not assign IP addresses at all, static or otherwise; it monitors and filters existing DHCP exchanges. Choice D is wrong because DHCP snooping has no load-balancing function; distributing requests across servers is unrelated to its trust/binding-table purpose.

Answer: B
Shutdown mode reacts to any violation by err-disabling the entire port, cutting both devices off until an administrator intervenes or an automatic recovery timer restores it. Forwarding one device while dropping others describes the protect and restrict modes, log-and-forward is not a violation behavior, and no port security event reboots hardware.

Answer: A
Device administration favors TACACS+ precisely because it encrypts the whole packet body and decouples authorization, enabling per-command policy. RADIUS encrypts only the password field and binds authentication with authorization, which suits network access rather than command control, Kerberos is a ticket-based authentication system without per-command device authorization, and LDAP is a directory protocol rather than a AAA transport.

Answer: D
When DHCP snooping is enabled, every port defaults to untrusted, and server-origin messages such as offers and acks arriving on an untrusted port are dropped; forgetting to mark the uplink toward the real DHCP server as trusted silently discards every reply, so clients time out and appear to have no server available. Distractor A is wrong because the binding table has no fixed default maximum that blocks first-time clients, and it records leases rather than gating them. Distractor B is wrong because snooping has no lease-duration dependency; it inspects DHCP message types, not timer values. Distractor C is wrong because option 82 relay tagging is optional snooping behavior, not a prerequisite the feature requires before forwarding client requests.

Answer: C
Statically addressed hosts have no snooping binding, so inspection needs an ARP access list defining their legitimate pairing; the ACL is consulted for validation and the server's traffic passes while protection continues for everyone else. Disabling the feature sacrifices the whole VLAN's protection, native VLAN placement does not bypass inspection, and sending more of the same unmatched ARP packets just generates more drops.

Answer: C
The default port security violation mode is shutdown, which err-disables the port entirely, stopping all traffic rather than just the offending frames, until it is manually re-enabled or recovers via the errdisable recovery timer; protect silently discards unauthorized frames without logging, and restrict discards them while also logging and counting the violation — this matches choice C. Choice A is wrong because it describes the protect mode's actual behavior, not the default shutdown mode. Choice B is wrong because it describes the restrict mode's actual behavior, logging and counting violations while continuing to forward known traffic, which is not the default either. Choice D is wrong because port security's default, and every standard violation mode, blocks the unauthorized address rather than permitting it to keep forwarding; there is no permit-and-log violation mode.

Answer: A
Per-entry hit counters in show access-lists increment every time a packet matches that specific line, so counts rising on the deny statement matching the affected source and destination is direct evidence the ACL is discarding that flow, pointing troubleshooting at reordering or editing the entry. Distractor B is wrong because the counters track every packet evaluated against the entry, transit traffic included, not just packets addressed to the router. Distractor C is wrong because hit counters increment regardless of whether the log keyword is present; logging only adds syslog messages on top of the count. Distractor D is wrong because a matching counter says nothing about which direction the ACL is applied -- it only confirms the entry is being evaluated and is matching.

Answer: C
Restrict mode is the only violation action that keeps the port forwarding for the authorized MAC while dropping frames from any additional address, incrementing the violation counter shown as 47, and generating syslog and SNMP notifications for each event -- matching every symptom described. Distractor A is wrong because protect mode drops offending frames silently, with no violation counter and no syslog message, so it could never produce the observed count. Distractor B is wrong because sticky is a MAC-learning mode, not a violation action, and it does not by itself stop additional devices from triggering a violation. Distractor D is wrong because shutdown mode err-disables the entire port on the very first violation, which would stop all forwarding rather than leave the authorized MAC passing traffic.

Answer: B
Centralized AAA provides authentication of identity, authorization of the specific commands a user may run, and accounting that records what was executed, all tied to one identity. A is wrong because handling authorization and accounting only locally on each device means permissions and activity logs do not follow the user centrally. C is wrong because accounting alone provides no centralized authentication or command-level authorization. D is wrong because AAA governs who can log in and what they can do, not encryption of traffic through the device.

Answer: D
Sticky learning converts the dynamically learned printer MAC into a secure MAC address command written to the running configuration, and saving that configuration to NVRAM makes the binding persist across a reload exactly like a manually typed static entry. Distractor A is wrong because secure MAC addresses appear in plain text in show running-config; port security has no encryption feature for stored addresses. Distractor B is wrong because port security matches the exact learned MAC address, not a vendor OUI prefix or block, so a same-vendor device is still a separate, unauthorized address. Distractor C is wrong because sticky learning fixes the address permanently once learned and saved; it does not relearn or replace bindings on any aging timer unless an administrator manually clears them.

Answer: D
Forged ARP replies binding the gateway's IP to the attacker's MAC divert the victim's outbound frames through the attacker, the textbook on-path interception on a shared LAN. A smurf attack weaponizes broadcast ping replies for a volumetric flood rather than quiet interception, session fixation manipulates an application's own cookie handling rather than Layer 2 addressing, and DNS amplification abuses open resolvers for reflection rather than using a victim's laptop as the reflector.

Answer: C
WPA2-Enterprise authenticates each user individually through 802.1X against a RADIUS or similar authentication server, so a departing employee's credentials can be revoked without touching anyone else's access -- something a single shared passphrase cannot do without rekeying every device. Distractor A is wrong because enterprise wireless authentication has no wired-bridging requirement; it works over standard wireless clients just as personal mode does. Distractor B is wrong because both modes use the same AES-CCMP data encryption once connected; the difference is entirely in how the encryption key is established, not whether encryption happens. Distractor D is wrong because enterprise mode eliminates the shared passphrase altogether rather than lengthening one; each user instead supplies unique 802.1X credentials.

Answer: B
AAA method lists are tried in order, and when both configured RADIUS servers are unreachable, the router falls through to the next method in the list -- here, the local username database -- so administrators with locally defined accounts can still log in. Distractor A describes the effect of an explicit none keyword at the end of a method list, which was never configured here, so authentication is never skipped. Distractor C is wrong because the same method list applies to the lines it is bound to, and nothing in the scenario restricts the fallback to console only. Distractor D confuses the RADIUS dead-server detection timer, which affects when a downed server is retried, with authentication failing outright -- the local fallback keeps logins working long before that timer matters.

Answer: A
Only version 3 offers user-based security, and its authPriv level provides both authentication and privacy through encryption, satisfying the mandate. Community strings in v2c travel in cleartext no matter their complexity, ACL restrictions on v1 limit sources but never encrypt, and informs are acknowledged notifications that inherit v2c's plaintext weakness.

Answer: D
Stratum counts distance from the reference clock: the internet source at stratum 1 makes the core router stratum 2, and the switches syncing from the router become stratum 3. Stratum is never inherited unchanged, stratum 0 designates the reference clocks themselves rather than network devices, and 15 is merely the edge of validity rather than a default assignment.

Answer: B
Syslog severities run from 0 through 7 with 0 as emergencies, reserved for a system rendered unusable, demanding immediate response. Debug output sits at the opposite end at 7, informational messages at 6, and warnings at 4, so none of those interpretations match a severity 0 event.

Answer: C
DHCP pools hand out any address in the scope unless exclusions carve out infrastructure addresses; forgetting to exclude the gateway allows exactly this collision. A DNS option only tells clients which name server to use and does not affect which addresses are eligible for leasing, lease duration affects renewal timing rather than protecting specific addresses from being handed out, and a relay agent statement applies to remote-subnet designs rather than a locally served pool on the same interface.

Answer: A
SNMPv3 should be selected because it adds authentication and encryption, while versions 1 and 2c send their community strings in clear text, exposing read-write access to anyone capturing the traffic. B is wrong because wide legacy support does not offset version 1 transmitting its community string unencrypted. C is wrong because version 2c only added bulk retrieval and improved error handling over version 1; it never added encryption. D is wrong because confining SNMP to a management VLAN does not eliminate the risk of a compromised host on that same VLAN capturing clear-text credentials.

Answer: A
The exchange runs discover, offer, request, acknowledgment: after an offer the client broadcasts its request naming the chosen server so competing servers can reclaim their offers. The acknowledgment is the server's final message rather than the client's, discover is only the opening message, and inform is a separate transaction used by clients that already have addresses.

Answer: B
The console severity can be tightened independently of other destinations, so critical events still appear locally while the syslog server receives the complete timestamped record for investigations. SNMP polling gathers periodic metric snapshots rather than timestamped event messages, disabling logging globally destroys the forensic trail entirely, and piping live debug output to a local file is the opposite of quiet and does nothing to centralize records on a server.

Answer: B
Severity filtering sends the configured level and everything more severe, meaning numerically lower: warnings sits at 4 and errors at 3, so both pass, while notifications at 5 is less severe and is suppressed. A trap severity setting is a threshold rather than the least restrictive option available, it does not match only one exact severity level, and notifications is numerically higher than warnings, which in syslog means less severe rather than the most severe of the three.

Answer: D
Private zones exist only on the organization's own name servers, so a public resolver returns failures for internal hostnames while resolving public sites normally, matching the symptoms exactly. Servers cannot distinguish connections by how the address was learned, public resolvers do answer queries from clients behind NAT since sources arrive translated, and DNS operates independently of how addressing was assigned.

Answer: B
Voice needs a strictly prioritized, low-latency queue with policing, because buffering only converts packet loss into delay that further damages a live call, and voice gains nothing from being held. A is wrong because a large output buffer increases queuing delay instead of avoiding it, the opposite of what voice needs. C is wrong because best-effort, fair-queued treatment gives voice no priority over bulk data and does not bound its delay or jitter. D is wrong because shaping that delays voice until bulk transfers finish introduces exactly the latency voice cannot tolerate.

Answer: A
Protocols that embed addresses in their message bodies break under plain header translation: the far end reads the private address from the SIP payload and streams audio toward it, producing one-way calls unless an application-layer gateway fixes the payload. NAT performs no packet compression and discards no audio data, translation does not reduce the effective path MTU below voice packet sizes, and there is no mechanism that reverses RTP stream direction based on whether a port number is odd or even.

Answer: B
The paired address-and-port entries reveal overload translation: each internal session is distinguished by a port number on the one public address, letting hundreds of hosts share it simultaneously. Static NAT cannot bind 180 different hosts to one address at once since each static entry is a fixed one-to-one mapping, DNS doctoring rewrites addresses inside name query responses rather than translating live sessions, and dynamic NAT without overload reserves a whole address per host rather than sharing one address among many concurrently.

Answer: C
PAT (NAT overload) maps every internal host's session to the single public IP address but assigns each session a unique source port, and the router tracks the resulting IP-address-and-port combination in its translation table to correctly demultiplex returning traffic — this matches choice C. Choice A is wrong because MAC addresses are Layer 2 information and are not carried inside the IP header at all, so a router cannot use them for this purpose. Choice B is wrong because PAT's entire purpose is to let many hosts share one public IP; rotating through an address pool describes dynamic NAT, not overload/PAT. Choice D is wrong because the NAT translation table is built from IP addresses and port numbers, not hostnames, and DNS plays no role in the translation lookup.

Answer: A
NTP synchronizes device clocks to a common, often hierarchical (stratum-based) time source, ensuring consistent, correlatable timestamps across switch and router logs — this matches choice A. Choice B is wrong because SNMP (using UDP ports 161 for polling and 162 for traps) is a monitoring and management protocol, not a clock-synchronization protocol. Choice C is wrong because CDP is Cisco's proprietary neighbor-discovery protocol, sending hellos every 60 seconds to learn about directly connected devices, and has nothing to do with time synchronization. Choice D is wrong because TFTP (UDP port 69) is a simple file-transfer protocol used for tasks like backing up configurations or IOS images, not for synchronizing clocks.

Answer: B
A low latency queuing policy grants the priority class strict service ahead of other queues, bounded by a policer so it cannot starve them, which keeps voice flowing cleanly during congestion. TCP does not throttle itself based on sensing an unrelated voice call starting, packet size does not exempt traffic from being counted against a queue's configured limit, and no mechanism duplicates a stream across every output queue to guarantee delivery.

Answer: B
TFTP rides UDP with a minimal command set, so it is easy to run but provides no login, no encryption, and no directory browsing, an acceptable trade inside an isolated management network. TFTP has no one-megabyte session cap and routinely moves images far larger than that, neither protocol encrypts transfers by itself so FTP is not sending cleartext while TFTP encrypts nothing, and TFTP's minimal implementation does not demand more router flash or DRAM than FTP for an equivalent file.

Answer: C
Statelessness means no server-side session memory: every call is self-contained with its own credentials and parameters, which is what lets REST services scale horizontally behind load balancers. Authentication tokens are not limited to a single use before reissuance, concurrent requests from multiple clients are a strength of the stateless model rather than something the server refuses, and device inventory data persists in whatever backing store the application uses rather than being discarded after each call.

Answer: A
The brackets after ports declare an array whose elements are objects, and indexing the second element then reading its id key yields Gi0/2. Object keying would use braces with names as keys, JSON arrays may contain any value type including objects, and a boolean value is data with no effect on parseability.

Answer: B
A controller ingests telemetry from every managed device and correlates it into one network-wide view, so operators diagnose issues from a single console instead of logging into each of sixty devices individually to piece events together -- this correlation is what actually shortens troubleshooting. Distractor A is wrong because controller-managed devices still run real software and can still have defects; no architecture eliminates bugs by centralizing management. Distractor C is wrong because centralizing logging concentrates and enriches log data for correlation, it does not disable logging or reduce what is captured. Distractor D is wrong because monitoring becomes more valuable, not obsolete, under centralized management -- failures still occur and are simply detected and analyzed faster.

Answer: B
Generative AI tools produce fluent, syntactically valid output that can still be wrong for the specific environment -- as with the mismatched interface naming here -- so the professional practice is treating AI drafts as accelerators that a human reviews and validates against local reality before deployment. Distractor A is wrong because syntax validity only confirms the configuration would parse; it says nothing about whether it matches this company's actual naming conventions or intent. Distractor C is wrong because abandoning AI assistance entirely discards real productivity gains over one correctable mismatch, rather than adding the review step that actually fixes the problem. Distractor D is wrong because a blanket read-only restriction is just one possible policy choice, not the lesson the scenario demonstrates, which is about verifying output, not disabling a capability.

Answer: C
The northbound interface exposes the SDN controller's capabilities to applications and orchestration systems, typically as a REST API, so business systems can request outcomes without knowing device syntax. A is wrong because carrying configuration down to devices via NETCONF or OpenFlow describes the southbound interface, the opposite direction. B is wrong because peering with an ISP's edge router over eBGP is a routing function unrelated to the application-facing interface. D is wrong because clock synchronization across the control plane is handled by NTP, not the northbound API.

Answer: D
Centralized intent-based management means the desired configuration is expressed once and the controller renders it identically to all sixty switches, so the kind of typo or per-box manual variance that caused the multi-week VLAN incident stops being possible under normal operation. Distractor A is wrong because controller-based fabrics still use VLANs as a building block, sometimes alongside VXLAN overlays, rather than eliminating the construct outright. Distractor B is wrong because console and SSH access typically remain available for local recovery; controllers add centralized management, they do not physically disable direct device access. Distractor C is wrong because devices continue accepting configuration changes normally, just delivered consistently through the controller rather than typed by hand on each box.

Answer: B
Declarative tools accept a description of the desired end state and calculate the steps needed to converge the device on it, which makes reapplying the same description idempotent. A is wrong because imperative configuration requires the administrator to specify each exact command and its order manually, rather than the tool determining the steps. C is wrong because typing commands directly into the CLI is manual configuration, with no tool determining convergence steps. D is wrong because reactive configuration only runs after an external trigger like an SNMP trap or syslog alert, not as a description of a target state.

Answer: D
A 429 status means Too Many Requests: the API is throttling the client for exceeding its rate limit, so well-behaved automation should back off, honor any Retry-After header the response provides, and reduce how often or how much data it polls per second. Distractor A is wrong because an empty inventory is reported as a successful response with an empty array, not a 429 throttling error. Distractor B is wrong because a permanently moved endpoint is signaled with a 3xx redirect status like 301, an entirely different class of response from rate limiting. Distractor C is wrong because certificate problems fail at the TLS handshake before any HTTP status is even returned, and switching to plain HTTP would remove security rather than fix throttling.

Answer: C
REST conventions map creation to POST against the collection resource, and a well-behaved API confirms with a created status code and often the new resource's location. GET is defined as a safe read that must not change state, DELETE removes resources rather than adding them, and HEAD returns headers without any body at all.

Answer: C
By convention, the northbound interface exposes the controller's APIs upward to orchestration platforms, automation scripts, and applications, while the southbound interface uses protocols like NETCONF or OpenFlow to program the managed switches and routers below it. Distractor A is wrong because the northbound/southbound split describes API direction relative to the controller, not a division between data center and wireless device types. Distractor B is wrong because the terms have nothing to do with physical network position such as internet edge versus distribution layer; both real network segments would be reached southbound, through managed devices. Distractor D is wrong because northbound and southbound are unrelated to IP address family; a controller manages both IPv4 and IPv6 devices southbound.

Answer: B
YAML's clean, indentation-based syntax makes it highly readable for humans while remaining machine-parsable, which is why tools like Ansible use it extensively for playbooks and variable files. Binary ASN.1 is a compact encoding used in protocols like SNMP (not human-friendly), MRT is a binary format for routing table dumps, and 802.1Q tagging is a Layer 2 frame format unrelated to automation data serialization.

Answer: A
Unquoted numeric values in JSON are numbers, and square brackets denote an array, here containing two string elements. Quoting is what would make uptime a string, curly braces rather than brackets would denote an object, JSON distinguishes several value types rather than treating everything as text, and booleans are only the literals true and false.

Answer: A
Fabric architectures split responsibilities between a physical underlay -- the real switches, links, and routing protocol that provide basic IP reachability -- and a logical overlay of tunnels, commonly VXLAN, built across that underlay to carry segmented, mobile user traffic. Distractor B is wrong because both control-plane and user data traffic can ride either layer depending on design; the underlay/overlay split is not a multicast-versus-unicast distinction. Distractor C is wrong because physical cabling is part of the underlay, not the overlay, which is purely a virtual, tunnel-based construct with no cabling of its own. Distractor D is wrong because underlay and overlay describe network transport layers, not controller redundancy roles, which is an entirely separate high-availability concept.

Answer: D
The standard division of labor is provisioning versus configuration management: Terraform declares and reconciles the existence, creation, and destruction of infrastructure resources, while Ansible drives the ongoing installation, configuration, and maintenance of software and device settings on systems that already exist, and many organizations use both together in a pipeline. Distractor A is wrong because both tools operate across cloud and on-premises targets; neither is restricted to one environment only. Distractor B is wrong because the languages are swapped -- Terraform uses its own HCL configuration language, while Ansible uses YAML playbooks, not a compiled language. Distractor C is wrong because the tools have distinct, complementary purposes rather than being identical, and the comparison is an architectural one, not a licensing decision.

Answer: C
Infrastructure as Code treats network and infrastructure definitions as versioned, text-based artifacts (e.g., YAML or JSON) that drive automated configuration generation and deployment, enabling repeatability and change tracking. Port mirroring copies traffic for monitoring, PortFast speeds up STP transition on access ports, and static NAT maps a fixed IP translation—none relate to representing infrastructure as version-controlled code.

Answer: C
Terraform's state file records what it believes exists; running plan (or a refresh) compares that record against the provider's actual resources, so a manually deleted subnet shows up as drift and Terraform proposes recreating it to match the declared configuration. Distractor A is wrong because deletion does not remove or lock the resource in Terraform's state -- the resource stays tracked in state exactly as declared until a plan reconciles it. Distractor B is wrong because Terraform performs this comparison on every plan or apply run, not only at first creation and not on a fixed daily schedule. Distractor D is wrong because Terraform does not block execution waiting for a manual import; it simply reports the drift and offers to fix it on the next apply.