35 Practice Exam, Study Plan and Exam-Day Strategy · CCNA

Exam topics covered

All six CCNA 200-301 v1.1 domains: 1.0 Network Fundamentals (20%), 2.0 Network Access (20%), 3.0 IP Connectivity (25%), 4.0 IP Services (10%), 5.0 Security Fundamentals (15%), 6.0 Automation and Programmability (10%)

Foundation. Knowing the material and passing the exam are related but different skills. The exam rewards fast, accurate subnetting, comfort at the CLI, careful reading under time pressure, and the stamina to stay sharp for two hours. This chapter gives you an eight-week plan, drilling techniques, an exam-day strategy and a full-length, 100-question practice exam weighted like the real blueprint. Take the practice exam under realistic conditions (120 minutes, no notes, no going back), then use the answer key, which points every question to the chapter that teaches it, to target your weak spots.

35.1 An Eight-Week Study Plan

The plan in Table 35-1 assumes you have already read the book once and can give the exam about 8 to 10 hours a week. Each week combines review reading, hands-on labs and timed drills. If you have more time, stretch it to twelve weeks; if you have less, compress weeks 1 to 3 but never skip week 8. Schedule your exam now for the end of week 8: a fixed date is the best cure for procrastination.

Table 35-1 Eight-week final preparation plan

5 stp, rstp,

Tip

Keep an error log: every practice question you miss, write the topic, why you chose the wrong answer (did not know, misread, rushed) and the fact you needed. Review the log every Sunday. Most candidates find that a third of their misses are reading errors, which are the cheapest points to recover.

35.2 Drilling Subnetting and Labs

35.2.1 Make subnetting automatic

Subnetting is hidden inside many questions beyond the obvious ones: ACL wildcard masks, OSPF network statements, routing-table longest-match decisions, NAT pools and DHCP scopes. You cannot afford to spend two minutes on each. The goal is to answer “What is the subnet, broadcast and host range of 172.16.45.200/20?” in under 30 seconds without paper. At the start of the exam you may write a reference table on the erasable board you are given; practise writing Table 35-2 from memory in under a minute.

Table 35-2 Subnetting reference to write from memory

Use the block size (also called the magic number, 256 minus the interesting mask octet) to find the subnet: the subnet ID is the largest multiple of the block size that is less than or equal to the address's value in the interesting octet. For 172.16.45.200/20 the interesting octet is the third, the block size is 16, the largest multiple of 16 not above 45 is 32, so the subnet is 172.16.32.0, the next subnet is 172.16.48.0, and the broadcast is one less: 172.16.47.255. Drill in short daily bursts (10 to 20 problems, timed) rather than occasional marathons; Appendix B has 100 problems with answers.

35.2.2 Make the CLI muscle memory

The exam can include simulation and simlet items in which you configure or inspect devices in an emulated CLI. Practise on Cisco Packet Tracer (free with a Networking Academy account), Cisco Modeling Labs, or real used equipment. Lab habits that pay off: build, break, fix (after every working lab, introduce one fault such as a wrong access VLAN, mismatched OSPF timers or an ACL in the wrong direction, and find it using only show commands); verify first, configure second (in a simulation, spend 30 seconds with show running-config , show ip interface brief and show vlan brief before typing); use the help system ( ? and Tab completion work in most simulations); and save when asked with copy running-config startup-config .

LAB Capstone lab: one network, every domain

Goal: build a small branch that exercises most configuration topics on the exam. Complete it twice in week 8: once with notes, once without, in under 90 minutes. L3

Nat/pat, ntp, ssh, acl

Isp 203.0.113.0/30

OSPF area 0, 10.0.0.0/30

Dsw1

SVIs, DHCP relay, HSRP-ready

Asw1 asw2

Figure 35-1 Capstone lab topology. Use 192.168.10.0/24 for VLAN 10 (data), 192.168.20.0/24 for VLAN 20 (voice) and 192.168.99.0/24 for VLAN 99 (management).

Steps:

1. On the switches: VLANs 10, 20, 99; 802.1Q trunks with native VLAN 99 and an allowed list; an LACP EtherChannel between ASW1 and ASW2; Rapid PVST+ with DSW1 as root; PortFast and BPDU Guard on access ports; port security (maximum 2 MAC addresses) on user ports.
2. On DSW1: SVIs for each VLAN, ip routing , ip helper-address pointing at a DHCP pool on R1, OSPF to R1.
3. On R1: DHCP pools for VLANs 10 and 20, PAT to the ISP interface, a default route redistributed with default-information originate , NTP client, syslog to a server, SSH version 2 only with local users.
4. Security: DHCP snooping and DAI on the access switches; an extended ACL that blocks Telnet from VLAN 10 to the management VLAN.

Verify: PCs receive addresses by DHCP; show ip ospf neighbor shows FULL; show ip nat translations shows PAT entries after a ping to the ISP; show etherchannel summary shows the bundle in use (SU/P flags); show spanning-tree shows DSW1 as root for every VLAN. Expected results: every host can reach the ISP loopback, Telnet from VLAN 10 to VLAN 99 fails while SSH from the management station succeeds, and a rogue DHCP server on an access port is blocked.

35.3 Exam-Day Strategy

35.3.1 Know the format

The CCNA 200-301 exam lasts 120 minutes. Cisco does not publish the exact number of questions or the passing score, and both can vary between exam forms; candidates typically report around 100 to 120 items. Scores are scaled, so you cannot work out a pass mark by counting. Item types include single-answer and multiple-answer multiple choice, drag-and-PASS the CCNA: Complete Study Guide 528 drop matching or ordering, testlets (a scenario with several questions), simlets (you run show commands on a simulated network to answer questions) and simulations (you configure devices to meet requirements). Check Cisco's exam page for current details before you book.

WATCH OUT: THERE IS NO GOING BACK

Once you submit an answer and move to the next question, you cannot return to it. There is no “mark for review”. Decide, commit and move on. This changes how you manage time: you cannot skip a hard question and come back later.

35.3.2 Budget your time

With roughly 100 to 120 items in 120 minutes you have about one minute per question, but simulations can take 5 to 10 minutes each. Bank time on recall questions (20 to 40 seconds) so you can afford the simulations. Because you cannot see the remaining question types in advance, use checkpoints: note the question count displayed on screen and compare it with elapsed time every 30 minutes.

0–30 min 30–60 min 60–90 min 90–120 min

~28% ~55% ~80%

Target share of items completed at each checkpoint (stay slightly ahead of the clock) Keep 5 minutes in hand at the end for a late simulation; never leave an item unanswered

Figure 35-2 A time budget with checkpoints. Being ahead of the line gives you room for simulations.

Never leave a question blank. There is no penalty for guessing. Eliminate what you can and pick the best remaining option.

Cap your losses. If a multiple-choice question is still unclear after about two minutes, make your best choice and move on; one question is not worth three.

Simulations: read all the requirements first, list them on the board, verify the current state, configure, then verify each requirement. Partial credit is generally believed to be possible, so complete what you can.

35.3.3 Reading tricks

Read the last sentence first so you know what is asked (“which command”, “which two”, “what is the cause”), and count how many answers are required.

Watch absolute and negative words: always, never, only, NOT, least, first. Read every exhibit line. The answer is often one field: a wildcard mask, an interface in the wrong area, “administratively down”, a VLAN missing from the allowed list. Check syntax and mode. Distractors often pair the right idea with the wrong syntax ( ip route for an IPv6 route) or mode.

Assume Cisco defaults when no other detail is given: OSPF reference bandwidth 100 Mbps, native VLAN 1, HSRP priority 100.

35.3.4 Logistics: online or test centre

Online (Pearson VUE OnVUE): run the system test beforehand on the same computer and network, disable VPNs and corporate restrictions, and prepare a private, quiet room with a clear desk; you will show government-issued photo ID and scan the room with the webcam, and leaving the camera view or being interrupted can end the exam. Test centre: plan the route and parking, arrive 15–30 minutes early with the identification the vendor's current policy requires, store your belongings in a locker, and use the erasable note board provided (ask for earplugs if the room is noisy).

The night before, stop studying early and sleep. On the day, eat and hydrate (breaks are not allowed), and spend the first minute writing your subnetting table. The three most expensive mistakes are spending ten minutes on one question, misreading “NOT” or “choose two”, and running out of time before the last simulation.

35.4 Full-Length Practice Exam

Answer all 100 questions in 120 minutes, without notes, and without going back. The questions follow the blueprint weighting: 20 on Network Fundamentals, 20 on Network Access, 25 on IP Connectivity, 10 on IP Services, 15 on Security Fundamentals and 10 on Automation and Programmability. Output in exhibits is illustrative of IOS 15 and IOS XE.

1. Which device makes forwarding decisions based on the destination IP address of a packet?

A. Hub
B. Layer 2 switch
C. Router
D. Wireless access point in local mode

2. What is the broadcast address of the subnet that contains host 172.16.45.200/20?

A. 172.16.45.255
B. 172.16.47.255
C. 172.16.63.255
D. 172.16.32.255

3. A subnet must support 50 hosts with the fewest wasted addresses. Which mask should be used?

A. 255.255.255.128
B. 255.255.255.192
C. 255.255.255.224
D. 255.255.255.240

4. Which two addresses are valid host addresses in the same subnet as 192.168.10.77/28? (Choose two.)

A. 192.168.10.64
B. 192.168.10.65
C. 192.168.10.78
D. 192.168.10.79
E. 192.168.10.80

5. Which IPv4 address is a public (globally routable) address?

A. 10.255.0.1
B. 172.31.200.1
C. 172.32.0.1
D. 192.168.255.254

6. Which two are valid abbreviations of 2001:0db8:0000:0000:0a00:0000:0000:0001? (Choose two.)

A. 2001:db8::a00::1
B. 2001:db8::a00:0:0:1
C. 2001:db8:0:0:a00::1
D. 2001:db8::a::1
E. 2001:db8::a00:1

7. Which IPv6 prefix identifies link-local addresses?

A. FC00::/7
B. FE80::/10
C. FF00::/8
D. 2000::/3

8. An interface with MAC address 0050.56A1.2B3C uses EUI-64 with prefix 2001:db8:1:1::/64. What is its IPv6 address?

A. 2001:db8:1:1:0050:56ff:fea1:2b3c
B. 2001:db8:1:1:250:56ff:fea1:2b3c
C. 2001:db8:1:1:250:56fe:ffa1:2b3c
D. 2001:db8:1:1:5056:a1ff:fe2b:3c00

9. Which two are characteristics of UDP? (Choose two.)

A. It is connectionless.
B. It uses a three-way handshake.
C. It uses windowing for flow control.
D. It has an 8-byte header with low

overhead.

E. It acknowledges every segment.

10. Which fibre type uses a laser light source and supports the longest distances?

A. Multimode fibre
B. Single-mode fibre
C. Shielded twisted pair
D. Category 6a UTP

11. Refer to Figure 35-3. Users on this switch port report slow performance. What is the most likely cause?

A. A speed mismatch
B. A duplex mismatch
C. A damaged cable causing CRC errors
D. An MTU mismatch

Exhibit: SW1

SW1# show interfaces gigabitethernet0/1

GigabitEthernet0/1 is up, line protocol is up (connected)

Hardware is Gigabit Ethernet, address is 0c1a.3b4c.5d01 (bia 0c1a.3b4c.5d01) MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,

Half-duplex, 100Mb/s, media type is 10/100/1000BaseTX
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 output errors, 1832 collisions, 0 interface resets
0 babbles, 412 late collision, 0 deferred

Figure 35-3 Exhibit for question 11.

12. Refer to Figure 35-4. The PC can ping 192.168.1.20 on its own LAN but cannot reach any remote network. What is the problem?

A. The subnet mask is wrong for a Class C

address.

B. The default gateway is not in the PC's

subnet.

C. The PC has no DNS server, so pings fail.
D. The link-local IPv6 address conflicts with

IPv4.

Exhibit: PC1 command prompt

C:\> ipconfig

Ethernet adapter Ethernet0:

Connection-specific DNS Suffix . : corp.example.com

Link-local IPv6 Address . . . . . : fe80::1c4d:2e8f:9a3b:7d21%12 IPv4 Address. . . . . . . . . . . : 192.168.1.50

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Default Gateway . . . . . . . . . : 192.168.2.1

Figure 35-4 Exhibit for question 12.

13. Which set of 2.4 GHz channels is non-overlapping in North America?

A. 1, 5, 9
B. 1, 6, 11
C. 2, 7, 12
D. 1, 7, 13

14. What uniquely identifies a basic service set (BSS)?

A. The SSID
B. The BSSID, which is the MAC address of

the AP radio

C. The channel number
D. The WLAN ID on the controller

15. Which type of hypervisor runs directly on the server hardware without a host operating system?

A. Type 1
B. Type 2
C. Container engine
D. Virtual switch

16. Match each cloud service model on the left to the description on the right. Service

model

Description

1. IaaS A. The provider runs a complete application; you just use it, such as web-based email.
2. PaaS B. The provider supplies virtual machines, storage and networks; you manage the OS and applications.
3. SaaS C. The provider supplies a development and runtime platform; you deploy your own application code.
17. A switch receives a unicast frame whose destination MAC address is not in its MAC address table. What does it do?

A. Drops the frame
B. Sends the frame out all ports in the same VLAN except the port it arrived on
C. Sends an ARP request for the MAC address
D. Returns the frame to the sender

18. What is a collapsed core (two-tier) campus design?

A. A design that combines the access and distribution layers
B. A design that combines the distribution and core layers
C. A design with no redundancy at the core
D. A design in which every leaf connects to every spine

19. What is the last usable host address in 10.20.0.0/22?

A. 10.20.0.254
B. 10.20.3.254
C. 10.20.3.255
D. 10.20.4.254

20. Which IPv6 address range is the equivalent of RFC 1918 private IPv4 space and is not routed on the Internet?

A. Unique local, FC00::/7
B. Link-local, FE80::/10
C. Global unicast, 2000::/3
D. Multicast, FF00::/8

Part 2: Network Access (questions 21–40)

21. What is the default native VLAN on an 802.1Q trunk on a Cisco switch?

A. VLAN 0
B. VLAN 1
C. VLAN 99
D. VLAN 1002

22. Refer to Figure 35-5. Hosts in VLAN 30 on SW1 cannot reach hosts in VLAN 30 on SW2. Which command on Gi0/1 fixes the problem without affecting other VLANs?

A. switchport trunk allowed vlan 30
B. switchport trunk allowed vlan add 30
C. switchport trunk native vlan 30
D. switchport mode trunk

Exhibit: SW1

SW1# show interfaces trunk

Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1
Port Vlans allowed on trunk
Gi0/1 1,10,20
Port Vlans allowed and active in management domain
Gi0/1 1,10,20
Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1,10,20

Figure 35-5 Exhibit for question 22. VLAN 30 exists on both switches.

23. Two switch ports are both configured with switchport mode dynamic auto . What is the result?

A. The link becomes a trunk.
B. The link remains an access link.
C. The ports are err-disabled.
D. The link becomes an EtherChannel.

24. Which command assigns VLAN 20 as the voice VLAN on an access port for an IP phone?

A. switchport access vlan 20 voice
B. switchport voice vlan 20
C. switchport trunk voice 20
D. vlan 20 voice

25. In a router-on-a-stick design, which command on subinterface G0/0.10 associates it with

Vlan 10?

A. switchport access vlan 10
B. encapsulation dot1q 10
C. vlan 10
D. ip vlan 10

26. LLDP is disabled globally on a Cisco switch. Which command enables it?

A. lldp enable
B. lldp run
C. cdp run lldp
D. lldp transmit

27. Which two pieces of information about a directly connected neighbor can CDP provide? (Choose two.)

A. The neighbor's platform/model
B. The neighbor's running configuration
C. The neighbor's management IP address
D. The neighbor's routing table
E. The neighbor's MAC address table

28. Refer to Figure 35-6. All switches run per-VLAN STP with default settings except as shown. Which switch becomes the root bridge?

A. SW1
B. SW2
C. SW3
D. The switch with the most ports

Priority 32769

Mac 0011.1111.1111

SW2

Priority 24577

Mac 0022.2222.2222

Figure 35-6 Exhibit for question 28 (VLAN 1 bridge priorities shown).

29. What is the default short-mode STP port cost of a 1 Gbps link?

A. 2
B. 4
C. 19
D. 100

30. In RSTP, which port role provides an alternate path toward the root bridge and is discarding?

A. Designated port
B. Backup port
C. Alternate port
D. Edge port

31. An access port has PortFast and BPDU Guard enabled. A user connects a switch that sends BPDUs. What happens?

A. The port becomes a root port.
B. The port is placed in the err-disabled

state.

C. The port ignores the BPDUs and keeps

forwarding.

D. The port changes to a trunk.

32. Which RSTP port state combines the legacy STP disabled, blocking and listening states?

A. Learning
B. Forwarding
C. Discarding
D. Listening

33. Which two pairs of EtherChannel modes successfully form an LACP bundle? (Choose two.)

A. active and active
B. passive and passive
C. active and passive
D. desirable and active
E. on and passive

34. An engineer bundles four ports into an EtherChannel, but one port is suspended. Which mismatch on that port is the most likely cause?

A. A different interface description
B. A different speed or duplex setting
C. A different CDP setting
D. A different port number

35. What is the maximum number of active links in a single LACP EtherChannel on Catalyst switches?

A. 2
B. 4
C. 8
D. 16

36. A branch AP is managed by a WLC at headquarters across the WAN, and client traffic must be switched locally at the branch if the WAN fails. Which AP mode is required?

A. Local
B. Monitor
C. FlexConnect
D. Sniffer

37. Which statement about CAPWAP between a lightweight AP and a WLC is true?

A. Control messages use TCP port 5246.
B. Control messages are encrypted with

Dtls.

C. Data traffic must always be encrypted.
D. CAPWAP runs only on Layer 2 without IP.

38. On a WLC, which type of interface maps a WLAN to a client VLAN?

A. Service port
B. Virtual interface
C. Dynamic interface
D. Management interface only

39. Which two statements describe TACACS+? (Choose two.)

A. It uses UDP ports 1812 and 1813.
B. It uses TCP port 49.
C. It encrypts the entire packet body.
D. It encrypts only the password.
E. It is an open IETF standard used for

802.1X.

40. Match each AP mode on the left to its description on the right. One description is not used.

AP mode Description

1. Local A. Captures 802.11 frames and forwards them to a remote packet analyzer
2. Monitor B. Provides wireless point-to-point or mesh links between sites
3. Sniffer C. Serves clients and tunnels all their traffic to the WLC in CAPWAP
4. Bridge D. Does not serve clients; scans all channels for rogues and intrusions

E. Routes traffic between VLANs using OSPF

Part 3: IP Connectivity (questions 41–65)

Exhibit: R1

R1# show ip route

Codes: L - local, C - connected, S - static, O - OSPF, * - candidate default Gateway of last resort is 203.0.113.1 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 203.0.113.1
10.0.0.0/8 is variably subnetted, 9 subnets, 5 masks
C 10.0.12.0/30 is directly connected, GigabitEthernet0/0
L 10.0.12.1/32 is directly connected, GigabitEthernet0/0
C 10.0.13.0/30 is directly connected, GigabitEthernet0/1
L 10.0.13.1/32 is directly connected, GigabitEthernet0/1
C 10.0.14.0/30 is directly connected, GigabitEthernet0/2
L 10.0.14.1/32 is directly connected, GigabitEthernet0/2

O 10.1.1.0/24 [110/3] via 10.0.12.2, 00:12:44, GigabitEthernet0/0 S 10.1.1.64/26 [1/0] via 10.0.13.3

O 10.1.1.64/27 [110/2] via 10.0.14.4, 00:12:44, GigabitEthernet0/2 203.0.113.0/24 is variably subnetted, 2 subnets, 2 masks

C 203.0.113.0/30 is directly connected, GigabitEthernet0/3

L 203.0.113.2/32 is directly connected, GigabitEthernet0/3

Figure 35-7 Exhibit for questions 41 and 43.

41. Refer to Figure 35-7. R1 receives a packet destined for 10.1.1.70. Which next hop does it use?

A. 10.0.12.2
B. 10.0.13.3
C. 10.0.14.4
D. 203.0.113.1

42. A router learns 172.20.0.0/16 from both OSPF and internal EIGRP. Which route is installed in the routing table, assuming default settings?

A. The OSPF route, because its AD is 110
B. The EIGRP route, because its AD is 90
C. Both, for load balancing
D. The route with the lowest metric, regardless of protocol

43. Refer to Figure 35-7. What does the value 3 in [110/3] represent?

A. The administrative distance
B. The OSPF cost (metric) to the destination
C. The number of hops
D. The OSPF area

44. R1 learns a default route through OSPF. An engineer adds ip route 0.0.0.0 0.0.0.0 203.0.113.1 130 . What is the purpose of this route?

A. It replaces the OSPF default route immediately.
B. It is a floating static route used only if the OSPF default route is lost.
C. It load balances with the OSPF default route.
D. It sets the OSPF cost of the default route to 130.

45. Which command configures an IPv6 default route through next hop 2001:db8:acad:1::1?

A. ip route ::/0 2001:db8:acad:1::1
B. ipv6 route ::/0 2001:db8:acad:1::1
C. ipv6 route 0.0.0.0/0 2001:db8:acad:1::1
D. ipv6 default-gateway 2001:db8:acad:1::1

46. Which command creates a host route to 192.168.5.10 through next hop 10.0.0.2?

A. ip route 192.168.5.10 255.255.255.0

10.0.0.2

B. ip route 192.168.5.10 255.255.255.255

10.0.0.2

C. ip route 192.168.5.0 0.0.0.255 10.0.0.2
D. ip host 192.168.5.10 10.0.0.2

47. Which IPv6 static route is valid when the next hop is a link-local address?

A. ipv6 route 2001:db8:5::/64 fe80::2
B. ipv6 route 2001:db8:5::/64 gigabitethernet0/0 fe80::2
C. ipv6 route 2001:db8:5::/64 fe80::2 link-local
D. ip route 2001:db8:5::/64 gigabitethernet0/0 fe80::2

48. An OSPF router has no router-id command. Its interfaces are Loopback0 10.255.255.1, Loopback1 172.16.255.1 and G0/0 192.168.1.1 (all up). What is its router ID?

A. 10.255.255.1
B. 172.16.255.1
C. 192.168.1.1
D. 0.0.0.0 until one is configured

49. Which statement about the OSPF DR election on a broadcast segment is true?

A. The router with the lowest router ID wins a tie.
B. A router with priority 0 can never become the DR or BDR.
C. A new router with a higher priority immediately takes over as DR.
D. The default interface priority is 0.

50. Two OSPF DROTHER routers share a broadcast segment with a DR and BDR. In which state do the two DROTHERs remain with each other?

A. INIT
B. 2-WAY
C. EXSTART
D. FULL

51. Refer to Figure 35-8. R1 and R2 do not form an OSPF adjacency. What is the cause?

A. The OSPF process IDs are different.
B. The hello and dead timers do not match.
C. The router IDs are different.
D. The network type is point-to-point.

Exhibit: R1 and R2

R1# show ip ospf interface g0/0 | include Area|Network|Hello

Internet Address 10.0.12.1/30, Area 0, Attached via Network Statement Process ID 1, Router ID 1.1.1.1, Network Type POINT_TO_POINT, Cost: 1 Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5

R2# show ip ospf interface g0/0 | include Area|Network|Hello

Internet Address 10.0.12.2/30, Area 0, Attached via Network Statement Process ID 2, Router ID 2.2.2.2, Network Type POINT_TO_POINT, Cost: 1 Timer intervals configured, Hello 5, Dead 20, Wait 20, Retransmit 5

Figure 35-8 Exhibit for question 51.

52. Which two parameters must match between two routers for an OSPFv2 adjacency to form on a shared link? (Choose two.)

A. Area ID
B. Router ID
C. Hello and dead intervals
D. Process ID
E. Interface priority

53. What is the effect of ip ospf network point-to-point on an Ethernet link between two routers?

A. OSPF elects a DR and BDR more quickly.
B. No DR or BDR is elected on the link.
C. The link cost becomes 1.
D. Hellos are sent as unicast every 30

seconds.

54. Which command enables OSPF area 0 on only the interface with address 172.16.10.1/30?

A. network 172.16.10.0 0.0.0.255 area 0
B. network 172.16.10.1 0.0.0.0 area 0
C. network 172.16.10.1 255.255.255.252 area
D. network 172.16.0.0 0.0.255.255 area 0

55. Why might an engineer configure auto-cost reference-bandwidth 10000 on all OSPF routers?

A. To make OSPF converge faster
B. So that links faster than 100 Mbps get different, lower costs
C. To limit OSPF to 10 Gbps links
D. To change the administrative distance

56. Refer to Figure 35-9. Which two statements are true? (Choose two.)

A. R1 is the DR.
B. R1 is a DROTHER.
C. The adjacency with 4.4.4.4 is stuck and must be fixed.
D. R1 has no neighbors in FULL state.
E. 4.4.4.4 is a DROTHER.

Exhibit: R1

R1# show ip ospf neighbor

Neighbor ID Pri State Dead Time Address Interface
2.2.2.2 100 FULL/DR 00:00:35 192.168.50.2 GigabitEthernet0/0
3.3.3.3 1 FULL/BDR 00:00:33 192.168.50.3 GigabitEthernet0/0

4.4.4.4 1 2WAY/DROTHER 00:00:38 192.168.50.4 GigabitEthernet0/0

Figure 35-9 Exhibit for question 56.

57. Which OSPF command advertises a router's static default route to other OSPF routers?

A. redistribute static default
B. default-information originate
C. network 0.0.0.0 255.255.255.255 area 0
D. ip default-network 0.0.0.0

58. What is the effect of passive-interface gigabitethernet0/1 under router ospf 1?

A. OSPF stops advertising the G0/1 subnet.
B. OSPF stops sending hellos on G0/1 but still advertises its subnet.
C. G0/1 is shut down.
D. G0/1 only receives LSAs.

59. What virtual MAC address does HSRP version 1 use for group 10?

A. 0000.0c07.ac10
B. 0000.0c07.ac0a
C. 0000.5e00.010a
D. 0000.0c9f.f00a

60. R1 has HSRP priority 110 and R2 has the default priority. R1 reloads; when it returns, R2 stays active. Why?

A. R1's priority is too low.
B. Preemption is not configured on R1.
C. The virtual IP addresses differ.
D. HSRP version 2 never changes the active

router.

61. Which two statements about first hop redundancy protocols are true? (Choose two.)

A. VRRP is an open standard.
B. HSRP is an IETF standard.
C. GLBP can load balance across multiple gateways using one virtual IP address.
D. VRRP uses virtual MAC 0000.0c07.acXX.
E. GLBP is an IEEE standard.

62. A router learns two OSPF routes to 10.9.0.0/16 with the same cost through different neighbors. What does it do by default?

A. Installs only the route from the neighbor with the highest router ID
B. Installs both routes and load balances
C. Installs neither route
D. Installs the first route learned only

63. A router shows "Gateway of last resort is not set" and receives a packet for a destination not in its routing table. What happens?

A. The packet is flooded out all interfaces.
B. The packet is dropped.
C. The packet is sent to the router's management interface.
D. The packet is buffered until a route appears.

64. An engineer configures ip route 10.5.0.0 255.255.0.0 192.168.1.2 . What must be true for the route to be installed?

A. The router must have a route to

192.168.1.2.

B. OSPF must be running.
C. 192.168.1.2 must be a loopback address.
D. The route must have AD 0.

65. To which multicast address do OSPFv2 routers send hello packets on a broadcast network?

A. 224.0.0.2
B. 224.0.0.5
C. 224.0.0.6
D. 224.0.0.10

Part 4: IP Services (questions 66–75)

66. Refer to Figure 35-10. Which two statements are true? (Choose two.)

A. 192.168.1.25 is an inside local address.
B. 203.0.113.10 is an inside local address.
C. The router is performing PAT (NAT

overload).

D. Static one-to-one NAT is in use.
E. 198.51.100.80 is an inside global

address.

Exhibit: R1

R1# show ip nat translations

Pro Inside global Inside local Outside local Outside global

tcp 203.0.113.10:51544 192.168.1.25:51544 198.51.100.80:443 198.51.100.80:443 tcp 203.0.113.10:51545 192.168.1.26:51545 198.51.100.80:443 198.51.100.80:443

Figure 35-10 Exhibit for question 66.

67. Which command translates inside hosts permitted by ACL 1 to the address of G0/1 using

Pat?

A. ip nat inside source list 1 interface

g0/1 overload

B. ip nat outside source list 1 interface

g0/1

C. ip nat inside source static 1 g0/1
D. ip nat pool 1 interface g0/1 overload

68. Which command makes a router act as an authoritative NTP server using its own clock at stratum 3?

A. ntp server 3
B. ntp master 3
C. ntp peer 3
D. clock stratum 3

69. Clients in VLAN 10 must receive addresses from a DHCP server on another subnet. Where is ip helper-address configured?

A. On the DHCP server's interface
B. On the router or SVI interface that receives the clients' broadcasts (VLAN 10)
C. In global configuration on the access switch
D. On every client

70. Which statement compares TFTP with FTP correctly?

A. TFTP uses TCP port 21 and requires a

B. TFTP uses UDP port 69 and has no

authentication.

C. FTP uses UDP and has no authentication.
D. Both protocols encrypt file transfers.

71. A router is configured with logging trap warnings . Which severity levels are sent to the syslog server?

A. Levels 0 through 4
B. Level 4 only
C. Levels 4 through 7
D. Levels 5 through 7

72. Which SNMP version and security level provide both authentication and encryption?

A. SNMPv2c with community strings
B. SNMPv3 noAuthNoPriv
C. SNMPv3 authNoPriv
D. SNMPv3 authPriv

73. Which DSCP per-hop behaviour is normally used for voice bearer traffic?

A. AF41
B. CS1
C. EF (DSCP 46)
D. Default (DSCP 0)

74. Which two statements describe traffic shaping and policing? (Choose two.)

A. Shaping buffers excess traffic, adding delay.
B. Policing buffers excess traffic.
C. Policing drops or re-marks traffic that exceeds the rate.
D. Shaping is used only on inbound traffic.
E. Policing never drops packets.

75. Which two commands are required on a classic IOS router before crypto key generate rsa can create keys for SSH? (Choose two.)

A. hostname R1 (a non-default hostname)
B. ip domain-name example.com
C. enable secret
D. service password-encryption
E. transport input telnet

Part 5: Security Fundamentals (questions 76–90)

76. Match each security term on the left with its definition on the right.

Term Definition

1. Vulnerability A. Code or a technique that takes advantage of a weakness
2. Exploit B. A weakness in a system or its design
3. Threat C. A measure that reduces the likelihood or impact of an attack
4. Mitigation D. A potential danger to an asset, such as an attacker who could use an exploit
77. Which combination is an example of multifactor authentication?

A. A password and a security question
B. A smart card and a PIN
C. Two different passwords
D. A username and a password

78. Which AAA function records the commands a user entered and how long the session lasted?

A. Authentication
B. Authorization
C. Accounting
D. Auditing

79. Which statement describes a site-to-site IPsec VPN?

A. Each end host runs VPN client software.
B. VPN gateways encrypt traffic between sites; end hosts send normal, unencrypted traffic.
C. It always uses a web browser and TLS.
D. It works only over private MPLS links.

80. A router has both enable password and enable secret configured with different values. Which is used to enter privileged EXEC mode?

A. The enable password
B. The enable secret
C. Either one
D. Neither; the console password is used

81. What is true of service password-encryption ?

A. It hashes passwords with SHA-256.
B. It applies weak, reversible type 7 encryption to plaintext passwords in the configuration.
C. It encrypts SSH sessions.
D. It is required for the enable secret.

82. Where should a standard IPv4 ACL generally be placed?

A. As close to the source as possible
B. As close to the destination as possible
C. Only on the outside interface
D. Only on VTY lines

83. Refer to Figure 35-11. ACL 110 is applied inbound on R2's interface facing 10.1.1.0/24. Which traffic from host 10.1.1.5 is permitted?

A. HTTP to 10.2.2.2
B. Ping (ICMP echo) to 10.2.2.2
C. HTTPS to 10.2.2.2
D. None; all traffic is denied

Exhibit: R2

R2# show access-lists 110

Extended IP access list 110
10 deny tcp 10.1.1.0 0.0.0.255 host 10.2.2.2 eq www
20 deny icmp any host 10.2.2.2 echo
30 permit ip 10.1.1.0 0.0.0.255 any

Figure 35-11 Exhibit for question 83.

84. Which address and wildcard mask match all hosts from 172.16.32.0 through 172.16.39.255?

A. 172.16.32.0 0.0.15.255
B. 172.16.32.0 0.0.7.255
C. 172.16.32.0 0.0.8.255
D. 172.16.32.0 255.255.248.0

85. A standard ACL contains only access-list 10 deny host 10.1.1.5 and is applied outbound on an interface. What happens to traffic from other hosts?

A. It is permitted.
B. It is denied by the implicit deny at the end of the ACL.
C. It is permitted only if it is TCP.
D. The ACL is ignored because it has no permit.

86. Which port security violation mode drops offending frames, logs the event and increments the violation counter without disabling the port?

A. Protect
B. Restrict
C. Shutdown
D. Err-disable

87. With DHCP snooping enabled, which switch port should be configured as trusted?

A. Every access port connected to a user PC
B. The uplink toward the legitimate DHCP

server

C. Ports connected to IP phones
D. Unused ports

88. What does Dynamic ARP Inspection use to validate ARP packets on untrusted ports?

A. The MAC address table
B. The DHCP snooping binding table
C. The routing table
D. The CDP neighbor table

89. Which mechanism does WPA3-Personal use in place of the WPA2 pre-shared key handshake?

A. TKIP
B. SAE (Simultaneous Authentication of

Equals)

C. WEP
D. 802.1X with EAP-TLS only

90. Which two components are required for WPA2-Enterprise authentication? (Choose two.)

A. 802.1X
B. A pre-shared key
C. A RADIUS (AAA) server
D. WEP keys
E. MAC filtering

Part 6: Automation and Programmability (questions 91–100)

91. Which two are benefits of network automation? (Choose two.)

A. Fewer configuration errors from manual entry
B. Elimination of the data plane
C. Consistent configuration deployed quickly to many devices
D. No need for network engineers to understand protocols
E. Devices no longer need management IP addresses

92. Which protocol is a southbound interface used by a controller to configure devices with YANG-modelled data over SSH?

A. NETCONF
B. SMTP
C. OSPF
D. JSON

93. In a software-defined fabric, what is the overlay?

A. The physical switches and links
B. Virtual networks built with tunnels such as VXLAN on top of the physical network
C. The controller's database
D. The northbound REST API

94. An assurance platform learns normal traffic patterns for each site and alerts when behaviour deviates. Which type of AI is this?

A. Generative AI
B. Predictive AI / machine learning
C. Rule-based expert system with fixed

thresholds

D. Large language model chat

95. Match each HTTP verb to the CRUD operation it normally performs. One operation is used twice.

HTTP verb CRUD operation

1. POST A. Create
2. GET B. Read
3. PATCH C. Update
4. DELETE D. Delete

5. put

96. A script first sends credentials to /api/v1/auth/token , then includes the returned string in a header on every later request. Which authentication type is this?

A. Basic authentication on every request
B. Token-based (bearer token)

authentication

C. SNMP community authentication
D. No authentication

97. Refer to Figure 35-12. Which two statements are true? (Choose two.)

A. The value of stp is an object.
B. The vlans array contains three objects.
C. The value of root is a string.
D. The document contains three arrays.
E. The values of id are strings.

Exhibit: API response body
{
"switch": "SW1",
"vlans": [

{ "id": 10, "name": "USERS", "ports": ["Gi1/0/1", "Gi1/0/2"] }, { "id": 20, "name": "VOICE", "ports": [] }

Figure 35-12 Exhibit for question 97.

98. Which JSON snippet is valid?

A. {"hostname": "R1", "vlans": [10, 20,]}
B. {"hostname": "R1", "enabled": true}
C. {hostname: "R1"}
D. {'hostname': 'R1'}

99. Which two statements describe Ansible? (Choose two.)

A. It requires an agent installed on each network device.
B. It is agentless and typically connects to network devices over SSH.
C. Playbooks are written in YAML.
D. It uses a pull model in which devices poll a master server.
E. Its configuration files are written in HCL.

00. Which statement about Terraform is true?

A. It is a procedural scripting tool that runs only on network devices.
B. It is declarative, uses HCL, and tracks managed resources in a state file.
C. It requires Puppet agents on every device.
D. It can only read configuration, never change it.

35.5 Answer Key

Score yourself: 85 or more correct suggests you are ready; 75 to 84 means review the chapters behind your misses and retest in a week; below 75, revisit the eight-week plan. For matching questions, count the question correct only if every pair is correct.

Table 35-4 Practice exam answers and explanations

Q Answer Explanation Ch.

1 C Routers forward by destination IP address; switches use MAC addresses and hubs repeat bits.

2 B /20 gives a block of 16 in the third octet: 45 falls in 32–47, so the subnet is 172.16.32.0 and the broadcast is 172.16.47.255.

3 B /26 (255.255.255.192) gives 62 hosts; /27 gives only 30, and /25 wastes 76. 7 4 B, C The /28 subnet is 192.168.10.64–.79: .64 is the subnet ID, .79 the broadcast, so hosts are .65–.78.

5 C The private 172 range is 172.16.0.0–172.31.255.255 (172.16.0.0/12); 172.32.0.1 is outside it.

6 B, C Either run of zeros may be replaced by :: once. A and D use :: twice; E drops two zero hextets.

7 B FE80::/10 is link-local. FC00::/7 is unique local, FF00::/8 multicast, 2000::/3 global unicast.

8 B Split the MAC, insert FFFE (0050:56FF:FEA1:2B3C) and flip the seventh bit: 00 becomes 02, giving 250:56ff:fea1:2b3c.

9 A, D UDP is connectionless with an 8-byte header. Handshakes, windowing and acknowledgements are TCP features.

10 B Single-mode fibre uses a laser and a narrow core to reach kilometres; multimode typically uses LEDs/VCSELs over shorter runs.

11 B Half duplex with collisions and especially late collisions indicates a duplex mismatch; there are no CRC errors.

12 B The gateway 192.168.2.1 is not in 192.168.1.0/24, so the PC cannot ARP for it to reach remote networks.

13 B Channels 1, 6 and 11 are the non-overlapping 2.4 GHz channels in North America.

14 B The BSSID (the AP radio's MAC) identifies a BSS; many BSSs can share one

Ssid.

15 A Type 1 (bare-metal) hypervisors such as ESXi run directly on hardware; Type 2 runs on a host OS.

16 1-B, 2-C,

3-A

IaaS gives infrastructure, PaaS a platform for your code, SaaS a finished application.

17 B Unknown unicast frames are flooded out all ports in the VLAN except the ingress port.

18 B A collapsed core merges the distribution and core layers into one tier. 11 19 B 10.20.0.0/22 spans 10.20.0.0–10.20.3.255; the last host is 10.20.3.254. 7 20 A Unique local addresses (FC00::/7, in practice FD00::/8) are the private-use equivalent.

21 B VLAN 1 is the default native (untagged) VLAN on 802.1Q trunks. 12 22 B add appends VLAN 30 to the allowed list; option A would replace the list and cut VLANs 1, 10 and 20.

23 B Dynamic auto only responds to DTP; two passive sides never negotiate a trunk. 12 24 B switchport voice vlan 20 tells the phone (via CDP/LLDP) to tag voice traffic in VLAN 20.

25 B Subinterfaces use encapsulation dot1q <vlan> before an IP address is assigned.

26 B lldp run enables LLDP globally; per-interface lldp transmit/receive are on by default once it runs.

27 A, C CDP advertises device ID, platform, IP address, port ID, capabilities and software version, not configurations or tables.

28 B Lowest bridge ID wins and priority is compared first: 24577 beats 32769, so MAC addresses do not matter.

29 B Short-mode costs: 10 Mbps 100, 100 Mbps 19, 1 Gbps 4, 10 Gbps 2. 15 30 C An alternate port is a discarding backup path to the root via another switch; a backup port backs up a designated port on the same segment.

31 B BPDU Guard err-disables a PortFast port that receives a BPDU. 16 32 C RSTP's discarding state replaces disabled, blocking and listening. 16 33 A, C LACP needs at least one active side. Passive/passive never starts; desirable is PAgP; on does not negotiate.

34 B Member ports must match speed, duplex and switchport (VLAN/trunk)

settings; descriptions do not matter.

35 C LACP allows up to 16 configured ports with 8 active and up to 8 in hot standby. 17 36 C FlexConnect APs can switch client traffic locally and keep serving clients if the WAN link to the WLC fails.

37 B CAPWAP control (UDP 5246) is DTLS-encrypted; data (UDP 5247) encryption is optional.

38 C Dynamic interfaces map WLANs to client VLANs on the controller. 18 39 B, C TACACS+ uses TCP 49 and encrypts the whole body; RADIUS uses UDP 1812/1813 and encrypts only the password.

40 1-C, 2-D,
3-A, 4-B
E is unused: APs do not run OSPF. 18

41 C Longest match wins before AD: 10.1.1.70 is in 10.1.1.64/27 (64–95), more specific than the /26 static or the /24.

42 B Lower AD wins between sources: internal EIGRP 90 beats OSPF 110. 19 43 B In [AD/metric], 110 is OSPF's AD and 3 is the OSPF cost. 19 44 B AD 130 is worse than OSPF's 110, so the static route is installed only if the OSPF default disappears.

45 B IPv6 static routes use ipv6 route and ::/0 for default. 20 46 B A host route uses a /32 mask, 255.255.255.255. 20

47 B Link-local next hops are only unique per link, so the exit interface must be specified too.

48 B Without a router-id command, OSPF uses the highest loopback IP (172.16.255.1) before any physical interface.

49 B Priority 0 makes a router ineligible. Ties go to the highest RID, elections are not preemptive, and the default priority is 1.

50 B DROTHERs stay in 2-WAY with each other and go FULL only with the DR and

Bdr.

51 B Hello/dead timers must match. Process IDs are locally significant and RIDs must differ.

52 A, C Area ID and hello/dead intervals must match (as must subnet, authentication and MTU); RID must be unique and process ID is local.

53 B The point-to-point network type skips DR/BDR election and goes straight to

Full.

54 B A 0.0.0.0 wildcard matches exactly one interface address. 22 55 B With the default 100 Mbps reference, FastEthernet, 1G and 10G all cost 1; raising it to 10000 Mbps distinguishes them.

56 B, E R1 is FULL with the DR and BDR and 2WAY with 4.4.4.4, so both R1 and 4.4.4.4 are DROTHERs; 2WAY between DROTHERs is normal.

57 B default-information originate advertises the default route into OSPF. 22 58 B A passive interface sends no hellos (forms no neighbors) but its subnet is still advertised.

59 B HSRPv1 uses 0000.0c07.acXX with the group in hex: 10 = 0a. 23 60 B HSRP preemption is disabled by default, so the higher-priority router does not reclaim the active role.

61 A, C VRRP is an IETF standard (MAC 0000.5e00.01XX); GLBP (Cisco) load balances with multiple AVFs; HSRP is Cisco proprietary.

62 B Equal-cost OSPF routes are installed together for ECMP load balancing (4 paths by default).

63 B With no matching route and no default route, the router drops the packet (and may send ICMP unreachable).

64 A A next-hop static route needs a recursive lookup that resolves the next hop to a connected interface.

65 B 224.0.0.5 is all OSPF routers; 224.0.0.6 is DR/BDR, 224.0.0.10 is EIGRP and 224.0.0.2 all routers.

66 A, C Private 192.168.1.x are inside local; many inside locals share 203.0.113.10 with different ports, which is PAT.

67 A The overload keyword with the interface creates PAT for inside sources matching ACL 1.

68 B ntp master 3 makes the router an authoritative source at stratum 3; ntp server makes it a client.

69 B The helper address goes on the interface that receives the client broadcasts and forwards them as unicast to the server.

70 B TFTP uses UDP 69 with no login; FTP uses TCP 20/21 with a username and password; neither encrypts.

71 A A logging level includes that severity and all more severe ones: warnings (4) sends 0–4.

72 D SNMPv3 authPriv provides authentication and privacy (encryption). 26 73 C Expedited Forwarding, DSCP 46, provides low loss, latency and jitter for voice. 27 74 A, C Shapers queue excess traffic (delay); policers drop or re-mark it. 27 75 A, B The RSA key name is built from hostname and domain name, so both must be set first.

76 1-B, 2-A,
3-D, 4-C
Weakness, technique, potential danger, countermeasure. 28

77 B A smart card (something you have) plus a PIN (something you know) is two factors; the others are one factor twice.

78 C Accounting records what users did and for how long. 28

79 B Site-to-site VPN gateways protect traffic transparently for hosts; remote-access VPNs use client software or a browser.

80 B If both are configured, the enable secret takes precedence. 29 81 B Type 7 is a reversible obfuscation; it only stops shoulder surfing. 29 82 B Standard ACLs match only source, so place them near the destination to avoid blocking other paths; extended ACLs go near the source.

83 C HTTP (www) and ping to 10.2.2.2 are denied; HTTPS matches line 30 and is permitted.

84 B 32–39 is a block of 8 in the third octet (/21), so the wildcard is 0.0.7.255. 30 85 B Every ACL ends with an implicit deny any, so an ACL with only deny entries blocks everything.

86 B Restrict drops, logs and counts; protect drops silently; shutdown err-disables the port (the default).

87 B Only ports toward legitimate DHCP servers are trusted; server messages arriving on untrusted ports are dropped.

88 B DAI checks ARP IP-to-MAC bindings against the DHCP snooping binding table (or ARP ACLs).

89 B WPA3-Personal uses SAE, which resists offline dictionary attacks. 32 90 A, C WPA2-Enterprise uses 802.1X/EAP with a RADIUS authentication server instead of a PSK.

91 A, C Automation reduces errors and delivers consistent changes at scale; devices still forward traffic and engineers still need protocol knowledge.

92 A NETCONF (TCP 830 over SSH) carries YANG-modelled XML between controller and device.

93 B The overlay is the tunnel-based virtual network; the underlay is the physical network.

94 B Learning baselines and detecting anomalies is predictive AI/ML; generative AI creates new content.

95 1-A, 2-B,
3-C, 4-D,
5-C

POST creates, GET reads, PUT and PATCH update, DELETE deletes. 34 96 B Exchanging credentials for a token that accompanies each request is token-based (bearer) authentication.34 97 A, D stp holds an object; arrays are vlans and the two ports lists (three); vlans has two objects; root is a boolean and id values are numbers.

98 B A has a trailing comma, C an unquoted key and D single quotes. 34 99 B, C Ansible is agentless, pushes over SSH, and uses YAML playbooks; HCL is Terraform's language.

100 B Terraform is declarative, written in HCL, and compares configuration with its state file to plan changes.