Cisco CCNA (200-301) — All Questions

With OSPF's default reference bandwidth of 100 Mbps, what cost is assigned to a 25 Mbps link?

• a.1, the minimum cost OSPF ever assigns
• b.40, from an incorrect reference calculation
• c.4✓
• d.25, taken directly from the link speed in Mbps

OSPF cost equals reference bandwidth divided by interface bandwidth: 100 / 25 = 4. Higher-bandwidth interfaces receive lower costs, so this 25 Mbps link is less preferred than a 50 or 100 Mbps link to the same destination.

If 'auto-cost reference-bandwidth 1000' is configured, what OSPF cost does a 100 Mbps interface receive?

• a.19, which is a spanning-tree cost value
• b.10✓
• c.1, as it would under the default reference bandwidth
• d.100, taken straight from the interface speed

Raising the reference bandwidth to 1000 Mbps changes the formula to 1000 / 100 = 10. Engineers raise the reference so gigabit and faster links receive distinct, lower costs instead of all collapsing to a cost of 1.

A packet traverses two OSPF links with costs of 1 and 10 to reach a destination network. What is the total path cost?

• a.1, using only the lowest single link cost
• b.11✓
• c.10, using only the highest single link cost
• d.5, from averaging the two link costs

OSPF sums the cost of each outgoing interface along the path, so 1 + 10 = 11 is the total cost to the destination. The router compares total path costs and installs the lowest-cost path in the routing table.

Which wildcard mask is used in an OSPF network statement to match exactly the /30 subnet 10.1.1.0?

• a.0.0.0.255, which would match an entire /24
• b.255.255.255.252, which is the subnet mask, not a wildcard
• c.0.0.0.3✓
• d.0.0.0.15, which matches a /28 range instead

A wildcard mask is the inverse of the subnet mask, so a /30 (255.255.255.252) becomes 0.0.0.3. The statement 'network 10.1.1.0 0.0.0.3 area 0' enables OSPF only on interfaces within that /30 subnet.

In an OSPF network statement, which wildcard mask matches a single /26 subnet?

• a.0.0.0.31, which matches a /27 subnet instead
• b.0.0.0.127, which matches a /25 subnet instead
• c.0.0.0.64, which is not a valid contiguous wildcard
• d.0.0.0.63✓

A /26 subnet mask is 255.255.255.192, whose inverse wildcard is 0.0.0.63. That wildcard matches the 64 addresses of one /26 block, enabling OSPF only on interfaces in that subnet.

By default, which two metrics does EIGRP use to compute its composite metric?

• a.Bandwidth and hop count combined together
• b.Hop count and maximum transmission unit size
• c.Load and reliability, which are off by default
• d.Bandwidth and delay✓

By default EIGRP's composite metric is derived from the minimum bandwidth and the cumulative delay along a path. Load and reliability can be enabled with K-values but are off by default, and MTU is carried but not used in the metric.

What is the administrative distance of an internal EIGRP route on a Cisco router?

• a.90✓
• b.120
• c.110
• d.100

Internal EIGRP routes have an administrative distance of 90, making them more trusted than OSPF (110) or RIP (120) for the same prefix. External EIGRP routes, learned via redistribution, use a higher AD of 170.

In EIGRP, what is a feasible successor?

• a.The route with the highest metric in the topology table
• b.A precomputed loop-free backup route ready to use if the successor fails✓
• c.The primary best route that is currently installed and forwarding
• d.The default gateway route learned from a neighbor

A feasible successor is a backup route that already satisfies the feasibility condition, so EIGRP can switch to it instantly without recalculating when the successor (the best route) is lost. This gives EIGRP very fast convergence.

Which OSPF LSA type is generated by the Designated Router to describe a multiaccess network segment and its attached routers?

• a.Type 2 (Network LSA)✓
• b.Type 5 (AS External LSA), which an ASBR originates
• c.Type 1 (Router LSA), which each router originates for itself
• d.Type 3 (Summary LSA), which an ABR sends between areas

The Designated Router floods a Type 2 Network LSA to represent a multiaccess segment and list the routers attached to it. Each router also originates a Type 1 Router LSA describing its own links and interfaces.

Which OSPF LSA type advertises routes redistributed into OSPF from an external autonomous system?

• a.Type 1 (Router LSA), describing a router's own interfaces
• b.Type 3 (Summary LSA), describing inter-area routes
• c.Type 5 (AS External LSA)✓
• d.Type 2 (Network LSA), describing a multiaccess segment

An ASBR originates Type 5 AS External LSAs to advertise routes learned from outside the OSPF domain, such as redistributed static or BGP routes. These are flooded throughout the OSPF domain except into stub-type areas.

What is the effect of configuring an OSPF area as a standard stub area?

• a.It disables the DR and BDR election on that area's segments
• b.It blocks Type 5 external LSAs and injects a default route instead✓
• c.It prevents any route summarization within the area
• d.It blocks all inter-area routes coming from other areas

A stub area does not receive Type 5 external LSAs; the ABR instead injects a default route so internal routers can still reach external destinations. This reduces the size of the link-state database on stub routers.

What is the default OSPF interface priority used during DR/BDR election on a broadcast segment?

• a.0, which would exclude the router from the election
• b.1✓
• c.100, which must be set manually to participate
• d.32768, which is a spanning-tree bridge priority

The default OSPF interface priority is 1, and the highest priority wins the DR election, with the router ID breaking ties. Setting the priority to 0 removes a router from the election entirely.

What does the command 'network 10.1.1.5 0.0.0.0 area 0' accomplish under an OSPF process?

• a.It statically sets the router ID to the value 10.1.1.5
• b.It enables OSPF only on the interface whose IP is exactly 10.1.1.5✓
• c.It enables OSPF on the entire 10.0.0.0/8 classful network
• d.It disables OSPF specifically on the 10.1.1.5 interface

A wildcard of 0.0.0.0 requires an exact match, so only the interface configured with 10.1.1.5 is placed into area 0. This is a precise way to enable OSPF interface by interface rather than by whole subnets.

In the output of 'show ip route', what does the 'O IA' code indicate?

• a.An EIGRP internal route learned from a neighbor
• b.An OSPF intra-area route within the same area
• c.An OSPF inter-area route✓
• d.An OSPF external type-2 route from redistribution

The 'O IA' code marks an OSPF route learned from another area through the backbone, meaning inter-area. Plain 'O' is intra-area, while 'O E1' and 'O E2' denote external routes redistributed into OSPF.

What is the default administrative distance of an external BGP (eBGP) route on a Cisco router?

• a.200
• b.20✓
• c.110
• d.90

External BGP routes have a low administrative distance of 20, making them highly trusted, while internal BGP (iBGP) routes use 200. The low eBGP value reflects that these routes come from a directly peered external autonomous system.

A packet is destined for 172.20.14.130. The routing table contains 172.20.0.0/16, 172.20.14.0/24, and 172.20.14.128/26. Which route is used?

• a.0.0.0.0/0, only if no other route existed at all
• b.172.20.0.0/16, the least specific of the three routes
• c.172.20.14.0/24, which is a shorter, less specific match
• d.172.20.14.128/26✓

Routers use longest-prefix match, so the most specific route wins. The /26 covers .128 through .191, which includes .130, and its 26-bit prefix is longer than the /24 or /16, so it is selected.

Which command configures an IPv6 static route to 2001:db8:2::/64 via the next hop 2001:db8:1::2?

• a.ipv6 static 2001:db8:2::/64 via 2001:db8:1::2, which is not valid
• b.ipv6 route 2001:db8:1::2 2001:db8:2::/64, with the arguments reversed
• c.ipv6 route 2001:db8:2::/64 2001:db8:1::2✓
• d.ip route 2001:db8:2::/64 2001:db8:1::2, using the IPv4 keyword

IPv6 static routes use 'ipv6 route <prefix>/<length> <next-hop>', so the destination prefix comes first, then the next hop. The IPv4 'ip route' keyword does not apply to IPv6 destinations.

On a router-on-a-stick subinterface serving VLAN 30, which command tags outgoing traffic for that VLAN?

• a.switchport access vlan 30, which is a switch-only command
• b.vlan 30, which only creates the VLAN in the database
• c.encapsulation dot1Q 30✓
• d.encapsulation isl 30, referencing a deprecated tagging method

On a router subinterface, 'encapsulation dot1Q 30' applies the 802.1Q tag for VLAN 30 so the router can route between VLANs over a single trunk. Switchport commands do not exist on router interfaces.

What must be configured for a Layer 3 switch to route between VLAN 10 and VLAN 20 using SVIs?

• a.Router-on-a-stick subinterfaces on an external router
• b.A trunk to an external router as the only option
• c.An interface VLAN (SVI) with an IP address for each VLAN, plus 'ip routing' enabled✓
• d.A separate physical routed port cabled for each VLAN

SVIs (interface vlan 10 and interface vlan 20) give each VLAN a gateway IP on the switch, and 'ip routing' must be enabled so the switch forwards between them. This provides fast inter-VLAN routing entirely within the multilayer switch.

What is the primary purpose of Cisco Express Forwarding (CEF)?

• a.It negotiates trunk links between adjacent switches
• b.It runs the shortest-path-first calculation for OSPF
• c.It encrypts routing protocol updates between neighbors
• d.It pre-builds forwarding and adjacency tables for fast hardware-based packet switching✓

CEF builds a Forwarding Information Base and an adjacency table ahead of time so packets are switched in hardware without a route-cache lookup per flow. This yields high, predictable forwarding performance compared with process switching.

Which summary address aggregates the networks 192.168.8.0/24 through 192.168.11.0/24 into a single route?

• a.192.168.8.0/22✓
• b.192.168.8.0/21, which also covers .12 through .15
• c.192.168.0.0/20
• d.192.168.8.0/23

The four networks 8, 9, 10, and 11 share the first 22 bits, so 192.168.8.0/22 exactly summarizes them. A /21 would also include .12 through .15, and a /23 covers only two of the four networks.

Which network is NOT contained within the summary route 10.4.0.0/14?

• a.10.5.0.0/16
• b.10.4.9.0/24, which sits at the start of the range
• c.10.8.5.0/24✓
• d.10.7.200.0/24

A /14 covers a block of four in the second octet, so 10.4.0.0/14 spans 10.4.0.0 through 10.7.255.255. The network 10.8.5.0 falls in the next block (10.8-10.11) and is therefore outside the summary.

Why does a router performing summarization often install a route to Null0 for the summarized prefix?

• a.To speed convergence by skipping the SPF calculation
• b.To drop packets that match the summary but have no more-specific route, preventing loops✓
• c.To advertise a default route to downstream neighbors
• d.To load-balance traffic across the summarized child networks

A discard (Null0) route for the summary silently drops traffic matching the aggregate that has no matching specific subnet, which prevents routing loops and black-holes stray packets. Longer-prefix routes to real subnets still take precedence.

A prefix is learned via both OSPF (metric 20) and EIGRP (metric 3000). Which route is installed and why?

• a.Neither route, because the two protocols conflict
• b.The OSPF route, because its metric of 20 is much lower
• c.Both routes, load-balanced across the two protocols
• d.The EIGRP route, because its administrative distance of 90 is lower than OSPF's 110✓

When the same prefix is learned from different protocols, administrative distance decides, not the metric. Internal EIGRP's AD of 90 beats OSPF's 110, so the EIGRP route is installed; metrics are only compared within a single protocol.

Which command displays the routing protocols running on a router, their timers, and the networks they advertise?

• a.show ip route, which lists installed routes only
• b.show running-config | section ospf, which shows raw config
• c.show ip protocols✓
• d.show ip interface brief, which lists interface status

'show ip protocols' summarizes each active routing protocol, including timers, administrative distances, networks advertised, and neighbor sources. It is a fast way to confirm what a router is running and how it is configured.

Hosts in VLAN 10 cannot reach VLAN 20 even though both SVIs show as up/up. What is the most likely cause?

• a.The 'ip routing' command is not enabled on the Layer 3 switch✓
• b.Spanning tree has blocked the uplink between the switches
• c.DNS is misconfigured on the client workstations
• d.The two VLANs share a single broadcast domain by design

Even with both SVIs up, a multilayer switch will not forward between VLANs unless 'ip routing' is enabled globally. VLANs are separate broadcast domains, so routing must be turned on to move traffic between them.

A static route points to a next-hop IP address that the router has no way to reach. What happens to the route?

• a.It is redistributed into every running routing protocol
• b.It triggers the router to form an OSPF adjacency automatically
• c.It is not installed until the next hop becomes reachable through a recursive lookup✓
• d.It is installed anyway with an administrative distance of 255

A static route with only a next-hop IP requires a recursive lookup to resolve how to reach that next hop; if that lookup fails, the route is not placed in the routing table. Once the next hop becomes reachable, the static route is installed.

What is the primary purpose of a First Hop Redundancy Protocol such as HSRP?

• a.To encrypt traffic sent to the default gateway
• b.To load-balance OSPF paths across multiple equal-cost links
• c.To present a virtual default-gateway IP shared by redundant routers for failover✓
• d.To assign IP addresses dynamically to end hosts

An FHRP like HSRP lets two or more routers share a virtual IP and MAC that hosts use as their default gateway, so if the active router fails a standby takes over transparently. Hosts keep the same gateway address throughout.

In HSRP, which router forwards traffic that hosts send to the group's virtual IP address?

• a.The Standby router, which waits in reserve
• b.The Active router✓
• c.Whichever router has the highest IP address at all times
• d.Both routers simultaneously by default

In HSRP only the Active router forwards traffic for the virtual IP; the Standby router monitors it and takes over if the Active fails. Election favors the highest HSRP priority, with the highest IP as a tie-breaker, not automatic load sharing.

How does GLBP differ from HSRP and VRRP?

• a.GLBP does not use a virtual IP address at all
• b.GLBP supports only a single active forwarding router
• c.GLBP can load-balance traffic across multiple gateways at the same time✓
• d.GLBP operates exclusively on IPv6 networks

GLBP (Gateway Load Balancing Protocol) allows several routers in the group to forward traffic simultaneously by handing out different virtual MACs to clients, providing load balancing as well as redundancy. HSRP and VRRP normally keep just one active forwarder.

At what point in a DHCP lease does a client first attempt to renew, entering the RENEWING state?

• a.At 50% of the lease time (timer T1)✓
• b.At 100% of the lease, only after the address expires
• c.At 87.5% of the lease time, when it would begin rebinding
• d.At 25% of the lease, immediately after acknowledgment

A DHCP client tries to renew directly with its server at T1, which is 50% of the lease duration. If that fails, at T2 (about 87.5%) it broadcasts to any server (rebinding), and at 100% the lease expires.

How does a DHCP server ensure a specific host always receives the same IP address?

• a.By adding the address to the pool's exclusion list
• b.By shortening that host's lease time to a few seconds
• c.By enabling DHCP snooping on the access switch
• d.By binding the address to the host's MAC in a reservation✓

A DHCP reservation ties a fixed IP to a client's MAC address, so that host always gets the same lease from the pool. Exclusions merely keep addresses out of the pool, and snooping is a security feature, not an assignment method.

In Cisco NAT terminology, what is an 'outside global' address?

• a.The real registered address of a destination host on the outside network✓
• b.The translated public address representing an inside host
• c.The IP configured on the router's inside NAT interface
• d.The private address of an inside host before translation

The outside global address is the actual public address of a host out on the Internet, as seen by everyone. Inside local is a host's private address, inside global is its translated public address, and outside local is how the outside host appears internally.

Which command marks the interface facing the Internet as the NAT outside interface?

• a.nat outside source, which relates to translation rules
• b.ip nat enable, which is not a valid IOS command
• c.ip nat outside✓
• d.ip nat inside, which designates an internal interface

'ip nat outside' is applied under the interface connected to the public network to identify it as the outside of the translation. The corresponding internal interface is marked with 'ip nat inside'.

A device attached directly to an authoritative reference clock such as GPS operates at which NTP stratum?

• a.Stratum 1✓
• b.Stratum 16, which indicates an unsynchronized clock
• c.Stratum 2, which syncs from a stratum-1 server
• d.Stratum 0, which is the reference clock hardware itself

Stratum 0 is the reference clock hardware (GPS, atomic), and a device directly attached to it becomes stratum 1, the most authoritative network time source. Each additional hop increases the stratum number, and 16 means unsynchronized.

Which command configures a Cisco router to act as an authoritative NTP time source for the network?

• a.ntp peer, which forms a symmetric relationship with a peer
• b.ntp server, which points to an upstream time source instead
• c.ntp master✓
• d.clock set, which only sets the local time manually

'ntp master' makes the router an authoritative NTP source so other devices can synchronize to it, useful when no external reference is reachable. 'ntp server' instead configures the router as a client of an upstream server.

Which command enables logging of Syslog messages to the router's internal memory buffer?

• a.logging trap, which sets the severity for a remote server
• b.logging buffered✓
• c.logging host, which points to an external Syslog server
• d.logging console, which sends messages to the console line

'logging buffered' stores log messages in RAM so they can be reviewed later with 'show logging', even without a remote server. Console and remote logging are controlled by separate commands.

What does the command 'logging trap 4' configure a device to send to a Syslog server?

• a.Messages of severity 4 (warnings) and all more severe levels✓
• b.Only the most verbose debugging-level messages
• c.All eight severity levels regardless of the setting
• d.Only messages that are exactly severity level 4

The logging trap level sets a threshold, so 'logging trap 4' forwards warnings (4) plus everything more severe (0 through 3). Lower numbers are more critical, and setting a threshold reduces noise sent to the server.

What is a notable security limitation of SNMPv2c?

• a.It requires TCP and cannot operate over UDP
• b.It provides no mechanism for sending traps to a manager
• c.It is unable to poll device statistics from an agent
• d.It relies on plaintext community strings with no encryption✓

SNMPv2c authenticates only with community strings sent in clear text and offers no encryption, so credentials and data can be captured. SNMPv3 was introduced to add authentication and encryption for secure management.

Which SNMP operation retrieves the value of a single specified object from an agent?

• a.TRAP
• b.SET, which changes an object's value on the agent
• c.INFORM
• d.GET✓

The SNMP GET operation is sent by the manager to read one specified object's value from an agent. TRAP and INFORM are notifications from the agent, and SET writes a new value rather than reading one.

In a QoS policy, what is the difference between classification and marking?

• a.Marking always happens before any classification occurs
• b.They are two names for the same single QoS action
• c.Classification sorts traffic into classes, while marking sets a field like DSCP so downstream devices can honor it✓
• d.Classification drops traffic while marking buffers it for later

Classification identifies and groups traffic (for example, by ACL or protocol), and marking then writes a value such as DSCP or CoS into the packet so other devices trust and act on that class consistently. Classify first, then mark.

Which 3-bit field inside the 802.1Q tag carries the Layer 2 Class of Service (CoS) marking?

• a.The Priority Code Point (802.1p) bits✓
• b.The 12-bit VLAN ID field within the same tag
• c.The DSCP field, which lives in the IP header instead
• d.The EtherType field that follows the tag

The 802.1Q tag includes a 3-bit Priority Code Point (802.1p) that carries the Layer 2 CoS value (0-7) for prioritization on trunks. DSCP is a Layer 3 marking in the IP header, not part of the 802.1Q tag.

Which command forces a Cisco device to accept only SSH version 2 for remote sessions?

• a.crypto key generate rsa, which just creates the key pair
• b.ip ssh version 2✓
• c.transport input ssh, which only limits the VTY protocol
• d.ssh version 2, which is not valid global syntax

'ip ssh version 2' restricts the device to SSHv2, which fixes weaknesses present in version 1. Generating RSA keys and restricting VTY input are separate prerequisites, but they do not by themselves force version 2.

Which command displays the IP addresses the router's DHCP server has leased and the client MAC addresses they map to?

• a.show ip dhcp conflict, which lists duplicate-address problems
• b.show ip dhcp binding✓
• c.show ip dhcp pool, which shows range and utilization only
• d.show running-config, which shows configuration, not leases

'show ip dhcp binding' lists the active bindings, including each leased IP, the client identifier or MAC, and the lease expiration. The pool command shows configuration and utilization, while conflict shows detected address conflicts.

Which command clears all dynamic NAT translations from the router's translation table?

• a.no ip nat
• b.clear ip nat *
• c.clear ip nat translation *✓
• d.reset ip nat, which does not exist in IOS

'clear ip nat translation *' removes all current dynamic translations, which is useful when reconfiguring NAT or freeing stale entries. Static translations are not affected because they are permanently configured.

Which command begins configuration of a named extended IPv4 ACL called BLOCK_WEB?

• a.access-list BLOCK_WEB extended, with the keywords out of order
• b.ip access-list 101 BLOCK_WEB, mixing a number and a name
• c.access-list extended BLOCK_WEB, missing the 'ip' keyword
• d.ip access-list extended BLOCK_WEB✓

Named ACLs are created with 'ip access-list extended BLOCK_WEB', which enters a sub-mode where you add permit and deny statements. Named ACLs let you use descriptive names and edit individual sequence numbers.

Which range of numbers identifies extended IPv4 ACLs?

• a.200-299
• b.100-199 (and 2000-2699)✓
• c.1-99
• d.1300-1999, another block used for standard ACLs

Extended IPv4 ACLs use 100-199 with an expanded block of 2000-2699. Standard ACLs use 1-99 and 1300-1999. The number chosen tells IOS which ACL type is being configured.

How does a router process the entries within an ACL?

• a.It checks the entries in a random, unordered fashion
• b.It applies whichever entry is the most specific match
• c.Sequentially from top to bottom, acting on the first match✓
• d.It evaluates every entry and uses the last one that matches

An ACL is evaluated top-down, and the first matching statement determines whether the packet is permitted or denied; no later entries are checked. Because of this, more specific entries must be placed before broader ones.

In an ACL, the keyword 'host 10.1.1.1' is equivalent to which address and wildcard pair?

• a.any 10.1.1.1, which is not valid ACL syntax
• b.10.1.1.1 0.0.0.0✓
• c.10.1.1.1 255.255.255.255, which would match everything
• d.10.1.1.1 0.0.0.255, which would match a whole /24

The 'host' keyword is shorthand for an exact match, equal to the address followed by the wildcard 0.0.0.0, where every bit must match. This targets exactly one IP address.

In an ACL, the keyword 'any' is equivalent to which address and wildcard combination?

• a.0.0.0.0 0.0.0.255, which matches just one /24 network
• b.255.255.255.255 0.0.0.0, which matches a single host
• c.0.0.0.0 0.0.0.0, which matches only that one address
• d.0.0.0.0 255.255.255.255✓

The 'any' keyword matches all addresses, equal to 0.0.0.0 with a wildcard of 255.255.255.255 (all bits ignored). It is used when a rule should apply to every source or destination.