CCNA Practice Test – 160 Free Exam Questions with Answers

Correct answer: A. 00:00:5e:00:01:a0

A valid VRRP virtual MAC address must start with 00:00:5e:00:01. The other options are invalid MAC address formats for VRRP.

Correct answer: B. fd45:93ac:8a8f:1::1

Unique local IPv6 addresses begin with the prefix fd. The other options represent link-local, multicast, or global unicast addresses.

Correct answer: D. No configurations are needed.

DNS queries are standard IP traffic that routers forward normally; no special helper or relay configuration is needed on the router for this to work.

Correct answer: B. SW1(config-if)# spanning-tree portfast

PortFast is the standard Cisco IOS command to configure an interface as an edge port, bypassing the STP listening and learning states.

Correct answer: D. You need to enable IPv6 routing on R2.

IPv6 routing must be explicitly enabled with 'ipv6 unicast-routing' on a Cisco router for it to forward IPv6 packets between its interfaces.

Correct answer: B. SW1(config)# no ip dhcp snooping information option

The correct answer proves that disabling Option 82 on a switch port resolves a DHCP issue when the server cannot process the option. The trap is thinking the switch port needs to be trusted instead of removing the option from the switch.

Correct answer: A. spanning-tree bpdufilter enable

The correct answer proves that BPDU filter prevents a port from sending or receiving BPDUs. BPDUGuard prevents reception, and PortFast is for edge ports.

Correct answer: C. LLDP

The correct answer proves that LLDP is the industry-standard protocol for neighbor discovery on multi-vendor networks. CDP is Cisco proprietary and would not work with other vendors.

Correct answer: B. service port interface

The correct answer proves that the service port interface is the dedicated physical interface for out-of-band management on a WLC. The management interface is logical.

Correct answer: D. R1(config)# ip route 10.0.0.0 255.255.128.0 g0/0

The correct answer proves that a directly attached route specifies an exit interface without a next-hop IP address. The other options are either recursive or host routes.

Correct answer: D. It controls management traffic destined for the WLC.

The correct answer proves that a CPU ACL protects the WLC's management CPU by filtering traffic destined for the controller itself. It does not control traffic to or from access points.

Correct answer: A. ipv6 route 2001:db8:0:1::/64 fe80::68a7:9389:9807:db9a

The correct answer proves that a static route with a link-local next-hop must be fully specified with an exit interface. The other options are all valid static route configurations.

Correct answer: D. SW1 F0/1 has received messages with an incorrect FCS.

The answer correctly interprets that CRC errors indicate frames with an incorrect FCS. This tests the ability to identify the specific error type from the 'show interfaces' output.

Correct answer: C. password: ccna4

The answer shows that the 'line console 0' configuration takes precedence for direct console access, which requires the specified password.

Correct answer: D. Version 1.99

SSH version 1.99 indicates backward compatibility with both SSHv1 and SSHv2. Option C, Version 2, is a distractor that only supports the newer, more secure version.

Correct answer: D. R1 will load-balance packets destined for 10.0.0.0/24 over three next hops.

Equal-cost load balancing occurs between the three routes with a default administrative distance of 1. The route with AD 2 is a floating backup and is excluded.

Correct answer: D. 224.0.0.18

VRRP routers use the multicast address 224.0.0.18 to communicate and share state information. Options A and C are multicast addresses used by other protocols.

Correct answer: B. Supervised learning

Supervised learning uses labeled data sets to train models. Unsupervised learning, in contrast, works with unlabeled data.

Correct answer: C. ASBR

The router becomes an ASBR by injecting an external default route into the OSPF domain. The trap is confusing ASBR with ABR, which redistributes between OSPF areas, not external routes.

Correct answer: D. Two

DROTHERs only exchange LSAs with the DR and BDR. The question tests knowledge of OSPF adjacency reduction on multi-access networks.

Correct answer: A. Management

These are management frames used for client association. The distractor 'Probe' is a related but incorrect frame type.

Correct answer: A. IPsec

IPsec is the industry standard for encrypting site-to-site VPN traffic over untrusted networks. TLS is typically for client-server.

Correct answer: D. GigabitEthernet0/5

The default route is used. R1 forwards packets to the next hop via its directly connected interface. The test is longest prefix match.

Correct answer: D. network 10.20.16.0 0.0.7.255 area 0

The OSPF network command uses a wildcard mask to match interface IP addresses. The correct wildcard mask option covers both subnet addresses, while other options only match one or neither.

Correct answer: B. ACL 101

ACL 101 correctly permits UDP syslog from PC1 to the server and denies other UDP syslog traffic to the server, while allowing all other traffic through.

Correct answer: B. switchport port-security violation restrict

The restrict action discards violating frames and logs the event but does not shut down the port, unlike the shutdown action.

Correct answer: B. You need to enable DHCP snooping on the VLAN.

DHCP snooping must be explicitly enabled on a VLAN to inspect traffic. The common mistake is assuming global configuration is sufficient, while VLAN-level enablement is required.

Correct answer: D. You swipe a key card and then do a fingerprint scan.

The correct answer proves that multi-factor authentication requires two distinct factors, like something you have and something you are. Option A is a distractor because both factors are biometric.

Correct answer: A. GigabitEthernet0/1

The correct answer proves that the router uses the most specific route to determine the exit interface. The longer prefix length for 203.0.113.96/27 is more specific than 203.0.113.96/28.

Correct answer: B. channel-group 1 mode on

This question verifies knowledge that Cisco WLCs require static LAG configuration using the 'mode on' command. The other options describe dynamic LAG protocols for switches and are incorrect.

Correct answer: C. R1(config-router)# auto-cost reference-bandwidth 100000

The answer proves that OSPF cost is calculated using the reference bandwidth. This question tests the ability to calculate the correct reference bandwidth needed to achieve a desired cost.

Correct answer: D. Southbound

This question confirms that southbound APIs manage the controller-to-device layer, while northbound APIs connect controllers to applications.

Correct answer: B. A curly brace is missing.

This question tests validation of JSON syntax. The key is to recognize that the structure is missing a closing brace, making it syntactically invalid.

Correct answer: C. 2000:ad08:9:900:1200::1000

This question verifies the rules for abbreviating IPv6 addresses: removing leading zeros from each block and using '::' to represent the longest sequence of zeros.

Correct answer: D. SAE

This answer correctly identifies SAE as the WPA3 feature that secures against brute-force attacks on the PSK, a security improvement over WPA2's PSK.

Correct answer: A. IaaS

IaaS provides the most customer control, as it allows management of the OS and applications. PaaS and SaaS offer less control as abstraction layers increase.

Correct answer: B. Directly connected

A directly connected static route specifies only an exit interface. A fully specified route includes both the next-hop IP and the exit interface.

Correct answer: D. 10.10.10.2

OSPF RID is the highest loopback IP address by default. The answer demonstrates the OSPF selection priority: loopback over physical interfaces.

Correct answer: A. PC1 > AP1 > SW1 > WLC1 > SW1 > WLC1 > SW1 > AP2 > PC2

In a central forwarding model, traffic is tunneled between APs and WLC, physically passing through the switch. The trap is the direct logical path.

Correct answer: C. R1(config)# access-list

An access-list identifies the specific traffic to be translated by matching the source IP addresses of packets that need NAT translation.

Correct answer: C. switchport voice vlan 20

The switchport voice vlan command allows a secondary, tagged VLAN to be carried on an access port without turning it into a trunk port.

Correct answer: C. Threat

A malicious user is a threat, a potential danger to security. The distractors define vulnerability, a weakness, and exploit, a method to use that weakness.

Correct answer: A. 0110

The Version field in the IPv6 header uses the binary pattern 0110, which is the decimal number 6. The distractors are incorrect version numbers.

Correct answer: D. ntp master

This answer confirms that the 'ntp master' command with no argument defaults to a stratum 8 server. The distractors involve incorrect client commands or potential variable stratum levels.

Correct answer: A. User awareness

This question demonstrates that user awareness is the security principle being applied. It is not training, as it focuses on awareness rather than structured instruction.

Correct answer: A. UDP uses a checksum for error detection.

UDP uses a checksum for basic error detection. Option D is a distractor that confuses UDP with TCP, as UDP lacks sequencing and acknowledgment.

Correct answer: B. AF31

The DSCP AF class uses the third digit for drop precedence, where a lower number means lower drop priority and higher survivability during congestion.

Correct answer: E. Traffic sent to and from the IP Phone is tagged.

Voice VLAN traffic is tagged with VLAN ID, while data VLAN traffic is untagged. The trap confusingly states traffic is untagged, but the voice VLAN setting explicitly enables tagging.

Correct answer: D. Silver

Silver is defined as Best Effort for standard data traffic. The distractors are higher-priority categories like Gold and Platinum.

Correct answer: A. protect

The 'protect' mode simply discards violating frames without taking more drastic action. The other options disable the interface or log violations.

Correct answer: B. The BDR will become the DR, and an election will be held to decide the new BDR.

The correct answer proves that the BDR immediately becomes the new DR upon failure, triggering an election for a new BDR. The distractor trap is assuming a full re-election for both roles occurs simultaneously.

Correct answer: D. HTTPS

The correct answer proves that HTTPS provides encrypted communication for sensitive data like credentials. SSH, Telnet, and HTTP are eliminated because they are either unencrypted or not the standard for web-based GUI access.

Correct answer: B. Link Local

The correct answer proves that the ipv6 enable command automatically configures a Link Local address. The distractor cue is knowing that other address types require specific configuration commands.

Correct answer: D. WPA, WPA2, and WPA3

The correct answer proves that all WPA versions support Enterprise mode with 802.1X and a RADIUS server. The distractor trap is assuming newer versions removed this feature.

Correct answer: D. 192.168.1.192/27

The correct answer proves that a /27 subnet provides exactly 30 usable addresses for 15 hosts. The distractor cue is recognizing that a /26 is unnecessarily large and wastes addresses.

Correct answer: C. R1(config)# ip dhcp excluded-address 192.168.1.1 192.168.1.10

The answer proves the correct command, ip dhcp excluded-address, used in global configuration mode to exclude a range of addresses from being assigned by DHCP. The distractors are syntactically incorrect commands.

Correct answer: D. Flood

The answer proves that a switch floods frames when it cannot find a destination MAC in its table. The distractors describe actions for known unicast, broadcast, or dropped frames.

Correct answer: B. Emergency, Alert, Critical, Error, Warning, Notice, Informational, Debugging

The answer proves the correct order of Syslog severity levels from highest to lowest. The distrators list the levels in an incorrect sequence.

Correct answer: C. auto-cost reference-bandwidth 10000

The correct answer proves the reference-bandwidth calculation for OSPF cost. The trap is a distractor with a bandwidth value that produces an incorrect cost.

Correct answer: A. Policing

The correct answer proves the function of policing in QoS. Shaping is a trap, as it buffers excess traffic instead of dropping it.

Correct answer: B. R1(config-if)# ip address dhcp

The correct answer proves the command to configure a router interface as a DHCP client. The trap is the command for configuring a DHCP server.

Correct answer: A. VRRP

The correct answer proves that VRRP is an open standard suitable for multi-vendor environments. HSRP is a Cisco-proprietary trap.

Correct answer: A. channel-group 1 mode active

The correct answer proves the LACP protocol for negotiating a LAG. The 'on' mode is a trap, as it is a static, non-negotiating configuration.

Correct answer: B. ip route 203.0.113.0 255.255.255.0 gigabitethernet0/0

The correct answer proves that a static route with only an exit interface depends on proxy ARP. The option with an explicit next-hop IP is a trap.

Correct answer: C. 404

The correct answer proves the meaning of the 404 Not Found status code. The 200 OK option is a trap for a successful request.

Correct answer: D. enable secret 5 <hash>

The correct answer proves the syntax for configuring a pre-hashed secret password. The trap is a command that hashes the password on the local device.

Correct answer: B. ip route 10.0.0.0 255.255.255.0 192.168.1.1 111

The correct answer proves that OSPF's default AD is 110, so 111 is 1 higher. Distractors use values that are either too high or lower than OSPF's AD.

Correct answer: C. Physical access control

The correct answer demonstrates understanding of physical security controls. User awareness and training are not the type of control, and MFA involves multiple factors.

Correct answer: B. 2001:db8:0:1:f32:a4ff:fe52:b104

The correct answer proves the ability to apply the EUI-64 process to a MAC address. The key step is flipping the 7th bit of the first octet from 0 to 1.

Correct answer: C. 1, 6, 11

The correct answer demonstrates knowledge of standard Wi-Fi channel planning. The three non-overlapping channels in the 2.4 GHz band are 1, 6, and 11.

Correct answer: D. Controller

The correct answer identifies the location for configuring interface VLAN mappings on a WLC. The Wireless and WLANs tabs are for client-related settings, not core interface configuration.

Correct answer: C. 203.0.113.64/26, learned via OSPF, metric 20

The correct answer demonstrates understanding of the most specific prefix match rule for routing decisions. The /26 subnet is the longest match for the destination address.

Correct answer: A. VLAN 10 is automatically created.

The switch will automatically create VLAN 10 when an interface is assigned to it. The other options describe the switch's behavior if the VLAN does not exist.

Correct answer: C. Overlay

The overlay is a virtual network built on the physical underlay, often using tunnels. VXLAN is a specific tunneling protocol, not the architecture layer.

Correct answer: D. It discards all DHCP server messages received on untrusted ports.

DHCP snooping discards rogue DHCP server messages on untrusted ports. The elimination cue is that trusted ports are allowed to pass these messages.

Correct answer: B. Anycast

An anycast address is assigned to multiple devices to deliver traffic to the nearest one. The trap is mistaking it for a unicast address based on its format.

Correct answer: C. ipv6 route 2001:db8::/64 2001:db8:1::1

The correct answer proves a recursive route by specifying a next-hop IP without an exit interface. The distractor trap is confusing it with a directly connected route, which uses an exit interface.

Correct answer: B. Traditional networks use a distributed control plane.

The correct answer proves that traditional networks use a distributed control plane, while controller-based uses a centralized one. The distractor trap is confusing the control plane with the data or management planes.

Correct answer: C. enable algorithm-type scrypt secret ccna123

The answer proves the command syntax for a type 9, scrypt-based enable secret. The distractors use the wrong algorithm type, making them invalid.

Correct answer: B. MR engine

The answer identifies the MR engine, the specific feature for AI-powered automated troubleshooting. The distractors are incorrect feature names or describe different functionalities.

Correct answer: D. R1 and R2 are DROTHERS.

The correct answer proves a specific OSPF adjacency rule. DROTHER routers only form FULL adjacencies with the DR and BDR, not each other.

Correct answer: A. 2-way

The correct answer proves that DR/BDR election occurs in the 2-way state after neighbors recognize each other but before full adjacency forms. States like Exchange occur after election.

Correct answer: B. When it is acceptable for some packets to be lost.

The correct answer proves that UDP is preferred when low latency is critical and some packet loss is acceptable. The trap is choosing TCP's reliability feature, which UDP lacks.

Correct answer: D. CPU ACL

The correct answer identifies the specific Cisco WLC security feature for management access. FlexConnect, L2, and TACACS+ serve different network or authentication purposes.

Correct answer: D. Trunk port

The correct answer connects the standard networking term for multi-VLAN traffic. Access ports are untagged, and SVIs and routed ports are not ports in the same context.

Correct answer: B. All PortFast-enabled ports

The correct answer describes the behavior of the 'spanning-tree portfast bpdufilter default' command. This setting specifically affects PortFast-enabled ports, not all ports or trunk ports.

Correct answer: A. Exploit

An exploit is a tool used to take advantage of a vulnerability. The trap is confusing the tool with the weakness it targets.

Correct answer: B. VLANs

VLANs segment a physical network into separate broadcast domains. The trap is subnetting, which affects Layer 3 forwarding, not broadcast domains.

Correct answer: C. spanning-tree guard loop

The correct answer proves that Loop Guard disables a port upon BPDU loss to prevent Layer-2 loops. The distractor cue is recognizing that BPDU Filter prevents BPDUs from being sent, not received.

Correct answer: B. Infrastructure

The answer proves the infrastructure layer is responsible for the physical and logical network fabric. The distractors describe other SDN layers like application or control.

Correct answer: B. The ports connected to the router, WLC, and APs.

The answer proves that ports to the router, WLC, and APs must be trunks to carry multiple VLANs. The distractors incorrectly omit at least one device that requires trunking.

Correct answer: C. Three

The answer proves that only one route with the best administrative distance is added. The distractors fail to account for the tie between the three routes with an AD of 1.

Correct answer: A. Dynamic entries are cleared from the MAC address table after 300 seconds of inactivity.

The correct answer proves that dynamic MAC entries age based on inactivity, not absolute time. Static entries never age, eliminating other options.

Correct answer: A. FQDN

The correct answer proves that RSA keys are named using the router's FQDN. The trap is confusing the hostname-only naming with the full FQDN standard.

Correct answer: B. Terraform

The correct answer proves knowledge of a popular IaC tool's programming language. Puppet and Chef are Ruby-based, Ansible is Python-based, making them distinguishable distractors.

Correct answer: A. Outbound on R1 G0/0

Applying the ACL outbound on R1's G0/0 interface filters traffic close to the source. The elimination cue is the rule that extended ACLs should be placed near the source.

Correct answer: A. switchport access vlan 10

The correct answer proves that a voice VLAN can be assigned to an access port to carry a second tagged VLAN. The distractor cue is knowing that a standard access port can only be assigned a single access VLAN.

Correct answer: D. network 172.16.0.0 0.15.255.255 area 0

The answer proves the wildcard mask logic in an OSPF network command to match multiple subnets. The distractors use incorrect wildcard masks that fail to match both interface addresses.

Correct answer: C. The switch supports both ISL and 802.1Q.

The correct answer proves that a switch must manually configure trunk encapsulation when in auto mode and supports both ISL and 802.1Q. The trap is assuming modern switches that don't support ISL don't require this configuration.

Correct answer: A. Resource owner

The correct answer identifies the OAuth2.0 role representing the end-user who has authority over the resource. The other options are server-side components and do not grant authorization.

Correct answer: A. Local

The correct answer proves that Local mode APs use CAPWAP to tunnel all data traffic to a controller. Other options like FlexConnect tunnel control but switch data locally.

Correct answer: B. 4

The correct answer proves that each router needs a route to the destination network not directly connected. The distractor trap is counting routes to all intermediate networks instead of just the final destination networks.

Correct answer: A. Generating device configurations requires fewer man-hours.

The correct answer proves that automation reduces OpEx by minimizing man-hours for repetitive tasks like configuration changes. Other options confuse design or hardware effects.

Correct answer: C. 2001:db8:0:1:942f:6dff:fe8a:8e27

The answer proves the correct EUI-64 process, which involves flipping the 7th bit of the MAC and inserting FFFE. The distractors incorrectly apply the bit-flip step, a common trap.

Correct answer: B. EtherChannel eliminates the risk of Layer-2 loops in a LAN

EtherChannel can create a larger logical link but does not eliminate all loop risks. The trap is that STP must still prevent loops within the EtherChannel.

Correct answer: C. network 192.168.50.0 0.0.0.255 area 0

This wildcard mask correctly matches both interfaces to the OSPF network command. The cue is that the range must include both /25 subnets.

Correct answer: A. ipv6 route ::/0 g1 2001:db8:1234:568::1234:ccb:2 2

This is a valid IPv6 floating default route. The correct answer uses an administrative distance of 2, which makes it a backup route.

Correct answer: B. 7

Each physical link requires a designated port. The exam rule is that there are as many designated ports as there are active links.

Correct answer: C. Marking

Marking modifies L2 and L3 headers to indicate QoS treatment. Classification is the process of using this mark for sorting, not modifying it.

Correct answer: D. 224.0.0.102

HSRPv2 uses the multicast address 224.0.0.102 for hello messages. The trap is confusing this address with the Virtual IP or the HSRPv1 address.

Correct answer: C. D 172.20.15.192/28 [90/200] via 10.1.1.1, 00:03:12, Gi0/0

The router uses the longest prefix match for forwarding. The cue is the /28 subnet, which covers the destination address.

Correct answer: D. switchport trunk allowed vlan add 13

The 'add' keyword appends VLANs to the existing list. The trap is that omitting 'add' overwrites the entire allowed list.

Correct answer: C. The active and standby routers share a VIP and virtual MAC address.

HSRP uses a single shared VIP and virtual MAC. The elimination cue is that only the active router responds to traffic for this shared address.

Correct answer: A. SW1(config)# interface g0/1

In ROAS, the switch port must be a trunk carrying the VLANs. The key cue is that switch subinterfaces are not used; they are configured on the router.

Correct answer: B. Inside global

The correct answer proves that 'Inside global' is the term for the translated IP address that internal hosts use to communicate with external networks. The trap confuses it with 'Outside global', which is an external host's real IP address.

Correct answer: D. Enterprise mode

The correct answer proves that Enterprise mode uses 802.1X for centralized authentication. The trap confuses it with 'RADIUS mode', which is the server technology, not the WPA operational mode.

Correct answer: F. D 203.0.113.72/29 [90/458] via 192.0.2.10, 00:02:17, Gi0/0

The correct answer proves that the router uses the most specific route, determined by the longest prefix length. The elimination cue is the /29 subnet, which is more specific than the other options.

Correct answer: D. The routes via 192.168.1.1 and 192.168.1.4

Correct answer proves OSPF uses the highest active loopback IP for its Router ID. The trap is that OSPF ignores physical interface IPs if loopbacks are present.

Correct answer: A. BSSID

Correct answer proves the BSSID is the MAC address of a wireless access point's radio. The trap confusing BSSID with SSID.

Correct answer: D. The ports connected to the WLC and router

Correct answer proves that only the WLC and router ports require trunking. The trap is that LWAPs, when not using FlexConnect, do not need a trunk.

Correct answer: D. access-class 1 in

Correct answer proves that the access-class command applies an ACL to VTY lines. The trap is using access-group or ip access-group, which are for interfaces.

Correct answer: F. 10.20.21.129

Correct answer proves OSPF uses the highest active loopback IP for its Router ID. The trap is that OSPF ignores physical interface IPs if loopbacks are present.

Correct answer: A. Digital certificates

Correct answer proves digital certificates are used to authenticate server identity in HTTPS. The trap is that AAA, 802.1X, and MFA are for user access, not website trust.

Correct answer: C. Installing MFA locks for server rooms.

Correct answer proves MFA locks control physical access to a location. The trap is confusing device security (console, Wi-Fi, TACACS+) with physical security.

Correct answer: D. To define which packets should be translated

Correct answer proves an ACL in NAT defines which packets to translate. The trap is that ACLs define inside local IPs for translation, not the global IPs or to filter traffic.

Correct answer: D. SYN, SYN-ACK, ACK

Correct answer proves the TCP three-way handshake is SYN, SYN-ACK, ACK. The trap is options with incorrect segment order.

Correct answer: E. O 10.10.50.32/27 [110/22] via 172.16.1.1, 00:00:34, Gi0/0

Correct answer proves the router uses the most specific (longest prefix) matching route. The trap is a less-specific route that also matches the destination IP.

Correct answer: D. ACK, OFFER

This demonstrates that DHCP Snooping discards server-originated OFFER and ACK messages on untrusted ports to prevent rogue servers. The distractors include client-originated messages, which are permitted.

Correct answer: C. The router will advertise the interface's network prefix to other OSPF routers, but won't send hello messages out of the interface.

The correct answer proves that passive interfaces stop OSPF hellos, preventing neighbor adjacency while still advertising the network prefix via LSAs. The other options incorrectly describe the function of sending hellos or forming neighbors.

Correct answer: B. FlexConnect

The correct answer proves that FlexConnect mode allows a lightweight access point to switch traffic locally without sending it to the controller. The other options are incorrect modes that don't provide this specific switching capability.

Correct answer: A. enable secret 9 <hash>

The correct answer proves that 'enable secret 9' uses the newer scrypt hashing algorithm. The trap is using '8', which refers to the older MD5 algorithm, not the pre-hashed value itself.

Correct answer: D. Trap

The correct answer proves that a Trap is an unacknowledged alert. The elimination cue is 'Inform', which is a similar but acknowledged message type.

Correct answer: B. SAE

The correct answer proves that SAE (Simultaneous Authentication of Equals) replaces PSK with a more secure handshake resistant to brute-force attacks. The other options are WPA3 features but not for this specific protection.

Correct answer: B. Tail drop

The correct answer proves that tail drop indiscriminately drops packets, causing multiple TCP sessions to back off simultaneously. The elimination cue is WRED, which is designed to avoid this by randomly dropping packets.

Correct answer: D. Reinforcement learning

The correct answer proves that reinforcement learning uses a reward/penalty system to train an agent. The trap is 'Incentive-based learning', a distractor term that sounds similar but is not a standard ML category.

Correct answer: A. R 198.51.100.120/29 [120/5] via 192.0.2.3, 00:00:45, Gi0/3

The correct answer proves that the router uses the most specific (longest prefix) match in the routing table. The elimination cue is the /32 route, which is more specific than the /29 but does not cover the destination IP address.

Correct answer: B. It checks if the ARP Sender MAC and Sender IP fields have a matching entry in the DHCP Snooping table.

The correct answer proves that Dynamic ARP Inspection validates the sender's MAC and IP against the DHCP snooping binding table. The distractor is checking the target fields, which is incorrect for validating the sender's legitimacy.

Correct answer: B. Tunnel mode

The correct answer proves that Tunnel mode encrypts the whole original packet and adds a new IP header. The elimination cue is Transport mode, which encrypts only the payload, not the original header.

Correct answer: A. VRF

The correct answer proves that VRF allows the same IP address on different interfaces by creating separate routing instances. The distractor 'Subnetting' is an elimination cue because it enforces unique IP addresses.

Correct answer: A. S* 0.0.0.0/0 [1/0] via 203.0.113.254

The correct answer proves that the default route matches any destination IP. The elimination cue is the /0 subnet mask, which makes it a catch-all route when no specific match exists.

Correct answer: C. Control plane

The correct answer proves that the control plane handles routing protocol exchanges to build routing tables. The distractor 'Data plane' is an elimination cue, as it only forwards packets based on the control plane's information.

Correct answer: C. show power inline

The correct answer proves that 'show power inline' displays the status and power usage of connected devices. The trap distractors are variations that either don't exist or don't provide the requested detailed information.

Correct answer: C. auto-cost reference-bandwidth 100000

The correct answer proves how to set the OSPF reference bandwidth to calculate a cost of 100 for a 1 Gbps link. The trap is using a value that results in the wrong cost, like 10000.

Correct answer: A. On the LAN interface that receives client broadcast messages

The correct answer proves that the command must be on the interface receiving client broadcasts. The trap is placing the configuration in the pool or on the server-facing interface.

Correct answer: C. It allows internal hosts to use addresses that are not globally unique.

The correct answer proves that RFC 1918 allows the use of non-unique private addresses. The distractor incorrectly claims it provides encryption or expands the public address space.

Correct answer: A. Sniffer

The correct answer proves that Sniffer mode is for capturing raw frames. The trap is choosing a mode for security analysis, like Rogue Detector.

Correct answer: D. OAuth 2.0

The correct answer proves OAuth 2.0 is for delegated access control. The distractors are simple authentication methods that lack the delegation capability.

Correct answer: D. EIGRP route, metric 5678

The correct answer proves that administrative distance, not metric, determines the best path when multiple protocols advertise a route. The distractor with the lowest metric is a trap for confusing AD with protocol metric.

Correct answer: C. interface vlan <vlan-id>

This command proves the creation of a Switch Virtual Interface, the logical entity used for routing between VLANs. The distractor 'ip routing' only enables the global routing function on the switch but does not create the specific interface.

Correct answer: B. Rapid elasticity

This proves the definition of rapid elasticity, a core cloud tenet for scalable resources. The distractor 'Resource pooling' describes the back-end model, not the customer-facing ability to scale.

Correct answer: A. ff02::1

The correct answer shows that ff02::1 is a link-local multicast address for all nodes on the same subnet. Distractors use other scopes like global (ff0e::1), site-local (ff05::1), and interface-local (ff01::1).

Correct answer: G. G0/1 is an access port

The correct answer proves that 'switchport mode access' configures an interface as an access port. The elimination cue is that access port commands override trunk commands, making 'G0/1 is an access port' true.

Correct answer: A. Gold

The correct answer proves that the Gold profile is optimized for video traffic with moderate latency control. The trap distractors are lower-priority profiles that would not provide adequate quality for video.

Correct answer: A. PortFast and BPDU Filter are disabled on the port

The correct answer proves that the port reverts to normal STP behavior to prevent loops. The trap is that the port does not remain filtered or error-disabled.

Correct answer: D. LINK

The correct answer proves that the facility identifies the device subsystem that generated the log message. The trap is confusing the facility with the message level or description.

Correct answer: A. copy ftp: flash:

This command proves the correct syntax for copying a file from a remote FTP server to a local flash storage device. The distractor 'copy flash: ftp:' reverses the source and destination, making it an upload command instead of a download.

Correct answer: D. 64 characters

The correct answer proves that a hexadecimal WPA2 PSK must be 64 characters long to represent the full 256-bit key. Distractors confuse hex length with ASCII passphrase length.

Correct answer: C. Outbound on R1 Eth1

This answer proves that placing an ACL outbound on the closest router to the source is the most efficient method. The distractor 'Inbound on R2 Eth1' is a common mistake, as it would require the traffic to first cross the network to be filtered.

Correct answer: B. It is a network route

The correct answer demonstrates that a route with a prefix length of /16 is classified as a network route. Distractors are eliminated by applying the definitions of host, default, directly-connected, and fully-specified routes.

Correct answer: A. access-list 101 permit tcp 203.0.113.1 0.0.0.0 any eq www

This proves that reply traffic from a server requires the server's IP as the source and its service port (eq www) in the source port field. The distractor with the source port as 'any' fails to match the required source port 80 on the reply.