Cisco CCNA 200-301 v1.1 & NetAcad v7.02 / v8 Exam Portal

Verified Final Exam Answers, Interactive Practice Mode, IOS CLI Cheat Sheets & Packet Tracer (.PKA) Labs.

Home » Verified Interactive Exam Module

CCNA 2 v7.02 & v8 (SRWE) Complete Final Exam & Modules 1 - 16 Master Question Bank (2026)

Updated: October 17, 2026 • Tip: Click any option (A, B, C, D) to check your answer instantly!

Verified question bank for CCNA 2 v7.02 & v8 (Switching, Routing, and Wireless Essentials - SRWE) Modules 1–4, 5–6, 7–9, 10–13, 14–16 & Final Exam.

📥 Download CCNA 2 v7.02 & v8 (SRWE) Complete Final Exam & Modules 1 - 16 Master Question Bank (2026) Packet Tracer (.PKA) & Verified PDF Guide

Includes complete Cisco NetAcad v7.02 / v8 topology file (.pka) and IOS CLI configuration script.

Verified Cisco NetAcad Exam Questions (42 Core Questions + Explanations)

Question 1 Two Cisco switches are connected together, and both ports are configured in 'switchport mode dynamic auto'. Why does a trunk link fail to form?
  • A. Both ends are passive in dynamic auto mode, so neither initiates DTP trunk negotiation.
  • B. 802.1Q encapsulation is disabled.
  • C. PortFast blocks DTP frames.
  • D. VLAN 1 is shut down.
✔ Correct Answer: A. Both ends are passive in dynamic auto mode, so neither initiates DTP trunk negotiation.
Technical Explanation: Dynamic Auto waits passively for the other side to request a trunk. If both sides are Dynamic Auto, the link stays an access port. At least one side must be 'trunk' or 'dynamic desirable'.
Question 2 An administrator wants to add VLAN 50 to an existing 802.1Q trunk that already carries VLANs 10, 20, and 30. The administrator enters 'switchport trunk allowed vlan 50'. What happens?
  • A. VLAN 50 is appended to the list alongside 10, 20, and 30.
  • B. VLANs 10, 20, and 30 are removed from the trunk, and ONLY VLAN 50 is permitted, causing an outage.
  • C. The command is rejected by the switch.
  • D. The port enters err-disabled mode.
✔ Correct Answer: B. VLANs 10, 20, and 30 are removed from the trunk, and ONLY VLAN 50 is permitted, causing an outage.
Technical Explanation: Without the 'add' keyword ('switchport trunk allowed vlan add 50'), the command overwrites the entire allowed VLAN list with only VLAN 50.
Question 3 In a Router-on-a-Stick (ROAS) Inter-VLAN routing configuration, where is the 'encapsulation dot1Q [vlan-id]' command applied?
  • A. On the switch access ports.
  • B. On the router's logical subinterfaces (e.g., interface GigabitEthernet0/0/1.10) before assigning the IPv4 address.
  • C. In global configuration mode on the router.
  • D. Under the OSPF routing process.
✔ Correct Answer: B. On the router's logical subinterfaces (e.g., interface GigabitEthernet0/0/1.10) before assigning the IPv4 address.
Technical Explanation: In Router-on-a-Stick, each VLAN requires a router subinterface configured with 'encapsulation dot1Q [vlan-id]' prior to configuring its 'ip address'.
Question 4 When configuring Inter-VLAN routing on a Layer 3 Multilayer Switch using SVIs, which global command must be enabled so the switch routes packets between VLANs?
  • A. ip default-gateway
  • B. ip routing
  • C. switchport mode trunk
  • D. no switchport
✔ Correct Answer: B. ip routing
Technical Explanation: Even if multiple SVIs (interface Vlan10, interface Vlan20) are up/up with IP addresses, a Multilayer Switch will not route packets between them until 'ip routing' is entered in global configuration mode.
Question 5 How does Spanning Tree Protocol (STP) elect the Root Bridge in a Layer 2 switched topology?
  • A. The switch with the highest MAC address wins.
  • B. The switch with the lowest Bridge ID (consisting of Bridge Priority + Extended System ID + MAC Address) becomes the Root Bridge.
  • C. The switch with the fastest Gigabit uplink ports wins.
  • D. The switch with the highest uptime wins.
✔ Correct Answer: B. The switch with the lowest Bridge ID (consisting of Bridge Priority + Extended System ID + MAC Address) becomes the Root Bridge.
Technical Explanation: In STP, the lowest Bridge ID (BID) wins the Root Bridge election. By default, all switches have priority 32768 (+ VLAN ID), so the switch with the lowest MAC address wins unless an admin lowers the priority (e.g., 'spanning-tree vlan 10 priority 4096' or 'root primary').
Question 6 What are the three port states used by Rapid Spanning Tree Protocol (RSTP - IEEE 802.1w) compared to 802.1D?
  • A. Blocking, Listening, Learning
  • B. Discarding, Learning, Forwarding
  • C. Disabled, Standby, Active
  • D. Init, Exchange, Full
✔ Correct Answer: B. Discarding, Learning, Forwarding
Technical Explanation: RSTP (802.1w) combines the legacy 802.1D Disabled, Blocking, and Listening states into a single 'Discarding' state, leaving only Discarding, Learning, and Forwarding.
Question 7 Which command should be enabled on all access ports connected to end-user PCs so they transition immediately to the STP forwarding state, and what security feature should pair with it to shut down the port if a switch is plugged in?
  • A. PortFast and BPDU Guard
  • B. Root Guard and Loop Guard
  • C. UplinkFast and BackboneFast
  • D. DTP and VTP
✔ Correct Answer: A. PortFast and BPDU Guard
Technical Explanation: PortFast ('spanning-tree portfast') bypasses the 30-second listening/learning delay on host ports, while BPDU Guard ('spanning-tree bpduguard enable') immediately places the port into 'err-disabled' state if a rogue switch sends a BPDU.
Question 8 Which LACP (IEEE 802.3ad) mode combination will successfully form an EtherChannel between Switch A and Switch B?
  • A. Passive on Switch A and Passive on Switch B
  • B. Active on Switch A and Passive on Switch B (or Active/Active)
  • C. Desirable on Switch A and Auto on Switch B
  • D. On on Switch A and Active on Switch B
✔ Correct Answer: B. Active on Switch A and Passive on Switch B (or Active/Active)
Technical Explanation: LACP uses 'active' and 'passive' keywords (whereas Cisco PAgP uses 'desirable' and 'auto'). At least one side must be 'active' to initiate LACP negotiation.
Question 9 All physical interfaces bundled into an EtherChannel must match on which four parameters?
  • A. Speed, Duplex, Native/Allowed VLANs (if trunk), and Access VLAN (if access port)
  • B. Interface description, port number, MAC address, and cable length
  • C. IP address, hostname, VTP password, and SSH version
  • D. Port Security sticky MACs, QoS markings, and CDP timers
✔ Correct Answer: A. Speed, Duplex, Native/Allowed VLANs (if trunk), and Access VLAN (if access port)
Technical Explanation: If any member port in an EtherChannel has a different speed, duplex, switchport mode, or allowed VLAN list, the EtherChannel will fail to bundle or become suspended.
Question 10 When a DHCPv4 server is located on a different subnet/VLAN from the clients, which command must be configured on the router's LAN interface facing the clients to forward DHCP broadcasts as unicasts?
  • A. ip dhcp pool
  • B. ip helper-address [dhcp-server-ip]
  • C. ip dhcp snooping trust
  • D. service dhcp
✔ Correct Answer: B. ip helper-address [dhcp-server-ip]
Technical Explanation: Routers drop Layer 2 broadcasts (255.255.255.255) by default. Configuring 'ip helper-address' on the ingress router interface relays UDP broadcast services (including DHCP ports 67/68) as unicast packets to the central DHCP server.
Question 11 What is the difference between SLAAC, Stateless DHCPv6, and Stateful DHCPv6 when a router sends an ICMPv6 Router Advertisement (RA)?
  • A. SLAAC: M=0, O=0; Stateless DHCPv6: M=0, O=1 (IP from RA, DNS from DHCPv6); Stateful DHCPv6: M=1 (All config from DHCPv6 server).
  • B. SLAAC requires M=1; Stateful DHCPv6 requires M=0.
  • C. All three use the exact same M and O flag values.
  • D. Stateful DHCPv6 disables IPv6 link-local addresses.
✔ Correct Answer: A. SLAAC: M=0, O=0; Stateless DHCPv6: M=0, O=1 (IP from RA, DNS from DHCPv6); Stateful DHCPv6: M=1 (All config from DHCPv6 server).
Technical Explanation: The Managed (M) and Other (O) flags in the router's ICMPv6 RA message instruct the client whether to use SLAAC alone (M=0, O=0), SLAAC + Stateless DHCPv6 for DNS (M=0, O=1), or Stateful DHCPv6 for its IPv6 address (M=1).
Question 12 In HSRP (Hot Standby Router Protocol), what is the default priority value, and what virtual MAC address format does HSRP Version 1 use?
  • A. Priority 100; Virtual MAC 0000.0C07.ACxx (where xx is the HSRP group ID in hex)
  • B. Priority 255; Virtual MAC 0000.5E00.01xx
  • C. Priority 1; Virtual MAC FFFF.FFFF.FFFF
  • D. Priority 150; Virtual MAC 0000.0C9F.Fxxx
✔ Correct Answer: A. Priority 100; Virtual MAC 0000.0C07.ACxx (where xx is the HSRP group ID in hex)
Technical Explanation: HSRP defaults to priority 100. HSRPv1 uses the virtual MAC 0000.0C07.ACxx, while HSRPv2 uses 0000.0C9F.Fxxx (and VRRP uses 0000.5E00.01xx).
Question 13 Compare the three Cisco Switch Port Security violation modes: Protect, Restrict, and Shutdown. Which statement is true?
  • A. Protect drops frames silently; Restrict drops frames and logs a syslog/SNMP trap while incrementing the violation counter; Shutdown places the port into err-disabled state.
  • B. Protect shuts down the port immediately; Shutdown only logs a warning.
  • C. Restrict forwards unauthorized traffic but sends an email alert.
  • D. All three modes place the interface into err-disabled state.
✔ Correct Answer: A. Protect drops frames silently; Restrict drops frames and logs a syslog/SNMP trap while incrementing the violation counter; Shutdown places the port into err-disabled state.
Technical Explanation: Shutdown is the default violation mode and puts the interface into 'err-disabled' (requiring 'shutdown' then 'no shutdown' to recover). Restrict logs violations and increments counters without shutting the port, while Protect drops frames silently.
Question 14 How do DHCP Snooping and Dynamic ARP Inspection (DAI) work together to secure a Layer 2 switch?
  • A. DHCP Snooping builds a trusted Binding Database (MAC-to-IP-to-VLAN-to-Port) from legitimate DHCP ACK messages, and DAI uses that database to drop spoofed ARP packets on untrusted ports.
  • B. DAI encrypts all ARP packets using IPsec.
  • C. DHCP Snooping blocks all DHCP traffic on trunk ports.
  • D. Both features require disabling Spanning Tree Protocol.
✔ Correct Answer: A. DHCP Snooping builds a trusted Binding Database (MAC-to-IP-to-VLAN-to-Port) from legitimate DHCP ACK messages, and DAI uses that database to drop spoofed ARP packets on untrusted ports.
Technical Explanation: Dynamic ARP Inspection (DAI) depends directly on the DHCP Snooping Binding Database to validate incoming ARP replies on untrusted access ports and prevent ARP poisoning.
Question 15 When configuring a Floating Static Route as a backup path to an OSPF-learned route (Administrative Distance 110), what Administrative Distance (AD) value must be assigned to the static route?
  • A. 1 (Default static route AD)
  • B. Any value greater than 110 (e.g., 115 or 150)
  • C. 0
  • D. 90
✔ Correct Answer: B. Any value greater than 110 (e.g., 115 or 150)
Technical Explanation: A floating static route must have an Administrative Distance higher (less trustworthy) than the primary routing protocol (OSPF AD = 110) so it stays hidden until the OSPF route disappears.
Question 16 What is the purpose of the FCS field in an Ethernet frame?
  • A. To obtain the MAC address of the sending node
  • B. To verify the logical address of the sending node
  • C. To compute the CRC header for the data field
  • D. To determine if errors occurred in the transmission and reception of the frame
✔ Correct Answer: D. To determine if errors occurred in the transmission and reception of the frame
Technical Explanation: The Frame Check Sequence (FCS) trailer uses a 32-bit Cyclic Redundancy Check (CRC) calculation so the receiving NIC can detect corrupted frames and drop them.
Question 17 Which switching method drops frames that fail the FCS check?
  • A. Store-and-forward switching
  • B. Cut-through switching
  • C. Fast-forward switching
  • D. Borderless switching
✔ Correct Answer: A. Store-and-forward switching
Technical Explanation: Store-and-forward switching buffers the entire Ethernet frame, calculates the CRC against the FCS trailer, and discards any corrupted frames or runts/giants before forwarding.
Question 18 What is the auto-MDIX feature on a Cisco Catalyst switch?
  • A. Automatic configuration of an interface for 10/100/1000 Mb/s operation
  • B. Automatic configuration of an interface for a straight-through or a crossover Ethernet cable connection
  • C. Automatic configuration of full-duplex operation over a single optical cable
  • D. The ability to turn a switch interface on or off if a loop is detected
✔ Correct Answer: B. Automatic configuration of an interface for a straight-through or a crossover Ethernet cable connection
Technical Explanation: Auto-MDIX detects the required cable pinout (transmit/receive pairs) and automatically adjusts the port internally, eliminating the need to worry about crossover vs. straight-through cables.
Question 19 What will a host on an Ethernet network do if it receives a frame with a unicast destination MAC address that does not match its own MAC address?
  • A. It will discard the frame.
  • B. It will forward the frame to the next host.
  • C. It will remove the frame from the media.
  • D. It will strip off the data-link frame to check the destination IP address.
✔ Correct Answer: A. It will discard the frame.
Technical Explanation: When a NIC receives an Ethernet frame whose destination MAC does not match the NIC's burned-in MAC, broadcast (FF-FF-FF-FF-FF-FF), or subscribed multicast MAC, it drops the frame at Layer 2 without interrupting the CPU.
Question 20 Which two statements describe the features or functions of the Logical Link Control (LLC) sublayer in Ethernet standards? (Choose two.)
  • A. Logical Link Control is implemented in software.
  • B. Logical Link Control is specified in the IEEE 802.3 standard.
  • C. The LLC sublayer adds a header and a trailer to the data.
  • D. The Data Link layer uses LLC to communicate with the upper layers of the protocol suite.
  • E. LLC is responsible for the placement and retrieval of frames on and off the media.
✔ Correct Answer: A. Logical Link Control is implemented in software. & D. The Data Link layer uses LLC to communicate with the upper layers of the protocol suite.
Technical Explanation: The IEEE 802.2 LLC sublayer is implemented in software/drivers and identifies which Network Layer protocol (IPv4, IPv6, ARP) is encapsulated inside the frame.
Question 21 What is the minimum Ethernet frame size that will not be discarded by the receiver as a runt frame?
  • A. 46 bytes
  • B. 64 bytes
  • C. 128 bytes
  • D. 1518 bytes
✔ Correct Answer: B. 64 bytes
Technical Explanation: The valid IEEE 802.3 Ethernet frame size ranges from 64 bytes (minimum) to 1518 bytes (maximum, excluding VLAN tagging). Any frame smaller than 64 bytes is discarded as a collision fragment (runt).
Question 22 How does a Layer 2 switch build its MAC address table?
  • A. By inspecting the destination MAC address of incoming frames.
  • B. By inspecting the source MAC address of incoming frames and recording the ingress port.
  • C. By sending ARP broadcasts out all active switch ports.
  • D. By downloading the table from the default gateway router.
✔ Correct Answer: B. By inspecting the source MAC address of incoming frames and recording the ingress port.
Technical Explanation: Switches learn MAC addresses dynamically by reading the Source MAC address of every incoming frame and mapping it to the ingress port in the CAM table.
Question 23 What is the special destination MAC address used by an IPv4 broadcast Ethernet frame?
  • A. 00-00-00-00-00-00
  • B. FF-FF-FF-FF-FF-FF
  • C. 01-00-5E-00-00-01
  • D. 33-33-00-00-00-01
✔ Correct Answer: B. FF-FF-FF-FF-FF-FF
Technical Explanation: An Ethernet broadcast frame uses a destination MAC address of all 1s in binary (FF-FF-FF-FF-FF-FF in hexadecimal), which causes switches to flood it out all ports in the VLAN.
Question 24 What is the primary benefit of twisting the wire pairs inside a UTP Ethernet cable?
  • A. It makes the copper wires stronger against physical pulling.
  • B. It reduces crosstalk and electromagnetic interference (EMI/RFI) through magnetic field cancellation.
  • C. It allows more wires to fit inside an RJ-45 connector.
  • D. It increases the voltage level of the electrical signal.
✔ Correct Answer: B. It reduces crosstalk and electromagnetic interference (EMI/RFI) through magnetic field cancellation.
Technical Explanation: Twisting opposing circuit wires together causes their electromagnetic fields to cancel each other out, protecting the signal from external EMI and internal pair-to-pair crosstalk.
Question 25 Why is Single-Mode Fiber (SMF) preferred over Multimode Fiber (MMF) for long-distance campus backbones and WAN links?
  • A. SMF uses cheaper LED light sources.
  • B. SMF has a much larger core diameter (62.5 microns).
  • C. SMF uses a laser light source and a single light path (9-micron core), eliminating modal dispersion over distances up to tens of kilometers.
  • D. SMF does not require glass cladding.
✔ Correct Answer: C. SMF uses a laser light source and a single light path (9-micron core), eliminating modal dispersion over distances up to tens of kilometers.
Technical Explanation: Single-mode fiber has a tiny 9-micron core that allows only a single ray of laser light to travel straight down the fiber, preventing dispersion and supporting long-haul links.
Question 26 What is the default aging timer for dynamic entries in a Cisco Catalyst switch MAC address table?
  • A. 30 seconds
  • B. 180 seconds
  • C. 300 seconds (5 minutes)
  • D. 3600 seconds (1 hour)
✔ Correct Answer: C. 300 seconds (5 minutes)
Technical Explanation: By default, Cisco switches keep dynamically learned MAC address entries in the CAM table for 300 seconds (5 minutes) after the last frame is received from that source MAC.
Question 27 Which cut-through switching method offers the lowest latency by forwarding a frame immediately after reading the 6-byte destination MAC address?
  • A. Fragment-free switching
  • B. Fast-forward switching
  • C. Store-and-forward switching
  • D. CRC-checked switching
✔ Correct Answer: B. Fast-forward switching
Technical Explanation: Fast-forward switching begins forwarding the frame as soon as the destination MAC address is read, offering the lowest possible latency (whereas fragment-free waits for the first 64 bytes).
Question 28 Which Layer 2 media access control method is used by 802.11 Wireless LANs (Wi-Fi) to avoid collisions on shared half-duplex radio frequencies?
  • A. CSMA/CD
  • B. CSMA/CA
  • C. Token Passing
  • D. Full-Duplex Point-to-Point
✔ Correct Answer: B. CSMA/CA
Technical Explanation: Wireless networks operate in half-duplex and cannot detect collisions while transmitting, so they use Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) and RTS/CTS.
Question 29 What happens when one side of an Ethernet link is configured for Full-Duplex and the other side is set to Half-Duplex?
  • A. The link automatically negotiates 10 Gbps speed.
  • B. A duplex mismatch occurs, causing late collisions, FCS errors, and severely degraded throughput.
  • C. Both ports immediately enter the err-disabled state.
  • D. The link converts to a Layer 3 routed port.
✔ Correct Answer: B. A duplex mismatch occurs, causing late collisions, FCS errors, and severely degraded throughput.
Technical Explanation: A duplex mismatch causes the full-duplex end to transmit at any time while the half-duplex end sees simultaneous transmissions as collisions, resulting in late collisions and packet loss.
Question 30 Which destination MAC address prefix is reserved for IPv4 multicast frames?
  • A. 01-00-5E
  • B. 33-33-00
  • C. FF-FF-FF
  • D. FE-80-00
✔ Correct Answer: A. 01-00-5E
Technical Explanation: IPv4 multicast packets map their lower 23 bits into the Ethernet MAC address prefix 01-00-5E-xx-xx-xx (whereas IPv6 multicast uses 33-33-xx-xx-xx-xx).
Question 31 When a router forwards an IPv4 packet from one interface to another on the path toward a remote destination, which two header fields change at every hop? (Choose two.)
  • A. Source IPv4 Address
  • B. Destination IPv4 Address
  • C. Source and Destination Layer 2 MAC Addresses
  • D. IPv4 Time-to-Live (TTL) and Header Checksum
  • E. TCP Destination Port
✔ Correct Answer: C. Source and Destination Layer 2 MAC Addresses & D. IPv4 Time-to-Live (TTL) and Header Checksum
Technical Explanation: Source and Destination IP addresses remain constant end-to-end (unless NAT is performed). At each router hop, the Layer 2 frame is stripped and rewritten with new source/destination MAC addresses, and the IPv4 TTL is decremented by 1 (requiring a new IPv4 Header Checksum).
Question 32 What is the primary enhancement in the IPv6 packet header compared to the IPv4 header?
  • A. IPv6 adds a variable-length Options field to every packet.
  • B. IPv6 uses a simplified, fixed 40-byte header with fewer fields and no header checksum, improving router forwarding efficiency.
  • C. IPv6 reduces the address size from 128 bits to 32 bits.
  • D. IPv6 requires routers to fragment oversized packets en route.
✔ Correct Answer: B. IPv6 uses a simplified, fixed 40-byte header with fewer fields and no header checksum, improving router forwarding efficiency.
Technical Explanation: IPv6 removes unnecessary fields (including the Header Checksum and router fragmentation fields) to create a fixed 40-byte header that hardware routers process much faster.
Question 33 What is the purpose of the Address Resolution Protocol (ARP) in an IPv4 network?
  • A. To resolve a known domain name (FQDN) into an IPv4 address.
  • B. To resolve a known IPv4 address on the local subnet into its corresponding Layer 2 MAC address.
  • C. To dynamically assign IPv4 addresses to new hosts.
  • D. To discover the MAC address of a remote web server across the Internet.
✔ Correct Answer: B. To resolve a known IPv4 address on the local subnet into its corresponding Layer 2 MAC address.
Technical Explanation: ARP broadcasts an ARP Request on the local LAN ('Who has IP X?') to discover the 48-bit Ethernet MAC address required to encapsulate the Layer 2 frame.
Question 34 If PC1 (192.168.1.10/24) wants to send a packet to a web server at 203.0.113.50, what destination MAC address will PC1 place in the Ethernet frame header?
  • A. The MAC address of the web server 203.0.113.50
  • B. The broadcast MAC address FF-FF-FF-FF-FF-FF
  • C. The MAC address of PC1's Default Gateway router interface (e.g., 192.168.1.1)
  • D. The MAC address of the local DNS server
✔ Correct Answer: C. The MAC address of PC1's Default Gateway router interface (e.g., 192.168.1.1)
Technical Explanation: When the destination IP is on a remote network, the host encapsulates the packet inside a Layer 2 frame addressed to the MAC address of its local Default Gateway router.
Question 35 In the output of 'show ip route' on a Cisco router, what do the codes 'C' and 'L' indicate?
  • A. 'C' indicates a directly connected network subnet; 'L' indicates the specific /32 local IPv4 address assigned to the router interface.
  • B. 'C' indicates a Cisco proprietary route; 'L' indicates a legacy RIP route.
  • C. 'C' indicates a converged OSPF route; 'L' indicates a loopback-only route.
  • D. 'C' indicates a static default route; 'L' indicates a link-local route.
✔ Correct Answer: A. 'C' indicates a directly connected network subnet; 'L' indicates the specific /32 local IPv4 address assigned to the router interface.
Technical Explanation: Since Cisco IOS 15+, activating an interface with an IP address adds two entries to the routing table: 'C' (Connected network prefix) and 'L' (Local host route with a /32 mask for the interface's own IP).
Question 36 Which protocol replaces IPv4 ARP in an IPv6 network by using ICMPv6 Neighbor Solicitation (NS) and Neighbor Advertisement (NA) messages?
  • A. DHCPv6
  • B. Neighbor Discovery Protocol (NDP)
  • C. OSPFv3
  • D. NAT64
✔ Correct Answer: B. Neighbor Discovery Protocol (NDP)
Technical Explanation: IPv6 eliminates broadcast ARP and uses ICMPv6 Neighbor Discovery Protocol (NDP) with solicited-node multicast addresses to resolve IPv6 addresses to MAC addresses.
Question 37 What is a security risk associated with ARP broadcasts on a local Ethernet LAN?
  • A. Threat actors can send gratuitous/forged ARP replies to poison the ARP cache of hosts (ARP Spoofing / Man-in-the-Middle attack).
  • B. ARP requests automatically traverse WAN routers across the Internet.
  • C. ARP encrypts traffic using weak DES keys.
  • D. ARP disables port security on Catalyst switches.
✔ Correct Answer: A. Threat actors can send gratuitous/forged ARP replies to poison the ARP cache of hosts (ARP Spoofing / Man-in-the-Middle attack).
Technical Explanation: Because ARP is stateless and unauthenticated, an attacker on the LAN can send spoofed ARP replies claiming to have the Default Gateway's IP address, intercepting all traffic.
Question 38 Which command must be entered on a Cisco router before it will forward IPv6 packets between interfaces?
  • A. ip routing
  • B. ipv6 unicast-routing
  • C. ipv6 enable
  • D. no ipv6 shutdown
✔ Correct Answer: B. ipv6 unicast-routing
Technical Explanation: By default, Cisco IOS routers forward IPv4 packets automatically, but IPv6 routing is disabled until the 'ipv6 unicast-routing' global configuration command is entered.
Question 39 What happens to an IPv4 packet when its Time-to-Live (TTL) field reaches zero at a router?
  • A. The router resets the TTL to 255 and forwards the packet.
  • B. The router drops the packet and sends an ICMP Time Exceeded message back to the source IP address.
  • C. The router buffers the packet until the destination responds.
  • D. The router floods the packet out all interfaces.
✔ Correct Answer: B. The router drops the packet and sends an ICMP Time Exceeded message back to the source IP address.
Technical Explanation: To prevent infinite routing loops, every router decrements TTL by 1. If TTL reaches 0, the router discards the packet and returns an ICMPv4 Type 11 (Time Exceeded) message to the sender.
Question 40 Which field in the IPv6 header is equivalent to the IPv4 Time-to-Live (TTL) field?
  • A. Next Header
  • B. Hop Limit
  • C. Flow Label
  • D. Traffic Class
✔ Correct Answer: B. Hop Limit
Technical Explanation: IPv6 renames the 8-bit TTL field to 'Hop Limit', which accurately reflects its function of counting router hops rather than seconds.
Question 41 When configuring a router GigabitEthernet interface, which command activates the physical port from its default 'administratively down' state?
  • A. enable
  • B. active
  • C. no shutdown
  • D. port up
✔ Correct Answer: C. no shutdown
Technical Explanation: Unlike switch ports (which are active by default), Cisco router interfaces are shut down by default and require the 'no shutdown' interface configuration command.
Question 42 Which command on a Windows PC displays the local routing table?
  • A. ipconfig /all
  • B. netstat -r (or route print)
  • C. arp -a
  • D. tracert
✔ Correct Answer: B. netstat -r (or route print)
Technical Explanation: Running 'netstat -r' or 'route print' in Windows Command Prompt displays the host's IPv4 and IPv6 routing tables, including the active default gateway (0.0.0.0/0).

SRWE Final Skills Exam: Router-on-a-Stick, LACP, STP & DHCP Snooping CLI

Cisco IOS CLI - Verification & Lab Script 
SW1(config)# spanning-tree mode rapid-pvst
SW1(config)# interface range Gi0/1 - 2
SW1(config-if-range)# channel-group 1 mode active
SW1(config-if-range)# exit
SW1(config)# interface Port-channel 1
SW1(config-if)# switchport mode trunk
SW1(config-if)# ip dhcp snooping trust

🔥 Related Cisco CCNA Practice Portals & Simlet Banks

Continue your certification preparation across our verified partner study portals:

📘 CCNA Final Exam Archive↗ 📗 Pass-CCNA Practice Tests↗ 📙 Scaling & Routing Labs↗ 🏆 Pass4Sure CCNA Simlets↗
🎯 Live Practice Score: 0 / 0