Prepare for the CCNA 3 v7.02 & v8 (Enterprise Networking, Security, and Automation - ENSA) Final Exam. Every question below covers single-area OSPFv2, Standard/Extended IPv4 ACLs, NAT/PAT (Overload), WAN/VPN concepts, QoS, and Network Automation (REST APIs, JSON, SDN Controllers).
📥 Download CCNA 3 (ENSA v7.02) Final PT Skills Assessment (PTSA) .PKA File
Full Packet Tracer topology covering OSPFv2 DR/BDR election, PAT Overload, Extended ACLs, and Syslog/NTP.
Verified Exam Questions & Interactive Explanations
Question 1
Two OSPFv2 routers R1 and R2 are connected over GigabitEthernet0/0, but their adjacency is stuck in the EXSTART/EXCHANGE state. What is the most probable cause?
✔ Correct Answer: C. Interface MTU mismatch between R1 and R2.
Technical Explanation: During the
EXSTART and EXCHANGE states, OSPF neighbors exchange Database Description (DBD) packets containing the interface MTU. If the MTU values do not match, the adjacency stalls in EXSTART/EXCHANGE. Fix by matching the MTU or configuring ip ospf mtu-ignore.
Question 2
In OSPFv2, what is the order of precedence when a Cisco router selects its 32-bit OSPF Router ID (RID)?
✔ Correct Answer: B. 1. Explicitly configured 'router-id' command -> 2. Highest active Loopback IPv4 address -> 3. Highest active physical interface IPv4 address
Technical Explanation: OSPF determines its Router ID strictly in this order:
1. Manual configuration via
2. Highest IPv4 address on any up Loopback interface.
3. Highest IPv4 address on any active (up/up) physical interface.
1. Manual configuration via
router-id x.x.x.x under router ospf [pid].2. Highest IPv4 address on any up Loopback interface.
3. Highest IPv4 address on any active (up/up) physical interface.
Question 3
Where should a network engineer place a Standard IPv4 Access Control List (ACL) versus an Extended IPv4 ACL?
✔ Correct Answer: B. Standard ACLs closest to the destination; Extended ACLs closest to the source.
Technical Explanation: Because Standard ACLs (1–99) filter strictly based on the Source IP address, placing them near the source could block traffic to all other legitimate destinations. Therefore, Standard ACLs go closest to the destination, while Extended ACLs (100–199) specify source, destination, and TCP/UDP ports, so they are placed closest to the source to drop unwanted traffic early.
Question 4
Which NAT configuration allows hundreds of internal private IPv4 hosts (10.1.1.0/24) to share a single public IPv4 address on router interface GigabitEthernet0/0/1 by tracking TCP/UDP source port numbers?
✔ Correct Answer: C. PAT (Port Address Translation / NAT Overload)
Technical Explanation: PAT (NAT Overload) configured with the
overload keyword (e.g., ip nat inside source list 1 interface GigabitEthernet0/0/1 overload) maps multiple Inside Local IPv4 addresses to a single Inside Global IP by assigning unique source TCP/UDP port numbers.
Question 5
Which IPsec VPN framework combines multipoint GRE tunnels, Next-Hop Resolution Protocol (NHRP), and IPsec encryption to dynamically build spoke-to-spoke tunnels?
✔ Correct Answer: A. DMVPN (Dynamic Multipoint VPN)
Technical Explanation: Cisco DMVPN relies on mGRE (Multipoint GRE) interfaces, NHRP for dynamic spoke public IP discovery, and IPsec for cryptographic protection, allowing direct spoke-to-spoke traffic without hair-pinning through the hub.
Question 6
In a QoS DiffServ model, which Per-Hop Behavior (PHB) and DSCP value is recommended for interactive Voice over IP (VoIP) traffic requiring strict priority queuing (LLQ) and minimum latency?
✔ Correct Answer: C. Expedited Forwarding EF (DSCP 46)
Technical Explanation: Expedited Forwarding (EF - DSCP 46 / CoS 5) is designated for real-time voice traffic and is serviced via Low Latency Queuing (LLQ) to provide guaranteed bandwidth and minimal jitter/delay.
Question 7
In Software-Defined Networking (SDN), which interface type does the SDN Controller use to push flow tables and configurations down to switches and routers using protocols like OpenFlow or NETCONF?
✔ Correct Answer: B. Southbound Interface (SBI)
Technical Explanation: The Southbound Interface (SBI) connects the SDN Controller (Control Plane) down to the physical/virtual networking devices (Data Plane) via OpenFlow, NETCONF, or OpFlex. The Northbound Interface (NBI) connects the controller up to applications via REST APIs.
Cisco IOS Single-Area OSPFv2, PAT Overload & Extended ACL CLI
Cisco IOS CLI - Verification & Configuration
! 1. Configure Single-Area OSPFv2 with Passive Default & Default Route: R1(config)# router ospf 10 R1(config-router)# router-id 1.1.1.1 R1(config-router)# passive-interface default R1(config-router)# no passive-interface GigabitEthernet0/0/0 R1(config-router)# network 10.10.1.0 0.0.0.255 area 0 R1(config-router)# network 172.16.1.0 0.0.0.3 area 0 R1(config-router)# default-information originate R1(config-router)# exit ! 2. Configure PAT (NAT Overload) on Exit Interface G0/0/1: R1(config)# access-list 1 permit 10.10.1.0 0.0.0.255 R1(config)# ip nat inside source list 1 interface GigabitEthernet0/0/1 overload R1(config)# interface GigabitEthernet0/0/0 R1(config-if)# ip nat inside R1(config-if)# interface GigabitEthernet0/0/1 R1(config-if)# ip nat outside R1(config-if)# end R1# show ip nat translations