ICT Officer II Network Administrator Practical Questions and Answers 2026

 

Practical Examination Date: 6th June 2026

This article provides practical examination questions and answers for the ICT Officer II – Network Administrator position. It covers Cisco router and switch configuration, network security, VLAN implementation, DHCP services, OSPF routing, access control lists (ACLs), RADIUS authentication, and network verification commands.

The questions and solutions are organized to help candidates understand the required configurations and prepare for practical networking examinations.

QUESTION ONE: BASIC DEVICE CONFIGURATION

A. Router Configuration

1. Configure SSHv2 Access Restriction

Question: Deny SSHv2 access from the host machine with IP address 172.16.10.2.

Answer:

Configure an access control list (ACL) to deny SSH access from the specified host while permitting other hosts.

enable
configure terminal

ip access-list standard ROUTER_SSH_ACCESS
 deny host 172.16.10.2
 permit any
exit

line vty 0 4
 access-class ROUTER_SSH_ACCESS in
 transport input ssh
 login local
exit

end

2. Configure Basic Router Security Settings

Question: Configure the following security settings:

• Hostname: Use your examination number.

• Username and password: PSRS123.

• Domain name: ajira.go.tz.

• Login banner message.

Answer:

enable
configure terminal

hostname YOUR_EXAM_NUMBER
enable secret PSRS123
username PSRS123 privilege 15 secret PSRS123

ip domain-name ajira.go.tz
crypto key generate rsa modulus 2048
ip ssh version 2

banner motd #UNAUTHORIZED ACCESS IS PROHIBITED#

end

Note: Replace YOUR_EXAM_NUMBER with your actual examination number.

3. Configure Login Security Policy

Question: Configure the router to block login attempts for three minutes after three unsuccessful login attempts within 90 seconds.

Answer:

configure terminal
login block-for 180 attempts 3 within 90
end

Explanation:

• 180 represents the blocking period in seconds (3 minutes).

• 3 represents the maximum number of unsuccessful login attempts.

• 90 represents the time window in seconds.

B. Switch Configuration

1. Configure SSHv2 Access Restriction

Question: Configure SSHv2 access so that only the host machine with IP address 172.16.20.2 can remotely access the switch.

Answer:

enable
configure terminal

ip access-list standard SWITCH_SSH_ACCESS
 permit host 172.16.20.2
 deny any
exit

line vty 0 15
 access-class SWITCH_SSH_ACCESS in
 transport input ssh
 login local
exit

end

2. Configure Basic Switch Security Settings

Question: Configure the following settings:

• Hostname: Examination number.

• Username and password: PSRS123.

• Domain name: ajira.go.tz.

• Login banner.

Answer:

enable
configure terminal

hostname YOUR_EXAM_NUMBER
enable secret PSRS123
username PSRS123 privilege 15 secret PSRS123

ip domain-name ajira.go.tz
crypto key generate rsa modulus 2048
ip ssh version 2

banner motd #UNAUTHORIZED ACCESS IS PROHIBITED#

end

Replace YOUR_EXAM_NUMBER with your actual examination number.

3. Configure EXEC Timeout on Remote Sessions

Question: Configure all remote sessions to disconnect automatically after a period of inactivity.

Answer:

The following example sets the idle timeout to five minutes.

configure terminal

line vty 0 15
 exec-timeout 5 0
exit

end
copy running-config startup-config

Explanation: The exec-timeout 5 0 command automatically disconnects remote users after five minutes of inactivity.

QUESTION TWO: VLAN DESIGN AND NETWORK SERVICES

A. VLAN Design and Voice Enablement

Question: Design and configure a network with the following VLANs:

VLAN ID	VLAN Name	Network Address
100	ICT_DIVISION	172.16.10.0/24
200	QUALITY_CONTROL_DIVISION	172.16.20.0/24
300	RECRUITMENT_DIVISION	172.16.30.0/24
400	IP_CAMERA	172.16.40.0/25
500	VOICE	172.16.50.0/26
600	GUEST_WIFI_NETWORK	172.16.60.0/24

Ensure that all required VLANs are configured and voice communication is enabled where required.

Step 1: Create and Name the VLANs

enable
configure terminal

vlan 100
 name ICT_DIVISION
exit

vlan 200
 name QUALITY_CONTROL_DIVISION
exit

vlan 300
 name RECRUITMENT_DIVISION
exit

vlan 400
 name IP_CAMERA
exit

vlan 500
 name VOICE
exit

vlan 600
 name GUEST_WIFI_NETWORK
exit

end

Step 2: Configure Router Subinterfaces for Inter-VLAN Routing

Assume GigabitEthernet0/0 is the router interface connected to the switch through a trunk link.

enable
configure terminal

interface gigabitEthernet0/0
 no shutdown
exit

interface gigabitEthernet0/0.100
 encapsulation dot1Q 100
 ip address 172.16.10.1 255.255.255.0
exit

interface gigabitEthernet0/0.200
 encapsulation dot1Q 200
 ip address 172.16.20.1 255.255.255.0
exit

interface gigabitEthernet0/0.300
 encapsulation dot1Q 300
 ip address 172.16.30.1 255.255.255.0
exit

interface gigabitEthernet0/0.400
 encapsulation dot1Q 400
 ip address 172.16.40.1 255.255.255.128
exit

interface gigabitEthernet0/0.500
 encapsulation dot1Q 500
 ip address 172.16.50.1 255.255.255.192
exit

interface gigabitEthernet0/0.600
 encapsulation dot1Q 600
 ip address 172.16.60.1 255.255.255.0
exit

end

Step 3: Enable Voice VLAN on IP Phone Ports

Configure voice VLAN 500 on switch ports connected to IP phones.

configure terminal

interface fa0/3
 switchport mode access
 switchport access vlan 100
 switchport voice vlan 500
exit

end

Apply the same configuration to other IP phone ports, adjusting the data VLAN according to the department using each port.

B. DHCP and Switch Port Configuration

1. Configure DHCP Pools for Required VLANs

Question: Configure DHCP pools for VLANs 100, 200, 300, 500 and 600.

Answer:

Configure DHCP on the router to automatically assign IP addresses to devices connected to the specified VLANs.

Step 1: Exclude Default Gateway Addresses

enable
configure terminal

ip dhcp excluded-address 172.16.10.1
ip dhcp excluded-address 172.16.20.1
ip dhcp excluded-address 172.16.30.1
ip dhcp excluded-address 172.16.50.1
ip dhcp excluded-address 172.16.60.1

Step 2: Configure DHCP Pool for VLAN 100

ip dhcp pool ICT_DIVISION
 network 172.16.10.0 255.255.255.0
 default-router 172.16.10.1
 dns-server 8.8.8.8 8.8.4.4
exit

Step 3: Configure DHCP Pool for VLAN 200

ip dhcp pool QUALITY_CONTROL_DIVISION
 network 172.16.20.0 255.255.255.0
 default-router 172.16.20.1
 dns-server 8.8.8.8 8.8.4.4
exit

Step 4: Configure DHCP Pool for VLAN 300

ip dhcp pool RECRUITMENT_DIVISION
 network 172.16.30.0 255.255.255.0
 default-router 172.16.30.1
 dns-server 8.8.8.8 8.8.4.4
exit

Step 5: Configure DHCP Pool for VLAN 500

ip dhcp pool VOICE
 network 172.16.50.0 255.255.255.192
 default-router 172.16.50.1
 dns-server 8.8.8.8
exit

Step 6: Configure DHCP Pool for VLAN 600

ip dhcp pool GUEST_WIFI_NETWORK
 network 172.16.60.0 255.255.255.0
 default-router 172.16.60.1
 dns-server 8.8.8.8 8.8.4.4
exit

end
copy running-config startup-config

2. Configure Switch Ports as Access Ports

Question: Configure switch ports as access ports and assign them to their respective VLANs.

Answer:

The following example assigns switch ports to different VLANs. Adjust the port allocation according to the actual examination network topology.

enable
configure terminal

interface range fa0/3-6
 switchport mode access
 switchport access vlan 100
exit

interface range fa0/7-10
 switchport mode access
 switchport access vlan 200
exit

interface range fa0/11-14
 switchport mode access
 switchport access vlan 300
exit

interface range fa0/15-17
 switchport mode access
 switchport access vlan 400
exit

interface range fa0/18-20
 switchport mode access
 switchport access vlan 600
exit

end

For ports connected to IP phones, configure the appropriate voice VLAN as demonstrated in the voice VLAN configuration section.

C. VLAN Security – VLAN Hopping Prevention

Question: Implement security measures to prevent VLAN hopping attacks.

Answer:

The following security measures help protect the network against VLAN hopping:

1. Configure trunk ports manually instead of using dynamic trunk negotiation.

2. Use an unused VLAN as the native VLAN.

3. Allow only required VLANs on trunk ports.

4. Disable unused switch ports.

5. Configure user-facing ports as static access ports.

Configuration Commands:

enable
configure terminal

vlan 999
 name NATIVE_UNUSED
exit

interface gigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 999
 switchport trunk allowed vlan 100,200,300,400,500,600
 switchport nonegotiate
exit

end

Disable Unused Switch Ports

configure terminal

interface range fa0/21-24
 switchport mode access
 switchport access vlan 999
 shutdown
exit

end

Explanation: These measures reduce the risk of unauthorized VLAN access and VLAN hopping attacks.

D. Port Security Configuration

Question: Configure switch port security on ports 3 to 24 using the following requirements:

• Allow a maximum of two MAC addresses per port.

• Set the violation mode to shutdown.

Answer:

enable
configure terminal

interface range fa0/3-24
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation shutdown
 switchport port-security mac-address sticky
exit

end
copy running-config startup-config

Explanation of Commands:

• switchport port-security enables port security.

• switchport port-security maximum 2 allows a maximum of two MAC addresses per port.

• switchport port-security violation shutdown shuts down the port when a security violation occurs.

• switchport port-security mac-address sticky dynamically learns and saves permitted MAC addresses.

E. RADIUS Server Configuration

Question: Configure remote access authentication using a RADIUS server with the following requirements:

• Use the server IP address provided in the examination.

• Use the shared secret key provided in the examination.

• Ensure remote authentication is properly enforced.

Answer:

The following example uses 172.16.10.10 as the RADIUS server address and RADIUS_SECRET as the shared secret. Replace these illustrative values with the actual examination details.

enable
configure terminal

aaa new-model

radius-server host 172.16.10.10 key RADIUS_SECRET

aaa authentication login default group radius local
aaa authorization exec default group radius local

end
copy running-config startup-config

Explanation:

• aaa new-model enables AAA services.

• radius-server host specifies the RADIUS server IP address and shared secret.

• aaa authentication login default group radius local authenticates users through RADIUS, with local authentication as a fallback.

• aaa authorization exec default group radius local authorizes EXEC sessions through RADIUS, with local fallback.

For strict RADIUS-only authentication, remove the local fallback only if this is explicitly required by the examination.

QUESTION THREE: OSPF ROUTING CONFIGURATION

A. Configure OSPF Process

Question: Configure OSPF routing using process ID 10.

Answer:

enable
configure terminal

router ospf 10

end

B. Assign Networks to OSPF Areas

Question: Assign the following networks to their respective OSPF areas:

Network / VLAN	OSPF Area
VLAN 100	Area 0
VLAN 200	Area 10
VLAN 300	Area 20
VLAN 400	Area 30
VLAN 600	Area 40
ISP WAN Link	Area 50

Answer:

Configure the following network statements under OSPF process 10.

Network Address	Wildcard Mask	OSPF Area
172.16.10.0/24	0.0.0.255	0
172.16.20.0/24	0.0.0.255	10
172.16.30.0/24	0.0.0.255	20
172.16.40.0/25	0.0.0.127	30
172.16.60.0/24	0.0.0.255	40
41.59.254.136/30	0.0.0.3	50

Configuration Commands:

configure terminal

router ospf 10
 network 172.16.10.0 0.0.0.255 area 0
 network 172.16.20.0 0.0.0.255 area 10
 network 172.16.30.0 0.0.0.255 area 20
 network 172.16.40.0 0.0.0.127 area 30
 network 172.16.60.0 0.0.0.255 area 40

 network 41.59.254.136 0.0.0.3 area 50
exit

end

Note: The WAN network 41.59.254.136/30 is derived from the supplied next-hop address 41.59.254.138, assuming a /30 WAN subnet.

C. Configure OSPF Router ID

Question: Set the OSPF Router ID to 1.1.1.1.

Answer:

configure terminal

router ospf 10
 router-id 1.1.1.1
exit

end

If OSPF is already running, use the following command to make the new Router ID take effect:

clear ip ospf process

Confirm the operation if prompted.

D. Configure Default Route

Question: Configure a default route pointing to the ISP WAN.

Next-hop IP: 41.59.254.138

Answer:

enable
configure terminal

ip route 0.0.0.0 0.0.0.0 41.59.254.138

router ospf 10
 default-information originate
exit

end
copy running-config startup-config

Explanation:

• The static default route directs unknown traffic to the ISP next-hop address.

• default-information originate advertises the default route to other OSPF routers.

E. Configure Passive Interfaces in OSPF

Question: Configure all LAN interfaces as passive interfaces in OSPF.

Answer:

Configure all OSPF interfaces as passive by default, then enable OSPF neighbor communication on the WAN interface.

Assuming GigabitEthernet0/1 is the WAN interface:

configure terminal

router ospf 10
 passive-interface default
 no passive-interface gigabitEthernet0/1
exit

end

Explanation: Passive interfaces advertise their connected networks through OSPF but do not send OSPF Hello packets or form OSPF neighbor relationships on those interfaces.

F. Configure ACL for Guest Wi-Fi Network

Question: Restrict the Guest Wi-Fi network (VLAN 600) from accessing internal LAN resources.

Answer:

Create an extended ACL to block Guest Wi-Fi users from accessing internal departmental networks while permitting access to other destinations.

The internal networks are:

• VLAN 100 – 172.16.10.0/24

• VLAN 200 – 172.16.20.0/24

• VLAN 300 – 172.16.30.0/24

• VLAN 400 – 172.16.40.0/25

• VLAN 500 – 172.16.50.0/26

Configuration Commands:

enable
configure terminal

ip access-list extended GUEST_WIFI_ACL

 deny ip 172.16.60.0 0.0.0.255 172.16.10.0 0.0.0.255
 deny ip 172.16.60.0 0.0.0.255 172.16.20.0 0.0.0.255
 deny ip 172.16.60.0 0.0.0.255 172.16.30.0 0.0.0.255
 deny ip 172.16.60.0 0.0.0.255 172.16.40.0 0.0.0.127
 deny ip 172.16.60.0 0.0.0.255 172.16.50.0 0.0.0.63

 permit ip 172.16.60.0 0.0.0.255 any

exit

interface gigabitEthernet0/0.600
 ip access-group GUEST_WIFI_ACL in
exit

end
copy running-config startup-config

Explanation:

• The ACL denies Guest Wi-Fi users access to internal departmental networks.

• The final permit statement allows guest users to communicate with other destinations, including the internet, subject to other network security policies.

• The ACL is applied inbound on the VLAN 600 router subinterface.

ADDITIONAL: NETWORK CONFIGURATION VERIFICATION

After completing the configurations, use the following commands to verify that the router and switch are operating correctly.

1. Router Verification Commands

show running-config
show ip interface brief
show ip ssh
show login
show access-lists
show ip route
show ip ospf neighbor
show ip ospf interface brief
show ip route ospf
show ip dhcp pool
show ip dhcp binding

2. Switch Verification Commands

show vlan brief
show interfaces trunk
show port-security
show port-security interface fa0/3
show running-config
show ip ssh
show access-lists

3. Save the Configuration

Always save the running configuration to the startup configuration to prevent losing your changes after restarting the device.

copy running-config startup-config

IMPORTANT PRACTICAL EXAMINATION NOTES

Before completing the practical examination, consider the following:

1. Replace YOUR_EXAM_NUMBER with your actual examination number.

2. Replace the illustrative RADIUS IP address and shared secret with the actual values supplied in the examination.

3. Confirm router and switch interface names before applying configurations.

4. Ensure that router LAN and WAN connections use different physical interfaces.

5. The WAN network 41.59.254.136/30 is inferred from the supplied ISP next-hop address 41.59.254.138.

6. The ISP router must participate in OSPF for an OSPF neighbor relationship to form across the WAN link.

7. Adjust the example switch port allocation according to the actual examination topology.

8. VLAN 400 does not have a DHCP pool because the examination specifically requests DHCP pools for VLANs 100, 200, 300, 500 and 600.

9. The five-minute switch EXEC timeout is an example because the question does not specify an exact timeout duration.

10. Ensure that the RADIUS server is reachable and its shared secret matches the configured value before testing remote authentication.

CONCLUSION

The practical examination covers important network administration skills, including router and switch security, VLAN configuration, DHCP services, inter-VLAN routing, port security, RADIUS authentication, OSPF routing and access control lists.

Candidates preparing for ICT Officer II – Network Administrator practical examinations should practise these configurations using Cisco Packet Tracer or compatible networking equipment. Understanding the purpose of each command is important for successfully completing practical networking tasks.

END OF ICT OFFICER II – NETWORK ADMINISTRATOR PRACTICAL EXAMINATION QUESTIONS AND ANSWERS

Institutions Mentioned:

• The Mwalimu Nyerere Memorial Academy (MNMA)

• Dar es Salaam Maritime Institute (DMI)

Prepared for educational and examination revision purposes.

BONYEZA HAPA KUPAKUA PDF -  CLICK HERE TO DOWNLOAD PDF