Practice for the CCNA exam with 23 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: What is a characteristic of spine-and-leaf architecture?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- What is a characteristic of spine-and-leaf architecture?
- Which virtual MAC address is used by VRRP group 1?
- A Cisco engineer at a new branch office is configuring a wireless network with access points that connect to…
- Which mechanism allows WPA3 to provide a higher degree of security than its predecessors?
- Which device segregates a network into separate zones that have their own security policies?
- Where does a switch maintain DHCP snooping information?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. What is a characteristic of spine-and-leaf architecture?
Answer: D. Each device is separated by the same number of hops.
In a spine-and-leaf topology, every leaf switch connects to every spine switch, ensuring consistent latency because any two devices are separated by the same number of hops. Options mentioning Spanning Tree Protocol or variable latency act as traps, as modern designs avoid such inefficiencies.
Q2. Which virtual MAC address is used by VRRP group 1?
Answer: D. 0000.5E00.0101
Virtual Router Redundancy Protocol version three uses a dedicated virtual MAC address format of zero zero zero zero dot five E zero zero dot zero one X X. The X X represents the group number in hexadecimal, making group one end in zero one.
Q3. A Cisco engineer at a new branch office is configuring a wireless network with access points that connect to a controller that is based at corporate headquarters. Wireless client traffic must terminate at the branch office and access-point…
Answer: B. FlexConnect with local switching enabled
FlexConnect with local switching enabled allows wireless client traffic to terminate locally at the branch office instead of traversing a WAN link. This mode also provides access point survivability, allowing the device to operate independently if the controller is unreachable.
Q4. Which mechanism allows WPA3 to provide a higher degree of security than its predecessors?
Answer: B. SAE password-based key exchange
WPA three replaces the vulnerable four-way handshake with Simultaneous Authentication of Equals, also known as SAE. This password-based key exchange provides robust protection against offline dictionary attacks, which is a major security improvement over previous versions.
Q5. Which device segregates a network into separate zones that have their own security policies?
Answer: D. firewall
A firewall segregates a network into separate security zones, such as inside, outside, or DMZ, and strictly controls traffic between them. Switches and access points provide connectivity, while an intrusion prevention system strictly monitors for attacks.
Q6. Where does a switch maintain DHCP snooping information?
Answer: D. In the binding database
A switch maintains DHCP snooping information in the binding database. This database tracks IP-to-MAC address bindings, VLAN, and port, and it is used to validate DHCP messages and enforce security features like Dynamic ARP Inspection.
Q7. Which component controls and distributes physical resources for each virtual machine?
Answer: A. hypervisor
The hypervisor abstracts and manages the underlying physical hardware resources such as CPU, memory, and storage for virtual machines. An operating system runs applications, while the CPU and enclosure are physical hardware components.
Q8. When is the PUT method used within HTTP?
Answer: A. to create or fully replace a resource at a specified URI
The PUT method creates or completely replaces a resource at a specific URI. It is idempotent, meaning repeated identical requests yield the same result. Displaying a website or performing read-only operations relies on methods like GET.
Q9. Using direct-sequence spread spectrum, which three 2.4-GHz channels are non-overlapping?
Answer: C. 1, 6, 11
Channels 1, 6, and 11 are the three non-overlapping channels in the 2.4-GHz band using DSSS. These channels are spaced far enough apart to prevent frequency overlap, unlike the other listed options.
Q10. Which network action occurs within the data plane?
Answer: D. compare the destination IP address to the IP routing table
The data plane handles actual packet forwarding by comparing the destination IP to the routing table. Control plane functions like OSPF routing and NETCONF configuration changes build the tables used for forwarding.
Q11. What is the function of the control plane?
Answer: A. It exchanges routing table information.
The control plane builds and maintains the routing table by exchanging network routing information using protocols like OSPF or BGP. Forwarding traffic and looking up egress interfaces are data plane functions.
Q12. What is the benefit of configuring PortFast on an interface?
Answer: B. After the cable is connected, the interface is available faster to send and receive user data.
PortFast allows an access port to bypass the listening and learning states of STP, transitioning immediately to the forwarding state. This significantly reduces the time before the interface can send and receive user traffic, such as during DHCP negotiation.
Q13. Which QoS forwarding per-hop behavior changes a specific value in a packet header to set the class of service for the packet?
Answer: D. marking
Marking modifies specific fields in the packet header to indicate the class of service. Classification identifies the traffic, but only marking actually changes the packet header to define the per-hop behavior for downstream devices.
Q14. Which IPv6 address block forwards packets to a multicast address rather than a unicast address?
Answer: D. FF00::/12
IPv6 multicast traffic uses the FF00::/12 address block to send packets to a group of interfaces. Global unicast uses 2000::/3, unique local uses FC00::/7, and link-local uses FE80::/10.
Q15. What is the operating mode and role of a backup port on a shared LAN segment in Rapid PVST+?
Answer: B. discarding state and provides a backup path for a designated port on the same LAN segment
A backup port in Rapid PVST+ provides a backup path for a designated port on the same LAN segment. It remains in the discarding state until the designated port fails, while an alternate port backs up the root port.
Q16. What does a switch search for in the CAM table when forwarding a frame?
Answer: D. destination MAC address
When forwarding a frame, a switch examines the destination MAC address and searches the CAM table for a matching entry. The source MAC address is only used during the MAC learning process, not the forwarding lookup.
Q17. Which protocol enables an application on a client to communicate with a server over an IP network?
Answer: D. HTTP
Application layer protocols like HTTP enable client applications to communicate with server applications. Lower layer protocols like TCP and IP provide reliable transport and logical addressing underneath.
Q18. Which keyword in a NAT configuration enables the use of one outside IP address for multiple inside hosts?
Answer: D. overload
The overload keyword enables Port Address Translation, allowing multiple inside hosts to share one public IP address. It differentiates sessions by assigning unique Layer 4 source port numbers to each connection.
Q19. Which connection type is used when an engineer connects to an AP without a configured IP address or dial-up number to manage the device?
Answer: D. console
A console connection provides direct, out-of-band management access without needing an IP address. The mention of a missing dial-up number eliminates the AUX port, leaving the console port as the only option for initial configuration.
Q20. The clients and DHCP server reside on different subnets. Which command must be used to forward requests and replies between clients on the 10.10.0.1/24 subnet and the DHCP server at 192.168.10.1?
Answer: D. ip helper-address 192.168.10.1
The IP helper address command is configured on a router interface to forward UDP broadcasts, including DHCP requests, to a server on a different subnet. Static routes and default gateways do not forward local broadcasts.
Q21. Which IPv4 address block is reserved for private use and commonly used inside enterprises?
Answer: B. 10.0.0.0/8
The 10.0.0.0/8 block is an RFC 1918 private address range used for internal enterprise networks. The 100.64.0.0/10 block is for carrier grade NAT, and 192.0.2.0/24 is a documentation block.
Q22. How does authentication differ from authorization?
Answer: B. Authentication verifies the identity of a person accessing a network, and authorization determines what resource a user can access.
Authentication verifies the identity of a user or device, while authorization determines what resources that validated entity is allowed to access. Be careful not to confuse authorization with accounting, which tracks user activity.
Q23. To improve corporate security, an organization is planning to implement badge authentication to limit access to the data center. Which element of a security program is being deployed?
Answer: C. physical access control
Implementing badge authentication to restrict building entry is a form of physical access control. User awareness and training are administrative controls, whereas vulnerability verification is a network scanning process.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.