Practice for the CCNA exam with 23 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which protocol requires authentication to transfer a backup configuration file from a router to a remote server?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- Which protocol requires authentication to transfer a backup configuration file from a router to a remote serv…
- Which default condition must be considered when an encrypted mobility tunnel is used between two Cisco WLCs?
- Which enhancement is implemented in WPA3?
- Which type of organization should use a collapsed-core architecture?
- What uses HTTP messages to transfer data to applications residing on different hosts?
- When should an engineer implement a collapsed-core architecture?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which protocol requires authentication to transfer a backup configuration file from a router to a remote server?
Answer: A. A. FTP
File Transfer Protocol requires a username and password before allowing file transfers. When backing up a router configuration using commands such as copy running-config ftp, the router prompts for credentials, unlike simpler protocols like TFTP.
Q2. Which default condition must be considered when an encrypted mobility tunnel is used between two Cisco WLCs?
Answer: B. B. Encryption is not enabled by default and must be explicitly configured.
Mobility tunnels between Wireless LAN Controllers are not encrypted by default. If encryption is required for inter-controller roaming across untrusted networks, it must be explicitly enabled rather than being an automatic default behavior.
Q3. Which enhancement is implemented in WPA3?
Answer: D. D. protects against brute force attacks
Wi-Fi Protected Access version three implements Simultaneous Authentication of Equals, which protects against offline brute-force attacks on passwords. This ensures that captured handshakes cannot be used for efficient offline dictionary attacks, a major improvement over previous versions.
Q4. Which type of organization should use a collapsed-core architecture?
Answer: A. A. small and needs to reduce networking costs
A collapsed-core architecture combines the core and distribution layers into a single tier, reducing hardware and operational costs. This design fits small organizations needing simplicity rather than large or rapidly growing networks that require the scalability of a three-tier model.
Q5. What uses HTTP messages to transfer data to applications residing on different hosts?
Answer: C. C. REST
Representational State Transfer uses standard HTTP methods like GET and POST to exchange data between applications on separate hosts. OpenFlow relies on a dedicated secure channel, whereas OpenStack manages virtual infrastructure rather than direct HTTP data transfers.
Q6. When should an engineer implement a collapsed-core architecture?
Answer: B. B. For small networks with minimal need for growth
Engineers implement a collapsed-core architecture for small networks with minimal growth requirements to reduce cost and complexity. Large networks or multi-site deployments require a full three-tier design to handle scaling and high availability.
Q7. How are VLAN hopping attacks mitigated?
Answer: A. A. manually implement trunk ports and disable DTP
VLAN hopping attacks are mitigated by manually configuring trunk ports and disabling Dynamic Trunking Protocol. Disabling DTP prevents rogue devices from automatically negotiating a trunk link to access unauthorized VLANs.
Q8. What is a zero-day exploit?
Answer: C. C. It is when a new network vulnerability is discovered before a fix is available.
A zero-day exploit targets a newly discovered vulnerability for which no patch or vendor fix is currently available. Attack options describing traffic saturation, SQL injection, or man-in-the-middle attacks represent different types of network threats.
Q9. Which key function is provided by the data plane?
Answer: D. D. Forwarding traffic to the next hop
The data plane is responsible for forwarding traffic to the next hop based on the forwarding information base. The control plane handles routing decisions and exchanging routing table information.
Q10. Why is a first-hop redundancy protocol implemented?
Answer: D. D. to protect against default gateway failures
First Hop Redundancy Protocols protect against default gateway failures by allowing multiple routers to share a virtual IP address. Options describing switch stacking, load-sharing, or loop prevention target different network features like VSS, EtherChannel, and Spanning Tree.
Q11. Which set of 2.4 GHz nonoverlapping wireless channels is standard in the United States?
Answer: D. D. channels 1, 6, and 11
Channels one, six, and eleven are the only standard nonoverlapping channels in the two point four gigahertz band within the United States. Channel fourteen is restricted to Japan, while the other combinations either overlap or are nonstandard.
Q12. How is noise defined in Wi-Fi?
Answer: B. B. any interference that is not Wi-Fi traffic that degrades the desired signal
Wi-Fi noise is defined as any non-Wi-Fi interference that degrades the desired wireless signal, such as microwaves or Bluetooth devices. Options mentioning co-channel interference or signal-to-noise ratios confuse noise sources with related metrics.
Q13. When a site-to-site VPN is used, which protocol is responsible for the transport of user data?
Answer: A. A. IPsec
IP Security, or IPsec, is responsible for encrypting and transporting user data across a site-to-site VPN tunnel. Internet Key Exchange versions one and two handle session negotiation, while MD5 provides integrity checking.
Q14. Which type of IPv6 address is similar to a unicast address but is assigned to multiple devices on the same network at the same time?
Answer: C. C. anycast address
An anycast address shares the format of a unicast address but is assigned to multiple devices, routing traffic to the nearest node. Multicast is strictly one-to-many, while global and link-local addresses identify single interfaces.
Q15. Which enhancements were implemented as part of WPA3?
Answer: A. A. Forward secrecy and SAE in personal mode for secure initial key exchange
WPA3 implements Simultaneous Authentication of Equals for personal mode, providing forward secrecy and a secure initial key exchange. TKIP is an obsolete WPA feature, while AES encryption applies to multiple generations.
Q16. A WLC sends alarms about a rogue AP, and the network administrator verifies that the alarms are caused by a legitimate autonomous AP. How must the alarms be stopped for the MAC address of the AP?
Answer: D. D. Set the AP Class Type to Friendly.
When a wireless LAN controller detects a legitimate autonomous access point as a rogue, the alarms must be stopped by classifying its MAC address as friendly. Manual containment is a mitigation action used against actual threats.
Q17. Which plane is centralized in software-defined networking?
Answer: D. D. control
Software-defined networking centralizes the control plane within an SDN controller, which programs the data plane to make forwarding decisions. The application and data planes remain distributed across the network devices.
Q18. What is the difference between controller-based networks and traditional networks as they relate to control-plane and/or data-plane functions?
Answer: D. D. Controller-based networks centralize all important control-plane functions, and traditional networks distribute control-plane functions.
Controller-based networks centralize the control plane, whereas traditional networks distribute control plane intelligence across individual devices. Traditional networking forces every device to build its own forwarding tables independently, which increases operational overhead.
Q19. Which SDN plane forwards user-generated traffic?
Answer: D. D. Data plane
The data plane, also called the forwarding plane, handles the actual physical forwarding of user-generated traffic based on programming from the control plane. Management and control planes operate independently and do not process user packets directly.
Q20. What is a reason why an administrator would choose to implement an automated network management approach?
Answer: C. C. Reduce inconsistencies in the network configuration.
Network automation enforces standardized, repeatable configurations which directly reduces human error and configuration drift across devices. The other options describe negative outcomes or traditional manual approaches that automation specifically aims to eliminate.
Q21. What describes a northbound REST API for SDN?
Answer: C. C. application-facing interface for GET, POST, PUT, and DELETE methods
A northbound application programming interface is application-facing, allowing external programs to communicate with the controller using HTTP methods. Southbound interfaces face the network elements, eliminating the other options.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.