Practice for the CCNA exam with 23 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which NAT address type represents the public IP address used to represent an internal host after translation?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- Which NAT address type represents the public IP address used to represent an internal host after translation?
- Which security program element involves installing badge readers on data-center doors to allow workers to ent…
- On a corporate network, hosts on the same VLAN can communicate with each other, but they are unable to commun…
- How does a Layer 2 switch forward frames for known unicast destinations?
- Which WPA mode uses PSK authenticaton?
- Which command enables HTTPS access to the Cisco WLC?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which NAT address type represents the public IP address used to represent an internal host after translation?
Answer: C. C. inside global
Inside global represents the public IP address used to represent an internal host after translation. Inside local refers to the private address before translation, helping you eliminate related distractors.
Q2. Which security program element involves installing badge readers on data-center doors to allow workers to enter and exit based on their job roles?
Answer: A. A. physical access control
Physical access control restricts facility entry using measures like badge readers. Role-based access control strictly governs logical network permissions, not physical door entry, eliminating that distractor.
Q3. On a corporate network, hosts on the same VLAN can communicate with each other, but they are unable to communicate with hosts on different VLANs. What is required to allow communication between VLANs?
Answer: A. A. a Layer 3 device to perform inter-VLAN routing
Inter-VLAN routing requires a Layer 3 device, such as a router or multilayer switch, to forward traffic between separate subnets. Trunk links merely pass VLAN traffic; they do not route between them.
Q4. How does a Layer 2 switch forward frames for known unicast destinations?
Answer: C. C. forwards frames only out the port associated with the destination MAC address
A Layer 2 switch forwards known unicast frames only out the specific port mapped to the destination MAC address. It floods unknown unicast frames out all active access and trunk ports instead.
Q5. Which WPA mode uses PSK authenticaton?
Answer: B. B. Personal
WPA Personal mode, also known as WPA-PSK, uses a Pre-Shared Key for authentication. WPA Enterprise uses a RADIUS server, which distinguishes it from the Personal mode required by the prompt.
Q6. Which command enables HTTPS access to the Cisco WLC?
Answer: B. B. config network secureweb enable
The command config network secureweb enable activates HTTPS access on a Cisco Wireless LAN Controller. The other commands either enable insecure protocols like Telnet or handle unrelated certificate generation.
Q7. Which CRUD operation modifies an existing table or view?
Answer: B. B. update
The Update operation modifies existing data within a table or view. Create inserts new records, while Read retrieves them, making Update the standard choice for editing existing database entries.
Q8. Which technology prevents client devices from arbitrarily connecting to the network without state remediation?
Answer: B. B. 802.1x
IEEE 802.1X provides port-based network access control, requiring authentication before granting access. It integrates with RADIUS servers to enforce posture checks, blocking noncompliant devices from connecting.
Q9. In QoS, which prioritization method is appropriate for interactive voice and video?
Answer: C. C. low-latency queuing
Low-Latency Queuing provides strict priority scheduling for delay-sensitive interactive voice and video. Expedited forwarding is a marking behavior, not a scheduling mechanism, making Low-Latency Queuing the operational configuration.
Q10. Which command creates a static NAT binding for a PC address of 10.1.1.1 to the public routable address 209.165.200.225 assigned to the PC?
Answer: A. A. R1(config)#ip nat inside source static 10.1.1.1 209.165.200.225
The command for static NAT maps the inside local address to the inside global address. The correct syntax places the private address first, followed by the public address, eliminating the outside source distractors.
Q11. An administrator must secure the WLC from receiving spoofed association requests. Which steps must be taken to configure the WLC to restrict the requests and force the user to wait 10 ms to retry an association request?
Answer: D. D. Enable the Protected Management Frame service and set the Comeback timer to 10.
Protected Management Frames, or PMF, prevents spoofing of wireless association requests. Enabling this service activates the Comeback timer, which forces clients to wait a specified interval before retrying an association request.
Q12. What is the role of SNMP in the network?
Answer: A. A. to monitor and manage network devices using a UDP underlay that operates on the application layer
Simple Network Management Protocol operates at the application layer to monitor and manage network devices. It relies on UDP as its transport protocol, ruling out the TCP, SSL, and SSH distractors.
Q13. Which physical component is distributed among multiple virtual machines running on the same hypervisor?
Answer: D. D. hardware resources
A hypervisor abstracts physical hardware resources like CPU and memory, distributing them among multiple virtual machines. This resource sharing is the foundational concept of virtualization.
Q14. What is a benefit of a point-to-point leased line?
Answer: C. C. simplicity of configuration
A point-to-point leased line offers simplicity of configuration because it provides a direct, dedicated connection between two endpoints. This removes complex multipoint routing considerations, though costs are typically higher.
Q15. A router running EIGRP has learned the same route from two different paths. Which parameter does the router use to select the best path?
Answer: C. C. metric
When multiple routes are learned through the same routing protocol, the router uses the metric to select the best path. Administrative distance is the tie-breaker only when the same route is learned from two entirely different routing protocols.
Q16. Which benefit does Cisco DNA Center provide over traditional campus management?
Answer: C. C. Cisco DNA Center leverages APIs, and traditional campus management requires manual data gathering.
Cisco DNA Center provides programmability and automation through REST-based application programming interfaces. Traditional campus management relies heavily on manual command-line configuration and fragmented data collection, which the platform streamlines.
Q17. You have two paths for the 10.10.10.0 network: one that has a feasible distance of 3072 and the other of 6144. What do you need to do to load balance your EIGRP routes?
Answer: C. C. Configure EIGRP variance to 2
EIGRP uses the variance command to support unequal-cost load balancing. By configuring a variance of two, the router multiplies the best metric, allowing feasible successors with metrics up to that higher threshold to be installed in the routing table.
Q18. By default, how does EIGRP determine the metric of a route for the routing table?
Answer: A. A. It uses the bandwidth and delay values of the path to calculate the route metric.
By default, EIGRP calculates its composite metric using the minimum bandwidth and cumulative delay along the path. Other K-values that incorporate reliability and load are disabled by default, isolating bandwidth and delay as the primary factors.
Q19. What occurs when PortFast is enabled on an interface that is connected to another switch?
Answer: D. D. Spanning-tree fails to detect a switching loop increasing the likelihood of broadcast storms.
Enabling PortFast on a switch-to-switch link causes the port to bypass listening and learning states and immediately transition to forwarding. This bypasses normal spanning-tree protections, which increases the risk of catastrophic broadcast storms.
Q20. An engineer must update the configuration on two PCs in two different subnets to communicate locally with each other. One PC is configured with IP address 192.168.25.128/25 and the other with 192.168.25.100/25. Which network mask must the…
Answer: C. C. 255.255.255.0
Applying a 24-bit mask places both IP addresses in the same local subnet. Without a router routing traffic between subnets, hosts must share an identical subnet mask to communicate directly.
Q21. Which device protects an internal network from the Internet?
Answer: B. B. firewall
A firewall enforces security policies by inspecting and filtering traffic between trusted and untrusted networks. While routers can use access control lists, dedicated firewalls are designed specifically to protect internal networks from internet threats.
Q22. Which 802.11 frame type is Association Response?
Answer: A. A. management
The Association Response frame is defined as a management frame in the IEEE 802.11 standard. Management frames handle establishing and maintaining wireless communication, whereas control frames assist with delivery and data frames carry traffic.
Q23. Which per-hop traffic-control feature does an ISP implement to mitigate the potential negative effects of a customer exceeding its committed bandwidth?
Answer: A. A. policing
Traffic policing is typically implemented by an ISP at the network edge to enforce a customer's committed information rate. When traffic exceeds the contracted bandwidth, policing drops or remarks excess packets immediately.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.