Practice for the CCNA exam with 22 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: R1 has learned route 192.168.12.0/24 via OSPF, RIP, and Internal EIGRP. Under normal operating conditions, which routing. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- R1 has learned route 192.168.12.0/24 via OSPF, RIP, and Internal EIGRP. Under normal operating conditions, wh…
- Which authentication method requires the user to provide a physical attribute to authenticate successfully?
- What is a function of a firewall on an enterprise network?
- Which script paradigm does Puppet use?
- When deploying a new network that includes both Cisco and third-party network devices, which redundancy proto…
- What is a function performed by a web server?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. R1 has learned route 192.168.12.0/24 via OSPF, RIP, and Internal EIGRP. Under normal operating conditions, which routing protocol is installed in the routing table?
Answer: B. B. Internal EIGRP
When multiple routing protocols learn the same route, the router installs the route with the lowest administrative distance. Internal EIGRP has a default AD of 90, beating OSPF at 110 and RIP at 120.
Q2. Which authentication method requires the user to provide a physical attribute to authenticate successfully?
Answer: A. A. biometric
Biometric authentication requires a physical characteristic such as a fingerprint or retina scan. This represents the something you are authentication factor. Multifactor combines several methods rather than relying on a physical trait.
Q3. What is a function of a firewall on an enterprise network?
Answer: A. A. It allows and denies ingress and egress traffic.
A firewall enforces security policies by explicitly allowing or denying inbound and outbound traffic. Modern firewalls typically use stateful inspection, which eliminates the stateless option, and they do not act as default gateways.
Q4. Which script paradigm does Puppet use?
Answer: D. D. manifests and modules
Puppet relies on manifests and modules to enforce configuration state. You can eliminate Chef and Ansible traps, because they use cookbooks and playbooks respectively.
Q5. When deploying a new network that includes both Cisco and third-party network devices, which redundancy protocol avoids the interruption of network traffic if the default gateway router fails?
Answer: A. A. VRRP
VRRP is the open standard protocol that ensures traffic continues if the default gateway fails. You must eliminate HSRP and GLBP, because those are Cisco proprietary protocols.
Q6. What is a function performed by a web server?
Answer: D. D. provide an application that is transmitted over HTTP
A web server hosts and delivers web applications or content to clients using HTTP. The other options describe email, FTP, and authentication servers, which serve completely different primary purposes.
Q7. An engineer has configured the domain name, user name, and password on the local router. What is the next step to complete the configuration for a Secure Shell access RSA key?
Answer: B. B. crypto key generate rsa
The crypto key generate rsa command is used to generate the RSA key pair required for SSH on a Cisco device. SSH relies on these keys for encryption and secure remote access.
Q8. What condition commonly causes a switch port to enter the err-disabled state?
Answer: B. B. a port security violation
A port security violation places a port into an err-disabled state to protect the network. Avoid choosing shutdown, because an administrator issues that command rather than the switch.
Q9. Network security team noticed that an increasing number of employees are becoming victims of phishing attacks. Which security program should be implemented to mitigate the problem?
Answer: D. D. user awareness training
User awareness training directly addresses the human factor exploited in phishing attacks. Technical controls like software firewalls or email patches cannot fully mitigate a user willingly clicking a malicious link.
Q10. When an access point is seeking to join a wireless LAN controller, which message is sent to the AP-Manager interface?
Answer: A. A. Discovery response
When an access point attempts to join a controller, it first sends a CAPWAP discovery request. The controller then replies from its AP-manager interface with a discovery response.
Q11. How does STP prevent forwarding loops at OSI Layer 2?
Answer: D. D. Port blocking
Spanning Tree Protocol prevents Layer 2 loops by placing redundant switch ports into a blocking state. This ensures only one active forwarding path exists between network segments, preventing continuous frame circulation.
Q12. You have configured a router with an OSPF router ID, but its IP address still reflects the physical interface. Which action can you take to correct the problem in the least disruptive way?
Answer: A. A. Reload the OSPF process
The Open Shortest Path First process selects its router ID only when the process starts. Clearing the OSPF process forces it to restart and apply the new router ID with minimal network disruption.
Q13. Which type of traffic is sent with pure IPsec?
Answer: C. C. unicast messages from a host at a remote site to a server at headquarters
Pure IPsec operates at Layer 3 and is designed to encrypt unicast traffic between endpoints. It does not natively support broadcast or multicast traffic without additional encapsulation like GRE.
Q14. Why does a switch flood a frame to all ports?
Answer: B. B. The destination MAC address of the frame is unknown.
A switch floods unknown unicast frames when the destination MAC address is not in the MAC address table. An unknown source address triggers learning, not flooding, which eliminates that trap.
Q15. Which action protects a network from VLAN hopping attacks?
Answer: B. B. Change the native VLAN to an unused VLAN ID.
Changing the native VLAN to an unused ID mitigates double-tagging VLAN hopping attacks. Dynamic ARP inspection combats ARP spoofing, and ACLs do not inherently prevent this layer two exploit.
Q16. What is the temporary state that switch ports always enter immediately after the boot process when Rapid PVST+ is used?
Answer: D. D. discarding
Rapid PVST+ ports initially enter the discarding state to prevent loops during convergence. Listening is a legacy spanning-tree state, while learning only records MAC addresses before forwarding.
Q17. Which command gives the switch the best chance to become the root bridge for VLAN 200 in Rapid PVST+?
Answer: B. B. spanning-tree vlan 200 priority 0
Configuring the spanning-tree priority to zero forces the lowest bridge ID, maximizing the chance of becoming root. The root primary command is valid but dynamically sets a value, making zero the absolute lowest priority.
Q18. Which type of API allows SDN controllers to dynamically make changes to the network?
Answer: D. D. southbound API
Southbound APIs let the SDN controller communicate down to network devices to update forwarding tables. Northbound APIs handle communication between the controller and higher-level management applications.
Q19. What is a characteristic of a Layer 2 switch?
Answer: D. D. supports segmentation using tagging protocols
A Layer 2 switch supports logical network segmentation through VLANs using tagging protocols such as IEEE 802.1Q. Unlike hubs that create a single collision domain, switches provide dedicated bandwidth per port and separate broadcast domains.
Q20. Which technology allows for multiple operating systems to be run on a single host computer?
Answer: D. D. server virtualization
Server virtualization uses a hypervisor to enable multiple operating systems to run simultaneously on a single physical host. Each virtual machine operates independently while sharing the underlying hardware resources.
Q21. What is an Ansible inventory?
Answer: B. B. file that defines the target devices upon which commands and tasks are executed
An Ansible inventory is a file that defines the managed hosts and groups where tasks are executed. This list specifies target devices by IP address or hostname, ensuring playbooks apply to the correct infrastructure.
Q22. How does MAC learning function?
Answer: A. A. adds unknown source MAC addresses to the CAM table
MAC learning occurs when a switch examines the source MAC address of an incoming frame and adds it to the CAM table. This process maps the address to the ingress port, allowing the switch to forward future traffic efficiently.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.