Practice for the CCNA exam with 22 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: An on-site service desk technician must verify the IP address and DNS server information on a user's Windows computer. W. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- An on-site service desk technician must verify the IP address and DNS server information on a user's Windows…
- Which characteristic differentiates the concept of authentication from authorization and accounting?
- Which JSON data type is an unordered set of attribute-value pairs?
- A router has two static routes to the same destination network, each with a different next-hop address. If bo…
- A network engineer must configure an access list on a new Cisco IOS router. The access list must deny HTTP tr…
- What is the primary purpose of a First Hop Redundancy Protocol?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. An on-site service desk technician must verify the IP address and DNS server information on a user's Windows computer. Which command must the technician enter at the command prompt on the user's computer?
Answer: B. B. ipconfig /all
The ipconfig command with the all switch displays full IP configuration details, including DNS servers, on Windows. Show interface and ifconfig are used on Cisco devices and Linux respectively, not Windows.
Q2. Which characteristic differentiates the concept of authentication from authorization and accounting?
Answer: B. B. identity verification
Authentication validates user identity. Authorization, accounting, and other concepts like logging or billing are related but distinct. Eliminate options focused on permissions, tracking, or billing to select the proper verification mechanism.
Q3. Which JSON data type is an unordered set of attribute-value pairs?
Answer: D. D. object
A JSON object consists of an unordered collection of attribute-value pairs enclosed in curly braces. Arrays are ordered, strings represent text, and Booleans represent truth values.
Q4. A router has two static routes to the same destination network, each with a different next-hop address. If both routes have the same administrative distance and metric, how will the router forward packets?
Answer: D. D. The router load-balances traffic over all routes to the destination.
When a router installs multiple routes to the same destination with identical administrative distances and metrics, it performs equal-cost load balancing across the available paths. The router does not select a path based on arbitrary criteria like the oldest age or lowest IP address.
Q5. A network engineer must configure an access list on a new Cisco IOS router. The access list must deny HTTP traffic to network 10.125.128.32/27 from the 192.168.240.0/20 network, but it must allow the 192.168.240.0/20 network to reach the r…
Answer: B. B. ip access-list extended deny_outbound 10 deny tcp 192.168.240.0 0.0.15.255 10.125.128.32 0.0.0.31 eq 80 20 permit ip 192.168.240.0 0.0.15.255 10.0.0.0 0.255.255.255 30 deny ip any any log
Extended access lists must be ordered from most specific to least specific to prevent unwanted traffic from being permitted. Option B correctly denies port 80 traffic first, allows the broader network range, applies accurate wildcard masks, and uses an implicit deny rule.
Q6. What is the primary purpose of a First Hop Redundancy Protocol?
Answer: D. D. It reduces routing failures by allowing more than one router to represent itself as the default gateway of a network
First Hop Redundancy Protocols provide default gateway resilience by allowing multiple physical routers to share a single virtual IP and MAC address. If the active router fails, the standby takes over seamlessly, eliminating single points of failure.
Q7. If a switch port receives a new frame while it is actively transmitting a previous frame, how does it process the frames?
Answer: C. C. The new frame is placed in a queue for transmission after the previous frame
Switch ports use memory buffers to hold outbound frames in a queue. If a frame arrives while the port is busy transmitting, the switch stores the new frame temporarily instead of dropping it, sending it once the current transmission finishes.
Q8. Which 802.11 management frame type is sent when a client roams between access points on the same SSID?
Answer: A. A. Reassociation Request
A wireless client sends a Reassociation Request frame when moving to a new access point within the same extended service set. Standard association frames are only for initial connections, whereas reassociation specifically handles the roaming transition.
Q9. What is a function of TFTP in network operations?
Answer: A. A. transfers IOS images from a server to a router for firmware upgrades
Trivial File Transfer Protocol is commonly used to transfer IOS images and configuration files without requiring authentication. Options mentioning passwords or local file system transfers are incorrect because TFTP relies on simple UDP file transfers.
Q10. Which role does a hypervisor provide for each virtual machine in server virtualization?
Answer: C. C. control and distribution of physical resources
A hypervisor provides control and distribution of physical resources like CPU and memory to virtual machines. Software as a service and infrastructure as a service refer to cloud computing delivery models, not hypervisor functions.
Q11. Which QoS profile is selected in the GUI when configuring a voice over WLAN deployment?
Answer: A. A. Platinum
The Platinum QoS profile is used for voice traffic in Cisco wireless deployments to ensure strict prioritization. Bronze, silver, and gold profiles are intended for lower priority background traffic or standard data applications.
Q12. Which type of hypervisor operates without an underlying OS to host virtual machines?
Answer: A. A. Type 1
A Type 1 hypervisor, also known as a bare-metal hypervisor, runs directly on the host's hardware to manage virtual machines. Type 2 hypervisors require a host operating system, making them incorrect.
Q13. A network engineer is installing an IPv6-only capable device. The client has requested that the device IP address be reachable only from the internal network. Which type of IPv6 address must the engineer assign?
Answer: B. B. unique local address
A unique local address is intended for internal communication and is not routed on the public internet. Link-local addresses are also internal but cannot route across subnets, making unique local the correct choice.
Q14. What is a characteristic of RSA?
Answer: B. B. It is a public-key cryptosystem.
RSA is a public-key cryptosystem that uses a pair of keys for encryption and decryption. The other options describe symmetric algorithms like preshared or private keys, which require identical keys on both sides.
Q15. Which type of security program is violated when a group of employees enters a building using the ID badge of only one person?
Answer: C. C. physical access control
Physical access control manages and restricts entry to physical locations like buildings or server rooms. Sharing an ID badge violates individual accountability and defeats the authentication mechanisms at the door.
Q16. Which port state processes BPDUs, but does not forward packets or update the address database in Rapid PVST+?
Answer: A. A. blocking
Rapid PVST+ uses the blocking or discarding state to process BPDUs without forwarding data or learning MAC addresses. Listening is a legacy STP state, while learning updates the MAC table.
Q17. An engineer is configuring a switch port that is connected to a VoIP handset. Which command must the engineer configure to enable port security with a manually assigned MAC address of abcd.abcd.abcd on voice VLAN 4?
Answer: A. A. switchport port-security mac-address abcd.abcd.abcd
Port security is applied per interface rather than per VLAN. If a voice VLAN is configured, the switch automatically separates voice and data traffic. You simply specify the MAC address in the command without a VLAN keyword.
Q18. What is one reason to implement LAG on a Cisco WLC?
Answer: C. C. to provide link redundancy and load balancing
Link Aggregation on a Wireless LAN Controller bundles multiple physical interfaces into one logical path. This provides redundancy and load balancing. If one link fails, traffic continues over the remaining active links.
Q19. When the LAG configuration is updated on a Cisco WLC, which additional task must be performed when changes are complete?
Answer: A. A. Reboot the WLC.
Modifying Link Aggregation changes how the controller internally bundles its interfaces. The system must reboot to properly initialize the new architecture. No manual MAC flushing or access point reassociation is required.
Q20. What is a characteristic of private IPv4 addressing?
Answer: C. C. provides an added level of protection against internet threats
Private IPv4 addresses are not routable across the public internet. This non-routability provides inherent isolation and an added layer of protection against external threats. Private addresses do not inherently provide secure encrypted connectivity.
Q21. A network administrator enabled port security on a switch interface connected to a printer. What is the next configuration action in order to allow the port to learn the MAC address of the printer and insert it into the table automatically?
Answer: C. C. enable sticky MAC addressing
Sticky MAC addressing allows a switch port to dynamically learn a MAC address and automatically save it to the running configuration. This secures the port without the administrative overhead of manually configuring static addresses.
Q22. Which statement about VLAN configuration is true?
Answer: B. B. The switch must be in config-vlan mode before you configure an extended VLAN
Extended VLANs are configured in config-vlan mode. Eliminate the other options because VTP mode restrictions and storage locations have specific limits that the distractors misstate.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.