Practice for the CCNA exam with 23 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which command can you enter to determine the addresses that have been assigned on a DHCP server?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- Which command can you enter to determine the addresses that have been assigned on a DHCP server?
- Which command can you enter to allow Telnet to be supported in addition to SSH?
- Which port-security violation mode drops traffic from unknown MAC addresses and forwards an SNMP trap?
- When a WPA2-PSK WLAN is configured in the Wireless LAN Controller, what is the minimum number of characters r…
- What is the root port in STP?
- Which feature or protocol is required for an IP SLA to measure UDP jitter?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which command can you enter to determine the addresses that have been assigned on a DHCP server?
Answer: C. show ip dhcp binding
The show IP DHCP binding command displays the active DHCP bindings, including assigned IP addresses, client MAC addresses, and lease expirations. Use the pool command to view configured ranges rather than active leases.
Q2. Which command can you enter to allow Telnet to be supported in addition to SSH?
Answer: A. transport input telnet ssh
Under VTY line configuration mode, the transport input telnet ssh command explicitly permits both protocols for remote management. If you only specify Telnet, the router will drop SSH sessions, violating the requirement.
Q3. Which port-security violation mode drops traffic from unknown MAC addresses and forwards an SNMP trap?
Answer: C. restrict
Port security restrict mode drops unauthorized traffic while generating log messages and SNMP traps. Protect mode drops traffic silently without sending traps, and shutdown mode immediately disables the interface.
Q4. When a WPA2-PSK WLAN is configured in the Wireless LAN Controller, what is the minimum number of characters required in ASCII format?
Answer: B. 8
Wi-Fi Protected Access version two requires a pre-shared key of at least eight ASCII characters. Anything shorter will be rejected by the wireless controller configuration, establishing the minimum secure baseline.
Q5. What is the root port in STP?
Answer: D. It is the port on a switch with the lowest cost to reach the root bridge.
In Spanning Tree Protocol, the root port is the interface on a non-root switch with the lowest cumulative path cost to the root bridge. Options mentioning the highest priority or ports on the root bridge itself describe designated ports instead.
Q6. Which feature or protocol is required for an IP SLA to measure UDP jitter?
Answer: D. IP SLA responder
Measuring UDP jitter requires an IP SLA responder enabled on the destination device to timestamp packets and return them. Protocols like Cisco Discovery Protocol and LLDP are for neighbor discovery, not active network monitoring.
Q7. In which situation is private IPv4 addressing appropriate for a new subnet on the network of an organization?
Answer: C. There is limited unique address space, and traffic on the new subnet will stay local within the organization.
Private IPv4 addressing is appropriate when unique public address space is limited and traffic remains internal to the organization. Options involving internet routing or external transit typically require unique public addresses or careful NAT traversal to function correctly.
Q8. What is the function of the controller in a software-defined network?
Answer: C. determining network paths and programming forwarding behavior
An SDN controller centralizes the control plane by determining network paths and programming forwarding behaviors on devices. It does not physically forward packets, as the actual data plane hardware handles the packet movement across the network.
Q9. What does the implementation of a first-hop redundancy protocol protect against on a network?
Answer: A. default gateway failure
First Hop Redundancy Protocols protect against default gateway failures by allowing multiple routers to share a virtual IP address. If the active router fails, a standby router takes over, preventing Layer 3 connectivity loss without requiring host reconfiguration.
Q10. Which STP states are bypassed when PortFast is enabled on a switch port?
Answer: C. listening and learning
Enabling PortFast bypasses the listening and learning states, causing the port to transition immediately to forwarding. This feature is intended for access ports connected to end hosts to prevent DHCP timeout issues during the spanning tree convergence process.
Q11. Why is TCP desired over UDP for applications that require extensive error checking, such as HTTPS?
Answer: D. UDP operates without acknowledgments, while TCP uses acknowledgments to ensure reliable delivery
TCP uses acknowledgments, sequencing, and retransmissions to ensure reliable, ordered data delivery for applications requiring extensive error checking. UDP is a connectionless protocol that operates without these reliability mechanisms, dropping packets under heavy load.
Q12. Which API is used in controller-based architectures to interact with edge devices?
Answer: A. southbound
Southbound APIs are used to communicate between the SDN controller and the network infrastructure devices in the data plane. Northbound APIs are used for the controller to communicate with upper-level applications and management programs instead.
Q13. Which port type does a lightweight AP use to connect to the wired network when configured in FlexConnect mode with local switching and VLAN tagging?
Answer: A. trunk
FlexConnect local switching with VLAN tagging requires an 802.1Q trunk port on the switch to carry multiple tagged VLANs. The access, LAG, and EtherChannel options are incorrect because a standard access port only carries a single untagged VLAN.
Q14. Which configuration management mechanism uses TCP port 22 by default when communicating with managed nodes?
Answer: A. Ansible
Ansible uses SSH, which operates over TCP port 22 by default, to communicate with managed nodes. It is agentless, making port 22 the standard transport for its operations. Puppet and Chef use agents that typically communicate over ports 8140 and 443.
Q15. By default, which virtual MAC address does HSRP group 14 use?
Answer: D. 00:00:0c:07:ac:0e
HSRP version 1 uses a virtual MAC address format of 0000.0c07.acXX, where XX represents the group number in hexadecimal. Group 14 in decimal converts to 0e in hexadecimal. The distractors either use the wrong OUI or fail to convert the group number properly.
Q16. How does Rapid PVST+ create a fast loop-free network topology?
Answer: D. It generates one spanning-tree instance for each VLAN.
Rapid PVST+ generates one spanning-tree instance for each VLAN. This allows faster convergence and supports load balancing across multiple links while maintaining a loop-free Layer 2 topology. The other options are incorrect because they either violate loop prevention or describe MST features.
Q17. An engineer requires a switch interface to actively attempt to establish a trunk link with a neighbor switch. What command must be configured?
Answer: B. switchport mode dynamic desirable
The switchport mode dynamic desirable command enables Dynamic Trunking Protocol and actively attempts to negotiate trunk formation with the neighboring switch. The dynamic auto mode is a trap because it only passively waits for the neighbor to initiate the negotiation.
Q18. Under which condition is TCP preferred over UDP?
Answer: C. TCP is used when data reliability is critical, and UDP is used when missing packets are acceptable.
TCP is preferred when data reliability is critical, using acknowledgments and retransmissions to ensure guaranteed delivery. UDP is used when occasional packet loss is acceptable, such as in voice or video streaming. The distractors incorrectly associate low latency or dropped data with TCP.
Q19. What is a characteristic of frame switching?
Answer: C. stores and forwards frames in a buffer and uses error checking
Store-and-forward switching receives the entire frame, stores it in a buffer, performs error checking like verifying the Frame Check Sequence, and then forwards it if valid. The trap options misrepresent switching behavior, as switches dynamically learn MACs and never rewrite them.
Q20. Which set of actions satisfy the requirement for multifactor authentication?
Answer: C. The user enters a user name and password, and then clicks a notification in an authentication app on a mobile device.
Multifactor authentication requires combining two different factors, such as something you know and something you have. Using a password plus a mobile authenticator app notification fits this rule, while merely re-entering credentials does not.
Q21. You are configuring your edge router's interface with a public IP address for Internet connectivity. The router needs to obtain the IP address from the service provider dynamically. Which command is needed on interface FastEthernet 0/0 to…
Answer: D. ip address dhcp
The ip address dhcp command allows a router interface to obtain an IP address dynamically from a service provider. The other options configure static routing or default gateways, which do not dynamically acquire an IP address.
Q22. In software-defined architecture, which plane handles switching for traffic through a Cisco router?
Answer: B. data
The data plane, also known as the forwarding plane, handles the actual switching and forwarding of traffic through a network device. The control plane builds the routing tables, but the data plane executes the forwarding decisions.
Q23. What is the difference between RADIUS and TACACS+?
Answer: B. TACACS+ separates authentication, authorization, and accounting, while RADIUS combines authentication and authorization.
TACACS plus separates authentication, authorization, and accounting into independent processes for granular control. RADIUS combines authentication and authorization, and it only encrypts the password, unlike TACACS plus which encrypts the entire payload.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.