Practice for the CCNA exam with 21 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which feature or protocol determines whether the QoS on the network is sufficient to support IP services?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- Which feature or protocol determines whether the QoS on the network is sufficient to support IP services?
- What is a link-local all-nodes IPv6 multicast address?
- How does MAC learning function?
- Which interface mode must be configured to connect the lightweight APs in a centralized WLAN architecture?
- A network administrator must configure SSH for remote access to router R1. The requirement is to use a public…
- Which type of IPv4 address must be assigned to a server to protect it from external access and allow only int…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which feature or protocol determines whether the QoS on the network is sufficient to support IP services?
Answer: C. C. IP SLA
IP SLA actively measures network performance metrics such as latency, jitter, and packet loss to validate quality of service for real-time applications. The other options are discovery or automation protocols that do not test traffic performance.
Q2. What is a link-local all-nodes IPv6 multicast address?
Answer: A. A. ff02:0:0:0:0:0:0:1
The link-local all-nodes IPv6 multicast address is ff02::1, fully written as ff02:0:0:0:0:0:0:1. The ff00 prefix denotes multicast, and the 02 specifies link-local scope.
Q3. How does MAC learning function?
Answer: D. D. adds unknown source MAC addresses to the CAM table
MAC learning happens when a switch examines the source MAC address of an incoming frame and records it in the CAM table. Switches do not rewrite MAC addresses or drop them simply for being unknown.
Q4. Which interface mode must be configured to connect the lightweight APs in a centralized WLAN architecture?
Answer: B. B. trunk
A lightweight access point typically requires a trunk port to carry multiple VLANs like management and user traffic locally. A controller connection is an access port, which makes centralized wording tricky.
Q5. A network administrator must configure SSH for remote access to router R1. The requirement is to use a public and private key pair to encrypt management traffic to and from the connecting client. Which configuration, when applied, meets th…
Answer: D. R1(config)# crypto key generate rsa modulus 1024
The crypto key generate rsa command creates the public and private key pair required for SSH encryption. The modulus keyword specifies the key size in bits, making this the correct configuration step for secure remote management.
Q6. Which type of IPv4 address must be assigned to a server to protect it from external access and allow only internal users access while restricting internet access?
Answer: A. A. private
Private IPv4 addresses are not routable on the public internet. Assigning a private IP address to a server restricts direct external access and limits communication to internal networks unless network address translation is configured.
Q7. Which WPA3 enhancement protects against hackers viewing traffic on the Wi-Fi network?
Answer: A. A. SAE encryption
WPA3 uses Simultaneous Authentication of Equals for its authentication and key exchange process. This protocol provides forward secrecy, meaning previously captured traffic cannot be decrypted even if the network password is compromised later.
Q8. A network engineer must create a diagram of a multivendor network. Which command must be configured on the Cisco devices so that the topology of the network is allowed to be mapped?
Answer: A. A. Device(config)#lldp run
Link Layer Discovery Protocol is an IEEE standard designed to operate seamlessly across equipment from various vendors. Cisco Discovery Protocol is a trap here because it only discovers directly connected Cisco hardware.
Q9. Why choose Cisco DNA Center for automated lifecycle management?
Answer: D. D. to provide fast and accurate deployment of patches and updates
Cisco DNA Center provides centralized, software defined lifecycle automation that rapidly deploys patches and updates across the infrastructure. The goal of this enterprise controller is policy enforcement and orchestration, rather than basic management redundancy.
Q10. An engineer needs to add an old switch back into a network. To prevent the switch from corrupting the VLAN database, which action must be taken?
Answer: A. A. Add the switch in the VTP domain with a lower revision number.
VLAN Trunking Protocol uses configuration revision numbers to push the most recent VLAN database across the domain. Resetting the old switch to a lower revision number ensures it cannot accidentally overwrite the production network configuration.
Q11. Which AP mode is used for capturing wireless traffic and forwarding that traffic to a PC that is running a packet analyzer?
Answer: D. D. sniffer
Sniffer mode configures an access point to capture wireless frames and forward them to a packet analyzer like Wireshark. Monitor mode only listens for rogue devices, while sniffer mode is used for deep troubleshooting.
Q12. How do servers connect to the network in a virtual environment?
Answer: D. D. a software switch on a hypervisor that is physically connected to the network
Virtual machines connect to the network through a software-based virtual switch running on the hypervisor. The hypervisor's physical network interface cards provide the uplink to the physical network infrastructure.
Q13. What does a switch use to build its MAC address table?
Answer: C. C. ingress traffic
Switches dynamically build their MAC address tables by examining the source MAC address of incoming frames on ingress ports. VTP and DTP are trunk negotiation protocols that do not populate MAC tables, while egress traffic exits the interface.
Q14. Which wireless security standard is generally considered the strongest among the options?
Answer: D. D. WPA3
WPA3 is the strongest wireless security standard available because it mandates modern protections like Simultaneous Authentication of Equals. Older protocols like WEP, WPA, and WPA2 contain known cryptographic vulnerabilities and have been deprecated.
Q15. What is the difference between 1000BASE-LX/LH and 1000BASE-ZX interfaces?
Answer: D. D. 1000BASE- LX/LH is supported on links up to 10km, and 1000Base-ZX operates over links up to 70 km
1000BASE-LX/LH supports distances up to 10 kilometers over single-mode fiber. 1000BASE-ZX operates over much longer distances, typically up to 70 kilometers. The conditioning patch cable mentioned in a distractor is only for LX multimode.
Q16. Which option about JSON is true?
Answer: B. B. used to describe structured data that includes arrays
JSON is a lightweight format used to describe structured data, including arrays and key-value pairs. XML uses the predefined tags mentioned in the distractors, and JSON is actually less verbose than XML.
Q17. What is a function of an endpoint on a network?
Answer: C. C. allows users to record data and transmit to a file server
Endpoints like workstations allow users to generate data and transmit it to network servers. Switches and access points provide infrastructure connectivity, which eliminates the other networking device roles.
Q18. A network engineer notices that two OSPF neighbors are connected using a crossover Ethernet cable. The neighbors are taking too long to become fully adjacent. Which command must be issued under the interface configuration on each router to…
Answer: D. D. ip ospf network point-to-point
Configuring an interface as point-to-point eliminates the DR and BDR election process on OSPF broadcast networks. Removing this election overhead accelerates adjacency formation between two directly connected routers.
Q19. What must a network administrator consider when deciding whether to configure a new wireless network with APs in autonomous mode or APs running in cloud-based mode?
Answer: A. A. Autonomous mode APs are less dependent on an underlay but more complex to maintain than APs in cloud-based mode.
Autonomous access points are less dependent on an underlay because they operate independently, but they are harder to maintain individually. Distractors misrepresent cloud management complexity or automation capabilities.
Q20. Which protocol uses SSL?
Answer: B. B. HTTPS
HTTPS uses SSL or TLS to encrypt HTTP web traffic between clients and servers. SSH, Telnet, standard HTTP, and other protocols do not use SSL for encryption.
Q21. An engineer is configuring SSH access to a router from the 10.139.58.0/28 subnet. Which configuration correctly permits this traffic on the destination router? A. interface FastEthernet0/0 ip address 10.122.49.2 255.255.255.252 ip access-g…
Answer: A. A.
An extended ACL must match the source network using the correct wildcard mask and destination port. Option A correctly applies the inbound access group and specifies the exact protocol and subnet.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.