Practice for the CCNA exam with 22 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: An engineer must configure a core router with a floating static default route to the backup router at 10.200.0.2. Which . Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- An engineer must configure a core router with a floating static default route to the backup router at 10.200…
- A network engineer is configuring a switch so that it is remotely reachable via SSH. The engineer has already…
- What is a function of a northbound API?
- Which addressing range is reserved for APIPA when DHCP fails on a Windows host?
- How does WPA3 improve security?
- A switch is forwarding a frame out of all interfaces except the interface that received the frame. What is th…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. An engineer must configure a core router with a floating static default route to the backup router at 10.200.0.2. Which command meets the requirements?
Answer: B. B. ip route 0.0.0.0 0.0.0.0 10.200.0.2 10
A floating static route is created by specifying an administrative distance higher than the default. Setting the distance to ten ensures this backup route is only installed in the routing table if the primary link fails.
Q2. A network engineer is configuring a switch so that it is remotely reachable via SSH. The engineer has already configured the host name on the router. Which additional command must the engineer configure before entering the command to gener…
Answer: C. C. ip domain-name domain
Generating RSA keys for SSH requires the device to have both a hostname and an IP domain name configured. These two values are combined to create a fully qualified domain name that serves as the basis for the cryptographic key pair.
Q3. What is a function of a northbound API?
Answer: D. D. It provides a path between an SDN controller and network applications.
A northbound API provides a communication interface between an SDN controller and upper-level network applications. It enables applications to request network services and program network behavior via the centralized controller.
Q4. Which addressing range is reserved for APIPA when DHCP fails on a Windows host?
Answer: A. A. 169.254.0.0/16
Automatic Private IP Addressing uses the sixteen bit block starting at sixteen nine dot two five four to self-assign an IP address. This happens automatically when a Windows host fails to receive a lease from a DHCP server.
Q5. How does WPA3 improve security?
Answer: A. A. It uses SAE for authentication.
WPA3 uses Simultaneous Authentication of Equals for authentication, which provides perfect forward secrecy and protects against offline dictionary attacks. RC4 and TKIP are deprecated legacy encryption protocols, while the four-way handshake is a vulnerable characteristic of WPA2.
Q6. A switch is forwarding a frame out of all interfaces except the interface that received the frame. What is the technical term for this process?
Answer: C. C. flooding
Flooding is the process where a switch forwards a frame out all active ports except the receiving interface when the destination MAC address is unknown. ARP and CDP are separate protocols for address resolution and neighbor discovery, while multicast targets specific subscribed groups.
Q7. Which protocol does a REST API use to communicate?
Answer: D. D. HTTP
REST APIs use HTTP as the underlying communication protocol to interact with web resources using standard methods like GET and POST. SSH, STP, and SNMP are incorrect because they handle remote management, loop prevention, and network monitoring rather than API data transfers.
Q8. In software-defined architectures, which plane is distributed and responsible for traffic forwarding?
Answer: C. C. data plane
In software-defined architectures, the data plane is distributed across network devices and is responsible for forwarding traffic. It handles the actual movement of packets between interfaces, applying policies computed by the centralized control plane.
Q9. When a client and server are not on the same physical network, which device is used to forward requests and replies between client and server for DHCP?
Answer: B. B. DHCP relay agent
A DHCP relay agent forwards broadcast messages from clients on one subnet to a server on another. Because broadcasts do not cross routers by default, the relay agent converts them to unicast, ensuring proper communication between separated clients and servers.
Q10. Which protocol prevents Layer 2 loops by placing some switch ports into a blocking state?
Answer: C. C. STP
Spanning Tree Protocol, or STP, prevents Layer 2 loops by placing redundant switch ports into a blocking state. Discovery protocols like LLDP and CDP only map neighbors, while NTP simply synchronizes the clock.
Q11. Which set of methods is supported with the REST API?
Answer: C. C. GET, PUT, POST, DELETE
Standard HTTP methods used by REST APIs include GET, PUT, POST, and DELETE. The other options invent nonexistent HTTP verbs like ERASE or CHANGE, which do not map to standard CRUD operations.
Q12. When the active router in a VRRP group fails, which router assumes the role and forwards packets?
Answer: C. C. backup
VRRP uses the terms master and backup. When the master router fails, the backup router takes over and starts forwarding packets. HSRP uses active and standby, so eliminate those terms.
Q13. A network administrator plans an update to the Wi-Fi networks in multiple branch offices. Each location is configured with the same SSID called "Office." The administrator wants every user who connects to the SSID at any location to receiv…
Answer: D. D. authentication and authorization policies
Consistent authentication and authorization policies ensure that users receive identical access levels regardless of the branch office they connect from. Radio policies and profile names handle local射频 configurations and interface mappings, not the centralized access rules.
Q14. Which type does a port become when it receives the best BPDU on a bridge?
Answer: D. D. The root port
A port becomes the root port when a non-root bridge receives the best, or lowest-cost, BPDU from the root bridge. Designated ports send the best BPDUs downstream, while alternate ports offer backup paths, ruling out those alternatives.
Q15. What is a difference between an IPv6 multicast address and an IPv6 anycast address?
Answer: B. B. A packet sent to an IPv6 multicast address is delivered to one or more destinations at once, but a packet sent to an IPv6 anycast address is routed to the closest interface with that address.
An IPv6 multicast packet is delivered to all interfaces that belong to a specific multicast group. An anycast address, on the other hand, is shared by multiple nodes, but routing delivers the packet only to the topologically closest interface.
Q16. Which plane is centralized by an SDN controller?
Answer: D. D. control-plane
Software-defined networking separates the control plane from the data plane. The SDN controller centralizes forwarding decisions and pushes them to the network devices, which only handle the actual data forwarding.
Q17. Which command automatically generates an IPv6 address from a specified IPv6 prefix and MAC address of an interface?
Answer: B. B. ipv6 address 2001:DB8:5:112::/64 eui-64
Adding the EUI-64 keyword to an IPv6 address command tells the router to derive the host identifier from its MAC address. Stateful protocols like DHCP handle IPv4 configurations.
Q18. Which command prevents passwords from being stored in the configuration as plain text on a router or switch?
Answer: C. C. service password-encryption
The global command service password-encryption obfuscates all clear-text passwords in the running configuration. The enable secret command only secures privileged exec access.
Q19. Which IPv6 address type uses the prefix FE80::/10?
Answer: A. A. Link-local
IPv6 link-local addresses use the FE80 colon colon slash ten prefix for local on-link communication like neighbor discovery. Global unicast and unique local addresses are routable, while multicast uses the FF00 prefix.
Q20. Which command must be entered so that the default gateway is automatically distributed when DHCP is configured on a router?
Answer: B. B. default-router
The default-router command inside a DHCP pool specifies the default gateway address provided to DHCP clients. The default-gateway command is a trap because it is used on end devices, not DHCP servers.
Q21. Which HTTP method is most commonly associated with the REST 'read' operation?
Answer: B. B. GET
The GET method retrieves a representation of a resource without modifying it, aligning with the REST read operation. Other methods like POST or PUT involve creating or modifying data, effectively eliminating them.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.