Practice for the CCNA exam with 22 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which type of address is shared by routers in a HSRP implementation and used by hosts on the subnet as their default gat. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- Which type of address is shared by routers in a HSRP implementation and used by hosts on the subnet as their…
- What is a function of a wireless LAN controller?
- An engineer must configure the IPv6 address 2001:0db8:0000:0000:0700:0003:400F:572B on the serial0/0 interfac…
- What is an enhancement implemented in WPA3?
- What is an advantage of using auto mode versus static mode for power allocation when an access point is conne…
- Which component of an Ethernet frame is used to notify a host that traffic is coming?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which type of address is shared by routers in a HSRP implementation and used by hosts on the subnet as their default gateway address?
Answer: B. B. virtual IP address
In HSRP, routers share a virtual IP address that hosts configure as their default gateway. This virtual IP remains active even if the primary router fails because the standby router seamlessly assumes the role.
Q2. What is a function of a wireless LAN controller?
Answer: C. C. manage and control lightweight access points using CAPWAP
A wireless LAN controller centrally manages and controls lightweight access points using the CAPWAP protocol. This centralized architecture allows the controller to push configuration and management policies down to the access points.
Q3. An engineer must configure the IPv6 address 2001:0db8:0000:0000:0700:0003:400F:572B on the serial0/0 interface of the HQ router and wants to compress it for easier configuration. Which command must be issued on the router interface?
Answer: A. A. ipv6 address 2001:db8::700:3:400F:572B
IPv6 compression rules allow you to omit leading zeros in any sixteen-bit block. Additionally, you can replace a single contiguous string of zero blocks with a double colons, which makes the first option the correct compressed notation.
Q4. What is an enhancement implemented in WPA3?
Answer: D. D. defends against deauthentication and disassociation attacks
WPA3 requires Protected Management Frames by default, which defends against deauthentication and disassociation attacks by cryptographically protecting wireless management frames. The other options describe standard WPA2 features or deprecated legacy protocols like TKIP.
Q5. What is an advantage of using auto mode versus static mode for power allocation when an access point is connected to a PoE switch port?
Answer: D. D. It detects the device is a powered device.
In auto mode, a PoE switch port automatically detects if the connected device is a powered device using standard resistance measurements before applying voltage. The other options describe unrelated physical layer characteristics, default configurations, or features that are not exclusive to auto mode.
Q6. Which component of an Ethernet frame is used to notify a host that traffic is coming?
Answer: C. C. preamble
The preamble synchronizes the receiving host's clock with the incoming bit stream, alerting it to an arriving frame. The start of frame delimiter marks the actual beginning of the frame, but the preamble provides the initial notification.
Q7. Which management security process is invoked when a user logs in to a network device using their username and password?
Answer: A. A. authentication
Authentication verifies the identity of a user during login using credentials like a username and password. Authorization determines what that verified user is allowed to do, while accounting tracks their actions.
Q8. Which switch concept is used to create separate broadcast domains?
Answer: C. C. VLAN
Virtual LANs logically segment a switch into separate broadcast domains to isolate traffic. Spanning Tree Protocol prevents loops, while VLAN Trunking Protocol manages configuration propagation.
Q9. An engineer must configure a WLAN using the strongest encryption type for WPA2-PSK. Which cipher fulfills the configuration requirement?
Answer: B. B. AES
Advanced Encryption Standard, or AES, provides the strongest confidentiality and integrity for WPA2 deployments. TKIP and RC4 are older, weaker legacy ciphers that are no longer recommended for secure networks.
Q10. What is the purpose of an ESSID?
Answer: A. A. It allows multiple access points to provide a common network for client connections.
An Extended Service Set Identifier allows multiple access points to advertise the same network name, creating a single logical wireless network. This enables clients to roam seamlessly across the coverage area.
Q11. A network engineer is configuring an IPv6 address on a router loopback interface. Which prefix length should be used for the loopback interface?
Answer: D. D. /128
An IPv6 loopback interface represents a single logical host, requiring a prefix length of 128. This mirrors the 32 bit host route convention used for IPv4 loopback configurations.
Q12. What does physical access control regulate?
Answer: A. A. access to networking equipment and facilities
Physical access control governs who can enter facilities and interact with networking hardware using mechanisms like locks or biometrics. It contrasts with logical controls that protect data on servers and networks.
Q13. What identifies the functionality of virtual machines?
Answer: C. C. The hypervisor virtualizes physical components including CPU, memory, and storage.
A hypervisor provides virtualization by abstracting physical hardware components like CPU, memory, and storage. This allows multiple isolated virtual machines to run efficiently on the same physical server.
Q14. Which QoS feature drops traffic that exceeds the committed access rate?
Answer: A. A. policing
Policing enforces a strict bandwidth threshold by immediately dropping or marking traffic that exceeds the defined rate limit. Shaping delays excess traffic by buffering it instead of dropping it outright.
Q15. Which command enables a router to become a DHCP client?
Answer: A. A. ip address dhcp
The command ip address dhcp is configured under an interface to enable that interface to obtain its IP address dynamically from a DHCP server. This effectively makes the router act as a DHCP client on that interface.
Q16. What is a network appliance that checks the state of a packet to determine whether the packet is legitimate?
Answer: D. D. firewall
A firewall, particularly a stateful firewall, examines the state of active connections to determine whether packets are part of a legitimate session. This process is known as stateful packet inspection and is a core firewall function.
Q17. An engineer is configuring router R1 with an IPv6 static route for prefix 2019:C15C:0CAF:E001::/64. The next hop must be 2019:C15C:0CAF:E002::1. The next hop is reachable via the R1 GigabitEthernet0/0 interface. Which command configures th…
Answer: D. D. R1(config)#ipv6 route 2019:C15C:0CAF:E001::/64 GigabitEthernet0/0 2019:C15C:0CAF:E002::1
IPv6 static routes are configured in global configuration mode using the ipv6 route command. When both an exit interface and next-hop address are specified, the router uses the interface to reach the next hop.
Q18. Which protocol is used to dynamically assign IP address configuration information to hosts?
Answer: C. C. DHCP
DHCP, or Dynamic Host Configuration Protocol, assigns IP configuration parameters dynamically via leases. This reduces manual configuration overhead and improves centralized management of IP address allocations.
Q19. Which channel-group mode must be configured when multiple distribution interfaces connected to a WLC are bundled?
Answer: D. D. Channel-group mode active.
Cisco Wireless LAN Controllers require Link Aggregation Control Protocol for bundled links. Configuring the distribution switch ports in channel-group mode active ensures they actively initiate LACP negotiation to properly form the EtherChannel.
Q20. When a site-to-site VPN is configured, which IPsec mode provides encapsulation and encryption of the entire original IP packet?
Answer: D. D. IPsec tunnel mode with ESP
IPsec tunnel mode with Encapsulating Security Payload encrypts and encapsulates the entire original IP packet, including the original header. A new IP header is added for routing between VPN endpoints, making it the standard for site-to-site VPNs.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.