Practice for the CCNA exam with 21 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: What is a characteristic of encryption in wireless networks?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- What benefit does controller-based networking provide versus traditional networking?
- How does traditional campus device management differ from Cisco DNA Center device management in regards to de…
- What is a requirement for nonoverlapping Wi-Fi channels?
- How does encryption protect the wireless network?
- What is the primary purpose of a console port on a Cisco WLC?
- Which definition describes JWT in regard to REST API security?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. What benefit does controller-based networking provide versus traditional networking?
Answer: A. A. allows configuration and monitoring of the network from one centralized point
Controller-based networking centralizes network management by separating the control plane from the data plane. This provides a single point of configuration and monitoring, which is the primary advantage over traditional distributed management.
Q2. How does traditional campus device management differ from Cisco DNA Center device management in regards to deployment?
Answer: B. B. Cisco DNA Center device management can deploy a network more quickly than traditional campus device management.
Cisco DNA Center uses automated provisioning to push configurations to multiple devices simultaneously from a central dashboard. Traditional management requires manual, device-by-device command-line configuration, making deployments much slower and more prone to human error.
Q3. What is a requirement for nonoverlapping Wi-Fi channels?
Answer: B. B. discontinuous frequency ranges
Nonoverlapping Wi-Fi channels must use discontinuous frequency ranges that do not share overlapping spectrum. In the 2.4 GHz band, for example, channels 1, 6, and 11 are spaced far enough apart to prevent frequency overlap.
Q4. How does encryption protect the wireless network?
Answer: B. B. via an algorithm to change wireless data so that only the access point and client understand it
Encryption protects wireless communications by applying cryptographic algorithms to transform plaintext data into ciphertext. Only authorized devices, such as the access point and authenticated client, can decrypt and understand the transmitted information.
Q5. What is the primary purpose of a console port on a Cisco WLC?
Answer: C. C. out-of-band management via an asynchronous transport
A console port provides out-of-band management access through an asynchronous serial connection. Options mentioning in-band or IP transport confuse console access with network management interfaces like SSH or HTTPS.
Q6. Which definition describes JWT in regard to REST API security?
Answer: C. C. an encoded JSON token that is used to securely exchange information
A JSON Web Token is an encoded token used to securely exchange information between parties. The token is digitally signed for integrity, but it is not encrypted by default, making the encrypted options incorrect.
Q7. What is the function of FTP?
Answer: D. D. Uses two separate connections for control and data traffic
File Transfer Protocol operates using two distinct TCP connections for control traffic and data transfer. Options referencing UDP port 69 are describing TFTP, which uses a simpler, connectionless architecture.
Q8. How are the switches in a spine-and-leaf topology interconnected?
Answer: B. B. Each leaf switch is connected to each spine switch.
A spine-and-leaf topology requires every leaf switch to connect to every spine switch. This fabric design provides equal-cost multipath routing and predictable latency. Options describing partial or central connections describe legacy designs.
Q9. What is used as a solution for protecting an individual network endpoint from attack?
Answer: A. A. antivirus software
Antivirus software is installed directly on endpoints to detect and remove malicious code. Network devices like routers and wireless controllers secure the broader network rather than the individual host.
Q10. Which selections must be used on the WLC when implementing a RADIUS server for wireless authentication?
Answer: C. C. AAA Override and the IP address of the server
Configuring a RADIUS server on a WLC requires the server IP address. AAA Override is optional for dynamic VLAN assignment but not mandatory for basic authentication, making this choice slightly ambiguous.
Q11. How does IPsec provide secure networking for applications within an organization?
Answer: C. C. It enables sets of security associations between peers.
IPsec establishes secure communication through the creation of Security Associations between peers. These associations define the cryptographic parameters and protocols used to protect traffic. FTP and TFTP are separate application layer protocols, while GRE provides tunneling without native encryption.
Q12. An engineer must configure interswitch VLAN communication between a Cisco switch and a third-party switch. Which action should be taken?
Answer: B. B. configure IEEE 802.1q
IEEE 802.1Q is the industry-standard trunking protocol used to tag frames for multiple VLANs across a single link. Because the connection involves a third-party switch, a standards-based protocol is required. Cisco's proprietary Inter-Switch Link, or ISL, is unsupported by other vendors.
Q13. Which value is the unique identifier that an access point uses to establish and maintain wireless connectivity to wireless network devices?
Answer: B. B. SSID
The Service Set Identifier, or SSID, is the unique logical name assigned to a wireless network that clients use to associate with an access point. VLAN and WLAN IDs map traffic logically, while RFID tracks physical assets, eliminating those distractors.
Q14. Which design element is a best practice when deploying an 802.11b wireless infrastructure?
Answer: A. A. allocating nonoverlapping channels to access points that are in close physical proximity to one another
Allocating non-overlapping channels to nearby access points reduces adjacent-channel interference and is a fundamental deployment best practice. Disabling TCP or restricting maximum data rates are invalid configuration concepts, directly eliminating those options.
Q15. What is the default port-security behavior on a trunk link? Correct answer
Answer: A. A. It places the port in the err-disabled state if it learns more than one MAC address.
Port security defaults to restricting a trunk link to a single MAC address and will place the port in err-disabled state upon violation. Because a trunk requires multiple addresses, you must manually raise the maximum allowed limit.
Q16. Which configuration most likely ensures that the switch becomes the root bridge for VLAN 750?
Answer: B. B. Switch(config)#spanning-tree vlan 750 priority 0
Setting the STP priority to zero forces the switch to have the lowest possible bridge ID, making it the root bridge. While the root primary command also works, a priority of zero provides an absolute guarantee against other switches.
Q17. Which goal is achieved by the implementation of private IPv4 addressing on a network?
Answer: A. A. provides an added level of protection against Internet exposure
Private IPv4 addresses are not routable on the public internet. This inherently shields internal hosts from direct external exposure, reducing attack vectors.
Q18. Which step immediately follows receipt of the EAP success message when session resumption is disabled for an EAP-TLS connection?
Answer: B. B. four-way handshake
After an EAP success message, an access point and client establish encryption keys using a four-way handshake. Disabling session resumption prevents fast roaming, forcing a full authentication before this key exchange.
Q19. How do TCP and UDP differ in the way that they establish a connection between two endpoints?
Answer: A. A. TCP uses the three-way handshake, and UDP does not guarantee message delivery.
TCP establishes a connection using a three-way handshake before data transfer. UDP is a connectionless protocol that simply sends packets without any handshake or delivery guarantee.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.