Practice for the CCNA exam with 21 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which action is taken by a switch port enabled for PoE power classification override?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- Which action is taken by a switch port enabled for PoE power classification override?
- Which WLC management connection type is vulnerable to man-in-the-middle attacks?
- Which device performs stateful inspection of traffic?
- What is the function of off-the-shelf switches in a controller-based network?
- Which DSCP per-hop forwarding behavior is divided into subclasses based on drop probability?
- Which type of wireless encryption is used for WPA2 in preshared key mode?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which action is taken by a switch port enabled for PoE power classification override?
Answer: D. D. Should a monitored port exceed the maximum administrative value for power, the port is shut down and err-disabled
Power classification override monitors a port to protect the power budget. If a device exceeds the administrative maximum, the switch shuts down the port and places it in an err-disabled state.
Q2. Which WLC management connection type is vulnerable to man-in-the-middle attacks?
Answer: B. B. Telnet
Telnet transmits data and credentials in plaintext, leaving it vulnerable to man-in-the-middle attacks. Secure protocols like SSH and HTTPS provide encryption, while a local console connection bypasses the network entirely, eliminating this risk.
Q3. Which device performs stateful inspection of traffic?
Answer: B. B. firewall
A firewall performs stateful inspection by monitoring the active state of connections to make forwarding decisions. Standard switches, access points, and wireless controllers generally lack this deep traffic inspection capability.
Q4. What is the function of off-the-shelf switches in a controller-based network?
Answer: B. B. forwarding packets
In a controller based network, switches operate strictly in the data plane to forward packets based on rules from the controller. The controller itself manages the centralized view and policy decisions.
Q5. Which DSCP per-hop forwarding behavior is divided into subclasses based on drop probability?
Answer: C. C. assured
Assured Forwarding defines four classes, each with three drop precedence values. The other behaviors do not use subclasses to dictate drop probability.
Q6. Which type of wireless encryption is used for WPA2 in preshared key mode?
Answer: A. A. AES-128
WPA2 uses AES with CCMP for encryption. TKIP and RC4 are legacy protocols tied to the older WPA standard and are eliminated for modern WPA2 networks.
Q7. What is the role of community strings in SNMP operations?
Answer: D. D. It serves as a password to protect access to MIB objects.
In SNMP versions one and two, a community string functions as a plain text password. It restricts access to Management Information Base objects rather than handling Active Directory integration.
Q8. Which technology is used to improve web traffic performance by proxy caching?
Answer: A. A. WSA
The Cisco Web Security Appliance provides web proxy and caching functionality to improve traffic performance and enforce security policies. The other options are incorrect because Firepower, ASA, and FireSIGHT are primarily focused on firewalling and threat defense rather than proxy caching.
Q9. A network engineer is implementing a corporate SSID for WPA3-Personal security with a PSK. Which encryption cipher must be configured?
Answer: D. D. GCMP128
WPA3-Personal requires the GCMP128 encryption cipher to provide both data confidentiality and integrity in a single operation. The other options are incorrect because GCMP256 is for enterprise mode, while CCMP variations are associated with the older WPA2 standard.
Q10. Which component runs inside a virtual machine?
Answer: A. A. Guest operating system and applications
A virtual machine contains a guest operating system and its associated applications. These operate as if they were on a physical machine, using virtualized hardware provided by the host's hypervisor.
Q11. What is the MAC address used with VRRP as a virtual address?
Answer: B. B. 00-00-5E-00-01-0a
VRRP uses a reserved MAC address format to ensure proper Layer 2 communication. The correct format is 00-00-5E-00-01-XX, where the last two hexadecimal digits represent the VRRP group number. The only option matching this exact pattern is 00-00-5E-00-01-0a.
Q12. What is a similarity between 1000BASE-LX and 1000BASE-T standards?
Answer: A. A. Both use the same data-link header and trailer formats.
Both 1000BASE-LX and 1000BASE-T are Gigabit Ethernet standards operating at Layer 1, meaning they use identical Layer 2 Ethernet frame formats. Distractors can be eliminated because fiber standards do not use RJ-45 connectors and have different distance limitations.
Q13. Which type of encryption does WPA1 use for data protection?
Answer: B. B. TKIP
WPA1 uses Temporal Key Integrity Protocol to encrypt wireless data frames. AES is a newer encryption standard associated with WPA2 and WPA3, making it a distractor here.
Q14. Which function is performed by the collapsed core layer in a two-tier architecture?
Answer: A. A. enforcing routing policies
In a collapsed core architecture, the core and distribution layers merge to handle routing policies and inter-VLAN routing. Options describing access layer functions, like attaching users to the network edge, are incorrect.
Q15. Which encryption method is used by WPA3 to protect wireless data?
Answer: B. B. AES
Advanced Encryption Standard, or AES, is the encryption algorithm used by WPA3 to protect wireless data confidentiality. Simultaneous Authentication of Equivalents, or SAE, is the key exchange method, while TKIP is an obsolete WPA1 mechanism, ruling out those options.
Q16. Which cable type must be used to interconnect one switch using 1000BASE-SX GBIC modules and another switch using 1000BASE-SX SFP modules?
Answer: A. A. LC to SC
A 1000BASE-SX GBIC typically uses an SC fiber connector, while an SFP uses an LC connector. Interconnecting them requires a cable with matching physical connectors on each end.
Q17. Which cipher is supported for wireless encryption only with the WPA2 standard?
Answer: B. B. AES
WPA2 mandates the Advanced Encryption Standard, or AES, for strong wireless security. RC4 is an older legacy stream cipher associated with the obsolete WPA standard, which allows you to eliminate it immediately.
Q18. What is the maximum number of concurrent Telnet sessions that a Cisco WLC supports?
Answer: B. B. 5
Cisco Wireless LAN Controllers support a maximum of five concurrent Telnet sessions for remote CLI management. Understanding these platform management limitations is important when planning administrative access to network infrastructure devices.
Q19. An organization secures its network with multi-factor authentication using an authenticator app on employee smartphones. How is the application secured in the case of a user's smartphone being lost or stolen?
Answer: A. A. The application requires the user to enter a PIN before it provides the second factor
Authenticator apps typically require a local PIN or biometric lock before displaying time-based one-time passwords. This local security measure prevents a thief from easily accessing the second factor on a stolen device.
Q20. What value does a router use for the OSPF router ID if all routers in an area share the same priority and no loopback interface is configured?
Answer: C. C. the highest IP address among its active interfaces
Without a manual ID or loopback, OSPF selects the highest IP address among active physical interfaces. Priority values only determine designated router elections and do not influence the router ID selection.
Q21. Which function does an iterative DNS query serve in the domain name resolution process?
Answer: C. C. Allow a DNS client to contact several DNS servers until the correct information is found.
In an iterative query, the DNS resolver contacts a DNS server and receives a referral to another server. It then contacts additional servers sequentially until the correct information is obtained. This contrasts with recursive queries where the server does the work.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.