Practice for the CCNA exam with 23 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: How does Chef configuration management enforce a required device configuration?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- How does Chef configuration management enforce a required device configuration?
- Which protocol is used for secure remote CLI access?
- Which protocol prompts the Wireless LAN Controller to generate its own local web administration SSL certifica…
- When a floating static route is configured, which action ensures that the backup route is used when the prima…
- Which IPv6 interface configuration creates a Unique Local Address that is routable within the organization bu…
- Which Spanning Tree feature allows an access port connected to an end host to move immediately to the forward…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. How does Chef configuration management enforce a required device configuration?
Answer: B. The installed agent on the device connects to the Chef Infra Server and pulls its required configuration from the cookbook.
Chef uses a pull-based model where an installed agent on the device connects to the central server to retrieve its configuration. This is a key distinction from push-based automation tools, as the client initiates the configuration request.
Q2. Which protocol is used for secure remote CLI access?
Answer: D. SSH
Secure Shell provides encrypted remote command-line access to network devices. Telnet sends traffic in cleartext, and HTTP or HTTPS are used for web-based graphical interfaces, so they can be eliminated.
Q3. Which protocol prompts the Wireless LAN Controller to generate its own local web administration SSL certificate for GUI access?
Answer: B. HTTPS
Enabling HTTPS prompts a Wireless LAN Controller to generate a local self-signed SSL certificate for secure graphical access. HTTP lacks encryption, while RADIUS and TACACS+ handle authentication rather than web certificates.
Q4. When a floating static route is configured, which action ensures that the backup route is used when the primary route fails?
Answer: D. The floating static route must have a higher administrative distance than the primary route so it is used as a backup
A floating static route is assigned a higher administrative distance than the primary route so it stays inactive until the primary fails. This ensures the backup path only installs when the preferred path disappears.
Q5. Which IPv6 interface configuration creates a Unique Local Address that is routable within the organization but not on the public Internet?
Answer: B. interface vlan 2000 ipv6 address fd00::1234:2343/64
IPv6 Unique Local Addresses use the FD00::/8 prefix for locally assigned addresses and are not routable on the public Internet. The FE80::/10 range is for link-local communication, while FF00::/8 designates multicast traffic.
Q6. Which Spanning Tree feature allows an access port connected to an end host to move immediately to the forwarding state?
Answer: B. PortFast
PortFast allows an access port to bypass the listening and learning states and transition directly to forwarding. The other features are loop prevention mechanisms. BPDU Guard, Root Guard, and Loop Guard restrict or block ports rather than speeding up their transition.
Q7. Which protocol is used to securely access a Cisco device for remote management?
Answer: B. SSH
Secure Shell encrypts the management session, protecting credentials and command output. It is the preferred secure remote access method for network devices. Telnet and TFTP send data in cleartext, exposing sensitive information to interception.
Q8. A DHCP pool named NOCC has already been created and configured with the network 192.168.20.0/24. The pool must use the next-to-last usable IP address as the default gateway for DHCP clients. Which command should be configured next?
Answer: C. default-router 192.168.20.253
In a slash twenty-four network, the last usable address is two fifty-four, making the next-to-last usable address two fifty-three. The default-router command configures the gateway distributed to DHCP clients. The ip default-gateway command is only used on the local device.
Q9. What is the purpose of the ip address dhcp command?
Answer: B. to configure an interface as a DHCP client
The IP address DHCP command is configured under an interface and instructs that interface to obtain its IP address dynamically from a DHCP server. Helper and relay commands are incorrect because they forward client requests rather than requesting an address for the router itself.
Q10. What is the primary effect of the spanning-tree portfast command?
Answer: B. It immediately puts the port into the forwarding state when the link comes up.
The spanning-tree portfast command causes an access port to transition immediately to the forwarding state when the link becomes active, bypassing the listening and learning states. This affects only the local port and does not speed up spanning-tree recalculations across the network.
Q11. Which access layer threat-mitigation technique provides security based on identity?
Answer: C. 802.1x
IEEE 802.1X provides port-based network access control and authenticates users or devices before granting network access. The other options are incorrect because they mitigate Layer 2 spoofing or VLAN hopping rather than enforcing identity-based security.
Q12. On Windows workstations configured for automatic IP addressing, which protocol provides the default gateway information?
Answer: B. DHCP
Dynamic Host Configuration Protocol provides IP configuration information to Windows workstations, including the IP address, subnet mask, default gateway, and DNS server addresses. The other options are incorrect because they handle routing, monitoring, or name resolution rather than dynamic address assignment.
Q13. What is a characteristic of RSA?
Answer: B. It is an asymmetric encryption algorithm.
RSA is an asymmetric encryption algorithm that uses a pair of keys, allowing secure communication without sharing a secret key in advance. The other options are incorrect because they describe symmetric encryption, which requires both sides to share an identical secret key.
Q14. Which SDN plane is responsible for forwarding user traffic through the network?
Answer: C. Data plane
The data plane is responsible for actually forwarding user traffic based on MAC and IP routing tables. Remember that the control plane makes the decisions, but the data plane performs the actual work of moving the packets.
Q15. What is a characteristic of a Layer 2 switch?
Answer: D. makes forwarding decisions based on MAC addresses
A Layer 2 switch makes forwarding decisions based on destination MAC addresses. Each switch port represents a separate collision domain, and communication between different VLANs requires routing, disproving the single broadcast domain distractor.
Q16. Which QoS queuing method discards or marks packets that exceed the desired bit rate of traffic flow?
Answer: B. policing
Policing enforces a configured traffic rate by dropping or marking packets that exceed the defined bit rate. Shaping delays excess traffic using queues, while CBWFQ and LLQ manage active queue scheduling.
Q17. A DHCP pool has been created with the name CONTROL. The pool uses the next to last usable IP address as the default gateway for the DHCP clients. The server is located at 172.16.32.15. What is the next step in the process for clients on th…
Answer: A. ip helper-address 172.16.32.15
A router interface requires the IP helper address command to forward DHCP broadcast requests to a server on a different subnet. Configuring a default gateway or forward protocol does not directly relay DHCP DISCOVER messages across broadcast domains.
Q18. How does MAC learning function on a switch?
Answer: A. associates the MAC address with the port on which it is received
MAC learning occurs when a switch examines the source MAC address of an incoming frame and associates it with the ingress port. Switches do not rewrite MAC addresses during learning, nor do they use ARP requests to populate the CAM table.
Q19. A port security violation has occurred on a switch port due to the maximum MAC address count being exceeded. Which command must be configured to increment the security-violation count and forward an SNMP trap?
Answer: C. switchport port-security violation restrict
The restrict violation mode drops unauthorized traffic while incrementing the violation counter and sending SNMP traps. Protect mode drops frames silently without incrementing the counter, while shutdown mode immediately error disables the interface.
Q20. Which interface IP address is used as the source of CAPWAP packets between a Cisco WLC and an access point?
Answer: C. management interface
The management interface on a Cisco wireless LAN controller is the default source IP address for CAPWAP packets exchanged with access points. The other options are either not valid WLC interfaces or do not handle CAPWAP tunnel termination.
Q21. Which command should you enter to verify the priority of a router in an HSRP group?
Answer: D. show standby
The show standby command displays HSRP group details, including the configured priority, active state, and virtual IP address. Show sessions displays management connections, and show interfaces does not provide first hop redundancy protocol states.
Q22. What does traffic shaping do?
Answer: A. It queues excess traffic
Traffic shaping regulates outbound bandwidth by buffering excess packets in a queue to smooth out traffic bursts. This is different from marking or organizing packets, and it avoids dropping packets like policing does.
Q23. Where does the configuration reside when a helper address is configured to support DHCP?
Answer: B. on the router closest to the client
The IP helper address must be configured on the router interface connected to the client to forward local broadcast requests. The router then forwards these packets as unicast to the remote server.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.