Practice for the CCNA exam with 23 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Refer to the exhibit. Which protocol should be permitted to provide secure VTY access to the router?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- Refer to the exhibit. Which protocol should be permitted to provide secure VTY access to the router?
- Refer to the exhibit. How does router R1 handle traffic to the 172.16.1.4/30 subnet?
- Refer to the exhibit. When router R1 is sending traffic to IP address 10.56.192.1, which interface or next ho…
- What is represented by the word "firewall" within this JSON schema?
- Refer to the exhibit. Which configuration parameter is preventing host С from reaching the internet?
- Refer to the exhibit. The DHCP server and clients are connected to the same switch. What is the next step to…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Refer to the exhibit. Which protocol should be permitted to provide secure VTY access to the router?
Answer: D. D. SSH
Secure Shell provides encrypted remote command-line access to virtual terminal lines. Telnet is eliminated because it sends data in clear text, creating a security vulnerability on the network.
Q2. Refer to the exhibit. How does router R1 handle traffic to the 172.16.1.4/30 subnet?
Answer: D. D. It load-balances traffic over 172.16.9.5 and 172.16.4.4
Equal-cost multipath routing allows a router to forward traffic across multiple paths with identical metrics. The router installs both EIGRP routes and actively load-balances the traffic rather than selecting a single primary path.
Q3. Refer to the exhibit. When router R1 is sending traffic to IP address 10.56.192.1, which interface or next hop address does it use to route the packet?
Answer: A. A. 10.56.0.1
Routers forward packets to the longest prefix match in the routing table, falling back to the default route if no specific match exists. Destination 10.56.192.1 falls outside the listed connected subnets, so the default route is the only valid path.
Q4. What is represented by the word "firewall" within this JSON schema?
Answer: B. B. key
In JSON syntax, a key is the name in a key-value pair that appears before the colon. In the entry { "firewall": "FW37", "port": "te23" }, the word "firewall" is the key that identifies the associated value.
Q5. Refer to the exhibit. Which configuration parameter is preventing host С from reaching the internet?
Answer: C. C. default gateway
A default gateway is essential for hosts to communicate outside their local subnet. The configured gateway address must exactly match the router interface IP, or external traffic will fail to route correctly.
Q6. Refer to the exhibit. The DHCP server and clients are connected to the same switch. What is the next step to complete the DHCP configuration to allow clients on VLAN 1 to receive addresses from the DHCP server?
Answer: C. C. Configure ip dhcp snooping trust command on the interface that is connected to the DHCP server.
When DHCP snooping is enabled, all switch ports are untrusted by default and will drop DHCP server responses. You must explicitly configure the port connected to the legitimate DHCP server as trusted using the ip dhcp snooping trust command.
Q7. Refer to the exhibit. A static route must be configured on R86 to forward traffic for the 172.16.34.0/29 network, which resides on R14. Which command must be used to fulfill the request?
Answer: B. B. ip route 172.16.34.0 255.255.255.248 10.73.65.65
A static route requires the destination network prefix, its subnet mask, and the next-hop IP address. The correct command uses the /29 mask and points to the next hop, while the distractors use wildcard masks or point to the destination itself.
Q8. Refer to the exhibit. Web traffic is coming in from the WAN interface. Which route takes precedence when the router is processing traffic destined for the LAN network at 10.0.10.0/24?
Answer: A. A. via next-hop 10.0.1.5
When multiple routing protocols provide routes with identical prefix lengths, the router selects the route with the lowest administrative distance. Internal EIGRP has a lower administrative distance than OSPF, making the EIGRP route the preferred path.
Q9. Refer to the exhibit. Router R1 currently is configured to use R3 as the primary route to the internet, and the route uses the default administrative distance settings. A network engineer must configure R1 so that it uses R2 as a backup, b…
Answer: B. B. ip route 0.0.0.0 0.0.0.0 209.165.200.230 6
A floating static route is created by assigning an administrative distance higher than the primary route. Setting the backup default route to an administrative distance of 6 ensures the primary route with the default distance of 1 remains active until it fails.
Q10. Refer to the exhibit. When router R1 receives a packet with destination IP address 10.56.0.62, through which interface does it route the packet?
Answer: A. A. Vlan58
The router uses the longest prefix match to determine the correct exit interface for a destination IP. The destination address falls within the range of the directly connected route, making its interface the chosen forwarding path.
Q11. Refer to the exhibit. How many objects are present in the given JSON-encoded data?
Answer: C. C. Seven
In JSON, curly braces define an object. Counting the root object and all nested attributes equals seven. Arrays are enclosed in square brackets and do not count as objects, eliminating the distractors.
Q12. Refer to the exhibit. Router OldR is replacing another router on the network with the intention of having OldR and R2 exchange routes. After the engineer applied the initial OSPF configuration, the routes were still missing on both devices…
Answer: D. OldR(config-router)#no router-id 192.168.1.1
Neighbors must have unique router IDs to form adjacencies. Removing the duplicate router ID allows the clearing process to assign a unique ID, whereas mismatched intervals prevent adjacencies entirely.
Q13. Refer to the exhibit. What administrative distance has the route to 192.168.10.1?
Answer: B. B. 90
The first number inside the brackets of a routing table entry is the administrative distance. Because the letter D indicates EIGRP and shows a distance of ninety, the correct value is ninety.
Q14. Refer to the exhibit. A network administrator is configuring a router for user access via SSH. The service-password encryption command has been issued. The configuration must meet these requirements: • Create the username as CCUser. • Crea…
Answer: C. C. username CCUser secret NA!2$cc
The command username CCUser secret stores the password using a secure one-way cryptographic hash. The service password-encryption command only applies weak Type 7 reversible encryption, so using the secret keyword is required to properly protect local user credentials.
Q15. Refer to the exhibit. What is represented beginning with line 1 and ending with line 5?
Answer: D. D. array
A JSON structure that begins with an opening square bracket and ends with a closing square bracket defines an array. While the array in this scenario contains multiple enclosed objects, the overall structure wrapping those items is classified as an array.
Q16. Refer to the exhibit. Which configuration must be applied to the router that configures PAT to translate all addresses in VLAN 200 while allowing devices on VLAN 100 to use their own IP addresses?
Answer: A. A.
Port address translation requires matching only the specific internal subnet that needs translation in the access control list. Allowing the entire class C subnet would accidentally translate the wrong virtual local area network, so restricting the wildcard mask to the specific block is required.
Q17. Refer to the exhibit. { "Cisco Devices": [ { "name": "ASA – Security Device" }, { "name": "Cisco 1100 ASR Router" }, { "name": "Cisco 6800 Switch" } ] } What is missing from this output for it to be executed?
Answer: D. D. curly braket ( } ) at the end
Valid JavaScript Object Notation requires balanced enclosing brackets to define an object. Because the configuration begins with an opening curly brace, adding the final closing curly brace at the end of the file completes the required structure for proper parsing.
Q18. Refer to the exhibit. Router R1 is connected to a shared network 10.0.20.0/24 with routers R2 and R3. R3 has a LAN network 10.0.15.0/24 connected behind it. Router R1 is already configured with its directly connected networks, but traffic…
Answer: D. D. ip route 10.0.15.0 255.255.255.0 10.0.20.3
A static route requires the exact destination subnet and a valid next-hop IP address. The correct route targets the 10.0.15.0/24 LAN via R3's shared interface IP, eliminating options with incorrect masks or unreachable next-hops.
Q19. Refer to the exhibit. An administrator configures four switches for local authentication using passwords that are stored as a cryptographic hash. The four switches must also support SSH access for administrators to manage the network infra…
Answer: C. C. SW3
Secure local authentication requires creating accounts with the secret command to store passwords as hashes. Applying login local under VTY lines enforces this database for remote access, whereas basic password commands leave credentials in clear text.
Q20. Refer to the exhibit. Which switch becomes the root bridge?
Answer: A. A. SW 1 – Bridge Priority – 8192 – mac-address 00:10:a1:30:eb:38
Spanning Tree Protocol selects the root bridge using the lowest bridge ID, evaluating priority first and MAC address second. Switch one wins the tiebreaker over switch two because its MAC address is numerically lower.
Q21. What is represented by the word "switch" within this JSON schema?
Answer: A. A. key
JSON structures data as key-value pairs where the left element identifies the attribute name. Therefore, the word functions as a key, while the right side holds the value assigned to that specific data field.
Q22. Refer to the exhibit. The IPv6 address for the LAN segment on router R2 must be configured using the EUI-64 format. Which address must be used?
Answer: A. A. ipv6 address 2001:DB8:D8D2:1009::/64 eui-64
EUI-64 configuration requires providing only the network prefix, allowing the router to auto-generate the host identifier. The router modifies the interface MAC by inserting FFFE and flipping the seventh bit, making the full address command unnecessary.
Q23. Refer to the exhibit. Which network prefix was learned via EIGRP?
Answer: D. D. 192.168.2.0/24
Routing tables indicate EIGRP-learned routes with the letter D, representing Diffusing Update Algorithm, alongside the default administrative distance of 90. This distinct protocol tag separates dynamically learned EIGRP prefixes from connected or statically defined routes.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.