Practice for the CCNA exam with 23 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which communication interaction takes place when a southbound API is used?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA 2026 practice test →
What you will practice
- Which communication interaction takes place when a southbound API is used?
- An application in the network is being scaled up from 300 servers to 600. Each server requires 3 network conn…
- Which type of attack is mitigated by dynamic ARP inspection?
- Which remote access protocol provides unsecured remote CLI access?
- What is the path for traffic sent from one user workstation to another workstation on a separate switch in a…
- Which protocol uses TCP port 22 by default?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which communication interaction takes place when a southbound API is used?
Answer: B. B. between the SDN controller and switches and routers on the network
A southbound application programming interface facilitates communication between the control plane and infrastructure devices like switches and routers. Northbound APIs handle communication between the controller and applications, easily eliminating those distractors.
Q2. An application in the network is being scaled up from 300 servers to 600. Each server requires 3 network connections to support production, backup, and management traffic. Each connection resides on a different subnet. The router configura…
Answer: B. B. ip address 10.10.10.1 255.255.252.0
The subnet mask 255.255.252.0 provides 1022 usable host addresses, making it the smallest available block that supports 600 hosts. Exam rules dictate choosing the smallest subnet that meets host requirements to strictly limit wasted IP address space.
Q3. Which type of attack is mitigated by dynamic ARP inspection?
Answer: C. C. man-in-the-middle
Dynamic ARP inspection mitigates man-in-the-middle attacks by validating ARP packets against a trusted DHCP snooping binding table. Distractors like DDoS or worms operate at different network layers, making man-in-the-middle the only correct target for Layer 2 ARP spoofing.
Q4. Which remote access protocol provides unsecured remote CLI access?
Answer: B. B. Telnet
Telnet provides remote command-line access but transmits all data in clear text, making it an unsecured protocol. SSH provides encrypted access, while console connections are physical and Bash is a local shell rather than a remote protocol.
Q5. What is the path for traffic sent from one user workstation to another workstation on a separate switch in a three-tier architecture model?
Answer: D. D. access → distribution → core → distribution → access
In a three-tier campus design, traffic moves from the access layer to the distribution layer, crosses the core, and routes back down the remote distribution and access layers. The hierarchical structure requires this path when traversing separate switch blocks.
Q6. Which protocol uses TCP port 22 by default?
Answer: D. D. SSH
Secure Shell uses TCP port 22 by default to provide encrypted remote management access. Telnet uses port 23, while HTTP and HTTPS use ports 80 and 443 respectively, making SSH the clear match.
Q7. What is the difference in data transmission delivery and reliability between TCP and UDP?
Answer: B. B. TCP requires the connection to be established before transmitting data. UDP transmits data at a higher rate without ensuring packet delivery.
TCP is a connection-oriented protocol requiring a handshake to provide reliable data delivery. UDP is connectionless and sacrifices delivery guarantees for lower overhead and faster transmission.
Q8. Which CRUD operation corresponds to the HTTP GET method?
Answer: B. B. read
The HTTP GET method retrieves data without modifying it, corresponding directly to the Read operation in CRUD. The Create, Update, and Delete operations map to HTTP POST, PUT, PATCH, or DELETE methods.
Q9. Which SNMP message type is reliable and precedes an acknowledgment response from the SNMP manager?
Answer: B. B. Inform
SNMP Inform messages require an acknowledgment from the manager to confirm delivery. Traps are asynchronous notifications sent without expecting a response.
Q10. When a switch receives a frame for a known destination MAC address, how is the frame handled?
Answer: C. C. sent to the port identified for the known MAC address
A switch forwards frames directly to the port associated with the known destination MAC address. Unknown unicast frames are flooded out all active ports except the receiving port.
Q11. Which NAT feature allows multiple inside hosts to share a single public IPv4 address by using unique TCP/UDP ports?
Answer: D. D. PAT
Port Address Translation maps multiple inside local addresses to a single inside global address using unique Layer 4 port numbers. Static and dynamic NAT map one-to-one without sharing ports, so they fail this requirement.
Q12. What is a characteristic of encryption in wireless networks?
Answer: C. C. uses protocols such as TKIP and CCMP to secure data
Wireless networks use cryptographic protocols like Temporal Key Integrity Protocol and Counter Mode CBC-MAC Protocol to secure data transmissions. Encryption specifically provides confidentiality, whereas integrity is handled by separate mechanisms like MIC checks.
Q13. Which device permits or denies network traffic based on a set of rules?
Answer: B. B. firewall
A firewall enforces network security by explicitly permitting or denying traffic based on configured rule sets. While switches and controllers direct traffic, they rely on standard forwarding logic rather than strict security policies.
Q14. Where is the interface between the control plane and data plane within the software-defined architecture?
Answer: D. D. control layer and the infrastructure layer
In software-defined networking, the southbound interface connects the control layer to the infrastructure layer. This boundary defines where centralized controllers push forwarding instructions down to distributed data plane hardware.
Q15. How does HSRP provide first hop redundancy?
Answer: B. B. It uses a shared virtual MAC and a virtual IP address to a group of routers that serve as the default gateway for hosts on a LAN.
Hot Standby Router Protocol provides first hop redundancy by sharing a virtual IP and MAC address among multiple routers. Hosts use this virtual gateway seamlessly, ignoring whether the active or standby router currently handles forwarding.
Q16. Which unified access point mode continues to serve wireless clients after losing connectivity to the Cisco Wireless LAN Controller?
Answer: C. C. flexconnect
FlexConnect allows an access point to locally switch client traffic if it loses connectivity to the WLC. This enables continued wireless service in branch deployments even if the WAN link to the controller fails.
Q17. Which global command encrypts all passwords in the running configuration?
Answer: A. A. service password-encryption
The global command service password-encryption encrypts all plaintext passwords in the running configuration, including line passwords. This provides a basic level of protection against casual viewing of weakly stored credentials.
Q18. Which cable type must be used when connecting a router and switch together using these criteria? Pins 1 and 2 are receivers and pins 3 and 6 are transmitters. Auto detection MDI-X is unavailable.
Answer: D. D. straight-through
A straight-through cable maintains the same pinout on both ends and connects unlike devices such as a router to a switch. Because one device transmits on pins one and two while the other receives, no crossover is required.
Q19. Which Layer 2 switch function encapsulates packets for different VLANs so that the packets traverse the same port and maintain traffic separation between the VLANs?
Answer: D. D. VLAN tagging
VLAN tagging, specifically using IEEE 802.1Q, inserts a tag into the Ethernet frame to identify the VLAN. This allows multiple VLANs to traverse the same physical trunk port while strictly maintaining traffic separation.
Q20. A network architect is deciding whether to implement Cisco autonomous access points or lightweight access points. Which fact about firmware updates must the architect consider?
Answer: B. B. Unlike autonomous access points, lightweight access points require a WLC to implement remote firmware updates.
Lightweight access points depend on a Wireless LAN Controller to receive and manage firmware updates. The controller distributes the appropriate image to associated access points, whereas autonomous APs are upgraded individually.
Q21. A packet from a company's branch office is destined to host 172.31.0.1 at headquarters. The sending router has three possible matches in its routing table for the packet: prefixes 172.31.0.0/16, 172.31.0.0/24, and 172.31.0.0/25. How does t…
Answer: C. C. It sends the traffic via prefix 172.31.0.0/25.
Routers use the longest prefix match rule to select the most specific route in the routing table. The /25 prefix has the longest subnet mask, making it the preferred path over the /16 and /24 routes, as it represents the most exact destination network.
Q22. An engineer needs to configure LLDP to send the port description type length value (TLV). Which command sequence must be implemented?
Answer: D. D. switch(config)#lldp port-description
Link Layer Discovery Protocol TLV advertisement settings, such as sending the port description, are configured globally. The correct command must be executed in global configuration mode, which eliminates the interface and line configuration modes as valid options.
Q23. Which protocol is used in Software Defined Access (SDA) to provide a tunnel between two edge nodes in different fabrics?
Answer: C. C. Virtual Extensible LAN (VXLAN)
Virtual Extensible Local Area Network, or VXLAN, is the data-plane encapsulation protocol used in Software-Defined Access to create overlay networks. VXLAN encapsulates Layer 2 frames inside UDP packets, providing scalable segmentation across the fabric.
More CCNA 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.