Practice for the CCNA exam with 23 multiple-choice questions. Answer each question before the reveal, then review the explanation to understand the reasoning.
This is Part 8/8 in the CertPunch CCNA practice exam series.
Topics covered: switching, routing, subnetting, access control lists, wireless, security fundamentals, and network troubleshooting.
More practice: certpunch.com
What you will practice
- Refer to the exhibit. Which address and mask combination represents a summary of the routes learned by EIGRP?
- What is the purpose of the client to make an IEEE 802.1X authentication request?
- Which two statements about IPv6 and routing protocols are true? (Choose two.)
- Which of the following would you use if you want to filter packets for management interfaces?
- Refer to the exhibit. What set of commands was configured on interface Fa0/3 to produce the given output?
- A network administrator wants to add a line to an access list that will block only Telnet access by the hosts…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Refer to the exhibit. Which address and mask combination represents a summary of the routes learned by EIGRP?
Answer: A. 192.168.25.16 255.255.255.240
The correct summary covers the 192.168.25.16/28 block. The distractor uses a network address that doesn't align with the route boundaries.
Q2. What is the purpose of the client to make an IEEE 802.1X authentication request?
Answer: B. * To connect to LAN
The request grants LAN access. The distractors describe other IEEE standards' functions.
Q3. Which two statements about IPv6 and routing protocols are true? (Choose two.)
Answer: A,B. OSPFv3 was developed to support IPv6 routing. || Link-local addresses are used to form routing adjacencies.
OSPFv3 supports IPv6. Link-local addresses are used for routing protocol adjacencies.
Q4. Which of the following would you use if you want to filter packets for management interfaces?
Answer: E. * Apply ACL to ""CPU Access Control Lists
The correct answer proves the use of CPU Access Control Lists for filtering traffic to the controller itself. The distractors are traps for other WLAN features.
Q5. Refer to the exhibit. What set of commands was configured on interface Fa0/3 to produce the given output?
Answer: A. interface FastEthernet 0/3 channel-group 2 mode passive switchport trunk encapsulation dot1q switchport mode trunk
Passive mode indicates the switch is not negotiating PAgP, but is ready to form a channel if the peer is active.
Q6. A network administrator wants to add a line to an access list that will block only Telnet access by the hosts on subnet 192.168.1.128/28 to the server at 192.168.1.5. What command should be issued to accomplish this task?
Answer: A. access-list 101 deny tcp 192.168.1.128 0.0.0.15 192.168.1.5 0.0.0.0 eq 23 access-list 101 permit ip any any
Correct answer uses a standard numbered ACL for filtering. The trap is using an extended ACL number or the wrong wildcard mask for the /28 subnet.
Q7. The following access list was applied outbound on the E0 interface connected to the 192.169.1.8/29 LAN: access-list 135 deny tcp 192.169.1.8 0.0.0.7 eq 20 any access-list 135 deny tcp 192.169.1.8 0.0.0.7 eq 21 any How will the above access…
Answer: B. All traffic exiting E0 will be denied
The correct answer proves that an implicit deny at the end of an ACL blocks all unmatched traffic. The distractor fails to recognize the default action when no permit rules exist.
Q8. Which is the most accurate description of DTP?
Answer: D. * When connecting between ""Dynamic Desirable"", it becomes a trunk port
The correct answer proves that two Dynamic Desirable ports negotiate to form a trunk. The distractors are incorrect due to misunderstandings about default modes, DTP on native VLANs, and the effect of connecting Dynamic AUTO to Desirable.
Q9. Which statement about a router on a stick is true?
Answer: A. It uses multiple subinterfaces of a single interface to encapsulate traffic for different VLANs.
The correct answer proves that router on a stick uses subinterfaces to encapsulate traffic for different VLANs. Distractor D is eliminated because subinterfaces must be on different subnets, not the same.
Q10. Which switch would STP choose to become the root bridge in the selection process?
Answer: A. 32768: 11-22-33-44-55-66
The root bridge is chosen based on the lowest Bridge ID, which is a combination of priority and MAC address. The lowest priority makes a switch the winner, regardless of MAC.
Q11. Which of the following are the correct descriptions about FCS (select 2)
Answer: A,F. * It is used to confirm whether the received data is incorrect || * It is stored on the Ethernet trailer
FCS is an error detection mechanism in Ethernet trailers that detects corruption. The distractors confuse FCS functions like data repair or SFD signaling.
Q12. Which two commands can you enter to verify that a configured NetFlow data export is operational? (Choose two.)
Answer: A,C. show ip cache flow || interface ethernet 0/0
The correct answers prove that verification requires checking the flow cache. The distractors are configuration commands, not verification commands.
Q13. Which of the options is the reason for the ERR-DISABLED state (select 2)?
Answer: C,D. * Generation of security violation || * BPDU Guard Violation
Security violations trigger the err-disabled state. The shutdown command is manual, not automatic, and port security is disabled by default.
Q14. Which is the correct description of a site VPN and client VPN (select 2)?
Answer: A,D. * The Client VPN connects to a VPN using TLS || * Within a site VPN, multiple terminals can use that one VPN
Client VPNs use TLS for connections. Site VPNs connect entire networks, allowing multiple devices to communicate through the tunnel.
Q15. Which of the following devices are appropriate for SOHO (select 2)?
Answer: A,E. * Router with switch and firewall functions || * Autonomous AP
SOHO networks use all-in-one devices like routers with switch/firewall features and simple, autonomous access points. Centralized and high-end devices are overkill.
Q16. Which of the following is correct about SLAAC?
Answer: D. * Automatically configures IPv6 address by interface ID generated by the received prefix and EUI-64
SLAAC uses a router-advertised prefix and an EUI-64 generated interface ID to auto-configure an IPv6 address.
Q17. Where are the responses to queries from DNS clients stored? (select 2)
Answer: D,E. * Authority DNS server || * DNS cache server
Authoritative DNS servers hold the primary data, and cache servers store temporary copies of responses to speed up future queries.
Q18. You want to reduce the cost of IT-related equipment currently in operation. Which one should you consider adopting?
Answer: B. * Cloud
The cloud reduces on-premises costs. The distractors are LAN technologies, not cost reduction models.
Q19. The Class B address of 172.16.0.0 is used in one network. Which subnet mask should you use to enable 985 hosts per subnet? 255.255.252.0
Answer: C. * 255.255.252.0
The correct answer proves the host bit calculation needed for 985 hosts. The distractors are traps using masks for larger or smaller subnets.
Q20. Refer to the exhibit. Which WAN protocol is being used PPP
Answer: B. Frame Relay
Frame Relay is identified by LMI messages in the exhibit. PPP does not use LMI, which is the key cue for elimination.
Q21. Which is "software delivered in the form of a service" in the cloud service model?
Answer: C. * SaaS
The correct answer proves that SaaS is the model for software as a service. The trap is confusing it with PaaS or IaaS, which deliver platforms and infrastructure, not ready-to-use software.
Q22. Which of the following are the correct descriptions about a server?
Answer: B. * Equipment that provides a service
A server provides services to clients. The distractors confuse server roles with clients, switches, or routers.
Q23. Which are the characteristics of the distance vector type routing protocol? (select 3)
Answer: A,B. * Uses a hop count as a metric || * Updates routing table based on routing update information received from adjacent routers
Distance vector protocols use hop count and update based on neighbor information. The question asks for three options but only two are correct, and EIGRP has a topology table.
More CCNA (Cisco Certified Network Associate) Exams 2026 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.