Test your CCNA knowledge with 19 exam-style questions, clean answer reveals, and concise explanations. Topics include: Which of the following is an example of physical access control?. Follow @CertPunch and visit certpunch.com for more certification practice videos and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the CCNA part: 3 practice test →
What you will practice
- Which of the following is an example of physical access control?
- When configuring NAT, what is the role of an ACL?
- What is the correct TCP connection establishment sequence?
- A router receives a packet destined to 10.10.50.37. Which routing table entry will it use to forward the pack…
- Which of the following DHCP messages are always discarded when received on a DHCP Snooping untrusted port?
- What is the effect of the passive-interface command on an OSPF-enabled interface?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which of the following is an example of physical access control?
Answer: C. Installing MFA locks for server rooms.
Correct answer proves MFA locks control physical access to a location. The trap is confusing device security (console, Wi-Fi, TACACS+) with physical security.
Q2. When configuring NAT, what is the role of an ACL?
Answer: D. To define which packets should be translated
Correct answer proves an ACL in NAT defines which packets to translate. The trap is that ACLs define inside local IPs for translation, not the global IPs or to filter traffic.
Q3. What is the correct TCP connection establishment sequence?
Answer: D. SYN, SYN-ACK, ACK
Correct answer proves the TCP three-way handshake is SYN, SYN-ACK, ACK. The trap is options with incorrect segment order.
Q4. A router receives a packet destined to 10.10.50.37. Which routing table entry will it use to forward the packet?
Answer: E. O 10.10.50.32/27 [110/22] via 172.16.1.1, 00:00:34, Gi0/0
Correct answer proves the router uses the most specific (longest prefix) matching route. The trap is a less-specific route that also matches the destination IP.
Q5. Which of the following DHCP messages are always discarded when received on a DHCP Snooping untrusted port?
Answer: D. ACK, OFFER
This demonstrates that DHCP Snooping discards server-originated OFFER and ACK messages on untrusted ports to prevent rogue servers. The distractors include client-originated messages, which are permitted.
Q6. What is the effect of the passive-interface command on an OSPF-enabled interface?
Answer: C. The router will advertise the interface's network prefix to other OSPF routers, but won't send hello messages out of the interface.
The correct answer proves that passive interfaces stop OSPF hellos, preventing neighbor adjacency while still advertising the network prefix via LSAs. The other options incorrectly describe the function of sending hellos or forming neighbors.
Q7. Which mode enables an LWAP to locally switch client traffic between the wired and wireless LANs?
Answer: B. FlexConnect
The correct answer proves that FlexConnect mode allows a lightweight access point to switch traffic locally without sending it to the controller. The other options are incorrect modes that don't provide this specific switching capability.
Q8. Which of the following commands configures an enable secret pre-hashed with the scrypt algorithm?
Answer: A. enable secret 9 <hash>
The correct answer proves that 'enable secret 9' uses the newer scrypt hashing algorithm. The trap is using '8', which refers to the older MD5 algorithm, not the pre-hashed value itself.
Q9. Which SNMP message type is an unacknowledged notification from a managed device to the NMS?
Answer: D. Trap
The correct answer proves that a Trap is an unacknowledged alert. The elimination cue is 'Inform', which is a similar but acknowledged message type.
Q10. Which WPA3 security feature protects the PSK against brute-force attacks?
Answer: B. SAE
The correct answer proves that SAE (Simultaneous Authentication of Equals) replaces PSK with a more secure handshake resistant to brute-force attacks. The other options are WPA3 features but not for this specific protection.
Q11. Which of the following often leads to TCP synchronization, affecting the efficiency of communications over the network?
Answer: B. Tail drop
The correct answer proves that tail drop indiscriminately drops packets, causing multiple TCP sessions to back off simultaneously. The elimination cue is WRED, which is designed to avoid this by randomly dropping packets.
Q12. Which type of ML trains a model by rewarding or penalizing its actions in a given environment?
Answer: D. Reinforcement learning
The correct answer proves that reinforcement learning uses a reward/penalty system to train an agent. The trap is 'Incentive-based learning', a distractor term that sounds similar but is not a standard ML category.
Q13. A router receives a packet destined to 198.51.100.123. Which routing table entry will it use to forward the packet?
Answer: A. R 198.51.100.120/29 [120/5] via 192.0.2.3, 00:00:45, Gi0/3
The correct answer proves that the router uses the most specific (longest prefix) match in the routing table. The elimination cue is the /32 route, which is more specific than the /29 but does not cover the destination IP address.
Q14. After configuring ip arp inspection vlan <vlan>, what check does the switch perform on ARP messages received on untrusted interfaces in the VLAN?
Answer: B. It checks if the ARP Sender MAC and Sender IP fields have a matching entry in the DHCP Snooping table.
The correct answer proves that Dynamic ARP Inspection validates the sender's MAC and IP against the DHCP snooping binding table. The distractor is checking the target fields, which is incorrect for validating the sender's legitimacy.
Q15. Which IPsec mode encrypts and encapsulates the entire original IP packet?
Answer: B. Tunnel mode
The correct answer proves that Tunnel mode encrypts the whole original packet and adds a new IP header. The elimination cue is Transport mode, which encrypts only the payload, not the original header.
Q16. A network design requires a router to have the same IP address on multiple interfaces. Which technology can make this possible?
Answer: A. VRF
The correct answer proves that VRF allows the same IP address on different interfaces by creating separate routing instances. The distractor 'Subnetting' is an elimination cue because it enforces unique IP addresses.
Q17. A router receives a packet destined to 192.168.1.250. Which routing table entry will it use to forward the packet?
Answer: A. S* 0.0.0.0/0 [1/0] via 203.0.113.254
The correct answer proves that the default route matches any destination IP. The elimination cue is the /0 subnet mask, which makes it a catch-all route when no specific match exists.
Q18. Which logical plane is responsible for routers exchanging OSPF messages with each other to share routing information and build their routing tables?
Answer: C. Control plane
The correct answer proves that the control plane handles routing protocol exchanges to build routing tables. The distractor 'Data plane' is an elimination cue, as it only forwards packets based on the control plane's information.
Q19. Which of the following commands can be used to confirm the status of PDs connected to a PoE switch?
Answer: C. show power inline
The correct answer proves that 'show power inline' displays the status and power usage of connected devices. The trap distractors are variations that either don't exist or don't provide the requested detailed information.
More CCNA part: 3 drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.