CCNA Practice Exam 2 — 20 Questions

Question 1

Why is idempotency valuable in network automation?

Accepted Answer

It ensures repeated runs converge on the same desired state safely.. Idempotent operations can be applied repeatedly without causing unintended changes once the desired state is already present.

Answer

It guarantees every API call will use TCP instead of UDP.

Answer

It encrypts device credentials stored in scripts.

Answer

It forces the controller to use only one management protocol.

Question 2

Match each routing term to its description.

Question 3

What is the most likely purpose of a GET request in a RESTful network API?

Accepted Answer

To retrieve data from the server. GET is typically used to retrieve information rather than create or modify it.

Answer

To delete a resource permanently

Answer

To create a new resource with a request body

Answer

To encrypt the API session automatically

Question 4

A controller API returns this data:

{
  "device": {
    "hostname": "Dist-1",
    "interfaces": [
      {"name": "Gig0/0", "status": "up"},
      {"name": "Gig0/1", "status": "down"}
    ]
  }
}

Which statement is correct?

Accepted Answer

The interfaces field is an array of objects. The interfaces field is an array of objects. The giveaway is the square brackets around the interface entries. In JSON, square brackets represent an array, and braces represent an object. Each interface entry inside that array has key-value pairs such as name and status, which makes each entry its own object. In plain language, the controller is returning a list of interface records for one device. The hostname field, by contrast, is a single value. This style of question appears in automation topics because the exam wants you to recognize common data structures used in controller APIs without requiring deep programming expertise. Understanding the difference between an object and an array is usually enough.

Answer

The response is XML because it contains nested elements

Answer

The hostname field is a list

Answer

The format shown is YAML

Question 5

Match each security concept to its most accurate purpose.

Question 6

An automation script must retrieve the current configuration state of a device from a REST API without modifying anything. Which HTTP method should it use?

Accepted Answer

GET. When a script only needs to read information, the normal REST choice is GET. In plain terms, GET asks the server, “Show me the current data,” without telling it to create, replace, or delete anything. That is why GET is the standard method for retrieving device state, configuration details, statistics, or inventory information from an API endpoint.

The other methods imply change. POST commonly creates or submits data. PUT commonly updates an existing resource. DELETE removes something. For a read-only query, GET is the clean and expected method.

Answer

DELETE

Answer

PUT

Answer

POST

Question 7

What is the main reason a default route is sometimes called a route of last resort?

Accepted Answer

It is used only when no more specific route matches the destination. A default route is called the route of last resort because the router uses it only when no more specific route matches the destination. In plain language, it is the fallback instruction the router follows when it does not have a better answer in the routing table. That makes it extremely useful for branch routers, Internet edge devices, and other places where unknown destinations should simply be sent to an upstream path.

The default route is not “last” because it is slow or because it is dangerous. It is last because it is the least specific match. As soon as the router finds a more specific prefix, that route takes precedence. This is a core route-selection concept and helps explain why default routes work so well alongside more detailed routing information.

Answer

It always has the highest bandwidth link

Answer

It is processed before all connected routes

Answer

It disables all dynamic routing protocols

Question 8

A network team wants centralized logging and also wants log timestamps from different devices to line up accurately. Which combination best supports that goal?

Accepted Answer

Syslog and NTP. The right combination is Syslog plus NTP. In plain language, Syslog gives the team a central place to collect and review device messages, while NTP makes sure the timestamps on those messages are consistent across the network. Centralized logs are useful on their own, but without synchronized clocks, incident timelines can become confusing and misleading.

This pairing is a common operational best practice. Syslog handles the collection side, and NTP handles the time-correlation side. Other services such as DHCP, STP, or NAT do not solve this combination of requirements. The best answer is the one that recognizes that centralized logging and time synchronization are complementary, not competing, services.

Answer

DHCP and STP

Answer

PAT and EtherChannel

Answer

ARP and CDP

Question 9

Why is PortFast typically enabled on switch ports connected to end devices?

Accepted Answer

To let end-device ports reach forwarding state more quickly. PortFast is enabled so access ports connected to end devices can move to forwarding more quickly instead of waiting through the normal spanning-tree listening and learning transitions. In plain language, it helps a user’s PC, printer, or similar endpoint start communicating sooner after the link comes up. That can reduce delays at startup and prevent certain device timeout problems.

PortFast is not intended as a loop-prevention mechanism by itself, and it should not normally be used carelessly on links to other switches. That is why it is commonly paired with BPDU Guard on edge ports. The correct answer is the one focused on faster transition for end-device access links rather than on unrelated routing or VLAN functions.

Answer

To make access ports participate in OSPF

Answer

To convert all access ports into trunks

Answer

To disable Ethernet addressing on PCs

Question 10

Which statement best describes the role of DNS in a network?

Accepted Answer

DNS resolves names into IP-related information. DNS helps devices and users resolve names into IP-related information. In plain language, it means people can use easy-to-remember hostnames instead of typing numeric IP addresses every time they want to reach a server or service. This makes networks more usable and easier to manage, especially when addresses change but names remain stable.

DNS does not assign addresses the way DHCP does, and it does not synchronize time like NTP. It also is not a routing protocol. Its job is name resolution. That is a fundamental service concept and a very common CCNA test point because many practical network symptoms can be traced back to name-resolution failures even when basic IP connectivity still works.

Answer

DNS dynamically assigns client IP addresses

Answer

DNS prevents switching loops on VLAN trunks

Answer

DNS is the default metric used by OSPF

Question 11

A switchport connected to an IP phone and a PC must carry user traffic and voice traffic separately. Which feature is designed for that purpose on a Cisco access port?

Accepted Answer

Voice VLAN. The correct feature is a voice VLAN. In plain language, a voice VLAN lets the switch treat the IP phone’s traffic differently from the user PC’s traffic even though both devices may be connected through the same physical access port. The phone can tag voice traffic for the voice VLAN while the PC remains in the normal data access VLAN. This is a practical design because it keeps voice traffic logically separate, which helps with policy, QoS, and management.

This is a classic CCNA switching concept because it shows that one physical edge port can still support more than one logical traffic type in a controlled way. A standard access VLAN by itself would not provide the same voice/data separation. EtherChannel, SPAN, and native VLAN concepts solve different problems. The best answer is the feature specifically built to support phones and workstations together on one access connection while keeping their traffic logically distinct.

Answer

EtherChannel

Answer

SPAN

Answer

Native VLAN

Question 12

Why does a passive interface in OSPF still matter even though it does not send hello packets?

Accepted Answer

The connected network can still be advertised into OSPF through other active adjacencies. A passive interface still matters because the connected network can still be advertised into OSPF even though the interface itself does not form neighbor relationships. In plain language, the router is saying, “This network is mine, and I want others to know about it, but I do not want to speak OSPF directly on this interface.” That is useful on user-facing or stub-like interfaces where no OSPF neighbor should exist.

This distinction is important because some engineers assume passive means “ignored entirely.” It does not. The connected network can still appear in routing updates sent through real neighbors on other interfaces. What changes is neighbor formation on the passive interface itself.

Answer

The passive interface automatically becomes the OSPF router ID

Answer

The passive interface disables all OSPF operation on the router

Answer

The passive interface converts OSPF into EIGRP on that link

Question 13

Match each automation or programmability term to its most accurate description.

Question 14

A router has both an OSPF route and a static route to the same destination. The static route has an administrative distance of 200. What is the expected behavior while the OSPF route remains available?

Accepted Answer

The static route remains a backup and is used only if the OSPF route is lost.. The static route with an administrative distance of 200 behaves as a floating backup. In plain language, the router keeps it in reserve and prefers the OSPF route while OSPF is healthy, because OSPF’s default administrative distance of 110 is lower and therefore more trusted. The static route does not disappear from the configuration, but it stays out of the active routing table unless the better route is lost.

This is a very common CCNA concept because it shows how routing preference works between different route sources. The higher-distance static route is not useless; it is intentionally configured so that it becomes active only during a failure. That design provides backup routing without interfering with the normal dynamic path. The correct answer is the one describing the static route as a standby or floating route rather than as the preferred path.

Answer

The static route overrides OSPF immediately because static routes always win.

Answer

Both routes must be installed simultaneously because they point to the same destination.

Answer

The router removes the OSPF route because the static route has a manually configured distance.

Question 15

Match each security term to its most accurate meaning.

Question 16

A switchport should automatically disable itself if too many MAC addresses are learned beyond the configured secure limit. Which port-security violation mode causes that behavior?

Accepted Answer

shutdown. Shutdown is the violation mode that error-disables the port. In plain language, when the switch sees a port-security violation under shutdown mode, it reacts by taking the interface out of service rather than simply dropping frames quietly. That behavior is useful when the administrator wants a clear and strong response to unauthorized devices.

This matters because port security has several violation modes and they do not behave the same way. Restrict and protect can keep the interface up, while shutdown is the mode associated with the most visible response.

Answer

protect

Answer

restrict

Answer

dynamic

Question 17

Match each AAA component or related term to its most accurate meaning.

Question 18

Which two statements accurately describe basic WLAN security at the CCNA level?

Accepted Answer

WPA2 is generally considered stronger than WEP for wireless security.. At the CCNA level, WLAN security questions usually focus on recognizing stronger standards and avoiding obviously unsafe choices. In plain language, WPA2 is widely recognized as stronger than older WEP-based security, and open wireless networks do not provide meaningful encryption by default.

The wrong answers often mix wireless security with unrelated ideas such as VLANs or duplex. The two correct answers are the ones that preserve the real security difference between secured and open WLAN designs.

Answer

Open wireless access provides meaningful default encryption.

Answer

A longer SSID makes WEP cryptographically strong.

Answer

WPA2 is an Ethernet duplex mode.

Question 19

Match each API or automation concept to the most accurate description.

Question 20

Match each basic JSON element to its most accurate description.