CCNA Practice Exam 3 — 20 Questions

Question 1

What is the main security benefit of using the principle of least privilege?

Accepted Answer

It limits access to only what is necessary, reducing unnecessary exposure and potential damage.. The principle of least privilege limits users or systems to only the access they actually need. In plain language, it reduces risk by avoiding unnecessary permissions. If an account is compromised or a mistake is made, the potential damage is smaller because the account does not have broad powers it never needed in the first place.

This is a conceptual question, but it matters in many technical designs. The correct answer is the one that focuses on reducing exposure and limiting the impact of misuse rather than on convenience or performance.

Answer

It guarantees every user full administrative access when needed.

Answer

It disables all logging to improve performance.

Answer

It forces all traffic into VLAN 1.

Question 2

Which statement best describes why a token might be used in an API request instead of sending a username and password with every request?

Accepted Answer

A token can provide a controlled way to authenticate or authorize API access without sending raw credentials every time.. A token can be used because it provides a more controlled and often more practical way to authorize or authenticate repeated API access without exposing raw credentials in every interaction. In plain language, the system can issue a token that the client presents on later requests, which can simplify automation workflows and improve security handling. This does not mean tokens remove the need for security; they are part of how secure API access is often managed.

This is increasingly common in controller and automation environments. The correct answer is the one that recognizes tokens as an access-control mechanism for API interaction rather than as a routing or VLAN concept.

Answer

A token is the IPv4 subnet mask for controller traffic.

Answer

A token is the STP root bridge identifier.

Answer

A token forces the API to use Telnet.

Question 3

Match each API security or access term to its most accurate description.

Question 4

What is the main reason extended ACLs are often placed closer to the source of the traffic being filtered?

Accepted Answer

To stop unwanted traffic earlier and avoid carrying it farther through the network.. Extended ACLs are often placed close to the source so unwanted traffic is stopped earlier in the path. In practical terms, that conserves bandwidth and reduces unnecessary forwarding of traffic that will be denied anyway. Because extended ACLs can match more specific conditions such as source, destination, and protocol, they are especially useful early in the traffic path.

This is a standard ACL placement principle. The goal is not just security logic, but efficient use of the network as well.

Answer

Because extended ACLs can function only on source interfaces.

Answer

Because standard ACLs must always be placed near the destination instead.

Answer

Because ACL placement has no effect on network efficiency.

Question 5

Which statement best describes integrity in the CIA triad?

Accepted Answer

Protecting information from unauthorized modification. Integrity is about protecting data from unauthorized changes and helping ensure that information remains accurate and trustworthy. In plain language, it answers the question of whether the data has been altered improperly. This is different from confidentiality, which is about preventing unauthorized disclosure, and availability, which is about access when needed.

This distinction matters because many security controls target one part of the CIA triad more directly than the others. The correct answer is the one focused on unauthorized modification rather than disclosure or uptime.

Answer

Making information available at all times

Answer

Preventing unauthorized people from seeing the data

Answer

Recording all commands for audit

Question 6

Which statement best describes the purpose of administrative distance when two different routing sources advertise the same prefix?

Accepted Answer

It ranks the trustworthiness of different route sources advertising the same destination.. Administrative distance helps the router decide which route source to trust more. In plain language, if the same network is learned from two different sources, such as OSPF and a static route, the router needs a source-preference rule before it can install one. Administrative distance provides that rule.

This is different from a metric, which typically compares multiple paths inside the same routing protocol. The correct answer is the one focused on source trust rather than path cost inside one protocol.

Answer

It determines the MAC address of the next hop.

Answer

It specifies the native VLAN for trunk links.

Answer

It defines the subnet mask of the learned route.

Question 7

Match each automation transport or interaction term to its most accurate description.

Question 8

A switch port connected to an end host is configured with both PortFast and BPDU Guard. What is the most likely outcome if a small switch is connected there and starts sending BPDUs?

Accepted Answer

The port is error-disabled by BPDU Guard.. The most likely outcome is that the port is placed into an error-disabled state by BPDU Guard. In plain language, PortFast treats the port as an edge port for faster startup, while BPDU Guard protects that assumption. If the switch receives a BPDU on a port that was supposed to connect only to an end device, it reacts by shutting the port down to help prevent accidental loops or topology problems.

This is one of the most recognizable edge-port protection behaviors in switching. The correct answer is the one focused on err-disable due to unexpected BPDU receipt.

Answer

The port automatically becomes the root port.

Answer

The port converts into a trunk for the attached switch.

Answer

The port ignores the BPDU because PortFast disables STP entirely.

Question 9

A router has routes for 10.10.0.0/16, 10.10.20.0/24, and a default route. Which route is used for destination 10.10.20.55?

Accepted Answer

The 10.10.20.0/24 route. The destination matches multiple routes, but the /24 is the most specific match and wins by longest prefix match.

Answer

The 10.10.0.0/16 route

Answer

The default route

Answer

The router load-balances across all matching routes

Question 10

Why is NTP especially useful when devices send logs to a centralized Syslog server?

Accepted Answer

It helps align device clocks so centralized log timestamps can be correlated more accurately.. NTP is especially useful because synchronized clocks make the log timestamps more meaningful and easier to correlate. In plain language, if each device thinks the current time is different, the sequence of events in the centralized log becomes confusing. NTP helps align time across devices so the logs tell a more accurate story.

This is an operational best practice. Syslog collects the messages, and NTP makes their timing consistent. The correct answer is the one focused on timestamp correlation.

Answer

It assigns the Syslog server an IP address.

Answer

It replaces the need for a Syslog server.

Answer

It encrypts every Syslog message automatically.

Question 11

Two routers are directly connected over IPv6 and should form an OSPFv3 adjacency, but they do not. Link-local addressing is present on both interfaces. Which issue is most likely to prevent the adjacency?

Accepted Answer

The interfaces are assigned to different OSPFv3 areas.. An area mismatch is a strong and direct explanation. In plain language, even though the routers can have valid IPv6 addressing and proper link-local communication on the interface, OSPFv3 still requires the two ends of the shared segment to agree on the area context for the adjacency. If one side places the interface in one area and the other side places it in another, the routers will not treat each other as valid neighbors.

This is very similar in principle to OSPF for IPv4. Link-local addressing matters in OSPFv3, but the protocol still enforces key neighbor-formation checks. The correct answer is the one that focuses on a required protocol match rather than on a vague issue like hostname or cable color.

Answer

The routers need matching hostnames before OSPFv3 can start.

Answer

IPv6 requires a /64 only for routing protocols to function.

Answer

OSPFv3 cannot run on directly connected interfaces.

Question 12

Which statement best explains the security value of SSH for device management?

Accepted Answer

It encrypts remote administrative traffic, helping protect credentials and session data.. SSH provides encrypted remote management, which helps protect credentials and session contents from being read in transit. In plain language, administrators can still manage devices remotely, but the traffic is protected instead of being sent as clear text. That makes SSH much safer than Telnet for routine administration.

This is one of the most fundamental management-plane security decisions in networking. The correct answer is the one focused on secure remote administration through encryption.

Answer

It removes the need for usernames and passwords.

Answer

It turns every management interface into a trunk.

Answer

It prevents all routing problems automatically.

Question 13

Which two actions are reasonable examples of basic device-hardening practice?

Accepted Answer

Disable unused services or interfaces where practical. Basic hardening is about reducing unnecessary exposure and making administrative access safer. In plain language, this usually means disabling services or interfaces that are not needed and preferring secure management protocols such as SSH. These choices shrink the attack surface and improve the security of routine device administration without requiring advanced security products.

The wrong answers in hardening questions often suggest convenience at the expense of security, such as leaving insecure access methods enabled or removing authentication. CCNA-level security expects you to recognize that strong fundamentals often come from disciplined configuration choices rather than from complex tools alone.

Answer

Allow anonymous administrative login for convenience

Answer

Place all traffic in VLAN 1 so it is easier to remember

Answer

Remove authentication from VTY lines

Question 14

Why might an automation script prefer a token-based API session over repeatedly prompting a human operator for credentials?

Accepted Answer

Because tokens support controlled repeated API access in a way that is practical for automation workflows.. A token-based API session is useful because it supports programmatic access in a way that is more suitable for automation than constant interactive prompts. In plain language, scripts often need to make repeated requests without a human sitting there typing a username and password every time. Tokens make that possible while still fitting into an access-control model.

This does not mean tokens are magically insecure or that authentication disappears. It means that token-based access is often more practical for software-driven workflows. The correct answer is the one centered on programmatic usability and controlled repeated access.

Answer

Because tokens eliminate the need for any security controls.

Answer

Because tokens automatically create VLANs on the switch.

Answer

Because tokens replace all routing protocols.

Question 15

Match each route source or concept to its most accurate description.

Question 16

An engineer configures a floating static route to 0.0.0.0/0 with an administrative distance of 200 while OSPF is providing a default route. What is the intended behavior?

Accepted Answer

The static default route acts as a backup and becomes active only if the OSPF default route is lost.. The intended behavior is that the static default route stays in reserve and becomes active only if the OSPF-learned default route disappears. In plain language, the administrator wants a backup path, not a replacement for the normal OSPF path. By assigning the static route a higher administrative distance than OSPF, the router treats it as less trustworthy during normal operation.

This is a standard floating-static design. The static route is still configured, but it does not normally appear as the preferred forwarding choice until the lower-distance route is lost. That is the key operational purpose of the configuration.

Answer

The static default route overrides OSPF immediately because it is manually configured.

Answer

Both default routes must always load-balance together.

Answer

The router ignores both defaults because they overlap.

Question 17

Which statement best describes why least privilege is useful for administrative accounts?

Accepted Answer

It limits unnecessary permissions so mistakes or compromise have less impact.. Least privilege is useful because even administrative or trusted users should not have more access than they actually need. In plain language, limiting permissions reduces the damage that can result from mistakes, misuse, or account compromise. It is a risk-reduction principle, not a sign that trusted users are assumed to be malicious.

This matters because broad permissions create a larger blast radius when something goes wrong. The correct answer is the one focused on limiting unnecessary exposure and impact.

Answer

It guarantees that trusted users can never make mistakes.

Answer

It replaces the need for authentication.

Answer

It requires every user to be placed in the same role.

Question 18

Why is the combination of strong authentication and centralized logging generally better than using either one alone?

Accepted Answer

Authentication helps prevent unauthorized access, while centralized logging improves visibility and investigation.. The combination is better because strong authentication helps prevent unauthorized access, while centralized logging helps detect, review, and investigate activity across the environment. In plain language, one control focuses more on prevention, while the other improves visibility and accountability. Together they create a stronger security posture than either one alone.

This is an important design mindset. Security is stronger when controls complement each other instead of trying to solve every problem with one mechanism. The correct answer is the one focused on prevention plus visibility.

Answer

They are redundant because both perform exactly the same function.

Answer

Centralized logging makes authentication unnecessary.

Answer

Strong authentication removes the need for device event records.

Question 19

Which statement best describes why SSH is safer than Telnet for remote administration?

Accepted Answer

SSH encrypts the management session, while Telnet does not.. SSH is safer because it encrypts the remote administrative session. In plain language, credentials and command traffic are protected while crossing the network, whereas Telnet sends that information in clear text. That makes SSH the preferred option for secure device management.

This is one of the most foundational security comparisons in network administration. The correct answer is the one focused on encryption in transit.

Answer

Telnet is safer because it is simpler.

Answer

SSH removes the need for usernames and passwords.

Answer

Telnet is the required protocol for VLAN trunks.

Question 20

A router has routes to 192.168.0.0/16 and 192.168.50.0/24. Which route is used for traffic to 192.168.50.99?

Accepted Answer

192.168.50.0/24. The 192.168.50.0/24 route is used because it is more specific. In practical terms, even though the /16 also matches, the router always prefers the route that describes the destination more narrowly. Since 192.168.50.99 falls inside the /24, longest-prefix match chooses that entry.

This is a basic but essential routing rule. The broader /16 still matters for other destinations in 192.168.0.0/16, but not for this one.

Answer

192.168.0.0/16

Answer

The default route

Answer

Both routes equally