CCNA Practice Test 2 — 30 Questions

Question 1

A switchport connected to an IP phone and a PC must carry user traffic and voice traffic separately. Which feature is designed for that purpose on a Cisco access port?

Accepted Answer

Voice VLAN. The correct feature is a voice VLAN. In plain language, a voice VLAN lets the switch treat the IP phone’s traffic differently from the user PC’s traffic even though both devices may be connected through the same physical access port. The phone can tag voice traffic for the voice VLAN while the PC remains in the normal data access VLAN. This is a practical design because it keeps voice traffic logically separate, which helps with policy, QoS, and management.

This is a classic CCNA switching concept because it shows that one physical edge port can still support more than one logical traffic type in a controlled way. A standard access VLAN by itself would not provide the same voice/data separation. EtherChannel, SPAN, and native VLAN concepts solve different problems. The best answer is the feature specifically built to support phones and workstations together on one access connection while keeping their traffic logically distinct.

Answer

EtherChannel

Answer

SPAN

Answer

Native VLAN

Question 2

Why does a passive interface in OSPF still matter even though it does not send hello packets?

Accepted Answer

The connected network can still be advertised into OSPF through other active adjacencies. A passive interface still matters because the connected network can still be advertised into OSPF even though the interface itself does not form neighbor relationships. In plain language, the router is saying, “This network is mine, and I want others to know about it, but I do not want to speak OSPF directly on this interface.” That is useful on user-facing or stub-like interfaces where no OSPF neighbor should exist.

This distinction is important because some engineers assume passive means “ignored entirely.” It does not. The connected network can still appear in routing updates sent through real neighbors on other interfaces. What changes is neighbor formation on the passive interface itself.

Answer

The passive interface automatically becomes the OSPF router ID

Answer

The passive interface disables all OSPF operation on the router

Answer

The passive interface converts OSPF into EIGRP on that link

Question 3

Match each automation or programmability term to its most accurate description.

Question 4

A router has both an OSPF route and a static route to the same destination. The static route has an administrative distance of 200. What is the expected behavior while the OSPF route remains available?

Accepted Answer

The static route remains a backup and is used only if the OSPF route is lost.. The static route with an administrative distance of 200 behaves as a floating backup. In plain language, the router keeps it in reserve and prefers the OSPF route while OSPF is healthy, because OSPF’s default administrative distance of 110 is lower and therefore more trusted. The static route does not disappear from the configuration, but it stays out of the active routing table unless the better route is lost.

This is a very common CCNA concept because it shows how routing preference works between different route sources. The higher-distance static route is not useless; it is intentionally configured so that it becomes active only during a failure. That design provides backup routing without interfering with the normal dynamic path. The correct answer is the one describing the static route as a standby or floating route rather than as the preferred path.

Answer

The static route overrides OSPF immediately because static routes always win.

Answer

Both routes must be installed simultaneously because they point to the same destination.

Answer

The router removes the OSPF route because the static route has a manually configured distance.

Question 5

Match each security term to its most accurate meaning.

Question 6

A switchport should automatically disable itself if too many MAC addresses are learned beyond the configured secure limit. Which port-security violation mode causes that behavior?

Accepted Answer

shutdown. Shutdown is the violation mode that error-disables the port. In plain language, when the switch sees a port-security violation under shutdown mode, it reacts by taking the interface out of service rather than simply dropping frames quietly. That behavior is useful when the administrator wants a clear and strong response to unauthorized devices.

This matters because port security has several violation modes and they do not behave the same way. Restrict and protect can keep the interface up, while shutdown is the mode associated with the most visible response.

Answer

protect

Answer

restrict

Answer

dynamic

Question 7

Match each AAA component or related term to its most accurate meaning.

Question 8

Which two statements accurately describe basic WLAN security at the CCNA level?

Accepted Answer

WPA2 is generally considered stronger than WEP for wireless security.. At the CCNA level, WLAN security questions usually focus on recognizing stronger standards and avoiding obviously unsafe choices. In plain language, WPA2 is widely recognized as stronger than older WEP-based security, and open wireless networks do not provide meaningful encryption by default.

The wrong answers often mix wireless security with unrelated ideas such as VLANs or duplex. The two correct answers are the ones that preserve the real security difference between secured and open WLAN designs.

Answer

Open wireless access provides meaningful default encryption.

Answer

A longer SSID makes WEP cryptographically strong.

Answer

WPA2 is an Ethernet duplex mode.

Question 9

Match each API or automation concept to the most accurate description.

Question 10

Match each basic JSON element to its most accurate description.

Question 11

What is the main security benefit of using the principle of least privilege?

Accepted Answer

It limits access to only what is necessary, reducing unnecessary exposure and potential damage.. The principle of least privilege limits users or systems to only the access they actually need. In plain language, it reduces risk by avoiding unnecessary permissions. If an account is compromised or a mistake is made, the potential damage is smaller because the account does not have broad powers it never needed in the first place.

This is a conceptual question, but it matters in many technical designs. The correct answer is the one that focuses on reducing exposure and limiting the impact of misuse rather than on convenience or performance.

Answer

It guarantees every user full administrative access when needed.

Answer

It disables all logging to improve performance.

Answer

It forces all traffic into VLAN 1.

Question 12

Which statement best describes why a token might be used in an API request instead of sending a username and password with every request?

Accepted Answer

A token can provide a controlled way to authenticate or authorize API access without sending raw credentials every time.. A token can be used because it provides a more controlled and often more practical way to authorize or authenticate repeated API access without exposing raw credentials in every interaction. In plain language, the system can issue a token that the client presents on later requests, which can simplify automation workflows and improve security handling. This does not mean tokens remove the need for security; they are part of how secure API access is often managed.

This is increasingly common in controller and automation environments. The correct answer is the one that recognizes tokens as an access-control mechanism for API interaction rather than as a routing or VLAN concept.

Answer

A token is the IPv4 subnet mask for controller traffic.

Answer

A token is the STP root bridge identifier.

Answer

A token forces the API to use Telnet.

Question 13

Match each API security or access term to its most accurate description.

Question 14

What is the main reason extended ACLs are often placed closer to the source of the traffic being filtered?

Accepted Answer

To stop unwanted traffic earlier and avoid carrying it farther through the network.. Extended ACLs are often placed close to the source so unwanted traffic is stopped earlier in the path. In practical terms, that conserves bandwidth and reduces unnecessary forwarding of traffic that will be denied anyway. Because extended ACLs can match more specific conditions such as source, destination, and protocol, they are especially useful early in the traffic path.

This is a standard ACL placement principle. The goal is not just security logic, but efficient use of the network as well.

Answer

Because extended ACLs can function only on source interfaces.

Answer

Because standard ACLs must always be placed near the destination instead.

Answer

Because ACL placement has no effect on network efficiency.

Question 15

Which statement best describes integrity in the CIA triad?

Accepted Answer

Protecting information from unauthorized modification. Integrity is about protecting data from unauthorized changes and helping ensure that information remains accurate and trustworthy. In plain language, it answers the question of whether the data has been altered improperly. This is different from confidentiality, which is about preventing unauthorized disclosure, and availability, which is about access when needed.

This distinction matters because many security controls target one part of the CIA triad more directly than the others. The correct answer is the one focused on unauthorized modification rather than disclosure or uptime.

Answer

Making information available at all times

Answer

Preventing unauthorized people from seeing the data

Answer

Recording all commands for audit

Question 16

Which statement best describes the purpose of administrative distance when two different routing sources advertise the same prefix?

Accepted Answer

It ranks the trustworthiness of different route sources advertising the same destination.. Administrative distance helps the router decide which route source to trust more. In plain language, if the same network is learned from two different sources, such as OSPF and a static route, the router needs a source-preference rule before it can install one. Administrative distance provides that rule.

This is different from a metric, which typically compares multiple paths inside the same routing protocol. The correct answer is the one focused on source trust rather than path cost inside one protocol.

Answer

It determines the MAC address of the next hop.

Answer

It specifies the native VLAN for trunk links.

Answer

It defines the subnet mask of the learned route.

Question 17

Match each automation transport or interaction term to its most accurate description.

Question 18

A switch port connected to an end host is configured with both PortFast and BPDU Guard. What is the most likely outcome if a small switch is connected there and starts sending BPDUs?

Accepted Answer

The port is error-disabled by BPDU Guard.. The most likely outcome is that the port is placed into an error-disabled state by BPDU Guard. In plain language, PortFast treats the port as an edge port for faster startup, while BPDU Guard protects that assumption. If the switch receives a BPDU on a port that was supposed to connect only to an end device, it reacts by shutting the port down to help prevent accidental loops or topology problems.

This is one of the most recognizable edge-port protection behaviors in switching. The correct answer is the one focused on err-disable due to unexpected BPDU receipt.

Answer

The port automatically becomes the root port.

Answer

The port converts into a trunk for the attached switch.

Answer

The port ignores the BPDU because PortFast disables STP entirely.

Question 19

A router has routes for 10.10.0.0/16, 10.10.20.0/24, and a default route. Which route is used for destination 10.10.20.55?

Accepted Answer

The 10.10.20.0/24 route. The destination matches multiple routes, but the /24 is the most specific match and wins by longest prefix match.

Answer

The 10.10.0.0/16 route

Answer

The default route

Answer

The router load-balances across all matching routes

Question 20

Why is NTP especially useful when devices send logs to a centralized Syslog server?

Accepted Answer

It helps align device clocks so centralized log timestamps can be correlated more accurately.. NTP is especially useful because synchronized clocks make the log timestamps more meaningful and easier to correlate. In plain language, if each device thinks the current time is different, the sequence of events in the centralized log becomes confusing. NTP helps align time across devices so the logs tell a more accurate story.

This is an operational best practice. Syslog collects the messages, and NTP makes their timing consistent. The correct answer is the one focused on timestamp correlation.

Answer

It assigns the Syslog server an IP address.

Answer

It replaces the need for a Syslog server.

Answer

It encrypts every Syslog message automatically.