CCNA Practice Test 5 — 10 Questions

Question 1

Why is HTTPS usually preferred over HTTP when accessing a controller API?

Accepted Answer

Because HTTPS provides encrypted transport for API traffic.. HTTPS is preferred because it protects the communication with encryption while it crosses the network. In practical terms, controller APIs often carry tokens, credentials, device state, or configuration information that should not be exposed in clear text. HTTPS helps protect those requests and responses in transit.

This does not make HTTPS the same thing as JSON, nor does it remove the need for authentication. It is simply the more secure transport choice for sensitive API communication.

Answer

Because HTTPS automatically replaces authentication.

Answer

Because HTTPS is the only format that can carry JSON.

Answer

Because HTTP cannot carry controller data at all.

Question 2

Which WAN technology is most closely associated with establishing a direct point-to-point data-link connection between two routers over a serial link?

Accepted Answer

PPP. PPP is the WAN technology most closely associated with point-to-point serial connections between routers. In practical terms, it is a Layer 2 WAN encapsulation method commonly discussed in traditional serial WAN contexts. It supports features such as authentication and link negotiation that make it more flexible than older basic encapsulations.

This is one of the classic CCNA WAN topics.

Answer

CAPWAP

Answer

SNMP

Answer

STP

Question 3

A user reports that a laptop can connect to the correct SSID but repeatedly fails authentication when joining the WLAN. Which category of issue is most strongly indicated?

Accepted Answer

A security or authentication mismatch related to WLAN access. The strongest indication is a wireless security or authentication mismatch rather than a pure RF coverage problem. In practical terms, the laptop can already see and attempt to join the correct SSID, which means discovery is working. Repeated authentication failure points more directly to credentials, security settings, or authentication-policy alignment than to channel or signal absence.

This question is about recognizing the stage of failure. The client is finding the WLAN, but it is not being accepted onto it.

Answer

A missing OSPF router ID on the access point

Answer

A routed-port mismatch on the switch uplink

Answer

A DHCP relay problem on the client

Question 4

A network administrator is troubleshooting connectivity loss in a switched network. All switches run Rapid PVST+. A host connected to an access port on SwitchC can no longer reach the default gateway. The access port is configured with PortFast and BPDU Guard. The administrator checks the interface status and finds it in an err-disabled state. What is the most likely cause of this issue?

Accepted Answer

BPDU Guard detected a BPDU on a PortFast-enabled port and disabled it.. B is correct because BPDU Guard is designed to protect the spanning-tree topology by disabling a PortFast-enabled port if it receives a BPDU, placing the port in err-disabled state. Option A is incorrect: a root bridge election failure would not cause a port to err-disable; loops do not directly trigger this state without BPDU Guard. Option C is incorrect because PortFast and BPDU Guard work with all spanning-tree variants including Rapid PVST+. Option D is incorrect: a trunk misconfiguration alone would not cause err-disable unless BPDU Guard detects a BPDU on a PortFast port.

Answer

The root bridge election failed, causing a loop.

Answer

Rapid PVST+ is not compatible with PortFast.

Answer

The port is configured as a trunk but should be an access port.

Question 5

Which IPv6 address type is automatically created on an interface and used for communication on the local link only?

Accepted Answer

Link-local. Every IPv6-enabled interface generates a link-local address, typically in the FE80::/10 range. It is used for neighbor discovery, local communication, and next-hop resolution on the same link.

Answer

Global unicast

Answer

Unique local

Answer

Multicast

Question 6

A standard ACL and an extended ACL are both available for a design. Which requirement most strongly indicates that an extended ACL is needed?

Accepted Answer

The policy must distinguish traffic by destination, protocol, or port.. An extended ACL is most strongly indicated when the policy must match not just on source address, but also on destination, protocol, or port information. In practical terms, if the requirement is something like “block HTTP but allow SSH” or “deny traffic to one server but not another,” a standard ACL is too limited because it mainly matches only the source. Option B (matching only one source subnet) can be done with a standard ACL, so it does not demand an extended ACL. Option C (placement near destination) is a guideline for standard ACLs, not a reason to choose an extended ACL. Option D (IPv6) is irrelevant because the scenario explicitly states both ACL types are available and standard ACLs do not exist for IPv6—this question is about IPv4 ACLs.

Answer

The policy needs to match only one source subnet.

Answer

The ACL must be placed near the destination.

Answer

The network uses IPv6 instead of IPv4.

Question 7

Exhibit: R1 shows an OSPF neighbor stuck in EXSTART with R2 on a serial link. What is the most likely cause?

Accepted Answer

An interface MTU mismatch between the routers. When two OSPF routers stay in EXSTART, the first thing to suspect is an MTU mismatch. They can discover each other, but database exchange does not complete because the DBD packets do not agree on interface MTU.

Answer

An OSPF area mismatch

Answer

A duplicate router ID on R1 and R2

Answer

A missing default route on R2

Question 8

A branch office uses PAT for user Internet access. The administrator notices that inside users can browse out, but an internal server still cannot be reached consistently from outside. Which change is most appropriate?

Accepted Answer

Add a static NAT mapping for the server while leaving PAT in place for user traffic.. The most appropriate change is to add a static NAT mapping for the internal server while keeping PAT for ordinary user traffic. In practical terms, PAT solves the many-users-outbound problem by allowing shared use of a public address. But an inbound-published server needs a stable, predictable public identity. That requirement is different from the requirement for user browsing.

This is a common NAT design distinction. PAT and static NAT can coexist because they solve different problems. The best answer is the one that preserves PAT for users while giving the server a fixed public translation.

Answer

Replace PAT with DHCP relay.

Answer

Disable NAT entirely because PAT is preventing inbound routing.

Answer

Put the server in the native VLAN.

Question 9

A network administrator wants to secure remote CLI access to a Cisco router, moving beyond simple username/password authentication. Which approach best achieves this goal?

Accepted Answer

Use stronger or additional authentication controls to improve remote administrative access security. The goal is to strengthen authentication beyond a simple password. Cisco AAA (Authentication, Authorization, and Accounting) using TACACS+ or RADIUS provides stronger, centralized authentication. Secure Shell (SSH) with key-based or two-factor authentication also enhances security. Option A correctly describes this concept, while the other options either weaken security (B, D) or address access control via ACLs, which does not improve the authentication factor itself (C).

Answer

Replace SSH with Telnet to simplify troubleshooting

Answer

Configure an extended ACL to limit remote access to specific source IP addresses

Answer

Disable password authentication and rely solely on device location in the network

Question 10

A company wants to reduce the chance that unused switch ports can be exploited. Which action best aligns with that goal?

Accepted Answer

Administratively shut down unused switch ports. The best action is to administratively disable unused ports and apply hardening where appropriate. In plain language, an unused port is still a possible entry point if it remains active and unmonitored. Shutting it down reduces exposure and aligns with the broader principle of minimizing unnecessary attack surface. This is a simple but effective part of switch hardening.

Leaving unused ports active may feel convenient, but it creates opportunities for unauthorized connections. The correct answer is the one focused on disabling resources that are not needed rather than on unrelated technologies.

Answer

Convert all unused ports into trunk ports

Answer

Enable Telnet on all unused ports

Answer

Advertise every unused port into OSPF