CCNA Practice Questions 1 — 50 Questions

Question 1

A router interface applies this ACL inbound:

10 deny tcp any any eq 80
20 permit ip any any

A user reports that web browsing to a server by IP address fails, but ping works. Which statement best explains the behavior?

Accepted Answer

The ACL blocks HTTP but allows ICMP. ACLs are processed top down. Line 10 denies TCP destination port 80, which blocks HTTP. Line 20 then permits all remaining IP traffic, including ICMP echo packets used by ping.

Answer

The ACL blocks all traffic because the first entry is a deny

Answer

The ACL permits HTTP because line 20 overrides line 10

Answer

The ACL blocks ping because ICMP is not explicitly permitted

Question 2

A switch has DHCP snooping enabled, but users still experience IP-to-MAC spoofing attacks. Which additional feature should be considered to help address that specific problem?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection validates ARP packets against trusted binding information, commonly learned through DHCP snooping. That makes it a natural companion control against ARP spoofing attacks.

Answer

PortFast

Answer

EtherChannel

Answer

NetFlow

Question 3

Switch SW1 sends traffic for VLAN 30 across a trunk to SW2, but hosts in VLAN 30 on SW2 cannot communicate with hosts in VLAN 30 on SW1. Other VLANs work across the trunk. Which trunk issue is most likely?

Accepted Answer

VLAN 30 is pruned or missing from the allowed VLAN list. If only one VLAN fails across an otherwise healthy trunk, a missing or filtered VLAN in the allowed list is a common cause. Native VLAN matching and encapsulation would affect broader trunk behavior, not usually just one VLAN in this way.

Answer

The native VLAN is set to 1 on both switches

Answer

The trunk uses 802.1Q encapsulation

Answer

SW1 is the STP root bridge

Question 4

What problem is HSRP designed to solve?

Accepted Answer

Loss of the default gateway if one router fails. HSRP provides a virtual default gateway so hosts continue forwarding traffic even if one physical gateway router fails.

Answer

Layer 2 switching loops

Answer

Duplicate MAC addresses on trunks

Answer

Wireless interference

Question 5

Which DHCP message does the client send to formally accept an offered address?

Accepted Answer

REQUEST. In the DORA process, the client sends DHCPREQUEST after receiving an offer. The server then responds with DHCPACK if the lease is granted.

Answer

DISCOVER

Answer

OFFER

Answer

ACK

Question 6

What metric does RIP use to choose the best path?

Accepted Answer

Hop count. RIP uses hop count as its metric. Lower hop count paths are preferred, up to the protocol maximum of 15 usable hops.

Answer

Bandwidth

Answer

Cost

Answer

Delay

Question 7

An ACL permits only tcp 10.10.10.0/24 host 192.0.2.10 eq 443 and has no other permit entries. What happens to an ICMP echo request from 10.10.10.5 to 192.0.2.10?

Accepted Answer

It is denied by the implicit deny. ACLs end with an implicit deny. Since the only explicit permit is for HTTPS traffic, the ICMP packet is denied.

Answer

It is permitted because the destination matches

Answer

It is translated into TCP and then permitted

Answer

It is permitted only if the source port is 443

Question 8

Which syslog severity is more critical: level 2 or level 5?

Accepted Answer

Level 2. In syslog, lower numeric values indicate higher severity. Level 2 is therefore more critical than level 5.

Answer

Level 5

Answer

They are equal

Answer

It depends on platform model

Question 9

Why does traceroute reveal each router hop along a path?

Accepted Answer

Each router decrements TTL or hop limit, and expired packets trigger ICMP messages. Traceroute sends packets with increasing TTL or hop-limit values. When the value expires, the router that drops the packet returns an ICMP message, identifying that hop.

Answer

Each router appends its hostname to the packet payload

Answer

Each router sends an ARP response back to the source

Answer

Each switch on the path sends a syslog message to the source host

Question 10

Given the JSON snippet below, what is the value of hostname?

{
  "device": {
    "hostname": "R1",
    "mgmt_ip": "192.0.2.10"
  }
}

Accepted Answer

R1. The key hostname inside the device object has the value R1.

Answer

device

Answer

hostname

Answer

192.0.2.10

Question 11

Which data format is commonly used with REST APIs to represent objects, arrays, and key-value pairs?

Accepted Answer

JSON. JSON is a common data-interchange format used in APIs and automation systems.

Answer

STP

Answer

EIGRP

Answer

802.1Q

Question 12

Why is SSH preferred over Telnet for remote device administration?

Accepted Answer

SSH encrypts management traffic, while Telnet sends data in clear text. SSH protects credentials and management traffic by encrypting the session. Telnet does not provide encryption, so usernames, passwords, and commands can be exposed in transit.

Answer

SSH uses less bandwidth because it removes the TCP header

Answer

SSH works only on console ports, which are more secure

Answer

SSH does not require user authentication

Question 13

As a general rule, where should an extended ACL be placed?

Accepted Answer

As close to the source as practical. Extended ACLs are commonly placed near the source to stop unwanted traffic earlier and conserve bandwidth and device resources.

Answer

As close to the destination as possible in all cases

Answer

Only on the default gateway

Answer

Only on WAN interfaces

Question 14

A switch shows this output:

Gi0/1  on  802.1q trunking  1
Gi0/2  auto n-802.1q trunking 1

Which statement is correct?

Accepted Answer

Gi0/1 is trunking, and Gi0/2 is waiting for DTP negotiation. Gi0/1 is already operating as an 802.1Q trunk. Gi0/2 is in dynamic auto mode, which waits for the other side to actively negotiate trunking.

Answer

Gi0/1 is an access port in VLAN 1

Answer

Gi0/2 is forced to trunk mode

Answer

Neither interface can carry tagged traffic

Question 15

A switchport is configured for 802.1X authentication. What is the usual role of the RADIUS server in that design?

Accepted Answer

It validates authentication credentials for the supplicant.. The switch acts as the authenticator and forwards authentication requests to the RADIUS server, which validates the user or device credentials.

Answer

It provides Layer 2 trunk negotiation for the supplicant.

Answer

It replaces the need for DHCP on the access layer.

Answer

It generates ARP replies on behalf of the default gateway.

Question 16

Two switches form an EtherChannel. One side is configured with LACP active. Which setting on the other side will successfully negotiate the bundle?

Accepted Answer

LACP passive. LACP forms when at least one side is active and the other side is active or passive.

Answer

PAgP desirable

Answer

on

Answer

PAgP auto

Question 17

Which two practices most improve safety when automating network changes? (Choose two.)

Accepted Answer

Testing changes in a lab or staging environment first. Testing and validation reduce risk before wide deployment, and version control with review/rollback supports controlled operations.

Answer

Running scripts directly in production without validation

Answer

Disabling backups so changes apply faster

Question 18

A REST API query returns this JSON snippet:

{
  "interface": {
    "name": "GigabitEthernet1",
    "admin-status": "up",
    "oper-status": "down"
  }
}

What does this indicate?

Accepted Answer

The interface is enabled but the link is not operational.. The interface is administratively enabled, but it is not operationally passing traffic or achieving link.

Answer

The interface is shut down by configuration.

Answer

The interface is operating normally.

Answer

The interface is a loopback.

Question 19

What data format is commonly used in REST API responses because it is lightweight and easy for applications to parse?

Accepted Answer

JSON. JSON is widely used in REST APIs for structured data exchange.

Answer

BGP

Answer

STP

Answer

ARP

Question 20

A show ip nat translations command displays this entry:

Inside global 203.0.113.10:30001
Inside local 192.168.10.25:51514
Outside local 198.51.100.20:443
Outside global 198.51.100.20:443

Which statement is correct?

Accepted Answer

192.168.10.25 is the inside local address of the host. Inside local is the actual address assigned to the inside host before translation. The inside global address is the public representation used after NAT, and the port values show PAT is in use.

Answer

203.0.113.10 is the inside local address of the host

Answer

198.51.100.20 is the translated private address of the internal client

Answer

The entry proves static NAT is being used without port translation