CCNA Practice Questions 2 — 50 Questions

Question 1

Two routers are directly connected over IPv6 and should form an OSPFv3 adjacency, but they do not. Link-local addressing is present on both interfaces. Which issue is most likely to prevent the adjacency?

Accepted Answer

The interfaces are assigned to different OSPFv3 areas.. An area mismatch is a strong and direct explanation. In plain language, even though the routers can have valid IPv6 addressing and proper link-local communication on the interface, OSPFv3 still requires the two ends of the shared segment to agree on the area context for the adjacency. If one side places the interface in one area and the other side places it in another, the routers will not treat each other as valid neighbors.

This is very similar in principle to OSPF for IPv4. Link-local addressing matters in OSPFv3, but the protocol still enforces key neighbor-formation checks. The correct answer is the one that focuses on a required protocol match rather than on a vague issue like hostname or cable color.

Answer

The routers need matching hostnames before OSPFv3 can start.

Answer

IPv6 requires a /64 only for routing protocols to function.

Answer

OSPFv3 cannot run on directly connected interfaces.

Question 2

Which statement best explains the security value of SSH for device management?

Accepted Answer

It encrypts remote administrative traffic, helping protect credentials and session data.. SSH provides encrypted remote management, which helps protect credentials and session contents from being read in transit. In plain language, administrators can still manage devices remotely, but the traffic is protected instead of being sent as clear text. That makes SSH much safer than Telnet for routine administration.

This is one of the most fundamental management-plane security decisions in networking. The correct answer is the one focused on secure remote administration through encryption.

Answer

It removes the need for usernames and passwords.

Answer

It turns every management interface into a trunk.

Answer

It prevents all routing problems automatically.

Question 3

Which two actions are reasonable examples of basic device-hardening practice?

Accepted Answer

Disable unused services or interfaces where practical. Basic hardening is about reducing unnecessary exposure and making administrative access safer. In plain language, this usually means disabling services or interfaces that are not needed and preferring secure management protocols such as SSH. These choices shrink the attack surface and improve the security of routine device administration without requiring advanced security products.

The wrong answers in hardening questions often suggest convenience at the expense of security, such as leaving insecure access methods enabled or removing authentication. CCNA-level security expects you to recognize that strong fundamentals often come from disciplined configuration choices rather than from complex tools alone.

Answer

Allow anonymous administrative login for convenience

Answer

Place all traffic in VLAN 1 so it is easier to remember

Answer

Remove authentication from VTY lines

Question 4

Why might an automation script prefer a token-based API session over repeatedly prompting a human operator for credentials?

Accepted Answer

Because tokens support controlled repeated API access in a way that is practical for automation workflows.. A token-based API session is useful because it supports programmatic access in a way that is more suitable for automation than constant interactive prompts. In plain language, scripts often need to make repeated requests without a human sitting there typing a username and password every time. Tokens make that possible while still fitting into an access-control model.

This does not mean tokens are magically insecure or that authentication disappears. It means that token-based access is often more practical for software-driven workflows. The correct answer is the one centered on programmatic usability and controlled repeated access.

Answer

Because tokens eliminate the need for any security controls.

Answer

Because tokens automatically create VLANs on the switch.

Answer

Because tokens replace all routing protocols.

Question 5

Match each route source or concept to its most accurate description.

Question 6

An engineer configures a floating static route to 0.0.0.0/0 with an administrative distance of 200 while OSPF is providing a default route. What is the intended behavior?

Accepted Answer

The static default route acts as a backup and becomes active only if the OSPF default route is lost.. The intended behavior is that the static default route stays in reserve and becomes active only if the OSPF-learned default route disappears. In plain language, the administrator wants a backup path, not a replacement for the normal OSPF path. By assigning the static route a higher administrative distance than OSPF, the router treats it as less trustworthy during normal operation.

This is a standard floating-static design. The static route is still configured, but it does not normally appear as the preferred forwarding choice until the lower-distance route is lost. That is the key operational purpose of the configuration.

Answer

The static default route overrides OSPF immediately because it is manually configured.

Answer

Both default routes must always load-balance together.

Answer

The router ignores both defaults because they overlap.

Question 7

Which statement best describes why least privilege is useful for administrative accounts?

Accepted Answer

It limits unnecessary permissions so mistakes or compromise have less impact.. Least privilege is useful because even administrative or trusted users should not have more access than they actually need. In plain language, limiting permissions reduces the damage that can result from mistakes, misuse, or account compromise. It is a risk-reduction principle, not a sign that trusted users are assumed to be malicious.

This matters because broad permissions create a larger blast radius when something goes wrong. The correct answer is the one focused on limiting unnecessary exposure and impact.

Answer

It guarantees that trusted users can never make mistakes.

Answer

It replaces the need for authentication.

Answer

It requires every user to be placed in the same role.

Question 8

Why is the combination of strong authentication and centralized logging generally better than using either one alone?

Accepted Answer

Authentication helps prevent unauthorized access, while centralized logging improves visibility and investigation.. The combination is better because strong authentication helps prevent unauthorized access, while centralized logging helps detect, review, and investigate activity across the environment. In plain language, one control focuses more on prevention, while the other improves visibility and accountability. Together they create a stronger security posture than either one alone.

This is an important design mindset. Security is stronger when controls complement each other instead of trying to solve every problem with one mechanism. The correct answer is the one focused on prevention plus visibility.

Answer

They are redundant because both perform exactly the same function.

Answer

Centralized logging makes authentication unnecessary.

Answer

Strong authentication removes the need for device event records.

Question 9

Which statement best describes why SSH is safer than Telnet for remote administration?

Accepted Answer

SSH encrypts the management session, while Telnet does not.. SSH is safer because it encrypts the remote administrative session. In plain language, credentials and command traffic are protected while crossing the network, whereas Telnet sends that information in clear text. That makes SSH the preferred option for secure device management.

This is one of the most foundational security comparisons in network administration. The correct answer is the one focused on encryption in transit.

Answer

Telnet is safer because it is simpler.

Answer

SSH removes the need for usernames and passwords.

Answer

Telnet is the required protocol for VLAN trunks.

Question 10

A router has routes to 192.168.0.0/16 and 192.168.50.0/24. Which route is used for traffic to 192.168.50.99?

Accepted Answer

192.168.50.0/24. The 192.168.50.0/24 route is used because it is more specific. In practical terms, even though the /16 also matches, the router always prefers the route that describes the destination more narrowly. Since 192.168.50.99 falls inside the /24, longest-prefix match chooses that entry.

This is a basic but essential routing rule. The broader /16 still matters for other destinations in 192.168.0.0/16, but not for this one.

Answer

192.168.0.0/16

Answer

The default route

Answer

Both routes equally

Question 11

PCs in VLAN 30 on SwitchA cannot reach PCs in VLAN 30 on SwitchB. VLAN 30 exists on both switches and all other VLANs work across the same link. Based on the exhibit, what is the most likely cause?

Accepted Answer

VLAN 30 is not allowed on the trunk from SwitchA.. The trunk is up, but VLAN 30 is missing from the allowed list on SwitchA. In plain language, the hallway between the switches is open, but one side is refusing to carry that specific VLAN through the hallway. Since the other VLANs are working, the failure is selective rather than total. That strongly points to an allowed-VLAN problem rather than a broader trunk outage.

This is a classic CCNA switching scenario because it tests whether you can separate trunk health from per-VLAN forwarding. A trunk can be operational and still block one VLAN if that VLAN is not permitted on one side. The native VLAN and encapsulation are not the issue shown here — the mismatch in the allowed list is.

Answer

The native VLAN is mismatched.

Answer

The trunk must use ISL instead of 802.1Q.

Answer

VLAN 30 must be configured as the native VLAN.

Question 12

Match each HTTP method to the action it most commonly represents in a REST-style API.

Question 13

Why is administratively shutting down unused switch ports considered a useful hardening practice?

Accepted Answer

Because it reduces attack surface by removing unused active connection points.. Unused active ports create unnecessary exposure. In practical terms, if a port is not needed, leaving it active gives someone an opportunity to connect a device where no legitimate business need exists. Shutting the port down removes that access point and reduces attack surface.

This is a simple but effective hardening measure. It does not replace other controls, but it removes a risk that does not need to exist in the first place.

Answer

Because it forces all users to manage devices with SSH.

Answer

Because it converts remaining ports into trunks.

Answer

Because it replaces VLAN segmentation.

Question 14

Match each API or programmability term to its most accurate meaning.

Question 15

A router has a default route and a specific route to 203.0.113.0/24. Which route is used for traffic to 203.0.113.25?

Accepted Answer

The specific route to 203.0.113.0/24. The specific route to 203.0.113.0/24 is used because it is a more specific match than the default route. In plain language, even though the default route could technically match almost anything, the router always prefers a route that more precisely describes the destination network. Since 203.0.113.25 is inside 203.0.113.0/24, that route wins under longest-prefix match.

This is one of the most basic routing-table interpretation rules. The default route remains important as a fallback, but it is not chosen when a more specific valid route exists.

Answer

The default route

Answer

Both routes are always load-balanced

Answer

Neither route because defaults cannot coexist with specific routes

Question 16

Why is HTTPS usually preferred over HTTP when accessing a controller API?

Accepted Answer

Because HTTPS provides encrypted transport for API traffic.. HTTPS is preferred because it protects the communication with encryption while it crosses the network. In practical terms, controller APIs often carry tokens, credentials, device state, or configuration information that should not be exposed in clear text. HTTPS helps protect those requests and responses in transit.

This does not make HTTPS the same thing as JSON, nor does it remove the need for authentication. It is simply the more secure transport choice for sensitive API communication.

Answer

Because HTTPS automatically replaces authentication.

Answer

Because HTTPS is the only format that can carry JSON.

Answer

Because HTTP cannot carry controller data at all.

Question 17

A network operations team wants centralized logging from routers and switches and also wants meaningful severity filtering. Which two statements about syslog are correct?

Accepted Answer

Devices can send log messages to a remote syslog server for central storage. Syslog gives you centralized event reporting, and severity levels help decide what should be forwarded, stored, or alerted on.

Answer

Syslog is used to assign IP addresses dynamically to endpoints

Answer

Syslog entries replace SNMP counters for interface statistics

Question 18

Why is shutting down unused switch ports considered a useful hardening measure?

Accepted Answer

Because it removes unused active connection points and reduces attack surface.. Shutting down unused switch ports reduces attack surface. In practical terms, an enabled port that no legitimate device needs is an unnecessary entry point into the network. Disabling that port removes the opportunity entirely instead of trying to manage a risk that should not exist.

This is a simple control, but it is effective precisely because it removes exposure rather than just monitoring it.

Answer

Because it converts all other ports into trunks.

Answer

Because it replaces VLAN segmentation.

Answer

Because it forces devices to use SSH.

Question 19

A switchport on one side of a link is configured as a trunk, but the peer side is configured as an access port. The physical link is up, but VLAN traffic behaves unexpectedly. What is the most likely cause?

Accepted Answer

The two ends disagree on whether the link is a trunk or an access port.. The most likely cause is a switchport mode mismatch. In practical terms, one side expects the link to carry multiple VLANs with tagging behavior, while the other side treats it as a normal one-VLAN endpoint-style access connection. The physical interface can still come up, but the two ends do not agree on how the traffic should be handled.

This is a classic Layer 2 troubleshooting pattern. The link may not be fully down, but the configuration disagreement causes logical forwarding problems.

Answer

The switches must both use the same hostname.

Answer

The native VLAN must be set to 1 on both sides first.

Answer

The ports need OSPF enabled.

Question 20

Which two statements accurately describe WPA2 and WPA3 in wireless security?

Accepted Answer

Both are wireless security standards used to help protect WLAN access and traffic.. WPA2 and WPA3 are wireless security standards used to protect WLAN access and traffic. In practical terms, both are associated with securing wireless communication, but WPA3 is generally positioned as the newer standard with security improvements over WPA2. The key idea at CCNA level is recognizing them as WLAN security standards rather than confusing them with SSIDs, controllers, or radio bands.

You do not need deep protocol internals here. You need the role and relative positioning right.

Answer

Both are names for specific 802.11 radio frequencies.

Answer

WPA2 and WPA3 are types of trunk ports.

Answer

WPA3 eliminates the need for SSIDs.