CCNA Matching — 50 Questions

Question 1

Drag and drop the AAA terms on the left to their correct definitions on the right.

Accepted Answer

Authentication: Verifies the identity of a user or device before granting access to the network.. AAA components: Authentication verifies identity, Authorization controls access, Accounting logs activities. RADIUS is an open standard that combines authentication and authorization, while TACACS+ is a Cisco proprietary protocol that separates all three functions.

Answer

Authorization: Determines what actions or resources an authenticated user is permitted to access.

Answer

Accounting: Logs and tracks user activities, such as login times, commands executed, and data usage.

Answer

RADIUS: A protocol that provides centralized authentication, authorization, and accounting for network access.

Question 2

Match each routing term to its description.

Accepted Answer

System routes: Default routes automatically created by the system.. Administrative distance is the trustworthiness rating of a routing protocol, where a lower number means higher trust. Metric is a value used by a routing protocol to select the best path among multiple routes from that same protocol. A default route is the path of last resort, used when no other specific route matches the destination. Summarization (route aggregation) combines several network prefixes into a smaller set of advertised prefixes, improving efficiency.

Answer

UDRs: Routes that are dynamically exchanged with on-premises networks.

Answer

BGP routes: Routes that override system routes when manually configured.

Answer

System routes: Routes that are dynamically exchanged with on-premises networks.

Question 3

Match each security concept to its most accurate meaning.

Accepted Answer

Phishing: A social engineering attack that tricks users into revealing sensitive information such as usernames and passwords.. Confidentiality ensures data is not disclosed to unauthorized parties; integrity prevents unauthorized modification of data; availability guarantees systems and data are accessible when needed; least privilege limits access rights to the minimum necessary. The correct matches reflect these core security principles.

Answer

Phishing: A type of malware that encrypts files and demands payment for decryption.

Answer

Phishing: An attack that overwhelms a network with traffic to disrupt services.

Answer

Phishing: An attack that intercepts communications between two parties to steal data.

Question 4

Drag and drop the wireless terms on the left to the correct descriptions on the right.

Accepted Answer

SSID: The network name broadcast by an access point to identify the wireless network.. 802.11ac (Wi-Fi 5) operates only in the 5 GHz band and introduced support for 160 MHz-wide channels to achieve higher throughput. 802.11ax (Wi-Fi 6) adds OFDMA for more efficient channel use and works in both 2.4 GHz and 5 GHz bands. WPA3-Personal uses SAE (Simultaneous Authentication of Equals) to protect pre-shared key authentication against offline dictionary attacks. A Basic Service Set (BSS) consists of a single AP and its associated clients, identified by the AP's radio MAC address (BSSID). A Wireless LAN Controller (WLC) centralizes management, handling AP configuration, client roaming, and security policies across the wireless network.

Answer

BSSID: The MAC address of the access point's radio interface, used to uniquely identify a BSS.

Answer

RSSI: A measurement of the power level of the received radio signal, indicating signal strength.

Answer

DFS: A mechanism that allows wireless devices to avoid interference with radar systems by dynamically selecting channels.

Question 5

Drag each automation or API concept from the left to its corresponding description on the right. Not all descriptions are used.

Concepts:
- Northbound API
- Southbound API
- JSON
- HTTPS

Accepted Answer

Application-facing interface to the controller. Northbound API: the application-facing interface of an SDN controller, allowing apps to request services. Southbound API: the interface that enables the controller to configure managed devices, such as OpenFlow. JSON: a structured data format using key/value pairs and arrays, lightweight and machine‑friendly. HTTPS: secure, encrypted transport for API communications, protecting data in transit. Distractors: 'Human-readable serialization format' describes YAML, not JSON or APIs. 'Protocol for network device configuration' might refer to NETCONF or CLI, not HTTPS or the APIs listed.

Question 6

Drag and drop the wireless LAN terms on the left to the correct descriptions on the right.

Accepted Answer

Access Point (AP). 802.11ac (Wi-Fi 5) operates exclusively in the 5 GHz band and uses wide channels (80/160 MHz) for high throughput. 802.11ax (Wi-Fi 6) introduces OFDMA for efficiency and supports both 2.4 GHz and 5 GHz. WPA3 enhances security with Simultaneous Authentication of Equals (SAE), replacing WPA2's Pre-Shared Key (PSK) to resist brute-force attacks. The SSID is the human-readable network name broadcast by access points. Channel overlap is a critical issue in the 2.4 GHz band because only three channels (1, 6, 11) are non-overlapping. WLC management interfaces commonly use HTTPS, SSH, or console for secure configuration.

Answer

Service Set Identifier (SSID)

Answer

Basic Service Set (BSS)

Answer

Wireless LAN Controller (WLC)

Question 7

Match each security control or idea to its most accurate purpose.

Accepted Answer

Firewall: Filters traffic based on security rules. SSH encrypts remote CLI sessions, ensuring secure management access. AAA is a framework that defines how users are authenticated, what they are authorized to do, and how their actions are accounted for. The least privilege principle restricts users to only the permissions essential for their role, minimizing potential damage. Syslog collects and centralizes log messages from devices, providing visibility into network events and aiding in troubleshooting and security monitoring.

Answer

Firewall: Detects and alerts on suspicious activity

Answer

Firewall: Prevents and blocks intrusions in real time

Answer

Firewall: Authenticates users and manages access rights

Question 8

Drag and drop the PDU names on the left to the correct OSI model layers on the right.

Accepted Answer

Segment: Transport layer PDU (TCP segment).. The correct matches are: Segment → Transport layer PDU, Packet → Network layer PDU, Frame → Data Link layer PDU, Bits → Physical layer PDU, and Data → Application layer PDU. No encapsulation term is included in this exercise.

Question 9

Match each management or monitoring concept to its most accurate role.

Accepted Answer

SIEM: Centralizes and correlates log data from multiple sources for security analysis.. SSH provides encrypted remote administration by encrypting the entire session, unlike unsecured protocols like Telnet. AAA is the foundational framework for network access control, covering who can authenticate, what operations they are authorized to perform, and what they did via accounting. Syslog enables centralized collection of event and log messages from multiple devices for monitoring and troubleshooting. NTP synchronizes system clocks across network devices, ensuring consistent timestamps for logging and security functions.

Answer

SIEM: Manages network device configurations and monitors device health via SNMP.

Answer

SIEM: Analyzes network traffic flows to identify bandwidth usage and application performance.

Answer

SIEM: Controls user access to network resources based on roles and policies.

Question 10

Match each IP service symptom to the most likely service involved.

Accepted Answer

DNS failures prevent name resolution. Hostnames fail but direct IP access works because DNS resolves names to IP addresses; without DNS, name resolution stops while IP connectivity remains intact. Clients not receiving IP configuration automatically indicates a DHCP failure, since DHCP is the service responsible for dynamic address assignment. Log timestamps differing noticeably between devices points to an NTP issue, as NTP synchronizes clocks across the network. Administrators wanting one place to collect device events rely on Syslog, which centralizes event messages from multiple devices.

Answer

Packet loss causes intermittent connectivity

Answer

Bandwidth congestion slows transfers

Answer

Jitter affects real-time services

Question 11

Match each automation-related data term to the most accurate description.

Accepted Answer

Ansible. JSON is a lightweight data-interchange format that uses human-readable text to store and transmit data objects. An array in structured data is an ordered collection of items, indexed by integers. A key is a unique identifier used to map to a value in a key-value pair, such as in JSON objects. YANG is specifically a data modeling language designed for defining configuration and state data for network devices, often used with NETCONF/RESTCONF.

Answer

Puppet

Answer

Chef

Answer

SaltStack

Question 12

Match each IPv4-related concept to its most accurate role.

Accepted Answer

IPv4 address. The subnet mask defines the network and host portions of an IP address, allowing a host to determine which destinations are on the local subnet versus remote. The default gateway is the local router that forwards traffic destined for other subnets. The broadcast address is used to send a packet to all hosts within the local subnet simultaneously. The host address uniquely identifies one specific device on that subnet.

Answer

Subnet mask

Answer

Default gateway

Answer

DNS server

Question 13

Drag and drop the switch port configuration commands on the left to the correct descriptions on the right.

Question 14

Drag and drop the items on the left to the correct descriptions on the right.

Question 15

Drag and drop the items on the left to the correct descriptions on the right.

Question 16

Drag and drop the items on the left to match the descriptions on the right.

Question 17

Drag and drop the items on the left to match the descriptions on the right.

Question 18

Match each trunking or switchport term to its most accurate description.

Accepted Answer

Trunk port: Carries traffic for multiple VLANs using tagging. These terms define how switchports handle VLAN traffic in trunking environments.

Question 19

Drag and drop the DNS record types on the left to the correct descriptions on the right.

Accepted Answer

A record: Maps a domain name to an IPv4 address. These are standard DNS record types as defined in RFCs and tested in networking certifications like CCNA.

Answer

AAAA record: Maps a domain name to an IPv6 address

Answer

CNAME record: Maps an alias domain name to another canonical domain name

Answer

MX record: Maps a domain name to a mail exchange server

Question 20

Drag and drop the cable/transceiver types on the left to the correct distance and speed descriptions on the right.

Accepted Answer

Cat5e UTP: 100 meters, 1 Gbps. These pairings reflect typical maximum distances and speeds for common Ethernet cabling and transceivers, as per IEEE standards.

Answer

Cat6 UTP: 100 meters, 10 Gbps

Answer

Single-mode fiber with 1000BASE-LX: 5 km, 1 Gbps

Answer

Multimode fiber with 1000BASE-SX: 550 meters, 1 Gbps