CCNA Multiple Select — 20 Questions

Question 1

Which TWO statements about IPv4 and IPv6 ACLs are true?

Accepted Answer

Extended IPv4 ACLs should be placed as close to the source as possible to minimize unnecessary traffic on the network.. Extended IPv4 ACLs filter on source and destination IP addresses, ports, and protocols, so placing them as close to the source as possible prevents unwanted traffic from traversing the network, reducing bandwidth waste and security risks. This is a best practice for extended ACLs, unlike standard ACLs which should be placed close to the destination.

Answer

Standard IPv4 ACLs use numbers in the range 100-199.

Answer

Standard IPv4 ACLs filter only the source IP address and are best placed close to the source to be most effective.

Answer

Numbered ACLs allow individual access control entries (ACEs) to be deleted without removing the entire ACL.

Question 2

Which TWO statements accurately describe the characteristics and deployment considerations for fiber optic cabling in a modern enterprise network?

Accepted Answer

When using a 10GBASE-SR SFP+ transceiver over OM3 multimode fiber, the maximum supported distance is 300 meters.. The correct statements are that 10GBASE-SR over OM3 multimode fiber supports up to 300 meters and that fiber optic cabling is immune to electromagnetic interference (EMI), making it ideal for electrically noisy environments. Single-mode fiber actually has a smaller core diameter than multimode, making option A incorrect. Multimode fiber is designed for shorter links, so option B is wrong. Standard 1000BASE-LX SFP transceivers over single-mode fiber are limited to 5 km, not 10 km, so option C is inaccurate.

Answer

Single-mode fiber (SMF) typically uses a larger core diameter than multimode fiber (MMF).

Answer

Multimode fiber (MMF) is generally preferred for longer-distance links, such as between buildings on a campus network.

Answer

A 1000BASE-LX SFP transceiver operating over single-mode fiber can support distances up to 10 km.

Question 3

Which TWO statements correctly describe the behavior of standard ACLs and their placement on interfaces?

Accepted Answer

Standard ACLs filter traffic based on source IP address only.. Standard ACLs filter traffic based solely on the source IP address, using numbers 1–99 or 1300–1999 in classic Cisco IOS. They do not consider destination IP, protocol, or port numbers. Because they lack granularity, placing them close to the destination (option D) prevents them from inadvertently blocking traffic that should be permitted, as they cannot distinguish between traffic destined for different services on the same destination host.

Answer

Standard ACLs should be placed as close to the source as possible.

Answer

Standard ACLs can filter traffic based on destination IP address.

Answer

Standard ACLs can filter traffic based on TCP or UDP port numbers.

Question 4

A branch router is running single-area OSPF. An engineer wants an interface to advertise its connected network into OSPF but must prevent hello packets from being sent on that LAN segment. Which two actions achieve that goal?

Accepted Answer

Enable OSPF on the interface or matching network statement. In OSPF, a passive interface still advertises the connected network but does not send or process hello packets. So the interface must participate in OSPF, and then it must be made passive.

Answer

Set the interface network type to point-to-point

Answer

Apply distribute-list out on the interface

Question 5

Which THREE statements accurately describe the characteristics of NETCONF and RESTCONF for programmatic network configuration?

Accepted Answer

NETCONF uses XML-encoded RPCs over a secure transport such as SSH or TLS.. NETCONF uses XML-encoded Remote Procedure Calls (RPCs) over a secure transport such as SSH or TLS, making option B correct. RESTCONF supports both XML and JSON encoding and uses standard HTTP methods (GET, POST, PUT, PATCH, DELETE), so option C is correct. Both NETCONF and RESTCONF rely on YANG data models to define the structure of configuration and operational data, confirming option D. Option A is incorrect because NETCONF does not use HTTP methods; that is a characteristic of RESTCONF. Option E is wrong because RESTCONF does not use a separate commit operation; changes are applied immediately with each HTTP request, unlike NETCONF's candidate config and commit model.

Answer

NETCONF uses HTTP methods such as GET, POST, PUT, and DELETE to manipulate configuration data.

Answer

NETCONF uses a separate commit operation to apply changes, while RESTCONF uses a similar commit mechanism.

Question 6

A router has learned route 172.16.50.0/24 from OSPF with cost 20 and also has a static route to the same prefix with administrative distance 5. Which two statements are correct about route selection?

Accepted Answer

The static route is installed because it has the lower administrative distance. When the same prefix is learned from different routing sources, the router first compares administrative distance (AD). The static route with AD 5 wins over OSPF with AD 110, so option A is correct. Option C is correct because if the static route is removed, the OSPF route becomes the next best candidate and is installed. Option B is wrong since AD is compared before metrics like OSPF cost; a lower cost does not override a lower AD. Option D is wrong because only one route is installed per destination based on AD, not both.

Answer

The OSPF route is installed because cost 20 is lower than metric 0

Answer

Both routes are installed as equal-cost paths automatically

Question 7

Which TWO commands can a network technician use on a modern Linux host to verify the IP address configuration and test reachability to a remote server?

Accepted Answer

ip addr. The `ip addr` command (option A) is the modern Linux utility for displaying IP address configuration, replacing the deprecated `ifconfig`. The `ping` command (option D) uses ICMP Echo Request/Reply messages to test Layer 3 reachability to a remote server. `ifconfig` (option B) is deprecated and not expected for current certification exams; `tracert` (option C) is a Windows command; `nslookup` (option E) performs DNS lookups but does not verify IP configuration or connectivity.

Answer

ifconfig

Answer

tracert

Answer

nslookup

Question 8

Which TWO interface errors are most likely caused by a mismatch in duplex settings between two connected switches?

Accepted Answer

Runts. A duplex mismatch occurs when one switch operates at full duplex while the other operates at half duplex. On the half-duplex side, frames arriving while the interface is transmitting are considered collisions, causing the frame to be truncated into fragments (runts). On the full-duplex side, the switch does not detect collisions but may receive incomplete frames, which are counted as runts if they are less than 64 bytes. CRC errors also spike because the truncated or corrupted frames fail the Frame Check Sequence (FCS) validation.

Answer

Giants

Answer

Input errors

Answer

Output errors

Answer

Flaps

Question 9

Which two statements accurately describe the relationship between a network address and a broadcast address in IPv4 subnetting?

Accepted Answer

The network address is the first address in the subnet block.. The network address identifies the beginning of the subnet block, and the broadcast address identifies the final address in that block. In practical terms, both are reserved and are not assigned to ordinary hosts. The usable host range falls between them.

This is a very basic subnetting truth, but it is foundational for every other addressing calculation.

Answer

Both addresses are normal host addresses that can be assigned to users.

Answer

The broadcast address always becomes the default gateway.

Answer

These concepts exist only in IPv6 and not IPv4.

Question 10

Which THREE statements correctly describe the configuration and verification of NAT, PAT, and static NAT?

Accepted Answer

To configure static NAT, use the command 'ip nat inside source static

'.. The 'ip nat inside source static' command creates a one-to-one permanent NAT mapping. Option B is correct because PAT is configured by adding the 'overload' keyword to a dynamic NAT statement that references an ACL and an interface, allowing many private addresses to share a single public IP with different port numbers. Option D is correct: dynamic NAT requires a NAT pool defined with 'ip nat pool' and an access list to identify the inside traffic to be translated. Option C is incorrect because 'show ip nat statistics' only displays counters and summary information, not the active translation entries; those are shown with 'show ip nat translations'. Option E is incorrect because 'show ip interface brief' does not show NAT translation mappings; verification of static NAT requires 'show ip nat translations'.

Answer

The command 'show ip nat statistics' displays the current active translations including inside and outside addresses.

Answer

To verify that static NAT is working, you should check the output of 'show ip interface brief' and look for the translated IP.

Question 11

Which TWO statements accurately describe how AI and ML concepts are applied to network operations?

Accepted Answer

Intent-based networking translates business intent into network policies and continuously validates that the network meets those intentions.. Intent-based networking (IBN) captures business intent in a declarative model, translates it into network policies (e.g., via Cisco DNA Center), and continuously validates that the network state matches the intended outcome using assurance and closed-loop analytics. Option B is correct because anomaly detection leverages ML models to establish a baseline of normal traffic and then flags deviations, which can indicate security threats or performance issues. Option C is incorrect because predictive analytics forecasts future network conditions but does not automatically reconfigure devices; that requires closed-loop automation. Option D is false because ML models in network operations are not trained exclusively on labeled data; unsupervised learning can detect unknown patterns without labeled datasets. Option E is false because rule-based systems cannot adapt to new, unknown patterns without manual updates, whereas ML models are better suited for anomaly detection due to their ability to learn and generalize from data.

Answer

Predictive analytics uses historical data to forecast future network conditions and automatically reconfigures network devices to prevent issues.

Answer

ML models in network operations are trained exclusively on labeled datasets to detect known attack signatures.

Answer

Rule-based systems are preferred over ML for anomaly detection because they can adapt to new, unknown patterns without manual updates.

Question 12

A support engineer is explaining why a host uses ARP before sending a frame on an Ethernet LAN. Which two statements are correct?

Accepted Answer

ARP resolves an IPv4 address to a MAC address. On Ethernet, the sender needs a destination MAC address. For remote destinations, that usually means ARPing for the default gateway's MAC.

Answer

ARP is used to discover the remote router's OSPF router ID

Answer

ARP replaces DNS for hostname resolution

Question 13

Which two features commonly strengthen access-switch security for user-facing ports? (Choose two.)

Accepted Answer

Port security. Port security can limit learned MAC addresses, and BPDU Guard can shut down an edge port that unexpectedly receives BPDUs.

Answer

Administrative distance

Answer

Route summarization

Question 14

A switch should learn one MAC address on an access port and shut the port down if a second unauthorized device appears. Which two port-security settings support that requirement?

Accepted Answer

switchport port-security maximum 1. Port security enforces how many MAC addresses may be learned on a port and what happens when a violation occurs. 'switchport port-security maximum 1' limits the port to one MAC address, and 'switchport port-security violation shutdown' disables the port if a violation occurs, matching the requirement. 'switchport protected' isolates ports within a switch but does not limit MAC addresses or cause a shutdown. 'switchport nonegotiate' disables DTP negotiation, which is unrelated to port security.

Answer

switchport protected

Answer

switchport nonegotiate

Question 15

A script authenticates to a controller API and receives a token that it presents in later requests. Which two statements about that token-based workflow are correct?

Accepted Answer

The token is often sent in an HTTP header in subsequent requests. After authentication, many APIs issue a token that the client includes in later HTTP requests. That token acts as proof that the client already authenticated successfully.

Answer

The token changes the API from REST to SNMP

Answer

The token must be stored in the router startup-config

Question 16

Which two statements accurately describe DNS and DHCP?

Accepted Answer

DNS resolves names to IP information, while DHCP dynamically assigns addressing information to clients.. DNS and DHCP solve very different problems, even though both are common infrastructure services. DNS helps devices and users find systems by name. In simple terms, it means people can type a hostname rather than memorizing numeric IP addresses. DHCP automatically gives clients important IP settings such as an address, subnet mask, default gateway, and often DNS server information.

The trick in comparison questions is not to blend their roles together. DHCP does not perform NAT, and it does not eliminate the need for addressing details; it actually supplies them.

Answer

DHCP is used primarily to translate private addresses into public addresses.

Answer

DHCP replaces the need for subnet masks and default gateways.

Answer

DNS and DHCP are both Layer 1 technologies.

Question 17

Which two statements about ARP on an IPv4 Ethernet network are correct? (Choose two.)

Accepted Answer

An ARP request is sent as a Layer 2 broadcast.. ARP resolves an IPv4 address to a MAC address on the local segment. ARP requests are broadcast; ARP replies are typically unicast.

Answer

ARP is used to map IPv6 addresses to MAC addresses.

Answer

ARP is forwarded by routers across subnets by default.

Question 18

Which TWO statements correctly describe differences between 802.11ac (Wi-Fi 5) and 802.11ax (Wi-Fi 6)?

Accepted Answer

802.11ax supports 1024-QAM modulation, whereas 802.11ac supports up to 256-QAM.. Options B and D are correct. 802.11ax (Wi-Fi 6) introduces 1024-QAM for higher data rates (B), while 802.11ac maxes at 256-QAM. Additionally, 802.11ax supports both 2.4 GHz and 5 GHz bands, whereas 802.11ac is limited to 5 GHz only (D). Option A is incorrect because it reverses the roles: 802.11ac uses OFDM, and 802.11ax uses OFDMA. Option C is incorrect because 802.11ax also operates in 2.4 GHz. Option E is incorrect because Target Wake Time (TWT) is introduced in 802.11ax, not 802.11ac.

Answer

802.11ac uses OFDMA, while 802.11ax uses only OFDM.

Answer

Both 802.11ac and 802.11ax operate exclusively in the 5 GHz band.

Answer

802.11ac introduces target wake time (TWT) for improved power saving, but 802.11ax does not support it.

Question 19

Which two statements about OSPF neighbor requirements on a shared Ethernet segment are correct? (Choose two.)

Accepted Answer

They must be in the same OSPF area on that link.. Neighbors must agree on key parameters such as area ID and subnet, and they exchange Hello packets on the segment.

Answer

They must have identical router IDs.

Answer

They must use the same process ID number on both routers.

Question 20

Which two statements about YANG are correct?

Accepted Answer

It defines structured models for configuration and state data. YANG is a data modeling language used to describe configuration and operational state. It is commonly used with NETCONF and RESTCONF, but it is not itself the transport protocol.

Answer

It is a replacement for OSPF adjacency formation

Answer

It is the same thing as JSON syntax

Answer

It automatically discovers neighbors on a LAN