Cisco Certified Network Associate (CCNA) practice questions

Question 1

A senior network engineer is reading debug ip ospf adj output is evaluating documented behavior and must decide the documented neighbor state progression. Per the Cisco OSPF documentation, which option matches?

Accepted Answer

OSPF neighbor states progress through Down, Init, Two-Way, ExStart, Exchange, Loading, and Full

Answer

OSPF neighbor states progress through Idle, Active, Established, Mature, and Pending in five well-defined phases

Answer

OSPF neighbor states progress through Listening, Learning, Forwarding, Blocking, and Disabled

Answer

OSPF neighbor states progress through Open, OpenSent, OpenConfirm, and Established as defined by RFC 4271

Question 2

A network admin is evaluating an issue while troubleshooting why a PAgP EtherChannel never forms between two Cisco switches. Per the Cisco EtherChannel documentation, which option matches the documented PAgP mode pair?

Accepted Answer

Port Aggregation Protocol (PAgP) is Cisco proprietary with desirable (initiates) and auto (responds only) modes

Answer

PAgP is the IEEE standards-based aggregation protocol with active and passive modes for any vendor interoperability

Answer

PAgP has no negotiation modes; it always forms a bundle unconditionally when interfaces share matching speeds

Answer

PAgP uses on and off modes only, with on forming an immediate bundle and off disabling EtherChannel completely

Question 3

A junior tech notices an interface auto-configures an FE80:: address even before SLAAC completes is evaluating documented behavior and must decide to the senior engineer why this happens. Per the Cisco IPv6 documentation, which option matches?

Accepted Answer

Link-Local addresses (FE80::/10) are auto-configured on every IPv6-enabled interface and used for neighbor discovery, routing protocol communications, and next-hop addresses

Answer

Link-Local addresses (2000::/3) are publicly routable and require ISP delegation before any IPv6 interface can come up

Answer

Link-Local addresses (FF00::/8) are multicast group addresses used only for joining well-known IPv6 multicast groups

Answer

Link-Local addresses (FC00::/7) are unique local addresses used as a replacement for RFC 1918 ranges in IPv6 networks

Question 4

An architect is evaluating documented behavior and must decide. A senior network engineer is building a site-to-site VPN between two enterprise gateways. Per the Cisco IPsec documentation, which option matches the documented IPsec mode?

Accepted Answer

Tunnel mode (default) encrypts the entire original IP packet and adds a new IP header, used for site-to-site VPNs between gateways

Answer

Tunnel mode encrypts only the payload and preserves the original IP header for site-to-site VPN gateways

Answer

Tunnel mode is a Layer 2 GRE technology that runs over Frame Relay and does not perform any encryption at all

Answer

Tunnel mode is deprecated and Cisco recommends transport mode for every site-to-site VPN today

Question 5

A senior network engineer is evaluating documented behavior and must decide what controller-based networking changes about plane separation. Per the Cisco REST API documentation, which option matches?

Accepted Answer

Controller-based (software-defined) networking separates the control plane (routing decisions, managed by the controller) from the data plane (packet forwarding, handled by network devices)

Answer

Controller-based networking merges control plane and data plane onto a single device and removes the controller entirely

Answer

Controller-based networking moves the data plane into the cloud and leaves the control plane on every device unchanged

Answer

Controller-based networking eliminates the data plane completely and forwards every packet through the controller in real time

Question 6

An architect is evaluating documented behavior and must decide. A senior network engineer is configuring internet egress for hundreds of internal users sharing a single public IP. Per the Cisco NAT documentation, which option matches PAT?

Accepted Answer

Port Address Translation (PAT), also called NAT overload, maps multiple inside local addresses to a single inside global address by using unique source port numbers to distinguish sessions, configured by adding the overload keyword

Answer

Port Address Translation (PAT) maps a single inside local address to many inside global addresses on a one-to-many basis in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Answer

Port Address Translation (PAT) operates only at Layer 2 by rewriting source MAC addresses without altering IP headers in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Answer

Port Address Translation (PAT) is implemented inside the upstream DNS server and is not a router-side feature in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Question 7

An architect is being asked which FHRP provides both redundancy and active-active load balancing across multiple routers in the same group. Per the Cisco FHRP documentation, which option matches?

Accepted Answer

Gateway Load Balancing Protocol (GLBP) is Cisco proprietary and provides both redundancy and load balancing by assigning different virtual MAC addresses to multiple Active Virtual Forwarders within the same virtual IP group

Answer

Gateway Load Balancing Protocol (GLBP) is a standards-based protocol that load-balances exclusively over IPsec tunnels in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Answer

Gateway Load Balancing Protocol (GLBP) is a deprecated form of HSRP with no load-balancing capability whatsoever in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Answer

Gateway Load Balancing Protocol (GLBP) operates only at Layer 2 and exists purely to alternate STP root bridges in the VLAN in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Question 8

An architect is evaluating documented behavior and must decide. A network admin is documenting how a multi-vendor network shares discovery data across non-Cisco hardware. Per the Cisco CDP documentation, which option matches?

Accepted Answer

Link Layer Discovery Protocol (LLDP, IEEE 802.1AB) is the standards-based alternative to CDP, operating similarly but with vendor-neutral interoperability

Answer

Link Layer Discovery Protocol (LLDP, IEEE 802.3ad) is the link aggregation protocol used to bundle vendor-neutral ports together

Answer

Link Layer Discovery Protocol (LLDP, IEEE 802.1Q) is the VLAN tagging protocol that replaces CDP for vendor interoperability

Answer

Link Layer Discovery Protocol (LLDP) is a Cisco proprietary protocol that operates only between Cisco-branded equipment

Question 9

A senior network engineer is evaluating documented behavior and must decide to a junior tech why a MAC entry disappears after a silent host is unplugged. Per the Cisco Layer 2 switching documentation, which option matches the documented default aging behavior?

Accepted Answer

MAC address table entries age out after a configurable timer (default 300 seconds on Cisco switches)

Answer

MAC address table entries never age out by default and must be manually cleared with each ARP table flush

Answer

MAC address table entries age out every 5 milliseconds by default to keep the CAM table empty at all times

Answer

MAC address table entries age out every 86,400 seconds (24 hours) by default per IEEE 802.1Q requirements

Question 10

A junior tech is being onboarded is evaluating documented behavior and must decide the documented distinction between threats, vulnerabilities, and exploits. Per the Cisco security concepts documentation, which option matches?

Accepted Answer

threats are potential events that can cause harm (malware, phishing, DDoS, social engineering, insider threats); vulnerabilities are weaknesses in systems that threats can exploit (unpatched software, misconfigured devices, weak passwords, open ports); exploits are the methods or tools used to take advantage of vulnerabilities

Answer

threats are confirmed compromises that already breached the network; vulnerabilities are firewalls; exploits are accidental misconfigurations only in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Answer

threats are user accounts that have failed authentication three times; vulnerabilities are passwords; exploits are RADIUS attribute mismatches in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Answer

threats, vulnerabilities, and exploits are interchangeable synonyms for any negative security finding from a vulnerability scanner in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Question 11

A network developer is evaluating documented behavior and must decide why Ansible is well-suited for network device automation. Per the Cisco automation documentation, which option matches?

Accepted Answer

Ansible is particularly well-suited for network automation because it is agentless (no software installation on managed devices), uses YAML-based playbooks that are human-readable, and has extensive Cisco-specific modules for IOS, IOS-XE, NX-OS, and ACI

Answer

Ansible requires installing a kernel module on every managed router before any playbook can run successfully in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Answer

Ansible uses binary configuration files only and does not support YAML, making it unsuitable for human-readable playbooks in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Answer

Ansible is a Cisco-only product that does not integrate with non-Cisco vendors or community modules at all in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Question 12

A junior tech is evaluating documented behavior and must decide which command displays the NAT translation table on a router. Per the Cisco NAT documentation, which TWO options match the documented capability?

Accepted Answer

NAT maintains a translation table viewable with show ip nat translations

Accepted Answer

Port Address Translation (PAT), also called NAT overload, maps multiple inside local addresses to a single inside global address by using unique source port numbers to distinguish sessions, configured by adding the overload keyword

Answer

NAT translations are visible only through a debug ip nat detail command, and there is no operational show command in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Answer

NAT translations are exposed only as SNMP OIDs to an external NMS and cannot be queried from the CLI in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Question 13

A senior network engineer is evaluating an issue while troubleshooting an OSPF process that picked an unexpected router ID after a reboot. Per the Cisco OSPF documentation, which option matches the documented router ID selection order?

Accepted Answer

The OSPF router ID is selected as: (1) explicitly configured value, (2) highest loopback IP address, or (3) highest active interface IP address

Answer

The OSPF router ID is selected as the lowest configured interface IP address regardless of whether a loopback exists

Answer

The OSPF router ID is always equal to the device's MAC address converted to dotted-decimal format with no override possible

Answer

The OSPF router ID is generated randomly at process start and rotates every 24 hours unless explicitly fixed in NVRAM

Question 14

A regional MSP is recommending centralized cloud management for SMB customers is evaluating documented behavior and must decide which Cisco platforms offer dashboard-based management. Per the Cisco management access documentation, which option matches?

Accepted Answer

Cloud-managed platforms like Cisco Meraki and Catalyst Center provide centralized dashboard-based management accessed through a web browser, with configuration pushed to devices over secure channels

Answer

Cloud-managed platforms require manual Telnet-only configuration to each device and have no central dashboard or push-mechanism in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Answer

Cloud-managed platforms require an on-premises X.25 packet switch as the only supported transport into the dashboard layer in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Answer

Cloud-managed platforms are deprecated for enterprise use and only Tcl scripting on the device is supported for automation in standard Cisco IOS XE deployments, which contradicts the documented behavior described in the official guide for this feature on Catalyst and ISR platforms

Question 15

A university IT team is evaluating documented behavior and must decide why their hierarchical design dedicates a separate core layer instead of collapsing it into distribution. Per the Cisco IOS XE documentation, which option matches the documented role of the core?

Accepted Answer

the core layer provides high-speed backbone transport between distribution switches

Answer

the core layer terminates end-user copper drops and provides PoE to access points and IP phones

Answer

the core layer hosts the DHCP server pools and the on-premises DNS resolver for all VLANs

Answer

the core layer is a Layer 7 application proxy that inspects HTTP requests and caches static content

Cisco Certified Network Associate (CCNA)

Sample questions

Sources

Similar exams