Cisco Certified Network Associate (CCNA) — Practice Set 1

Question 1

A network engineer is explaining the Ethernet frame structure to a junior technician. Which field in an Ethernet frame contains the source and destination Layer 2 addresses used for delivery within a single network segment?

Accepted Answer

An Ethernet frame header contains the Destination MAC Address (6 bytes) and Source MAC Address (6 bytes) used for Layer 2 delivery within a broadcast domain. The IP header is an encapsulated Layer 3 construct inside the frame payload. The EtherType field identifies the network-layer protocol (e.g., 0x0800 for IPv4, 0x86DD for IPv6). The FCS is a 4-byte trailer used for error detection via cyclic redundancy check (CRC).

Question 2

A client initiates a TCP connection to a web server. In the correct order, which sequence of messages is exchanged during the TCP three-way handshake?

Accepted Answer

The TCP three-way handshake proceeds as follows: (1) The client sends a SYN (synchronize) segment to the server to initiate the connection. (2) The server responds with a SYN-ACK (synchronize-acknowledge) to confirm receipt and synchronize its own sequence number. (3) The client sends an ACK (acknowledge) to confirm the server's SYN, completing the handshake and establishing the connection. All other sequences are incorrect.

Question 3

A Cisco router has the following IPv4 subnets configured on its interfaces. Which of these addresses is a valid host address for the subnet 192.168.5.64/26?

Accepted Answer

The subnet 192.168.5.64/26 has a block size of 64. The network address is 192.168.5.64 and the broadcast address is 192.168.5.127 (64 + 64 − 1). Usable host addresses are 192.168.5.65 through 192.168.5.126. 192.168.5.63 is the broadcast of the preceding subnet (192.168.5.0/26). 192.168.5.64 is the network address (not assignable). 192.168.5.127 is the broadcast address (not assignable). 192.168.5.100 falls within the valid host range.

Question 4

A Cisco IOS router is connected to a new switch. A technician logs in and needs to enter a command to set the device hostname. Which CLI mode must the technician be in to execute the `hostname` command?

Accepted Answer

The `hostname` command is a global configuration command and must be entered in global configuration mode (Router(config)#), accessed by running `configure terminal` from privileged EXEC mode. User EXEC mode provides limited read-only commands. Privileged EXEC mode allows show and debug commands and entering configuration modes, but the `hostname` command itself is not available there. Interface configuration mode is used for interface-specific settings.

Question 5

How does a switch differ from a hub in terms of collision domains?

Accepted Answer

A switch creates a separate collision domain per port, because each port can operate in full-duplex mode with buffering, eliminating collisions entirely. A hub is a shared medium — all ports share a single collision domain, so only one device can transmit at a time. Routers separate broadcast domains but also create separate collision domains. Switches do not separate broadcast domains by default (all ports are in the same broadcast domain unless VLANs are configured).

Question 6

A switch port is configured as a trunk port using 802.1Q encapsulation. What information does the 802.1Q tag insert into an Ethernet frame?

Accepted Answer

IEEE 802.1Q inserts a 4-byte tag between the Source MAC address and the EtherType field of an Ethernet frame. The tag contains a 16-bit Tag Protocol Identifier (TPID, value 0x8100), a 3-bit Priority Code Point (PCP/CoS), a 1-bit Drop Eligible Indicator (DEI), and a 12-bit VLAN ID (supporting VLANs 1–4094). The tag does not contain IP or port information, does not replace MAC addresses, and is not appended to the end of the frame.

Question 7

A network administrator observes a switch port that remains in the 'Blocking' state even though it is not the root port or a designated port. Which Spanning Tree Protocol (STP) state comes AFTER 'Listening' in the standard 802.1D port state progression?

Accepted Answer

In IEEE 802.1D STP, the port state progression is: Blocking → Listening → Learning → Forwarding (with Disabled as a manually disabled state). After the Listening state (15 seconds, processes BPDUs only), the port transitions to the Learning state (15 seconds, builds MAC address table without forwarding frames), and then to Forwarding. 'Designated' is a port role, not a port state. The full convergence takes approximately 50 seconds (20-second max age + 15-second listening + 15-second learning).

Question 8

A network engineer configures an EtherChannel between two switches. The channel does not come up. The engineer verifies the following configuration on Switch A:

interface range GigabitEthernet0/1 - 2
   channel-group 1 mode active

Switch B is configured with:

interface range GigabitEthernet0/1 - 2
   channel-group 1 mode on

Why does the EtherChannel fail to form?

Accepted Answer

Mode 'on' statically forces the EtherChannel without using any negotiation protocol (no LACP or PAgP). LACP mode 'active' sends LACP PDUs expecting a negotiating peer. Because 'on' ignores all negotiation PDUs, the LACP-active side never receives valid LACP responses, and the channel does not form. For LACP, valid pairings are active/active or active/passive. For PAgP, valid pairings are desirable/desirable or desirable/auto. Mode 'on' only works when both sides are 'on'. Channel-group numbers are locally significant and do not need to match across switches.

Question 9

A wireless LAN controller (WLC) manages multiple lightweight access points across a building. An engineer adds a new access point to the network. Which protocol does the lightweight AP use to establish a control channel with the WLC?

Accepted Answer

Lightweight Access Point Protocol (LWAPP) and its successor Control and Provisioning of Wireless Access Points (CAPWAP) are the protocols used to establish a control tunnel between a lightweight AP and a Wireless LAN Controller (WLC). CAPWAP uses UDP port 5246 for control traffic and 5247 for data traffic. SNMP is a network management protocol. Telnet provides CLI management but is not the AP-to-WLC control protocol. STP is a Layer 2 loop prevention protocol unrelated to wireless.

Question 10

A network administrator needs to configure a switch port so that it belongs to VLAN 30 and carries traffic for that VLAN only. Which IOS commands correctly configure the port GigabitEthernet0/1 as an access port in VLAN 30?

Accepted Answer

To configure an access port, you first set `switchport mode access` to lock the port to access mode, then assign it with `switchport access vlan 30`. Using `switchport mode trunk` with `allowed vlan 30` creates a trunk port (carries 802.1Q tagged traffic), not an access port. The `switchport trunk native vlan` command applies to trunk ports only. The `vlan` command under an interface is not valid IOS syntax — VLANs are created with the `vlan` command in global config mode.

Question 11

A network engineer needs to configure a static default route on a router so that all traffic with no more-specific match is forwarded to the next-hop address 10.0.0.1. Which IOS command accomplishes this?

Accepted Answer

The static default route in Cisco IOS is configured with `ip route 0.0.0.0 0.0.0.0 <next-hop>`. The network 0.0.0.0 with subnet mask 0.0.0.0 matches all destination addresses and acts as the gateway of last resort. Using 255.255.255.255 as the mask specifies a host route to 0.0.0.0, which is incorrect. `ip default-network` is a legacy command for classful routing protocols and does not create a static route. `ip route default` is not valid IOS syntax.

Question 12

A router running OSPF displays the following output:

Router# show ip ospf neighbor
  Neighbor ID   Pri   State     Dead Time  Address      Interface
  2.2.2.2         1   FULL/DR   00:00:38   10.1.1.2     GigabitEthernet0/0

What does the 'FULL/DR' state indicate?

Accepted Answer

In the `show ip ospf neighbor` output, the State column shows the neighbor's OSPF state followed by the neighbor's role on the segment. 'FULL' means the adjacency is fully established and LSDBs have been synchronized. '/DR' indicates that the neighbor (2.2.2.2) is the Designated Router (DR) on the shared segment. The local router would show '/BDR' or '/DROther' for its own role. A failed state would appear as EXSTART, EXCHANGE, or DOWN, not FULL.

Question 13

A router has the following routing table entries:

O    10.0.0.0/8       [110/20] via 192.168.1.1
  O    10.1.0.0/16      [110/30] via 192.168.1.2
  O    10.1.1.0/24      [110/40] via 192.168.1.3
  S    0.0.0.0/0        [1/0] via 192.168.1.254

A packet arrives destined for 10.1.1.50. Which route does the router use?

Accepted Answer

IP routing uses longest prefix match (most specific route) as the primary forwarding decision, regardless of administrative distance or metric. The destination 10.1.1.50 matches all four routes, but 10.1.1.0/24 (/24) is more specific than 10.1.0.0/16 (/16), which is more specific than 10.0.0.0/8 (/8), which is more specific than 0.0.0.0/0 (/0). Administrative distance is only used to select between routes from different sources to the same destination prefix — it does not override longest prefix match across different prefixes.

Question 14

A network engineer is configuring single-area OSPF on a router. Which command correctly enables OSPF process 1 and advertises the 192.168.10.0/24 network (interface address 192.168.10.1/24) into OSPF area 0?

Accepted Answer

The OSPF `network` command uses a wildcard mask (the bitwise inverse of the subnet mask), not a subnet mask. For a /24 network, the wildcard mask is 0.0.0.255. The correct syntax is `network

area `. Option A incorrectly uses a subnet mask (255.255.255.0) instead of a wildcard mask. Option C uses the interface IP address rather than the network address — while this would also match the interface, it is non-standard. Option D has incorrect `router ospf` syntax (area is not specified on the `router ospf` line).

Question 15

A network engineer is troubleshooting OSPF and notices two routers are stuck in the EXSTART state. What is the MOST likely cause?

Accepted Answer

The EXSTART state is the first step in the database exchange process where routers negotiate master/slave roles and exchange DBD packets. An MTU mismatch causes OSPF to get stuck in EXSTART/EXCHANGE because the DBD packets cannot be successfully exchanged — the router with the smaller MTU drops oversized packets from its peer. Area ID mismatches prevent any adjacency from forming (neighbors never appear). Hello/dead timer mismatches cause routers to never enter the INIT state (no neighbor relationship forms at all). Different loopback addresses affect Router IDs but do not prevent adjacency formation.

Question 16

A junior engineer asks about the administrative distance values used by Cisco IOS to prefer one routing source over another. Which routing source has the LOWEST (most preferred) administrative distance by default?

Accepted Answer

A directly connected interface has an administrative distance of 0, which is the most trusted (lowest) value possible. Static routes have an AD of 1. EIGRP internal routes have an AD of 90. OSPF routes have an AD of 110. RIP has an AD of 120. Administrative distance is used to select the best path when the same destination prefix is learned from multiple routing sources — lower is preferred.

Question 17

A router is configured with NAT overload (PAT). Which address translation feature allows many internal hosts to share a single public IP address simultaneously?

Accepted Answer

Port Address Translation (PAT), also called NAT overload, maps multiple private IP addresses to a single public IP address by tracking unique source port numbers for each session. This allows hundreds or thousands of internal hosts to share one public IP simultaneously. Static NAT provides a one-to-one mapping. Dynamic NAT uses a pool of public addresses but does not allow sharing (one address per active session). DHCP is an IP address assignment protocol, not a translation mechanism.

Question 18

A network engineer configures a Cisco router as a DHCP server for the 10.10.10.0/24 network. Which IOS commands correctly create the DHCP pool with a default gateway and DNS server?

Accepted Answer

The correct IOS DHCP pool syntax uses `ip dhcp pool `, followed by `network

` (using a subnet mask, not wildcard), `default-router `, and `dns-server `. Option B incorrectly uses a wildcard mask and incorrect subcommands (`gateway` and `dns` are not valid — the correct keywords are `default-router` and `dns-server`). Option C uses `ip dhcp server pool`, which is not valid IOS syntax. Option D attempts to use `service dhcp` as a configuration block, which is only a global enable/disable toggle command.

Question 19

A network engineer needs to synchronize the clock on a router to an NTP server at 192.168.1.100. Which IOS command configures the router as an NTP client pointing to this server?

Accepted Answer

The `ntp server <ip-address>` command configures the router to synchronize its clock from the specified NTP server — this is the standard way to configure NTP client mode on Cisco IOS. `clock set` is used for manually setting the hardware clock and does not configure NTP. `ntp client` is not a valid IOS command. `ntp master` configures the router itself as an NTP master (stratum clock source), not as a client of another server.

Question 20

A network administrator needs to permit only SSH traffic (TCP port 22) inbound on a router's GigabitEthernet0/0 interface from host 10.0.0.5, while denying all other traffic. Which IOS commands correctly create and apply this extended ACL?

Accepted Answer

Extended ACLs (numbered 100–199 or 2000–2699) can filter based on source/destination IP, protocol, and port. `access-list 101 permit tcp host 10.0.0.5 any eq 22` correctly permits TCP from host 10.0.0.5 to any destination on port 22. `ip access-group 101 in` applies it to inbound traffic. The implicit deny at the end blocks all other traffic. Option B uses ACL 1, which is a standard ACL (1–99) — standard ACLs cannot filter by protocol or port. Option C permits all IP traffic from the host (not just SSH) and applies it outbound. Option D is functionally equivalent to A (`host 10.0.0.5` and `10.0.0.5 0.0.0.0` are identical), making A the cleaner canonical answer.

Question 21

A security engineer needs to configure SSH on a Cisco IOS router. Before generating the RSA key pair, which global configuration command is required as a prerequisite?

Accepted Answer

The `crypto key generate rsa` command requires a hostname and domain name to be set, because the RSA key pair name is derived from the fully qualified domain name (.). Configuring `ip domain-name` is a required prerequisite before the RSA key can be generated. `ip ssh version 2` specifies the SSH version but can be set after key generation. `service ssh enable` is not a valid IOS command. A local username is needed for SSH authentication but is not required before key generation.

Question 22

A switch port is configured with port security. An unauthorized device is connected and triggers a security violation. The port immediately shuts down and an SNMP trap is sent. Which port security violation mode is configured?

Accepted Answer

In Cisco IOS, port security has three violation modes. 'Shutdown' (the default) places the port in an err-disabled state, increments the violation counter, and sends a syslog message and SNMP trap. 'Restrict' drops frames from violating MAC addresses, increments the violation counter, and sends syslog/SNMP notifications, but keeps the port up. 'Protect' drops violating frames silently with no notification and no counter increment. 'Lockdown' is not a valid Cisco port security violation mode.

Question 23

A network engineer is reviewing a REST API response from a Cisco device. The response data is formatted in JSON. Which of the following correctly represents a JSON object containing a device hostname and IP address?

Accepted Answer

JSON (JavaScript Object Notation) uses curly braces {} for objects, with key-value pairs separated by colons and enclosed in double quotes. The correct representation is `{"hostname": "Router1", "ip": "10.0.0.1"}`. Option A is XML syntax. Option C is an ini/key-value format. Option D is YAML syntax. JSON is the predominant data format used in REST APIs, including Cisco's RESTCONF and DNA Center APIs.

Question 24

A network engineer uses a Python script to retrieve the running configuration from a Cisco IOS-XE device via RESTCONF. Which HTTP method should the script use to retrieve (read) data without modifying the device configuration?

Accepted Answer

In REST API semantics, the GET method is used to retrieve (read) data from a resource without modifying it — it is idempotent and read-only. POST creates a new resource. PUT replaces an entire resource (used for configuration updates). DELETE removes a resource. When using RESTCONF to read a Cisco IOS-XE device's running configuration, the script sends an HTTP GET request to the appropriate YANG data path (e.g., /restconf/data/Cisco-IOS-XE-native:native).

Question 25

A network automation engineer is evaluating SDN vs. traditional networking. In a traditional network, where does the control plane reside?

Accepted Answer

In traditional (non-SDN) networking, the control plane — which makes forwarding decisions (routing tables, MAC tables, etc.) — is distributed and resides within each individual network device. Each device independently runs protocols such as OSPF, BGP, or STP to build its own control plane tables. In an SDN architecture, the control plane is moved to a centralized controller (such as Cisco DNA Center) that communicates with the data plane of each device via southbound APIs (like OpenFlow or NETCONF). Options A, C, and D describe SDN or incorrect architectures.

200-301 CCNA — Cisco Certified Network Associate (CCNA)