Cisco Certified Support Technician (CCST) Networking — Practice Set 1

Question 1

A network technician is reviewing the OSI model. Which OSI layer is responsible for end-to-end error detection, flow control, and reliable data delivery between two hosts?

Accepted Answer

The Transport layer (Layer 4) provides end-to-end communication services including error detection, flow control, and reliable delivery via TCP or best-effort delivery via UDP. The Network layer handles logical addressing and routing. The Session layer manages dialog control between applications. The Data Link layer handles node-to-node delivery within a single network segment.

Question 2

Which term describes the data unit used at the Network layer (Layer 3) of the OSI model?

Accepted Answer

At the Network layer (Layer 3), the data unit is called a packet. A frame is the data unit at the Data Link layer (Layer 2). A segment is the data unit at the Transport layer (Layer 4). Bits are the data unit at the Physical layer (Layer 1).

Question 3

A network administrator explains that two devices sharing the same cable segment can transmit data simultaneously without collision. Which transmission method makes this possible?

Accepted Answer

Full-duplex allows simultaneous bidirectional transmission — both devices can send and receive at the same time, eliminating collisions. Half-duplex allows two-way communication but only one direction at a time (one device transmits while the other listens), requiring CSMA/CD collision detection. Simplex is one-way only. Multiplexing is a technique for combining multiple signals on one medium.

Question 4

A user complains that file downloads are slower than the 100 Mbps bandwidth their ISP advertises. A technician explains the difference between bandwidth and throughput. Which statement BEST distinguishes these two concepts?

Accepted Answer

Bandwidth is the theoretical maximum data transfer capacity of a link, measured in bits per second. Throughput is the actual measured rate of successful data delivery, which is always less than or equal to bandwidth due to overhead, latency, retransmissions, and network congestion. They are not interchangeable, and neither is directionally limited.

Question 5

A small business uses an application hosted by a third-party provider over the internet and pays a monthly subscription. The business does not manage any servers or networking hardware. Which cloud service model BEST describes this arrangement?

Accepted Answer

Software as a Service (SaaS) delivers fully managed applications over the internet on a subscription basis — the provider manages all infrastructure, platforms, and the application itself. IaaS provides virtualized compute, storage, and networking resources the customer manages. PaaS provides a development platform without the customer managing the underlying OS or hardware. NaaS is not one of the standard NIST-defined cloud service models.

Question 6

Which of the following IP addresses belongs to the Class B private address range defined in RFC 1918?

Accepted Answer

RFC 1918 defines three private address ranges: 10.0.0.0/8 (Class A), 172.16.0.0/12 (Class B, covering 172.16.0.0–172.31.255.255), and 192.168.0.0/16 (Class C). The address 172.16.50.1 falls within the 172.16.0.0/12 Class B private range. 10.5.0.1 is a Class A private address. 192.168.1.254 is a Class C private address. 169.254.0.0/16 is the Automatic Private IP Addressing (APIPA) range, not an RFC 1918 private address.

Question 7

A network is assigned the address 192.168.10.0/27. How many usable host addresses are available in this subnet?

Accepted Answer

A /27 prefix leaves 5 host bits (32 − 27 = 5). The total number of addresses is 2^5 = 32. Subtracting the network address and broadcast address gives 32 − 2 = 30 usable host addresses. 32 is the total address count before subtracting network and broadcast. 62 is the count for a /26. 14 is the count for a /28.

Question 8

Which IPv6 address type is automatically assigned to every IPv6-enabled interface and is valid only on the local link (not routed beyond it)?

Accepted Answer

Link-local addresses (fe80::/10) are automatically configured on every IPv6-enabled interface and are scoped to the local link — they are never forwarded by routers. Global unicast addresses are publicly routable IPv6 addresses. The loopback address ::1 identifies the local device itself (equivalent to 127.0.0.1 in IPv4). Multicast addresses identify a group of interfaces and are used for one-to-many communication.

Question 9

A network technician records the MAC address of a workstation as 00:1A:2B:3C:4D:5E. Which portion of this MAC address identifies the manufacturer of the network interface card?

Accepted Answer

A MAC address is 48 bits (6 bytes) long. The first 24 bits (first three octets) form the Organizationally Unique Identifier (OUI), which is assigned by the IEEE to identify the network interface card manufacturer. The last 24 bits are the device-specific identifier assigned by the manufacturer. The middle 16 bits have no special independent designation.

Question 10

A technician needs to express the subnet mask 255.255.255.192 in CIDR prefix notation. Which prefix length is correct?

Accepted Answer

Converting 255.255.255.192 to binary: 11111111.11111111.11111111.11000000. Counting the consecutive 1-bits gives 8+8+8+2 = 26. Therefore the CIDR notation is /26. A /25 corresponds to 255.255.255.128. A /27 corresponds to 255.255.255.224. A /28 corresponds to 255.255.255.240.

Question 11

A web developer needs to transfer a large video file to a remote server. The transfer must guarantee that all data arrives intact and in the correct order. Which transport layer protocol should the application use?

Accepted Answer

TCP (Transmission Control Protocol) is a connection-oriented protocol that guarantees reliable, ordered delivery through sequencing, acknowledgments, and retransmission of lost segments. UDP (User Datagram Protocol) is connectionless and does not guarantee delivery or order, making it better suited for real-time applications where some loss is acceptable. ICMP is a network-layer protocol used for diagnostics such as ping, not data transfer. ARP resolves IP addresses to MAC addresses and does not transport data.

Question 12

A technician wants to verify that a hostname resolves to the correct IP address from a workstation. Which protocol is responsible for translating hostnames to IP addresses?

Accepted Answer

DNS (Domain Name System) is responsible for resolving fully qualified domain names (FQDNs) to IP addresses. DHCP dynamically assigns IP addresses to hosts. ARP resolves IP addresses to MAC addresses within a local network segment. SNMP is used for network device monitoring and management.

Question 13

A network engineer is analyzing a packet capture and observes a four-step process where a client broadcasts 'DHCP Discover,' receives a 'DHCP Offer,' sends a 'DHCP Request,' and finally receives a 'DHCP Acknowledgement.' What is the common acronym for this DHCP lease process?

Accepted Answer

The DHCP lease acquisition process is known as DORA: Discover (client broadcasts to find a DHCP server), Offer (server proposes an IP address), Request (client requests the offered address), and Acknowledge (server confirms the lease). The other options are not valid acronyms for this process.

Question 14

A security policy requires all web traffic to be encrypted. A technician checks the firewall rules and confirms that the correct destination port is allowed. Which port number should be permitted for HTTPS traffic?

Accepted Answer

HTTPS (HTTP Secure) uses TCP port 443. HTTP uses TCP port 80. FTP control connections use TCP port 21 (data transfers use port 20). SMTP uses TCP port 25 for email transmission between servers.

Question 15

A host needs to communicate with another device on the same Ethernet subnet but only knows the destination's IP address. Which protocol does the host use to learn the destination's MAC address before transmitting?

Accepted Answer

Address Resolution Protocol (ARP) is used to map a known IPv4 address to an unknown MAC address on the same local network. The host broadcasts an ARP request to all devices on the segment; the device with the matching IP address replies with its MAC address. ICMP is used for diagnostic messages, not address resolution. DNS resolves hostnames to IP addresses, not MAC addresses. DHCP assigns IP configuration to hosts.

Question 16

A network technician runs the traceroute command from a Linux workstation to a remote server. Which protocol does the traceroute utility primarily use to discover the path and measure per-hop latency?

Accepted Answer

On Linux/Unix systems, traceroute sends UDP probe packets with incrementing TTL values. Each router that decrements the TTL to zero returns an ICMP Time Exceeded message, revealing the router's IP and round-trip time. When the probe reaches the destination, the destination returns an ICMP Port Unreachable message (because the UDP port is intentionally unusable), signaling the end of the path. Windows tracert uses ICMP Echo Requests instead. ARP does not traverse routers.

Question 17

A technician needs to run a cable between two offices that are 80 meters apart within the same building. The installation must support Gigabit Ethernet and be resistant to crosstalk. Which cable type is MOST appropriate?

Accepted Answer

Cat5e UTP (Category 5 enhanced) supports Gigabit Ethernet (1000BASE-T) at distances up to 100 meters and provides improved crosstalk rejection over Cat5. Cat3 only supports up to 10 Mbps (10BASE-T). RG-6 coaxial is used for cable TV and broadband, not standard Ethernet. Single-mode fiber is appropriate for long-distance runs (kilometers), which is unnecessary and more costly for an 80-meter in-building installation.

Question 18

A campus network requires a fiber optic backbone link that spans 2 kilometers between two buildings. Which fiber type is MOST appropriate for this distance?

Accepted Answer

Single-mode fiber (SMF) uses a narrow core (typically 9 µm) with a laser light source to support transmission distances of many kilometers with low signal loss, making it ideal for inter-building runs. Multimode fiber (MMF) is limited to shorter distances — OM3/OM4 supports up to 300–550 meters for 10 Gbps. Cat6A UTP has a maximum distance of 100 meters. OM1 multimode fiber supports even shorter distances at higher speeds.

Question 19

A wireless survey reveals poor performance near industrial machinery. A technician suspects electromagnetic interference (EMI). Which 802.11 standard operates exclusively in the 5 GHz band, which is less susceptible to the 2.4 GHz interference from nearby equipment?

Accepted Answer

802.11ac (Wi-Fi 5) operates exclusively in the 5 GHz band, which avoids the 2.4 GHz interference from many industrial devices and appliances. 802.11b operates only in 2.4 GHz. 802.11g operates only in 2.4 GHz. 802.11n (Wi-Fi 4) operates in both 2.4 GHz and 5 GHz (dual-band), so it can be configured for 5 GHz but is not exclusively 5 GHz.

Question 20

A network technician is terminating a Cat6 cable with an RJ-45 connector. What is the maximum distance for this cable type when used for Gigabit Ethernet (1000BASE-T)?

Accepted Answer

The IEEE 802.3 standard specifies a maximum cable segment length of 100 meters (328 feet) for copper twisted-pair Ethernet, including Cat6 running 1000BASE-T. 55 meters is the distance limit for Cat6 when used for 10GBASE-T (10 Gbps). 185 meters applies to 10BASE2 coaxial (Thinnet). 500 meters applies to 10BASE5 coaxial (Thicknet).

Question 21

A network diagram shows a device that connects multiple network segments and forwards traffic based on logical (IP) addresses. Which network device does this describe?

Accepted Answer

A router operates at the Network layer (Layer 3) and forwards packets between different networks based on IP addresses using routing tables. A switch operates at Layer 2 and forwards frames within a single network based on MAC addresses. A hub is a Layer 1 device that simply broadcasts all received signals to all ports. A repeater regenerates electrical signals to extend cable distance without any intelligent forwarding.

Question 22

A facilities team wants to install IP phones in a conference room that lacks power outlets near the wall Ethernet ports. Which technology allows the network switch to supply electrical power to the IP phones over the existing Ethernet cable?

Accepted Answer

Power over Ethernet (PoE), standardized in IEEE 802.3af (15.4 W) and 802.3at (30 W), allows network switches to deliver DC power to connected devices over the same Cat5e or higher Ethernet cable used for data, eliminating the need for separate power adapters or nearby power outlets. 802.1Q is VLAN tagging. 802.3ad (now 802.1AX) is link aggregation. 802.1D is the original Spanning Tree Protocol.

Question 23

A Windows workstation cannot reach a website. A technician runs `ipconfig` and sees the output below:

IPv4 Address. . . . . . : 169.254.45.12
  Subnet Mask . . . . . . : 255.255.0.0
  Default Gateway . . . . :

What does this output indicate?

Accepted Answer

An address in the 169.254.0.0/16 range is an Automatic Private IP Addressing (APIPA) address. Windows automatically assigns an APIPA address when a DHCP server is unreachable, allowing limited local communication. The blank default gateway confirms the workstation cannot route to other networks. This is not a DHCP-assigned address, not a manually configured static address (administrators would not intentionally use 169.254.x.x), and is not a standard RFC 1918 private address.

Question 24

A technician receives the following ping output from a Windows workstation:

Pinging 10.1.1.1 with 32 bytes of data:
  Request timed out.
  Request timed out.
  Request timed out.
  Request timed out.
  Ping statistics for 10.1.1.1:
      Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)

The technician then successfully pings the default gateway (10.1.1.254). Which is the MOST likely cause of the failure?

Accepted Answer

Because the workstation successfully pings its default gateway (10.1.1.254), the local NIC, TCP/IP stack, and Layer 1–3 functionality are working correctly. The failure to reach 10.1.1.1 (which is on the same /24 subnet) indicates either the destination host does not exist, is powered off, has a host-based firewall blocking ICMP, or there is a network policy preventing ICMP. An incorrect subnet mask or faulty NIC would prevent the gateway ping from succeeding as well.

Question 25

A help desk technician uses the OSI bottom-up troubleshooting methodology to diagnose a connectivity problem. The technician has confirmed that the physical cable is intact (Layer 1) and that the switch port shows a connected link light. The workstation cannot ping any other device on the network. What is the NEXT layer the technician should investigate?

Accepted Answer

The OSI bottom-up approach starts at Layer 1 (Physical) and works upward. Having confirmed Layer 1 is functioning, the next step is Layer 2 (Data Link). At this layer, the technician should verify that the NIC has a valid MAC address, check for duplex mismatches between the workstation and switch port, and confirm the NIC driver is loaded correctly. Only after confirming Layer 2 functionality should the technician move to Layer 3 (IP addressing), then Layer 4, and so on up the stack.

100-150 CCSTNW — Cisco Certified Support Technician (CCST) Networking