Free CCNA practice test

12 original questions written by our editors against the official Cisco exam domains. They are not real exam questions. Pick an answer to see the explanation.

0 / 0 correct

1. Network Fundamentals

   You are assigning an IPv4 subnet to a new office VLAN that needs 50 host addresses. To save address space, which is the smallest prefix length that works?

   A/26B/28C/25D/27
   Show answer

   Answer: A. A /26 has 6 host bits, giving 2^6 - 2 = 62 usable addresses, which covers 50 hosts. A /27 gives only 30 usable addresses and a /28 only 14, both too few. A /25 works (126 hosts) but wastes more address space than needed.

2. Network Fundamentals

   A company is deploying voice over IP phones. Which transport protocol normally carries the voice media stream, and why?

   ATCP, because its windowing gives voice traffic priorityBUDP, because it has low overhead and does not delay audio by retransmitting lost packetsCTCP, because it guarantees every packet arrivesDICMP, because it is the lightest protocol available
   Show answer

   Answer: B. Real-time voice favours UDP: a retransmitted packet would arrive too late to be useful, so speed matters more than guaranteed delivery. TCP's retransmissions and acknowledgements add delay, and windowing controls flow rather than giving priority. ICMP is used for control and error messages, not to carry application data.

3. Network Access

   Two switches are connected by an 802.1Q trunk. SW1 uses native VLAN 1 and SW2 uses native VLAN 99, and both switches log native VLAN mismatch messages. What is the correct fix?

   AConfigure the same native VLAN on both ends of the trunkBShut down the trunk and use separate access links for each VLANCEnable PortFast on both trunk portsDChange the trunk encapsulation to ISL on both switches
   Show answer

   Answer: A. The native VLAN must match on both ends of an 802.1Q trunk, otherwise untagged traffic ends up in the wrong VLAN. Changing to ISL is not a fix and is not supported on many current switches. Replacing the trunk with access links throws away the benefit of trunking, and PortFast is meant for edge ports, not trunks between switches.

4. Network Access

   Access ports connect to user PCs. You want these ports to start forwarding immediately when a PC connects, and to shut down automatically if someone plugs in a switch that sends BPDUs. What should you configure?

   AConfigure the ports as trunksBRoot guard on the access portsCPortFast with BPDU guard on the access portsDDisable spanning tree on the user VLAN
   Show answer

   Answer: C. PortFast moves an edge port straight to forwarding, and BPDU guard err-disables the port if it receives a BPDU, which protects against a rogue switch. Root guard only stops a port from becoming a root port; it does not speed up forwarding. Making the ports trunks is wrong for PCs, and disabling spanning tree risks loops.

5. IP Connectivity

   A router has three routes in its routing table: 10.0.0.0/8 learned by OSPF, 10.1.0.0/16 configured as a static route, and 10.1.1.0/24 learned by OSPF. Which route does it use to forward a packet to 10.1.1.20?

   A10.1.1.0/24, because it is the longest prefix matchBThe default route, because more than one route matchesC10.1.0.0/16, because static routes have a lower administrative distanceD10.0.0.0/8, because it was learned first
   Show answer

   Answer: A. The router picks the most specific matching route, the longest prefix, so the /24 wins. Administrative distance is only compared between routes to the same prefix, so the static /16 does not override it. Learning order is irrelevant, and a default route is used only when nothing more specific matches.

6. IP Connectivity

   A branch router learns its route to headquarters through OSPF over the primary link. You want a static route through a backup ISP link that is used only if the OSPF route disappears. How should you configure the static route?

   AA static route with an administrative distance higher than 110, such as 120BA static route with the default administrative distance of 1CA static route pointing to the Null0 interfaceDA static route with an administrative distance of 90
   Show answer

   Answer: A. A floating static route has an administrative distance higher than the primary route's (OSPF is 110), so it is installed only when the OSPF route is lost. With a distance of 1 or 90 the static route would always win and replace the OSPF path. A route to Null0 discards traffic instead of sending it over the backup link.

7. IP Connectivity

   Three routers share an Ethernet segment running OSPF. R1 has interface priority 0. R2 and R3 both have priority 1, with router IDs 2.2.2.2 and 3.3.3.3. All three start at the same time. Which router becomes the designated router (DR)?

   AR1BR3CNone, because Ethernet segments do not elect a DRDR2
   Show answer

   Answer: B. The highest interface priority wins the DR election, and the highest router ID breaks a tie. R1 has priority 0, so it can never become DR or BDR. R2 and R3 tie on priority and R3 has the higher router ID. Ethernet is a broadcast network type by default, so OSPF does elect a DR.

8. IP Services

   A small office has 40 internal hosts with private IPv4 addresses and only one public IPv4 address from its ISP. All hosts need internet access at the same time. Which NAT setup fits?

   AA DHCP relay agent on the router's outside interfaceBDynamic NAT with a pool containing the single public address, without overloadCStatic NAT for each internal hostDPAT (NAT overload), translating all inside hosts to the single public address using different port numbers
   Show answer

   Answer: D. PAT lets many inside hosts share one public address by tracking unique source port numbers. Static NAT needs one public address per host. Dynamic NAT without overload would let only one host use the single address at a time, and DHCP relay has nothing to do with address translation.

9. IP Services

   PCs in VLAN 20 cannot get IP addresses. The DHCP server is on a different subnet in the data center and works for other VLANs. What should you configure?

   ANTP client mode on the VLAN 20 gatewayBDHCP snooping on the VLAN 20 access switchCThe ip helper-address command on the VLAN 20 gateway interface, pointing to the DHCP serverDStatic ARP entries for the DHCP server on each PC
   Show answer

   Answer: C. DHCP discover messages are broadcasts that routers do not forward, so the gateway needs to act as a DHCP relay with ip helper-address pointing to the server. DHCP snooping is a security feature that filters DHCP messages; it does not relay them. Static ARP and NTP do not help clients obtain addresses.

10. Security Fundamentals

    In a meeting room, a switch port should allow only one device. If a second device's MAC address appears on the port, the port must be disabled. Which feature and setting meet this requirement?

    ADynamic ARP inspection on the room's VLANBBPDU guard on the portCPort security with a maximum of 1 MAC address and the shutdown violation modeDDHCP snooping with the port set as trusted
    Show answer

    Answer: C. Port security limits how many MAC addresses a port learns, and the shutdown violation mode err-disables the port when the limit is exceeded. DHCP snooping and dynamic ARP inspection protect against rogue DHCP servers and ARP spoofing, not extra devices. BPDU guard only reacts to spanning tree BPDUs, which a PC does not send.

11. Security Fundamentals

    You must stop host 192.168.10.5 from reaching the server subnet 10.20.0.0/24 while allowing all its other traffic. You can only use a standard numbered ACL. Where should you apply it?

    AOutbound on the router interface closest to the server subnet, with a deny for the host followed by permit anyBInbound on the router interface closest to the hostCInbound on the interface closest to the host, with only a deny statement for the hostDOutbound on the interface closest to the server subnet, with only a permit statement for the host
    Show answer

    Answer: A. A standard ACL matches only the source address, so it should be placed close to the destination; otherwise it would block the host from every network. It also needs permit any after the deny, because every ACL ends with an implicit deny. Placing it near the source blocks all the host's traffic, and permitting only the host would block everyone else.

12. Automation and Programmability

    A script needs to read the current device inventory from a network controller's REST API without changing anything. Which HTTP method should it use?

    APOSTBDELETECGETDPUT
    Show answer

    Answer: C. GET retrieves a resource without modifying it, matching the read operation in CRUD. POST usually creates a new resource, PUT replaces or updates one, and DELETE removes one, so all three would change data on the controller.