50 Free CCNA Practice Questions (200-301)

Answer: c) Layer 3 — Network

Explanation: The Network layer (Layer 3) handles logical addressing (IP addresses), routing between networks, and path determination. Key protocols: IP, ICMP, OSPF, EIGRP.

Answer: c) 255.255.255.224

Explanation: /27 = 255.255.255.224. The network bits: 8+8+8+3 = 27, leaving 5 host bits. That's 2⁵ = 32 addresses per subnet (30 usable).

Answer: a) 14

Explanation: /28 = 255.255.255.240. 32 - 28 = 4 host bits. 2⁴ = 16 addresses, minus network and broadcast = 14 usable hosts.

Answer: b) 443

Explanation: HTTPS (HTTP Secure) uses TCP port 443. HTTP uses 80, SSH uses 22, DNS uses 53.

Answer: a) TCP is connection-oriented and reliable; UDP is connectionless and faster

Explanation: TCP provides reliability (acknowledgments, retransmission, sequencing) but adds overhead. UDP is faster but best-effort, suitable for streaming and real-time applications.

Answer: b) 10.0.0.1

Explanation: RFC 1918 private addresses: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16. 172.32.1.1 is outside the 172.16-31 range.

Answer: b) Tags Ethernet frames with VLAN information

Explanation: 802.1Q inserts a 4-byte VLAN tag into Ethernet frames, allowing multiple VLANs to traverse a single trunk link between switches.

Answer: c) Fiber optic (single-mode)

Explanation: Single-mode fiber supports the longest distances (up to 40+ km) and highest bandwidth, making it ideal for backbone connections.

Answer: c) Ring

Explanation: In a ring topology, each device connects to exactly two neighbors. Data travels in one direction. Examples: Token Ring, FDDI.

Answer: b) 100 meters

Explanation: The maximum length for UTP (Cat5e, Cat6, Cat6a) Ethernet is 100 meters (328 feet) before signal degradation requires a repeater or switch.

Answer: b) Preventing loops in a switched network

Explanation: STP prevents Layer 2 loops by blocking redundant paths while maintaining multiple connections for fault tolerance. It uses BPDUs to elect a root bridge and determine port states.

Answer: a) Blocking

Explanation: Blocking is the initial STP port state. The port listens to BPDUs but doesn't forward traffic or learn MAC addresses. It transitions to listening (15s), then learning (15s), then forwarding.

Answer: a) Accelerates convergence on access ports

Explanation: PortFast immediately transitions a port to forwarding, bypassing the listening/learning states. It's used only on access ports connected to end devices (not switches).

Answer: c) Both a and b

Explanation: PAgP (Port Aggregation Protocol) is Cisco proprietary. LACP (Link Aggregation Control Protocol) is the IEEE standard. Both negotiate EtherChannel bundles.

Answer: c) 802.11n (WiFi 4)

Explanation: 802.11n supports both 2.4 GHz and 5 GHz. 802.11ac is 5 GHz only. 802.11b/g are 2.4 GHz only.

Answer: a) Actively tries to form a trunk with the neighboring switch

Explanation: DTP (Dynamic Trunking Protocol) modes: dynamic desirable actively sends DTP frames to negotiate trunking. dynamic auto responds to DTP but doesn't initiate.

Answer: b) A port assigned to a single VLAN

Explanation: An access port belongs to only one VLAN and carries traffic for that VLAN only. Trunk ports carry traffic for multiple VLANs using 802.1Q tagging.

Answer: b) The VLAN that carries untagged traffic on a trunk

Explanation: The native VLAN (default VLAN 1) is the VLAN that carries untagged frames on a trunk. Both sides must match the native VLAN to avoid misconfiguration.

Answer: a) 2.4 GHz

Explanation: 2.4 GHz has better wall penetration and longer range but lower speed and more interference. 5 GHz is faster but shorter range. 6 GHz (WiFi 6E) is even faster.

Answer: b) Centralized management of lightweight APs

Explanation: WLCs manage lightweight access points (LAPs) centrally, handling configuration, RF management, roaming, and security policies.

Answer: a) ip route 0.0.0.0 0.0.0.0 10.0.0.1

Explanation: The default route (quad-zero) matches any destination. The command syntax: ip route <network> <mask> <next-hop>.

Answer: b) OSPF

Explanation: OSPF uses cost = 10⁸ / bandwidth to determine the best path. RIP uses hop count. EIGRP uses a composite metric (bandwidth, delay, load, reliability). BGP uses path attributes.

Answer: c) 110

Explanation: OSPF has AD 110. Connected routes = 0, Static = 1, EIGRP = 90, RIP = 120, External EIGRP = 170. Lower AD = more trustworthy.

Answer: b) Area Border Router (ABR)

Explanation: ABRs have interfaces in Area 0 and at least one other area. They summarize routes between areas. ASBRs connect OSPF to external routing domains.

Answer: b) Routing between different VLANs within a network

Explanation: Inter-VLAN routing allows communication between hosts on different VLANs. Methods: router-on-a-stick (subinterfaces), Layer 3 switch (SVIs), or routed ports.

Answer: a) interface g0/0.10 → encapsulation dot1Q 10 → ip address 10.0.10.1 255.255.255.0

Explanation: R-O-A-S creates subinterfaces with 802.1Q encapsulation matching the VLAN number. Each subinterface acts as the default gateway for its VLAN.

Answer: b) Link-local

Explanation: IPv6 link-local addresses (fe80::/10) are automatically assigned and used for communication on a single link (no routing). They're used for OSPFv3 neighbor discovery.

Answer: b) Electing a DR/BDR to reduce LSAs

Explanation: On broadcast networks (Ethernet), OSPF elects a Designated Router (DR) and Backup DR to reduce the number of adjacencies and link-state advertisements.

Answer: c) Full

Explanation: The Full state means both routers have identical LSDBs and are fully adjacent. Other states: Down → Init → 2-Way → ExStart → Exchange → Loading → Full.

Answer: b) A static route with a higher AD to serve as a backup

Explanation: A floating static route has a higher administrative distance than the primary route. It only appears in the routing table when the primary route fails.

Answer: b) Forwarding DHCP broadcasts to a DHCP server on another subnet

Explanation: DHCP uses broadcasts which don't cross routers. ip helper-address converts DHCP broadcasts to unicasts and forwards them to the DHCP server.

Answer: b) SSH

Explanation: SSH provides encrypted remote access to network devices. Telnet is unencrypted and should be disabled. SSH requires crypto keys to be generated.

Answer: b) Time synchronization across devices

Explanation: NTP (Network Time Protocol) synchronizes clocks across network devices, critical for accurate logging, authentication, and troubleshooting.

Answer: a) Multiple private IPs to share a single public IP using port numbers

Explanation: PAT (Port Address Translation) maps multiple private IP addresses to a single public IP by using unique port numbers. This conserves public IPv4 addresses.

Answer: c) SNMPv3

Explanation: SNMPv3 provides message integrity, authentication, and encryption. v1 and v2c use community strings in plaintext.

Answer: b) Standard ACL

Explanation: Standard ACLs (1-99, 1300-1999) filter only on source IP address. Extended ACLs (100-199, 2000-2699) filter on source/destination IP, protocol, and port.

Answer: a) As close to the destination as possible

Explanation: Standard ACLs (source-only) should be placed near the destination because they can't distinguish specific traffic types. Extended ACLs should be placed near the source.

Answer: b) Limiting the number of MAC addresses allowed on a port

Explanation: Port security restricts the number of MAC addresses per port (default 1) and can take action (shutdown, restrict, protect) if violated. It prevents MAC flooding attacks.

Answer: b) Preventing rogue DHCP server attacks

Explanation: DHCP snooping filters untrusted DHCP messages. Trusted ports (uplinks) can send DHCP offers; untrusted ports (access) cannot, preventing rogue DHCP servers.

Answer: b) CHAP

Explanation: CHAP (Challenge-Handshake Authentication Protocol) uses a three-way handshake with hashed challenge-response. PAP sends passwords in plaintext.

Answer: b) Disabling a port if it receives a BPDU (prevents loop extension)

Explanation: BPDUguard puts the port in errdisable state if a BPDU is received, preventing accidental STP loop extension from unauthorized switches.

Answer: b) TACACS+ with AAA

Explanation: TACACS+ encrypts the entire packet and provides AAA (Authentication, Authorization, Accounting) with granular command-level control.

Answer: b) Communication between applications and the SDN controller

Explanation: Northbound APIs allow applications to communicate with the SDN controller. Southbound APIs (OpenFlow, NETCONF) connect the controller to network devices.

Answer: d) All of the above

Explanation: Cisco DNA Center uses REST APIs for northbound communication and supports NETCONF, SNMP, SSH, and CLI for southbound device management.

Answer: b) JSON

Explanation: JSON (JavaScript Object Notation) uses curly braces {}, colons, and key-value pairs. YAML uses indentation and dashes. XML uses angle brackets.

Answer: b) Ansible pushes configurations to devices without agents

Explanation: Ansible is agentless and push-based. It connects via SSH (Linux) or WinRM (Windows) and pushes configurations. Puppet/Chef are pull-based (agents).

Answer: a) A data modeling language for network configuration

Explanation: YANG (Yet Another Next Generation) defines data models for network configuration and state data. It's used with NETCONF and RESTCONF protocols.

Answer: b) GET

Explanation: REST API HTTP methods: GET (read), POST (create), PUT/PATCH (update), DELETE (delete). GET is idempotent and safe.

Answer: b) Centralized management and policy enforcement

Explanation: SDN controllers provide centralized management, consistency, automation, and intent-based networking — reducing manual configuration errors and operational overhead.

Answer: a) Ansible

Explanation: Ansible is widely used for network automation due to its agentless architecture, YAML-based playbooks, and extensive module support for Cisco, Juniper, Arista, and more.