Question bank
Cisco Certified Network Associate
40 Cisco Certified Network Associate questions with the correct answer and a written explanation, organised across 6 exam domains.
- 40 questions
- 6 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Automation and Programmability
4 questions in this domain
- Question 1Single Choice
What is the primary characteristic of Software-Defined Networking (SDN)?
- ACentralized control planeCorrect answer
- BDistributed control plane
- CUse of proprietary protocols only
- DElimination of all routing protocols
Why this is the answer
SDN decouples the control plane from the data plane, centralizing network intelligence into a controller.
- Question 2Multiple Select
Select the correct mappings of HTTP methods to CRUD operations.
- AGET - RetrieveCorrect answer
- BPOST - CreateCorrect answer
- CPUT - Delete
- DDELETE - Update
Why this is the answer
GET retrieves data, POST creates a new resource. PUT replaces, DELETE removes.
- Question 3Interactive
Given the JSON response below, what is the IP address of interface GigabitEthernet1?
- A10.0.0.1Correct answer
- B10.0.0.2
- C192.168.1.1
- D172.16.0.1
Why this is the answer
The JSON shows the ip address under the interface object as 10.0.0.1.
- Question 4Single Choice
Which configuration management tool uses an agentless push model?
- AAnsibleCorrect answer
- BPuppet
- CChef
- DSaltStack
Why this is the answer
Ansible is agentless and uses a push model via SSH. Puppet and Chef use agent-based pull.
IP Connectivity
10 questions in this domain
- Question 5Interactive
Examine the following output. Which router ID is used by the router in the OSPF process?
- A1.1.1.1Correct answer
- B2.2.2.2
- C192.168.1.1
- D0.0.0.0
Why this is the answer
The router ID is explicitly set to 1.1.1.1 via the 'router-id' command under the OSPF process.
- Question 6Interactive
Refer to the configuration. What is the purpose of the 'encapsulation dot1Q 10' command under the subinterface?
- AIt assigns an IP address to the subinterface.
- BIt enables 802.1Q trunking and associates the subinterface with VLAN 10.Correct answer
- CIt sets the MTU for the subinterface.
- DIt configures the subinterface for ISL encapsulation.
Why this is the answer
The 'encapsulation dot1Q 10' command enables 802.1Q trunking and ties the subinterface to VLAN 10 for tagging.
- Question 7Interactive
Analyze the routing table entry below. What does the 'S' stand for in the 'S*' code?
- AStatic routeCorrect answer
- BOSPF route
- CRIP route
- DDirectly connected route
Why this is the answer
In Cisco IOS, 'S' indicates a static route. The asterisk (*) means the route is a candidate for default route (gateway of last resort).
- Question 8Interactive
Review the IPv6 neighbor cache output. What is the state of the neighbor at 2001:db8::1?
- AREACHABLE
- BSTALECorrect answer
- CINCOMPLETE
- DDELAY
Why this is the answer
The state is STALE, indicating no positive confirmation within the last 30 seconds.
- Question 9Single Choice
What is the default administrative distance for OSPF routes?
- A90
- B110Correct answer
- C120
- D1
Why this is the answer
OSPF internal routes have a default AD of 110. EIGRP internal is 90, RIP is 120.
- Question 10Multiple Select
Which two statements about route summarization are correct?
- ASummarization reduces the size of the routing table.Correct answer
- BOSPF automatically summarizes at classful boundaries.
- CEIGRP manual summarization creates a Null0 route.Correct answer
- DSummarization is always performed by redistributing routes.
Why this is the answer
Summarization reduces table size; EIGRP creates a discard route to Null0. OSPF does not auto-summarize; redistribution is separate.
- Question 11Interactive
Based on the configuration, what is the purpose of the 'redistribute ospf 1 metric 100000 10 255 1 1500' command under router eigrp?
- AIt injects OSPF routes into EIGRP with a specific seed metric.Correct answer
- BIt converts EIGRP routes to OSPF.
- CIt sets the default metric for all redistributed routes.
- DIt filters OSPF routes from entering EIGRP.
Why this is the answer
The 'redistribute ospf 1 metric' command injects OSPF routes into the EIGRP process, assigning a seed metric (bandwidth, delay, etc.).
- Question 12Single Choice
Which IPv6 Neighbor Discovery message is sent by a host to quickly obtain a Router Advertisement?
- AType 133Correct answer
- BType 134
- CType 135
- DType 136
Why this is the answer
Router Solicitation (RS) is ICMPv6 type 133. Type 134 is RA, 135 is NS, 136 is NA.
- Question 13Multiple Select
Which two statements are correct regarding the 'ip route 0.0.0.0 0.0.0.0' command? (Choose two.)
- AIt defines a default route.Correct answer
- BIt defines a host route for 0.0.0.0.
- CThe route is used when no other matching route exists.Correct answer
- DThe route is automatically redistributed into OSPF.
Why this is the answer
The command creates a default route (gateway of last resort) and it is used only when no more specific match is found. Redistribution is not automatic.
- Question 14Interactive
Examine the OSPFv3 configuration. Why is the 'ipv6 ospf 100 area 0' command applied under the interface?
- AIt enables OSPFv3 on the interface and assigns it to area 0.Correct answer
- BIt assigns an IPv6 address to the interface.
- CIt creates an OSPFv3 process for IPv4.
- DIt configures authentication for OSPFv3.
Why this is the answer
The command enables OSPFv3 on that interface and places it into area 0 (backbone).
IP Services
4 questions in this domain
- Question 15Single Choice
During the DHCP DORA process, which message is the first broadcast sent by the client to locate a server?
- ADiscoverCorrect answer
- BOffer
- CRequest
- DAcknowledgement
Why this is the answer
The DHCP Discover is the first broadcast sent by the client to locate available servers.
- Question 16Multiple Select
Which of the following statements about DHCP relay agents are true? (Select all that apply.)
- AForwards DHCP broadcasts across subnetsCorrect answer
- BRequires the 'ip helper-address' command on the client-facing interfaceCorrect answer
- CIs configured directly on the DHCP server
- DOperates using UDP ports 67 and 68Correct answer
Why this is the answer
A DHCP relay forwards broadcasts to a remote server using the 'ip helper-address' command and relays on UDP ports 67/68.
- Question 17Interactive
A network administrator wants to enable DNS resolution on a Cisco router. Which command is missing in the configuration snippet?
- Aip domain-lookupCorrect answer
- Bip host
- Cdns-server
- Dip dns server
Why this is the answer
The 'ip domain-lookup' command globally enables DNS resolution on Cisco IOS devices.
- Question 18Single Choice
What transport protocol and port number does NTP use to synchronize time?
- ATCP port 123
- BUDP port 123Correct answer
- CUDP port 161
- DTCP port 514
Why this is the answer
NTP operates over UDP port 123 for time synchronization.
Network Access
8 questions in this domain
- Question 19Single Choice
What is the primary purpose of a Virtual Local Area Network (VLAN)?
- ATo extend the LAN across multiple geographic locations
- BTo logically segment a switched network into isolated broadcast domainsCorrect answer
- CTo provide routing between different network subnets
- DTo increase the physical bandwidth of a network link
Why this is the answer
A VLAN creates separate broadcast domains within a switch, improving security and scalability by isolating traffic.
- Question 20Multiple Select
Which of the following are valid Dynamic Trunking Protocol (DTP) modes on a Cisco switch? (Choose two.)
- ADynamic DesirableCorrect answer
- BDynamic Active
- CDynamic AutoCorrect answer
- DDynamic Preferred
Why this is the answer
DTP modes are Dynamic Desirable and Dynamic Auto. Dynamic Active and Dynamic Preferred are not valid DTP modes.
- Question 21Interactive
Refer to the show command output. What is the native VLAN for the trunk port?
- AVLAN 1
- BVLAN 10Correct answer
- CVLAN 20
- DVLAN 100
Why this is the answer
The show interfaces trunk output indicates the native VLAN as VLAN 10.
- Question 22Single Choice
What is the default native VLAN on a Cisco switch trunk port?
- AVLAN 0
- BVLAN 1Correct answer
- CVLAN 100
- DVLAN 1002
Why this is the answer
The default native VLAN on Cisco switches is VLAN 1. It is recommended to change it to an unused VLAN for security.
- Question 23Multiple Select
Which of the following statements about DTP are true? (Choose two.)
- ADTP is an IEEE standard protocol.
- BDTP is a Cisco proprietary protocol.Correct answer
- CDTP automatically negotiates trunk links between switches.Correct answer
- DDTP is required for trunking to work.
Why this is the answer
DTP is Cisco proprietary and used for automatic trunk negotiation. Trunking can be configured manually without DTP.
- Question 24Interactive
Examine the configuration. What is the DTP mode on interface GigabitEthernet0/1?
- AAccess
- BTrunk
- CDynamic DesirableCorrect answer
- DDynamic Auto
Why this is the answer
The command 'switchport mode dynamic desirable' sets the DTP mode to Dynamic Desirable, which actively negotiates a trunk.
- Question 25Single Choice
Which switch becomes the root bridge in a Spanning Tree Protocol (STP) network?
- AHighest MAC address
- BLowest bridge IDCorrect answer
- CHighest port number
- DMost physical ports
Why this is the answer
The root bridge is elected based on the lowest bridge ID, which combines priority and MAC address.
- Question 26Multiple Select
Which of the following port roles exist in Rapid Spanning Tree Protocol (RSTP)? (Choose two.)
- ARoot Port
- BAlternate PortCorrect answer
- CBackup PortCorrect answer
- DDesignated Port
Why this is the answer
RSTP introduces Alternate and Backup ports to provide faster convergence. Root and Designated ports also exist in STP.
Network Fundamentals
8 questions in this domain
- Question 27Interactive
Refer to the ACL entry. Which type of traffic does this ACL permit?
- AHTTP trafficCorrect answer
- BHTTPS traffic
- CAll TCP traffic
- DAll IP traffic
Why this is the answer
The ACL permits TCP traffic to destination port 80, which is used by HTTP.
- Question 28Interactive
Refer to the network diagram description. How many links are required for a full mesh of 4 nodes?
- A4
- B6Correct answer
- C8
- D12
Why this is the answer
A full mesh of n nodes requires n(n-1)/2 links. For 4 nodes, it is 4*3/2 = 6 links.
- Question 29Interactive
Examine the encapsulation order. Which PDU is formed at the Network layer?
- APacketCorrect answer
- BFrame
- CSegment
- DBits
Why this is the answer
At the Network layer, the PDU is called a packet (or IP datagram).
- Question 30Interactive
Refer to the IPv6 address. What is the correct compressed form?
- A2001:db8::1Correct answer
- B2001:db8:0:0:0:0:0:1
- C2001:db8:0::1
- D2001:db8::0:1
Why this is the answer
The address 2001:0db8:0000:0000:0000:0000:0000:0001 is compressed to 2001:db8::1 by removing leading zeros and replacing consecutive zero groups with ::.
- Question 31Interactive
Refer to the interface status output. What duplex mode is the interface operating in?
- AFull-duplexCorrect answer
- BHalf-duplex
- CAuto-negotiation failed
- DSimplex
Why this is the answer
The output shows 'Full-duplex' indicating the interface is running in full-duplex mode.
- Question 32Single Choice
Which protocol is used to resolve an IP address to a MAC address on a local network?
- AARPCorrect answer
- BDNS
- CDHCP
- DICMP
Why this is the answer
Address Resolution Protocol (ARP) resolves an IPv4 address to a MAC address on the same local network.
- Question 33Multiple Select
Which two statements about ICMP are correct? (Choose two)
- AICMP is used for error reporting.Correct answer
- BICMP supports the ping command.Correct answer
- CICMP operates at the Transport layer.
- DICMP assigns IP addresses dynamically.
Why this is the answer
ICMP is used for error messages and diagnostic tools like ping. It operates at Layer 3, not Transport. DHCP assigns IP addresses dynamically.
- Question 34Interactive
Refer to the DHCP debug output. Which phase follows the DHCP Offer?
- ADHCP RequestCorrect answer
- BDHCP Discover
- CDHCP Acknowledge
- DDHCP NAK
Why this is the answer
The DORA process is Discover, Offer, Request, Acknowledge. After the Offer, the client sends a DHCP Request.
Security Fundamentals
6 questions in this domain
- Question 35Single Choice
What is the default action of an Access Control List (ACL) when a packet does not match any entry?
- AThe packet is permitted
- BThe packet is denied (implicit deny)Correct answer
- CThe packet is forwarded to the next ACL
- DThe router sends an ICMP message
Why this is the answer
Every ACL ends with an implicit deny any any; unmatched packets are dropped.
- Question 36Multiple Select
Which of the following are true about standard ACLs? (Choose two.)
- AThey filter based on source IP onlyCorrect answer
- BThey can filter by destination port
- CThey are identified by numbers 100-199
- DBest practice is to apply them near the destinationCorrect answer
Why this is the answer
Standard ACLs use source IP only and should be placed near the destination. Extended ACLs use port numbers and numbers 100-199.
- Question 37Interactive
Refer to the configuration. What is the issue with this ACL?
- AThe ACL is missing a permit any any at the end
- BThe order of entries is incorrect
- CThe ACL has an implicit deny that blocks all other trafficCorrect answer
- DThe ACL number is invalid
Why this is the answer
The ACL only permits specific traffic; the implicit deny will block everything else, which may be intended.
- Question 38Single Choice
Which type of firewall maintains a state table to track active connections?
- AStateless firewall
- BStateful firewallCorrect answer
- CProxy firewall
- DPacket filter
Why this is the answer
A stateful firewall uses a state table to remember connection states, unlike stateless firewalls.
- Question 39Multiple Select
Which of the following are security threats covered in the CCNA? (Choose two.)
- APhishingCorrect answer
- BDistributed Denial of Service (DDoS)Correct answer
- CSQL Injection
- DMan-in-the-Middle
Why this is the answer
Phishing and DDoS are explicitly covered in the Security Fundamentals section. SQL injection and MiTM are not.
- Question 40Interactive
Based on the configuration, what type of VPN tunnel does this represent?
- ATransport mode
- BTunnel modeCorrect answer
- CSSL VPN
- DAggressive mode
Why this is the answer
The command 'tunnel mode ipsec ipv4' indicates tunnel mode, which encapsulates the entire original packet.
Frequently asked questions
Everything about the Cisco Certified Network Associate question bank and how to use it.