CCNA Sample Questions: Practice Real Exam Format

Sample Questions

Read each question, answer based on your knowledge, and review the explanation to understand the reasoning. These samples span all CCNA domains.

Question 1 (IP Connectivity)

A SaaS startup is moving its API tier into an AWS VPC, but its database cluster stays on-premises. You must run single-area OSPFv2 in area 0 between the on-prem Cisco router and a Cisco CSR in the VPC. The new link is a point-to-point GRE over IPsec tunnel using a /30 subnet, and the router IDs are already unique. You want an OSPF adjacency with no DR/BDR election. Which OSPF network type should be set on the tunnel interfaces?

A) Set the OSPF network type to point-to-point. B) Set the OSPF network type to broadcast. C) Set the OSPF cost to 10 on both endpoints. D) Set the OSPF interface priority to 0.

Correct Answer: A

The point-to-point setting is correct because a point-to-point OSPF link has exactly one neighbor and performs no DR/BDR election, satisfying the requirement. The broadcast setting is the strongest distractor: on a /30 tunnel that looks Ethernet-like, broadcast is an easy choice, but it would force a DR/BDR election and is not needed on a two-router link. Setting interface priority to 0 only makes a router ineligible to become DR/BDR; on a broadcast network it does not remove the election, and with both endpoints ineligible the adjacency can fail to advance. The general rule is to use OSPF network type point-to-point on any link that connects exactly two routers to eliminate DR/BDR overhead and make the adjacency deterministic.

---

Question 2: AAA and TACACS+ (Security Fundamentals)

While players are online, a gaming studio cannot stop or reconfigure the RADIUS server that authenticates player accounts. The network team now needs AAA for administrators who manage routers and switches. Compliance requires per-command authorization and a central record of every command an administrator executes. Which AAA solution satisfies the requirement?

A) Create unique local accounts on each device and use privilege levels to control command access. B) Add a TACACS+ server for admin authentication, command authorization, and command accounting. C) Reconfigure the existing player RADIUS server to authenticate administrators and log their commands. D) Add a dedicated RADIUS server for admin authentication and standard login/logout accounting.

Correct Answer: B

The TACACS+ option is correct because the requirement is per-command authorization and a central record of every command, and the existing RADIUS server cannot be touched. TACACS+ separates authentication, authorization, and accounting and is designed to authorize individual commands on network devices. The strongest distractor is the option that reconfigures the existing RADIUS server: RADIUS is a strong choice for network access but it does not provide per-command authorization, and the scenario forbids reconfiguring that server. The local-account option fails the central command record requirement. The rule that generalises is: use TACACS+ for administrative device access when command-level authorization and accounting are required, and RADIUS for end-user network access such as Wi-Fi or VPN.

---

Question 3: OSPF Router ID (IP Connectivity)

A telecom operator is replacing a failed core router; the replacement will run single-area OSPFv2 in area 0. The old router's OSPF Router ID (192.0.2.1) is used by fault-management and reporting systems, so it must remain the replacement's Router ID after every reload. The replacement has loopback0 192.0.2.254/32 for management and loopback1 10.255.255.1/32 for a new service. Both loopbacks must stay configured. What must be configured on the replacement?

A) Advertise 192.0.2.1/32 with a network statement and rely on OSPF to select it. B) Set router-id 192.0.2.1 inside the OSPF process and verify with show ip ospf. C) Change loopback0 to primary 192.0.2.1 and keep 192.0.2.254 as a secondary. D) Add loopback2 with address 192.0.2.1/32 and advertise that loopback into OSPF area 0.

Correct Answer: B

The explicit router-id option is correct because a manually configured router ID takes precedence over the highest-loopback/highest-interface-IP selection rule in OSPF. Since loopback0 is 192.0.2.254, address-based selection would give 192.0.2.254, so the consistency requirement forces an explicit value of 192.0.2.1. The strongest distractor is the option that makes 192.0.2.1 the primary address of loopback0 while retaining 192.0.2.254 as a secondary: the no-router-id rule uses the highest active interface IP address, and secondary addresses are still interface addresses, so the router still selects 192.0.2.254. The general rule is to configure an explicit router-id whenever a stable Router ID is an operational requirement, and to remember that duplicate Router IDs on adjacent routers prevent OSPF from reaching Full state.

---

Question 4: DHCP Snooping (Network Access)

A clinic's DHCP server has one /24 scope for 60 IoT pumps and 80 staff BYOD phones. An attacker on a wall port floods DHCPDISCOVER with spoofed MAC addresses until the pool is exhausted. The clinic must keep pumps and BYOD phones online, and IT staff cannot reconfigure personal phones. Which action meets both requirements?

A) Increase the DHCP lease duration to reduce repeated DHCP requests. B) Expand the DHCP scope to a /16 and release all current leases. C) Enable DHCP snooping and rate-limit DHCP messages on untrusted ports. D) Manually assign static IP addresses to the pumps and BYOD phones.

Correct Answer: C

Because an attacker can repeat the spoofed DHCP floods until any newly enlarged scope is also exhausted, the scope-expansion answer only treats the symptom and fails the 'prevent a repeat' constraint. The correct action is the one that enables DHCP snooping on the switch and rate-limits DHCP messages on untrusted ports: user-facing wall ports are untrusted, and the switch drops DHCP traffic that exceeds the configured rate, while maintaining a binding table of legitimate leases. The static-IP answer is infeasible because IT staff cannot reconfigure personal BYOD phones; increasing lease duration can actually prolong malicious leases. The general rule is that resource-exhaustion attacks are stopped at the trust boundary by rate-limiting and validating the source, not by increasing the size of the resource.

---

Question 5: OSPF Equal-Cost Multipath (IP Connectivity)

A healthcare provider's core router has five equal-bandwidth Metro Ethernet circuits to its distribution router. OSPF is running over all five, but the routing table has only four equal-cost next hops for the electronic health record server. To meet telehealth latency targets, OSPF must install and use all five equal-cost paths, and no new or replacement WAN services are funded. What should the engineer do?

A) Change OSPF cost on the fifth circuit so it is the preferred path. B) Configure maximum-paths 5 under the OSPF process on both routers. C) Replace the five Metro Ethernet circuits with one 10 Gbps circuit instead. D) Add a floating static route to the server subnet over the fifth circuit.

Correct Answer: B

The correct answer raises OSPF's maximum-paths limit. Cisco IOS OSPF installs only four equal-cost routes by default, so the fifth equal-cost path is known to OSPF but is not placed in the routing table. The floating static route is the strongest distractor: it is a real backup mechanism, but because it is floating it stays inactive while the OSPF route exists, so it does not make the fifth circuit carry live traffic. Replacing the circuits is not allowed under the stated funding constraint. General rule: before adding links or static backup routes, check for protocol path limits; OSPF equal-cost multipath is governed by the maximum-paths command.

---

Question 6: Catalyst 9800 WLAN Client Limit (Network Access)

A public-sector agency uses a Catalyst 9800 and one access point. The only client-count setting changed in the GUI was the 'Public_Guest' WLAN's Client Association Limit, now set to 25. When the 26th user tries to join, the device sees the SSID but association fails; the 25 connected users stay online. What is enforcing the failure?

A) The access point radio has reached its separate configured client maximum. B) The WLAN's Client Association Limit, configured in Advanced settings, is full. C) The RADIUS server denied authentication because the guest account has expired. D) The WLAN's failed-authentication client exclusion policy has blocked the new user.

Correct Answer: B

This is correct because Client Association Limit is a WLAN-level hard cap in the Catalyst 9800 GUI. Once 25 clients are associated to that WLAN, further association attempts to the same SSID are refused even though the SSID is still visible and the existing clients are unaffected. The access point radio maximum answer is the strongest distractor, but a radio cap is a separate boundary at the AP/radio layer, and the scenario describes a setting changed on a single WLAN's Advanced tab. The rule to generalise is: when one SSID stops accepting new clients while current clients stay connected, check the WLAN Advanced Client Association Limit before suspecting AP/radio limits or RADIUS issues.

---

Question 7: Ansible Command Timeout (Automation and Programmability)

A public sector agency's network team uses Ansible to deploy identical ACL changes to Cisco IOS XE routers at 60 sites. The agency policy says no individual configuration command on any router may run longer than two minutes; the team has a four-hour maintenance window for the whole rollout. Which Ansible configuration enforces the per-device command ceiling?

A) Wrap the playbook in an external command that stops it after four hours. B) Set forks: 30 in ansible.cfg so updates run in parallel. C) Set ansible_command_timeout: 120 on the group of 60 routers. D) Set serial: 1 on the play so only one site is updated at a time.

Correct Answer: C

This is correct because ansible_command_timeout places the limit on each individual command sent to each network device; when the limit is exceeded the command is treated as failed. The constraint is per command per device, so the total four-hour maintenance window does not control it. The strongest distractor is the concurrency option: raising forks only changes how many devices are updated in parallel, which helps meet the aggregate window but does nothing to cap a single command's runtime. The general rule is to match the envelope to the constraint: use a per-item/per-connection timeout when the requirement is per command or per connection, and use parallelism only for aggregate throughput.

---

Question 8: Windows DNS Client Configuration (Network Fundamentals)

A SaaS startup has moved its public application to AWS and keeps a legacy inventory system in an on-premises data center connected to the VPC through AWS Site-to-Site VPN. A new Windows laptop in the office receives its IP configuration from the on-premises DHCP server. The laptop can reach AWS resources by IP address but cannot resolve the inventory hostname through the on-prem DNS server. You need to confirm whether the laptop was assigned the wrong DNS server or DNS suffix. What should you do first?

A) Run Get-DnsClientServerAddress on the laptop to see the assigned DNS server addresses. B) Review the AWS VPC DHCP option set for the subnet used by the SaaS application. C) Run ipconfig /all on the laptop to see the assigned DNS servers and DNS suffix. D) Review the DHCP scope options on the on-premises DHCP server for the laptop's subnet.

Correct Answer: C

This is correct because the laptop is an on-premises client and gets its IP parameters from the on-premises DHCP server, so the AWS VPC DHCP option set cannot influence it. ipconfig /all displays the IPv4 address, subnet mask, default gateway, DNS servers, and DNS suffix the client actually received, which directly checks the suspected DNS server and DNS suffix assignment. The strongest distractor is the VPC DHCP option set task: that AWS object only supplies DNS settings to resources attached to VPC subnets, not to a laptop in an on-premises office. The Get-DnsClientServerAddress answer is also tempting but shows only DNS server addresses, not the DNS suffix. General rule: when the problem is a client on a non-cloud network, verify the client's own received IP parameters first; cloud DHCP options only matter for resources inside that cloud network.

---

Question 9: Port Security and Multiple MACs (Network Access)

An encoder at a media streaming company connects to an access switchport through a dual-port NIC. Port security is configured with maximum 2 and the default violation mode. To support 8K output, the vendor enables a third NIC port, so the appliance now presents three authorized MAC addresses carrying media. During a live event, the switchport error-disables and the stream is blacked out. The security team requires port security to remain enabled. What should the engineer do first?

A) Change the violation mode to protect so the port stays up and drops the new MAC. B) Change the violation mode to restrict so the port stays up while violations are logged. C) Remove port security from the port and rely on DHCP snooping for policy enforcement. D) Raise the port security maximum to three and re-enable the switchport.

Correct Answer: D

The shutdown was triggered because the configured port-security ceiling of two secure MAC addresses was crossed by a third MAC that the appliance is authorized to use. Because the constraint is to keep port security enabled and the third port is part of the live media path, the engineer must adjust the boundary: configure switchport port-security maximum 3 and re-enable the port. The strongest distractor, changing the violation mode to restrict, keeps the link up and logs events, but it still drops frames above the two-MAC ceiling, so the third media NIC's traffic remains blocked and the outage is not fixed. The rule is: when port security error-disables a port, determine whether the violation is an attacker or an under-sized allowed-MAC set; if the MACs are authorized, change the maximum, not just the violation response.

Related Resources

Review the exam objectives, explore the study plan, and check the practice test for comprehensive assessment.

Exam facts on this page come from Cisco’s own pages (official exam page). Prices, versions and policies change — confirm there before you book.