العربية

Cisco Certified Network Associate (CCNA): free practice test

Start with 10 free questions to see what needs more practice. Finish to see your score, weakest units and every option explained.

Back to Cisco Certified Network Associate (CCNA)

Practice test questions with answers and explanations

Try the questions in the test above first, then open each one here to see the correct answer and why every other option is wrong.

01An exercise explicitly uses Modified EUI-64 derived from MAC 00:25:96:12:34:56. Which interface identifier is produced?

Practice question Unit: Network Fundamentals

  1. A0025:96ff:fe12:3456

    This inserts ff:fe but fails to invert the universal/local bit in the first octet.

  2. B0225:9612:3456:fffe

    The inserted octets belong in the middle of the MAC-derived identifier, not at its end.

  3. C0225:96ff:fe12:3456 ✓ Correct answer

    Insert ff:fe after the first three octets and XOR the first octet with 02: 00 becomes 02.

  4. D0225:96fe:ff12:3456

    The inserted octets are ff then fe, not fe then ff.

Reference: https://www.rfc-editor.org/rfc/rfc4291.html — Appendix A, Links or Nodes with IEEE 802 48-bit MACs

02A valid RA advertises 2001:db8:40::/64 with L=1, A=0 and nonzero lifetimes. The host has no prior address from this prefix. Which result is supported by this prefix option?

Practice question Unit: Network Fundamentals

  1. ACreate a SLAAC address and also force DHCPv6 to stop

    The option neither authorizes SLAAC nor commands a DHCPv6 client to stop.

  2. BIgnore the option for both on-link discovery and SLAAC

    A=0 blocks use for SLAAC, not the separate L=1 on-link information.

  3. CTreat the prefix as on-link, but do not create a SLAAC address from this option ✓ Correct answer

    L and A have independent meanings: on-link discovery can succeed without autonomous address creation.

  4. DCreate a SLAAC address but treat the prefix as off-link

    L=1 advertises on-link status, while A=0 does not authorize autonomous address formation.

Reference: https://www.rfc-editor.org/rfc/rfc4862.html — §5.5.3 Router Advertisement Processing; https://www.rfc-editor.org/rfc/rfc4861.html — §4.6.2 Prefix Information

03What enables VLAN 10 and VLAN 20 traffic to share one switch link?

Practice question Unit: Network Access

  1. APortFast on both interfaces

    PortFast changes STP transition behavior, not VLAN multiplexing.

  2. BTwo access VLAN assignments on one ordinary access port

    An ordinary data access port has one assigned data VLAN.

  3. CIdentical access VLAN numbers at both ends

    A single access VLAN does not carry both VLANs on the link.

  4. DAn 802.1Q trunk ✓ Correct answer

    A trunk carries several VLANs.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3650/software/release/37e/consolidated_guide/b_37e_consolidated_3650_cg/configuring_vlan_trunks.html — Trunking Overview

04A supported LACP port-channel has min-links set to 2. It initially has two active members, then one fails. What is expected even though the remaining physical link is up?

Practice question Unit: Network Access

  1. AThe remaining link automatically becomes a separate routed interface

    The threshold failure does not reconfigure a member as an independent routed link.

  2. BThe channel remains active with no bandwidth threshold

    min-links explicitly requires enough active bundled members.

  3. CThe minimum automatically falls to one

    A member failure does not reduce the configured threshold.

  4. DThe port-channel becomes inactive because the minimum is unmet ✓ Correct answer

    One active member is fewer than the configured minimum of two.

Reference: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3650/software/release/37e/consolidated_guide/b_37e_consolidated_3650_cg/configuring_etherchannels.html — LACP and Link Redundancy

05A dual-stack router has an installed IPv4 default via 192.0.2.2. Its IPv6 table contains only connected LAN prefixes, with no match for 2001:db8:900::10. A host can reach an external IPv4 server but not that IPv6 server. Which routing correction directly addresses the missing path?

Practice question Unit: IP Connectivity

  1. AAdd another IPv4 default through the same physical link

    Using the same physical link does not let an IPv4 default match IPv6 packet destinations.

  2. BIncrease the metric of the IPv4 default

    An IPv4 metric cannot provide an IPv6 forwarding entry.

  3. CAdd a valid IPv6 route covering the external IPv6 destination ✓ Correct answer

    IPv6 needs its own matching route or default via a reachable IPv6 next hop.

  4. DChange the IPv4 default mask to /32

    An IPv4 host route still does not cover an IPv6 destination.

Reference: https://www.cisco.com/c/en/us/td/docs/routers/ios-xe/ip-addressing/ip-addressing/m_ip6-add-basic-conn-xe.html — Dual IPv4 and IPv6 Protocol Stack; https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_pi/configuration/15-mt/iri-15-mt-book/ip6-route-static.html — Configuring a Static IPv6 Route

06show ipv6 route includes C 2001:db8:10::/64 via Gi0/0 and L 2001:db8:10::1/128 via Gi0/0, receive. A received packet is addressed to 2001:db8:10::1. What is the intended disposition?

Practice question Unit: IP Connectivity

  1. AForward it to every neighbor on the /64

    The local /128 represents the router’s own address, not all LAN neighbors.

  2. BPrefer the connected /64 because its scope is broader

    The local /128 specifically identifies the router’s own address; the broader connected prefix does not override that receive entry.

  3. CDiscard it solely because it matches a local entry

    Local receive is not inherently a discard action, though service or security policy can later reject traffic.

  4. DDeliver it for processing by this router itself ✓ Correct answer

    The L /128 receive entry identifies a local destination handled by the router.

Reference: https://www.cisco.com/c/en/us/support/docs/ip/ip-routing/116264-technote-ios-00.html — Cisco IOS Local Routes

07R1 Gi0/0 is 10.12.0.1/30 and R2 is 10.12.0.2/30. R1 has only network 10.12.0.2 0.0.0.0 area 0 under router ospf 1, with no interface-level OSPF command. The link is up, but Gi0/0 is absent from R1’s OSPF interfaces. Which correction targets the cause?

Practice question Unit: IP Connectivity

  1. AAdd only no passive-interface Gi0/0 without enabling OSPF there

    A passive exception does not supply a missing OSPF interface assignment.

  2. BChange only R1’s OSPF priority

    Priority affects DR eligibility after OSPF is enabled; it does not match the interface.

  3. CUse network 10.12.0.1 0.0.0.0 area 0 on R1 ✓ Correct answer

    The network statement matches local interface addresses, not the remote neighbor’s address.

  4. DChange only R1’s router ID to 10.12.0.2

    Router ID identifies the process but does not enable OSPF on the interface.

Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_ospf/command/iro-cr-book/m_ospf-i1.html — network area — Usage Guidelines

08Clients enter the relay router through Gi0/0.20; Gi0/1 faces the remote DHCP server 192.0.2.50. The helper is mistakenly configured only on Gi0/1. Where should ip helper-address 192.0.2.50 be configured to relay the client broadcasts?

Practice question Unit: IP Services

  1. AOnly on Gi0/1, because that is the server-facing interface

    Configuring the server-facing interface alone misses these incoming broadcasts.

  2. BOn Gi0/0.20, which receives the client broadcasts ✓ Correct answer

    The helper belongs on the interface receiving the client broadcast.

  3. COnly on a disconnected loopback

    The loopback does not receive these LAN broadcasts.

  4. DOnly under router ospf

    The helper is an interface command, not an OSPF process command.

Reference: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/xe-2/dhcp-xe-2-book/dhcp-relay-agent-xe.html — Information About the DHCP Relay Agent — Packet Forwarding Address

09An extended ACL must match exactly source subnet 10.40.8.64/26. Which source address/wildcard pair should be used?

Practice question Unit: Security Fundamentals

  1. A10.40.8.64 255.255.255.192

    This is the subnet mask; ACL wildcard bits use the opposite matching convention.

  2. B10.40.8.64 0.0.0.63 ✓ Correct answer

    Six ignored low bits cover .64–.127, exactly this /26.

  3. C10.40.8.64 0.0.0.127

    Ignoring seven low bits also includes addresses outside this /26.

  4. D10.40.8.64 0.0.0.31

    Ignoring five low bits matches only .64–.95.

Reference: Cisco IP Access List Overview, Wildcard Mask for Addresses in an Access List: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/15-mt/sec-data-acl-15-mt-book/sec-access-list-ov.html

10A stable Catalyst Center inventory contains 650 devices. Its documented API uses 1-based offset and a maximum limit of 500. A first GET with offset=1&limit=500 returns 500 devices. Which request retrieves the remainder without repeating the first page?

Practice question Unit: Automation and Programmability

  1. AGET the same collection with offset=1&limit=500 again

    This repeats the already collected page.

  2. BGET the same collection with offset=501&limit=500 ✓ Correct answer

    The next unread record is 501, so the response can contain the remaining 150.

  3. CDELETE the first page, then repeat the GET

    Retrieving inventory does not require deleting devices.

  4. DGET the same collection with offset=500&limit=500

    With 1-based indexing this repeats record 500.

Reference: https://developer.cisco.com/docs/catalyst-center/get-device-list/ — Description: paginated response, limit and offset

Keep preparing for Cisco Certified Network Associate (CCNA)

See also: Engineering Exams