CCNA practice questions, with answers and explanations

• A.Class A
• B.Class B
• C.Class C ✓ correct
• D.Class D

Why: Class C addresses have first octet 192-223, with default mask 255.255.255.0 (/24).

• A.1-126 ✓ correct
• B.128-191
• C.192-223
• D.0-255

Why: Class A: 1-126 (0 and 127 reserved). Default mask 255.0.0.0 (/8).

• A.FE80::1 ✓ correct
• B.FF02::1
• C.2001::1
• D.FC00::1

Why: FE80::/10 is the link-local range. FF02 is multicast, 2001 is global unicast, FC00 is unique local.

• A.Automatic Private IP Addressing ✓ correct
• B.Advanced Public IP Assignment
• C.Automated Protocol IP Allocation
• D.Available Private IP Addresses

Why: APIPA (Automatic Private IP Addressing) assigns 169.254.x.x when DHCP fails.

• A.32 bits
• B.64 bits
• C.128 bits ✓ correct
• D.256 bits

Why: IPv6 addresses are 128 bits long, written as 8 groups of 4 hexadecimal digits.

• A.172.16.0.0/12
• B.192.168.0.0/16
• C.10.0.0.0/8 ✓ correct
• D.All of them

Why: 10.0.0.0/8 is the Class A private range (RFC 1918).

• A.127.0.0.1 ✓ correct
• B.192.168.1.1
• C.10.0.0.1
• D.0.0.0.0

Why: 127.0.0.1 is the standard IPv4 loopback address for testing local TCP/IP.

• A.Binary
• B.Decimal
• C.Hexadecimal ✓ correct
• D.Octal

Why: IPv6 addresses use hexadecimal notation (0-9, A-F), grouped by colons.

• A.FE80::/10
• B.FF00::/8 ✓ correct
• C.2000::/3
• D.FC00::/7

Why: FF00::/8 is the IPv6 multicast prefix. IPv6 has no broadcast, only multicast.

• A.0
• B.128
• C.255
• D.256 ✓ correct

Why: Each IPv4 octet must be 0-255. 256 is invalid (exceeds 8-bit maximum).

• A.5
• B.6
• C.7 ✓ correct
• D.8

Why: OSI model has 7 layers.

• A.Layer 2
• B.Layer 3 ✓ correct
• C.Layer 4
• D.Layer 7

Why: Layer 3 (Network) handles routing with IP addresses.

• A.Packet
• B.Frame ✓ correct
• C.Segment
• D.Bit

Why: Layer 2 uses Frames as Protocol Data Units.

• A.1-1024
• B.1-4094 ✓ correct
• C.0-4095
• D.1-1005

Why: VLAN IDs: 1-4094. 0 and 4095 are reserved.

• A.4-byte tag ✓ correct
• B.8-byte tag
• C.MAC address
• D.IP address

Why: 802.1Q adds a 4-byte tag containing VLAN information.

• A.VLAN 1 ✓ correct
• B.VLAN 99
• C.VLAN 100
• D.VLAN 999

Why: VLAN 1 should not be native VLAN (security best practice).

• A.1 ✓ correct
• B.2
• C.Multiple
• D.All VLANs

Why: Access ports carry only one VLAN.

• A.Switch only
• B.Router or L3 switch ✓ correct
• C.Hub
• D.VLAN 1

Why: Inter-VLAN routing requires Layer 3 device (router or L3 switch).

• A.Routing loops
• B.Broadcast storms ✓ correct
• C.IP conflicts
• D.DNS issues

Why: STP prevents Layer 2 loops causing broadcast storms.

• A.Designated port
• B.Root bridge ✓ correct
• C.Blocked port
• D.Backup port

Why: Switch with lowest Bridge ID becomes root bridge.

• A.Every second
• B.Every 2 seconds ✓ correct
• C.Every 10 seconds
• D.Every 20 seconds

Why: BPDUs sent every 2 seconds (Hello timer).

• A.802.1D
• B.PVST
• C.RSTP ✓ correct
• D.MST

Why: RSTP (Rapid STP) converges in <1 second vs 30-50s for classic.

• A.Designated port
• B.Root port ✓ correct
• C.Alternate port
• D.Edge port

Why: Port with best path to root bridge is the Root Port.

• A.802.1Q
• B.802.3ad ✓ correct
• C.802.1X
• D.802.11ac

Why: LACP is IEEE 802.3ad standard for link aggregation (later updated to 802.1AX).

• A.Active
• B.Passive
• C.Desirable ✓ correct
• D.On

Why: Desirable is a PAgP mode. LACP modes: Active, Passive. Static mode: On (no protocol).

• A.Forms normally
• B.Fails to form ✓ correct
• C.Forms but drops traffic
• D.Causes spanning-tree loop

Why: EtherChannel requires identical configuration. Mismatched VLANs prevent channel formation.

• A.Auto-Auto
• B.Desirable-Auto ✓ correct
• C.On-Passive
• D.Active-Desirable

Why: Desirable-Auto or Desirable-Desirable forms PAgP channel. Auto-Auto won't (both wait).

• A.Multiple separate links
• B.One logical link ✓ correct
• C.Ignores it completely
• D.Blocks all ports

Why: STP sees EtherChannel as single logical link, preventing port blocking within the bundle.

• A.port-channel load-balance src-dst-ip ✓ correct
• B.etherchannel load-balance ip
• C.load-balance src-dst-ip
• D.channel load-balance ip both

Why: Global config: 'port-channel load-balance src-dst-ip' for IP-based load distribution.

• A.Passive mode
• B.Port is down
• C.Port is bundled in port-channel ✓ correct
• D.PAgP protocol

Why: (P) indicates port is bundled and active in the port-channel. (D) means down.

• A.Yes, automatically adjusts
• B.Yes, but reduces to slowest speed
• C.No, speeds must match ✓ correct
• D.Only with LACP

Why: All EtherChannel members must have identical speed, duplex, and configuration.

• A.Active
• B.Passive
• C.On ✓ correct
• D.Desirable

Why: 'On' mode forces EtherChannel without LACP/PAgP negotiation (use cautiously).

• A.Vlan interface
• B.Routed port-channel ✓ correct
• C.Switch virtual interface
• D.Tunnel interface

Why: Layer 3 EtherChannel creates a routed port-channel interface with IP address.

• A.Longer range
• B.More non-overlapping channels ✓ correct
• C.Better wall penetration
• D.Lower cost

Why: 5 GHz has more non-overlapping channels, reducing interference in dense deployments.

• A.3 ✓ correct
• B.11
• C.13
• D.24

Why: Only 3 non-overlapping channels in 2.4 GHz: 1, 6, and 11.

• A.Secure Service ID
• B.Service Set Identifier ✓ correct
• C.System Security ID
• D.Signal Strength Indicator

Why: SSID = Service Set Identifier, the wireless network name.

• A.802.11n
• B.802.11ac
• C.802.11ax ✓ correct
• D.802.11g

Why: 802.11ax is marketed as Wi-Fi 6, the latest generation.

• A.AP SSID
• B.AP MAC address ✓ correct
• C.Client MAC address
• D.Network password

Why: BSSID is the AP's MAC address, uniquely identifying each BSS.

• A.Higher security
• B.Roaming between APs ✓ correct
• C.Faster speeds
• D.More clients

Why: ESS (Extended Service Set) enables seamless roaming between multiple APs with same SSID.

• A.Excellent
• B.Good
• C.Fair
• D.Poor ✓ correct

Why: -85 dBm is poor signal. Scale: -30=excellent, -50=good, -70=fair, -85=poor.

• A.Range
• B.Throughput ✓ correct
• C.Security
• D.Number of clients

Why: Channel bonding combines channels for higher throughput (40/80/160 MHz).

• A.2.4 GHz ✓ correct
• B.5 GHz
• C.Both equal
• D.Neither

Why: 2.4 GHz has better wall penetration and longer range than 5 GHz.

• A.Multiple Internet Multiple Output
• B.Multi-Input Multi-Output
• C.Multiple Input Multiple Output ✓ correct
• D.Managed Input Managed Output

Why: MIMO = Multiple Input Multiple Output, uses multiple antennas for better performance.

• A.PSK
• B.802.1X ✓ correct
• C.WEP
• D.Open authentication

Why: WPA2-Enterprise uses 802.1X authentication with EAP and RADIUS server.

• A.WPA
• B.WPA2
• C.WEP ✓ correct
• D.WPA3

Why: WEP is broken and easily cracked. Always use WPA2 minimum.

• A.Faster speeds
• B.Per-user authentication ✓ correct
• C.Easier setup
• D.Works with older devices

Why: Enterprise provides per-user authentication and centralized management via RADIUS.

• A.DDoS
• B.Offline dictionary attacks ✓ correct
• C.MAC spoofing
• D.ARP poisoning

Why: WPA3's SAE protects against offline dictionary/brute-force attacks on captured handshakes.

• A.Remote Authentication Dial-In User Service ✓ correct
• B.Rapid Access Dynamic Internet User System
• C.Router Authentication Data Internet User Service
• D.Remote Access Domain Internet User Service

Why: RADIUS = Remote Authentication Dial-In User Service, centralized AAA server.

• A.PEAP
• B.EAP-TLS ✓ correct
• C.EAP-FAST
• D.EAP-MD5

Why: EAP-TLS uses digital certificates for mutual authentication (most secure EAP method).

• A.Faster connection
• B.Past traffic protected if password compromised ✓ correct
• C.Automatic updates
• D.Better range

Why: Forward secrecy ensures old traffic remains encrypted even if current password is discovered.

• A.Faster setup
• B.PIN brute-force attack ✓ correct
• C.Better encryption
• D.Guest access

Why: WPS is vulnerable to PIN brute-force attacks. Disable WPS for security.

• A.Strong security
• B.Weak security (easily bypassed) ✓ correct
• C.Enterprise security
• D.No security

Why: MAC filtering is weak security - MACs are easily spoofed. Use with WPA2/3, not alone.

• A.8 characters
• B.12 characters
• C.15 characters
• D.20+ characters ✓ correct

Why: While 8 is minimum, 20+ character passphrases provide strong security against attacks.

• A.1
• B.90 ✓ correct
• C.110
• D.120

Why: EIGRP has AD=90, making it more trusted than OSPF (110) or RIP (120).

• A.C
• B.S ✓ correct
• C.D
• D.O

Why: 'S' indicates static routes, manually configured by administrators.

• A.90
• B.100
• C.110 ✓ correct
• D.120

Why: OSPF has AD=110, less trusted than EIGRP (90) but more than RIP (120).

• A.Less trusted
• B.More trusted ✓ correct
• C.Slower
• D.Faster

Why: Lower AD = more trusted. Routers prefer routes with lower administrative distance.

• A.AD=110, Metric=20 ✓ correct
• B.Cost=110, Hops=20
• C.Bandwidth=110, Delay=20
• D.Priority=110, Weight=20

Why: [AD/Metric] format: 110 is AD (OSPF), 20 is the metric (cost).

• A.VRRP
• B.HSRP ✓ correct
• C.Both
• D.Neither

Why: HSRP is Cisco proprietary. VRRP is an open standard (RFC 3768).

• A.Standby router
• B.Active router ✓ correct
• C.Both routers
• D.Virtual router

Why: Active router forwards traffic. Standby router takes over if active fails.

• A.Both become active
• B.Highest IP wins ✓ correct
• C.Configuration error
• D.Random selection

Why: If priorities match, router with highest IP address becomes active.

• A.Yes
• B.No ✓ correct
• C.Depends on IOS version
• D.Only in VRRP

Why: HSRP preemption is disabled by default. Must manually enable with 'standby preempt'.

• A.0
• B.100
• C.200
• D.255 ✓ correct

Why: VRRP IP address owner uses priority 255 (highest possible).

• A.16
• B.255 ✓ correct
• C.1024
• D.Unlimited

Why: Most Cisco platforms support HSRP groups 0-255.

• A.show hsrp
• B.show standby ✓ correct
• C.show fhrp
• D.show redundancy

Why: 'show standby' or 'show standby brief' displays HSRP status and configuration.

• A.224.0.0.1
• B.224.0.0.2 ✓ correct
• C.224.0.0.9
• D.224.0.0.18

Why: HSRP version 1 uses 224.0.0.2. Version 2 uses 224.0.0.102.

• A.Yes, different groups
• B.No, conflict ✓ correct
• C.Only with GLBP
• D.Yes, same group

Why: HSRP and VRRP cannot run simultaneously on same interface (different protocols).

• A.HSRP
• B.VRRP
• C.GLBP ✓ correct
• D.All of them

Why: GLBP (Gateway Load Balancing Protocol) supports load balancing. HSRP/VRRP are active/standby.

• A.Stub area
• B.Backbone area ✓ correct
• C.Transit area
• D.Border area

Why: Area 0 is the backbone area. All other areas must connect to it (directly or via virtual links).

• A.Highest IP
• B.Lowest priority
• C.Highest priority, then highest RID ✓ correct
• D.First one online

Why: Highest priority wins. If tied, highest Router ID (RID). Priority 0 = never DR/BDR.

• A.Hop count
• B.Bandwidth ✓ correct
• C.Delay
• D.Load

Why: OSPF uses cost metric based on bandwidth: Cost = Reference BW / Interface BW.

• A.Type 1
• B.Type 2 ✓ correct
• C.Type 3
• D.Type 5

Why: DR sends Type 2 LSA (Network LSA) for multi-access networks. Type 1 = Router LSA.

• A.2-Way
• B.ExStart
• C.Full ✓ correct
• D.Loading

Why: Full state indicates neighbors have synchronized LSDB (Link-State Database).

• A.show ip route ospf
• B.show ip ospf neighbor ✓ correct
• C.show ospf
• D.show ip protocols

Why: 'show ip ospf neighbor' displays OSPF neighbor status, state, and priority.

• A.Highest priority
• B.Default priority
• C.Never become DR/BDR ✓ correct
• D.Always DR

Why: Priority 0 means router will never participate in DR/BDR election.

• A.Area 0
• B.Standard area
• C.Stub area ✓ correct
• D.Backbone area

Why: Stub areas block Type 5 (External) LSAs, reducing routing table size.

• A.TCP
• B.UDP
• C.IP protocol 89 ✓ correct
• D.IP protocol 88

Why: OSPF runs directly on IP using protocol number 89 (not TCP/UDP).

• A.15
• B.16
• C.255
• D.Unlimited ✓ correct

Why: OSPF has no hop count limit (unlike RIP's 15). Uses cost metric instead.

• A.0
• B.1 ✓ correct
• C.90
• D.110

Why: Static routes have AD=1, second only to connected routes (AD=0).

• A.ip route 0.0.0.0 0.0.0.0 [next-hop] ✓ correct
• B.ip default-route [next-hop]
• C.default-gateway [next-hop]
• D.ip route all [next-hop]

Why: 'ip route 0.0.0.0 0.0.0.0 [next-hop]' creates a default route.

• A.Automatic failover
• B.Scalability
• C.No routing protocol overhead ✓ correct
• D.Automatic updates

Why: Static routing has no protocol overhead, uses less CPU/bandwidth than dynamic protocols.

• A.Static route that changes
• B.Backup static route ✓ correct
• C.Dynamic static route
• D.Default route

Why: Floating static route is a backup with higher AD, only used when primary route fails.

• A.Large enterprise
• B.Small/stub networks ✓ correct
• C.Dynamic topologies
• D.Never

Why: Static routing best for small, stub networks with predictable topology.

• A.Private Address Translation
• B.Port Address Translation ✓ correct
• C.Public Access Translation
• D.Protocol Address Translation

Why: PAT = Port Address Translation (also called NAT overload).

• A.One-to-many
• B.Many-to-one
• C.One-to-one ✓ correct
• D.Many-to-many

Why: Static NAT: Permanent one-to-one mapping between inside local and inside global addresses.

• A.show nat table
• B.show ip nat translations ✓ correct
• C.show nat active
• D.display nat

Why: 'show ip nat translations' displays active NAT mappings and connection details.

• A.Static NAT
• B.Dynamic NAT
• C.PAT ✓ correct
• D.Double NAT

Why: 'overload' keyword enables PAT, allowing multiple inside hosts to share one public IP using ports.

• A.Layer 2
• B.Layer 3 ✓ correct
• C.Layer 4
• D.Layer 7

Why: NAT operates at Layer 3, translating IP addresses (PAT also uses Layer 4 port numbers).

• A.Only 192.168.0.0/16
• B.Only 10.0.0.0/8
• C.10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 ✓ correct
• D.Only 172.16.0.0/12

Why: RFC 1918 defines three private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16.

• A.Slower
• B.Pool can be exhausted ✓ correct
• C.Less secure
• D.Doesn't support TCP

Why: Dynamic NAT limited by pool size. PAT overcomes this using port numbers with one IP.

• A.Public IP on internet
• B.Private IP on internal network ✓ correct
• C.ISP gateway IP
• D.Loopback address

Why: Inside Local = private IP address used on the internal network (before translation).

• A.Uses static NAT
• B.New connections dropped ✓ correct
• C.Automatically expands
• D.Switches to PAT

Why: When pool exhausted, new connection attempts are dropped until translations are freed.

• A.Increases speed
• B.Conserves IPv4 addresses ✓ correct
• C.Improves QoS
• D.Reduces latency

Why: NAT's main benefit: conserves public IPv4 addresses by reusing private addresses internally.

• A.Discover Offer Request Acknowledge ✓ correct
• B.Dynamic Obtain Release Assign
• C.Destination Offer Route Allocate
• D.Data Open Request Allow

Why: DORA: Discover, Offer, Request, Acknowledge - the 4-step DHCP process.

• A.Unicast
• B.Broadcast ✓ correct
• C.Multicast
• D.Anycast

Why: DHCP Discover is broadcast to 255.255.255.255 since client doesn't know server IP yet.

• A.Speed up DHCP
• B.Reserve IPs for static devices ✓ correct
• C.Block unwanted clients
• D.Increase pool size

Why: Excludes addresses needed for servers, routers, printers - devices with static IPs.

• A.Server uptime
• B.How long client keeps assigned IP ✓ correct
• C.Network bandwidth
• D.Pool capacity

Why: Lease time specifies duration client can use assigned IP before needing renewal.

• A.show dhcp leases
• B.show ip dhcp binding ✓ correct
• C.show bindings
• D.display dhcp active

Why: 'show ip dhcp binding' displays active leases: MAC address, IP, expiration time.

• A.Broadcast
• B.Unicast ✓ correct
• C.Multicast
• D.Anycast

Why: DHCP Offer is unicast from server to client (server knows client MAC from Discover).

• A.At 50% of lease time ✓ correct
• B.When lease expires
• C.Every hour
• D.Only manually

Why: Client attempts renewal at 50% of lease time (T1), then 87.5% (T2) if first attempt fails.

• A.Assigns static IP
• B.Forwards DHCP broadcasts ✓ correct
• C.Creates DHCP pool
• D.Blocks DHCP

Why: 'ip helper-address' converts and forwards DHCP broadcasts to specified server IP.

• A.1 hour
• B.1 day ✓ correct
• C.7 days
• D.30 days

Why: Default DHCP lease is 1 day (24 hours) on Cisco routers.

• A.Server offline
• B.Two devices have same IP ✓ correct
• C.Pool exhausted
• D.Wrong gateway

Why: Conflict occurs when assigned IP is already in use (often from static misconfiguration).

• A.Best Effort
• B.IntServ
• C.DiffServ ✓ correct
• D.FIFO

Why: DiffServ (Differentiated Services) is scalable, class-based, and industry standard.

• A.50ms
• B.150ms ✓ correct
• C.500ms
• D.1000ms

Why: Voice requires delay under 150ms one-way for acceptable quality (preferably <100ms).

• A.3 bits ✓ correct
• B.6 bits
• C.8 bits
• D.16 bits

Why: CoS uses 3 bits in 802.1Q header, providing 8 priority levels (0-7).

• A.Web browsing
• B.Voice traffic ✓ correct
• C.Email
• D.File transfer

Why: DSCP EF (Expedited Forwarding, value 46) provides highest priority for voice.

• A.FIFO
• B.Priority Queuing ✓ correct
• C.WFQ
• D.Round Robin

Why: Priority Queuing (PQ) strictly prioritizes high queues, potentially starving low priority.

• A.PQ + FIFO
• B.PQ + CBWFQ ✓ correct
• C.WFQ + Round Robin
• D.Shaping + Policing

Why: LLQ (Low Latency Queuing) = Priority Queue + CBWFQ for voice + data.

• A.Core routers
• B.Network edge ✓ correct
• C.End devices
• D.Anywhere

Why: Mark at network edge, trust markings in core. Prevents remarking/gaming the system.

• A.Current Information Rate
• B.Committed Information Rate ✓ correct
• C.Constant Input Rate
• D.Configured Interface Rate

Why: CIR (Committed Information Rate) is the guaranteed bandwidth rate in traffic shaping/policing.

• A.Policing
• B.Shaping ✓ correct
• C.Both equal
• D.Neither

Why: Shaping buffers excess (no drops), allowing TCP to adjust gracefully. Policing drops packets.

• A.show qos
• B.show policy
• C.show policy-map interface ✓ correct
• D.show class-map

Why: 'show policy-map interface [name]' displays applied QoS policies and statistics.

• A.Source IP only
• B.Destination IP only
• C.Source, destination, protocol, port ✓ correct
• D.MAC address only

Why: Extended ACLs filter by source IP, destination IP, protocol type, and port numbers.

• A.Permit all
• B.Deny all ✓ correct
• C.No rule
• D.Log all

Why: Implicit 'deny any' at end of every ACL blocks all unmatched traffic.

• A.Bottom-up
• B.Top-down, first match wins ✓ correct
• C.Random order
• D.By priority number

Why: ACLs process top-down, stopping at first match. Order matters!

• A.Near source
• B.Near destination ✓ correct
• C.On core routers only
• D.Anywhere

Why: Standard ACLs: Place near destination (they filter ALL traffic from source).

• A.Near source ✓ correct
• B.Near destination
• C.On access switches
• D.Core only

Why: Extended ACLs: Place near source to filter specific traffic early, reducing bandwidth waste.

• A.Single host
• B.Entire /24 subnet ✓ correct
• C.Entire /16 subnet
• D.Any address

Why: 0.0.0.255 wildcard matches all hosts in a /24 subnet (last octet can vary).

• A.access-list 100 permit icmp any any ✓ correct
• B.access-list 100 permit ping any any
• C.access-list 100 allow icmp any any
• D.permit icmp 100

Why: 'access-list 100 permit icmp any any' allows all ICMP (ping, traceroute, etc.).

• A.Faster processing
• B.Can insert/delete specific lines ✓ correct
• C.Use less memory
• D.No implicit deny

Why: Named ACLs allow inserting/deleting specific lines using sequence numbers for easier editing.

• A.equal
• B.eq ✓ correct
• C.port
• D.match

Why: 'eq 80' means 'equal to port 80'. Other operators: neq, lt, gt, range.

• A.No limits
• B.One per direction (in/out)
• C.One per protocol per direction ✓ correct
• D.Maximum 5 ACLs

Why: One ACL per protocol (IP, IPX), per direction (in/out), per interface. Typically one IP ACL in, one IP ACL out.

• A.DoS
• B.Man-in-the-Middle ✓ correct
• C.Phishing
• D.SQL Injection

Why: Man-in-the-Middle (MITM) intercepts and potentially modifies communications between parties.

• A.Malware
• B.Social engineering ✓ correct
• C.DoS attack
• D.Network scanning

Why: Phishing is social engineering, manipulating users via fake emails to divulge information.

• A.Encryption
• B.Hashing ✓ correct
• C.Firewall
• D.Antivirus

Why: Hashing ensures integrity by detecting unauthorized changes to data.

• A.Virus
• B.Worm
• C.Ransomware ✓ correct
• D.Spyware

Why: Ransomware encrypts victim's files and demands ransom payment for decryption key.

• A.Password cracking
• B.MITM attacks ✓ correct
• C.DoS attacks
• D.Port scanning

Why: ARP poisoning redirects traffic through attacker, enabling MITM attacks on local network.

• A.Demilitarized Zone between internal and external networks ✓ correct
• B.Database Management Zone
• C.Dynamic Memory Zone
• D.Direct Mail Zone

Why: DMZ is a buffer network segment between trusted internal and untrusted external networks.

• A.Network bandwidth
• B.Passwords ✓ correct
• C.DNS servers
• D.Physical access

Why: Brute-force systematically tries all possible password combinations until successful.

• A.Hashing
• B.Encryption ✓ correct
• C.Access lists
• D.Firewalls

Why: Encryption ensures confidentiality by making data unreadable without decryption key.

• A.Following someone through secure door ✓ correct
• B.Network monitoring
• C.Email spoofing
• D.Port scanning

Why: Tailgating: Unauthorized person follows authorized person through secure access point.

• A.Maximum File Access
• B.Multi-Factor Authentication ✓ correct
• C.Managed Firewall Application
• D.Multiple Function Access

Why: MFA (Multi-Factor Authentication) requires multiple verification methods for stronger security.

• A.PPTP
• B.L2TP
• C.IPsec ✓ correct
• D.SSL

Why: IPsec is the most secure VPN protocol with strong encryption and authentication.

• A.Payload only
• B.Header only
• C.Entire packet ✓ correct
• D.Nothing

Why: Tunnel mode encrypts entire original packet and adds new IP header.

• A.Encryption
• B.Authentication
• C.Tunneling only ✓ correct
• D.All security

Why: GRE provides tunneling/encapsulation but NO encryption or authentication.

• A.Two VPN connections
• B.Some traffic through VPN, rest direct ✓ correct
• C.VPN plus internet
• D.Dual authentication

Why: Split tunneling routes corporate traffic through VPN, internet traffic direct.

• A.Data encryption
• B.Management tunnel ✓ correct
• C.User authentication
• D.Data tunnel

Why: Phase 1 (ISAKMP) establishes secure management tunnel for negotiation.

• A.requests
• B.netmiko ✓ correct
• C.flask
• D.django

Why: Netmiko is the popular Python library for SSH connections to network devices.

• A.Java Standard Object Notation
• B.JavaScript Object Notation ✓ correct
• C.Joint System Object Network
• D.Java Serialized Object Name

Why: JSON = JavaScript Object Notation, lightweight data format.

• A.22
• B.80
• C.443
• D.830 ✓ correct

Why: NETCONF uses port 830 (SSH-based protocol).

• A.Created
• B.OK/Success ✓ correct
• C.Not Found
• D.Unauthorized

Why: HTTP 200 means OK/Success - request completed successfully.

• A.Encryption
• B.Data modeling ✓ correct
• C.Authentication
• D.Routing

Why: YANG defines data models for NETCONF/RESTCONF configuration.

• A.SPF
• B.DUAL ✓ correct
• C.Bellman-Ford
• D.Dijkstra

Why: EIGRP uses DUAL (Diffusing Update Algorithm) to guarantee loop-free paths.

• A.224.0.0.5
• B.224.0.0.6
• C.224.0.0.9
• D.224.0.0.10 ✓ correct

Why: EIGRP uses 224.0.0.10 for multicast updates (OSPF uses 224.0.0.5).

• A.Backup route
• B.Best route to destination ✓ correct
• C.All available routes
• D.Default route

Why: Successor is the best route with lowest metric to the destination.

• A.RD > FD
• B.RD < FD ✓ correct
• C.RD = FD
• D.No condition needed

Why: Feasibility Condition: Reported Distance < Feasible Distance ensures loop-free backup.

• A.Match between neighbors ✓ correct
• B.Be globally unique
• C.Match OSPF area
• D.Be 1-255 only

Why: EIGRP AS number must match between neighbors to form adjacency (locally significant).

• A.K1 only
• B.K1 and K2
• C.K1 and K3 ✓ correct
• D.All K values

Why: K1 (Bandwidth) and K3 (Delay) are enabled by default. K2, K4, K5 are disabled.

• A.show eigrp neighbors
• B.show ip eigrp neighbors ✓ correct
• C.show neighbors eigrp
• D.display eigrp neighbors

Why: 'show ip eigrp neighbors' displays neighbor relationships, addresses, and uptime.

• A.Static Interface Active
• B.Stuck-in-Active ✓ correct
• C.Synchronize Internal Area
• D.System Interface Alert

Why: SIA (Stuck-in-Active) occurs when a query goes unanswered, typically in unstable networks.

• A.Link-state routing
• B.Unequal-cost load balancing ✓ correct
• C.Area hierarchy
• D.SPF algorithm

Why: EIGRP supports unequal-cost load balancing using variance command (OSPF only equal-cost).

• A.Speeds up routing
• B.Enables VLSM/CIDR ✓ correct
• C.Reduces CPU
• D.Required for OSPF

Why: 'no auto-summary' disables classful summarization, enabling proper VLSM/CIDR routing.