CCNA Exam Prep Free practice test →

Free CCNA Practice Questions

10 free, exam-style Cisco Certified Network Associate (CCNA) practice questions with answers and explanations. No signup required. Work through them below, then take the full free CCNA practice test to study every exam domain.

These 10 free CCNA questions are organized by exam domain, so you can see how each part of the Cisco Certified Network Associate blueprint is tested. Reveal the answer and explanation under each question.

Domain 1: Network Fundamentals 20% of exam

Question 1

A host is assigned the IP address 172.16.130.50/20. What is the broadcast address of this subnet?

  1. 172.16.130.255
  2. 172.16.131.255
  3. 172.16.143.255
  4. 172.16.127.255
Show answer & explanation

Correct answer: C - 172.16.143.255

Question 2

A network device has the MAC address 00:1A:2B:3C:4D:5E. Using the modified EUI-64 process, what is the resulting IPv6 interface identifier?

  1. 001A:2BFF:FE3C:4D5E
  2. 021A:2B3C:FFFE:4D5E
  3. 021A:2BFF:FE3C:4D5E
  4. 001A:2B3C:FF4D:5EFE
Show answer & explanation

Correct answer: C - 021A:2BFF:FE3C:4D5E

Domain 2: Network Access 20% of exam

Question 3

A network engineer enables PortFast and BPDU Guard on all access ports globally. A user plugs an unmanaged switch into one of these ports. What is the expected result?

  1. The port blocks the unmanaged switch using Root Guard
  2. The port is placed into an err-disabled state
  3. The port enters a root-inconsistent state
  4. The port continues forwarding but ignores BPDUs from the switch
Show answer & explanation

Correct answer: B - The port is placed into an err-disabled state

Question 4

Switch A has its trunk native VLAN set to VLAN 10. Switch B, connected to Switch A via an 802.1Q trunk, has its native VLAN set to VLAN 1 (default). What is the operational impact?

  1. The trunk link will not form and remains in an access state
  2. Traffic on VLAN 10 from Switch A will be received on VLAN 1 at Switch B
  3. Both switches will automatically negotiate a common native VLAN
  4. STP will block the trunk link to prevent a loop
Show answer & explanation

Correct answer: B - Traffic on VLAN 10 from Switch A will be received on VLAN 1 at Switch B

Domain 3: IP Connectivity 25% of exam

Question 5

On a multi-access Ethernet segment running OSPF, Router A has a priority of 100 and a router-ID of 3.3.3.3. Router B has a priority of 100 and a router-ID of 5.5.5.5. Router B is currently the DR. A new Router C comes online with a priority of 255 and a router-ID of 1.1.1.1. What happens to the DR role?

  1. Router B remains the DR because the OSPF DR election is non-preemptive
  2. Router C immediately becomes the DR because it has the highest priority
  3. Router C triggers a new election and wins DR due to highest priority
  4. Router C becomes the BDR and will take over as DR when Router B goes down
Show answer & explanation

Correct answer: A - Router B remains the DR because the OSPF DR election is non-preemptive

Question 6

Two OSPF routers connected via a GigabitEthernet link have formed a neighbor relationship but are stuck in the ExStart state. Which of the following is the MOST likely cause?

  1. The hello timers do not match on both sides
  2. One router has a duplicate router-ID
  3. The interfaces are in different OSPF areas
  4. There is an MTU mismatch between the two interfaces
Show answer & explanation

Correct answer: D - There is an MTU mismatch between the two interfaces

Question 7

A network engineer configures the following static route: ip route 10.10.0.0 255.255.0.0 192.168.1.2 210 The same network is also learned via OSPF with a metric of 30. Under normal conditions, which route does the router install in its routing table?

  1. The OSPF route, because 110 is a lower administrative distance than 210
  2. The static route, because static routes are always preferred
  3. The OSPF route, because its metric of 30 is lower than 210
  4. Both routes are installed for equal-cost load balancing
Show answer & explanation

Correct answer: A - The OSPF route, because 110 is a lower administrative distance than 210

Domain 4: IP Services 10% of exam

Question 8

An internal host at 192.168.1.50 sends a packet to an external web server at 8.8.8.8. The router performs PAT using its outside interface IP of 203.0.113.5. In the NAT translation table, what is 192.168.1.50 classified as?

  1. Inside global
  2. Outside local
  3. Outside global
  4. Inside local
Show answer & explanation

Correct answer: D - Inside local

Domain 5: Security Fundamentals 15% of exam

Question 9

An engineer needs to block Telnet traffic from the 10.1.4.0/22 network to server 172.16.5.10, while permitting all other traffic. Which access-list entry correctly accomplishes this?

  1. access-list 100 deny tcp 10.1.4.0 0.0.0.3 host 172.16.5.10 eq 23
  2. access-list 100 deny tcp 10.1.4.0 0.0.3.255 host 172.16.5.10 eq 23
  3. access-list 100 deny tcp 10.1.4.0 0.0.0.255 host 172.16.5.10 eq 23
  4. access-list 100 deny tcp 10.1.4.0 0.0.7.255 host 172.16.5.10 eq 23
Show answer & explanation

Correct answer: B - access-list 100 deny tcp 10.1.4.0 0.0.3.255 host 172.16.5.10 eq 23

Domain 6: Automation and Programmability 10% of exam

Question 10

A company wants to provision virtual machines, VPCs, and subnets across AWS and Azure from a single declarative configuration file that tracks the current state of all deployed infrastructure. Which tool is BEST suited for this requirement?

  1. Ansible, because it uses agentless SSH connections to cloud APIs
  2. Python scripts, because they offer the most flexibility for multi-cloud
  3. Cisco Catalyst Center, because it supports multi-cloud orchestration
  4. Terraform, because it uses a state file and declarative HCL configuration
Show answer & explanation

Correct answer: D - Terraform, because it uses a state file and declarative HCL configuration

Ready for the real thing?

Practice hundreds more CCNA questions with instant scoring, weak-area drills, and full exam simulations.

Start the free practice test See pricing