How to use these CCNA practice questions
The CCNA is a timed, computer-based exam with multiple-choice and multiple-response questions, drag-and-drop tasks, and simulation or lab-style questions. The questions can test both knowledge and practical application across networking fundamentals, IP connectivity and services, security fundamentals, automation and programmability, and common operational tasks.
That means memorising definitions is not enough. You need to read an output or constraint, identify the layer or protocol involved, choose the safest next action, and understand what result would verify your decision.
For each question below, select an answer before reading the explanation. Pay particular attention to the distractor that looks plausible but violates a protocol rule or ignores evidence. That is usually where marks are lost.
1. Subnetting from a host requirement
This tests whether you can select the smallest valid subnet rather than choosing a mask by habit.
You must create a subnet for 50 user devices. Which subnet mask provides enough usable IPv4 host addresses while wasting the fewest addresses?
/26 provides 64 total addresses and 62 usable host addresses, so it is the smallest listed subnet that supports 50 devices. /27 provides only 30 usable addresses, making it the strongest distractor because its prefix length looks close but cannot meet the requirement.
The useful habit is to calculate usable hosts as 2 to the power of the host bits, minus two for the network and broadcast addresses in a conventional IPv4 subnet. Then compare the result with the stated requirement.
2. Choosing a route
This question tests longest-prefix matching, which takes priority before administrative distance and metric.
A router has these routes for destination 10.20.30.45: 10.0.0.0/8 via OSPF, administrative distance 110; 10.20.0.0/16 via EIGRP, administrative distance 90; and 10.20.30.0/24 via a static route, administrative distance 200. Which route is selected?
The /24 is the longest matching prefix, so it is selected before the /16 and /8 routes. The static route's higher administrative distance does not matter because administrative distance is compared between routes to the same prefix. The strongest distractor is the EIGRP route: its administrative distance is lower, but it is less specific.
When reading a routing table, first list every matching prefix. Do not start with the protocol you prefer or the lowest administrative distance. The selected route must be the most specific match.
3. Trunk configuration
This tests whether you can distinguish a trunk problem from a VLAN existence problem.
A switch port connects to another switch. VLAN 20 exists on both switches, but hosts in VLAN 20 cannot communicate across the link. The link is configured as an access port in VLAN 10 on one side. What is the most appropriate correction?
An inter-switch link carrying more than one VLAN should be configured as a trunk, with VLAN 20 permitted. Making both ends access ports would not carry multiple VLANs and is the strongest distractor because it mentions VLAN 20 but does not solve the link's role.
In a real troubleshooting task, verify both ends rather than changing one side blindly. Useful evidence includes the interface mode, allowed VLAN list, native VLAN settings and the operational state of the trunk.
4. DHCP across a routed boundary
This tests the role of a DHCP relay when broadcasts cannot cross a router.
Clients on VLAN 30 do not receive DHCP addresses. The DHCP server is on another subnet, and the client VLAN interface is the default gateway. Which configuration is required on the client VLAN interface?
The router or Layer 3 switch interface needs an ip helper-address pointing to the DHCP server so the client's broadcast can be relayed as a unicast request. ip default-gateway is a host or switch management setting, so it is the strongest distractor but does not relay DHCP broadcasts.
The reasoning chain is: the client begins with a broadcast, routers do not forward ordinary broadcasts, and a relay function is therefore needed. Confirm the helper address, the server's return route and the DHCP scope for the client subnet.
5. Spanning Tree root selection
This tests the order in which STP elects a root bridge.
Two switches are in the same spanning-tree instance. Switch A has priority 4096 and MAC address 00:11:22:33:44:55. Switch B has priority 32768 and a lower MAC address. Which switch becomes the root bridge?
The lowest bridge ID wins, and bridge priority is considered before the MAC address. Switch A's priority of 4096 is lower than Switch B's 32768, so A would actually become root. Therefore the correct option is Switch A; its MAC address is not the reason. The strongest distractor is Switch B, which incorrectly gives priority to the lower MAC address despite the different priorities.
This is a useful example of checking the answer choices against the evidence rather than accepting a familiar rule in isolation. If priorities were equal, the lower MAC address would then become relevant.
6. Extended ACL placement
This tests both ACL evaluation order and placement near the traffic source.
You must block hosts in 192.0.2.0/24 from reaching the HTTPS service on 198.51.100.10, while allowing their other traffic. Where should the extended ACL normally be applied?
An extended ACL is normally placed close to the source so the unwanted traffic is filtered before it travels through the network. The rule must match the source subnet, destination host and TCP destination port 443, followed by an appropriate permit for other traffic. Applying it close to the destination is the strongest distractor: it can work, but permits unwanted traffic to cross more of the network first.
Before applying an ACL, check the implicit deny at the end and the direction of the interface. A syntactically correct rule can still cause an outage if it is placed in the wrong direction or lacks permits for required traffic.
7. IPv6 address configuration
This tests the difference between link-local addressing and a globally usable IPv6 address.
A host has an IPv6 address beginning fe80:: and cannot reach a remote IPv6 network. Which statement is correct?
Addresses beginning fe80:: are link-local. They are used on the local link and are not routed across networks. The strongest distractor is that the address proves a global prefix: a host can have a link-local address without having received a global unicast address through router advertisements or another configuration method.
When troubleshooting IPv6, separate the questions: does the interface have a link-local address, does it have a global or unique-local address, is there a default route, and can neighbour discovery and router advertisements be observed?
8. Wireless channel planning
This tests whether you can avoid creating interference by selecting non-overlapping channels in the 2.4 GHz band.
Three nearby access points operate in the 2.4 GHz band. Which channel plan is commonly used to minimise overlap between the cells?
Channels 1, 6 and 11 are the commonly used non-overlapping 2.4 GHz channels in many regulatory domains when using 20 MHz channels. The strongest distractor is using adjacent channels: their energy overlaps, creating interference rather than clean separation. Local regulatory rules and the configured channel width still need to be checked.
The important exam habit is to distinguish co-channel reuse from adjacent-channel interference. Channel planning is also affected by local regulation, channel width, access-point power and the physical layout.
9. Troubleshooting a failed ping
This tests evidence-led diagnosis rather than assuming that a failed ping identifies one particular fault.
A workstation can ping its default gateway but cannot ping a server on another subnet. The workstation has a valid address and mask. What is the best next step?
Reachability of the default gateway shows that the local link and basic local addressing work. The next step is to inspect the route towards the remote server and use traceroute or equivalent evidence to locate the failure, while checking ACLs at the relevant boundary. Disabling every ACL is the strongest distractor because it is unsafe and removes evidence rather than isolating the fault.
A good troubleshooting answer narrows the fault domain after every test. Avoid destructive changes until you have identified the likely device, interface, route or policy responsible.
10. REST and structured data
This tests basic automation terminology and the relationship between an API request and its payload.
An engineer wants to retrieve interface information from a network controller without changing its state. Which combination is most appropriate?
GET is used to retrieve a resource without requesting a change, and JSON is commonly used to represent structured API data. DELETE is the strongest distractor because it is an HTTP method, but it requests removal of a resource and is therefore inappropriate for a read-only task.
For automation questions, identify the intended operation first: retrieve, create, modify or delete. Then check the method, endpoint, authentication, payload format and expected response before considering syntax.
What to record after the set
Do not record only your total score. For every missed or guessed question, write down the failed reasoning step:
- Did you misread a prefix length, mask or port number?
- Did you apply a rule before checking the evidence?
- Did you choose a technically possible action that was unsafe or unnecessarily broad?
- Did you confuse a protocol's purpose with a configuration command?
- Did you fail to identify what result would verify the fix?
A strong CCNA practice session includes a second pass in which you explain why each wrong option is wrong. This is particularly important for scenario-driven questions, where several options may sound operationally reasonable but only one respects the stated constraints.
In MySummaries, a question session can turn those missed steps into a focused remediation queue rather than leaving them as a percentage score.
Use the weakest section to choose your next practice set. If subnetting is weak, work short timed calculations before returning to mixed scenarios. If ACL reasoning is weak, practise direction, placement, implicit deny and verification. If troubleshooting is weak, require yourself to name the next command and the result that would confirm or reject your hypothesis.
You lost this mark twice: A router has matching /8, /16 and /24 routes. Which route is selected, and when does administrative distance matter?
The aim is not to memorise the ten answers above. It is to make the reasoning automatic enough that you can apply it to a different address, output, topology or constraint under time pressure.
How MySummaries helps
MySummaries lets you build a revision board from your networking notes, then generate practice questions from sections such as subnetting, routing, switching, security and automation. It can mark scenario answers against the material on your board, identify repeated weaknesses and return missed points as cards for spaced review.
Start with your own CCNA notes at portal.mysummaries.app.