Prepare for the CCNA Cisco Certified Network Associate Exam

Free CCNA Practice Questions (With Answers)

5 real questions from the CCNA bank, with the full explanation for each answer. No sign-up needed to read them.

1. Question 1IP Services [DHCP/DNS]

   A helpdesk technician is troubleshooting a workstation that can't obtain an IP address. To diagnose where the DHCP process fails, the technician needs to understand the correct message sequence. What is the correct order of DHCP messages?

   • A.Discover, Request, Offer, Acknowledge
   • B.Offer, Discover, Request, Acknowledge
   • C.Request, Discover, Offer, Acknowledge
   • D.Discover, Offer, Request, Acknowledge
   Show answer and explanation

   Correct answer: D

   Correct. DORA: Discover (client broadcasts 'I need an IP'), Offer (server proposes an address), Request (client accepts the offer), Acknowledge (server confirms the lease). Understanding this sequence is key to troubleshooting — if you see Discovers but no Offers, the server isn't reachable; if you see Offers but no Requests, the client may be rejecting the configuration.

   Why the other options are wrong

   A. Incorrect. The server must Offer before the client can Request. The Offer contains the proposed IP, subnet mask, gateway, and lease duration — the client needs this information before it can make a Request.

   B. Incorrect. The client must initiate by broadcasting a Discover first — it doesn't know any DHCP servers exist yet. A server can't Offer an address until it receives a Discover requesting one.

   C. Incorrect. A client can't Request a specific address until a server has Offered one. The Request step formally accepts a particular Offer, which is important when multiple DHCP servers respond.

2. Question 2Security Fundamentals [Concepts]

   What is the difference between a vulnerability and an exploit?

   • A.A vulnerability is a weakness; an exploit is code that takes advantage of it
   • B.Vulnerabilities only affect software; exploits affect hardware
   • C.They are the same thing — both refer to a software flaw
   • D.An exploit is a weakness; a vulnerability is code that takes advantage of it
   Show answer and explanation

   Correct answer: A

   Correct. Vulnerabilities are flaws; exploits are the methods used to attack those flaws.

   Why the other options are wrong

   B. Incorrect. This option relies on the misconception that physical hardware is immune to vulnerabilities. In truth, both hardware (like CPU microcode) and software can have vulnerabilities, and exploits can target either medium.

   C. Incorrect. It is common to conflate these terms because they are closely related. However, a vulnerability is the passive security flaw itself, whereas an exploit is the active tool or code used to take advantage of that flaw.

   D. Incorrect. This option reverses the actual definitions of the two terms. A vulnerability is the underlying weakness or gap in security, while an exploit is the specific vehicle, script, or technology used to target that weakness.

3. Question 3Automation and Programmability [Controller-Based Networking]

   An enterprise IT director wants to manage, automate, and troubleshoot their entire campus network — wired and wireless — from a single platform. They need features like automated provisioning, AI-driven analytics, and policy-based segmentation. What is Cisco Catalyst Center?

   • A.A firewall appliance to inspect and block traffic
   • B.A routing protocol to exchange topology information
   • C.A wireless access point
   • D.A network management and automation platform
   Show answer and explanation

   Correct answer: D

   Correct. Cisco Catalyst Center (formerly Cisco DNA Center) is an intent-based networking platform that serves as the centralized management, automation, and assurance system for enterprise networks. It provides: automated device provisioning (zero-touch deployment), AI/ML-driven analytics for proactive troubleshooting, policy-based network segmentation (Software-Defined Access), and a single pane of glass for managing campus, branch, and WAN infrastructure. It communicates with network devices through NETCONF/YANG southbound.

   Why the other options are wrong

   A. Incorrect. Catalyst Center is a management and automation platform, not a security appliance. While it can define and enforce security policies through network segmentation, the actual traffic filtering happens on the managed network devices.

   B. Incorrect. Catalyst Center is not a protocol — it's a comprehensive network management platform. Protocols (like OSPF or OpenFlow) handle specific communication tasks; Catalyst Center orchestrates the entire network management lifecycle.

   C. Incorrect. Catalyst Center manages wireless access points (through integration with Cisco WLC), but it's not an access point itself. It's the management layer that sits above the entire network infrastructure.

4. Question 4Security Fundamentals [ACL - Show Command Output]

   What does this tell you about traffic filtering?

   show ip interface Gi0/0

   Router# show ip interface Gi0/0
   GigabitEthernet0/0 is up, line protocol is up
     Inbound access list is 101
     Outgoing access list is not set

   • A.ACL 101 filters outbound traffic leaving the router on interface Gi0/0 to secure the network
   • B.All traffic is blocked on Gi0/0 by the ACL
   • C.ACL 101 filters traffic entering the router on Gi0/0; outbound is not filtered
   • D.No filtering is applied; the ACL is defined but not active
   Show answer and explanation

   Correct answer: C

   Correct. Inbound ACL filters ingress traffic; no outbound ACL means egress is unrestricted.

   Why the other options are wrong

   A. Incorrect. This option confuses the direction of the applied filter. The output shows that ACL 101 is explicitly bound as an inbound access list, meaning it only inspects traffic entering the router through this interface.

   B. Incorrect. This option assumes an overly restrictive behavior. Only traffic entering the interface is subject to the rules of ACL 101, while outbound traffic remains completely unfiltered because no outgoing access list is configured.

   D. Incorrect. This option assumes the ACL is dormant. However, the output explicitly lists ACL 101 under the inbound access list field, confirming that the filter is active and actively processing incoming packets on this interface.

5. Question 5Network Fundamentals [ARP - Show Command Output]

   What does 'Incomplete' for 192.168.1.30 indicate?

   show ip arp

   Router# show ip arp
   Protocol  Address          Age (min)  Hardware Addr   Type   Interface
   Internet  192.168.1.1             -   0001.0001.0001  ARPA   Gi0/0
   Internet  192.168.1.10           5   0011.2233.4455  ARPA   Gi0/0
   Internet  192.168.1.20          15   0022.3344.5566  ARPA   Gi0/0
   Internet  192.168.1.30           -   Incomplete      ARPA   Gi0/0

   • A.The entry is a static ARP configured by an administrator
   • B.The MAC address is being learned
   • C.The entry is being deleted
   • D.ARP request was sent but no reply received
   Show answer and explanation

   Correct answer: D

   Correct. Incomplete means the router sent ARP but the host hasn't responded (may be offline).

   Why the other options are wrong

   A. Incorrect. This option confuses unresolved dynamic entries with static configurations. A static ARP entry is manually defined with a valid MAC address and would display that hardware address rather than showing as incomplete.

   B. Incorrect. This option assumes active learning is in progress. While the router is waiting for a response, the term 'Incomplete' means the resolution process has not succeeded, rather than indicating a normal learning state.

   C. Incorrect. This option mistakes a pending resolution for an aging-out process. An entry being deleted would simply be removed from the table, whereas 'Incomplete' indicates an active, unanswered ARP request.