CCNA Network Fundamentals: 116 practice questions

12 of the 116 Network Fundamentals questions in the Certsqill CCNA bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for CCNA? Take the free 5-min readiness check →

1. 14, found by removing the network and broadcast addresses: How many usable host addresses does this subnet pro

1. 14, found by removing the network and broadcast addresses from the sixteen that a /28 provides ✓

   A /28 leaves 4 host bits, so 2^4 = 16 total addresses. Subtracting the reserved network and broadcast addresses gives 16 - 2 = 14 usable host addresses.
2. 16, counting every address combination available across all four host bits of the /28 subnet

   16 is the total address count in a /28, but the network and broadcast addresses cannot be assigned to hosts, so only 14 remain usable.
3. 12, reserving exactly the number of addresses the twelve branch-office hosts are expected to use

   12 matches the host requirement, but a /28 actually yields 14 usable addresses; the subnet accommodates the 12 hosts with 2 addresses to spare.
4. 30, applying the usable-host formula to five host bits rather than the four a /28 mask leaves

   30 usable hosts corresponds to a /27, which has five host bits (2^5 - 2 = 30). A /28 has only four host bits and yields 14.

A /28 subnet has a 4-bit host portion, giving 2^4 = 16 total addresses. Subtract the network address and broadcast: 16 - 2 = 14 usable host addresses.

2. Network 172.16.45.192 and broadcast 172.16.45.255: What is the network address and broadcast address for this

1. Network 172.16.45.128 and broadcast 172.16.45.191, placing .200 within the third 64-address block

   The 172.16.45.128/26 block covers 128-191. Host address .200 is above .191, so it belongs to the next block (.192-.255), not this one.
2. Network 172.16.45.192 and broadcast 172.16.45.255, since .200 falls inside the fourth 64-address block ✓

   A /26 uses 64-address blocks: .0, .64, .128, .192. Address .200 lies in the .192 block (192-255), so the network is 172.16.45.192 and the broadcast is 172.16.45.255.
3. Network 172.16.45.0 and broadcast 172.16.45.63, treating .200 as part of the very first 64-address block

   The 172.16.45.0/26 block covers 0-63. Host address .200 is far outside this range and cannot belong to the first block.
4. Network 172.16.45.192 and broadcast 172.16.45.223, using a 32-address /27 boundary for the block size

   Broadcast .223 would be correct for a 32-address /27, not a /26. A /26 spans 64 addresses, so the .192 block broadcasts at .255.

A /26 creates 64-address blocks: .0, .64, .128, .192. Host .200 falls in the .192 block (192–255). Network = 172.16.45.192, Broadcast = 172.16.45.255.

3. UDP port 53, the default transport for standard DNS: Which protocol and port number combination is used by the

1. TCP port 53, which DNS relies on for routine client lookups because of its reliable, connection-oriented delivery

   TCP/53 is used by DNS only for zone transfers (AXFR) and responses exceeding 512 bytes, not for everyday client queries. The default query transport is UDP/53.
2. UDP port 67, the transport a DNS resolver uses when it forwards a query to an authoritative name server

   UDP port 67 is the DHCP server port used to receive client messages. It plays no role in DNS name resolution, which uses port 53.
3. UDP port 53, the default transport for standard DNS name-resolution queries between clients and resolvers ✓

   DNS uses UDP port 53 for standard queries because UDP's low overhead suits the short request-response exchange. TCP/53 is reserved for zone transfers and oversized responses.
4. TCP port 443, carrying encrypted DNS queries in the same way it secures ordinary web browser traffic

   TCP port 443 is used by HTTPS. Standard DNS name resolution uses port 53, not 443.

DNS uses UDP port 53 for standard client name resolution queries. DNS also uses TCP port 53 for zone transfers and large responses, but the default query protocol is UDP.

4. SYN, then SYN-ACK, then ACK, matching how a client opens: Which sequence of messages correctly describes the T

1. SYN, then ACK, then SYN-ACK, reversing the server's reply and the client's final acknowledgment

   This order is wrong: the server's SYN-ACK must precede the client's final ACK. The correct sequence is SYN, SYN-ACK, ACK.
2. ACK, then SYN, then SYN-ACK, opening the exchange with an acknowledgment before any synchronization

   A connection cannot begin with an ACK; ACK acknowledges data or completes a handshake. The initiating segment is always a SYN.
3. SYN, then SYN, then ACK, sending two separate synchronize segments ahead of a single acknowledgment

   The server combines SYN and ACK into one SYN-ACK segment rather than sending two separate SYN messages.
4. SYN, then SYN-ACK, then ACK, matching how a client opens and the server confirms a new TCP session ✓

   In the three-way handshake the client sends SYN, the server replies with a combined SYN-ACK to acknowledge and synchronize, and the client sends ACK to complete the connection.

TCP three-way handshake: Client SYN → Server SYN-ACK → Client ACK. This exchange synchronizes sequence numbers and establishes the connection before data transfer begins.

5. A link-local address: What type of IPv6 address is this, and what is its primary purpose?

1. A link-local address, used only for communication on the local link and never routed off the segment ✓

   Addresses in FE80::/10 are link-local. They are auto-assigned to every IPv6 interface and used for neighbor discovery and routing protocol hellos, but never routed beyond the local segment.
2. A global unicast address, used for internet-routable traffic between hosts in different networks worldwide

   Global unicast addresses begin with 2000::/3 (first three bits 001). The FE80::/10 prefix identifies a link-local address, not a global unicast one.
3. A unique local address, mirroring the private, non-routable RFC 1918 ranges long familiar from IPv4

   Unique local addresses use the FC00::/7 prefix (FC00 through FDFF), not FE80::. They are the IPv6 equivalent of RFC 1918 private ranges.
4. A multicast address, used to deliver a single packet to many subscribed receivers at the same time

   IPv6 multicast addresses begin with FF00::/8. FE80:: is a link-local unicast prefix, not a multicast prefix.

FE80::/10 identifies an IPv6 link-local address — automatically assigned to every IPv6-enabled interface and used for local-link communication only (never routed beyond the local segment).

6. Flood the frame out every port except the one it arrived: What will the switch do with this frame?

1. Drop the frame and return an ICMP unreachable message to notify the original sending host of the failure

   Switches do not drop frames with unknown destination MACs; they flood them. ICMP unreachable is generated by routers at Layer 3, not by Layer 2 switches.
2. Flood the frame out every port except the one it arrived on, since the destination MAC is still unknown ✓

   When the destination MAC is not in the address table, the switch performs unknown-unicast flooding, sending the frame out all ports except the ingress port.
3. Send an ARP request out its ports to learn the MAC-to-IP binding before making a forwarding decision

   ARP is used by hosts to resolve IP addresses to MAC addresses. A switch forwards on MAC addresses alone and does not issue ARP requests for forwarding.
4. Hold the frame in a buffer until a MAC learning update populates the matching address-table entry

   Switches do not buffer frames awaiting MAC learning. They immediately flood an unknown unicast out all ports except the ingress port.

When a switch cannot find a destination MAC in its MAC address table, it performs unicast flooding — forwarding the frame out every port except the one it arrived on, ensuring delivery while learning MAC addresses.

7. Core layer: Which layer is responsible for high-speed packet switching and acts as the backbone of the campus

1. Distribution layer

   The distribution layer aggregates access layer connections, enforces policies (ACLs, QoS), and performs routing between VLANs — it connects the access and core layers but is not the high-speed backbone itself.
2. Access layer

   The access layer provides end-device connectivity (workstations, IP phones, printers) — it is the lowest tier, not the high-speed backbone.
3. Core layer ✓

   The core layer provides high-speed, high-availability backbone switching between distribution layer devices. Its primary function is fast packet forwarding — not policy enforcement or end-device connectivity.
4. Spine layer

   The spine layer is part of the spine-leaf architecture (data center design), not the traditional three-tier campus design. The three-tier model uses core, distribution, and access layers.

In the three-tier hierarchical campus model: Core = high-speed backbone (fast switching, no policy); Distribution = policy enforcement, routing between VLANs, aggregation; Access = end-device connectivity.

8. Channels 1, 6, and 11, the only fully non-overlapping: To avoid co-channel interference between adjacent APs,

1. Channels 1, 5, and 10, spaced far enough apart to keep their transmitted signals from overlapping

   Channels 1, 5, and 10 still overlap in the 2.4 GHz band. Only 1, 6, and 11 are truly non-overlapping in most regulatory domains.
2. Channels 1, 7, and 13, giving three evenly separated frequencies spread across the available band

   Channels 1, 7, and 13 are not the standard non-overlapping set, and channel 13 is unavailable in some regulatory domains such as the US. The standard set is 1, 6, and 11.
3. Any three consecutive channels, on the idea that each channel occupies its own distinct frequency slot

   Each 2.4 GHz channel is 22 MHz wide but spaced only 5 MHz apart, so consecutive channels overlap heavily. Non-overlapping channels must be five apart, giving 1, 6, and 11.
4. Channels 1, 6, and 11, the only fully non-overlapping choices available across the whole 2.4 GHz band ✓

   In the 2.4 GHz band (802.11b/g/n), channels 1, 6, and 11 are the only combination that does not overlap, so using them across adjacent APs avoids co-channel interference.

The 2.4 GHz band has only three non-overlapping channels: 1, 6, and 11. These channels are spaced far enough apart (25 MHz between centers) to avoid mutual interference between adjacent APs.

9. VRF, which builds separate routing-table instances so: Which technology enables this?

1. VRF, which builds separate routing-table instances so overlapping customer address spaces stay fully isolated ✓

   VRF creates multiple independent routing tables on one router. Each customer's routes live in their own VRF, letting overlapping address spaces coexist without conflict.
2. VLAN trunking, which separates customer traffic into distinct Layer 2 segments carried over a single physical link

   VLAN trunking segments traffic only at Layer 2. Overlapping IP addresses would still collide in the router's single routing table without VRF.
3. NAT, which rewrites the overlapping customer addresses into unique ranges before the traffic is routed onward

   NAT can mask overlapping addresses at a network boundary, but VRF is the routing-layer solution that keeps complete routing-table separation in MPLS service-provider designs.
4. HSRP, which presents one virtual gateway so customers keep connectivity if a physical router interface fails

   HSRP provides default-gateway redundancy for hosts and has nothing to do with routing-table isolation or handling overlapping address spaces.

VRF creates multiple independent routing table instances on a single physical router — each instance (VRF) maintains completely separate routing tables, allowing overlapping IP address spaces from different customers to coexist without conflict.

10. A Wireless LAN Controller: Which device performs this centralized management role?

1. An autonomous access point, which stores its own full configuration and operates without any central controller

   An autonomous AP is self-contained and self-managed and does not report to a controller. The scenario clearly describes lightweight APs managed centrally.
2. A Wireless LAN Controller, which centrally manages RF, security policy, and firmware for every lightweight AP ✓

   A WLC centralizes lightweight-AP management, controlling RF settings, WPA2/WPA3 policy, firmware, client association, and the CAPWAP tunnel to each AP.
3. A RADIUS server, which centralizes authentication and accounting but leaves RF and firmware to other devices

   A RADIUS server handles AAA (authentication, authorization, accounting). It does not manage AP RF settings, firmware, or CAPWAP tunnels; it works alongside a WLC.
4. A Layer 3 switch, which routes between VLANs and forwards frames but never manages AP radio configuration

   A Layer 3 switch provides routing and VLAN switching. It does not manage wireless RF settings, AP firmware, or CAPWAP tunnels.

A Wireless LAN Controller (WLC) centrally manages lightweight APs via CAPWAP tunnels — controlling RF settings, security policies, firmware updates, and client management from a single management point.

11. 02:1A:2B:FF:FE:3C:4D:5E, inserting FF:FE in the middle: What will the 64-bit interface ID be?

1. 00:1A:2B:FF:FE:3C:4D:5E, inserting FF:FE correctly but leaving the universal/local bit of the first byte unchanged

   This inserts FF:FE correctly but skips flipping the U/L bit. EUI-64 requires that flip, so the first byte 00 must become 02.
2. 00:1A:2B:3C:4D:5E:FF:FE, appending FF:FE to the end of the MAC instead of splitting the address in the middle

   EUI-64 splits the MAC after the 3-byte OUI and inserts FF:FE in the middle, not at the end, so appending FF:FE is incorrect.
3. 02:1A:2B:FF:FE:3C:4D:5E, inserting FF:FE in the middle and then flipping the seventh bit within the first byte ✓

   EUI-64 inserts FF:FE between the OUI and the device bytes and flips the universal/local bit. The first byte 00 (00000000) becomes 02 (00000010), giving 02:1A:2B:FF:FE:3C:4D:5E.
4. 02:1A:2B:3C:4D:5E, flipping the seventh bit of the first byte properly but never inserting the FF:FE bytes

   This flips the U/L bit but omits the FF:FE insertion. EUI-64 requires both steps: insert FF:FE and flip the seventh bit.

EUI-64 converts a 48-bit MAC to a 64-bit interface ID by: (1) splitting MAC after byte 3, (2) inserting FF:FE in the middle, and (3) flipping the 7th bit of byte 1. For MAC 00:1A:2B:3C:4D:5E → 02:1A:2B:FF:FE:3C:4D:5E.

12. 25 collision domains and 2 broadcast domains: How many collision domains and broadcast domains exist in this n

1. 1 collision domain and 1 broadcast domain, behaving as though a single shared hub linked all the hosts

   A hub would give one collision domain, but a switch provides a separate collision domain per port. The router also splits the network into more than one broadcast domain.
2. 24 collision domains and 1 broadcast domain, counting each host port but omitting the switch-to-router uplink

   The link between the switch and router is also a collision domain, making 25 in total. The router further separates broadcast domains, so the count of 1 is also low.
3. 25 collision domains and 1 broadcast domain, counting the ports correctly but ignoring the router's boundary

   The 25 collision domains are correct, but the router separates broadcast domains: the switch LAN side is one and the router's other interface adds at least one more.
4. 25 collision domains and 2 broadcast domains, one per switch port plus the router-separated network segments ✓

   Each full-duplex switch port is its own collision domain (24 host ports + 1 router uplink = 25). The switch keeps one broadcast domain, and the router's other interface creates a second.

Each switch port is a separate collision domain (25 total: 24 host ports + 1 router uplink). The Layer 2 switch does not break up broadcast domains — all hosts share one, and the router creates a boundary for at least a second one.

Other CCNA domains

• IP Connectivity — 97 questions →
• Network Access — 96 questions →
• Security Fundamentals — 68 questions →
• IP Services — 66 questions →
• Automation and Programmability — 51 questions →
• All 494 CCNA questions →