CCST Networking Practice Exam.
Free practice test — 35 verified questions, instant feedback.
Know the exam before you sit it
the facts most prep sites buryEvery free resource for this exam
family overview →Get a free CCST Networking study plan
A week-by-week plan plus new practice questions, straight to your inbox.
Frequently asked questions
What topics do CCST Networking (100-150) practice questions need to cover?
<p>Your practice set should mirror the official objective domains, which Cisco organizes into 6 domains:</p><ul><li><strong>Standards and Concepts</strong> — the TCP/IP model, OSI model, frames and packets, and the differences between LAN, WAN, MAN, CAN, PAN, and WLAN.</li><li><strong>Addressing and Subnet Formats</strong> — private versus public addresses, IPv4 addresses and subnet formats, and IPv6 addresses and prefix formats.</li><li><strong>Endpoints and Media Types</strong> — cables and connectors, Wi-Fi versus cellular versus wired technologies, and setting up connectivity on Windows, Linux, Mac OS, Android, and Apple iOS.</li><li><strong>Infrastructure</strong> — Cisco device status lights, network diagrams and cabling, device ports, and basic routing and switching concepts.</li><li><strong>Diagnosing Problems</strong> — troubleshooting methodologies, packet capture with Wireshark, basic diagnostic commands, and basic show commands on a Cisco device.</li><li><strong>Security</strong> — how firewalls filter traffic, foundational concepts like CIA and AAA, and basic wireless security (WPA, WPA2, WPA3).</li></ul><p>Cisco's objective domain document does not publish a percentage weighting for each domain, so the safest strategy is to practice all six evenly rather than betting that one area dominates the exam.</p>
Is there a passing score for the CCST Networking exam?
<p>No numeric passing score is published. Results are reported on a pass/fail basis rather than against a published cut score, so you won't know exactly how many questions you need to get right.</p><p>That has two practical consequences for how you practice. First, since you can't target a specific number, use practice exams to find and eliminate weak domains rather than chasing a percentage. Second, the exam runs 50 minutes, so it's worth doing at least some practice sessions under timed conditions to make sure your pace holds up on exam day.</p>
How much does the CCST Networking exam cost, and how do I schedule it?
<p>Cisco lists the registration cost of the exam as 125 USD. If you buy through the Certiport store instead, a Cisco Certified Support Technician single-exam voucher is sold for 130 USD. Each voucher covers exactly one exam attempt, and a separate voucher is required for each of the three CCST exams — so a failed attempt means paying for another voucher.</p><p>The CCST program is delivered exclusively through Certiport, a Pearson VUE business. You can redeem a voucher to schedule the CCST Networking (100-150) exam either at a Certiport Authorized Testing Center or via remote proctoring from home.</p><p>Since every attempt costs real money and there is no bundled retake, it makes financial sense to keep taking free practice exams until you are passing them consistently before you book the real thing.</p>
Am I ready to sit the CCST Networking exam, and who is it designed for?
<p>There are no exam prerequisites — anyone can register for CCST Networking. That said, Cisco describes successful candidates as entry-level network technicians with at least 150 hours of instruction and hands-on experience, so "no prerequisites" doesn't mean "no preparation."</p><p>The exam targets Network Support Technicians, IT Support Technicians, Help Desk Technicians, and IT Support Specialists. It serves as an entry point into the Cisco certification program, with CCNA as the next certification in the pathway — making it a sensible first credential if CCNA is your longer-term goal.</p><p>A practical readiness check: combine the 150-hour benchmark with your practice-exam results. If you have put in the study and lab time and are consistently passing full-length practice sets across all six domains, you are in a strong position to book the exam.</p>
Browse all questions & answers
1. A technician needs to explain to a new hire why the OSI model splits networking into seven layers instead of using a single monolithic model. What is the primary benefit of this layered approach?
- A. It allows each layer to be developed, troubleshot, and replaced independently as long as the interfaces between layers stay consistent
- B. It guarantees that every network will automatically use encryption at every layer
- C. It eliminates the need for any addressing scheme because each layer handles delivery on its own
- D. It requires every vendor to use identical hardware so layers can be swapped physically
Show answer & explanation
Answer: A
Layered models (OSI and TCP/IP) exist so that each layer can evolve or be swapped (e.g., changing a physical medium) without redesigning the whole stack, as long as the layer interfaces remain stable. Encryption is not automatic at every layer, addressing is still required at multiple layers (MAC, IP), and vendors do not need identical hardware for layering to work.2. A frame arrives on a switch port and the switch reads the destination MAC address to decide where to forward it. At which OSI layer does this decision primarily occur?
- A. Layer 2, the Data Link layer
- B. Layer 3, the Network layer
- C. Layer 4, the Transport layer
- D. Layer 7, the Application layer
Show answer & explanation
Answer: A
Switches forward frames based on MAC addresses, which is Data Link layer (Layer 2) addressing. Layer 3 uses IP addresses for routing, Layer 4 handles segment/datagram delivery between processes, and Layer 7 concerns application data - none of these govern MAC-based frame forwarding.3. A small business wants to connect three offices in different cities together using a service provider's network, while each individual office uses its own internal network for desks and printers. Which two network type terms best describe this scenario?
- A. A WAN connects the offices between cities, while each office runs its own LAN internally
- B. A PAN connects the offices between cities, while each office runs its own CAN internally
- C. A MAN connects the offices between cities, while each office runs its own WLAN internally
- D. A CAN connects the offices between cities, while each office runs its own PAN internally
Show answer & explanation
Answer: A
A Wide Area Network (WAN) spans large geographic distances such as connecting offices in different cities, while a Local Area Network (LAN) covers a single office or building. A PAN is personal-device scale (e.g., Bluetooth), a CAN spans a campus, and a MAN spans a single metropolitan area - none fit inter-city connectivity as precisely as WAN/LAN.4. When comparing a WLAN to a traditional wired LAN, which statement accurately describes a key architectural difference a support technician should understand?
- A. A WLAN uses radio frequency signals and requires an access point to bridge wireless clients into the wired network
- B. A WLAN cannot use IP addressing because it operates entirely at Layer 1
- C. A WLAN always provides faster throughput than any wired LAN connection
- D. A WLAN eliminates the need for a Data Link layer because there is no cable
Show answer & explanation
Answer: A
WLANs use RF signals and rely on an access point to bridge wireless stations onto the wired infrastructure. WLANs still use IP addressing and still have a Data Link layer (802.11 framing) - only the physical medium differs from wired Ethernet - and wired connections are generally faster and more reliable than wireless.5. A technician is asked why a PAN is not a suitable term for describing the network connecting an entire university campus with buildings up to a mile apart. What is the best explanation?
- A. A PAN is designed for very short-range personal device connections, while a network spanning multiple buildings on a campus is better described as a CAN
- B. A PAN specifically requires fiber optic cabling which campuses cannot install
- C. A PAN is only used for connecting servers in a data center, never end-user devices
- D. A PAN and a CAN are interchangeable terms with no practical distinction
Show answer & explanation
Answer: A
A Personal Area Network (PAN) covers a very short range around an individual (e.g., Bluetooth between a phone and headset), while a Campus Area Network (CAN) interconnects multiple buildings across a larger site such as a university. PANs have no fiber requirement, are not data-center-specific, and are not interchangeable with CAN given the vastly different scale.6. A network engineer is assigning IP addresses for an internal office network that will never be directly reachable from the public internet. Which type of address range should be used?
- A. A private address range such as 192.168.0.0/16
- B. A public address range assigned by a regional internet registry
- C. A multicast address range such as 224.0.0.0/4
- D. A loopback address range such as 127.0.0.0/8
Show answer & explanation
Answer: A
Private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are reserved for internal use and are not routed on the public internet, making them appropriate for internal-only networks. Public ranges are meant for internet-routable hosts, multicast ranges are for one-to-many delivery, and loopback addresses (127.0.0.0/8) are used only for a device to test itself.7. A host is configured with the IPv4 address 172.16.45.10 and subnet mask 255.255.255.0. What is the network address for this host's subnet?
- A. 172.16.45.0
- B. 172.16.0.0
- C. 172.16.45.255
- D. 172.16.45.1
Show answer & explanation
Answer: A
With a /24 mask (255.255.255.0), the first three octets define the network portion, so the network address is 172.16.45.0. 172.16.0.0 would only apply to a /16 mask, 172.16.45.255 is the broadcast address for this subnet (all host bits set to 1), and 172.16.45.1 would be a typical usable host address, not the network address.8. An administrator needs to subnet the network 192.168.10.0/24 into at least 4 equally sized subnets. What subnet mask should be used to achieve exactly 4 subnets while maximizing usable hosts per subnet?
- A. 255.255.255.192 (/26)
- B. 255.255.255.240 (/28)
- C. 255.255.255.0 (/24)
- D. 255.255.255.224 (/27)
Show answer & explanation
Answer: A
Borrowing 2 bits from the host portion of a /24 yields a /26, which creates exactly 2^2 = 4 subnets, each with 62 usable hosts - the maximum host count while still meeting the 4-subnet requirement. A /28 creates 16 subnets with far fewer hosts each, /24 is the original single network with no subnetting, and /27 creates 8 subnets rather than the requested 4.9. A technician examines an IPv6 address written as 2001:0db8:0000:0000:0000:ff00:0042:8329. Which of the following is a valid compressed representation of this same address?
- A. 2001:db8::ff00:42:8329
- B. 2001:db8:0:0:0:ff00::42:8329
- C. 2001::db8::ff00:42:8329
- D. 2001:db8:0000:0000:0000:ff:42:8329
Show answer & explanation
Answer: A
IPv6 compression allows leading zeros in each group to be dropped and one single run of consecutive all-zero groups to be replaced with '::'. 2001:db8::ff00:42:8329 correctly does both. Option B misuses '::' after already writing zero groups explicitly, option C illegally uses '::' twice (only one occurrence is allowed per address), and option D incorrectly drops a zero from 'ff00' making it a different value than intended.10. Which IPv6 address type is designed so that a packet sent to it is delivered to only the nearest single interface out of a group of interfaces sharing that address, typically used for load-distributed services?
- A. Anycast address
- B. Unicast address
- C. Multicast address
- D. Link-local address
Show answer & explanation
Answer: A
An anycast address is assigned to multiple interfaces, and routing delivers a packet to the topologically nearest one - commonly used for distributed services like DNS root servers. A unicast address identifies exactly one interface, a multicast address delivers to all members of a group simultaneously, and a link-local address is scoped to a single local network segment, not a distributed group.11. A host is configured with an IPv6 address that begins with fe80:: . What does this prefix indicate about the address's scope?
- A. It is a link-local address usable only for communication on the local network segment, not routed beyond it
- B. It is a globally routable address usable anywhere on the internet
- C. It is a multicast address intended for all-hosts group communication
- D. It is a loopback address used only for testing the local device itself
Show answer & explanation
Answer: A
The fe80::/10 prefix is reserved for IPv6 link-local addresses, which are automatically configured and confined to the local link - routers do not forward them. Global unicast addresses typically begin with 2000::/3, IPv6 multicast addresses begin with ff00::/8, and the IPv6 loopback address is the single address ::1, not a prefix range.12. A user connects a laptop to a docking station that provides a wired Ethernet port. Which connector type is used at the physical interface for standard copper Ethernet cabling?
- A. RJ-45
- B. RJ-11
- C. SC connector
- D. DB-9
Show answer & explanation
Answer: A
RJ-45 is the standard 8-position connector used for twisted-pair copper Ethernet cabling. RJ-11 is the smaller 4/6-position connector used for telephone lines, SC is a fiber-optic connector type, and DB-9 is a legacy serial (RS-232) connector, none of which are used for standard Ethernet.13. A technician needs to run a network cable between two buildings 300 meters apart where there is also significant electromagnetic interference from nearby power lines. Which cabling choice is most appropriate?
- A. Fiber-optic cable, since it is immune to electromagnetic interference and supports long distances
- B. Unshielded twisted-pair (UTP) copper cable, since it is the cheapest option regardless of distance
- C. Coaxial cable limited to 100 meters, since it matches typical Ethernet copper limits
- D. A standard Cat5e patch cable, since patch cables are rated for any distance
Show answer & explanation
Answer: A
Fiber-optic cable uses light rather than electrical signals, making it immune to EMI, and it supports much longer distances than copper - ideal for a 300-meter inter-building run near power lines. UTP copper is typically limited to 100 meters and is susceptible to EMI, coaxial is rarely used for modern Ethernet and still copper-based (EMI-prone), and Cat5e patch cables are also copper and subject to the same 100-meter and interference limitations.14. A field technician must connect a laptop's fiber network interface to a switch's fiber port but the switch is several years old and only accepts a specific transceiver form factor. Which component would the technician most likely need to check for compatibility?
- A. An SFP (small form-factor pluggable) transceiver module
- B. An RJ-45 keystone jack
- C. A USB-C to HDMI adapter
- D. A DB-25 serial adapter
Show answer & explanation
Answer: A
SFP (and related SFP+, QSFP) transceiver modules plug into switch ports to convert between the switch's electrical interface and various fiber (or copper) media types, and different switches may require specific SFP types. An RJ-45 keystone jack is for copper Ethernet wall terminations, a USB-C to HDMI adapter is for video display, and DB-25 is a legacy serial connector - none relate to fiber switch uplinks.15. A user's smartphone automatically switches from a 5 GHz Wi-Fi network to the cellular data network when walking out of the office building. Which factor most directly explains why cellular, rather than Wi-Fi, can maintain connectivity over a much larger geographic area?
- A. Cellular networks use carrier-operated towers spaced across wide areas with handoff between towers, while Wi-Fi access points have a much shorter individual range
- B. Wi-Fi signals are physically incapable of traveling more than 10 meters under any circumstance
- C. Cellular networks do not use radio frequency signals, so they are not limited by distance
- D. Wi-Fi requires a wired connection to every client device at all times
Show answer & explanation
Answer: A
Cellular networks rely on a wide-area infrastructure of carrier towers with seamless handoff as a device moves between cells, giving them far greater coverage than a single Wi-Fi access point, which typically covers a building or a portion of one. Wi-Fi range varies but can exceed 10 meters depending on conditions, cellular networks do use RF signals just like Wi-Fi, and Wi-Fi is inherently wireless for client devices, not wired.16. A technician needs to connect a new switch to an existing switch to extend available ports in a wiring closet. Which type of port-to-port connection and cabling consideration is most relevant?
- A. Connect an uplink or standard port on each switch using a straight-through or Auto-MDI-X-compatible Ethernet cable
- B. Switches can only be connected using a fiber-to-copper direct splice with no transceiver
- C. Switch-to-switch connections require a console cable, not an Ethernet cable
- D. Switches must always be connected through a router positioned between them
Show answer & explanation
Answer: A
Extending a network by daisy-chaining switches is done by connecting Ethernet ports between the two switches using standard cabling, relying on Auto-MDI-X (or a dedicated uplink port) to handle the pinout. A direct fiber-to-copper splice without a transceiver is not a valid physical connection method, a console cable is used for out-of-band management/configuration access, not for carrying data traffic, and a router is not required simply to link two switches at Layer 2.17. A network diagram shows a router with a routing table containing a default route of 0.0.0.0/0 pointing to an ISP's gateway. What is the function of this default route?
- A. It directs traffic destined for any network not explicitly listed elsewhere in the routing table toward the ISP gateway
- B. It blocks all outbound traffic from leaving the local network
- C. It is only used for broadcast traffic within the local subnet
- D. It assigns IP addresses to devices on the local network automatically
Show answer & explanation
Answer: A
A default route (0.0.0.0/0) acts as a catch-all, matching any destination not covered by a more specific route in the routing table, and forwards such traffic to the specified next hop - commonly an ISP gateway for internet-bound traffic. It does not block traffic, it is unrelated to local broadcast handling, and address assignment is the function of DHCP, not a routing table entry.18. A switch receives a frame destined for a MAC address that is not currently in its MAC address table. What action does the switch take with this frame?
- A. It floods the frame out all ports except the one it was received on
- B. It silently discards the frame since the destination is unknown
- C. It sends the frame back out the same port it arrived on
- D. It converts the frame to a routing table lookup request
Show answer & explanation
Answer: A
When a switch does not have an entry for the destination MAC in its table, it floods the frame out every port except the ingress port, ensuring delivery while it 'learns' the correct port when a reply is received. Discarding the frame would break normal Layer 2 delivery, sending it back out the same port would violate basic loop-prevention/split-horizon Layer 2 behavior, and switches operate on MAC tables, not routing tables, for this decision.19. A help desk technician is troubleshooting a user's report of 'the internet is down.' Following a structured troubleshooting methodology, what is generally the most effective first step?
- A. Gather information by identifying exactly what is not working and what has changed, before jumping to a fix
- B. Immediately reformat the user's operating system to rule out software issues
- C. Replace the user's network cable without asking any questions
- D. Escalate directly to the network engineering team without any initial investigation
Show answer & explanation
Answer: A
Structured troubleshooting methodologies (e.g., identify the problem, establish a theory, test the theory) all begin with gathering information - clarifying symptoms, scope, and recent changes - before attempting any fix. Reformatting an OS or replacing a cable without investigation are premature, potentially destructive or wasteful actions, and immediate escalation skips the basic triage a technician should perform first.20. A technician runs a packet capture in Wireshark and wants to isolate only traffic between a specific host and a web server on port 443. Which type of Wireshark feature should the technician use?
- A. A display filter, such as one matching the host IP address and tcp.port == 443
- B. A capture interface change to a different network adapter
- C. The Wireshark statistics menu's I/O graph only
- D. A firewall rule configured directly within Wireshark
Show answer & explanation
Answer: A
Wireshark display filters let you narrow a capture to specific criteria, such as an IP address combined with tcp.port == 443, without needing to recapture traffic. Changing the capture interface affects what is being captured, not filtering existing captured data, the I/O graph visualizes throughput over time rather than isolating specific conversations, and Wireshark is a passive capture/analysis tool - it does not enforce firewall rules.21. A user reports intermittent connectivity to a remote server. A technician runs a continuous ping to the server and observes that some replies take significantly longer than others, with occasional timeouts. What does this pattern most likely indicate?
- A. Variable latency and possible packet loss along the path, suggesting congestion or an unstable link
- B. The remote server's DNS name is definitely misspelled
- C. The local host's IP address is definitely configured incorrectly
- D. The ping command itself is deprecated and its results should be ignored
Show answer & explanation
Answer: A
Fluctuating round-trip times combined with intermittent timeouts in a continuous ping are classic signs of variable latency (jitter) and packet loss, pointing to congestion or an unstable path rather than a hard failure. A DNS misspelling would typically cause ping to fail immediately with a resolution error, not intermittent replies; a misconfigured local IP would likely prevent any replies rather than producing inconsistent ones; and ping remains a standard, valid diagnostic tool.22. A technician wants to trace the path packets take from a workstation to a remote website and identify at which hop delays begin to occur. Which diagnostic command is best suited for this task?
- A. traceroute (or tracert on Windows)
- B. ipconfig /all with no other commands
- C. nslookup only
- D. arp -a only
Show answer & explanation
Answer: A
traceroute/tracert reports each router hop along the path to a destination along with round-trip times per hop, making it ideal for identifying where delays begin. ipconfig /all shows local interface configuration but not the path to a remote host, nslookup queries DNS records rather than tracing a path, and arp -a shows the local ARP cache mapping IPs to MAC addresses on the local segment, not the full multi-hop path.23. On a Cisco IOS device, a technician runs the command 'show ip interface brief.' What information does this command primarily provide?
- A. A summary of each interface's IP address and its up/down status for both the interface and line protocol
- B. A detailed listing of the device's entire running configuration file
- C. A real-time packet capture of traffic crossing the device
- D. A list of all VLANs configured on a connected switch only, with no interface details
Show answer & explanation
Answer: A
show ip interface brief gives a concise summary table of each interface's assigned IP address and status (interface up/down and line protocol up/down), which is a common first troubleshooting step. The full running configuration is shown with show running-config, live packet capture is not a native IOS CLI capability without additional tools, and VLAN listings are shown with commands like show vlan brief, not this command.24. A technician suspects a duplex mismatch is causing performance issues on a link between a switch and a server. Which basic diagnostic approach would most directly help confirm this suspicion on a Cisco switch?
- A. Use 'show interfaces' to check for a mismatch between configured duplex settings and incrementing collision/error counters
- B. Reboot the entire switch stack immediately without checking any interface statistics
- C. Change the server's IP address to a different subnet
- D. Disable the switch's spanning-tree protocol entirely
Show answer & explanation
Answer: A
The 'show interfaces' command displays duplex/speed settings along with error counters (such as late collisions), which are telltale signs of a duplex mismatch when they increment abnormally on a specific link. Rebooting the switch does not diagnose the root cause and causes unnecessary disruption, changing the server's IP address is unrelated to a Layer 1/2 duplex issue, and disabling spanning-tree does not address or reveal duplex mismatches and could introduce loops.25. A security-conscious organization wants to ensure that sensitive customer data cannot be read by anyone who intercepts it in transit, that the data is not altered without detection, and that authorized systems can always access it when needed. Which foundational security concept describes this set of goals?
- A. The CIA triad: Confidentiality, Integrity, and Availability
- B. The AAA framework: Authentication, Authorization, and Accounting
- C. The OSI model's seven layers
- D. The TCP three-way handshake
Show answer & explanation
Answer: A
The CIA triad - Confidentiality (protection from unauthorized disclosure), Integrity (protection from unauthorized modification), and Availability (ensuring access when needed) - directly maps to the three goals described. AAA is about verifying identity, permissions, and logging usage rather than these three protection goals; the OSI model describes network communication layers, not security goals; and the TCP handshake is a connection-establishment mechanism unrelated to these security principles.26. A company implements a system where employees must first prove their identity with a username and password, then are granted access only to specific resources based on their role, and all their access activity is logged for later review. Which security framework does this describe?
- A. AAA: Authentication, Authorization, and Accounting
- B. CIA: Confidentiality, Integrity, and Availability
- C. WPA3 personal mode only
- D. A firewall access control list exclusively
Show answer & explanation
Answer: A
AAA describes exactly this three-part process: Authentication (proving identity), Authorization (granting access based on role/policy), and Accounting (logging activity for auditing). CIA describes data protection goals rather than an access control process, WPA3 personal is a wireless encryption/authentication standard for Wi-Fi specifically (not a general access framework), and a firewall ACL alone only filters traffic - it does not inherently authenticate users or log detailed accounting data.27. A firewall is configured to permit outbound traffic from the internal network to any destination, but only allow inbound traffic that is a response to a connection the internal network initiated. What type of firewall behavior does this describe?
- A. Stateful inspection, which tracks the state of active connections to determine whether inbound traffic is a legitimate response
- B. Stateless packet filtering, which evaluates every packet independently with no memory of prior packets
- C. A proxy server operating exclusively at the application layer with no packet filtering
- D. A hub, which simply repeats all traffic out every port
Show answer & explanation
Answer: A
Stateful firewalls maintain a table of active connection states, allowing them to permit inbound return traffic that matches an established outbound session while blocking unsolicited inbound traffic. Stateless filtering evaluates each packet in isolation without tracking connection state, so it could not selectively allow only 'response' traffic this way; an application-layer proxy is a different architecture not defined by this behavior alone; and a hub is a Layer 1 device with no filtering capability at all.28. A home user is setting up a new Wi-Fi router and wants the strongest wireless security protocol currently available on the device to protect against offline password-guessing attacks. Assuming the router supports it, which protocol should be selected?
- A. WPA3, since it offers stronger protections such as Simultaneous Authentication of Equals against offline dictionary attacks compared to WPA2
- B. WEP, since it is the most modern and widely recommended protocol
- C. An open network with no password, since encryption slows down Wi-Fi performance
- D. WPA2 with TKIP, since TKIP is newer and more secure than AES
Show answer & explanation
Answer: A
WPA3 improves on WPA2 by using Simultaneous Authentication of Equals (SAE) for the handshake, which is much more resistant to offline dictionary/password-guessing attacks than WPA2's PSK handshake. WEP is an outdated, cryptographically broken protocol and should never be recommended; an open network provides no encryption at all, exposing all traffic; and TKIP is an older, weaker encryption method than AES, which WPA2 also supports and WPA3 requires.29. A technician is asked to configure basic wireless security on a small office access point and is deciding between WPA2-Personal and WPA2-Enterprise. Which factor should most influence this decision?
- A. WPA2-Enterprise requires a RADIUS authentication server for per-user credentials, while WPA2-Personal uses a single shared pre-shared key for all users
- B. WPA2-Personal and WPA2-Enterprise use completely different encryption algorithms with no relation to each other
- C. WPA2-Enterprise cannot be used on any access point without a dedicated cellular connection
- D. WPA2-Personal supports per-user authentication through a RADIUS server just like Enterprise mode
Show answer & explanation
Answer: A
WPA2-Personal (PSK mode) uses one shared passphrase for all connecting devices, which is simple but offers less accountability, while WPA2-Enterprise authenticates each user individually against a RADIUS server, offering stronger per-user control - an important distinction for choosing the right mode for an office. Both modes can use the same underlying AES-CCMP encryption, cellular connectivity is unrelated to Enterprise mode's authentication requirement, and per-user RADIUS authentication is specifically an Enterprise-mode feature, not part of Personal mode.30. A technician configures a Windows 10 workstation to join a wired network and needs to verify the assigned IP address, subnet mask, and default gateway from the command line. Which command should be used?
- A. ipconfig /all
- B. ifconfig -a, which is native to Windows Command Prompt
- C. netstat -r only, which never shows IP configuration
- D. nslookup, which only queries DNS servers
Show answer & explanation
Answer: A
On Windows, ipconfig /all displays detailed adapter information including IP address, subnet mask, default gateway, and DNS servers. ifconfig is the Linux/macOS equivalent, not a native Windows command; netstat -r shows the routing table, not full IP configuration details like subnet mask; and nslookup is solely for DNS lookups, not general interface configuration.31. A user with an Android phone reports they cannot connect to the office Wi-Fi network despite entering the correct password. A technician wants to check the phone's currently assigned IP address without using any third-party apps. Where would this information typically be found?
- A. Within the phone's built-in Wi-Fi settings menu, under the details/advanced view for the connected network
- B. Only by connecting the phone to a Cisco switch console port
- C. Only by running a Wireshark capture directly on the phone's baseband processor
- D. Android phones never display assigned IP address information to the user
Show answer & explanation
Answer: A
Android's native Wi-Fi settings menu includes a details or advanced view for the currently connected network that shows the assigned IP address, along with signal strength and security type, without needing third-party apps. A console port connection is used for configuring network infrastructure devices, not viewing a phone's own IP settings; Wireshark on a baseband processor is not a standard or accessible diagnostic method for typical technicians; and Android does expose this information natively to users.32. A technician is deciding whether to use TCP or UDP for a new application that streams live video where occasional dropped frames are acceptable but delay is not. Which transport protocol characteristic makes UDP more suitable here than TCP?
- A. UDP does not perform retransmission or connection setup overhead, reducing latency at the cost of guaranteed delivery
- B. UDP guarantees ordered, reliable delivery of every packet, which TCP cannot do
- C. UDP requires a three-way handshake before any data can be sent, just like TCP
- D. TCP is always faster than UDP because it uses larger packet headers
Show answer & explanation
Answer: A
UDP is connectionless and does not retransmit lost packets or perform handshake setup, which minimizes latency - ideal for real-time streaming where a dropped frame is preferable to a delay from retransmission. It is TCP, not UDP, that guarantees ordered, reliable delivery; the three-way handshake and connection setup overhead are TCP characteristics, not UDP's; and a larger header does not make TCP faster - the added reliability mechanisms actually introduce more latency than UDP.33. A technician is explaining to a junior colleague why an organization might deploy both a firewall and an intrusion detection system (IDS) rather than relying on the firewall alone. What is the key difference in their roles?
- A. A firewall primarily filters traffic based on rules, while an IDS monitors traffic for suspicious patterns and alerts on potential threats without necessarily blocking them
- B. A firewall and an IDS perform the exact same function and one is always redundant
- C. An IDS physically blocks all network cables when an attack is detected
- D. A firewall can only operate on wireless networks, while an IDS only operates on wired networks
Show answer & explanation
Answer: A
A firewall enforces access control by permitting or denying traffic based on defined rules, while an IDS passively monitors traffic for signs of malicious activity and generates alerts, providing a complementary layer of visibility that a firewall's rule-based filtering alone does not cover. The two are not redundant since they serve different functions, an IDS does not physically disconnect cables (that is more characteristic of an inline IPS response, and even then not a literal physical disconnection), and neither device is restricted to only wireless or only wired networks.34. On a Cisco switch, a technician notices the port status LED next to a connected cable is solid green. What does this typically indicate about that port?
- A. The port has an active link and is operating normally without a fault condition
- B. The port has been administratively shut down
- C. The port is experiencing a duplex mismatch causing errors
- D. The port is not receiving any power from the switch
Show answer & explanation
Answer: A
A solid green LED on most Cisco switch ports indicates a healthy, active link with no detected fault. An administratively shut-down port typically shows the LED off (or amber depending on the platform), duplex mismatches or errors are often indicated by a blinking or amber/alternating LED pattern depending on the model, and a port lacking power (on a non-PoE issue) would simply show no light at all rather than solid green.35. A technician is documenting device ports on a small business router. The router has one port labeled 'WAN' and four ports labeled '1' through '4' under a 'LAN' grouping. What is the functional distinction between these port groups?
- A. The WAN port connects to the external network such as the ISP, while the LAN ports connect internal devices to the local network
- B. The WAN and LAN ports are functionally identical and interchangeable on all routers
- C. The LAN ports are used exclusively for fiber connections, while WAN is copper-only
- D. The WAN port only functions when the router is in bridge mode
Show answer & explanation
Answer: A
On consumer/small-business routers, the WAN port connects upstream to the ISP/external network while the LAN ports connect downstream to internal devices such as computers and switches - these roles are distinct and not interchangeable. Media type (fiber vs. copper) is not what distinguishes WAN from LAN ports, and the WAN port functions in normal routing mode, not only in bridge mode.