CCST Networking Practice Test.

1. A technician needs to explain to a new hire why the OSI model splits networking into seven layers instead of using a single monolithic model. What is the primary benefit of this layered approach?

• A. It allows each layer to be developed, troubleshot, and replaced independently as long as the interfaces between layers stay consistent
• B. It guarantees that every network will automatically use encryption at every layer
• C. It eliminates the need for any addressing scheme because each layer handles delivery on its own
• D. It requires every vendor to use identical hardware so layers can be swapped physically

2. A frame arrives on a switch port and the switch reads the destination MAC address to decide where to forward it. At which OSI layer does this decision primarily occur?

• A. Layer 2, the Data Link layer
• B. Layer 3, the Network layer
• C. Layer 4, the Transport layer
• D. Layer 7, the Application layer

3. A small business wants to connect three offices in different cities together using a service provider's network, while each individual office uses its own internal network for desks and printers. Which two network type terms best describe this scenario?

• A. A WAN connects the offices between cities, while each office runs its own LAN internally
• B. A PAN connects the offices between cities, while each office runs its own CAN internally
• C. A MAN connects the offices between cities, while each office runs its own WLAN internally
• D. A CAN connects the offices between cities, while each office runs its own PAN internally

4. When comparing a WLAN to a traditional wired LAN, which statement accurately describes a key architectural difference a support technician should understand?

• A. A WLAN uses radio frequency signals and requires an access point to bridge wireless clients into the wired network
• B. A WLAN cannot use IP addressing because it operates entirely at Layer 1
• C. A WLAN always provides faster throughput than any wired LAN connection
• D. A WLAN eliminates the need for a Data Link layer because there is no cable

5. A technician is asked why a PAN is not a suitable term for describing the network connecting an entire university campus with buildings up to a mile apart. What is the best explanation?

• A. A PAN is designed for very short-range personal device connections, while a network spanning multiple buildings on a campus is better described as a CAN
• B. A PAN specifically requires fiber optic cabling which campuses cannot install
• C. A PAN is only used for connecting servers in a data center, never end-user devices
• D. A PAN and a CAN are interchangeable terms with no practical distinction

6. A network engineer is assigning IP addresses for an internal office network that will never be directly reachable from the public internet. Which type of address range should be used?

• A. A private address range such as 192.168.0.0/16
• B. A public address range assigned by a regional internet registry
• C. A multicast address range such as 224.0.0.0/4
• D. A loopback address range such as 127.0.0.0/8

7. A host is configured with the IPv4 address 172.16.45.10 and subnet mask 255.255.255.0. What is the network address for this host's subnet?

• A. 172.16.45.0
• B. 172.16.0.0
• C. 172.16.45.255
• D. 172.16.45.1

8. An administrator needs to subnet the network 192.168.10.0/24 into at least 4 equally sized subnets. What subnet mask should be used to achieve exactly 4 subnets while maximizing usable hosts per subnet?

• A. 255.255.255.192 (/26)
• B. 255.255.255.240 (/28)
• C. 255.255.255.0 (/24)
• D. 255.255.255.224 (/27)

9. A technician examines an IPv6 address written as 2001:0db8:0000:0000:0000:ff00:0042:8329. Which of the following is a valid compressed representation of this same address?

• A. 2001:db8::ff00:42:8329
• B. 2001:db8:0:0:0:ff00::42:8329
• C. 2001::db8::ff00:42:8329
• D. 2001:db8:0000:0000:0000:ff:42:8329

10. Which IPv6 address type is designed so that a packet sent to it is delivered to only the nearest single interface out of a group of interfaces sharing that address, typically used for load-distributed services?

• A. Anycast address
• B. Unicast address
• C. Multicast address
• D. Link-local address

11. A host is configured with an IPv6 address that begins with fe80:: . What does this prefix indicate about the address's scope?

• A. It is a link-local address usable only for communication on the local network segment, not routed beyond it
• B. It is a globally routable address usable anywhere on the internet
• C. It is a multicast address intended for all-hosts group communication
• D. It is a loopback address used only for testing the local device itself

12. A user connects a laptop to a docking station that provides a wired Ethernet port. Which connector type is used at the physical interface for standard copper Ethernet cabling?

• A. RJ-45
• B. RJ-11
• C. SC connector
• D. DB-9

13. A technician needs to run a network cable between two buildings 300 meters apart where there is also significant electromagnetic interference from nearby power lines. Which cabling choice is most appropriate?

• A. Fiber-optic cable, since it is immune to electromagnetic interference and supports long distances
• B. Unshielded twisted-pair (UTP) copper cable, since it is the cheapest option regardless of distance
• C. Coaxial cable limited to 100 meters, since it matches typical Ethernet copper limits
• D. A standard Cat5e patch cable, since patch cables are rated for any distance

14. A field technician must connect a laptop's fiber network interface to a switch's fiber port but the switch is several years old and only accepts a specific transceiver form factor. Which component would the technician most likely need to check for compatibility?

• A. An SFP (small form-factor pluggable) transceiver module
• B. An RJ-45 keystone jack
• C. A USB-C to HDMI adapter
• D. A DB-25 serial adapter

15. A user's smartphone automatically switches from a 5 GHz Wi-Fi network to the cellular data network when walking out of the office building. Which factor most directly explains why cellular, rather than Wi-Fi, can maintain connectivity over a much larger geographic area?

• A. Cellular networks use carrier-operated towers spaced across wide areas with handoff between towers, while Wi-Fi access points have a much shorter individual range
• B. Wi-Fi signals are physically incapable of traveling more than 10 meters under any circumstance
• C. Cellular networks do not use radio frequency signals, so they are not limited by distance
• D. Wi-Fi requires a wired connection to every client device at all times

16. A technician needs to connect a new switch to an existing switch to extend available ports in a wiring closet. Which type of port-to-port connection and cabling consideration is most relevant?

• A. Connect an uplink or standard port on each switch using a straight-through or Auto-MDI-X-compatible Ethernet cable
• B. Switches can only be connected using a fiber-to-copper direct splice with no transceiver
• C. Switch-to-switch connections require a console cable, not an Ethernet cable
• D. Switches must always be connected through a router positioned between them

17. A network diagram shows a router with a routing table containing a default route of 0.0.0.0/0 pointing to an ISP's gateway. What is the function of this default route?

• A. It directs traffic destined for any network not explicitly listed elsewhere in the routing table toward the ISP gateway
• B. It blocks all outbound traffic from leaving the local network
• C. It is only used for broadcast traffic within the local subnet
• D. It assigns IP addresses to devices on the local network automatically

18. A switch receives a frame destined for a MAC address that is not currently in its MAC address table. What action does the switch take with this frame?

• A. It floods the frame out all ports except the one it was received on
• B. It silently discards the frame since the destination is unknown
• C. It sends the frame back out the same port it arrived on
• D. It converts the frame to a routing table lookup request

19. A help desk technician is troubleshooting a user's report of 'the internet is down.' Following a structured troubleshooting methodology, what is generally the most effective first step?

• A. Gather information by identifying exactly what is not working and what has changed, before jumping to a fix
• B. Immediately reformat the user's operating system to rule out software issues
• C. Replace the user's network cable without asking any questions
• D. Escalate directly to the network engineering team without any initial investigation

20. A technician runs a packet capture in Wireshark and wants to isolate only traffic between a specific host and a web server on port 443. Which type of Wireshark feature should the technician use?

• A. A display filter, such as one matching the host IP address and tcp.port == 443
• B. A capture interface change to a different network adapter
• C. The Wireshark statistics menu's I/O graph only
• D. A firewall rule configured directly within Wireshark

21. A user reports intermittent connectivity to a remote server. A technician runs a continuous ping to the server and observes that some replies take significantly longer than others, with occasional timeouts. What does this pattern most likely indicate?

• A. Variable latency and possible packet loss along the path, suggesting congestion or an unstable link
• B. The remote server's DNS name is definitely misspelled
• C. The local host's IP address is definitely configured incorrectly
• D. The ping command itself is deprecated and its results should be ignored

22. A technician wants to trace the path packets take from a workstation to a remote website and identify at which hop delays begin to occur. Which diagnostic command is best suited for this task?

• A. traceroute (or tracert on Windows)
• B. ipconfig /all with no other commands
• C. nslookup only
• D. arp -a only

23. On a Cisco IOS device, a technician runs the command 'show ip interface brief.' What information does this command primarily provide?

• A. A summary of each interface's IP address and its up/down status for both the interface and line protocol
• B. A detailed listing of the device's entire running configuration file
• C. A real-time packet capture of traffic crossing the device
• D. A list of all VLANs configured on a connected switch only, with no interface details

24. A technician suspects a duplex mismatch is causing performance issues on a link between a switch and a server. Which basic diagnostic approach would most directly help confirm this suspicion on a Cisco switch?

• A. Use 'show interfaces' to check for a mismatch between configured duplex settings and incrementing collision/error counters
• B. Reboot the entire switch stack immediately without checking any interface statistics
• C. Change the server's IP address to a different subnet
• D. Disable the switch's spanning-tree protocol entirely

25. A security-conscious organization wants to ensure that sensitive customer data cannot be read by anyone who intercepts it in transit, that the data is not altered without detection, and that authorized systems can always access it when needed. Which foundational security concept describes this set of goals?

• A. The CIA triad: Confidentiality, Integrity, and Availability
• B. The AAA framework: Authentication, Authorization, and Accounting
• C. The OSI model's seven layers
• D. The TCP three-way handshake

26. A company implements a system where employees must first prove their identity with a username and password, then are granted access only to specific resources based on their role, and all their access activity is logged for later review. Which security framework does this describe?

• A. AAA: Authentication, Authorization, and Accounting
• B. CIA: Confidentiality, Integrity, and Availability
• C. WPA3 personal mode only
• D. A firewall access control list exclusively

27. A firewall is configured to permit outbound traffic from the internal network to any destination, but only allow inbound traffic that is a response to a connection the internal network initiated. What type of firewall behavior does this describe?

• A. Stateful inspection, which tracks the state of active connections to determine whether inbound traffic is a legitimate response
• B. Stateless packet filtering, which evaluates every packet independently with no memory of prior packets
• C. A proxy server operating exclusively at the application layer with no packet filtering
• D. A hub, which simply repeats all traffic out every port

28. A home user is setting up a new Wi-Fi router and wants the strongest wireless security protocol currently available on the device to protect against offline password-guessing attacks. Assuming the router supports it, which protocol should be selected?

• A. WPA3, since it offers stronger protections such as Simultaneous Authentication of Equals against offline dictionary attacks compared to WPA2
• B. WEP, since it is the most modern and widely recommended protocol
• C. An open network with no password, since encryption slows down Wi-Fi performance
• D. WPA2 with TKIP, since TKIP is newer and more secure than AES

29. A technician is asked to configure basic wireless security on a small office access point and is deciding between WPA2-Personal and WPA2-Enterprise. Which factor should most influence this decision?

• A. WPA2-Enterprise requires a RADIUS authentication server for per-user credentials, while WPA2-Personal uses a single shared pre-shared key for all users
• B. WPA2-Personal and WPA2-Enterprise use completely different encryption algorithms with no relation to each other
• C. WPA2-Enterprise cannot be used on any access point without a dedicated cellular connection
• D. WPA2-Personal supports per-user authentication through a RADIUS server just like Enterprise mode

30. A technician configures a Windows 10 workstation to join a wired network and needs to verify the assigned IP address, subnet mask, and default gateway from the command line. Which command should be used?

• A. ipconfig /all
• B. ifconfig -a, which is native to Windows Command Prompt
• C. netstat -r only, which never shows IP configuration
• D. nslookup, which only queries DNS servers

31. A user with an Android phone reports they cannot connect to the office Wi-Fi network despite entering the correct password. A technician wants to check the phone's currently assigned IP address without using any third-party apps. Where would this information typically be found?

• A. Within the phone's built-in Wi-Fi settings menu, under the details/advanced view for the connected network
• B. Only by connecting the phone to a Cisco switch console port
• C. Only by running a Wireshark capture directly on the phone's baseband processor
• D. Android phones never display assigned IP address information to the user

32. A technician is deciding whether to use TCP or UDP for a new application that streams live video where occasional dropped frames are acceptable but delay is not. Which transport protocol characteristic makes UDP more suitable here than TCP?

• A. UDP does not perform retransmission or connection setup overhead, reducing latency at the cost of guaranteed delivery
• B. UDP guarantees ordered, reliable delivery of every packet, which TCP cannot do
• C. UDP requires a three-way handshake before any data can be sent, just like TCP
• D. TCP is always faster than UDP because it uses larger packet headers

33. A technician is explaining to a junior colleague why an organization might deploy both a firewall and an intrusion detection system (IDS) rather than relying on the firewall alone. What is the key difference in their roles?

• A. A firewall primarily filters traffic based on rules, while an IDS monitors traffic for suspicious patterns and alerts on potential threats without necessarily blocking them
• B. A firewall and an IDS perform the exact same function and one is always redundant
• C. An IDS physically blocks all network cables when an attack is detected
• D. A firewall can only operate on wireless networks, while an IDS only operates on wired networks

34. On a Cisco switch, a technician notices the port status LED next to a connected cable is solid green. What does this typically indicate about that port?

• A. The port has an active link and is operating normally without a fault condition
• B. The port has been administratively shut down
• C. The port is experiencing a duplex mismatch causing errors
• D. The port is not receiving any power from the switch

35. A technician is documenting device ports on a small business router. The router has one port labeled 'WAN' and four ports labeled '1' through '4' under a 'LAN' grouping. What is the functional distinction between these port groups?

• A. The WAN port connects to the external network such as the ISP, while the LAN ports connect internal devices to the local network
• B. The WAN and LAN ports are functionally identical and interchangeable on all routers
• C. The LAN ports are used exclusively for fiber connections, while WAN is copper-only
• D. The WAN port only functions when the router is in bridge mode

36. A home or small office device combines several network functions in one box. Which functions does it typically provide?

• A. Routing to the internet provider, switching between local ports, wireless access and DHCP address assignment
• B. Routing only, with switching requiring a separate device
• C. Wireless access only
• D. Address assignment only

37. A technician documents a network change. What information makes the record useful later?

• A. What was changed, on which device and port, when, why, and how to reverse it
• B. Only the date the change was made
• C. Only the name of the technician
• D. Only whether the change succeeded

38. A firewall is placed between the office network and the internet. What is its basic function?

• A. Permitting or denying traffic according to a rule set, typically allowing internally initiated sessions while blocking unsolicited inbound connections
• B. Assigning IP addresses to internal hosts
• C. Resolving domain names to addresses
• D. Amplifying the wireless signal throughout the office

39. A user runs a connectivity test to a remote server by name and receives a name resolution failure. What should be tested next?

• A. The same test using the server's IP address, to determine whether the fault is in name resolution or in connectivity
• B. Rebooting the workstation immediately
• C. Replacing the network cable
• D. Reinstalling the application

40. A user needs to browse a secure website and send email. Which port numbers are involved?

• A. 443 for HTTPS and 25, 587 or 465 for outbound mail submission depending on the configuration
• B. 80 for HTTPS and 110 for outbound mail
• C. 22 for HTTPS and 53 for outbound mail
• D. 21 for HTTPS and 23 for outbound mail

41. A technician must connect a workstation to a wall jack in an office. Which cable type is used?

• A. A straight-through twisted pair patch cable, since the devices at each end are of dissimilar types
• B. A crossover cable, which is used between similar device types on older equipment
• C. A rollover console cable, which is used for device management
• D. A coaxial cable with BNC connectors

42. A copper Ethernet run must span 130 metres between a switch and a workstation. What is the problem?

• A. It exceeds the 100-metre limit for twisted pair Ethernet, so signal degradation makes the link unreliable or non-functional
• B. It requires a crossover cable at that distance
• C. It requires a higher category of cable but no distance limit applies
• D. There is no problem, since Ethernet has no distance limit

43. A fibre optic link uses single-mode rather than multi-mode fibre. What does this indicate about the deployment?

• A. Longer distances are required, since single-mode carries a single light path over much greater ranges than multi-mode
• B. Shorter distances are required, since single-mode is limited to a building
• C. Copper transceivers are being used at each end
• D. The link carries only management traffic

44. A workstation is configured with an IP address, subnet mask and default gateway. What does the default gateway do?

• A. It receives traffic destined for addresses outside the local subnet and forwards it onward
• B. It assigns the workstation its IP address
• C. It resolves hostnames into IP addresses
• D. It filters traffic based on port numbers

45. A department of 12 staff is given the block 192.168.5.0/28. How many usable host addresses does that provide, and is it sufficient?

• A. 14 usable addresses, which is sufficient, since 16 total minus the network and broadcast addresses leaves 14
• B. 16 usable addresses, since all addresses in the block can be assigned to hosts
• C. 12 usable addresses, exactly matching the staff count
• D. 8 usable addresses, which is insufficient

46. Which address range is reserved for private use and not routable on the public internet?

• A. 8.8.8.0 through 8.8.8.255
• B. 1.1.1.0 through 1.1.1.255
• C. 203.0.113.0 through 203.0.113.255
• D. 192.168.0.0 through 192.168.255.255, alongside 10.0.0.0/8 and 172.16.0.0 through 172.31.255.255

47. A workstation shows an IP address in the 169.254 range. What does this tell the technician?

• A. The host did not receive a response from a DHCP server and self-assigned a link-local address, so it can only reach other hosts doing the same
• B. The host received a valid address from the corporate DHCP server
• C. The host is configured with a static address by an administrator
• D. The host's network adapter has failed completely

48. A technician checks a switch port and finds the link light is off with a cable connected. What should be checked first?

• A. Whether the cable is properly seated at both ends and whether the port is administratively enabled, before replacing hardware
• B. The routing table on the upstream router
• C. The DNS server configuration
• D. The application's firewall rules

49. Several users report slow performance while one user reports none, all on the same switch. What does this pattern suggest?

• A. A shared resource used by the affected users rather than the switch itself, since a switch fault would affect everyone connected to it
• B. A failing switch power supply
• C. An incorrect cable type on the working user's port
• D. A DNS misconfiguration affecting only some names

50. The OSI model's layers are listed from bottom to top. Which sequence is correct?

• A. Application, presentation, session, network, transport, data link, physical
• B. Physical, network, data link, transport, application, session, presentation
• C. Physical, data link, network, transport, session, presentation, application
• D. Data link, physical, transport, network, session, application, presentation

51. A protocol data unit at the data link layer is called what, and what does it contain beyond the payload?

• A. A frame, containing source and destination MAC addresses and a frame check sequence for error detection
• B. A packet, containing source and destination IP addresses
• C. A segment, containing source and destination port numbers
• D. A bit, containing only the raw signal

52. A wireless client shows a strong signal but cannot pass traffic. What should be considered?

• A. That signal strength measures the radio link only, while authentication, address assignment and upstream connectivity are separate and can each fail independently
• B. That a strong signal guarantees full connectivity, so the report must be mistaken
• C. That the client's screen brightness is affecting the radio
• D. That the access point must be physically moved closer

53. Wireless performance is poor in an area where several access points are deployed close together. What should be examined?

• A. Increasing transmit power on every access point to overcome the interference
• B. Assigning every access point the same channel for consistency
• C. Disabling encryption to reduce processing overhead
• D. Channel assignment and transmit power, since overlapping channels and excessive power cause access points to interfere with one another

54. A small office must extend wireless coverage to a distant room. What is the trade-off of using a wireless repeater?

• A. Coverage extends but throughput is reduced, since the repeater receives and retransmits each frame on the same radio
• B. Coverage and throughput both increase
• C. Throughput increases while coverage stays the same
• D. Neither coverage nor throughput changes

55. A device is powered over its Ethernet cable. What must be verified when planning this?

• A. That the switch supports the required power standard and that its total power budget covers all connected devices
• B. That the cable is a crossover type
• C. That the device has a separate power outlet nearby
• D. That the switch port is configured as a trunk

56. An endpoint must be identified on the network by a hardware address. Where does this address come from?

• A. It is assigned to the network interface by its manufacturer, with the first portion identifying the vendor
• B. It is assigned by the DHCP server at each boot
• C. It is derived from the IP address configured on the host
• D. It is chosen by the user during installation

57. A small office wireless network uses WPA2 with a shared passphrase. What limitation should be understood?

• A. Anyone with the passphrase has access, and removing one person's access requires changing it on every device
• B. The passphrase automatically changes each month
• C. Each device receives a unique passphrase automatically
• D. The passphrase prevents any device from seeing another's traffic

58. A user receives an email asking them to confirm their password by following a link. What should they do?

• A. Not follow the link, verify independently through a known channel, and report the message
• B. Follow the link and check whether the site looks legitimate
• C. Reply to the message asking whether it is genuine
• D. Forward the message to colleagues to warn them

59. Device configuration backups are taken regularly. Why does this matter for a network technician?

• A. A failed device can be replaced and restored to its prior configuration quickly, rather than being reconfigured from memory or documentation
• B. Backups improve the device's forwarding performance
• C. Backups replace the need for change documentation
• D. Backups prevent configuration errors from being made

60. A network uses a switch rather than a hub. What is the practical difference?

• A. A switch forwards a frame only to the port where its destination resides, while a hub repeats every frame to all ports
• B. A hub forwards selectively while a switch repeats to all ports
• C. Both forward selectively using IP addresses
• D. A switch operates only on wireless networks

61. A technician must connect to a switch's console port for initial configuration. What is required?

• A. A console cable and terminal emulation software configured with the correct serial settings, since the device has no IP configuration yet
• B. A web browser pointed at the device's default IP address
• C. An SSH client and the device's management address
• D. A DHCP server to assign the device an address

62. An organization uses IPv6 alongside IPv4. Why was IPv6 developed?

• A. Principally to address IPv4 address exhaustion, using a far larger address space alongside simplifications to the header and address configuration
• B. Principally to reduce the number of protocols in use
• C. Principally to increase the maximum speed of network links
• D. Principally to eliminate the need for routing

63. A cloud-hosted application replaces an on-premises server for a small office. What network consideration becomes more important?

• A. Internet connection reliability and bandwidth, since the application is now unreachable if the internet link fails
• B. The speed of the office's internal switch backplane
• C. The number of Ethernet ports available on the wall
• D. The physical security of the empty server room

64. A technician escalates an unresolved issue to a senior engineer. What makes the escalation effective?

• A. A clear statement of the symptom, its scope, what was already tested and the result of each test
• B. A statement that the network is broken and needs attention
• C. A copy of every log file collected without commentary
• D. A request for the senior engineer to start the diagnosis again

65. A technician must verify the path a packet takes to a remote destination. Which utility provides this?

• A. A trace utility listing each router hop toward the destination along with the response time to each
• B. An address resolution display showing local hardware addresses
• C. A name lookup utility resolving hostnames
• D. An interface configuration display showing the local address