Cisco Certified Support Technician (CCST) Networking — Questions and Answers

Question 1: What is the difference between an access port and a trunk port on a Cisco switch?

An access port connects to routers; a trunk port connects to end hosts
An access port carries multiple VLANs; a trunk port carries only one VLAN
An access port carries traffic for a single VLAN; a trunk port carries traffic for multiple VLANs using 802.1Q tagging (Correct answer)
An access port uses fiber; a trunk port uses copper

Correct answer: An access port carries traffic for a single VLAN; a trunk port carries traffic for multiple VLANs using 802.1Q tagging

An access port carries untagged traffic for a single VLAN (typically connected to end devices), while a trunk port carries tagged traffic for multiple VLANs using 802.1Q encapsulation.

Question 2: Which 802.11 feature allows a client to request its AP to suggest better APs to roam to, improving overall network efficiency?

802.11w (Management Frame Protection)
802.11r (Fast Transition)
802.11k (Radio Resource Management) (Correct answer)
802.11s (Mesh Networking)

Correct answer: 802.11k (Radio Resource Management)

802.11k allows clients to request a neighbor report from their current AP, receiving a list of candidate APs for roaming based on radio resource management data.

Question 3: A Cisco router shows 'up/down' for an interface. What does this indicate?

The interface is administratively disabled
The physical layer is active but the data link layer protocol has failed (Correct answer)
The interface has correct IP configuration but no route
The interface is fully operational

Correct answer: The physical layer is active but the data link layer protocol has failed

An 'up/down' state means the physical connection (Layer 1) is detected but the line protocol (Layer 2) has not established, often due to encapsulation or keepalive issues.

Question 4: What does VLSM (Variable Length Subnet Masking) allow network engineers to do?

Assign multiple IP addresses to a single interface
Automatically allocate IP addresses using DHCP
Use different subnet mask sizes within the same network to minimize IP address waste (Correct answer)
Combine multiple subnets into one larger network

Correct answer: Use different subnet mask sizes within the same network to minimize IP address waste

VLSM allows subnets of different sizes within the same address space, allocating exactly as many addresses as each segment needs.

Question 5: What is the default administrative distance of a static route in Cisco IOS?

0
110
90
1 (Correct answer)

Correct answer: 1

Static routes in Cisco IOS have a default administrative distance of 1, making them preferred over most dynamic routing protocols except directly connected routes (AD=0).

Question 6: Which IPv4 address range is reserved for loopback testing?

169.254.0.0/16
192.168.0.0/16
127.0.0.0/8 (Correct answer)
10.0.0.0/8

Correct answer: 127.0.0.0/8

The 127.0.0.0/8 range is reserved for loopback; pinging 127.0.0.1 tests the local TCP/IP stack without sending traffic to the network.

Question 7: A technician needs to prevent rogue devices from sending forged ARP responses on a VLAN. DHCP snooping is already enabled. What additional feature should be configured?

IP Source Guard
Storm control
Dynamic ARP Inspection (DAI) (Correct answer)
Port security

Correct answer: Dynamic ARP Inspection (DAI)

Dynamic ARP Inspection (DAI) uses the DHCP snooping binding table to validate ARP packets and drop those with spoofed IP-to-MAC mappings.

Question 8: A technician uses traceroute and sees that hop 5 shows '* * *' but hop 6 responds normally. What does this most likely indicate?

The route is broken at hop 5
The destination is unreachable
Hop 5 blocks ICMP/UDP but forwards traffic (Correct answer)
Hop 6 is misconfigured

Correct answer: Hop 5 blocks ICMP/UDP but forwards traffic

A router can be configured to drop ICMP TTL-exceeded messages while still forwarding traffic normally, causing asterisks in traceroute output.

Question 9: What is the BEST strategy for resource allocation in Cisco Certified Support Technician Networking management?

Keep significant reserves without deployment
Focus resources only on largest tasks
Allocate all resources equally
Match resources to priorities based on needs, risks, and strategic goals (Correct answer)

Correct answer: Match resources to priorities based on needs, risks, and strategic goals

Effective resource allocation matches resources to priorities based on assessment of needs.

Question 10: Which first DHCP message does a client broadcast when it needs an IP address?

DHCPOFFER
DHCPDISCOVER (Correct answer)
DHCPREQUEST
DHCPACK

Correct answer: DHCPDISCOVER

The DHCP process begins with a DHCPDISCOVER broadcast sent by the client to locate available DHCP servers on the local network segment.

Question 11: Which frequency band does the 802.11b standard use?

60 GHz
5 GHz
6 GHz
2.4 GHz (Correct answer)

Correct answer: 2.4 GHz

802.11b operates in the 2.4 GHz band, offering up to 11 Mbps and was one of the earliest widely adopted Wi-Fi standards.

Question 12: What is the broadcast address for the subnet 10.0.0.64/26?

10.0.0.126
10.0.0.255
10.0.0.127 (Correct answer)
10.0.0.128

Correct answer: 10.0.0.127

The /26 block starting at .64 spans .64–.127, so .127 is the broadcast address.

Question 13: How many usable host addresses are available in a /29 subnet?

8
30
14
6 (Correct answer)

Correct answer: 6

A /29 subnet has 2^3 = 8 addresses total, minus 2 (network and broadcast) = 6 usable hosts.

Question 14: Which of the following correctly describes a /16 subnet mask?

255.255.0.0 with 65,536 usable hosts
255.255.255.0 with 254 usable hosts
255.255.0.0 with 65,534 usable hosts (Correct answer)
255.0.0.0 with 16,777,214 usable hosts

Correct answer: 255.255.0.0 with 65,534 usable hosts

A /16 mask is 255.255.0.0, providing 2^16 = 65,536 total addresses minus 2 = 65,534 usable hosts.

Question 15: When documenting assessment findings in CCST practice, which approach is MOST appropriate?

Summarize verbally without written documentation
Record objective findings, measurements, and observations factually (Correct answer)
Include only positive findings
Use jargon only experts understand

Correct answer: Record objective findings, measurements, and observations factually

Assessment documentation must be objective, factual, and comprehensive.

Question 16: Which network security tool monitors and analyzes traffic in real time to detect and potentially block malicious activity?

Intrusion Detection/Prevention System (IDS/IPS) (Correct answer)
Network Access Control (NAC)
Security Information and Event Management (SIEM)
Vulnerability scanner

Correct answer: Intrusion Detection/Prevention System (IDS/IPS)

An IDS detects suspicious traffic and alerts administrators, while an IPS can also actively block or drop malicious packets in real time.

Question 17: A company needs to allow remote employees to securely access internal resources over the internet as if they were on the local network. Which solution best meets this need?

NAT overload (PAT)
Proxy server
Site-to-site VPN
Remote Access VPN (Correct answer)

Correct answer: Remote Access VPN

A remote access VPN creates an encrypted tunnel from an individual user's device to the corporate network, providing secure access to internal resources.

Question 18: A company needs 5 subnets with at least 25 hosts each from 192.168.1.0/24. Which subnet mask satisfies this?

255.255.255.128 (/25)
255.255.255.224 (/27) (Correct answer)
255.255.255.240 (/28)
255.255.255.192 (/26)

Correct answer: 255.255.255.224 (/27)

/27 provides 30 usable hosts per subnet and allows 8 subnets from a /24, meeting both requirements.

Question 19: What is the purpose of the loopback address 127.0.0.1?

To identify the default gateway
To communicate with all hosts on the local subnet
To test the local TCP/IP stack without sending traffic on the network (Correct answer)
To assign a temporary address when DHCP fails

Correct answer: To test the local TCP/IP stack without sending traffic on the network

127.0.0.1 is the loopback address used to test that the local IP stack is functioning correctly.

Question 20: What is the purpose of CDP (Cisco Discovery Protocol)?

To dynamically assign IP addresses to Cisco devices
To encrypt traffic between Cisco devices
To monitor bandwidth utilization on Cisco switches
To allow Cisco devices to discover and share information about directly connected Cisco neighbors (Correct answer)

Correct answer: To allow Cisco devices to discover and share information about directly connected Cisco neighbors

CDP is a Cisco-proprietary Layer 2 protocol that allows Cisco devices to advertise and discover directly connected Cisco neighbors, sharing device type, IP address, and port information.

Question 21: What is the result of ANDing a host IP address with its subnet mask?

The network address (Correct answer)
The gateway address
The broadcast address
The host portion of the address

Correct answer: The network address

ANDing an IP address with its subnet mask zeroes out the host bits, revealing the network address.

Question 22: What is the purpose of Spanning Tree Protocol (STP) in a switched network?

To load-balance traffic across multiple uplinks
To encrypt traffic between switches
To assign IP addresses to switch ports
To prevent Layer 2 switching loops by blocking redundant paths (Correct answer)

Correct answer: To prevent Layer 2 switching loops by blocking redundant paths

STP (IEEE 802.1D) prevents broadcast storms and Layer 2 loops in networks with redundant switch paths by logically blocking all but one active path.

Question 23: A host with IP 192.168.10.50/28 tries to communicate with 192.168.10.65. Are these hosts on the same subnet?

Cannot be determined without the MAC address
No, they are on different subnets (Correct answer)
It depends on the default gateway
Yes, they are on the same subnet

Correct answer: No, they are on different subnets

/28 creates 16-address blocks; .50 belongs to 192.168.10.48–.63 and .65 belongs to 192.168.10.64–.79, so they are on different subnets.

Question 24: How should a CCST professional manager address underperformance?

Ignore it until formal reviews
Address publicly in team meetings
Provide timely, specific feedback with support and a clear improvement plan (Correct answer)
Immediately reassign the individual

Correct answer: Provide timely, specific feedback with support and a clear improvement plan

Timely, specific feedback with support gives individuals a fair opportunity to improve.

Question 25: How many subnets are created when you borrow 3 bits from the host portion of a Class C network?

8 (Correct answer)
4
6
16

Correct answer: 8

Borrowing 3 bits creates 2^3 = 8 subnets.

Question 26: Which protocol is used to synchronize the clocks of devices across a network?

TFTP
LLDP
NTP (Correct answer)
SNMP

Correct answer: NTP

NTP (Network Time Protocol) synchronizes clocks of networked devices to a reference time source, which is critical for accurate logging and security event correlation.

Question 27: What is the MOST effective way for new CCST professionals to build competency?

Combining formal education, mentored practice, and ongoing professional development (Correct answer)
Learning through trial and error
Studying certification materials exclusively
Focusing solely on advanced topics

Correct answer: Combining formal education, mentored practice, and ongoing professional development

Building competency requires formal education, mentored practice, and ongoing development.

Question 28: What type of address is FF:FF:FF:FF:FF:FF?

Multicast IP address
Unicast MAC address
Broadcast MAC address (Correct answer)
Loopback address

Correct answer: Broadcast MAC address

FF:FF:FF:FF:FF:FF is the Layer 2 broadcast MAC address, causing all devices on a LAN segment to receive and process the frame.

Question 29: How does the CCST body of knowledge relate to daily professional practice?

It is only for academic research
It is theoretical with limited application
It only applies during exams
It provides the foundational framework guiding decision-making and standard practices (Correct answer)

Correct answer: It provides the foundational framework guiding decision-making and standard practices

The body of knowledge provides the framework guiding daily decision-making and practices.

Question 30: What is the purpose of DNS?

Saves passwords
Connects printers
Translates domain names (Correct answer)
Encrypts traffic

Correct answer: Translates domain names

DNS (Domain Name System) acts like a phonebook for the internet, translating human-readable domain names (e.g., google.com) into machine-readable IP addresses (e.g., 172.217.160.142). This translation is essential for web browsers and other applications to locate and connect to internet resources. Without DNS, users would have to remember complex numerical IP addresses to access websites.

Question 31: What is the PRIMARY purpose of obtaining CCST certification in Cisco Certified Support Technician Networking?

To guarantee employment
To satisfy a personal achievement goal
To bypass educational requirements
To demonstrate verified competency and adherence to professional standards (Correct answer)

Correct answer: To demonstrate verified competency and adherence to professional standards

Certification demonstrates verified competency and adherence to professional standards.

Question 32: Which command displays the current ARP cache on a Windows system?

arp -n
arp -d
arp -s
arp -a (Correct answer)

Correct answer: arp -a

The arp -a command displays all current ARP cache entries mapping IP addresses to MAC addresses.

Question 33: A user reports receiving an email claiming to be from IT support asking for their password to resolve an account issue. What type of attack is this?

Phishing (Correct answer)
Whaling
Vishing
Spear phishing

Correct answer: Phishing

Phishing is a social engineering attack using deceptive emails that appear legitimate to trick users into revealing sensitive information.

Question 34: What does 'half-duplex' mean in the context of network communication?

Data can only flow in one direction permanently
Data can flow in only one direction at a time (Correct answer)
Data can flow in both directions simultaneously
Data is transmitted in two separate channels

Correct answer: Data can flow in only one direction at a time

Half-duplex allows data to travel in both directions but not at the same time — one side must finish transmitting before the other can send.

Question 35: An attacker floods a network with spoofed TCP SYN packets to exhaust server resources. What type of attack is this?

SYN flood (DoS) (Correct answer)
Smurf attack
Ping of Death
Teardrop attack

Correct answer: SYN flood (DoS)

A SYN flood exploits the TCP three-way handshake by sending many SYN packets without completing the handshake, exhausting server connection resources.

Question 36: Which command on Windows displays all active TCP and UDP connections along with the listening ports?

route print
ipconfig /all
arp -a
netstat -an (Correct answer)

Correct answer: netstat -an

The 'netstat -an' command shows all active network connections and listening ports in numerical format without DNS resolution.

Question 37: What distinguishes a Cisco Certified Support Technician Networking certified professional from a non-certified practitioner?

There is no meaningful difference
Certified professionals always have more experience
Certified professionals only work in larger organizations
Certification validates competency through standardized assessment against benchmarks (Correct answer)

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 38: What is the total number of IPv4 addresses in a /22 subnet?

512
2048
1024 (Correct answer)
256

Correct answer: 1024

A /22 leaves 10 host bits, so 2^10 = 1024 total addresses.

Question 39: What does CSMA/CD stand for, and which network technology uses it?

Carrier Signal Multiplexing / Channel Division — used in fiber optics
Carrier Sense Multiple Access / Collision Detection — used in traditional wired Ethernet (Correct answer)
Circuit Switching Multiple Access / Channel Delay — used in WAN links
Controlled Slot Multiple Access / Collision Detection — used in Wi-Fi

Correct answer: Carrier Sense Multiple Access / Collision Detection — used in traditional wired Ethernet

CSMA/CD (Carrier Sense Multiple Access with Collision Detection) is the media access method used by legacy half-duplex Ethernet to detect and recover from frame collisions.

Question 40: What is the BEST strategy for resource allocation in Cisco Certified Support Technician Networking management?

Focus resources only on largest tasks
Keep significant reserves without deployment
Match resources to priorities based on needs, risks, and strategic goals (Correct answer)
Allocate all resources equally

Correct answer: Match resources to priorities based on needs, risks, and strategic goals

Effective resource allocation matches resources to priorities based on assessment of needs.

Question 41: Which Cisco IOS command prevents brute-force login attempts by blocking access after repeated failed logins?

service password-encryption
security passwords min-length
login local
login block-for (Correct answer)

Correct answer: login block-for

The 'login block-for' command temporarily blocks login attempts after a specified number of failures within a given time window.

Question 42: Which foundational principle is MOST important for success in Cisco Certified Support Technician Networking?

Specializing in only one narrow area
Maximizing financial returns
Maintaining minimum certification requirements
Commitment to continuous learning, ethical practice, and quality outcomes (Correct answer)

Correct answer: Commitment to continuous learning, ethical practice, and quality outcomes

Success requires continuous learning, ethical practice, and focus on quality outcomes.

Question 43: What tool resolves IPs to MAC addresses?

ARP (Correct answer)
Traceroute
NSLookup
Ping

Correct answer: ARP

ARP (Address Resolution Protocol) is a crucial protocol used to resolve IP addresses to MAC (Media Access Control) addresses within a local area network. When a device needs to communicate with another device on the same network segment, it uses ARP to discover the MAC address associated with the target device's known IP address. This mapping is fundamental for data link layer communication.

Question 44: What distinguishes a Cisco Certified Support Technician Networking certified professional from a non-certified practitioner?

Certified professionals only work in larger organizations
Certification validates competency through standardized assessment against benchmarks (Correct answer)
There is no meaningful difference
Certified professionals always have more experience

Correct answer: Certification validates competency through standardized assessment against benchmarks

Certification provides objective validation of competency through standardized assessment.

Question 45: Which supernet correctly summarizes the subnets 192.168.4.0/24 through 192.168.7.0/24?

192.168.4.0/23
192.168.4.0/22 (Correct answer)
192.168.0.0/22
192.168.4.0/21

Correct answer: 192.168.4.0/22

Four consecutive /24 subnets (4–7) can be summarized as a single /22 block starting at 192.168.4.0.

Question 46: Which IPv4 address block is used for testing and documentation purposes only (TEST-NET)?

192.0.2.0/24 (Correct answer)
203.0.113.0/24
192.168.0.0/16
198.51.100.0/24

Correct answer: 192.0.2.0/24

192.0.2.0/24 is designated by RFC 5737 as TEST-NET-1, reserved for documentation and example use.

Question 47: What is the maximum cable length for a standard Cat5e or Cat6 Ethernet run?

100 meters (Correct answer)
50 meters
150 meters
200 meters

Correct answer: 100 meters

IEEE 802.3 standards specify a maximum horizontal cable run of 100 meters (328 feet) for copper Ethernet (Cat5e/Cat6).

Question 48: Which protocol does a Cisco router use by default to dynamically learn routes from other Cisco routers in an enterprise network?

OSPF
RIP
BGP
EIGRP (Correct answer)

Correct answer: EIGRP

EIGRP (Enhanced Interior Gateway Routing Protocol) is Cisco's proprietary advanced distance-vector routing protocol, commonly deployed by default in Cisco enterprise networks.

Question 49: What is the purpose of Syslog in a network environment?

To encrypt management traffic between devices
To collect and store log messages from network devices for monitoring and troubleshooting (Correct answer)
To synchronize time across all network devices
To assign IP addresses to devices on the network

Correct answer: To collect and store log messages from network devices for monitoring and troubleshooting

Syslog is a standard protocol used to send system log messages from network devices to a centralized syslog server, enabling monitoring, auditing, and troubleshooting.

Question 50: Which type of wireless attack involves setting up a rogue AP with the same SSID as a legitimate network to intercept traffic?

Evil Twin attack (Correct answer)
Jamming attack
Deauthentication attack
War driving

Correct answer: Evil Twin attack

An Evil Twin attack creates a rogue access point mimicking a legitimate SSID to trick users into connecting and expose their traffic to interception.

Question 51: A packet destined for 10.5.3.255 on a 10.5.3.0/24 network will be sent to which type of address?

Directed broadcast (Correct answer)
Unicast
Multicast
Anycast

Correct answer: Directed broadcast

10.5.3.255 is the directed broadcast address for the 10.5.3.0/24 subnet, delivered to all hosts on that subnet.

Cisco Certified Support Technician (CCST) Networking

This exam validates foundational knowledge and skills in networking, including basic concepts, network access, IP connectivity, and network services.

Questions

50 min

Time Limit

80%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds