Cisco Certified Support Technician Networking (CCST) — Questions and Answers

Question 1: A junior support technician is asked to explain the difference between a vulnerability assessment and a penetration test. Which statement would be the most accurate explanation?

A vulnerability assessment finds weaknesses, while a penetration test actively tries to exploit them. (Correct answer)
A penetration test is performed first to find vulnerabilities, which are then assessed.
A vulnerability assessment is manual, while a penetration test is fully automated.
They are the same process; the terms are used interchangeably in the industry.

Correct answer: A vulnerability assessment finds weaknesses, while a penetration test actively tries to exploit them.

The key difference is in the approach. A vulnerability assessment is a broad, often automated process that scans for and lists potential weaknesses. A penetration test is a more focused, hands-on process that goes a step further by attempting to actively exploit identified vulnerabilities to determine the real-world impact.

Question 2: What is the primary function of the Presentation Layer (Layer 6)?

To manage physical connections
To translate data formats, handle encryption, and compress data (Correct answer)
To segment data for transmission
To route packets

Correct answer: To translate data formats, handle encryption, and compress data

The Presentation Layer translates between application format and network format, handling encoding, encryption, and compression.

Question 3: What is the primary advantage of STP cable over UTP?

Higher data speeds
Easier installation
Lower cost
Better protection against electromagnetic interference (EMI) (Correct answer)

Correct answer: Better protection against electromagnetic interference (EMI)

STP includes metallic shielding protecting against EMI from electrical equipment and other cables.

Question 4: Which command-line tool sends ICMP echo requests to test basic connectivity between two hosts?

netstat
nslookup
traceroute
ping (Correct answer)

Correct answer: ping

The ping command sends ICMP echo requests to a destination host to verify basic IP connectivity.

Question 5: A PC with IP address 192.168.1.10 needs to send data to a server with IP address 192.168.1.50 on the same local Ethernet network. The PC does not have the server's MAC address in its cache. Which protocol will the PC use to find the MAC address of the server?

ICMP
DHCP
DNS
ARP (Correct answer)

Correct answer: ARP

The Address Resolution Protocol (ARP) is used to map a Layer 3 (IP) address to a Layer 2 (MAC) address on a local network. The PC will send out an ARP request broadcast on the local network asking for the MAC address associated with 192.168.1.50. The server will respond with an ARP reply containing its MAC address, allowing the PC to properly address the Ethernet frame.

Question 6: What does a 'Request timed out' message in a ping output typically indicate?

The destination host responded too slowly
The ICMP packet was blocked or the host is unreachable (Correct answer)
DNS could not resolve the hostname
The TTL value expired in transit

Correct answer: The ICMP packet was blocked or the host is unreachable

A 'Request timed out' result means no ICMP reply was received, suggesting the host is unreachable or a firewall is blocking ICMP.

Question 7: Which protocol synchronizes the clocks of networked devices and uses UDP port 123?

NTP (Correct answer)
SNMP
DNS
LDAP

Correct answer: NTP

NTP (Network Time Protocol) uses UDP port 123 to synchronize device clocks across a network to a common time source.

Question 8: Which Network Layer protocol handles error reporting and diagnostics?

ARP
UDP
TCP
ICMP (Correct answer)

Correct answer: ICMP

ICMP provides error reporting (destination unreachable) and diagnostics (ping, traceroute) at Layer 3.

Question 9: Which Cisco IOS command can a support technician use to verify the IP configuration on a router interface?

debug ip packet
show ip interface brief (Correct answer)
show ip route
show interfaces

Correct answer: show ip interface brief

'show ip interface brief' provides a quick summary of all interfaces with their IP addresses and up/down status.

Question 10: A company wants to implement the highest level of security for its corporate wireless network, which is used by hundreds of employees with individual company-issued laptops. Which wireless security protocol and mode should be implemented to ensure each user authenticates with unique credentials?

WPA3-Personal
WPA2-Enterprise (Correct answer)
WPA2-Personal
WPA with TKIP

Correct answer: WPA2-Enterprise

WPA2-Enterprise mode is designed for corporate environments. Unlike the 'Personal' mode which uses a single pre-shared key (PSK) for all users, 'Enterprise' mode integrates with a RADIUS server to authenticate each user individually with unique credentials (e.g., username and password). This provides superior security, accountability, and management, as access can be granted or revoked on a per-user basis.

Question 11: What role does multi-factor authentication (MFA) play in supporting the CIA triad?

It has no relation to the CIA triad
It supports confidentiality by ensuring only verified users access protected resources (Correct answer)
It supports integrity by preventing data modification
It supports availability by allowing faster logins

Correct answer: It supports confidentiality by ensuring only verified users access protected resources

MFA strengthens confidentiality by requiring multiple verification factors to access information.

Question 12: According to the NIST SP 800-61 incident response lifecycle, what is the correct sequence of the major phases?

Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Correct answer)
Detection, Containment, Preparation, Recovery
Containment, Preparation, Detection, Post-Incident Activity
Identification, Eradication, Recovery, Preparation

Correct answer: Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity

The widely adopted NIST incident response lifecycle follows a logical progression: first, you prepare for incidents; then you detect and analyze them; next, you contain, eradicate, and recover from them; and finally, you conduct post-incident activities to learn from the event.

Question 13: What is the broadcast address for the network 10.0.0.0/8?

10.255.255.255 (Correct answer)
10.0.0.255
10.0.255.255
10.255.255.254

Correct answer: 10.255.255.255

The broadcast address is the last address in the subnet; for 10.0.0.0/8, all host bits are set to 1, giving 10.255.255.255.

Question 14: Which of the following cable types is designed with a plastic spline or additional shielding to reduce crosstalk and can support 10 Gbps speeds over shorter distances (up to 55 meters)?

Cat3
Cat5e
Cat6 (Correct answer)
Coaxial

Correct answer: Cat6

Category 6 (Cat6) cable is designed for higher performance than Cat5e. It features more tightly wound pairs, often a plastic spline to separate the pairs, and thicker sheathing to reduce crosstalk (NEXT and AXT). This allows it to support speeds of up to 10 Gbps for distances up to 55 meters.

Question 15: Which subnet mask corresponds to the /24 prefix length in CIDR notation?

255.0.0.0
255.255.255.0 (Correct answer)
255.255.255.128
255.255.0.0

Correct answer: 255.255.255.0

A /24 prefix means 24 bits are set to 1 in the subnet mask, which equals 255.255.255.0 in dotted-decimal notation.

Question 16: Which of the following functions is a primary responsibility of the Transport Layer in both the OSI and TCP/IP models?

Formatting data with encryption and compression.
Establishing reliable, end-to-end connections using protocols like TCP. (Correct answer)
Converting data into electrical signals for transmission.
Providing logical device addressing and path determination.

Correct answer: Establishing reliable, end-to-end connections using protocols like TCP.

The Transport Layer (Layer 4 in OSI, also a layer in TCP/IP) is primarily responsible for establishing and maintaining end-to-end communication between hosts. It ensures reliable data delivery using connection-oriented protocols like TCP, which provides error checking and flow control.

Question 17: A user cannot reach a website by name but CAN ping its IP address. Which service is most likely failing?

DNS (Correct answer)
DHCP
HTTP
Default gateway

Correct answer: DNS

If a host can be reached by IP but not by name, it indicates a DNS resolution failure rather than a connectivity problem.

Question 18: Which of the following is the BEST example of a mechanism used to ensure data integrity?

Implementing a complex password policy
Using a firewall to block unauthorized network traffic
Generating an MD5 hash of a file (Correct answer)
Storing sensitive files in a locked room

Correct answer: Generating an MD5 hash of a file

An MD5 hash creates a unique digital fingerprint of a file. By comparing the hash of a file at two different times, one can verify if any changes have been made, thus ensuring the file's integrity.

Question 19: Why is full disk encryption important for endpoint security?

It backs up data to the cloud
It protects data if the device is lost or stolen by making it unreadable without the decryption key (Correct answer)
It prevents malware installation
It speeds up disk operations

Correct answer: It protects data if the device is lost or stolen by making it unreadable without the decryption key

Full disk encryption ensures all data is unreadable without proper authentication if the device is lost or stolen.

Question 20: Which protocol allows routers to exchange routing information automatically and is classified as a dynamic routing protocol?

NAT
ARP
STP
OSPF (Correct answer)

Correct answer: OSPF

OSPF (Open Shortest Path First) is a link-state dynamic routing protocol that routers use to automatically learn and share network routes.

Question 21: Which of the following EXEC commands will reset LLDP traffic error counters?

clear table lldp
clear lldp all
clear lldp table
clear lldp counters (Correct answer)

Correct answer: clear lldp counters

The `clear lldp counters` command is used on network devices to reset the Link Layer Discovery Protocol (LLDP) traffic error counters to zero. This command is valuable for troubleshooting and monitoring, as it allows an administrator to clear previous error statistics. By resetting the counters, one can obtain fresh data to accurately assess ongoing LLDP-related issues or verify the resolution of past problems.

Question 22: A host has an IP address of 169.254.x.x. What does this indicate?

The host is using a static IP
DHCP failed and the host assigned itself an APIPA address (Correct answer)
DHCP assignment succeeded
The host is on a private Class A network

Correct answer: DHCP failed and the host assigned itself an APIPA address

169.254.0.0/16 is the APIPA (Automatic Private IP Addressing) range, assigned automatically when a host cannot reach a DHCP server.

Question 23: A company is transitioning to an IPv6-only internal network but still needs to allow its users to access services on the IPv4 internet. Which technology is specifically designed to facilitate this communication between IPv6 and IPv4 networks?

NAT64 (Correct answer)
Broadcast
SLAAC
ARP

Correct answer: NAT64

NAT64 is a translation mechanism that allows IPv6-only clients to communicate with IPv4-only servers. A NAT64 gateway translates IPv6 packets into IPv4 packets and vice versa, enabling compatibility between the two protocols during the transition period.

Question 24: Which of the following activities is a critical component of the 'Preparation' phase of the security incident handling process, according to the NIST framework?

Establishing and training a Computer Security Incident Response Team (CSIRT). (Correct answer)
Restoring data from backups after a ransomware attack.
Disconnecting an infected machine from the network.
Analyzing system logs to determine the scope of a breach.

Correct answer: Establishing and training a Computer Security Incident Response Team (CSIRT).

The 'Preparation' phase involves all the proactive steps taken before an incident occurs to ensure the organization is ready to respond. Establishing and training a CSIRT is a fundamental preparatory step, along with creating policies, acquiring necessary tools, and performing risk assessments.

Question 25: A network technician is troubleshooting a connectivity issue and suspects a routing problem. On a Cisco router, which command would be used to display the table that the router uses to determine the best path to a destination network?

show ip route (Correct answer)
show interfaces
show arp
show mac address-table

Correct answer: show ip route

The `show ip route` command on a Cisco IOS device is used to display the IP routing table. This table contains a list of all known networks, the administrative distance and metric for those routes, and the next-hop IP address or exit interface used to reach them. It is the primary tool for verifying and troubleshooting a router's decision-making process.

Question 26: A user reports an intermittent network connection. A technician inspects the user's patch cable and notices that the small plastic tab on the RJ45 connector is broken. Which of the following is the most likely consequence of this physical defect?

The connector will revert to the T568A wiring standard automatically.
The cable will suffer from increased crosstalk.
The cable will be unable to negotiate Gigabit speeds.
The connector will not seat securely in the port, leading to a loose connection. (Correct answer)

Correct answer: The connector will not seat securely in the port, leading to a loose connection.

The plastic tab on an RJ45 connector is a locking mechanism designed to hold the plug securely in the jack or port. If this tab is broken, the connector can easily become loose or partially unplugged with slight movement, causing an unreliable, intermittent physical connection.

Question 27: Which tool would a technician use to test whether a specific TCP port (e.g., port 443) is open on a remote server?

telnet or Netcat (nc) (Correct answer)
ipconfig
ping
traceroute

Correct answer: telnet or Netcat (nc)

Telnet or Netcat can attempt a TCP connection to a specific port, confirming whether that port is open and accepting connections.

Question 28: Which of the following options are used in standard access lists?

Destination address and subnet mask
Source address and subnet mask
Destination address and wildcard mask
Source address and wildcard mask (Correct answer)

Correct answer: Source address and wildcard mask

Standard access lists (ACLs) in network devices, such as Cisco routers, filter traffic based solely on the source IP address of the packets. They use a wildcard mask in conjunction with the source IP address to define a range of IP addresses that the ACL rule should match. The wildcard mask specifies which bits of the IP address must match exactly and which bits can be ignored, providing flexibility in defining address ranges.

Question 29: Which file transfer protocol uses TCP port 21 for control and TCP port 20 for data transfer in active mode?

SFTP
FTP (Correct answer)
SCP
TFTP

Correct answer: FTP

FTP (File Transfer Protocol) uses port 21 for the control connection and port 20 for the data connection in active mode.

Question 30: What is the dotted-decimal subnet mask for the /20 prefix length?

255.255.248.0
255.255.240.0 (Correct answer)
255.255.224.0
255.255.252.0

Correct answer: 255.255.240.0

A /20 mask has 20 ones: the first two octets are 255.255, and the third octet has 4 ones (11110000 = 240), giving 255.255.240.0.

Question 31: When using traceroute, what does it mean if several consecutive hops show '* * *' (asterisks)?

The packet reached the destination
The hops are using IPv6 only
The route is optimized for speed
Those routers are not responding to TTL-expired probes, often due to firewall rules (Correct answer)

Correct answer: Those routers are not responding to TTL-expired probes, often due to firewall rules

Asterisks in traceroute output indicate that routers at those hops are not sending TTL-exceeded ICMP messages back, typically due to filtering.

Question 32: Which Windows feature controls whether applications can make changes to the operating system?

User Account Control (UAC) (Correct answer)
Windows Firewall
BitLocker
Windows Defender

Correct answer: User Account Control (UAC)

UAC prompts for confirmation before allowing applications to make changes requiring elevated privileges.

Question 33: A user's computer is running unusually slow, and they are seeing frequent, unwanted pop-up advertisements. A support technician suspects a malware infection. What is the most appropriate FIRST action to take?

Check for and install the latest operating system security patches.
Disconnect the computer from the network to prevent potential spread.
Reinstall the operating system to ensure the malware is completely removed.
Update the antivirus definitions and perform a full system scan. (Correct answer)

Correct answer: Update the antivirus definitions and perform a full system scan.

The symptoms are classic indicators of a malware infection. The standard and most effective first step is to update the antivirus or antimalware software to ensure it can recognize the latest threats and then initiate a full system scan to detect and quarantine the malicious software.

Question 34: An accountant discovers that a financial report file has been modified, and the totals no longer match the source data. A checksum analysis confirms the file has changed since it was last saved. Which core security principle has been violated?

Availability
Confidentiality
Non-repudiation
Integrity (Correct answer)

Correct answer: Integrity

Integrity is the principle that ensures data has not been altered or tampered with in an unauthorized manner. The checksum mismatch is a direct indication that the file's integrity has been compromised.

Question 35: A company has just recovered from a major data breach. The management team holds a meeting with the IT and security staff to review the incident timeline, discuss what went well, identify weaknesses in the response, and update the incident response plan. In which phase of the incident handling process does this activity occur?

Post-Incident Activity (Lessons Learned) (Correct answer)
Recovery
Preparation
Containment

Correct answer: Post-Incident Activity (Lessons Learned)

The Post-Incident Activity, or Lessons Learned, phase is a critical final step where the team analyzes the incident and the response to it. The goal is to improve security controls and the incident handling process itself to prevent or better handle future incidents.

Question 36: A support technician is troubleshooting a user's connectivity issue. The user's computer is connected to the wall jack with a new patch cable, but the network interface card (NIC) link light is off. The technician tests the cable with a basic cable tester, which shows a 'miswire' fault. What is the most likely cause of the problem?

The cable is an STP cable when a UTP cable is required.
There is excessive electromagnetic interference (EMI) near the cable run.
The RJ45 connectors on the ends of the cable are terminated using different wiring standards (e.g., T568A on one end and T568B on the other). (Correct answer)
The cable is too long, exceeding the maximum length for Ethernet.

Correct answer: The RJ45 connectors on the ends of the cable are terminated using different wiring standards (e.g., T568A on one end and T568B on the other).

When a straight-through Ethernet cable is terminated with T568A on one end and T568B on the other, it creates a crossover cable. While modern devices with Auto MDI-X can often compensate, this miswiring is a common error that a cable tester would identify. It would prevent a link on older devices or if Auto MDI-X is disabled. The other options are less likely to be reported as a simple 'miswire'.

Question 37: What is the valid host range for the network 172.16.0.0/16?

172.16.0.0 to 172.16.255.255
172.16.0.1 to 172.16.255.254 (Correct answer)
172.0.0.1 to 172.255.255.254
172.16.1.0 to 172.16.254.255

Correct answer: 172.16.0.1 to 172.16.255.254

For 172.16.0.0/16, the network address is 172.16.0.0 and broadcast is 172.16.255.255, so valid hosts range from 172.16.0.1 to 172.16.255.254.

Question 38: Which protocol automatically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to network clients?

DHCP (Correct answer)
DNS
NAT
ARP

Correct answer: DHCP

DHCP (Dynamic Host Configuration Protocol) dynamically assigns IP configuration parameters to network hosts from a central server.

Question 39: No matter how it's configured, a single switch port is considered what?

A separate unicast domain
A separate multicast domain
A separate collision domain (Correct answer)
A separate broadcast domain

Correct answer: A separate collision domain

In modern Ethernet networks, each individual port on a switch operates in full-duplex mode, meaning it can send and receive data simultaneously without collisions. Consequently, each switch port effectively creates its own separate collision domain. This design significantly improves network performance compared to older hub-based networks where all devices shared a single collision domain, leading to potential data collisions.

Question 40: At which TCP/IP model layer does HTTP operate?

Internet
Network Access
Application (Correct answer)
Transport

Correct answer: Application

HTTP operates at the Application layer, which combines OSI layers 5-7.

Question 41: How many subnets can be created by borrowing 3 bits from the host portion of a subnet?

6
16
4
8 (Correct answer)

Correct answer: 8

Borrowing 3 bits creates 2^3=8 subnets, as each additional borrowed bit doubles the number of available subnets.

Question 42: Which of the following statements accurately describes a key difference in how IPv4 and IPv6 handle network-wide messages?

IPv6 relies exclusively on broadcast messages for address resolution.
IPv4 uses broadcast messages, while IPv6 has eliminated broadcast in favor of multicast and anycast. (Correct answer)
Both IPv4 and IPv6 use identical broadcast mechanisms for all network-wide communication.
IPv4 has no mechanism for sending a message to all hosts on a subnet.

Correct answer: IPv4 uses broadcast messages, while IPv6 has eliminated broadcast in favor of multicast and anycast.

IPv4 uses broadcast messages to send a packet to all devices on a local network segment. This can be inefficient. IPv6 eliminates the concept of broadcast and instead uses more efficient multicast messages to communicate with specific groups of devices (e.g., all routers or all nodes on a link). IPv6 also introduces anycast addressing.

Question 43: Which command displays the routing table on a Cisco router?

show ip route (Correct answer)
show mac-address-table
show interfaces
show arp

Correct answer: show ip route

The 'show ip route' command displays the complete IP routing table including connected, static, and dynamic routes.

Question 44: Which of the following IP addresses falls within the Class B address range?

10.10.10.10
172.16.1.1 (Correct answer)
192.168.1.1
224.0.0.1

Correct answer: 172.16.1.1

Class B addresses range from 128.0.0.0 to 191.255.255.255; 172.16.1.1 falls within this range.

Question 45: A support technician is investigating a connectivity issue. The user's network cable is properly connected, and the link light on the network interface card (NIC) is green. However, the user cannot access any network resources. Using a bottom-up troubleshooting approach based on the OSI model, what is the NEXT layer the technician should investigate?

Transport Layer
Physical Layer
Network Layer
Data Link Layer (Correct answer)

Correct answer: Data Link Layer

The technician has already verified the Physical Layer (Layer 1) by checking the cable and the link light. The next step in a bottom-up troubleshooting methodology is to investigate the Data Link Layer (Layer 2). This would involve checking for issues like MAC address problems, VLAN configuration, or switch port status.

Question 46: What does the acronym VLAN stand for, and what is its primary purpose?

Virtual Link Aggregation Network — bonds multiple interfaces
Verified LAN — authenticates all connected devices
Variable Length Address Network — supports CIDR addressing
Virtual LAN — logically segments a physical network into separate broadcast domains (Correct answer)

Correct answer: Virtual LAN — logically segments a physical network into separate broadcast domains

A VLAN (Virtual LAN) logically divides a physical switch into multiple isolated broadcast domains, improving security and traffic management.

Cisco Certified Support Technician Networking (CCST)

The CCST Networking exam validates foundational knowledge of networking concepts including the OSI model, IP addressing, routing and switching, network security, and troubleshooting.

Questions

50 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cisco.com — Test delivery, eligibility, fees, exam format, retake policy, score release, time limit · verified Oct 2026
certiport.pearsonvue.com — Score validity · verified Oct 2026