Cisco Certified Support Technician Networking (CCST) — Questions and Answers

Question 1: Which of the following statements accurately describes a key difference in how IPv4 and IPv6 handle network-wide messages?

IPv4 has no mechanism for sending a message to all hosts on a subnet.
IPv4 uses broadcast messages, while IPv6 has eliminated broadcast in favor of multicast and anycast. (Correct answer)
IPv6 relies exclusively on broadcast messages for address resolution.
Both IPv4 and IPv6 use identical broadcast mechanisms for all network-wide communication.

Correct answer: IPv4 uses broadcast messages, while IPv6 has eliminated broadcast in favor of multicast and anycast.

IPv4 uses broadcast messages to send a packet to all devices on a local network segment. This can be inefficient. IPv6 eliminates the concept of broadcast and instead uses more efficient multicast messages to communicate with specific groups of devices (e.g., all routers or all nodes on a link). IPv6 also introduces anycast addressing.

Question 2: Which disaster recovery metric defines the maximum acceptable time a system can be unavailable?

SLA (Service Level Agreement)
RPO (Recovery Point Objective)
RTO (Recovery Time Objective) (Correct answer)
MTBF (Mean Time Between Failures)

Correct answer: RTO (Recovery Time Objective)

RTO defines the maximum acceptable downtime, directly supporting availability.

Question 3: Which command-line tool sends ICMP echo requests to test basic connectivity between two hosts?

traceroute
nslookup
netstat
ping (Correct answer)

Correct answer: ping

The ping command sends ICMP echo requests to a destination host to verify basic IP connectivity.

Question 4: What is the function of a proxy server on a corporate network?

Connects two different Layer 3 networks
Assigns IP addresses to client devices
Acts as an intermediary for client requests, providing caching, filtering, and access control (Correct answer)
Provides encrypted tunnels between branch offices

Correct answer: Acts as an intermediary for client requests, providing caching, filtering, and access control

A proxy server sits between clients and the internet, forwarding requests on behalf of clients while providing caching, content filtering, and access logging.

Question 5: Which command flushes the local DNS resolver cache in Windows to force fresh DNS lookups?

arp -d *
nslookup flush
netsh flush dns
ipconfig /flushdns (Correct answer)

Correct answer: ipconfig /flushdns

ipconfig /flushdns clears the Windows DNS resolver cache, forcing the system to perform new DNS queries for all hostnames.

Question 6: What type of IPv6 address begins with fe80::/10 and is used for single-segment communication?

Anycast
Link-local (Correct answer)
Global unicast
Multicast

Correct answer: Link-local

Link-local addresses (fe80::/10) are auto-assigned and limited to the local network segment, not routable beyond it.

Question 7: What is the purpose of the IPv6 loopback address ::1?

To communicate with the default gateway
To test the local TCP/IP stack without sending traffic on the network (Correct answer)
To connect to external DNS servers
To reach all devices on the subnet

Correct answer: To test the local TCP/IP stack without sending traffic on the network

::1 (equivalent to 127.0.0.1) tests the local device's TCP/IP stack without generating network traffic.

Question 8: What is a compensating control in vulnerability management?

An alternative security measure when a vulnerability cannot be directly remediated (Correct answer)
A financial reserve for incidents
A duplicate scanner
A backup vulnerability database

Correct answer: An alternative security measure when a vulnerability cannot be directly remediated

Compensating controls reduce risk when direct patching is not feasible, such as network segmentation for legacy systems.

Question 9: A technician configures a switch port to carry traffic for multiple VLANs between switches. What type of port configuration is this?

Mirror port
Native port
Trunk port (Correct answer)
Access port

Correct answer: Trunk port

A trunk port carries tagged traffic for multiple VLANs between switches or between a switch and a router using IEEE 802.1Q tagging.

Question 10: What is a fiber optic patch panel used for?

To convert fiber to electrical signals
To amplify optical signals
To split a single fiber into multiple outputs
To provide a centralized termination point for organized connections and easy management (Correct answer)

Correct answer: To provide a centralized termination point for organized connections and easy management

Patch panels provide organized termination where permanent runs connect on one side and patch cables to equipment on the other.

Question 11: Software applications that allow remote access to command-line interfaces on network devices.

Latency, delay
Database
Terminal emulators (Correct answer)
Port forwarding

Correct answer: Terminal emulators

Terminal emulators are software applications that provide remote access to the command-line interface (CLI) of network devices like routers, switches, and servers. They typically use protocols such as SSH (Secure Shell) or Telnet to establish a connection. These tools enable network administrators to configure, manage, and troubleshoot devices from a remote workstation, making them essential for network operations.

Question 12: Which Windows command displays the local machine's IP address, subnet mask, and default gateway?

ipconfig (Correct answer)
route
netstat
ifconfig

Correct answer: ipconfig

ipconfig is the Windows command that displays all current TCP/IP network configuration values for each adapter.

Question 13: A company needs 5 subnets with at least 25 hosts each. Which subnet mask is most appropriate?

/29
/28
/27 (Correct answer)
/26

Correct answer: /27

A /27 subnet provides 30 usable host addresses (2^5-2), which meets the requirement of at least 25 hosts per subnet.

Question 14: What is a tabletop exercise and why is it valuable?

A discussion-based exercise where team members walk through a hypothetical incident to test plans and identify gaps (Correct answer)
A physical evacuation drill
A type of penetration test
A compliance audit by external assessors

Correct answer: A discussion-based exercise where team members walk through a hypothetical incident to test plans and identify gaps

Tabletop exercises are low-cost simulations that test decision-making and identify weaknesses in the IR plan.

Question 15: What is the network address for the host 192.168.10.35/28?

192.168.10.16
192.168.10.48
192.168.10.32 (Correct answer)
192.168.10.0

Correct answer: 192.168.10.32

A /28 mask (255.255.255.240) has a block size of 16; the subnets are .0, .16, .32, .48 — host .35 falls in the .32 subnet.

Question 16: Why is maintaining chain of custody important during incident handling?

To prevent employees from learning about the incident
To ensure digital evidence is properly documented, preserved, and admissible in legal proceedings (Correct answer)
To reduce cost
To speed up response

Correct answer: To ensure digital evidence is properly documented, preserved, and admissible in legal proceedings

Chain of custody documents every handler of evidence, ensuring integrity and court admissibility.

Question 17: How many usable host addresses are available in a /30 subnet?

4
6
8
2 (Correct answer)

Correct answer: 2

A /30 subnet has 2 host bits (32-30=2), giving 2^2=4 total addresses; subtracting network and broadcast leaves only 2 usable hosts.

Question 18: Use light to transmit data and offer high-speed, long-distance connectivity.

Coaxial cables
Mac address tables
Patch cables
Fiber optic cables (Correct answer)

Correct answer: Fiber optic cables

Fiber optic cables transmit data using pulses of light through thin strands of glass or plastic. This method allows for significantly higher bandwidth and much longer transmission distances compared to traditional copper cables, as light signals experience minimal attenuation. They are the preferred choice for high-speed backbone connections, long-haul data transmission, and environments requiring immunity to electromagnetic interference.

Question 19: How does SLAAC in IPv6 differ from DHCP in IPv4?

No functional difference
SLAAC allows devices to self-configure addresses using router-advertised prefixes without a central server (Correct answer)
SLAAC requires a central server
SLAAC only works on wireless

Correct answer: SLAAC allows devices to self-configure addresses using router-advertised prefixes without a central server

SLAAC lets devices auto-configure by combining router-advertised prefixes with self-generated interface IDs, no DHCP server needed.

Question 20: Why is vulnerability scanning alone insufficient for a complete security assessment?

Scanners are always inaccurate
Scanners only work on Linux
Automated scans cannot test business logic, chain vulnerabilities, or assess real-world exploitability (Correct answer)
Scanning is too expensive

Correct answer: Automated scans cannot test business logic, chain vulnerabilities, or assess real-world exploitability

Scans cannot understand business logic, demonstrate attack chains, or discover zero-day vulnerabilities.

Question 21: Which fiber optic cable type uses a larger core and is for shorter distances?

Coaxial cable
Shielded twisted pair
Single-mode fiber
Multimode fiber (Correct answer)

Correct answer: Multimode fiber

Multimode fiber has a larger core (50/62.5 micrometers) for shorter distances up to ~550m for 10G.

Question 22: What does CIDR stand for in networking?

Classless Inter-Domain Routing (Correct answer)
Common Internet Data Routing
Cisco Inter-Domain Routing
Classful Internet Domain Routing

Correct answer: Classless Inter-Domain Routing

CIDR stands for Classless Inter-Domain Routing, a method for allocating IP addresses and routing that replaced the older classful network system.

Question 23: A host has an IP address of 169.254.x.x. What does this indicate?

The host is using a static IP
DHCP failed and the host assigned itself an APIPA address (Correct answer)
DHCP assignment succeeded
The host is on a private Class A network

Correct answer: DHCP failed and the host assigned itself an APIPA address

169.254.0.0/16 is the APIPA (Automatic Private IP Addressing) range, assigned automatically when a host cannot reach a DHCP server.

Question 24: Host A receives a frame and discards it after determining it is corrupt. Which OSI layer checks frames for errors?

Network
Application
Data-link (Correct answer)
Physical

Correct answer: Data-link

The Data-link layer (Layer 2) of the OSI model is responsible for detecting and often correcting errors within frames as they are transmitted across a physical link. It uses mechanisms like Cyclic Redundancy Check (CRC) to ensure data integrity. If a frame is found to be corrupt upon reception, the Data-link layer will discard it, preventing damaged data from being passed up to higher layers.

Question 25: Which protocol provides a way for a device to discover its IP address automatically when no DHCP server is available, resulting in an address in the 169.254.0.0/16 range?

RARP
SLAAC
APIPA (Correct answer)
BOOTP

Correct answer: APIPA

APIPA (Automatic Private IP Addressing) allows a host to self-assign an address from 169.254.0.0/16 when no DHCP server responds.

Question 26: Which attack sends a specially crafted packet larger than the maximum allowed size?

ARP spoofing
DNS poisoning
Ping of Death (Correct answer)
SYN flood

Correct answer: Ping of Death

A Ping of Death sends an oversized ICMP packet that causes a buffer overflow during reassembly.

Question 27: A support technician is troubleshooting a user's connectivity issue. The user's computer is connected to the wall jack with a new patch cable, but the network interface card (NIC) link light is off. The technician tests the cable with a basic cable tester, which shows a 'miswire' fault. What is the most likely cause of the problem?

The cable is an STP cable when a UTP cable is required.
The cable is too long, exceeding the maximum length for Ethernet.
There is excessive electromagnetic interference (EMI) near the cable run.
The RJ45 connectors on the ends of the cable are terminated using different wiring standards (e.g., T568A on one end and T568B on the other). (Correct answer)

Correct answer: The RJ45 connectors on the ends of the cable are terminated using different wiring standards (e.g., T568A on one end and T568B on the other).

When a straight-through Ethernet cable is terminated with T568A on one end and T568B on the other, it creates a crossover cable. While modern devices with Auto MDI-X can often compensate, this miswiring is a common error that a cable tester would identify. It would prevent a link on older devices or if Auto MDI-X is disabled. The other options are less likely to be reported as a simple 'miswire'.

Question 28: Which layer of the TCP/IP model is responsible for logical addressing and determining the best path for data to travel across the network?

Transport
Application
Network Access
Internet (Correct answer)

Correct answer: Internet

The Internet layer of the TCP/IP model is responsible for logical addressing (using IP addresses) and routing, which involves selecting the best path for data to travel from the source to the destination network. This layer directly corresponds to the Network Layer of the OSI model.

Question 29: Which tool provides active TCP/UDP connection information, listening ports, and routing tables on a local system?

traceroute
netstat (Correct answer)
dig
whois

Correct answer: netstat

netstat (network statistics) displays active connections, open ports, and routing table information on the local host.

Question 30: What is the primary purpose of a default gateway in a network?

To forward traffic destined for networks outside the local subnet (Correct answer)
To provide DNS resolution services
To filter incoming traffic based on MAC addresses
To assign IP addresses to devices

Correct answer: To forward traffic destined for networks outside the local subnet

A default gateway forwards packets destined for networks not on the local subnet.

Question 31: Which OSI layer provides end-to-end flow control and reliable delivery?

Network
Physical
Transport (Correct answer)
Data Link

Correct answer: Transport

The Transport Layer (Layer 4) provides end-to-end flow control, error recovery, and reliable delivery via TCP.

Question 32: What is the difference between TIA-568A and TIA-568B wiring standards?

568A is residential only; 568B is commercial only
They specify different pin-to-wire color assignments for RJ-45, with 568B more common commercially (Correct answer)
568A uses fiber; 568B uses copper
568A supports faster speeds

Correct answer: They specify different pin-to-wire color assignments for RJ-45, with 568B more common commercially

Both define different color code arrangements for RJ-45 connectors; 568B is more widely used commercially.

Question 33: A technician needs to transfer a router's IOS image using a lightweight protocol that requires no authentication and uses UDP. Which protocol should they use?

SFTP
SCP
FTP
TFTP (Correct answer)

Correct answer: TFTP

TFTP (Trivial File Transfer Protocol) uses UDP port 69 and provides simple, unauthenticated file transfers, commonly used for IOS images and config files.

Question 34: What is the purpose of a media converter in a network?

To filter traffic by protocol
To convert signals between different media types such as copper to fiber optic (Correct answer)
To increase port count
To compress data

Correct answer: To convert signals between different media types such as copper to fiber optic

Media converters convert between different physical media, most commonly copper Ethernet to fiber optic.

Question 35: A user reports an intermittent network connection. A technician inspects the user's patch cable and notices that the small plastic tab on the RJ45 connector is broken. Which of the following is the most likely consequence of this physical defect?

The connector will not seat securely in the port, leading to a loose connection. (Correct answer)
The connector will revert to the T568A wiring standard automatically.
The cable will be unable to negotiate Gigabit speeds.
The cable will suffer from increased crosstalk.

Correct answer: The connector will not seat securely in the port, leading to a loose connection.

The plastic tab on an RJ45 connector is a locking mechanism designed to hold the plug securely in the jack or port. If this tab is broken, the connector can easily become loose or partially unplugged with slight movement, causing an unreliable, intermittent physical connection.

Question 36: Which type of cable consists of pairs of insulated copper wires twisted together to help protect against signal interference from adjacent pairs?

Fiber optic cable
Serial cable
Coaxial cable
Twisted-pair cable (Correct answer)

Correct answer: Twisted-pair cable

Twisted-pair cable, used for Ethernet and telephone communications, has two conductors of a single circuit twisted together. This design helps to cancel out electromagnetic interference (EMI) from external sources and reduce crosstalk between neighboring pairs.

Question 37: What should a lessons learned meeting focus on after an incident?

Planning the annual budget
Training on basic computer skills
Analyzing what happened, what worked, what could improve, and how to prevent recurrence (Correct answer)
Assigning blame

Correct answer: Analyzing what happened, what worked, what could improve, and how to prevent recurrence

Post-incident review evaluates response effectiveness and produces actionable improvements.

Question 38: A technician is auditing the security of a wireless network and discovers that Wi-Fi Protected Setup (WPS) is enabled. Why is this feature generally considered a significant security risk on WPA/WPA2 networks?

It requires the SSID to be broadcast, preventing the use of a hidden network.
It limits the password length to 8 characters.
It disables AES encryption and forces the use of the weaker TKIP protocol.
The WPS PIN is susceptible to brute-force attacks, which can reveal the WPA2 pre-shared key. (Correct answer)

Correct answer: The WPS PIN is susceptible to brute-force attacks, which can reveal the WPA2 pre-shared key.

Wi-Fi Protected Setup (WPS) was designed for ease of use but introduced a major vulnerability. The PIN-based authentication method can be brute-forced relatively quickly because the validation process happens in two halves, drastically reducing the number of combinations an attacker needs to try. A successful attack reveals the WPS PIN, which can then be used to retrieve the network's main WPA/WPA2 pre-shared key.

Question 39: What does a Layer 2 switch use to make forwarding decisions?

Routing protocols
Port numbers
IP addresses
MAC addresses (Correct answer)

Correct answer: MAC addresses

Layer 2 switches use MAC addresses stored in a CAM table to forward frames to the correct port.

Question 40: What is multiplexing at the Transport Layer?

Splitting data across multiple cables
Combining VLANs onto a trunk
Enabling multiple applications to share a network connection using port numbers (Correct answer)
Sending data to multiple destinations

Correct answer: Enabling multiple applications to share a network connection using port numbers

Port numbers let multiple applications simultaneously use the same network connection.

Question 41: A company has just recovered from a major data breach. The management team holds a meeting with the IT and security staff to review the incident timeline, discuss what went well, identify weaknesses in the response, and update the incident response plan. In which phase of the incident handling process does this activity occur?

Post-Incident Activity (Lessons Learned) (Correct answer)
Preparation
Containment
Recovery

Correct answer: Post-Incident Activity (Lessons Learned)

The Post-Incident Activity, or Lessons Learned, phase is a critical final step where the team analyzes the incident and the response to it. The goal is to improve security controls and the incident handling process itself to prevent or better handle future incidents.

Question 42: A technician pings a remote host and receives 'Destination Host Unreachable'. What does this response mean?

The remote host is powered off
The TTL expired before reaching the destination
The remote host's firewall blocked the ping
A router along the path has no route to the destination (Correct answer)

Correct answer: A router along the path has no route to the destination

'Destination Host Unreachable' is an ICMP error from an intermediate router indicating it has no route to the specified destination.

Question 43: Which command displays the ARP cache, showing the mapping of IP addresses to MAC addresses?

arp -a (Correct answer)
ping -a
netstat -r
ipconfig /all

Correct answer: arp -a

The 'arp -a' command displays all current entries in the ARP cache, listing IP-to-MAC address mappings.

Question 44: A network technician is troubleshooting a connectivity issue and suspects a routing problem. On a Cisco router, which command would be used to display the table that the router uses to determine the best path to a destination network?

show mac address-table
show ip route (Correct answer)
show interfaces
show arp

Correct answer: show ip route

The `show ip route` command on a Cisco IOS device is used to display the IP routing table. This table contains a list of all known networks, the administrative distance and metric for those routes, and the next-hop IP address or exit interface used to reach them. It is the primary tool for verifying and troubleshooting a router's decision-making process.

Question 45: A PC with IP address 192.168.1.10 needs to send data to a server with IP address 192.168.1.50 on the same local Ethernet network. The PC does not have the server's MAC address in its cache. Which protocol will the PC use to find the MAC address of the server?

DNS
ARP (Correct answer)
ICMP
DHCP

Correct answer: ARP

The Address Resolution Protocol (ARP) is used to map a Layer 3 (IP) address to a Layer 2 (MAC) address on a local network. The PC will send out an ARP request broadcast on the local network asking for the MAC address associated with 192.168.1.50. The server will respond with an ARP reply containing its MAC address, allowing the PC to properly address the Ethernet frame.

Question 46: Why is it important to manage cables through management hardware?

To aid in the end-to-end tracing of cables
Because engineers generally like neatness
To prevent cables from hanging off their connectors (Correct answer)
Because OSHA regulations require well-organized cables

Correct answer: To prevent cables from hanging off their connectors

Cable management hardware, such as cable trays, ties, and raceways, is vital for supporting and organizing network cables. Its primary purpose is to prevent strain on cable connectors and ports, which can lead to intermittent connectivity issues or physical damage to equipment. Proper cable management ensures the longevity of network components and maintains reliable network performance by keeping cables secure and orderly.

Cisco Certified Support Technician Networking (CCST)

The CCST Networking exam validates foundational knowledge of networking concepts including the OSI model, IP addressing, routing and switching, network security, and troubleshooting.

Questions

50 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds