Cisco Certified Support Technician Networking (CCST) — Questions and Answers

Question 1: A network for connecting personal devices, like Bluetooth.

Pat (port Address Translation)
Wan (wide Area Network)
PAN (Personal Area Network) (Correct answer)
Can (campus Area Network)

Correct answer: PAN (Personal Area Network)

A Personal Area Network (PAN) is a computer network used for communication among various personal devices within a very short range, typically a few meters. Technologies like Bluetooth, NFC, and sometimes USB are commonly used to establish PANs. This allows devices such as smartphones, tablets, and wearable technology to exchange data and synchronize information directly with each other.

Question 2: A network switch receives an Ethernet frame on its Fa0/1 port. The destination MAC address of the frame is unknown to the switch. Which action will the switch take?

Forward the frame out all ports except for Fa0/1 (Correct answer)
Hold the frame in a buffer until the destination MAC is learned
Send an ARP request to the default gateway
Drop the frame immediately

Correct answer: Forward the frame out all ports except for Fa0/1

When a switch receives a frame with a destination MAC address that is not in its MAC address table, its default behavior is to flood the frame. This means it forwards the frame out of every port in the same VLAN except for the port on which it was received, ensuring the frame reaches its destination if it exists on the network. The switch also adds the source MAC address and its corresponding port (Fa0/1) to its MAC address table.

Question 3: A network technician is troubleshooting an issue where a user can ping the IP address of a web server but cannot open the website in their browser. At which layer of the OSI model is the problem MOST likely occurring?

Network Layer
Transport Layer
Data Link Layer
Application Layer (Correct answer)

Correct answer: Application Layer

The ability to successfully ping the server's IP address indicates that connectivity exists at the Network Layer (Layer 3). The problem lies with the web browsing service itself, which operates at the Application Layer (Layer 7). Protocols like HTTP or HTTPS are used for web browsing, and an issue with the server's web service or a firewall blocking these specific protocols would cause this symptom.

Question 4: A company needs 5 subnets with at least 25 hosts each. Which subnet mask is most appropriate?

/28
/29
/26
/27 (Correct answer)

Correct answer: /27

A /27 subnet provides 30 usable host addresses (2^5-2), which meets the requirement of at least 25 hosts per subnet.

Question 5: What is the administrative distance of a directly connected route?

5
0 (Correct answer)
1
110

Correct answer: 0

Directly connected routes have an administrative distance of 0, the most trustworthy value.

Question 6: A technician pings a remote host and receives 'Destination Host Unreachable'. What does this response mean?

A router along the path has no route to the destination (Correct answer)
The remote host is powered off
The remote host's firewall blocked the ping
The TTL expired before reaching the destination

Correct answer: A router along the path has no route to the destination

'Destination Host Unreachable' is an ICMP error from an intermediate router indicating it has no route to the specified destination.

Question 7: Which OSI layer provides end-to-end flow control and reliable delivery?

Network
Physical
Data Link
Transport (Correct answer)

Correct answer: Transport

The Transport Layer (Layer 4) provides end-to-end flow control, error recovery, and reliable delivery via TCP.

Question 8: Which RFC defines the private IPv4 address ranges used in internal networks?

RFC 1519
RFC 2460
RFC 1918 (Correct answer)
RFC 793

Correct answer: RFC 1918

RFC 1918 defines three private IPv4 address ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, which are not routable on the public Internet.

Question 9: A network technician is troubleshooting a connectivity issue and suspects a routing problem. On a Cisco router, which command would be used to display the table that the router uses to determine the best path to a destination network?

show interfaces
show arp
show ip route (Correct answer)
show mac address-table

Correct answer: show ip route

The `show ip route` command on a Cisco IOS device is used to display the IP routing table. This table contains a list of all known networks, the administrative distance and metric for those routes, and the next-hop IP address or exit interface used to reach them. It is the primary tool for verifying and troubleshooting a router's decision-making process.

Question 10: Which fiber optic cable type uses a larger core and is for shorter distances?

Multimode fiber (Correct answer)
Single-mode fiber
Shielded twisted pair
Coaxial cable

Correct answer: Multimode fiber

Multimode fiber has a larger core (50/62.5 micrometers) for shorter distances up to ~550m for 10G.

Question 11: What is a host-based firewall and how does it differ from a network firewall?

Blocks external threats while network blocks internal
Requires no configuration while network needs manual setup
Runs on individual endpoints filtering per-device traffic while a network firewall protects the perimeter (Correct answer)
Filters wireless only while network firewall filters wired

Correct answer: Runs on individual endpoints filtering per-device traffic while a network firewall protects the perimeter

Host-based firewalls control traffic per-device; network firewalls protect the network boundary.

Question 12: A user on a public Wi-Fi network discovers that their online banking credentials have been compromised. The user suspects an attacker intercepted and relayed their communication with the bank's website without their knowledge. Which type of attack most likely occurred?

MAC spoofing
Man-in-the-Middle (MITM) attack (Correct answer)
VLAN hopping
Distributed Denial of Service (DDoS) attack

Correct answer: Man-in-the-Middle (MITM) attack

A Man-in-the-Middle (MITM) attack occurs when an attacker secretly intercepts and potentially alters the communication between two parties who believe they are directly communicating with each other. This is a common threat on unsecured public Wi-Fi networks where an attacker can position themselves between the user and the router.

Question 13: Which command can a technician use on a Cisco IOS device to verify current active connections and listening TCP ports?

show ip sockets (Correct answer)
show running-config
show tcp brief
netstat -an

Correct answer: show ip sockets

'show ip sockets' on Cisco IOS displays the active TCP and UDP socket connections on the device.

Question 14: Which of the following activities is a critical component of the 'Preparation' phase of the security incident handling process, according to the NIST framework?

Restoring data from backups after a ransomware attack.
Analyzing system logs to determine the scope of a breach.
Establishing and training a Computer Security Incident Response Team (CSIRT). (Correct answer)
Disconnecting an infected machine from the network.

Correct answer: Establishing and training a Computer Security Incident Response Team (CSIRT).

The 'Preparation' phase involves all the proactive steps taken before an incident occurs to ensure the organization is ready to respond. Establishing and training a CSIRT is a fundamental preparatory step, along with creating policies, acquiring necessary tools, and performing risk assessments.

Question 15: Which of the following IP addresses falls within the Class B address range?

224.0.0.1
192.168.1.1
172.16.1.1 (Correct answer)
10.10.10.10

Correct answer: 172.16.1.1

Class B addresses range from 128.0.0.0 to 191.255.255.255; 172.16.1.1 falls within this range.

Question 16: A company's web server crashes and customers cannot access the online store. Which CIA principle is violated?

Non-repudiation
Confidentiality
Integrity
Availability (Correct answer)

Correct answer: Availability

Availability ensures systems are accessible when needed. A server crash preventing access violates this.

Question 17: At which TCP/IP model layer does HTTP operate?

Application (Correct answer)
Network Access
Internet
Transport

Correct answer: Application

HTTP operates at the Application layer, which combines OSI layers 5-7.

Question 18: What is the purpose of the ARP protocol in networking?

To translate domain names to IP addresses
To resolve IP addresses to MAC addresses (Correct answer)
To encrypt data during transmission
To assign IP addresses dynamically

Correct answer: To resolve IP addresses to MAC addresses

ARP resolves a known IP address to an unknown MAC address on the local network segment for Layer 2 frame delivery.

Question 19: What distinguishes a crossover cable from a straight-through cable?

Crossover cables are longer
Crossover cables swap transmit and receive pairs at one end for connecting similar devices (Correct answer)
Crossover cables use different connectors
Crossover cables only work with fiber

Correct answer: Crossover cables swap transmit and receive pairs at one end for connecting similar devices

A crossover cable reverses TX/RX pairs to enable direct communication between like devices.

Question 20: A company enforces a policy where employees use standard user accounts for daily tasks. When they need to install new software, they are prompted to enter administrator credentials. This practice is a direct implementation of which security principle?

Defense in Depth
Security through Obscurity
Data Encryption
Principle of Least Privilege (Correct answer)

Correct answer: Principle of Least Privilege

The Principle of Least Privilege (PoLP) states that a user or process should only have the minimum level of access (privileges) necessary to perform its required functions. By using a standard account for normal work, the potential damage from a compromised account is significantly limited.

Question 21: Which of the following EXEC commands will reset LLDP traffic error counters?

clear lldp table
clear table lldp
clear lldp all
clear lldp counters (Correct answer)

Correct answer: clear lldp counters

The `clear lldp counters` command is used on network devices to reset the Link Layer Discovery Protocol (LLDP) traffic error counters to zero. This command is valuable for troubleshooting and monitoring, as it allows an administrator to clear previous error statistics. By resetting the counters, one can obtain fresh data to accurately assess ongoing LLDP-related issues or verify the resolution of past problems.

Question 22: A support technician observes alerts from a SIEM tool indicating multiple failed login attempts on a critical server, followed by a successful login from an unrecognized IP address. Which phase of the incident handling process has just begun?

Containment
Preparation
Detection and Analysis (Correct answer)
Recovery

Correct answer: Detection and Analysis

The 'Detection and Analysis' phase begins when potential signs of an incident are discovered. This involves detecting anomalies (the alerts) and then analyzing them to determine if a security incident has actually occurred, which is the immediate next step for the technician.

Question 23: A network administrator needs subnets from 192.168.5.0/24 that each support exactly 14 usable hosts. Which subnet mask should be used?

/26
/29
/27
/28 (Correct answer)

Correct answer: /28

A /28 subnet has 4 host bits, providing 2^4-2=14 usable host addresses, which exactly meets the requirement.

Question 24: A host has an IP address of 169.254.x.x. What does this indicate?

The host is on a private Class A network
DHCP failed and the host assigned itself an APIPA address (Correct answer)
The host is using a static IP
DHCP assignment succeeded

Correct answer: DHCP failed and the host assigned itself an APIPA address

169.254.0.0/16 is the APIPA (Automatic Private IP Addressing) range, assigned automatically when a host cannot reach a DHCP server.

Question 25: What is the network address for the host 192.168.10.35/28?

192.168.10.32 (Correct answer)
192.168.10.0
192.168.10.48
192.168.10.16

Correct answer: 192.168.10.32

A /28 mask (255.255.255.240) has a block size of 16; the subnets are .0, .16, .32, .48 — host .35 falls in the .32 subnet.

Question 26: No matter how it's configured, a single switch port is considered what?

A separate collision domain (Correct answer)
A separate broadcast domain
A separate unicast domain
A separate multicast domain

Correct answer: A separate collision domain

In modern Ethernet networks, each individual port on a switch operates in full-duplex mode, meaning it can send and receive data simultaneously without collisions. Consequently, each switch port effectively creates its own separate collision domain. This design significantly improves network performance compared to older hub-based networks where all devices shared a single collision domain, leading to potential data collisions.

Question 27: Which tool provides active TCP/UDP connection information, listening ports, and routing tables on a local system?

dig
netstat (Correct answer)
whois
traceroute

Correct answer: netstat

netstat (network statistics) displays active connections, open ports, and routing table information on the local host.

Question 28: A company is transitioning to an IPv6-only internal network but still needs to allow its users to access services on the IPv4 internet. Which technology is specifically designed to facilitate this communication between IPv6 and IPv4 networks?

ARP
NAT64 (Correct answer)
SLAAC
Broadcast

Correct answer: NAT64

NAT64 is a translation mechanism that allows IPv6-only clients to communicate with IPv4-only servers. A NAT64 gateway translates IPv6 packets into IPv4 packets and vice versa, enabling compatibility between the two protocols during the transition period.

Question 29: What is the primary function of the Common Vulnerability Scoring System (CVSS)?

To automatically patch and remediate identified software vulnerabilities.
To define the legal and regulatory compliance requirements for data protection.
To offer a standardized framework for rating the severity of security vulnerabilities. (Correct answer)
To provide a unique identifier (ID number) for each publicly known vulnerability.

Correct answer: To offer a standardized framework for rating the severity of security vulnerabilities.

CVSS is an open industry standard used to convey the severity of a vulnerability. It provides a numerical score (from 0.0 to 10.0) based on a vulnerability's intrinsic characteristics, helping security teams prioritize their response and remediation efforts.

Question 30: Why is cable certification testing important after installation?

To verify installed cabling meets performance standards for intended data rates (Correct answer)
To confirm manufacturer warranty
To measure total cable length used
To check color coding

Correct answer: To verify installed cabling meets performance standards for intended data rates

Certification testing verifies that cabling meets performance specifications (attenuation, crosstalk, return loss) for reliable operation.

Question 31: A network administrator wants to improve security and network efficiency by segmenting a single physical switch into two separate logical networks: one for the 'Sales' department and one for the 'Engineering' department. Devices in one department should not be able to communicate directly with devices in the other at Layer 2. Which technology should be implemented?

Spanning Tree Protocol (STP)
Virtual Local Area Networks (VLANs) (Correct answer)
Port Security
Network Address Translation (NAT)

Correct answer: Virtual Local Area Networks (VLANs)

VLANs allow a network administrator to logically segment a single physical switch into multiple virtual switches. Each VLAN is a separate broadcast domain. This prevents Layer 2 traffic from crossing between the configured VLANs, effectively isolating the 'Sales' and 'Engineering' departments as requested, even though they are connected to the same physical hardware.

Question 32: What is the primary purpose of the management network port?

Carry customer traffic within the local network
Carry customer traffic to destinations outside the local network
Connect to a low-speed out-of-band management network (Correct answer)
Provide access to the device's command-line interface

Correct answer: Connect to a low-speed out-of-band management network

The management network port is primarily used for out-of-band management, meaning it provides a dedicated connection separate from the main data network. This allows administrators to configure, monitor, and troubleshoot the device even if the primary network is experiencing issues, typically via a low-speed, dedicated management network.

Question 33: What is a fiber optic patch panel used for?

To amplify optical signals
To provide a centralized termination point for organized connections and easy management (Correct answer)
To convert fiber to electrical signals
To split a single fiber into multiple outputs

Correct answer: To provide a centralized termination point for organized connections and easy management

Patch panels provide organized termination where permanent runs connect on one side and patch cables to equipment on the other.

Question 34: What happens when a switch receives a frame with a destination MAC address not in its MAC address table?

The frame is sent back to the source
The frame is dropped
The frame is sent to the default gateway
The frame is flooded out all ports except the source port (Correct answer)

Correct answer: The frame is flooded out all ports except the source port

When a switch encounters an unknown destination MAC, it floods the frame out all ports except the ingress port.

Question 35: Which class of IPv4 addresses uses the default subnet mask of 255.255.0.0?

Class B (Correct answer)
Class D
Class C
Class A

Correct answer: Class B

Class B addresses (128.0.0.0–191.255.255.255) use a default subnet mask of 255.255.0.0, providing a /16 prefix.

Question 36: Which protocol automatically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to network clients?

ARP
DNS
DHCP (Correct answer)
NAT

Correct answer: DHCP

DHCP (Dynamic Host Configuration Protocol) dynamically assigns IP configuration parameters to network hosts from a central server.

Question 37: Which approach provides defense in depth for CIA triad protections?

Deploying a single antivirus on all endpoints
Implementing multiple layers of security controls addressing confidentiality, integrity, and availability (Correct answer)
Relying on a single strong firewall
Using only encryption for all security

Correct answer: Implementing multiple layers of security controls addressing confidentiality, integrity, and availability

Defense in depth uses multiple overlapping layers so if one fails, others still provide protection.

Question 38: A technician runs 'ipconfig /release' followed by 'ipconfig /renew'. What is the purpose of this action?

Flush the DNS cache
Release the current DHCP lease and obtain a new IP address (Correct answer)
Reset the ARP cache
Restart the NIC driver

Correct answer: Release the current DHCP lease and obtain a new IP address

ipconfig /release drops the current DHCP-assigned IP address, and /renew sends a new DHCP discovery to obtain a fresh lease.

Question 39: What is the principle of least privilege in endpoint security?

Users should have no access to any resources
All users should share one admin account
Administrators should have unlimited access
Users should be granted only the minimum permissions needed for their job (Correct answer)

Correct answer: Users should be granted only the minimum permissions needed for their job

Least privilege means users and processes only get the minimum access needed, reducing damage from compromised accounts.

Question 40: Which well-known port does the SMTP protocol use to send outgoing email between mail servers?

993
25 (Correct answer)
110
143

Correct answer: 25

SMTP (Simple Mail Transfer Protocol) uses TCP port 25 for server-to-server email delivery and relay.

Question 41: Which tool would a technician use to test whether a specific TCP port (e.g., port 443) is open on a remote server?

traceroute
ping
ipconfig
telnet or Netcat (nc) (Correct answer)

Correct answer: telnet or Netcat (nc)

Telnet or Netcat can attempt a TCP connection to a specific port, confirming whether that port is open and accepting connections.

Question 42: Which statement about NTP is true?

You must configure two or more NTP sources for times to be accurate
NTP must be configured to synchronize with one of a handful of atomic clocks available on the internet.
A stratum 2 NTP server is directly attached to an authoritative time source.
NTP authentication is disabled by default. (Correct answer)

Correct answer: NTP authentication is disabled by default.

By default, Network Time Protocol (NTP) authentication is disabled on most network devices. This means that NTP clients will accept time updates from any configured NTP server without verifying its authenticity, which can pose a security risk. For enhanced security and to prevent malicious time synchronization, it is highly recommended to enable NTP authentication to ensure that time updates come from trusted sources.

Question 43: How many subnets can be created by borrowing 3 bits from the host portion of a subnet?

16
8 (Correct answer)
4
6

Correct answer: 8

Borrowing 3 bits creates 2^3=8 subnets, as each additional borrowed bit doubles the number of available subnets.

Question 44: What is the relationship between non-repudiation and the CIA triad?

Non-repudiation replaces availability controls
Non-repudiation is unrelated to security
Non-repudiation is another name for confidentiality
Non-repudiation extends the CIA triad by providing proof that a specific action was performed by a specific party (Correct answer)

Correct answer: Non-repudiation extends the CIA triad by providing proof that a specific action was performed by a specific party

Non-repudiation prevents a party from denying an action, supporting integrity through digital signatures and audit logs.

Question 45: A support technician is configuring a new SOHO (Small Office/Home Office) wireless router. The goal is to use the most current and secure protocol that protects against offline dictionary attacks, even if the password is simple. Which WPA protocol should be chosen?

WPA with AES
WPA2 with AES-CCMP
WPA2 with TKIP
WPA3 with SAE (Correct answer)

Correct answer: WPA3 with SAE

WPA3 is the latest Wi-Fi security standard and its key advantage is the use of Simultaneous Authentication of Equals (SAE), also known as the Dragonfly key exchange. This method is inherently resistant to offline dictionary attacks, where an attacker captures the initial handshake and tries to guess the password repeatedly. SAE ensures the password is never transmitted, providing robust protection even with less complex passwords.

Question 46: When using traceroute, what does it mean if several consecutive hops show '* * *' (asterisks)?

The packet reached the destination
The route is optimized for speed
The hops are using IPv6 only
Those routers are not responding to TTL-expired probes, often due to firewall rules (Correct answer)

Correct answer: Those routers are not responding to TTL-expired probes, often due to firewall rules

Asterisks in traceroute output indicate that routers at those hops are not sending TTL-exceeded ICMP messages back, typically due to filtering.

Cisco Certified Support Technician Networking (CCST)

The CCST Networking exam validates foundational knowledge of networking concepts including the OSI model, IP addressing, routing and switching, network security, and troubleshooting.

Questions

50 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cisco.com — Test delivery, eligibility, fees, exam format, retake policy, score release, time limit · verified Oct 2026
certiport.pearsonvue.com — Score validity · verified Oct 2026