Cisco Certified Support Technician Networking (CCST) — Questions and Answers

Question 1: A user reports an intermittent network connection. A technician inspects the user's patch cable and notices that the small plastic tab on the RJ45 connector is broken. Which of the following is the most likely consequence of this physical defect?

The connector will revert to the T568A wiring standard automatically.
The cable will suffer from increased crosstalk.
The connector will not seat securely in the port, leading to a loose connection. (Correct answer)
The cable will be unable to negotiate Gigabit speeds.

Correct answer: The connector will not seat securely in the port, leading to a loose connection.

The plastic tab on an RJ45 connector is a locking mechanism designed to hold the plug securely in the jack or port. If this tab is broken, the connector can easily become loose or partially unplugged with slight movement, causing an unreliable, intermittent physical connection.

Question 2: When a router determines which network a destination IP address belongs to, what operation does it perform?

ARP lookup in the neighbor table
Performing a DNS query for the destination
ANDing the destination IP address with the subnet mask (Correct answer)
Checking the TTL field in the IP header

Correct answer: ANDing the destination IP address with the subnet mask

A router performs a bitwise AND operation between the destination IP address and the subnet mask to determine the network address and find the correct routing table entry.

Question 3: What does a 'Request timed out' message in a ping output typically indicate?

The destination host responded too slowly
The ICMP packet was blocked or the host is unreachable (Correct answer)
The TTL value expired in transit
DNS could not resolve the hostname

Correct answer: The ICMP packet was blocked or the host is unreachable

A 'Request timed out' result means no ICMP reply was received, suggesting the host is unreachable or a firewall is blocking ICMP.

Question 4: A support technician is investigating a connectivity issue. The user's network cable is properly connected, and the link light on the network interface card (NIC) is green. However, the user cannot access any network resources. Using a bottom-up troubleshooting approach based on the OSI model, what is the NEXT layer the technician should investigate?

Data Link Layer (Correct answer)
Network Layer
Physical Layer
Transport Layer

Correct answer: Data Link Layer

The technician has already verified the Physical Layer (Layer 1) by checking the cable and the link light. The next step in a bottom-up troubleshooting methodology is to investigate the Data Link Layer (Layer 2). This would involve checking for issues like MAC address problems, VLAN configuration, or switch port status.

Question 5: Which command on a Windows PC shows the local routing table, including the default gateway route?

arp -a
ipconfig /all
netstat -p
route print (Correct answer)

Correct answer: route print

'route print' displays the full IPv4 and IPv6 routing tables on a Windows host, including the default route (0.0.0.0).

Question 6: What diagrams are commonly used in network engineering?

Topological and logical
Physical and logical (Correct answer)
Overlay and routing
Topological and physical

Correct answer: Physical and logical

Network diagrams are essential tools for visualizing and documenting network infrastructure. Physical diagrams illustrate the actual hardware layout, cabling, and physical connections between devices. Logical diagrams, on the other hand, depict the network's logical topology, IP addressing schemes, and how data flows, independent of the physical arrangement. Both types are crucial for effective network planning, troubleshooting, and maintenance.

Question 7: A cloud computing model providing a platform for developers to build and deploy applications.

SaaS (Software as a Service)
PaaS (Platform as a Service) (Correct answer)
IaaS (Infrastructure as a Service)
DaaS (Desktop as a Service)

Correct answer: PaaS (Platform as a Service)

Platform as a Service (PaaS) is a cloud computing model that provides a complete development and deployment environment. It includes operating systems, programming language execution environments, databases, and web servers, all managed by the cloud provider. PaaS allows developers to build, run, and manage applications without the complexity of building and maintaining the underlying infrastructure, focusing solely on application development.

Question 8: What type of route must be manually configured by a network administrator?

OSPF route
BGP route
Connected route
Static route (Correct answer)

Correct answer: Static route

Static routes are manually configured using 'ip route' and do not adapt to topology changes.

Question 9: How does data classification support the CIA triad?

It categorizes data by sensitivity so appropriate controls can be applied to each category (Correct answer)
It compresses data to save space
It organizes data alphabetically
It moves data between servers for load balancing

Correct answer: It categorizes data by sensitivity so appropriate controls can be applied to each category

Data classification assigns sensitivity levels enabling proportional security controls for confidentiality, integrity, and availability.

Question 10: Which protocol prevents switching loops in a redundant Layer 2 network?

STP (Correct answer)
OSPF
ARP
DHCP

Correct answer: STP

STP prevents loops by logically blocking redundant ports while keeping them as backups.

Question 11: Which Network Layer protocol handles error reporting and diagnostics?

TCP
ICMP (Correct answer)
ARP
UDP

Correct answer: ICMP

ICMP provides error reporting (destination unreachable) and diagnostics (ping, traceroute) at Layer 3.

Question 12: How are IPv6 addresses typically represented in human-readable format?

A single 128-bit decimal number.
Four decimal numbers separated by periods.
Six hexadecimal numbers separated by hyphens.
Eight hexadecimal numbers separated by colons. (Correct answer)

Correct answer: Eight hexadecimal numbers separated by colons.

IPv6 addresses are 128 bits long and are written as eight groups of four hexadecimal digits, with the groups separated by colons. For example: 2001:0db8:85a3:0000:0000:8a2e:0370:7334.

Question 13: A security technician runs a vulnerability scan that logs into a Windows server using provided credentials to check for missing security patches and insecure registry settings. What type of scan is being performed?

Unauthenticated scan
Intrusive scan
Penetration test
Authenticated scan (Correct answer)

Correct answer: Authenticated scan

An authenticated (or credentialed) scan uses valid user credentials to log into a target system. This provides deeper visibility into the system's configuration, patch levels, and software, resulting in a more comprehensive and accurate vulnerability assessment from an insider's perspective.

Question 14: Which RFC defines the private IPv4 address ranges used in internal networks?

RFC 2460
RFC 1519
RFC 793
RFC 1918 (Correct answer)

Correct answer: RFC 1918

RFC 1918 defines three private IPv4 address ranges: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16, which are not routable on the public Internet.

Question 15: Which layer of the TCP/IP model is responsible for logical addressing and determining the best path for data to travel across the network?

Application
Transport
Internet (Correct answer)
Network Access

Correct answer: Internet

The Internet layer of the TCP/IP model is responsible for logical addressing (using IP addresses) and routing, which involves selecting the best path for data to travel from the source to the destination network. This layer directly corresponds to the Network Layer of the OSI model.

Question 16: Which of the following cable types is designed with a plastic spline or additional shielding to reduce crosstalk and can support 10 Gbps speeds over shorter distances (up to 55 meters)?

Cat6 (Correct answer)
Cat5e
Coaxial
Cat3

Correct answer: Cat6

Category 6 (Cat6) cable is designed for higher performance than Cat5e. It features more tightly wound pairs, often a plastic spline to separate the pairs, and thicker sheathing to reduce crosstalk (NEXT and AXT). This allows it to support speeds of up to 10 Gbps for distances up to 55 meters.

Question 17: What is the role of patch management in endpoint security?

To systematically apply security updates to fix known vulnerabilities (Correct answer)
To create OS backups
To replace hardware
To install new features

Correct answer: To systematically apply security updates to fix known vulnerabilities

Patch management regularly applies security updates to fix vulnerabilities that attackers could exploit.

Question 18: What is the primary function of a default gateway in a host's IP configuration?

To translate private IP addresses to public IP addresses
To provide a path for traffic destined for hosts on remote networks (Correct answer)
To resolve fully qualified domain names (FQDNs) to IP addresses
To dynamically assign an IP address to the host

Correct answer: To provide a path for traffic destined for hosts on remote networks

The default gateway is the IP address of a router on the same local network as the host. When the host needs to send a packet to an IP address that is not on its local subnet, it sends the packet to the default gateway. The gateway router is then responsible for forwarding the packet toward its final destination.

Question 19: Which Windows feature controls whether applications can make changes to the operating system?

Windows Defender
Windows Firewall
BitLocker
User Account Control (UAC) (Correct answer)

Correct answer: User Account Control (UAC)

UAC prompts for confirmation before allowing applications to make changes requiring elevated privileges.

Question 20: The host 192.168.1.130 has a subnet mask of 255.255.255.192. Which network does this host belong to?

192.168.1.128 (Correct answer)
192.168.1.0
192.168.1.192
192.168.1.64

Correct answer: 192.168.1.128

A /26 mask (255.255.255.192) creates blocks of 64 addresses: .0-.63, .64-.127, .128-.191, .192-.255 — host .130 falls in the 192.168.1.128 subnet.

Question 21: What is the CIDR prefix length for the subnet mask 255.255.252.0?

/24
/21
/22 (Correct answer)
/23

Correct answer: /22

255.255.252.0 in binary is 11111111.11111111.11111100.00000000, which has 22 consecutive ones, giving a prefix of /22.

Question 22: Which disaster recovery metric defines the maximum acceptable time a system can be unavailable?

RPO (Recovery Point Objective)
RTO (Recovery Time Objective) (Correct answer)
SLA (Service Level Agreement)
MTBF (Mean Time Between Failures)

Correct answer: RTO (Recovery Time Objective)

RTO defines the maximum acceptable downtime, directly supporting availability.

Question 23: Which protocol allows routers to exchange routing information automatically and is classified as a dynamic routing protocol?

OSPF (Correct answer)
NAT
ARP
STP

Correct answer: OSPF

OSPF (Open Shortest Path First) is a link-state dynamic routing protocol that routers use to automatically learn and share network routes.

Question 24: Which command flushes the local DNS resolver cache in Windows to force fresh DNS lookups?

ipconfig /flushdns (Correct answer)
netsh flush dns
nslookup flush
arp -d *

Correct answer: ipconfig /flushdns

ipconfig /flushdns clears the Windows DNS resolver cache, forcing the system to perform new DNS queries for all hostnames.

Question 25: A technician wants to see every router hop a packet traverses from source to destination. Which tool should they use?

ipconfig
traceroute (Correct answer)
ping
arp

Correct answer: traceroute

Traceroute (tracert on Windows) reveals each hop along the path by incrementing the TTL value of probe packets.

Question 26: How many usable host addresses are available in a /27 subnet?

28
32
16
30 (Correct answer)

Correct answer: 30

A /27 subnet has 5 host bits (32-27=5), giving 2^5=32 total addresses minus 2 (network and broadcast) = 30 usable hosts.

Question 27: When using traceroute, what does it mean if several consecutive hops show '* * *' (asterisks)?

Those routers are not responding to TTL-expired probes, often due to firewall rules (Correct answer)
The hops are using IPv6 only
The route is optimized for speed
The packet reached the destination

Correct answer: Those routers are not responding to TTL-expired probes, often due to firewall rules

Asterisks in traceroute output indicate that routers at those hops are not sending TTL-exceeded ICMP messages back, typically due to filtering.

Question 28: Why is the OSI model called a 'reference model' rather than a protocol specification?

It was never completed by ISO
It has been replaced by TCP/IP
It defines functional layers and responsibilities without specifying exact protocols (Correct answer)
It only applies to wireless

Correct answer: It defines functional layers and responsibilities without specifying exact protocols

The OSI model describes what each layer should do without mandating specific protocols, making it a universal reference.

Question 29: A user cannot reach a website by name but CAN ping its IP address. Which service is most likely failing?

HTTP
DNS (Correct answer)
DHCP
Default gateway

Correct answer: DNS

If a host can be reached by IP but not by name, it indicates a DNS resolution failure rather than a connectivity problem.

Question 30: Why are regular security audits important for maintaining the CIA triad?

They reduce bandwidth usage
They automatically fix all vulnerabilities
They replace the need for firewalls
They verify security controls are functioning and identify gaps in confidentiality, integrity, and availability protections (Correct answer)

Correct answer: They verify security controls are functioning and identify gaps in confidentiality, integrity, and availability protections

Audits evaluate whether existing controls effectively protect all three CIA dimensions.

Question 31: How many usable host addresses are available in a /30 subnet?

2 (Correct answer)
8
6
4

Correct answer: 2

A /30 subnet has 2 host bits (32-30=2), giving 2^2=4 total addresses; subtracting network and broadcast leaves only 2 usable hosts.

Question 32: Which tool would a technician use to test whether a specific TCP port (e.g., port 443) is open on a remote server?

telnet or Netcat (nc) (Correct answer)
traceroute
ping
ipconfig

Correct answer: telnet or Netcat (nc)

Telnet or Netcat can attempt a TCP connection to a specific port, confirming whether that port is open and accepting connections.

Question 33: Which protocol provides a way for a device to discover its IP address automatically when no DHCP server is available, resulting in an address in the 169.254.0.0/16 range?

RARP
SLAAC
BOOTP
APIPA (Correct answer)

Correct answer: APIPA

APIPA (Automatic Private IP Addressing) allows a host to self-assign an address from 169.254.0.0/16 when no DHCP server responds.

Question 34: Which type of cable consists of pairs of insulated copper wires twisted together to help protect against signal interference from adjacent pairs?

Serial cable
Fiber optic cable
Coaxial cable
Twisted-pair cable (Correct answer)

Correct answer: Twisted-pair cable

Twisted-pair cable, used for Ethernet and telephone communications, has two conductors of a single circuit twisted together. This design helps to cancel out electromagnetic interference (EMI) from external sources and reduce crosstalk between neighboring pairs.

Question 35: What is the broadcast address for the network 10.0.0.0/8?

10.0.0.255
10.255.255.255 (Correct answer)
10.255.255.254
10.0.255.255

Correct answer: 10.255.255.255

The broadcast address is the last address in the subnet; for 10.0.0.0/8, all host bits are set to 1, giving 10.255.255.255.

Question 36: Which CIA triad component ensures that data has not been altered without authorization?

Integrity (Correct answer)
Availability
Confidentiality
Authentication

Correct answer: Integrity

Integrity ensures data remains accurate and unmodified by unauthorized parties.

Question 37: A support technician is troubleshooting a user's connectivity issue. The user's computer is connected to the wall jack with a new patch cable, but the network interface card (NIC) link light is off. The technician tests the cable with a basic cable tester, which shows a 'miswire' fault. What is the most likely cause of the problem?

The cable is too long, exceeding the maximum length for Ethernet.
The cable is an STP cable when a UTP cable is required.
The RJ45 connectors on the ends of the cable are terminated using different wiring standards (e.g., T568A on one end and T568B on the other). (Correct answer)
There is excessive electromagnetic interference (EMI) near the cable run.

Correct answer: The RJ45 connectors on the ends of the cable are terminated using different wiring standards (e.g., T568A on one end and T568B on the other).

When a straight-through Ethernet cable is terminated with T568A on one end and T568B on the other, it creates a crossover cable. While modern devices with Auto MDI-X can often compensate, this miswiring is a common error that a cable tester would identify. It would prevent a link on older devices or if Auto MDI-X is disabled. The other options are less likely to be reported as a simple 'miswire'.

Question 38: What is the function of a host-based intrusion detection system (HIDS)?

To monitor system activities and file changes to detect intrusion or policy violations (Correct answer)
To encrypt all files
To automatically install updates
To block all incoming connections

Correct answer: To monitor system activities and file changes to detect intrusion or policy violations

HIDS monitors file integrity, registry changes, log entries, and process activity to detect unauthorized modifications.

Question 39: How does the TCP/IP model differ from the OSI model?

TCP/IP has more layers than OSI
Both have the same layers
TCP/IP has 5 layers; OSI has 7
TCP/IP has 4 layers mapping to OSI's 7, combining several layers (Correct answer)

Correct answer: TCP/IP has 4 layers mapping to OSI's 7, combining several layers

TCP/IP has 4 layers: Application (= OSI 5-7), Transport (= OSI 4), Internet (= OSI 3), Network Access (= OSI 1-2).

Question 40: What does the acronym VLAN stand for, and what is its primary purpose?

Verified LAN — authenticates all connected devices
Variable Length Address Network — supports CIDR addressing
Virtual Link Aggregation Network — bonds multiple interfaces
Virtual LAN — logically segments a physical network into separate broadcast domains (Correct answer)

Correct answer: Virtual LAN — logically segments a physical network into separate broadcast domains

A VLAN (Virtual LAN) logically divides a physical switch into multiple isolated broadcast domains, improving security and traffic management.

Question 41: What is the purpose of NAT (Network Address Translation)?

Encrypts traffic between internal and external networks
Maps private internal IP addresses to a public IP address for internet access (Correct answer)
Resolves hostnames to MAC addresses
Assigns IP addresses to devices dynamically

Correct answer: Maps private internal IP addresses to a public IP address for internet access

NAT translates private RFC 1918 addresses used inside a network to a public IP address when communicating with the internet, conserving public address space.

Question 42: Identify which of the services below uses both TCP and UDP ports.

SSH
TFTP
DNS (Correct answer)
FTP

Correct answer: DNS

The Domain Name System (DNS) uniquely utilizes both TCP and UDP protocols on port 53. UDP port 53 is primarily used for fast, connectionless DNS queries, such as resolving hostnames to IP addresses. TCP port 53, on the other hand, is used for more reliable and larger data transfers, specifically for zone transfers between DNS servers and for DNSSEC (DNS Security Extensions) to ensure data integrity and authenticity.

Question 43: A PC with IP address 192.168.1.10 needs to send data to a server with IP address 192.168.1.50 on the same local Ethernet network. The PC does not have the server's MAC address in its cache. Which protocol will the PC use to find the MAC address of the server?

ICMP
DHCP
ARP (Correct answer)
DNS

Correct answer: ARP

The Address Resolution Protocol (ARP) is used to map a Layer 3 (IP) address to a Layer 2 (MAC) address on a local network. The PC will send out an ARP request broadcast on the local network asking for the MAC address associated with 192.168.1.50. The server will respond with an ARP reply containing its MAC address, allowing the PC to properly address the Ethernet frame.

Question 44: Which approach provides defense in depth for CIA triad protections?

Relying on a single strong firewall
Using only encryption for all security
Deploying a single antivirus on all endpoints
Implementing multiple layers of security controls addressing confidentiality, integrity, and availability (Correct answer)

Correct answer: Implementing multiple layers of security controls addressing confidentiality, integrity, and availability

Defense in depth uses multiple overlapping layers so if one fails, others still provide protection.

Question 45: How does network segmentation support all three pillars of the CIA triad?

It only supports availability via redundant links
It increases network speed only
It divides the network into isolated zones, limiting access (confidentiality), containing breaches (integrity), and preventing widespread outages (availability) (Correct answer)
It only supports confidentiality via encryption

Correct answer: It divides the network into isolated zones, limiting access (confidentiality), containing breaches (integrity), and preventing widespread outages (availability)

Segmentation restricts access between zones, contains malware spread, and isolates failures to individual segments.

Question 46: Which of the following security controls is primarily used to enforce the principle of confidentiality?

RAID 5 array
Digital signatures
Daily data backups
AES encryption (Correct answer)

Correct answer: AES encryption

AES (Advanced Encryption Standard) is a method of encrypting data, making it unreadable to unauthorized individuals. This directly supports confidentiality by preventing the unauthorized disclosure of information.

Cisco Certified Support Technician Networking (CCST)

The CCST Networking exam validates foundational knowledge of networking concepts including the OSI model, IP addressing, routing and switching, network security, and troubleshooting.

Questions

50 min

Time Limit

75%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds

These practice questions were written with AI tools. They are not real exam questions. Exam facts are checked against the official sources listed below. Not reviewed by a subject-matter expert. Editorial policy

Sources & references

Exam facts on this page (fees, format, dates, passing scores) are checked against these official sources; the date is our last check. Editorial policy

cisco.com — Test delivery, eligibility, fees, exam format, retake policy, score release, time limit · verified Oct 2026
certiport.pearsonvue.com — Score validity · verified Oct 2026