Cisco CCST Networking (100-150) Practice Exam

What the Cisco CCST Networking (100-150) exam covers

• Standards and Concepts116 questions
• Addressing and Subnet Formats123 questions
• Endpoints and Media Types95 questions
• Infrastructure170 questions
• Diagnosing Problems128 questions
• Security74 questions

Free Cisco CCST Networking (100-150) sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 706.

1. Question 1Standards and Concepts

   At which OSI layer does IP routing operate?

   • ALayer 7 (Application)
   • BLayer 4 (Transport)
   • CLayer 3 (Network)Correct
   • DLayer 2 (Data Link)
   ✓ Correct answer: C

   The OSI Network layer (Layer 3) is responsible for logical addressing and routing. IP (Internet Protocol) lives at this layer, and routers use IP addresses to forward packets between networks. Layer 3 devices examine destination IP addresses and consult routing tables to determine the best path for each packet.

   Why the other options are wrong

   • ALayer 7 (Application) handles end-user services such as HTTP and DNS name resolution, not packet routing between networks.
   • BLayer 4 (Transport) manages end-to-end communication and port-based multiplexing via TCP or UDP, not IP routing.
   • DLayer 2 (Data Link) handles MAC addressing and frame delivery within a single network segment, not inter-network routing.
2. Question 2Addressing and Subnet Formats

   Using CIDR/VLSM to assign subnets sized to each segment's host count primarily helps with what?

   • AEncrypting traffic between the subnets
   • BSynchronizing clocks across all devices
   • CConserving IP address space (efficient utilization)Correct
   • DIncreasing the physical link bandwidth
   ✓ Correct answer: C

   CIDR and VLSM (Variable Length Subnet Mask) enable subnets to be sized precisely to each segment's requirements. This eliminates wasted addresses by avoiding allocating large subnets when fewer hosts are needed, extending the usable life of address blocks and reducing pressure on address space.

   Why the other options are wrong

   • AEncrypting traffic between the subnets is incorrect because subnetting defines address boundaries, not encryption.
   • BSynchronizing clocks across all devices is incorrect because time sync is handled by NTP, not by subnetting.
   • DIncreasing the physical link bandwidth is incorrect because subnetting does not change physical link speed.
3. Question 3Security

   A new Wi-Fi deployment must protect against credential reuse and offer the strongest available encryption. Which design choice is best?

   • AWPA2-Personal with a hidden SSID as the single only protection method
   • BWEP encryption, because it is still widely supported by legacy clients
   • CAn open, unencrypted network protected with only a captive portal
   • DWPA3 (or WPA2-Enterprise with 802.1X) rather than WPA2-Personal with a shared passphraseCorrect
   ✓ Correct answer: D

   WPA3 introduces Simultaneous Authentication of Equals (SAE), which replaces the Pre-Shared Key handshake and eliminates offline dictionary attacks against captured handshakes. Each session uses forward secrecy, so capturing one session's traffic does not decrypt past or future sessions. WPA2-Enterprise with 802.1X issues per-user credentials via a RADIUS server, preventing credential reuse across users - if one credential is stolen, only that user is affected. Both options far exceed WPA2-Personal's shared-passphrase model.

   Why the other options are wrong

   • AWPA2-Personal with a hidden SSID as the single only protection method is incorrect because a shared passphrase is brute-forceable and hiding the SSID is easily defeated.
   • BWEP encryption, because it is still widely supported by legacy clients is incorrect because WEP uses weak static keys and can be cracked in minutes.
   • CAn open, unencrypted network protected with only a captive portal is incorrect because all data frames stay unencrypted regardless of the portal login.
4. Question 4Standards and ConceptsSelect all that apply

   Which TWO data-serialization formats are commonly used to define network configuration in automation tools? (Choose TWO)

   • AYAMLCorrect
   • BICMP
   • CPoE
   • DJSONCorrect
   ✓ Correct answer: A, D

   YAML and JSON are the dominant human-readable data-serialization formats used in network automation tools like Ansible, Nornir, and Terraform. YAML is favored for playbook and inventory files due to its readability, while JSON is the native format of REST APIs and is returned by platforms such as Cisco DNA Center, Meraki, and NSO. Both formats represent structured data that automation frameworks can parse and apply to device configurations.

   Why the other options are wrong

   • BICMP is the Internet Control Message Protocol used for network diagnostics like ping; it is a network-layer protocol, not a data-serialization format.
   • CPoE (Power over Ethernet) is an IEEE standard for delivering electrical power over Ethernet cabling; it is a physical-layer power technology, not a data format.
5. Question 5SecuritySelect all that apply

   Which TWO are valid factors used in multifactor authentication? (Choose TWO)

   • ASomething you deleted
   • BSomething you downloaded
   • CSomething you have (hardware token)Correct
   • DSomething you know (password)Correct
   ✓ Correct answer: C, D

   Multifactor authentication (MFA) strengthens security by requiring users to verify their identity using two or more factors from distinct categories. The three recognized authentication factor categories are something you know (such as a password or PIN), something you have (such as a hardware token, smart card, or mobile device), and something you are (such as a fingerprint or facial recognition). Using factors from different categories ensures that compromising one factor alone is insufficient to gain access, significantly raising the bar for attackers.

   Why the other options are wrong

   • ASomething you deleted is incorrect because deletion is a destructive action, not an authentication factor; there is no recognized security framework that uses the act of deleting something as a means of verifying identity.
   • BSomething you downloaded is incorrect because downloading is a data transfer action and does not constitute an authentication factor; downloaded files could be copied or shared, making them unreliable as proof of identity.
6. Question 6Endpoints and Media Types

   A small form-factor pluggable (SFP) transceiver is inserted into a switch. Which of the following accurately describes an SFP module's role in a network?

   • AIt assigns IP addresses to devices on the switch.
   • BIt provides a hot-swappable interface that can accept various fiber or copper media.Correct
   • CIt boosts the signal level on a copper run beyond 100 meters.
   • DIt converts between 802.11 wireless and 802.3 Ethernet frames.
   ✓ Correct answer: B

   SFP (Small Form-factor Pluggable) modules are compact, hot-swappable transceivers that slide into a standard SFP port. Different SFP variants support multimode fiber, single-mode fiber, and copper (1000BASE-T), allowing administrators to choose the right media for each link without replacing the switch. This modularity is a key advantage in flexible network design.

   Why the other options are wrong

   • AIP address assignment is a function of DHCP servers or static configuration, not a transceiver module.
   • CSFPs do not extend copper distances beyond 100 m; extending copper runs would require a repeater or a switch.
   • DConverting between Wi-Fi and Ethernet is performed by a wireless access point or bridge, not an SFP transceiver.
7. Question 7Security

   Which feature on a Cisco switch dynamically inspects ARP packets and drops those whose IP-to-MAC mapping does not match the DHCP snooping binding table?

   • AIP Source Guard
   • BDynamic ARP Inspection (DAI)Correct
   • C802.1X port authentication
   • DStorm control
   ✓ Correct answer: B

   Dynamic ARP Inspection (DAI) is a switch security feature that intercepts ARP requests and replies on untrusted ports and checks whether the sender's IP-MAC pair matches the DHCP snooping binding table. If the mapping is valid, the ARP packet is forwarded; if not, it is dropped and a log message is generated. This prevents ARP cache poisoning attacks where an attacker sends forged ARP replies to redirect traffic through their system.

   Why the other options are wrong

   • AIP Source Guard filters IP packets on untrusted ports based on source IP and MAC address entries in the DHCP snooping binding table, but it operates on IP traffic, not specifically on ARP protocol messages.
   • C802.1X port authentication requires a device to authenticate via RADIUS before being allowed network access; it controls admission but does not inspect ARP packet contents after a host is admitted.
   • DStorm control limits the rate of broadcast, multicast, or unknown unicast traffic on a port to prevent bandwidth saturation from traffic storms; it does not inspect or validate ARP packet content.
8. Question 8Addressing and Subnet FormatsSelect all that apply

   Which TWO statements correctly describe the IPv4 address 127.0.0.1? (Choose TWO)

   • AIt is the IPv4 loopback address used to test the local TCP/IP stackCorrect
   • BPackets sent to it never leave the local hostCorrect
   • CIt is a private address routable within an organization
   • DIt is the default gateway for most home networks
   ✓ Correct answer: A, B

   The entire 127.0.0.0/8 range is reserved for loopback. Pinging 127.0.0.1 verifies the local IP stack is functioning, and the operating system loops these packets back internally without sending them onto the network.

   Why the other options are wrong

   • CLoopback is not a routable private address; RFC 1918 private ranges are 10/8, 172.16/12, and 192.168/16.
   • DThe default gateway is a router interface address (often 192.168.x.1), not the loopback address.
9. Question 9Infrastructure

   A campus design groups several access switches and their uplinks to a pair of distribution switches that aggregate and route traffic toward the core. Which layer performs this aggregation and policy enforcement?

   • ADistribution layerCorrect
   • BAccess layer
   • CCore layer
   • DPhysical layer
   ✓ Correct answer: A

   In the three-tier hierarchical model, the distribution layer serves as the boundary between Layer 2 access switches and the Layer 3 core, performing inter-VLAN routing, filtering, and traffic aggregation before high-speed transport in the core.

   Why the other options are wrong

   • BThe access layer connects end devices and does not aggregate other switches or enforce inter-VLAN policy.
   • CThe core layer provides fast, non-blocking transport and generally avoids policy enforcement to maximize throughput.
   • DThe physical layer is an OSI concept, not a hierarchical campus design tier.
10. Question 10Security

    An organization places its public-facing email and web servers in a separate network segment that is reachable from the internet but isolated from the internal LAN. What is this segment commonly called?

    • AA demilitarized zone (DMZ)Correct
    • BA broadcast domain
    • CA native VLAN
    • DA loopback network
    ✓ Correct answer: A

    A demilitarized zone is a buffer segment, typically behind a firewall, where servers that must accept inbound internet traffic are placed. If one is compromised, the firewall still restricts movement into the protected internal network.

    Why the other options are wrong

    • BA broadcast domain is the scope reached by a broadcast frame, not a security buffer zone.
    • CA native VLAN carries untagged frames on a trunk and is not a server isolation zone.
    • DA loopback network is an internal logical interface range, not a perimeter segment.

Related Cisco resources

• Cisco CCST Networking (100-150) study guideKey concepts
• Cisco practice examsAll Cisco
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• Cisco CCNP Security SCOR (350-701) practice examRelated
• Cisco CCST Cybersecurity (100-160) practice examRelated
• Cisco Cybersecurity Associate (200-201 CBROPS) practice examRelated

Cisco CCST Networking (100-150) practice exam FAQ