Free Cisco CCNA Sample Questions

Correct answer: A — TCP provides flow control, while UDP does not.

• A. Correct. TCP includes flow control mechanisms (e.g., sliding window) to regulate data transmission rate, ensuring the sender does not overwhelm the receiver. UDP is connectionless and lacks built-in flow control, making it simpler but less reliable.
• B. Incorrect. TCP provides sequencing through sequence numbers to ensure packets are reassembled in order. UDP does not provide sequencing or guarantee packet ordering because it is a lightweight, connectionless protocol.
• C. Incorrect. Only TCP uses a three-way handshake (SYN, SYN-ACK, ACK) to establish a reliable connection. UDP is connectionless and does not perform any handshake process.
• D. Incorrect. TCP is stateful; it maintains connection state (e.g., sequence numbers, acknowledgments) for reliable communication. UDP is stateless and does not track connection state, as it is connectionless.

Correct answer: B — It provides resources or services to client devices

• A. Incorrect. Initiating requests for web pages is the role of a client device, such as a web browser. Servers respond to client requests rather than originate them.
• B. Correct. A server provides resources, services, or data to client devices on the network. Examples include file services, web hosting, email services, and database access.
• C. Incorrect. Forwarding data frames between network segments is the function of a switch or bridge, which operates at Layer 2. Servers do not perform this function.
• D. Incorrect. While an email server can generate and send emails, this is a specific service, not the general role of all servers. The broader definition is providing resources to clients.

Correct answer: B — Anycast

• A. Incorrect. Global unicast addresses are used for one-to-one communication and are globally routable. They identify a single interface, not the nearest among a group.
• B. Correct. Anycast in IPv6 uses the same address on multiple interfaces, and packets are delivered to the nearest one based on routing distance. This is ideal for services where the closest available device should respond.
• C. Incorrect. Multicast is used to deliver packets to all members of a multicast group, not to the nearest of multiple possible destinations. It is one-to-many communication.
• D. Incorrect. Link-local addresses are only valid on the local network segment and are not used to identify the nearest interface among multiple devices. They are commonly used for neighbor discovery and routing protocols.

Correct answer: B — To identify the wireless network

• A. Incorrect. Encryption of wireless traffic is performed by security protocols like WPA2 or WPA3, not by the SSID. The SSID only identifies the network.
• B. Correct. The SSID (Service Set Identifier) is the name of the wireless network, allowing clients to identify and connect to it. It distinguishes one wireless network from another.
• C. Incorrect. Dynamic IP address assignment is the function of DHCP (Dynamic Host Configuration Protocol), not the SSID. The SSID does not manage IP addressing.
• D. Incorrect. User authentication is handled by wireless security mechanisms such as 802.1X or pre-shared keys, not by the SSID alone. The SSID is used during connection but does not authenticate users.

Correct answer: B — Containers share the host operating system kernel, while VMs each include a full operating system.

• A. Incorrect. Containers do not include a full operating system; they share the host kernel. Each VM runs its own guest OS, while containers only package the application and dependencies.
• B. Correct. Containers share the host kernel and are lightweight, running only the application and its dependencies. VMs each include a full guest OS, making them heavier but more isolated.
• C. Incorrect. Containers use OS-level isolation via namespaces and cgroups, not hypervisors. VMs rely on hypervisors to abstract and isolate guest operating systems from hardware.
• D. Incorrect. VMs generally provide stronger security isolation because each VM runs its own OS and uses hardware virtualization. Containers share the host kernel, which reduces isolation.

Correct answer: A — ipconfig /all

• A. Correct. The ipconfig /all command displays detailed IP configuration information for all network adapters, including IP address, subnet mask, default gateway, and DNS servers. It is the most direct way to verify DHCP-assigned parameters on a Windows system.
• B. Incorrect. ping 8.8.8.8 tests basic connectivity to a remote IP address but does not show the local adapter's IP configuration. It can confirm reachability but not whether DHCP provided valid settings.
• C. Incorrect. nslookup google.com is used to test DNS name resolution. While useful for troubleshooting DNS issues, it does not verify the adapter's assigned IP address, subnet mask, or default gateway.
• D. Incorrect. tracert 8.8.8.8 traces the path packets take to a destination and can reveal routing issues. It does not display the local DHCP-assigned IP configuration, so it is not the first command to use.

Correct answer: C — Single-mode fiber with 9-micron core

• A. Incorrect. 62.5-micron multimode fiber (OM1) supports shorter distances, typically up to 275 meters for 10 Gbps, due to higher modal dispersion.
• B. Incorrect. 50-micron multimode fiber (OM2/OM3/OM4) supports longer distances than OM1 but is still limited to around 300-550 meters for 10 Gbps. It is not suitable for very long distances.
• C. Correct. Single-mode fiber with a 9-micron core supports the longest distances, often exceeding 10 kilometers or more, because the small core reduces dispersion, making it ideal for long-haul and high-bandwidth applications.
• D. Incorrect. Copper twisted-pair (UTP) cabling, such as Cat6 or Cat6a, is limited to shorter distances (typically up to 100 meters) and is not suitable for long-distance high-speed transmission.

Correct answer: B — Distribution layer

• A. Incorrect. The access layer is where end devices connect to the network, such as PCs, printers, and IP phones. It provides end-user access but does not perform policy-based connectivity between the access and core layers.
• B. Correct. The distribution layer aggregates traffic from access layer switches and enforces policies, such as routing, filtering, and QoS, to control traffic between the access and core layers. It is responsible for policy-based connectivity.
• C. Incorrect. The core layer is designed for high-speed, reliable transport of data across the network backbone. Its primary role is fast forwarding, not policy enforcement or aggregation.
• D. Incorrect. The WAN edge layer connects the enterprise network to external networks or service providers. It is not part of the traditional three-tier campus hierarchy (access, distribution, core).

Correct answers: B, D — Devices establish outbound HTTPS connections to the Meraki cloud.; Management traffic between the devices and the cloud is encrypted.

• A. Incorrect. Meraki devices do not use SSH to send periodic keepalives to the cloud; they communicate using secure web-based connectivity (HTTPS), not SSH-based monitoring.
• B. Correct. Meraki devices initiate outbound HTTPS connections to the Meraki cloud dashboard for management, registration, and configuration updates. This is the standard model for cloud-managed networking.
• C. Incorrect. The cloud controller does not push configurations using Telnet, which is an insecure protocol. Meraki uses secure HTTPS channels for configuration delivery.
• D. Correct. Management traffic between Meraki devices and the cloud is encrypted using HTTPS/TLS to ensure data integrity and confidentiality.
• E. Incorrect. A static public IP is not required; Meraki devices can use dynamic IPs and typically need only outbound internet access, working behind NAT.

Correct answer: C — The default VLAN is VLAN 1 and carries CDP and VTP messages.

• A. Incorrect. VLAN 1002 is one of the legacy VLANs reserved for Token Ring and FDDI, but the default VLAN on a Cisco switch is VLAN 1, not VLAN 1002.
• B. Incorrect. The default VLAN (VLAN 1) cannot be removed from a Cisco switch; it is a built-in VLAN that always exists.
• C. Correct. VLAN 1 is the default VLAN on Cisco switches and is used by control-plane protocols such as CDP and VTP. It also serves as the native VLAN on 802.1Q trunks unless changed.
• D. Incorrect. The default VLAN does not drop user data frames; it is the default membership VLAN for access ports and can carry user traffic unless explicitly restricted.

Correct answer: B — switchport trunk encapsulation dot1q

• A. Incorrect. This command sets the port to trunk mode but does not specify the encapsulation type. On switches that support multiple encapsulations, the encapsulation must be set separately.
• B. Correct. This command explicitly sets the trunk encapsulation to IEEE 802.1Q, which is required on older Cisco switches that support both ISL and dot1q. On modern switches, dot1q is the default, but this command is still valid.
• C. Incorrect. This command sets the native VLAN for untagged traffic on the trunk. It does not configure the encapsulation method.
• D. Incorrect. This command restricts the VLANs allowed on the trunk. It is used after the trunk is established and does not affect encapsulation.
• E. Incorrect. This is not a valid Cisco IOS command. The correct command to set the native VLAN is 'switchport trunk native vlan <vlan>'.
• F. Incorrect. This command configures Dynamic Trunking Protocol (DTP) to auto-negotiate trunking. It does not set encapsulation or directly configure trunking.

Correct answer: B — 16

• A. Incorrect. 8 is the default maximum number of active interfaces in an EtherChannel, but the total maximum (including standby) can be increased to 16.
• B. Correct. Cisco switches support up to 16 interfaces in a single LACP EtherChannel, with 8 active and up to 8 standby links. This is the standard Cisco behavior for LACP.
• C. Incorrect. 32 exceeds the maximum supported number of interfaces for a single LACP EtherChannel on Cisco switches.
• D. Incorrect. 64 is far above the supported maximum for a single LACP EtherChannel on Cisco switches.

Correct answer: A — IEEE 802.3af/at standard

• A. IEEE 802.3af and 802.3at (PoE and PoE+) define Power over Ethernet, enabling power delivery over Ethernet cables to devices like wireless access points, IP phones, and other network devices without a separate power adapter.
• B. IEEE 802.1Q is the standard for VLAN tagging on Ethernet frames, used to identify VLAN membership across trunk links, not for delivering power.
• C. IEEE 802.11ac is a Wi-Fi standard for high-speed wireless LAN communication in the 5 GHz band, unrelated to Power over Ethernet.
• D. IEEE 802.1D is the standard for Spanning Tree Protocol (STP) used to prevent Layer 2 loops in bridged networks, not for Power over Ethernet.

Correct answer: B — Route with metric 500

• A. Incorrect. EIGRP selects the route with the lowest metric. A metric of 1000 is higher than 500, so this route is not chosen.
• B. Correct. EIGRP uses the lowest metric to determine the best path. The route with metric 500 is preferred and installed in the routing table.
• C. Incorrect. EIGRP does not load-balance by default unless multiple routes have the same metric. Here, the metrics differ, so only the best route is used.
• D. Incorrect. Both routes are valid EIGRP routes to the destination, but the router selects only the one with the lowest metric (500) for forwarding.

Correct answer: A — Router A will become active because its priority is higher.

• A. Correct. When both routers boot simultaneously and no active router is already serving, HSRP elects the active router based on the highest priority. Router A has priority 150, which is higher than Router B's 100, so Router A becomes active. Preemption is irrelevant here because there is no pre-existing active router to displace.
• B. Incorrect. A lower priority does not win the HSRP election. The router with the highest priority becomes active, so Router B would not be selected over Router A.
• C. Incorrect. Although the router that boots first could become active if boot times differ, the question states both routers reboot at the same time. In that case, HSRP uses priority (and IP address as tiebreaker) to elect the active router, not the order of booting.
• D. Incorrect. HSRP does not use the lowest IP address. If priorities are equal, the router with the highest IP address wins the tie, not the lowest.

Correct answer: B — A static route with a higher administrative distance that acts as a backup if the primary route fails.

• A. Incorrect. A static route with a low administrative distance is preferred over most other routes, so it would not normally serve as a backup. Floating static routes are specifically configured with a higher administrative distance so they are only used when the primary route is unavailable.
• B. Correct. A floating static route is configured with a higher administrative distance than the primary route. It remains in the routing table but is only used if the primary route fails, making it a backup route for redundancy.
• C. Incorrect. Static routes do not dynamically change their next-hop address without manual configuration; that behavior is characteristic of dynamic routing protocols. A floating static route is still static and only becomes active based on route preference.
• D. Incorrect. Static routes are manually configured and do not automatically advertise themselves to other routers. Advertising routes is a function of dynamic routing protocols, not static routing.

Correct answer: A — OSPF

• A. Correct. In a Cisco routing table, the letter 'O' stands for OSPF (Open Shortest Path First), a link-state routing protocol. Routes learned via OSPF are marked with 'O'.
• B. Incorrect. ODR (On-Demand Routing) is indicated by a lowercase 'o' (or sometimes 'O*') in the routing table, not by the single uppercase 'O', which is reserved for OSPF.
• C. Incorrect. BGP (Border Gateway Protocol) routes are represented by the letter 'B' in the routing table, not 'O'.

Correct answer: B — Forwards DHCP broadcasts to a server as unicast packets

• A. Incorrect. A DHCP relay agent does not assign IP addresses or DHCP options; that is the role of the DHCP server. The relay agent merely facilitates communication between clients and the server.
• B. Correct. A DHCP relay agent forwards DHCP broadcast requests (e.g., DHCPDISCOVER) from clients on a local subnet to a DHCP server as unicast packets, enabling clients on different subnets to obtain IP addresses. It does not assign addresses itself.
• C. Incorrect. DNS configuration can be delivered to clients via DHCP options, but that is a function of the DHCP server, not the relay agent. The relay agent only forwards DHCP messages.
• D. Incorrect. Blocking unauthorized DHCP requests is not the primary role of a DHCP relay agent. That protection is typically handled by security features such as DHCP snooping on switches.

Correct answers: B, D — The configuration uses overload to perform Port Address Translation (PAT).; The access-list 1 referenced in the NAT configuration is a standard numbered ACL.

• A. Incorrect. The NAT pool is defined as 203.0.113.10 through 203.0.113.20, not including 203.0.113.1. The outside interface IP is only used as the outside-facing interface address, not as part of the pool unless explicitly configured.
• B. Correct. The 'overload' keyword enables Port Address Translation (PAT), allowing multiple internal devices to share one or more public IP addresses by using unique transport-layer ports. This is exactly how inside source NAT with a pool and overload operates.
• C. Incorrect. Overload does not limit translation to TCP and UDP only; it supports other IP protocols as well, such as ICMP, by using protocol identifiers when applicable. The key effect of overload is port multiplexing, not protocol restriction.
• D. Correct. Access-list 1 is a standard numbered ACL (range 1-99). Standard ACLs match only source IP addresses, which is appropriate here for identifying the inside local subnet (10.1.1.0/24) to be translated.
• E. Incorrect. The NAT pool explicitly starts at 203.0.113.10 and ends at 203.0.113.20. The outside interface address 203.0.113.1 is not included in the pool based on the configuration shown.

Correct answer: E — username admin secret cisco

• A. Incorrect. This command restricts VTY access to SSH only, but it does not define user credentials or generate the RSA key pair needed for SSH.
• B. Incorrect. This command enables local authentication on VTY lines, but it does not create the username and password entries in the local database.
• C. Incorrect. This sets a simple line password, which is not the recommended method for SSH authentication; local username authentication is preferred.
• D. Incorrect. This generates the RSA key pair required for SSH encryption, but it does not provide the user login credentials needed for authentication.
• E. Correct. This command creates a local user with a hashed secret, which can be used for SSH authentication when combined with 'login local' on the VTY lines.

Correct answers: A, D — An NTP client sends time synchronization requests to an NTP server.; An NTP client can be configured to also act as an NTP server for others.

• A. Correct. An NTP client sends time synchronization requests to an NTP server to obtain accurate time. This is the fundamental client-server operation of NTP.
• B. Incorrect. An NTP server provides time to multiple clients but does not synchronize its own clock with them. The server synchronizes with higher-stratum servers or a reference clock.
• C. Incorrect. NTP authentication is optional; it is used for security but not mandatory for a client to query a server.
• D. Correct. An NTP client can be configured as an NTP server for other devices, allowing hierarchical time distribution. For example, a Cisco router can act as both client and server.
• E. Incorrect. Stratum level decreases as a device gets closer to the reference clock. Stratum 1 is directly connected to the clock, while higher numbers indicate greater distance.
• F. Incorrect. NTP uses UDP port 123, not TCP. UDP is used for its low overhead and efficiency in time-sensitive synchronization.

Correct answer: B — Drop or re-mark packets that exceed a set rate limit

• A. Incorrect. Delaying excess packets by queuing them describes traffic shaping, not policing. Policing typically drops or re-marks packets that exceed the rate limit rather than queuing them. Queuing is used in shaping or congestion management.
• B. Correct. Traffic policing enforces a rate limit by monitoring traffic and dropping or re-marking packets that exceed the configured threshold. This is a fundamental QoS mechanism to control bandwidth usage and prevent congestion.
• C. Incorrect. Assigning packets to different queues based on priority is a function of classification and queuing, not policing. Policing focuses on rate enforcement, not queue assignment.
• D. Incorrect. Monitoring traffic flows and reporting bandwidth consumption is associated with traffic monitoring or accounting, not policing. Policing actively enforces rate limits rather than just observing usage.

Correct answers: A, B, C — TFTP uses UDP and is suitable for small file transfers.; FTP uses TCP ports 21 and 20 for separate control and data.; TFTP is commonly used to load OS images on devices during bootup.

• A. Correct. TFTP uses UDP (port 69) and is designed for small, simple file transfers where reliability is not critical. It lacks authentication and encryption, making it lightweight.
• B. Correct. FTP uses TCP port 21 for control commands and TCP port 20 for data transfers in active mode, providing separate control and data connections.
• C. Correct. TFTP is commonly used in network devices like routers and switches to load OS images or configuration files during bootup or recovery, due to its simplicity.
• D. Incorrect. FTP active mode is less firewall-friendly because the server initiates the data connection to the client, which can be blocked. Passive mode is more firewall-friendly as the client initiates both connections.
• E. Incorrect. Neither TFTP nor standard FTP encrypts data by default. FTP transmits credentials and data in plaintext, and TFTP has no security features. For encryption, protocols like SFTP or FTPS are used.
• F. Incorrect. TFTP uses UDP with limited error handling, making it less reliable for large transfers. FTP, using TCP, provides guaranteed delivery and is more suitable for large file transfers.

Correct answer: B — service timestamps log datetime

• A. Incorrect. The 'service timestamps debug datetime' command enables timestamps on debug messages, not on syslog or general log messages. It is used for debugging output only.
• B. Correct. The 'service timestamps log datetime' command adds date and time stamps to log messages, which is the standard Cisco IOS feature to timestamp syslog/log output. This allows easier correlation of log entries with events.
• C. Incorrect. The 'clock set' command manually sets the device's system clock, but it does not enable timestamps in log messages. While the clock value affects the time displayed, this command is not the syslog timestamp feature itself.
• D. Incorrect. 'logging timestamp' is not a valid Cisco IOS command for enabling timestamps on syslog messages. The correct command is 'service timestamps log datetime'.

Correct answers: A, C, D — Simultaneous Authentication of Equals (SAE); Opportunistic Wireless Encryption (OWE); 192-bit encryption suite

• A. Correct. Simultaneous Authentication of Equals (SAE) is a WPA3 feature that replaces the WPA2-PSK handshake, providing stronger protection against offline dictionary attacks. It is used in WPA3-Personal for secure password-based authentication.
• B. Incorrect. Temporal Key Integrity Protocol (TKIP) was introduced with WPA and is not a feature of WPA3. It is an older encryption protocol that has been deprecated due to security weaknesses.
• C. Correct. Opportunistic Wireless Encryption (OWE) is introduced with WPA3 to provide encryption for open networks without requiring a password. It enhances privacy on public Wi-Fi by encrypting individual client traffic.
• D. Correct. The 192-bit encryption suite is a WPA3-Enterprise feature intended for high-security environments. It strengthens cryptographic requirements compared to standard WPA2/WPA3 modes, offering enhanced security for enterprise networks.
• E. Incorrect. Wired Equivalent Privacy (WEP) is an obsolete and insecure legacy protocol that predates WPA. It is not related to WPA3 and should no longer be used.
• F. Incorrect. Preshared Key (PSK) is associated with WPA/WPA2-Personal and refers to a pre-shared password model. WPA3 replaces PSK with Simultaneous Authentication of Equals (SAE) for personal mode authentication.

Correct answers: A, B, C — Something you know; Something you have; Something you are

• A. Correct. 'Something you know' is a knowledge factor, such as a password, PIN, or passphrase. It is one of the three classic authentication factors.
• B. Correct. 'Something you have' is a possession factor, such as a smart card, security token, or mobile device. It is the second of the three classic authentication factors.
• C. Correct. 'Something you are' is an inherence factor, referring to biometrics like fingerprints, facial recognition, or iris scans. It is the third classic authentication factor.
• D. Incorrect. 'Something you do' is not a standard primary factor in multifactor authentication. Behavioral biometrics exist but are not universally recognized as a primary factor.
• E. Incorrect. 'Where you are' is a location-based contextual factor, not one of the three primary factors (knowledge, possession, inherence).
• F. Incorrect. 'Time you access' is a time-based contextual factor, not a standard authentication factor. The classic factors are knowledge, possession, and inherence.

Correct answer: B — A potential danger that could exploit a vulnerability

• A. Incorrect. This describes a vulnerability, which is a weakness or flaw in a system, not a threat. A threat is the potential danger, not the flaw itself.
• B. Correct. A security threat is a potential danger that could exploit a vulnerability and cause harm. It may be a person, event, or condition that poses risk to systems or data.
• C. Incorrect. This describes a successful attack or compromise, not a threat. A threat exists before exploitation occurs and does not require the system to be compromised.
• D. Incorrect. This describes a mitigation or safeguard used to reduce risk. Mitigations help defend against threats, but they are not the definition of a threat.

Correct answer: C — 1-99 and 1300-1999

• A. Incorrect. While standard IP ACLs originally used the range 1-99, this option omits the expanded standard ACL range (1300-1999) that was introduced later in Cisco IOS. Standard ACLs can use both 1-99 and 1300-1999.
• B. Incorrect. The range 100-199 is reserved for extended IP ACLs, which can filter based on source and destination IP, protocol, and ports. Standard ACLs do not use this range.
• C. Correct. Standard IP ACLs use the numbered ranges 1-99 (original) and 1300-1999 (expanded). These ranges identify ACLs that match traffic based only on the source IP address.
• D. Incorrect. The range 100-199 is for extended ACLs, and 2000-2699 is also associated with extended ACLs in later IOS versions. Standard ACLs do not use these ranges.

Correct answers: B, C — Pre-shared key authentication (using a passphrase); CCMP encryption (Advanced Encryption Standard)

• A. Incorrect. 802.1X authentication is used with WPA2-Enterprise, not WPA2-PSK. WPA2-PSK relies on a pre-shared key rather than an authentication server.
• B. Correct. Pre-shared key authentication is a core component of WPA2-PSK. A passphrase is used to authenticate all devices on the network.
• C. Correct. CCMP (AES) encryption is mandatory for WPA2 and provides strong data confidentiality. While it is an encryption protocol, it is an integral part of the WPA2-PSK configuration.
• D. Incorrect. TKIP is a legacy encryption protocol used with WPA, not WPA2. WPA2 requires CCMP/AES for encryption.
• E. Incorrect. RADIUS server integration is used with WPA2-Enterprise for centralized authentication. WPA2-PSK does not require a RADIUS server; it uses a shared passphrase.

Correct answers: A, B, C — The peer's IP address that serves as the remote VPN gateway.; The transform set that defines encryption and hashing algorithms.; The access list that identifies the traffic to be encrypted.

• A. Correct. The peer's IP address identifies the remote VPN gateway endpoint. This address is required to establish the IPsec tunnel, as it tells the local device where to send encrypted traffic.
• B. Correct. The transform set defines the encryption and hashing algorithms (e.g., AES for encryption, SHA for integrity) used to protect data in the IPsec tunnel. It is a mandatory component in the crypto map configuration.
• C. Correct. The access list (crypto ACL) specifies which traffic should be encrypted and sent through the VPN tunnel. Without it, the device would not know which packets to protect.
• D. Incorrect. The Diffie-Hellman group is used during IKE key exchange for perfect forward secrecy, but it is not a direct component of the IPsec transform or crypto map. Default values can be used, and it is optional in basic configurations.
• E. Incorrect. The keepalive interval for NAT traversal (NAT-T) is optional and used only when the VPN peers are separated by NAT devices. It is not mandatory for all IPsec site-to-site VPNs.
• F. Incorrect. The security association (SA) lifetime determines when the IPsec SA should be rekeyed. It can be left at default values, making it optional in the configuration.

Correct answer: B — A formal session to educate employees on security policies

• A. This describes security awareness, an ongoing effort to keep security top of mind, not formal training.
• B. Correct. This is security training, a structured formal session to educate employees on policies, procedures, and responsibilities.
• C. This describes physical access control, which uses barriers, locks, or guards to prevent unauthorized entry, not a user education program.
• D. This refers to network security monitoring using tools like IDS/IPS or SIEM, which is not part of user awareness or training.

Correct answer: B — Use an orchestration tool like Ansible to automate configuration backups

• A. Incorrect. While a Python script can automate SSH connections, it is less scalable and more error-prone than using a dedicated orchestration platform. It requires custom logic for inventory, retries, and state handling, and lacks centralized management for large-scale deployments.
• B. Correct. An orchestration tool like Ansible provides a centralized, scalable, and consistent way to automate configuration backups across multiple devices. It uses playbooks to define tasks, handles large inventories efficiently, reduces manual effort, and improves repeatability.
• C. Incorrect. Scheduling each device to back up its configuration to TFTP can provide backups, but this approach lacks centralized control and flexibility. It depends on device-by-device configuration and may not ensure the same level of consistency or scalability across a large environment.
• D. Incorrect. Manually logging into each device is time-consuming, error-prone, and does not scale well for a large number of devices. It increases the chance of human error and inconsistent backup procedures, and does not leverage automation effectively.

Correct answer: B — Southbound API

• A. Incorrect. A northbound API is used for communication between the SDN controller and applications or orchestration tools, not for direct device-level control. It exposes controller capabilities to higher-layer services.
• B. Correct. A southbound API is the interface used by the SDN controller to program and manage network devices (switches, routers) in the underlay/fabric. Examples include OpenFlow, NETCONF, and Cisco's OpFlex.
• C. Incorrect. 'Application API' is not a standard term in SDN architecture. Applications typically interact with the controller via northbound APIs.
• D. Incorrect. A management API is used for administrative tasks like configuration and monitoring of devices, but it is not specific to the controller-to-device communication in SDN. The standard term for that is the southbound API.

Correct answer: B — Migrate to a controller-based architecture to centrally define and enforce policies across all devices, using APIs for automation.

• A. Incorrect. While CLI scripts offer granular control, they are not scalable for large networks and do not support centralized policy enforcement or automation, which is a key aspect of controller-based networking.
• B. Correct. A controller-based architecture centralizes policy definition and enforcement, enabling automation via APIs, which improves scalability and reduces manual configuration errors. This aligns with modern intent-based networking.
• C. Incorrect. SNMP is primarily used for monitoring and basic management, not for pushing comprehensive configuration changes in a controller-based model. It lacks the robustness and scalability of modern controller-based solutions for policy enforcement.
• D. Incorrect. A hybrid model may be practical in some environments, but it introduces complexity and inconsistency in policy enforcement. Controller-based networking emphasizes centralized policy control and automation, not a mix of manual and automated methods.

Correct answer: D — No fixed limit

• A. Incorrect. The JSON specification (RFC 8259) does not impose a fixed depth limit of 10. Some parsers may enforce this as a practical limit, but it is not part of the JSON standard.
• B. Incorrect. There is no maximum depth of 100 defined in the JSON specification. This number is arbitrary and has no basis in the standard, though some implementations might use it internally.
• C. Incorrect. The JSON specification does not set a maximum depth of 1000. Such limits are implementation-specific and depend on the parser or application, not the JSON standard.
• D. Correct. According to RFC 8259, the JSON specification does not define a maximum depth for nested objects or arrays. Any limit, if present, is determined by the parser, implementation, or available memory, not by the standard itself.