Cisco CCNA Security Fundamentals, Automation &
Programmability Certification Exam | Complete Practice
Questions & Verified Answers 2026/ 2027
Question 1
Which protocol is a Cisco-proprietary AAA protocol that runs over TCP
port 49 and encrypts the entire packet payload during communication?
A. RADIUS
B. TACACS+
C. LDAP
D. Kerberos
Correct Answer: B. TACACS+
Detailed Rationale: TACACS+ (Terminal Access Controller Access-Control
System Plus) runs over TCP port 49 and encrypts the entire packet body,
whereas RADIUS typically runs over UDP and encrypts only the
password field by default.
Question 2
What is the default port security violation mode on a Cisco Catalyst
switch interface if a violation occurs and no specific mode has been
manually configured?
A. Protect
B. Restrict
C. Shutdown
,D. Disable
Correct Answer: C. Shutdown
Detailed Rationale: By default, if the maximum number of secure MAC
addresses is exceeded, the port enters the error-disabled (shutdown)
state, stops forwarding traffic, and generates a syslog message.
Question 3
What database does DHCP Snooping use to validate client IP-to-MAC
address bindings on untrusted switch ports?
A. The ARP cache table
B. The DHCP snooping binding database
C. The MAC address forwarding table
D. The VLAN database
Correct Answer: B. The DHCP snooping binding database
Detailed Rationale: DHCP Snooping builds a trusted binding database
containing the client's MAC address, IP address, lease time, VLAN, and
interface, which is subsequently used by features like Dynamic ARP
Inspection and IP Source Guard.
Question 4
Which type of cryptographic algorithm uses a pair of keys (public and
key private) for encryption and decryption, commonly used for digital
signatures and secure key exchange?
A. Symmetric encryption
B. Asymmetric encryption
,C. Hashing algorithm
D. Message Authentication Code (MAC)
Correct Answer: B. Asymmetric encryption
Detailed Rationale: Asymmetric cryptography (such as RSA or ECC) uses
a public key for encryption (or signature verification) and a private key
for decryption (or signing), solving the key distribution problem
inherent in symmetric encryption.
Question 5
Which HTTP method is typically used in a REST API to request the
complete representation of a specific resource without modifying
server state?
A. POST
B. PUT
C. GET
D. DELETE
Correct Answer: C. GET
Detailed Rationale: The GET method is safe and idempotent, designed
solely to retrieve resource data from a server without changing any data
or states on the server.
Question 6
How are key-value pairs structured within a JSON object?
A. Enclosed in square brackets [] and separated by semicolons
B. Enclosed in curly braces {} and separated by colons :
, C. Enclosed in angle brackets <> and separated by equal signs =
D. Enclosed in parentheses () and separated by commas
Correct Answer: B. Enclosed in curly braces {} and separated by colons :
Detailed Rationale: JSON objects are written as unordered collections
of key-value pairs enclosed by curly braces {, where each key is followed
by a colon : and the associated value.
Question 7
What primary architectural characteristic distinguishes Ansible from
traditional configuration management tools like Puppet or Chef?
A. Ansible requires a dedicated daemon running on every managed
node.
B. Ansible is agentless and communicates with managed nodes over
standard protocols like SSH or NETCONF.
C. Ansible only operates on Windows operating systems.
D. Ansible requires a central SQL database server to store playbook
states.
Correct Answer: B. Ansible is agentless and communicates with
managed nodes over standard protocols like SSH or NETCONF.
Detailed Rationale: Ansible does not require agents to be installed on
remote endpoints; it pushes tasks and playbooks over secure channels
like SSH (for Linux/Unix) or WinRM (for Windows).
Question 8
Programmability Certification Exam | Complete Practice
Questions & Verified Answers 2026/ 2027
Question 1
Which protocol is a Cisco-proprietary AAA protocol that runs over TCP
port 49 and encrypts the entire packet payload during communication?
A. RADIUS
B. TACACS+
C. LDAP
D. Kerberos
Correct Answer: B. TACACS+
Detailed Rationale: TACACS+ (Terminal Access Controller Access-Control
System Plus) runs over TCP port 49 and encrypts the entire packet body,
whereas RADIUS typically runs over UDP and encrypts only the
password field by default.
Question 2
What is the default port security violation mode on a Cisco Catalyst
switch interface if a violation occurs and no specific mode has been
manually configured?
A. Protect
B. Restrict
C. Shutdown
,D. Disable
Correct Answer: C. Shutdown
Detailed Rationale: By default, if the maximum number of secure MAC
addresses is exceeded, the port enters the error-disabled (shutdown)
state, stops forwarding traffic, and generates a syslog message.
Question 3
What database does DHCP Snooping use to validate client IP-to-MAC
address bindings on untrusted switch ports?
A. The ARP cache table
B. The DHCP snooping binding database
C. The MAC address forwarding table
D. The VLAN database
Correct Answer: B. The DHCP snooping binding database
Detailed Rationale: DHCP Snooping builds a trusted binding database
containing the client's MAC address, IP address, lease time, VLAN, and
interface, which is subsequently used by features like Dynamic ARP
Inspection and IP Source Guard.
Question 4
Which type of cryptographic algorithm uses a pair of keys (public and
key private) for encryption and decryption, commonly used for digital
signatures and secure key exchange?
A. Symmetric encryption
B. Asymmetric encryption
,C. Hashing algorithm
D. Message Authentication Code (MAC)
Correct Answer: B. Asymmetric encryption
Detailed Rationale: Asymmetric cryptography (such as RSA or ECC) uses
a public key for encryption (or signature verification) and a private key
for decryption (or signing), solving the key distribution problem
inherent in symmetric encryption.
Question 5
Which HTTP method is typically used in a REST API to request the
complete representation of a specific resource without modifying
server state?
A. POST
B. PUT
C. GET
D. DELETE
Correct Answer: C. GET
Detailed Rationale: The GET method is safe and idempotent, designed
solely to retrieve resource data from a server without changing any data
or states on the server.
Question 6
How are key-value pairs structured within a JSON object?
A. Enclosed in square brackets [] and separated by semicolons
B. Enclosed in curly braces {} and separated by colons :
, C. Enclosed in angle brackets <> and separated by equal signs =
D. Enclosed in parentheses () and separated by commas
Correct Answer: B. Enclosed in curly braces {} and separated by colons :
Detailed Rationale: JSON objects are written as unordered collections
of key-value pairs enclosed by curly braces {, where each key is followed
by a colon : and the associated value.
Question 7
What primary architectural characteristic distinguishes Ansible from
traditional configuration management tools like Puppet or Chef?
A. Ansible requires a dedicated daemon running on every managed
node.
B. Ansible is agentless and communicates with managed nodes over
standard protocols like SSH or NETCONF.
C. Ansible only operates on Windows operating systems.
D. Ansible requires a central SQL database server to store playbook
states.
Correct Answer: B. Ansible is agentless and communicates with
managed nodes over standard protocols like SSH or NETCONF.
Detailed Rationale: Ansible does not require agents to be installed on
remote endpoints; it pushes tasks and playbooks over secure channels
like SSH (for Linux/Unix) or WinRM (for Windows).
Question 8
