220-1101 Networking Practice Test 12 — 15 Questions

Question 1

A network technician is configuring a small office network. The company wants to ensure that only authorized company devices can connect to the wired network. The network uses a managed switch and a DHCP server. Which security feature should the technician configure on the switch to BEST meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

802.1X. 802.1X is the correct answer because it provides port-based network access control (PNAC) that authenticates devices before granting access to the wired network. It uses the Extensible Authentication Protocol (EAP) over LAN (EAPoL) to verify credentials against an authentication server (e.g., RADIUS), ensuring only authorized company devices can connect. This meets the requirement precisely by enforcing per-device authentication at the switch port level.

Answer

Port security

Answer

DHCP snooping

Answer

MAC address filtering

Question 2

A user reports that they can access internal network resources by IP address but cannot browse the internet by domain name (e.g., www.google.com). The technician checks the workstation's network adapter settings and sees that the IP address is obtained via DHCP. Which of the following is the MOST likely cause of this issue?

Accepted Answer

DNS server configuration. The user can access internal resources by IP address but not by domain name, which indicates that name resolution is failing. Since the workstation obtains its IP address via DHCP, the DNS server configuration is likely missing or incorrect, preventing the system from translating domain names like www.google.com into IP addresses.

Answer

Incorrect subnet mask

Answer

Wrong default gateway

Answer

Duplicate IP address

Question 3

A small office network uses a single router connected to a managed switch. The technician has configured two VLANs on the switch: VLAN 10 for Sales and VLAN 20 for Engineering. Both VLANs can access the internet, but devices in Sales cannot reach devices in Engineering. The router has one physical interface connected to the switch. The technician configured a subinterface on the router for each VLAN with appropriate IP addresses. However, devices on VLAN 20 cannot access the internet, while VLAN 10 works fine. Which of the following is the MOST likely missing configuration?

Accepted Answer

The switch port connecting to the router is not configured as a trunk port. The router uses subinterfaces for VLAN routing, which requires the switch port connecting to the router to be configured as a trunk port (802.1Q trunking). Without trunking, the switch port will only carry traffic from a single VLAN (likely VLAN 1 or the native VLAN), so VLAN 20 frames are dropped at the switch-to-router link. This explains why VLAN 10 works (if it matches the access VLAN on that port) and VLAN 20 fails to reach the internet.

Answer

The router's DHCP server is not configured for VLAN 20

Answer

The firewall on the router is blocking all traffic from VLAN 20

Answer

The VLAN 20 subinterface is not assigned a gateway IP address

Question 4

A small office uses a router with a built-in switch and a separate wireless access point. Users on the wired network can access the internet and internal resources, but wireless users cannot access any internal resources. Wireless users can connect to the access point and obtain an IP address in the 192.168.2.0/24 range, while wired users are on 192.168.1.0/24. The router's LAN interface is 192.168.1.1/24, and the access point is connected to the router's switch port and has an IP of 192.168.1.100/24. Which of the following is the MOST likely cause?

Accepted Answer

The router does not have a route between the two subnets.. The router's LAN interface is on 192.168.1.0/24, and the access point is connected to that same subnet with IP 192.168.1.100/24. Wireless clients receive IPs in 192.168.2.0/24, which is a different subnet. For traffic from 192.168.2.0/24 to reach internal resources on 192.168.1.0/24, the router must have a route between these two subnets. Without that route, the router drops or fails to forward packets, isolating wireless users from internal resources.

Answer

The access point is not configured as a bridge.

Answer

The wireless network encryption is set incorrectly.

Answer

The access point's DHCP server is conflicting with the router.

Question 5

A network technician is setting up a wireless access point (AP) for a small business. The company's router provides DHCP for the 192.168.1.0/24 network. The AP needs to broadcast two SSIDs: one for employees and one for guest users. The guest network must be completely isolated from the employee network and internal resources, while both SSIDs must have internet access. The AP is connected to a managed switch. Which configuration will BEST meet these requirements?

Accepted Answer

Configure VLANs on the managed switch and set the AP to tag the employee SSID on VLAN 10 and the guest SSID on VLAN 20; configure trunk port on switch to the AP. It uses VLANs to logically separate the employee and guest traffic at Layer 2. By configuring the managed switch port as a trunk with VLAN 10 (employee) and VLAN 20 (guest), and having the AP tag each SSID to its respective VLAN, the guest network is isolated from the employee network and internal resources. The router can then route both VLANs to the internet via separate subinterfaces or a Layer 3 switch, ensuring both SSIDs have internet access while maintaining isolation.

Answer

Place both SSIDs on the same subnet and enable client isolation on the AP

Answer

Configure a DHCP reservation on the router for the AP and set the guest SSID to use a static IP in a different subnet

Answer

Disable the guest network's ability to access the default gateway by changing the AP's management settings

Question 6

A network technician is configuring a router-on-a-stick for inter-VLAN routing. The router has one physical interface (G0/0) connected to a managed switch. The technician creates subinterfaces G0/0.10 for VLAN 10 (192.168.10.1/24) and G0/0.20 for VLAN 20 (192.168.20.1/24). The switch port connected to the router is configured as a trunk allowing VLANs 10 and 20. On a workstation in VLAN 10, the technician can ping the gateway 192.168.10.1 but cannot ping the gateway 192.168.20.1. Which of the following is the MOST likely cause?

Accepted Answer

The subinterface G0/0.20 is missing the encapsulation dot1Q 20 command. The workstation in VLAN 10 can ping its own gateway (192.168.10.1) but not the gateway in VLAN 20 (192.168.20.1). This indicates that the router's subinterface for VLAN 20 is not properly configured to accept and forward traffic from VLAN 20. The most likely cause is that the subinterface G0/0.20 is missing the `encapsulation dot1Q 20` command, which is required to tag frames with VLAN 20 ID when they traverse the trunk link. Without this command, the router will not process traffic for VLAN 20, and the gateway remains unreachable.

Answer

The switch trunk port is set to the wrong native VLAN

Answer

The workstation in VLAN 10 has an incorrect subnet mask

Answer

The router interface G0/0 is in a VLAN that is not allowed on the trunk

Question 7

A network technician is configuring a small office network. The company wants to ensure that only authorized company devices can connect to the wired network. The network uses a managed switch and a DHCP server. Which security feature should the technician configure on the switch to BEST meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Only devices in VLAN 10 can access the internet.. The switch port connected to the router is configured as an access port in VLAN 10. This means it only carries traffic for VLAN 10, stripping any VLAN tags. The router's subinterface G0/0.20 for VLAN 20 never receives or sends traffic because the access port does not allow VLAN 20 frames. Therefore, only devices in VLAN 10 can reach the router's default gateway (192.168.10.1) and access the internet.

Answer

Both VLAN 10 and VLAN 20 can access the internet.

Answer

Only devices in VLAN 20 can access the internet.

Answer

Neither VLAN can access the internet.

Question 8

A network technician is installing a new fiber optic link between two switches located in different buildings. The technician uses identical SFP modules on both ends and connects them with a single fiber patch cable. After powering on, the link lights on both switches remain off. The technician verifies the SFP modules are compatible with the switches and that the cable is not damaged. Which of the following should the technician check NEXT?

Accepted Answer

Swap the transmit and receive connections at one end of the fiber cable. Fiber optic communication requires two separate strands: one for transmitting (TX) and one for receiving (RX). If a single fiber patch cable is used, it typically contains two fibers, but the connectors must be crossed at one end so that the TX of one switch connects to the RX of the other. Since the link lights are off despite compatible SFPs and an undamaged cable, the most likely issue is a polarity mismatch, where both ends are wired straight through (TX to TX, RX to RX), preventing the optical signal from being received.

Answer

Change the duplex settings on both switches to half-duplex

Answer

Update the firmware on both switches

Answer

Verify that the VLAN configuration matches on both ends

Question 9

A small business has a 24-port PoE+ switch powering 12 IP cameras (each requiring 15W) and 8 VoIP phones (each requiring 6W). The switch has a PoE budget of 240W. A technician installs two additional IP cameras (each 15W) but they do not power on. The existing cameras and phones continue to work normally. The technician has verified the Ethernet cables are good and the ports are enabled. Which of the following is the MOST likely cause?

Accepted Answer

The switch's PoE budget is exceeded by the additional cameras.. The switch has a PoE budget of 240W. The existing load is 12 cameras × 15W + 8 phones × 6W = 180W + 48W = 228W. Adding two more 15W cameras would require an additional 30W, totaling 258W, which exceeds the 240W budget. PoE switches use a power management algorithm to prioritize existing powered devices (PDs) and deny power to new ones when the budget is exceeded, which explains why the existing devices continue working while the new cameras do not power on.

Answer

The new cameras are connected with crossover cables instead of straight-through cables.

Answer

The new cameras are on a different VLAN that is not configured on the switch.

Answer

The DHCP server has run out of IP addresses in the scope.

Question 10

A technician is troubleshooting a workstation that cannot connect to the network. The link light on the network interface card is blinking amber, and the switch port shows no link light. The Ethernet cable run from the workstation to the patch panel is approximately 125 meters. Which of the following is the MOST likely cause of the connectivity issue?

Accepted Answer

The cable exceeds the maximum segment length for Ethernet.. The Ethernet cable run is 125 meters, which exceeds the IEEE 802.3 maximum segment length of 100 meters for twisted-pair copper cabling (e.g., Cat5e, Cat6). This distance causes signal attenuation and timing issues, preventing the switch port from establishing a link, as indicated by the absence of a link light on the switch and the amber blinking link light on the NIC (which often signals a physical-layer problem).

Answer

The cable is damaged near the connector.

Answer

The network switch is not providing PoE.

Answer

The workstation's NIC is set to a static IP address.

Question 11

A network technician is troubleshooting intermittent connectivity issues on a small office network. The issue only occurs for a few minutes at a time, and users lose access to both internal servers and the internet. During the issue, the technician can ping the default gateway from the core switch but not from the router. The router logs show multiple 'Duplicate IP address' errors for the router's LAN interface. Which of the following is the MOST likely cause?

Accepted Answer

A rogue DHCP server on the network. The 'Duplicate IP address' error on the router's LAN interface indicates that another device on the network is using the same IP address as the router. A rogue DHCP server can assign the router's IP address to another client, causing intermittent connectivity loss. During the conflict, the router cannot respond to traffic, which explains why pinging the default gateway fails from the router but succeeds from the core switch (which may have a cached ARP entry or be on a different VLAN).

Answer

A misconfigured DHCP server on the network

Answer

A spanning tree protocol convergence loop

Answer

A faulty network cable causing CRC errors

Question 12

A technician connects a workstation to a switch port configured for VLAN 30. The network uses DHCP servers located on VLAN 10. After connecting, the workstation receives an APIPA address (169.254.x.x). The technician verifies that the Ethernet cable is functional and the switch port link light is solid. Other workstations on the same switch, connected to ports in VLAN 10, obtain valid IP addresses. Which of the following is the MOST likely cause of the issue?

Accepted Answer

The workstation is not receiving a DHCP offer because it is on a different VLAN than the DHCP server. The workstation is on VLAN 30, but the DHCP server resides on VLAN 10. By default, DHCP broadcasts (using UDP port 67/68) are not forwarded across VLANs unless a DHCP relay agent (IP helper-address) is configured on the VLAN 30 interface. Without that relay, the workstation never receives a DHCP offer, so it falls back to an APIPA address (169.254.x.x per RFC 3927).

Answer

The switch port is configured as a trunk port

Answer

The network cable is faulty

Answer

The workstation's NIC driver is outdated

Question 13

A technician configures a new workstation on a managed switch port. The workstation successfully obtains an IP address from the DHCP server and can ping its own IP address as well as the default gateway. However, it cannot ping any other workstations on the same subnet. The technician has verified that the Ethernet cable is good and the switch port link is up. Which of the following should the technician check NEXT?

Accepted Answer

The VLAN assignment on the switch port. The workstation can obtain an IP address and ping the default gateway, indicating Layer 3 connectivity to the local subnet is functional. The inability to ping other workstations on the same subnet suggests a Layer 2 isolation issue, most commonly caused by the switch port being assigned to a different VLAN than the other workstations. VLANs segment broadcast domains, so devices in different VLANs cannot communicate directly without a router, even if they share the same IP subnet.

Answer

The DNS server settings

Answer

The workstation's subnet mask

Answer

The speed and duplex settings on the switch port

Question 14

A user reports that their laptop cannot access the internet but can still access shared files on the local network. The technician runs ipconfig and sees an IP address of 169.254.15.32. Which of the following is the MOST likely cause of this issue?

Accepted Answer

The DHCP server is unavailable. The IP address 169.254.15.32 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP server is unavailable and the client fails to obtain a lease. Since the laptop can still access local shared files, the local network is functional, but without a valid DHCP-assigned IP, it cannot reach external networks or the internet. This directly points to the DHCP server being unavailable.

Answer

The DNS server is not responding

Answer

The default gateway is misconfigured

Answer

The subnet mask is incorrect

Question 15

A technician connects a new workstation to a switch port that is configured with port security and a maximum of one MAC address. After connecting the workstation, the port link LED remains off. The technician has verified the Ethernet cable is good, the switchport is not administratively down, and the workstation's NIC is functioning. Which of the following is the MOST likely cause?

Accepted Answer

The workstation's MAC address violates port security, causing the port to error-disable. Port security with a maximum of one MAC address will place the port into an error-disabled state if a MAC address violation occurs, such as when the workstation's MAC address differs from the one already learned or when the port detects a new MAC after the limit is reached. The link LED being off indicates the port is administratively up but not operational, which is consistent with an error-disabled condition caused by a security violation. Since the cable, switchport status, and NIC are verified good, the most likely cause is that the workstation's MAC triggered a port security violation, disabling the port.

Answer

The switchport is configured for a different VLAN than the workstation

Answer

The switch requires a reboot to recognize the new workstation

Answer

The workstation has a duplicate IP address on the network