Cisco · Free Practice Questions · Last reviewed May 2026
36 real exam-style questions organised by domain, each with the correct answer highlighted and a plain-English explanation of why it's right — and why the others are wrong.
A network technician is troubleshooting a connectivity issue where a workstation can communicate with local devices but cannot access any resources on a different subnet. After verifying the IP address and subnet mask, which component should be investigated next to ensure the packet can leave the local segment?
The MAC address table of the local access switch.
The default gateway address configured on the workstation.
The default gateway is the IP address of the router interface that connects the local subnet to the rest of the network. If this address is missing or incorrectly configured, the workstation will not know where to send packets destined for remote networks, effectively trapping all communication within the local broadcast domain.
The physical layer integrity of the crossover cable.
The DNS server settings for name resolution.
An organization is upgrading its cabling infrastructure to support Gigabit Ethernet over a distance of 85 meters. Which twisted-pair cable category is the minimum requirement to reliably support 1000 Mbps speeds at this specific distance?
Category 3 (Cat3)
Category 5 (Cat5)
Category 5e (Cat5e)
Category 5e is specifically enhanced to handle Gigabit Ethernet speeds up to 1000 Mbps over distances of 100 meters. It features tighter twists and better shielding against near-end crosstalk compared to standard Cat5. This makes it the most cost-effective minimum requirement for a standard office environment needing reliable Gigabit connectivity over 85 meters.
Category 2 (Cat2)
Which TWO characteristics distinguish the User Datagram Protocol (UDP) from the Transmission Control Protocol (TCP)?
UDP provides connectionless communication without a handshake.
UDP does not establish a formal session before sending data, which reduces latency and overhead. This connectionless nature means that the sender simply transmits packets to the destination without verifying if the receiver is ready. This is ideal for time-sensitive applications like VOIP or online gaming where speed is a primary concern.
UDP uses sequence numbers to reassemble data in the correct order.
UDP does not perform error recovery or retransmit lost packets.
Unlike TCP, which uses acknowledgments and timeouts to detect and retransmit lost data, UDP simply discards corrupted or missing packets. This lack of reliability makes it much faster because there is no need to wait for acknowledgments or manage retransmission buffers, making it suitable for protocols like DNS and DHCP.
UDP operates at the Network Layer of the OSI model.
UDP includes a three-way handshake to ensure delivery.
Which THREE statements accurately describe the functions of a Layer 2 switch in a local area network?
Switches use MAC addresses to make forwarding decisions.
A Layer 2 switch examines the destination MAC address of an incoming frame to determine which physical port it should be sent out. This process is much faster and more efficient than using Layer 3 IP addresses, as it happens in specialized hardware known as Application-Specific Integrated Circuits (ASICs) within the switch.
Switches create a separate collision domain for each port.
Each port on a switch operates as its own collision domain, typically in full-duplex mode. This means that two devices can send and receive data simultaneously without their signals interfering with one another. This is a primary advantage over legacy hubs, where all devices shared a single collision domain and frequently encountered data collisions.
Switches route traffic between different VLANs using IP addresses.
Switches flood broadcast frames out of all ports except the source port.
When a switch receives a broadcast frame (destination MAC FF:FF:FF:FF:FF:FF), it must ensure all devices in the VLAN receive it. To do this, the switch replicates the frame and sends it out of every active port except the one where it arrived. This ensures that services like ARP and DHCP can function properly.
Switches perform deep packet inspection to filter malicious traffic.
A network administrator is implementing IPv6 in a corporate environment. Which TWO address types are commonly used to facilitate local link communication and global internet access respectively?
Link-Local Address (FE80::/10)
Link-local addresses are automatically generated by every IPv6-enabled interface. They are used for communication between devices on the same local link and for neighbor discovery protocols. These addresses are not routable beyond the local segment, making them perfect for internal overhead tasks and initial configuration before a global address is assigned.
Unique Local Address (FC00::/7)
Global Unicast Address (2000::/3)
Global Unicast Addresses (GUAs) are globally unique and routable on the public internet. They allow devices to communicate directly with any other IPv6-enabled device worldwide without the need for Network Address Translation (NAT). These addresses are typically assigned by an ISP and are the primary way enterprise networks provide external connectivity.
Multicast Address (FF00::/8)
Loopback Address (::1/128)
Which layer of the OSI model is responsible for determining the best physical path for data to travel across multiple interconnected networks using logical addressing?
Data Link Layer (Layer 2)
Transport Layer (Layer 4)
Network Layer (Layer 3)
The Network Layer is specifically designed for routing and logical addressing. It uses IP addresses to identify devices across different subnets and employs routing protocols to determine the optimal path for packets to reach their destination. This layer provides the connectivity and path selection logic that allows the internet to function as a collection of networks.
Physical Layer (Layer 1)
Want more Standards and Concepts practice?
Practice this domainAn administrator needs to subnet the 192.168.10.0/24 network into subnets that support at least 25 hosts each. Which CIDR mask provides the most efficient use of addresses while meeting the requirement?
/25
/26
/27
A /27 mask provides 30 usable host addresses. This is the smallest possible subnet size that accommodates 25 hosts, adhering to the requirement for maximum efficiency. It leaves only 5 addresses wasted per subnet, which is the optimal mathematical balance for this specific host count requirement.
/28
Which TWO of the following statements regarding IPv6 address representation are accurate?
The double-colon (::) can be used multiple times in a single IPv6 address to shorten it.
Leading zeros in a 16-bit field can be omitted.
The IPv6 specification allows for the omission of leading zeros within each hexadecimal quartette. For example, 0db8 becomes db8. This convention significantly reduces the length of written addresses, making them easier for network administrators to manage, read, and type into device configuration files without introducing errors.
An IPv6 address must always be written in full 32-character hexadecimal format.
The double-colon (::) represents one or more groups of 16-bit fields containing all zeros.
The double-colon is the designated shorthand for a contiguous string of zero-valued fields. This notation is essential for shortening long strings of zeros, such as in link-local or unique local addresses. It streamlines the input process and is the standard way to reference unspecified addresses in configurations.
Trailing zeros in a 16-bit field can be omitted.
Refer to the exhibit. An administrator is reviewing the interface configuration. Which statement regarding these subnets is true?
The subnets overlap, causing a routing conflict.
The subnets are contiguous and correctly separated by 16 addresses each.
Each /28 subnet consumes 16 addresses (2^4). Starting at .0, the next block begins at .16, and the following at .32. This represents a perfect, non-overlapping contiguous addressing scheme, which is standard practice for hierarchical network design and ensures efficient routing table management on the Cisco router.
The configuration will fail because the IP addresses are not on the same network.
The mask /28 is invalid for these specific IP addresses.
What is the decimal equivalent of the subnet mask 255.255.255.224?
/25
/26
/27
A /27 mask means 27 bits are set to one. The first three octets are 24 bits. The last octet has 3 bits set (11100000), resulting in 224. This matches the provided decimal mask, confirming that /27 is the correct CIDR prefix for this network segment configuration.
/28
Which THREE of the following are valid private IPv4 address ranges as defined in RFC 1918?
10.0.0.0/8
The 10.0.0.0/8 block is the largest private address range, spanning from 10.0.0.0 to 10.255.255.255. It is commonly used in enterprise environments to facilitate internal communication across large-scale distributed networks without the need for public IP address registration for every internal host on the network.
172.16.0.0/12
The 172.16.0.0/12 block ranges from 172.16.0.0 to 172.31.255.255. This is a well-known private range frequently used by ISPs and large organizations. Recognizing this range is essential for configuring internal subnets and avoiding overlap with public IP addresses when designing a robust and scalable internal corporate network.
192.168.0.0/16
The 192.168.0.0/16 block is the most common private range, spanning 192.168.0.0 to 192.168.255.255. It is widely used for home routers and small office/home office (SOHO) setups. Identifying this range is critical for basic network troubleshooting, as it is the default for millions of consumer networking devices worldwide.
127.0.0.0/8
224.0.0.0/4
A network engineer needs to allocate a subnet for a link connecting two routers. Which prefix provides the most efficient addressing for a point-to-point connection?
/24
/28
/29
/30
A /30 mask provides exactly two usable host addresses, which is the perfect amount for a point-to-point router connection. It eliminates address wastage and is the industry-standard prefix for serial or Ethernet links connecting two devices directly, making it the most efficient choice for this specific networking scenario.
Want more Addressing and Subnet Formats practice?
Practice this domainA network administrator observes that a workstation cannot ping its default gateway. The physical link light is active, and the local IP configuration appears correct. Which diagnostic step should be performed first to isolate the layer 2 connectivity issue?
Perform a traceroute to the internet gateway.
Flush the DNS cache on the workstation.
Check the ARP table for the gateway IP address.
Checking the ARP table is critical for determining if the host can map the gateway IP to a physical MAC address. If the entry is incomplete or missing, it indicates a failure in layer 2 frames reaching the gateway, suggesting a VLAN mismatch or blocked port on the switch.
Reboot the switch connected to the workstation.
A user reports intermittent connectivity to the internal server. Which TWO commands are most useful to identify if the issue is caused by physical layer flapping or interface errors?
show interfaces
This command displays the status of the interface including CRC errors, runts, and collisions. High counts of these errors indicate a faulty cable, bad transceiver, or duplex mismatch, which are primary causes of intermittent connectivity. It is the fundamental starting point for diagnosing physical layer degradation in Cisco environments.
show ip route
show logging
This command displays system events including interface line protocol state transitions. If a port is flapping, the log will show repetitive 'up' and 'down' messages with timestamps. This historical data is essential for determining if the connectivity issue is due to a physical cabling fault or hardware failure.
show ip arp
show ip protocols
A user cannot reach a web server. You perform a ping and it fails, but a traceroute shows the packets reaching the last hop before the server. What does this indicate?
The intermediate router is down.
The destination server is likely unreachable or blocking ICMP.
Reaching the final hop indicates the network path is valid. If the ping fails at the final hop, the server is either dropping ICMP packets via a firewall or the server process itself is non-responsive. This isolates the problem to the destination host's configuration rather than the network infrastructure.
The default gateway is misconfigured.
The DNS server is down.
Which tool is best suited for identifying a slow network segment caused by excessive broadcast traffic?
Cisco DNA Center.
Protocol analyzer.
A protocol analyzer, such as Wireshark, allows for the inspection of packet headers and traffic statistics. It is the ideal tool for detecting excessive broadcast or multicast traffic by analyzing the frame distribution, which helps pinpoint the source of congestion or loops within a local area network segment.
SNMP Manager.
TDR cable tester.
Refer to the exhibit. What is the most likely cause of poor performance on this link?
The interface has a duplex mismatch.
The link is experiencing excessive congestion.
When the input traffic rate exceeds the interface's bandwidth, the link becomes congested. This results in buffer overflows and packet drops as the device cannot egress the traffic fast enough. The provided statistics clearly show that the input traffic far exceeds the physical limitations of the port.
The cable is faulty and causing retransmissions.
The interface MTU is configured incorrectly.
When a network administrator uses the 'ping' command to test connectivity, what is the primary purpose of the ICMP 'Echo Request' and 'Echo Reply' process?
To establish a TCP session for data transfer.
To verify reachability and basic network connectivity.
The primary goal of the ICMP echo mechanism is to check if a remote host is accessible. By sending an echo request, the administrator validates that the routing is correct, the destination is online, and the path back is also functioning, which confirms fundamental network connectivity.
To resolve a hostname to an IP address.
To encrypt packets for secure communication.
Want more Diagnosing Problems practice?
Practice this domainA network administrator needs to connect a workstation to a Cisco switch. Which cabling standard and medium should be utilized to ensure full-duplex communication while preventing collision domains?
Coaxial cable with half-duplex settings
Fiber optic cable with half-duplex settings
Category 6 twisted-pair cable with full-duplex settings
Category 6 twisted-pair cabling supports high-speed Ethernet standards and full-duplex operation, which allows simultaneous transmit and receive paths. By isolating these paths, collisions are eliminated, and the port operates as a point-to-point link, maximizing bandwidth utilization and throughput for the workstation.
Category 3 twisted-pair cable with full-duplex settings
Which device is primarily responsible for managing traffic between different IP subnets in a corporate network?
Layer 2 Switch
Hub
Router
A router acts as a gateway between subnets, analyzing the destination IP address of incoming packets against its routing table. It strips Layer 2 headers and rebuilds them to forward traffic toward the destination network, providing the essential connectivity required for multi-segment infrastructure.
Repeater
Which TWO functions are performed by a Cisco switch at the Data Link layer? (Choose two.)
Calculating the best path based on IP addresses
Forwarding frames based on destination MAC addresses
Switching operations rely on the MAC address table to map destination hardware addresses to specific ports. When a frame enters, the switch examines the destination MAC and directs the frame only to the appropriate physical interface, reducing traffic congestion across the local network.
Learning MAC addresses by inspecting ingress frames
Switches dynamically build their forwarding tables by inspecting the source MAC addresses of incoming frames. This learning process allows the switch to associate device addresses with specific physical ports, enabling precise delivery of future frames intended for those specific devices.
Translating between different network topologies
Encapsulating data packets into segments
Which THREE factors influence the selection of a specific router interface for traffic forwarding? (Choose three.)
Longest prefix match
The longest prefix match is the primary rule for routing decisions. When multiple routes match a destination IP, the router chooses the path with the most specific subnet mask, ensuring that traffic is directed to the most precise destination possible within the network hierarchy.
Source MAC address
Administrative distance
Administrative distance represents the trustworthiness of a routing source. When a router learns about the same network from multiple protocols, it selects the route with the lowest administrative distance, ensuring that more reliable information takes precedence over less trusted or less stable sources.
Metric value
Metrics are used to compare multiple paths learned via the same routing protocol. A lower metric indicates a more efficient or desirable path based on parameters like bandwidth or delay, allowing the router to select the optimal exit interface when several paths are available.
Switching fabric capacity
An administrator wants to implement a security policy that prevents unauthorized devices from accessing the network via open switch ports. Which feature should be enabled to achieve this?
VLAN Trunking Protocol
Port Security
Port security allows an administrator to define specific allowed MAC addresses or limit the count of devices per port. If a violation occurs, the switch can shut down the port, effectively blocking unauthorized hardware and maintaining the integrity of the network access segment.
Spanning Tree Protocol
Dynamic ARP Inspection
Which primary benefit does the implementation of VLANs provide to a corporate network infrastructure?
Increased physical cabling requirements
Reduction of broadcast domain size
VLANs segment a physical switch into isolated logical broadcast domains. This restricts the scope of broadcast frames to only those ports assigned to the same VLAN, significantly reducing network overhead and preventing performance degradation caused by excessive background traffic on large networks.
Automatic encryption of all traffic
Elimination of the need for routers
Want more Infrastructure practice?
Practice this domainA network administrator needs to prevent unauthorized devices from connecting to switch ports. Which feature provides the most effective Layer 2 security by verifying the MAC address of the connected device against a database?
DHCP Snooping
BPDU Guard
Port Security
Port Security enables the restriction of input to an interface by limiting and identifying the MAC addresses of the stations allowed to access the port. This provides granular control over physical access, ensuring that only pre-approved hardware can establish a link and transmit data through the switch port.
Dynamic ARP Inspection
Which TWO of the following are primary security benefits of implementing an Access Control List (ACL) on a Cisco router interface?
Encrypting sensitive data traffic
Restricting unauthorized network access
ACLs provide a way to define explicit rules that permit or deny traffic based on IP addresses or protocols. By applying these lists to interfaces, you effectively restrict access to network resources, ensuring that only authorized traffic flows between specified endpoints, thus hardening the network against intruders.
Limiting traffic based on specific criteria
ACLs allow network engineers to filter traffic based on source, destination, port numbers, and protocol types. This capability is foundational for controlling traffic flow and ensuring that only necessary communication occurs, which minimizes the attack surface and enforces organizational security policies across the network infrastructure.
Automatically updating firmware
Providing hardware redundancy
Refer to the exhibit. What is the expected behavior if a second device with a different MAC address is plugged into this port?
The port will remain up and drop the traffic.
The port will move to err-disabled state.
The 'violation shutdown' command explicitly causes the interface to transition to the err-disabled state upon a MAC address limit breach. This is a secure default that forces the port to stop passing all traffic until the administrator intervenes, ensuring unauthorized devices cannot gain network access.
The port will alert the console but stay active.
The switch will replace the existing MAC.
Which protocol is recommended for secure remote management of Cisco network devices over insecure networks?
Telnet
HTTP
SSH
SSH is the industry-standard protocol for secure remote access. It uses public-key cryptography to authenticate the remote computer and encrypt the data being transferred. This prevents eavesdropping and ensures that administrative commands and credentials remain private while traversing potentially untrusted or public network segments.
SNMPv1
An organization wants to implement a security policy that requires users to authenticate against a centralized server before gaining network access. Which protocol provides the necessary AAA framework to achieve this?
ICMP
RADIUS
RADIUS is a widely used AAA protocol that provides centralized authentication, authorization, and accounting for network access. It allows network devices to delegate authentication to a central server, ensuring that users are properly verified before being granted network resources, which is a standard requirement for secure enterprise access.
DHCP
DNS
Which security threat involves an attacker sending unsolicited and massive amounts of traffic to a network service to make it unavailable to legitimate users?
Phishing
Denial of Service
A Denial of Service attack is explicitly intended to render a network, application, or service unavailable by overwhelming it with an excessive amount of traffic or requests. This consumes critical infrastructure resources such as CPU, memory, or bandwidth, effectively blocking legitimate users from accessing the system.
Man-in-the-Middle
MAC Spoofing
Want more Security practice?
Practice this domainA network technician is tasked with connecting two distribution switches located in separate buildings 500 meters apart. Which media type should be selected to ensure reliable connectivity and high bandwidth without the need for repeaters?
Category 6 UTP cabling
Single-mode fiber optic cabling
Single-mode fiber uses a laser light source and a narrow core to transmit data over very long distances, often exceeding 10 kilometers. It is the ideal choice for this 500-meter span because it provides high bandwidth, low signal loss, and total immunity to any external electromagnetic interference between buildings.
Shielded Twisted Pair (STP) cabling
Category 5e crossover cabling
A junior technician is organizing a box of fiber optic patch cords. Which TWO connector types are commonly used to terminate modern fiber optic media? (Choose TWO.)
RJ-45
LC (Lucent Connector)
The LC connector is a small form-factor fiber optic connector that uses a 1.25mm ferrule. It is highly popular in high-density environments because its size allows for more ports on a switch faceplate or patch panel, and it features a locking tab similar to an RJ-45.
BNC
SC (Subscriber Connector)
The SC connector is a square-shaped fiber connector that uses a push-pull latching mechanism to ensure a secure connection. It is widely used for both single-mode and multi-mode fiber applications and was the standard for many years before the smaller LC connector gained widespread enterprise adoption.
F-type
Refer to the exhibit. A technician is troubleshooting a connection between a Cisco switch and a server. Based on the output, what is the most likely cause of the 'line protocol is down' status?
The physical cable is disconnected.
A duplex or speed mismatch exists.
A 'line protocol is down' status often results from a duplex mismatch where one side is hard-coded to full-duplex and the other is set to half-duplex. This prevents the successful exchange of frames at the Data Link layer, even though the physical layer detects a valid signal.
The switch port has been administratively disabled.
The MAC address on the server is incorrect.
A company is experiencing intermittent network drops in a manufacturing area where unshielded twisted-pair (UTP) cables are run parallel to high-voltage power lines. What is the most effective solution to resolve this issue?
Upgrade the cabling to Category 6a UTP.
Install a wireless bridge between endpoints.
Replace UTP with Shielded Twisted Pair (STP).
Shielded Twisted Pair (STP) cabling includes a metallic foil or braid that surrounds the internal conductors to block external electromagnetic interference. By grounding the shield properly, the electrical noise from the power lines is diverted, protecting the data signals and preventing the intermittent drops experienced with UTP.
Configure the switch ports for half-duplex.
A network administrator is designing a wireless deployment for an office. Which TWO frequency bands are most commonly used by standard Wi-Fi endpoints to transmit data? (Choose TWO.)
2.4 GHz
The 2.4 GHz band is the most widely supported frequency for Wi-Fi, offering excellent range and the ability to pass through solid objects like walls. However, it is prone to interference from non-Wi-Fi devices such as microwaves and Bluetooth, making it more congested in crowded office environments.
900 MHz
5 GHz
The 5 GHz band supports faster data speeds and has more available channels than the 2.4 GHz band, which significantly reduces interference. Most modern enterprise Wi-Fi deployments prioritize the 5 GHz band to ensure high-performance connectivity for data-intensive applications and high-density endpoint environments.
60 GHz
10 GHz
An office uses Power over Ethernet (PoE) to provide power to IP phones. Which device is responsible for acting as the Power Sourcing Equipment (PSE) in this scenario?
The IP Phone
The DHCP Server
The PoE-capable Switch
A PoE-capable switch acts as the Power Sourcing Equipment (PSE) by detecting if a connected device requires power and then delivering it safely over the UTP cable. This eliminates the need for separate power adapters at each desk, simplifying deployment and management of network endpoints.
The Patch Panel
Want more Endpoints and Media Types practice?
Practice this domainThe vendor does not publish an exact question count for the 100-150; the exam lasts 50 minutes. Always confirm current details on the vendor's official exam page.
CLI output interpretation, network topology analysis, routing behaviour, switching concepts, troubleshooting, and configuration questions.
The exam covers 6 domains: Standards and Concepts, Addressing and Subnet Formats, Diagnosing Problems, Infrastructure, Security, Endpoints and Media Types. Questions are weighted by domain — higher-weight domains appear more on your actual exam.
No. These are original exam-style practice questions written against the official Cisco 100-150 exam objectives. They are not copied from the real exam. Courseiva focuses on genuine understanding, not memorisation of braindumps.
Courseiva tracks your accuracy per domain and routes you toward weak areas automatically. Free, no account required.