100-150 Practice Test 15 — 15 Questions

Question 1

A user at a branch office receives a phone call from someone claiming to be a help desk technician. The caller already knows the user's employee ID, manager's name, and the model of laptop issued to the user, and asks the user to read back the six-digit code that was just texted to their phone so the technician can 'verify the device.' The user complies, and minutes later the attacker logs into the corporate VPN using the user's credentials. Which type of attack has occurred?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Vishing. The attacker used a telephone call, impersonated support staff, and leveraged previously gathered personal details to pressure the user into revealing a one-time password. That combination of voice channel plus pretexting plus credential harvesting is the textbook definition of vishing. The texted code was genuine, so no SMS link was clicked and no wireless or in-path manipulation occurred.

Answer

Evil twin

Answer

On-path attack

Answer

Smishing

Question 2

A small office has a single Cisco wireless router providing both employee and guest access. The manager wants guests to reach the internet but must not be able to reach the internal file server or the printer on the office LAN. Which feature should be enabled on the wireless router to meet this requirement?

Accepted Answer

Guest SSID mapped to a separate VLAN with an ACL that blocks access to internal subnets. Guests need internet access without any path to internal resources. Placing guest traffic on a dedicated VLAN and applying an ACL that denies access to internal subnets enforces that boundary at the network layer. Encryption, MAC lists, and SSID hiding all control who joins the wireless network, not what an already-connected guest can reach, so only proper segmentation solves the problem.

Answer

WPA2-Personal with a strong pre-shared key on the guest network

Answer

Disabling SSID broadcast on the guest wireless network

Answer

MAC address filtering with a list of approved guest devices

Question 3

A network engineer is deploying a fiber-optic link between two buildings 550 meters apart. The engineer selects 1000BASE-SX multimode fiber with a wavelength of 850 nm. Which statement accurately describes the expected performance or limitation of this choice?

Accepted Answer

1000BASE-SX supports distances up to 550 meters on 50-micron multimode fiber, so the link should operate correctly if the fiber meets that specification.. 1000BASE-SX is specified for 850 nm transmission over multimode fiber, with a maximum reach of 550 meters on 50-micron multimode fiber. Because the buildings are exactly 550 meters apart, the link is at the limit but still within the standard. The engineer must confirm the fiber core size and modal bandwidth to ensure the link operates reliably.

Answer

1000BASE-SX uses a 1310 nm wavelength and can reach 550 meters on single-mode fiber only.

Answer

1000BASE-SX cannot be used for inter-building links because it is limited to 100 meters regardless of fiber type.

Answer

1000BASE-SX supports distances up to 10 kilometers on single-mode fiber, so the engineer should use single-mode instead.

Question 4

A user reports that they cannot access any websites by name, but they can access websites by typing their IP addresses directly into the browser. The user's computer has a valid IP address, subnet mask, and default gateway, and can ping the default gateway successfully. Which is the most likely cause of the problem?

Accepted Answer

The DNS server address is misconfigured on the user's computer.. The ability to access websites by IP address but not by name is a classic symptom of DNS resolution failure. The user's computer can route traffic to the internet (since IP access works), but it cannot resolve domain names to IP addresses. This points to a misconfigured DNS server address, an unreachable DNS server, or a DNS service issue. Checking the DNS settings and testing resolution with nslookup or ping by name would confirm the diagnosis.

Answer

The default gateway is down.

Answer

The web browser is configured with a proxy server that is offline.

Answer

The user's computer has an incorrect subnet mask.

Question 5

A network administrator is troubleshooting a workstation that cannot access network resources. The administrator runs the command arp -a and sees an incomplete entry for the default gateway. Which two actions should the administrator take to resolve the issue? (Choose two.)

Accepted Answer

Check the physical connection and link status on the workstation's network interface.. An incomplete ARP entry for the default gateway indicates the workstation cannot learn the gateway's MAC address. This can be due to an incorrect gateway IP configuration or a physical link problem. Verifying the gateway address and checking the physical connection are the two most direct actions to identify and resolve the issue. Other steps like DNS cache flush or traceroute do not address Layer 2 ARP resolution.

Answer

Restart the workstation to force a new DHCP lease.

Answer

Clear the DNS cache using ipconfig /flushdns.

Answer

Run a traceroute to the default gateway to identify the failing hop.

Question 6

A network administrator is reviewing a Cisco switch configuration and sees that a port in the employee area has been configured with the 'switchport port-security' command and a maximum of one MAC address. A user unplugs their laptop and connects a different laptop to the same port. Assuming the default violation mode, what happens?

Accepted Answer

Frames from the new laptop are dropped and a violation counter is incremented.. When port security is enabled with the default settings, the violation mode is restrict. A second MAC address on a port limited to one secure address triggers a violation, and the switch drops the frames from the offending device while keeping the port operational. The violation counter increments and logging may occur, but the interface is not disabled unless shutdown mode is explicitly configured.

Answer

The port is placed into a VLAN that quarantines the new device.

Answer

The port shuts down and must be manually re-enabled or recovered.

Answer

The new laptop is allowed but its MAC address replaces the existing secure MAC.

Question 7

A technician is troubleshooting a workstation that cannot reach the network. The workstation's NIC shows a link light, but the switch port statistics indicate a high number of FCS errors and late collisions. The cable run is approximately 120 meters of Cat 5e UTP. Which is the most likely cause of the problem?

Accepted Answer

The cable exceeds the maximum supported distance for Ethernet, causing signal degradation and errors.. Ethernet over Cat 5e UTP is limited to 100 meters. A 120-meter run exceeds this limit, causing attenuation and signal distortion that produce FCS errors and late collisions. While duplex mismatch can also cause late collisions, the explicitly stated cable length makes the distance violation the most likely and direct cause. The technician should shorten the run or insert a repeater.

Answer

The switch port is configured with port security and has shut down due to a MAC address violation.

Answer

The workstation NIC is configured for half-duplex while the switch port is set to full-duplex.

Answer

The cable is a crossover cable instead of a straight-through cable.

Question 8

A security team is reviewing how to protect a small office network from common Layer 2 attacks. The team wants to implement features that specifically prevent MAC address table overflow and ARP cache poisoning. Which two Cisco switch features should the team deploy? (Choose two.)

Accepted Answer

Port security to limit MAC addresses per port. MAC address table overflow attacks are mitigated by port security, which caps the number of source MAC addresses a port can learn and takes a configured action on violation. ARP cache poisoning is mitigated by Dynamic ARP Inspection, which validates ARP packets against the DHCP snooping binding table and drops spoofed mappings. Together they address both attack types named in the scenario.

Answer

Storm control to limit broadcast traffic

Answer

BPDU Guard to disable ports receiving BPDUs

Answer

Root Guard to prevent rogue root bridge election

Question 9

A network administrator is troubleshooting a workstation that cannot communicate with any other device on the network. The administrator runs 'ipconfig' and sees that the workstation has an IP address of 169.254.10.20 with a subnet mask of 255.255.0.0. The workstation is connected to a switch port that is up and forwarding. Which is the most likely explanation for the workstation's inability to communicate?

Accepted Answer

The workstation failed to obtain an IP address from a DHCP server.. The IP address 169.254.10.20 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when it cannot contact a DHCP server. This means the workstation did not receive a valid IP configuration. Without a proper IP address and default gateway, it cannot communicate with other devices. The switch port being up and forwarding confirms physical connectivity, so the issue is DHCP-related, such as a DHCP server outage or a VLAN misconfiguration preventing DHCP requests from reaching the server.

Answer

The workstation has a static IP address that conflicts with another device.

Answer

The workstation's NIC is faulty and cannot transmit frames.

Answer

The switch port is configured for the wrong VLAN.

Question 10

A technician is troubleshooting a workstation that cannot connect to the network. The workstation has a valid IP address, subnet mask, and default gateway. The technician can ping the default gateway but cannot ping a server on a remote subnet. Which two commands should the technician use to further isolate the problem? (Choose two.)

Accepted Answer

ping <remote server IP>. The technician can reach the default gateway but not a remote server, indicating a problem beyond the local subnet. Using tracert will show the path and identify the last hop that responds, narrowing down where packets are dropped. Repeating the ping to the remote server confirms the failure is consistent. Together, these commands help isolate whether the issue is with an intermediate router, a routing table, or the destination network.

Answer

nslookup <remote server hostname>

Answer

ping <default gateway IP>

Answer

ipconfig /all

Question 11

A network administrator is troubleshooting a connectivity issue between two devices on the same VLAN. The administrator suspects a duplex mismatch on a switch port. Which command should be used on the Cisco switch to verify the duplex settings and error statistics on the interface?

Accepted Answer

show interfaces. A duplex mismatch often results in performance degradation and specific error counters such as late collisions, FCS errors, and runts. The show interfaces command provides a comprehensive view of the interface status, including duplex mode and error statistics. By checking these counters, the administrator can confirm whether a duplex mismatch is present and take corrective action, such as manually setting matching duplex settings on both ends.

Answer

show cdp neighbors

Answer

show running-config

Answer

show version

Question 12

A network administrator is deploying a new Cisco switch in a small office and wants to apply basic security hardening to protect the management plane. The administrator plans to restrict remote access and prevent unauthorized configuration changes. Which two actions should the administrator take to secure management access to the switch? (Choose two.)

Accepted Answer

Configure a strong enable secret and use local usernames with privilege levels for authentication.. Securing the management plane requires strong authentication and restricted access. Configuring an enable secret with local usernames and privilege levels ensures only authenticated administrators can reach privileged EXEC mode. Applying an access list to the VTY lines limits remote management sessions to trusted source subnets. Together these controls protect the switch from unauthorized configuration changes and remote access attempts.

Answer

Assign the management VLAN to an unused access port and leave it in the default VLAN 1.

Answer

Enable Telnet on all VTY lines so that administrators can manage the switch from any network segment.

Answer

Configure the switch to use the default enable password with no secret so that recovery is easier.

Question 13

A technician is troubleshooting a wireless client that associates successfully with an access point but cannot obtain an IP address from the DHCP server on the wired network. The access point is configured with a management IP on the correct VLAN, and other wired clients on that VLAN obtain leases normally. Which is the MOST likely cause?

Accepted Answer

The wireless client is associated to an SSID mapped to a VLAN that is not trunked to the access point.. When a wireless client associates but never receives a DHCP lease while wired clients on the same VLAN work, the fault lies between the access point and the wired network. The most common cause is that the VLAN mapped to the SSID is not allowed on the trunk uplink, so the client's broadcast DHCP request cannot reach the server. Verifying the trunk configuration resolves the issue.

Answer

The access point's radio is operating on a channel with high interference from neighboring APs.

Answer

The DHCP server's scope for the wired VLAN has run out of available leases.

Answer

The wireless client has an incorrect DNS server address configured manually.

Question 14

A network engineer is investigating why a switch port Gi1/0/5 is not forwarding traffic, even though the connected device is powered on and the cable is known to be good. The engineer runs 'show interfaces Gi1/0/5 switchport' and sees that the administrative mode is dynamic auto, and the operational mode is access. The port status is 'notconnect'. Which is the most likely reason the port is not forwarding?

Accepted Answer

The connected device's network interface card is not transmitting a link signal.. The 'notconnect' status on a switch port indicates that the physical link is down. Since the cable is known good and the device is powered on, the most likely cause is that the connected device's NIC is not sending a link signal. This could be due to a disabled NIC, faulty NIC, or driver issue. The administrative mode being dynamic auto and operational mode access are not causing the link failure; they only affect VLAN and trunking behavior once a link is established.

Answer

The switch port is configured with the wrong speed and duplex settings.

Answer

The port is in an err-disabled state due to a violation.

Answer

The port is configured as a trunk and the connected device is sending untagged frames.

Question 15

A security analyst notices that an attacker on the same VLAN as a user is sending forged ARP replies so that the user's traffic to the default gateway is redirected through the attacker's workstation. The switch is a Cisco Catalyst with DHCP snooping already configured and working. Which feature should the analyst enable to block this specific attack?

Accepted Answer

Dynamic ARP Inspection on the user VLAN. The attack is ARP cache poisoning, where forged replies redirect a victim's traffic. Dynamic ARP Inspection, which relies on the DHCP snooping binding table to validate ARP packets on untrusted ports, is designed specifically to drop such forgeries. Because DHCP snooping is already in place, DAI can be enabled on the user VLAN with minimal additional configuration, making it the correct mitigation.

Answer

Port security with a maximum of one MAC address per port

Answer

BPDU Guard on all access ports

Answer

Storm control configured to limit broadcast traffic