100-150 Practice Test 16 — 15 Questions

Question 1

A company's IT policy states that only members of the finance group may access the payroll application, and that all access to it must be logged. A technician is asked to enforce this at the network level. Which concept does this requirement primarily describe?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Confidentiality and accountability through access control and logging. Limiting payroll access to the finance group enforces confidentiality by preventing unauthorized viewing of sensitive records. Logging every access provides accountability, since actions can be traced to specific users. These two objectives, implemented through access control lists, authentication, and audit logging, are what the policy describes at the network level, making them the best match for the requirement.

Answer

Availability through redundant links and failover

Answer

Integrity through cryptographic hashing of the payroll database

Answer

Non-repudiation through digital certificates on user workstations

Question 2

An attacker on the same subnet sends frames with forged source MAC addresses to overwhelm a switch's MAC address table, causing the switch to flood unicast traffic out all ports. Which switch feature should be enabled to prevent this behavior on access ports?

Accepted Answer

Port security with a maximum MAC address limit. MAC flooding works by sending frames with many different source MAC addresses so the switch's limited address table fills with bogus entries, forcing unknown unicast frames to be flooded. Port security caps the number of MAC addresses a port may learn and can take a protective action when the limit is exceeded, directly preventing this overflow.

Answer

Dynamic ARP Inspection

Answer

Root Guard

Answer

BPDU Guard

Question 3

A security administrator is reviewing logs and notices that an attacker on the internal network is sending forged ARP replies claiming to be the default gateway. The attacker's goal is to intercept traffic from multiple hosts. The switches in the network already have DHCP snooping enabled on the user VLAN. Which additional Cisco feature should the administrator enable to block the forged ARP replies?

Accepted Answer

Dynamic ARP Inspection. Dynamic ARP Inspection inspects ARP packets on untrusted ports and compares them to the DHCP snooping binding table. Forged ARP replies claiming the gateway IP with a different MAC are dropped, preventing ARP cache poisoning. IP Source Guard filters IP packets, port security limits MAC addresses, and Private VLANs segment traffic, but none of them validate ARP payloads against a trusted binding table.

Answer

Private VLANs

Answer

Port security with sticky MAC addresses

Answer

IP Source Guard

Question 4

A network administrator is configuring a point-to-point WAN link between two Cisco routers. To conserve IPv4 address space, the administrator decides to use a /30 subnet mask on the serial interface. Which of the following best describes the number of usable host addresses provided by this subnet mask?

Accepted Answer

2 usable host addresses. A /30 subnet mask provides 2 usable host addresses because it allocates 2 host bits, resulting in 4 total addresses minus the network and broadcast addresses. This is the standard choice for point-to-point WAN links, conserving address space while ensuring both routers have a unique IP.

Answer

1 usable host address

Answer

4 usable host addresses

Answer

6 usable host addresses

Question 5

A network engineer is configuring IPv6 on a Cisco router interface. The engineer assigns the address 2001:db8:acad:1::1/64 to GigabitEthernet0/0. Which of the following statements is true regarding the interface's IPv6 configuration?

Accepted Answer

The interface will automatically generate a link-local address using the EUI-64 format.. When an IPv6 global unicast address is configured on a Cisco router interface, the interface automatically creates a link-local address using the EUI-64 format. This link-local address is mandatory for IPv6 operations, including neighbor discovery and routing protocols, and is generated without additional configuration.

Answer

The interface will use the global unicast address as its link-local address.

Answer

The interface will require manual configuration of a link-local address to enable IPv6.

Answer

The interface will not have a link-local address because only global unicast addresses are configured.

Question 6

A network engineer is troubleshooting connectivity on a host configured with the address 10.10.10.130/26. The host cannot reach a server at 10.10.10.200. Assuming no ACLs or routing issues, what is the most likely explanation?

Accepted Answer

The host and server are in different subnets, so the host must use its default gateway to reach the server.. The /26 mask splits the 10.10.10.0 range into blocks of 64 addresses. The host at 10.10.10.130 belongs to the 10.10.10.128 subnet, while the server at 10.10.10.200 belongs to the 10.10.10.192 subnet. Because they are on different subnets, the host must forward traffic through a default gateway. If the gateway is absent or wrong, communication fails even though both addresses are individually valid.

Answer

The server address 10.10.10.200 is the broadcast address of the host subnet and cannot be used.

Answer

The host address 10.10.10.130 is invalid because it falls in a reserved range within the /26 subnet.

Answer

The two devices are in the same subnet, so the server must be down or have a firewall blocking traffic.

Question 7

Refer to the exhibit. What is the result of applying this ACL to a router interface, and what is its implication for other traffic?

Accepted Answer

Permits only HTTP and blocks others.. The ACL permits HTTP traffic and implicitly denies everything else due to the 'deny ip any any' statement. This is a common 'whitelist' approach used to secure interfaces by allowing only necessary services. Understanding this logic is vital because every Cisco ACL has an implicit deny at the end; failing to explicitly permit required traffic will result in connectivity issues, making careful ACL planning essential for maintaining network functionality.

Answer

Permits all traffic including HTTP.

Answer

Permits all traffic except HTTP.

Answer

Allows all traffic by default.

Question 8

Which TWO protocols are commonly used to remotely manage Cisco network devices? (Choose two.)

Accepted Answer

SSH. Secure remote management is critical for operational efficiency and network security. Administrators use terminal emulation protocols to access the Command Line Interface (CLI) from anywhere on the network. While older methods were insecure, modern standards prioritize encryption, ensuring that administrative traffic remains protected against sniffing and credential theft during routine configuration or monitoring tasks in an enterprise environment.

Answer

Telnet

Answer

ICMP

Answer

SMTP

Question 9

Which THREE of the following are considered best practices for hardening a Cisco network device?

Accepted Answer

Disabling unused services and ports. Hardening a device is a continuous process of reducing the attack surface. Disabling unused services, using strong authentication, and physical security are foundational. These steps are crucial because many attacks exploit default configurations or legacy, insecure services. By proactively minimizing the services running on a device and enforcing rigorous access controls, administrators significantly lower the risk of unauthorized exploitation and ensure the device remains compliant with security standards.

Answer

Using Telnet for remote access

Answer

Configuring SNMPv1 with 'public' string

Question 10

Which THREE of the following are valid private IPv4 address ranges as defined in RFC 1918?

Accepted Answer

10.0.0.0/8. RFC 1918 defines specific address blocks reserved for private networks. These addresses are not routable on the public internet and are used internally to conserve public IPv4 address space. Technicians must be able to identify these ranges to configure NAT, DHCP, and internal routing policies accurately, as misusing public addresses in private ranges can lead to connectivity failures or security issues.

Answer

127.0.0.0/8

Answer

224.0.0.0/4

Question 11

Users in an office report that the wireless network is extremely slow during the middle of the day. A technician discovers a microwave oven and several 2.4GHz cordless phones in the breakroom near the Access Point. What is the cause of this performance issue?

Accepted Answer

Radio Frequency Interference (RFI) is degrading the signal.. Wireless networks using the 2.4GHz band are highly susceptible to electromagnetic interference from non-802.11 devices. Microwaves and cordless phones operate on similar frequencies, creating noise that disrupts Wi-Fi signals. This results in high packet loss and retransmissions, which the users perceive as slow speeds or intermittent connectivity during peak usage times.

Answer

The Access Point is experiencing a DHCP exhaustion attack.

Answer

The Access Point is configured with the wrong SSID.

Answer

The switch port connecting the Access Point is in half-duplex mode.

Question 12

Which TWO of the following statements are true regarding IPv4 and IPv6 coexistence?

Accepted Answer

Dual-stack enables a device to run IPv4 and IPv6 protocol stacks simultaneously.. As the industry transitions from IPv4 to IPv6, coexistence mechanisms are required. Dual-stack allows devices to run both protocols simultaneously, while tunneling encapsulates IPv6 packets within IPv4 headers. These methods ensure that legacy systems can still communicate while modern IPv6-enabled infrastructure is deployed, which is a critical skill for network administrators managing hybrid, multi-protocol corporate environments during the long-term industry shift.

Answer

IPv6 addresses are directly compatible with IPv4 routing tables.

Answer

IPv4 is natively supported by all IPv6-only devices.

Answer

Broadcast traffic is still required for IPv6 address resolution.

Question 13

A company is experiencing intermittent network drops in a manufacturing area where unshielded twisted-pair (UTP) cables are run parallel to high-voltage power lines. What is the most effective solution to resolve this issue?

Accepted Answer

Replace UTP with Shielded Twisted Pair (STP).. Electromagnetic Interference (EMI) occurs when electrical signals from power lines disrupt the data signals in copper cables. Replacing UTP with Shielded Twisted Pair (STP) or fiber optic cabling provides the necessary protection to maintain data integrity. Technicians must recognize environmental factors that degrade signal quality to ensure stable endpoint connectivity in industrial settings.

Answer

Upgrade the cabling to Category 6a UTP.

Answer

Install a wireless bridge between endpoints.

Answer

Configure the switch ports for half-duplex.

Question 14

A technician suspects a cable issue on a copper link. Which command should they use to check for electrical issues like shorts or opens?

Accepted Answer

test cable-diagnostics tdr interface <int>. The TDR (Time Domain Reflectometer) feature available on many modern Cisco switches allows the administrator to perform a diagnostic test on the physical copper cable. By sending a pulse of energy and measuring the reflection, the switch can accurately identify if there is an open or short circuit, or if the cable length is within operational limits, providing clear physical layer diagnostic data without additional hardware.

Answer

show cable status

Answer

ping -t <ip>

Answer

show interfaces summary

Question 15

A help desk technician is troubleshooting a user who can access internal network shares using an IP address but cannot reach the same shares using the server's hostname. Which network service should the technician investigate first?

Accepted Answer

DNS. DNS resolution translates human-readable hostnames into IP addresses required for routing across the network. When a user can reach internal services via IP but fails via hostname, the underlying network transport is functional, but the application-layer mapping service is failing. Diagnosing this involves checking the configured DNS server address on the client and verifying connectivity.

Answer

Default Gateway

Answer

DHCP

Answer

ARP