100-150 Practice Test 20 — 15 Questions

Question 1

A help desk technician is asked to connect a new laptop to the corporate network. The wall jack provides a copper Ethernet connection, and the laptop does not have a built-in RJ-45 port. Which type of adapter should the technician use to provide a wired connection?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

USB-to-RJ-45 Ethernet adapter. A USB-to-RJ-45 Ethernet adapter is the correct endpoint media because it adds a physical Ethernet interface to a laptop that lacks an integrated RJ-45 port. It allows the laptop to use standard copper cabling and connect to the corporate LAN. The other adapters provide serial, video, or direct-transfer functions, none of which deliver Ethernet connectivity.

Answer

USB-to-VGA display adapter

Answer

USB-to-RS-232 serial adapter

Answer

USB-to-USB null modem cable

Question 2

A network technician is configuring a new Cisco switch port for a server that must support both voice and data traffic on separate VLANs. The server's network interface card is VLAN-aware and will tag its own frames. The technician wants to ensure the switch port can carry traffic for multiple VLANs. Which type of switch port configuration should the technician apply?

Accepted Answer

Trunk port. A trunk port is designed to carry traffic for multiple VLANs using 802.1Q tagging. Because the server's NIC is VLAN-aware and will tag frames, the switch port must be configured as a trunk to accept and forward those tagged frames. Access ports support only a single VLAN, and routed ports operate at Layer 3 without VLAN tagging.

Answer

Native VLAN port

Answer

Access port

Answer

Routed port

Question 3

Which port security violation mode will drop packets from an unauthorized MAC address, increment the security violation counter, and send a syslog message, but will not shut down the interface?

Accepted Answer

Restrict. Port security is a Layer 2 feature that limits the number of MAC addresses allowed on a switch port to prevent MAC flooding attacks. By defining specific violation actions, administrators can control how the switch reacts when an unauthorized device connects. Understanding these modes is essential for maintaining physical port integrity.

Answer

Protect

Answer

Sticky

Answer

Shutdown

Question 4

A network engineer is hardening a new Cisco switch that will be deployed in a lobby area accessible to visitors. The engineer wants to protect against MAC flooding attacks and against unauthorized devices connecting to access ports. Which two measures should the engineer implement? (Choose two.)

Accepted Answer

Set the violation mode to restrict or shutdown when the maximum MAC count is exceeded.. Port security limits the number of MAC addresses per port, which directly counters MAC flooding and unauthorized device connections. The violation mode determines the enforcement action when the limit is exceeded, such as dropping frames or shutting the port. BPDU Guard, DTP hardening, and Root Guard protect the Spanning Tree topology but do not limit MAC addresses or prevent CAM table exhaustion.

Answer

Disable DTP on all access ports by configuring switchport mode access and switchport nonegotiate.

Answer

Enable BPDU Guard on all access ports.

Answer

Enable Root Guard on all access ports.

Question 5

A technician is troubleshooting a workstation that cannot connect to the network. The workstation's network interface card (NIC) shows a solid link light, but the technician cannot ping the default gateway. The technician suspects a duplex mismatch. Which command should the technician use on a Cisco switch to verify the duplex settings of the port connected to the workstation?

Accepted Answer

show interfaces gigabitethernet0/1. The show interfaces gigabitethernet0/1 command provides detailed operational status, including the current duplex and speed, as well as error counters that can confirm a duplex mismatch. The show interfaces status command gives a summary but lacks error details. The show interfaces counters errors command focuses on errors but not duplex. The show running-config shows configured settings, not operational status. Thus, the detailed interface command is best for verifying duplex.

Answer

show running-config interface gigabitethernet0/1

Answer

show interfaces status

Answer

show interfaces counters errors

Question 6

A network administrator is configuring a switch and needs to ensure that only one VLAN is carried on a specific access port. The administrator wants to assign VLAN 10 to a port connected to a user's PC. Which command should the administrator use on a Cisco switch to assign the port to VLAN 10?

Accepted Answer

switchport access vlan 10. To assign an access port to a specific VLAN on a Cisco switch, the administrator uses the interface configuration command 'switchport access vlan 10'. This command sets the access VLAN for the port. The port must be in access mode, which is typically the default, but can be set with 'switchport mode access'. The other commands either set the mode, configure trunk allowed VLANs, or create the VLAN globally.

Answer

switchport trunk allowed vlan 10

Answer

vlan 10

Answer

switchport mode access

Question 7

A network technician is configuring a small branch office network. The ISP has assigned a single public IPv4 address that must be shared by all internal devices. The technician needs a solution that allows multiple internal hosts to communicate on the internet simultaneously without requiring a one-to-one mapping of internal to external addresses. Which technology should the technician implement?

Accepted Answer

Port Address Translation (PAT). Port Address Translation (PAT) is the correct choice because it enables many-to-one translation, allowing multiple internal hosts to share a single public IPv4 address by multiplexing sessions using source port numbers. Dynamic NAT and static NAT both require multiple public addresses or one-to-one mappings, which are not available. Proxy ARP does not perform translation and is irrelevant to internet sharing.

Answer

Static NAT with a one-to-one mapping

Answer

Dynamic NAT with a pool of public addresses

Answer

Proxy ARP

Question 8

Which TWO of the following are valid methods for securing the administrative access of a Cisco device?

Accepted Answer

Configuring SSH for remote management. Securing administrative access is paramount to preventing total network compromise. Using AAA for centralized authentication and disabling insecure protocols like Telnet are standard industry practices. These steps ensure that access is limited to authorized personnel and that credentials are not exposed during transit. In an enterprise environment, these controls are the first line of defense against both internal and external threats, ensuring only trusted users can modify configurations.

Answer

Allowing all traffic via ACL on management interfaces

Answer

Enabling the HTTP server

Answer

Sharing a single admin password for all devices

Question 9

An engineer needs to subnet a 192.168.10.0/24 network to provide at least 5 usable subnets, with each subnet accommodating a minimum of 25 host devices. Which subnet mask meets these specific design requirements?

Accepted Answer

255.255.255.224. The subnet mask /27 provides 32 total IP addresses per subnet, leaving 30 usable hosts after excluding the network and broadcast addresses. This satisfies the requirement for 25 hosts while yielding 8 total subnets from the original /24 network, easily meeting the minimum threshold of 5 subnets.

Answer

255.255.255.192

Answer

255.255.255.240

Answer

255.255.255.248

Question 10

A network administrator is designing a wireless deployment for an office. Which TWO frequency bands are most commonly used by standard Wi-Fi endpoints to transmit data? (Choose TWO.)

Accepted Answer

2.4 GHz. Wi-Fi standards primarily utilize the 2.4 GHz and 5 GHz bands to provide a balance of range and speed. The 2.4 GHz band offers better penetration through walls, while the 5 GHz band provides higher data rates and less congestion. Understanding these bands helps technicians troubleshoot interference and coverage issues for mobile endpoints.

Answer

900 MHz

Answer

60 GHz

Answer

10 GHz

Question 11

A user reports that their laptop cannot connect to the corporate Wi-Fi network, but other devices in the same area can connect fine. The laptop's wireless adapter is enabled and shows available networks. Which of the following is the most likely cause of the issue?

Accepted Answer

The laptop's wireless adapter is configured with the wrong SSID.. The most likely cause is that the laptop is configured with the wrong SSID. Other devices connecting successfully indicates the access point and network are operational. Interference would affect all devices, and IP or driver issues would typically manifest differently. A wrong SSID prevents association even if the network is visible, making it the prime suspect.

Answer

The access point is experiencing high interference.

Answer

The laptop's wireless adapter driver is outdated.

Answer

The laptop has an incorrect IP address configuration.

Question 12

A network is experiencing high latency. The administrator finds that the switch has high CPU utilization. Which diagnostic step is most appropriate to identify the cause?

Accepted Answer

Run 'show processes cpu' to identify the top processes.. High CPU on a switch often indicates that the control plane is being overwhelmed by traffic that requires processing rather than hardware switching. By using the 'show processes cpu' command, the administrator can identify which specific process is consuming resources. This allows for distinguishing between legitimate traffic spikes, management overhead, or an ongoing denial-of-service attack, which helps in applying the correct mitigation strategy to restore network performance.

Answer

Check the ARP table for excessive entries.

Answer

Clear the interface statistics.

Answer

Disable spanning-tree on all ports.

Question 13

Which of the following describes the primary purpose of a security policy in a network environment?

Accepted Answer

To define organizational standards and expected behaviors for security.. A security policy defines the formal rules, procedures, and expectations for all users and systems within an organization. It provides the legal and operational framework for network security management. Establishing a policy is critical because it ensures that security practices are consistent, measurable, and enforceable across the enterprise, preventing ambiguity when handling sensitive data or responding to security incidents effectively.

Answer

To automatically configure firewall rules on all network devices.

Answer

To encrypt all traffic flowing between internal network segments.

Answer

To identify all potential vulnerabilities in the network infrastructure.

Question 14

An administrator needs to deploy several new IP cameras in a parking lot. The cameras require 25 Watts of power each and are connected to a switch 80 meters away. Which technology must the switch support on its ports?

Accepted Answer

802.3at (PoE+). 802.3at (PoE+) delivers up to 30 W per port (25.5 W at the device after cable loss), which comfortably covers the 25 W requirement of each camera. It also supports the 80-meter distance because PoE standards are designed for standard Ethernet cabling up to 100 meters. 802.3af would be insufficient at 15.4 W, and while 802.3bt would also work, it is overkill and not the minimum required.

Answer

802.3af (PoE)

Answer

802.3bt (UPOE+)

Answer

Passive PoE (24V)

Question 15

A network administrator is configuring a Cisco switch and wants to ensure that only the designated uplink port can send DHCP server replies, while all other ports are prevented from acting as DHCP servers. Which command should be applied to the uplink port?

Accepted Answer

ip dhcp snooping trust. DHCP snooping treats all ports as untrusted by default, dropping DHCP server messages such as OFFER and ACK. Marking the uplink with ip dhcp snooping trust allows replies from the legitimate DHCP server to reach clients while rogue servers on access ports remain blocked. This is the standard way to permit only the designated port to act as a DHCP server path.

Answer

ip dhcp snooping limit rate 10

Answer

ip dhcp snooping vlan 10

Answer

switchport port-security