100-150 Practice Exam 2 — 20 Questions

Question 1

A network engineer is configuring a new switch and needs to ensure that management traffic is isolated from user data traffic. The engineer decides to create a separate VLAN for management and assign an IP address to a switch virtual interface (SVI) on that VLAN. Which type of VLAN is being implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Management VLAN. A management VLAN is dedicated to carrying administrative traffic, allowing network devices to be managed securely without mixing that traffic with user data. By creating such a VLAN and assigning an SVI, the engineer ensures that management access is isolated, which is a best practice for network security and segmentation.

Answer

Native VLAN

Answer

Data VLAN

Answer

Voice VLAN

Question 2

A network engineer is deploying a new Cisco switch and needs to configure it for remote management. The engineer wants to ensure that management traffic is isolated from user data traffic and that only authorized personnel can access the switch. Which two configuration steps should the engineer perform? (Choose two.)

Accepted Answer

Enable SSH and disable Telnet for remote access.. To enable secure remote management, the switch needs an IP address on a management VLAN interface, and remote access should use SSH while Telnet is disabled. These steps provide a reachable management address and ensure that management sessions are encrypted. Other options, like port security or DHCP snooping, address different security concerns and do not fulfill the specific requirements.

Answer

Configure port security on all access ports.

Answer

Configure a default gateway on the switch.

Answer

Enable DHCP snooping on the management VLAN.

Question 3

Which component of the AAA security framework is responsible for determining which specific commands a user is permitted to execute on a Cisco router after they have successfully logged in?

Accepted Answer

Authorization. The AAA framework (Authentication, Authorization, and Accounting) provides a modular way to manage access control. Each component serves a distinct purpose in securing network devices. Understanding how these functions interact allows administrators to implement granular security policies that restrict user actions to only what is necessary for their job.

Answer

Authentication

Answer

Accounting

Answer

Availability

Question 4

A network team is hardening a Cisco Catalyst switch that will be deployed at the edge of the corporate network. They want to reduce the risk of Layer 2 attacks such as MAC flooding and unauthorized device attachment. Which two actions should they take? (Choose two.)

Accepted Answer

Enable port security on access ports to limit the number of MAC addresses.. MAC flooding is countered by limiting learned MAC addresses per port, which port security accomplishes. Unauthorized physical attachment is reduced by disabling unused ports and parking them in an unused VLAN. Together these measures harden the access edge. The other options either misplace a feature, depend on missing prerequisites, or actively weaken trunk security, so they do not serve the team's stated objectives.

Answer

Enable Dynamic ARP Inspection on all access ports without DHCP snooping.

Answer

Configure the native VLAN on all trunk ports to match VLAN 1.

Answer

Enable IP source guard on routed uplinks only.

Question 5

A user reports they cannot access a web server at 192.168.50.10. Which TWO commands would provide the most useful initial diagnostic information regarding the path and reachability to this destination from a Windows workstation? (Choose two).

Accepted Answer

ping 192.168.50.10. Ping and Traceroute are the primary tools used to diagnose reachability and path issues across an IP network. Ping tests basic end-to-end connectivity using ICMP Echo Requests, while Traceroute identifies each hop along the path, helping to pinpoint exactly where a packet is being dropped. Mastering these utilities allows technicians to isolate faults between local, ISP, or remote segments.

Answer

ipconfig /renew

Answer

netstat -a

Answer

nslookup 192.168.50.10

Question 6

A network administrator is evaluating endpoint media types for a new VoIP deployment. The IP phones will be powered by the access switches and must negotiate power requirements automatically. Which TWO statements correctly describe how Power over Ethernet (PoE) negotiation works between a Power Sourcing Equipment (PSE) switch and a Powered Device (PD) phone? (Choose two.)

Accepted Answer

The PSE applies a low voltage to detect a valid PD signature resistance before supplying full power.. PoE negotiation begins with a physical-layer detection phase where the PSE checks for a valid PD signature resistance, then proceeds to classification. Later standards add LLDP-MED for dynamic power negotiation, allowing the phone and switch to agree on precise power levels. DHCP and manual static budgeting are not part of the PoE power negotiation process, and Gigabit Ethernet supports PoE without limitation.

Answer

The PSE supplies power on the same pairs used for data in 10BASE-T and 100BASE-TX, which is why Gigabit Ethernet cannot support PoE.

Answer

The PD must be manually configured with a static power budget on the switch port before it will receive any power.

Answer

The PD sends a DHCP request to the PSE to request a specific power class before link negotiation.

Question 7

Which component of the Cisco network architecture is specifically designed to provide high-speed switching and fast transport between different parts of the network?

Accepted Answer

Core Layer. The Core Layer of the Cisco network architecture is designed for high-speed switching and fast transport between different parts of the network. It acts as the backbone, connecting distribution layer devices and providing a high-capacity, low-latency path for data. The core should be highly resilient and avoid processing-intensive tasks like access control lists.

Answer

Access Layer

Answer

Distribution Layer

Answer

Edge Layer

Question 8

Refer to the exhibit. Based on the IPv6 configuration of the GigabitEthernet0/0 interface, which statement is true regarding the connectivity of this router?

Accepted Answer

The router can only communicate with other hosts on the local link.. The exhibit shows a GigabitEthernet0/0 interface configured with only a link-local IPv6 address (FE80::/10 range, typically starting with FE80::). A link-local address is automatically generated and is only valid on the local segment; it is never routed beyond the local link. Therefore the router can communicate only with directly connected IPv6 hosts on that link, not with the internet or remote networks.

Answer

The router can communicate with any host on the internet.

Answer

The interface is disabled because it lacks a global address.

Answer

The router will use the FF02::1 address to route external traffic.

Question 9

Which cabling infrastructure standard should an engineer deploy to support 10 Gigabit Ethernet transmissions across a 300-meter horizontal run inside a modern enterprise building?

Accepted Answer

OM3 laser-optimized multimode fiber optic cabling terminated with LC duplex connectors.. Multimode fiber optic cabling, specifically laser-optimized OM3 or OM4 fiber, supports 10 Gigabit Ethernet up to 300 or 400 meters respectively. Copper cabling such as Category 6 is strictly limited to 100 meters for standard Ethernet, making fiber the mandatory physical medium for distances exceeding that threshold within enterprise horizontal runs.

Answer

Category 6 unshielded twisted-pair copper cable terminated with standard RJ-45 modular plugs.

Answer

Category 5e structured copper cabling tested to 100 MHz bandwidth performance profiles.

Answer

Coaxial broadband cabling utilizing 50-ohm impedance connectors and barrel adapters.

Question 10

Which component of an IPv4 address does the subnet mask identify?

Accepted Answer

The network and host portions of the address.. The subnet mask is a 32-bit value that, when ANDed with an IPv4 address, separates the network portion (bits set to 1 in the mask) from the host portion (bits set to 0). It tells the device which part of the address identifies the network and which part identifies the specific host on that network.

Answer

The MAC address of the destination device.

Answer

The default gateway for the host.

Answer

The TCP port number for the application.

Question 11

A network designer is choosing between SFP and SFP+ transceivers for a new switch deployment. Which TWO statements correctly describe the differences and compatibility between these media modules?

Accepted Answer

SFP modules typically support speeds up to 1 Gbps. Option A is correct because SFP (Small Form-factor Pluggable) transceivers are specified for Gigabit Ethernet and lower rates, typically up to 1 Gbps, making them the standard choice for 1000BASE-X/SX/LX/T connections. Option B is correct because SFP+ is the enhanced variant standardized for 10 Gbps Ethernet (10GBASE-SR/LR/ER and DAC), which is its primary design purpose. Option C is wrong because SFP+ in an SFP slot is not guaranteed; the slot must explicitly support 10 Gbps and often requires the same form factor with matching electrical characteristics, so it will not 'always' work. Option D is wrong because SFP modules support fiber connectors such as LC (and sometimes SC), plus copper variants like 1000BASE-T use RJ-45, so RJ-45 is not exclusive. Option E is wrong because SFP+ modules exist for both single-mode and multimode fiber (e.g., 10GBASE-SR for MMF, 10GBASE-LR for SMF), so single-mode-only is inaccurate.

Answer

An SFP+ module will always work in a standard SFP slot

Answer

SFP modules use RJ-45 connectors exclusively

Answer

SFP+ modules are only compatible with single-mode fiber

Question 12

Which of the following is the correct representation of the IPv6 address 2001:0DB8:0000:0000:0008:0800:200C:417A in compressed format?

Accepted Answer

2001:DB8::8:800:200C:417A. The correct compressed format is 2001:DB8::8:800:200C:417A. IPv6 compression rules (RFC 5952) allow leading zeros in each group to be omitted and a single contiguous sequence of all-zero groups to be replaced with '::'. Here, the two consecutive zero groups (0000:0000) are replaced by '::', and leading zeros in other groups are dropped (0DB8→DB8, 0008→8, 0800→800).

Answer

2001:DB8:0:0:8:800:200C:417A

Answer

2001:DB8::0000::8:800:200C:417A

Answer

2001:DB8:0000:0000:8:800:200C:417A

Question 13

What is the directed broadcast address for the subnet in which the host 172.16.50.131/29 resides?

Accepted Answer

172.16.50.135. For 172.16.50.131/29, the subnet mask is 255.255.255.248, meaning each subnet has 8 addresses (2^3). The subnet containing .131 starts at .128 (network address) and ends at .135 (broadcast address). The directed broadcast address is the last address in the subnet, which is 172.16.50.135.

Answer

172.16.50.159

Answer

172.16.50.255

Answer

172.16.50.133

Question 14

A technician needs to identify which endpoint is connected to a specific switch port. Which command should be used to see the Layer 2 address of the connected device and the port it is associated with?

Accepted Answer

show mac address-table. The show mac address-table command displays the switch's MAC address table, which maps MAC addresses to switch ports and VLANs. This allows a technician to identify which endpoint (by its Layer 2 MAC address) is connected to a specific port. It is the standard Cisco IOS command for Layer 2 endpoint-to-port mapping.

Answer

show ip route

Answer

show interfaces status

Answer

show running-config

Question 15

A network technician is configuring a point-to-point serial link between two Cisco routers. To conserve address space, the engineer wants the smallest possible subnet that still provides two usable host addresses. Which subnet mask should be applied to the serial interfaces?

Accepted Answer

255.255.255.252. A point-to-point serial link requires only two host addresses, one for each router interface. The /30 mask 255.255.255.252 provides exactly four addresses, of which two are usable hosts, making it the smallest conventional subnet for this purpose. Larger masks waste addresses, and while /31 is an option in some modern implementations, the /30 remains the standard expected configuration for conserving address space on WAN links.

Answer

255.255.255.254

Answer

255.255.255.128

Answer

255.255.255.248

Question 16

A technician needs to connect a laptop to a Cisco router's console port to perform initial configuration. Which cable should be used for this task?

Accepted Answer

Rollover cable. A rollover cable (also called a console cable) is specifically wired to connect a computer's serial port (via a DB-9 or USB adapter) to a Cisco router's console port (RJ-45). The pinout is reversed end-to-end, which is why it is called a rollover cable. It is the standard cable for out-of-band initial configuration and password recovery.

Answer

Straight-through Ethernet cable

Answer

Crossover Ethernet cable

Answer

Single-mode fiber patch cord

Question 17

Users on a floor of an office building report that file transfers to a server are slow and sometimes stall. The technician suspects a duplex mismatch on the switch port connecting the server. Which TWO symptoms or outputs would confirm a duplex mismatch on that link? (Choose two.)

Accepted Answer

The switch interface shows a high number of FCS and CRC errors on received frames.. A duplex mismatch produces collisions on the half-duplex side while the full-duplex side keeps transmitting, corrupting frames in flight. The two clearest confirmations are late collisions counted on the half-duplex interface and CRC or FCS errors counted on received frames. Both counters rise steadily under load, and throughput drops because corrupted frames must be retransmitted by upper-layer protocols.

Answer

The switch logs show the port entering the err-disabled state repeatedly.

Answer

The switch port shows the line protocol as down while the physical link remains up.

Answer

The server's NIC reports a negotiated speed of 1000 Mb/s and full duplex.

Question 18

A company wants to ensure that even if an attacker steals a user's password, the attacker cannot log in without a second factor. Which authentication approach best meets this requirement?

Accepted Answer

Combining a password with a one-time code from an authenticator app. Multi-factor authentication requires two different categories of proof, such as something the user knows (password) and something the user has (an authenticator app generating one-time codes). A stolen password alone is useless without the second factor. Password complexity, lockout, and expiration all strengthen a single factor but do not prevent misuse of a stolen password.

Answer

Requiring a longer and more complex password

Answer

Locking accounts after three failed login attempts

Answer

Enforcing a password expiration policy every 30 days

Question 19

Which TWO characteristics distinguish the User Datagram Protocol (UDP) from the Transmission Control Protocol (TCP)?

Accepted Answer

UDP provides connectionless communication without a handshake.. The choice between TCP and UDP is a fundamental architectural decision based on the needs of the application. TCP provides reliability and flow control at the cost of overhead, while UDP prioritizes speed and efficiency. Understanding these differences allows network professionals to troubleshoot performance issues and optimize traffic for different types of data, such as streaming or file transfers.

Answer

UDP uses sequence numbers to reassemble data in the correct order.

Answer

UDP operates at the Network Layer of the OSI model.

Answer

UDP includes a three-way handshake to ensure delivery.

Question 20

Which Cisco feature is used to prevent Man-in-the-Middle attacks that rely on corrupting the ARP cache of connected hosts?

Accepted Answer

Dynamic ARP Inspection. ARP spoofing allows attackers to associate their MAC address with the IP address of a default gateway, effectively intercepting traffic. Dynamic ARP Inspection (DAI) uses the DHCP snooping database to validate ARP packets, ensuring that only legitimate mappings are allowed. This is a critical security feature in modern switches to prevent internal traffic interception, ensuring data privacy and integrity between hosts on the same Layer 2 domain.

Answer

DHCP Snooping

Answer

Port Security

Answer

IP Source Guard