100-150 Practice Exam 3 — 20 Questions

Question 1

A network administrator must ensure that only specific management stations can reach the management VLAN on a Cisco switch, while ordinary user traffic on other VLANs flows unrestricted. The administrator wants a mechanism that filters traffic based on source IP addresses and can log denied attempts. Which feature should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An IP access control list applied to the management VLAN interface. Filtering by source IP address while leaving other VLANs untouched points to an IP access control list bound to the management switched virtual interface. The list permits only the designated management subnets and denies everything else, and log entries record rejected attempts. Layer 2 protections such as port security, Dynamic ARP Inspection, and BPDU Guard address different threats entirely.

Answer

Port security with sticky MAC address learning

Answer

Dynamic ARP Inspection on all user-facing ports

Answer

BPDU Guard enabled on access ports

Question 2

A user is unable to reach 'cisco.com' in their web browser but can successfully ping the IP address '72.163.4.161'. Which network service is most likely failing or misconfigured?

Accepted Answer

Domain Name System (DNS). This scenario highlights the distinction between basic connectivity and name resolution. If a user can reach a destination by IP but not by name, the underlying network path is functional, but the translation service is broken. Diagnosing DNS issues is a daily task for technicians, as it is often the root cause of 'internet is down' complaints when the connection is actually active.

Answer

Dynamic Host Configuration Protocol (DHCP)

Answer

Network Address Translation (NAT)

Answer

Address Resolution Protocol (ARP)

Question 3

A user reports intermittent connectivity to the internal server. Which TWO commands are most useful to identify if the issue is caused by physical layer flapping or interface errors?

Accepted Answer

show interfaces. Identifying physical layer issues requires inspecting interface statistics and state changes. 'show interfaces' reveals error counters like CRC, giants, and runts which signify physical layer degradation. 'show logging' provides a chronological history of interface state changes, allowing the technician to correlate connectivity drops with physical link flaps. Together, these tools provide a comprehensive view of the physical health of the connection between the host and the switch infrastructure.

Answer

show ip route

Answer

show ip arp

Answer

show ip protocols

Question 4

Refer to the exhibit. An administrator observes high error counts on a switch port. Based on the output, what is the most likely cause of the issue?

Accepted Answer

A duplex mismatch on the physical connection.. High error counts (CRC errors, late collisions, runts, giants) on a switch port are the classic signature of a duplex mismatch. When one side is set to full-duplex and the other to half-duplex, the full-duplex side transmits whenever it wants while the half-duplex side detects collisions and reports late collisions and FCS errors. The exhibit typically shows 'Late collisions' and 'CRC' counters incrementing.

Answer

A VLAN mismatch between the switch and the connected device.

Answer

The switch port has been disabled by Port Security.

Answer

An incorrect IP address assigned to the interface.

Question 5

A network administrator is configuring a Cisco switch and wants to ensure that only the MAC addresses of known devices are allowed to send traffic on a specific access port. The administrator wants to manually specify the allowed MAC addresses and have the port shut down if a violation occurs. Which feature should be configured?

Accepted Answer

Port security with static MAC addresses and violation mode shutdown. Port security is the correct feature to restrict a switch port to specific MAC addresses and take action on violation. Configuring static MAC addresses and setting the violation mode to shutdown ensures that only known devices can communicate, and any violation disables the port. Other features like DAI, 802.1X, and DHCP snooping serve different security purposes.

Answer

802.1X authentication

Answer

DHCP snooping

Answer

Dynamic ARP Inspection (DAI)

Question 6

Which field in an IPv4 header is used to prevent a packet from circulating indefinitely in the event of a routing loop?

Accepted Answer

Time to Live (TTL). The Time to Live (TTL) field in the IPv4 header is an 8-bit value that is decremented by one at each router hop. When it reaches zero, the router discards the packet and sends an ICMP Time Exceeded message back to the source, preventing packets from looping forever in the event of a routing loop.

Answer

Protocol Field

Answer

Header Checksum

Answer

Differentiated Services (DiffServ)

Question 7

A user discovers that all their files have been encrypted and a message is displayed demanding payment in exchange for the decryption key. What type of malware has infected the system?

Accepted Answer

Ransomware. Malware comes in many forms, each with unique characteristics and objectives. Ransomware has become one of the most significant threats to organizations, often leading to total operational shutdown. Recognizing the behavior of different malware types allows technicians to implement better defense strategies and respond more effectively when an infection is detected.

Answer

Computer worm

Answer

Trojan horse

Answer

Spyware

Question 8

When a router receives a packet, what action does it take if the destination network is not in its routing table and no default route is configured?

Accepted Answer

It drops the packet and sends an ICMP error message.. Routers operate based on explicit routing entries. If a destination network is missing and no default gateway (quad-zero route) exists, the router has no path information to forward the packet. It then drops the packet and sends an ICMP 'Destination Unreachable' message back to the sender. This is a vital diagnostic mechanism that informs hosts of connectivity failures.

Answer

It forwards the packet to all connected ports.

Answer

It stores the packet until a route is learned.

Answer

It sends a request to the DNS server for the path.

Question 9

A network administrator is evaluating a new campus LAN design. The design requires a Layer 2 protocol that prevents switching loops by placing redundant switch ports into a blocking state while still allowing automatic failover if the active path fails. Which protocol should the administrator select?

Accepted Answer

IEEE 802.1D Spanning Tree Protocol. Spanning Tree Protocol is the standard Layer 2 mechanism that builds a loop-free logical topology by blocking redundant ports and unblocking them after a failure. VLAN tagging, PoE, and wireless standards address different functions and cannot prevent switching loops, so STP is the appropriate selection for the stated design requirement.

Answer

IEEE 802.3af Power over Ethernet

Answer

IEEE 802.11ac

Answer

IEEE 802.1Q

Question 10

What is the primary function of the 'show running-config' command on a Cisco switch?

Accepted Answer

To view the active configuration stored in RAM.. The 'show running-config' command displays the current active configuration stored in RAM. This command is vital for verification, as it allows administrators to see exactly how the device is configured in real-time. Knowing how to interpret this output is essential for troubleshooting, as it reveals the current status of interfaces, security settings, and routing protocols before they are saved to the permanent startup configuration.

Answer

To save the current configuration to NVRAM.

Answer

To clear all existing configurations on the device.

Answer

To view the hardware version and serial number.

Question 11

What is the primary function of the Address Resolution Protocol (ARP) in an IPv4 network?

Accepted Answer

It maps a known IPv4 address to a corresponding MAC address.. ARP (Address Resolution Protocol) is used when a host knows the IPv4 address of a destination on the same local network but needs the corresponding MAC address to build the Layer 2 frame. The host broadcasts an ARP request asking 'Who has IP X? Tell MAC Y,' and the owner of that IP replies with its MAC address. This mapping is then cached in the ARP table for future use.

Answer

It maps a known MAC address to a dynamically assigned IP address.

Answer

It translates human-readable domain names into numerical IP addresses.

Answer

It provides a secure encrypted tunnel for data transmission between hosts.

Question 12

Which device is primarily responsible for managing traffic between different IP subnets in a corporate network?

Accepted Answer

Router. A router operates at Layer 3 (Network layer) and is responsible for forwarding packets between different IP subnets by examining IP addresses and making routing decisions. It maintains a routing table and uses protocols like OSPF or BGP to determine the best path. This makes it the primary device for inter-subnet traffic management in a corporate network.

Answer

Layer 2 Switch

Answer

Hub

Answer

Repeater

Question 13

A network administrator needs to prevent unauthorized devices from connecting to a switch port while ensuring that only a specific workstation can access the network. Which security feature should be implemented?

Accepted Answer

Port Security. Port security limits the number of valid MAC addresses allowed on a port and binds a specific MAC address to a physical interface. This prevents unauthorized devices from spoofing addresses or connecting rogue hardware to the enterprise network. Implementing this feature is a fundamental step in securing the access layer against layer 2 attacks like MAC flooding or unauthorized device insertion, ensuring only authenticated hardware gains link connectivity.

Answer

DHCP Snooping

Answer

Dynamic ARP Inspection

Answer

VLAN Trunking Protocol

Question 14

An office uses Power over Ethernet (PoE) to provide power to IP phones. Which device is responsible for acting as the Power Sourcing Equipment (PSE) in this scenario?

Accepted Answer

The PoE-capable Switch. In a PoE environment, the Power Sourcing Equipment (PSE) is the device that injects power into the Ethernet cable. Usually, this is a PoE-capable switch. Understanding the roles of PSE and Powered Devices (PD) is vital for troubleshooting power-related issues at the network edge where endpoints are connected.

Answer

The IP Phone

Answer

The DHCP Server

Answer

The Patch Panel

Question 15

A network administrator is documenting the IPv6 addressing scheme for a new campus. The administrator must identify which statements about IPv6 address structure and notation are accurate. (Choose two.)

Accepted Answer

Leading zeros within each 16-bit group of an IPv6 address can be omitted to shorten the notation.. IPv6 text representation permits two key shortcuts: suppressing leading zeros inside each hextet and replacing one contiguous run of zero hextets with a double colon. The double colon may appear only once to keep the address unambiguous. Dotted-decimal masks and removal of trailing zeros are not valid, since they would either mix IPv4 conventions or alter the numeric value of the address.

Answer

An IPv6 address can contain multiple double colon sequences as long as each replaces a different zero run.

Answer

The IPv6 prefix length is expressed in dotted-decimal notation following a space, such as 2001:db8::1 255.255.255.0.

Answer

Trailing zeros at the end of a hextet may be removed to shorten the address, so 2001:0db0::1 can be written as 2001:0db::1.

Question 16

A technician is terminating a UTP cable and notices that the plastic clip on the RJ-45 connector is broken. What is the most likely consequence of using this connector for a network endpoint?

Accepted Answer

The connection will experience intermittent link drops.. The RJ-45 retention clip locks the connector into the port and maintains consistent contact pressure between the eight gold pins and the port's contacts. A broken clip allows the plug to slide slightly, breaking or degrading individual pin contacts, which produces intermittent link drops and CRC errors. The link may come up and then drop repeatedly as the cable shifts.

Answer

The cable will only support half-duplex speeds.

Answer

The cable will cause a short circuit in the switch.

Answer

Data will be transmitted without encryption.

Question 17

A network engineer needs to allocate a subnet for a link connecting two routers. Which prefix provides the most efficient addressing for a point-to-point connection?

Accepted Answer

/30. A /30 mask leaves 2 host bits, yielding exactly 2 usable addresses — one for each router interface on the point-to-point link. That is the minimum needed for a functional link, so /30 is the most efficient allocation without wasting addresses.

Answer

/24

Answer

/28

Answer

/29

Question 18

Which IPv6 address type is represented by the prefix fe80::/10?

Accepted Answer

Link-Local. The fe80::/10 prefix is reserved for Link-Local addresses in IPv6. These addresses are automatically configured on all IPv6-enabled interfaces and are essential for neighbor discovery and routing protocol communication on a single local link. Unlike global unicast addresses, these are not routable outside the local segment, making them fundamental for basic connectivity and troubleshooting in IPv6 environments.

Answer

Global Unicast

Answer

Unique Local

Answer

Multicast

Question 19

A network technician is selecting devices to protect a corporate network from external threats. Which TWO devices provide active threat mitigation by inspecting and blocking malicious traffic? (Choose TWO).

Accepted Answer

Firewall. Network security requires a multi-layered approach to protect against diverse threats. Firewalls and Intrusion Prevention Systems (IPS) are two fundamental components that work together to secure the perimeter and internal segments. Understanding the distinct roles these technologies play helps technicians design robust networks that can both block bad traffic and detect anomalies.

Answer

Antivirus

Answer

Honeypot

Answer

Load Balancer

Question 20

A network administrator is documenting a subnet used for a point-to-point WAN link between two Cisco routers. The link is configured with the address 10.10.10.1/30. What is the network address and the usable host range for this subnet?

Accepted Answer

Network 10.10.10.0, usable hosts 10.10.10.1 through 10.10.10.2. A /30 prefix provides two host bits, yielding exactly four addresses per subnet: one network, two usable hosts, and one broadcast. For the address 10.10.10.1/30, the subnet boundaries are multiples of four, so the network is 10.10.10.0, usable hosts are .1 and .2, and the broadcast is .3. This design is common on point-to-point links because it conserves address space.

Answer

Network 10.10.10.0, usable hosts 10.10.10.1 through 10.10.10.4

Answer

Network 10.10.10.4, usable hosts 10.10.10.5 through 10.10.10.6

Answer

Network 10.10.10.1, usable hosts 10.10.10.2 through 10.10.10.3