100-150 Practice Test 3 — 10 Questions

Question 1

A network engineer is configuring a new switch and needs to ensure that management traffic is isolated from user data traffic. The engineer decides to create a separate VLAN for management and assign an IP address to a switch virtual interface (SVI) on that VLAN. Which type of VLAN is being implemented?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Management VLAN. A management VLAN is dedicated to carrying administrative traffic, allowing network devices to be managed securely without mixing that traffic with user data. By creating such a VLAN and assigning an SVI, the engineer ensures that management access is isolated, which is a best practice for network security and segmentation.

Answer

Native VLAN

Answer

Data VLAN

Answer

Voice VLAN

Question 2

A network engineer is deploying a new Cisco switch and needs to configure it for remote management. The engineer wants to ensure that management traffic is isolated from user data traffic and that only authorized personnel can access the switch. Which two configuration steps should the engineer perform? (Choose two.)

Accepted Answer

Enable SSH and disable Telnet for remote access.. To enable secure remote management, the switch needs an IP address on a management VLAN interface, and remote access should use SSH while Telnet is disabled. These steps provide a reachable management address and ensure that management sessions are encrypted. Other options, like port security or DHCP snooping, address different security concerns and do not fulfill the specific requirements.

Answer

Configure port security on all access ports.

Answer

Configure a default gateway on the switch.

Answer

Enable DHCP snooping on the management VLAN.

Question 3

Which component of the AAA security framework is responsible for determining which specific commands a user is permitted to execute on a Cisco router after they have successfully logged in?

Accepted Answer

Authorization. The AAA framework (Authentication, Authorization, and Accounting) provides a modular way to manage access control. Each component serves a distinct purpose in securing network devices. Understanding how these functions interact allows administrators to implement granular security policies that restrict user actions to only what is necessary for their job.

Answer

Authentication

Answer

Accounting

Answer

Availability

Question 4

A network team is hardening a Cisco Catalyst switch that will be deployed at the edge of the corporate network. They want to reduce the risk of Layer 2 attacks such as MAC flooding and unauthorized device attachment. Which two actions should they take? (Choose two.)

Accepted Answer

Enable port security on access ports to limit the number of MAC addresses.. MAC flooding is countered by limiting learned MAC addresses per port, which port security accomplishes. Unauthorized physical attachment is reduced by disabling unused ports and parking them in an unused VLAN. Together these measures harden the access edge. The other options either misplace a feature, depend on missing prerequisites, or actively weaken trunk security, so they do not serve the team's stated objectives.

Answer

Enable Dynamic ARP Inspection on all access ports without DHCP snooping.

Answer

Configure the native VLAN on all trunk ports to match VLAN 1.

Answer

Enable IP source guard on routed uplinks only.

Question 5

A user reports they cannot access a web server at 192.168.50.10. Which TWO commands would provide the most useful initial diagnostic information regarding the path and reachability to this destination from a Windows workstation? (Choose two).

Accepted Answer

ping 192.168.50.10. Ping and Traceroute are the primary tools used to diagnose reachability and path issues across an IP network. Ping tests basic end-to-end connectivity using ICMP Echo Requests, while Traceroute identifies each hop along the path, helping to pinpoint exactly where a packet is being dropped. Mastering these utilities allows technicians to isolate faults between local, ISP, or remote segments.

Answer

ipconfig /renew

Answer

netstat -a

Answer

nslookup 192.168.50.10

Question 6

A network administrator is evaluating endpoint media types for a new VoIP deployment. The IP phones will be powered by the access switches and must negotiate power requirements automatically. Which TWO statements correctly describe how Power over Ethernet (PoE) negotiation works between a Power Sourcing Equipment (PSE) switch and a Powered Device (PD) phone? (Choose two.)

Accepted Answer

The PSE applies a low voltage to detect a valid PD signature resistance before supplying full power.. PoE negotiation begins with a physical-layer detection phase where the PSE checks for a valid PD signature resistance, then proceeds to classification. Later standards add LLDP-MED for dynamic power negotiation, allowing the phone and switch to agree on precise power levels. DHCP and manual static budgeting are not part of the PoE power negotiation process, and Gigabit Ethernet supports PoE without limitation.

Answer

The PSE supplies power on the same pairs used for data in 10BASE-T and 100BASE-TX, which is why Gigabit Ethernet cannot support PoE.

Answer

The PD must be manually configured with a static power budget on the switch port before it will receive any power.

Answer

The PD sends a DHCP request to the PSE to request a specific power class before link negotiation.

Question 7

Which component of the Cisco network architecture is specifically designed to provide high-speed switching and fast transport between different parts of the network?

Accepted Answer

Core Layer. The Core Layer of the Cisco network architecture is designed for high-speed switching and fast transport between different parts of the network. It acts as the backbone, connecting distribution layer devices and providing a high-capacity, low-latency path for data. The core should be highly resilient and avoid processing-intensive tasks like access control lists.

Answer

Access Layer

Answer

Distribution Layer

Answer

Edge Layer

Question 8

Refer to the exhibit. Based on the IPv6 configuration of the GigabitEthernet0/0 interface, which statement is true regarding the connectivity of this router?

Accepted Answer

The router can only communicate with other hosts on the local link.. The exhibit shows a GigabitEthernet0/0 interface configured with only a link-local IPv6 address (FE80::/10 range, typically starting with FE80::). A link-local address is automatically generated and is only valid on the local segment; it is never routed beyond the local link. Therefore the router can communicate only with directly connected IPv6 hosts on that link, not with the internet or remote networks.

Answer

The router can communicate with any host on the internet.

Answer

The interface is disabled because it lacks a global address.

Answer

The router will use the FF02::1 address to route external traffic.

Question 9

Which cabling infrastructure standard should an engineer deploy to support 10 Gigabit Ethernet transmissions across a 300-meter horizontal run inside a modern enterprise building?

Accepted Answer

OM3 laser-optimized multimode fiber optic cabling terminated with LC duplex connectors.. Multimode fiber optic cabling, specifically laser-optimized OM3 or OM4 fiber, supports 10 Gigabit Ethernet up to 300 or 400 meters respectively. Copper cabling such as Category 6 is strictly limited to 100 meters for standard Ethernet, making fiber the mandatory physical medium for distances exceeding that threshold within enterprise horizontal runs.

Answer

Category 6 unshielded twisted-pair copper cable terminated with standard RJ-45 modular plugs.

Answer

Category 5e structured copper cabling tested to 100 MHz bandwidth performance profiles.

Answer

Coaxial broadband cabling utilizing 50-ohm impedance connectors and barrel adapters.

Question 10

Which component of an IPv4 address does the subnet mask identify?

Accepted Answer

The network and host portions of the address.. The subnet mask is a 32-bit value that, when ANDed with an IPv4 address, separates the network portion (bits set to 1 in the mask) from the host portion (bits set to 0). It tells the device which part of the address identifies the network and which part identifies the specific host on that network.

Answer

The MAC address of the destination device.

Answer

The default gateway for the host.

Answer

The TCP port number for the application.