100-150 Practice Test 2 — 30 Questions

Question 1

A network designer is choosing between SFP and SFP+ transceivers for a new switch deployment. Which TWO statements correctly describe the differences and compatibility between these media modules?

Accepted Answer

SFP modules typically support speeds up to 1 Gbps. Option A is correct because SFP (Small Form-factor Pluggable) transceivers are specified for Gigabit Ethernet and lower rates, typically up to 1 Gbps, making them the standard choice for 1000BASE-X/SX/LX/T connections. Option B is correct because SFP+ is the enhanced variant standardized for 10 Gbps Ethernet (10GBASE-SR/LR/ER and DAC), which is its primary design purpose. Option C is wrong because SFP+ in an SFP slot is not guaranteed; the slot must explicitly support 10 Gbps and often requires the same form factor with matching electrical characteristics, so it will not 'always' work. Option D is wrong because SFP modules support fiber connectors such as LC (and sometimes SC), plus copper variants like 1000BASE-T use RJ-45, so RJ-45 is not exclusive. Option E is wrong because SFP+ modules exist for both single-mode and multimode fiber (e.g., 10GBASE-SR for MMF, 10GBASE-LR for SMF), so single-mode-only is inaccurate.

Answer

An SFP+ module will always work in a standard SFP slot

Answer

SFP modules use RJ-45 connectors exclusively

Answer

SFP+ modules are only compatible with single-mode fiber

Question 2

Which of the following is the correct representation of the IPv6 address 2001:0DB8:0000:0000:0008:0800:200C:417A in compressed format?

Accepted Answer

2001:DB8::8:800:200C:417A. The correct compressed format is 2001:DB8::8:800:200C:417A. IPv6 compression rules (RFC 5952) allow leading zeros in each group to be omitted and a single contiguous sequence of all-zero groups to be replaced with '::'. Here, the two consecutive zero groups (0000:0000) are replaced by '::', and leading zeros in other groups are dropped (0DB8→DB8, 0008→8, 0800→800).

Answer

2001:DB8:0:0:8:800:200C:417A

Answer

2001:DB8::0000::8:800:200C:417A

Answer

2001:DB8:0000:0000:8:800:200C:417A

Question 3

What is the directed broadcast address for the subnet in which the host 172.16.50.131/29 resides?

Accepted Answer

172.16.50.135. For 172.16.50.131/29, the subnet mask is 255.255.255.248, meaning each subnet has 8 addresses (2^3). The subnet containing .131 starts at .128 (network address) and ends at .135 (broadcast address). The directed broadcast address is the last address in the subnet, which is 172.16.50.135.

Answer

172.16.50.159

Answer

172.16.50.255

Answer

172.16.50.133

Question 4

A technician needs to identify which endpoint is connected to a specific switch port. Which command should be used to see the Layer 2 address of the connected device and the port it is associated with?

Accepted Answer

show mac address-table. The show mac address-table command displays the switch's MAC address table, which maps MAC addresses to switch ports and VLANs. This allows a technician to identify which endpoint (by its Layer 2 MAC address) is connected to a specific port. It is the standard Cisco IOS command for Layer 2 endpoint-to-port mapping.

Answer

show ip route

Answer

show interfaces status

Answer

show running-config

Question 5

A network technician is configuring a point-to-point serial link between two Cisco routers. To conserve address space, the engineer wants the smallest possible subnet that still provides two usable host addresses. Which subnet mask should be applied to the serial interfaces?

Accepted Answer

255.255.255.252. A point-to-point serial link requires only two host addresses, one for each router interface. The /30 mask 255.255.255.252 provides exactly four addresses, of which two are usable hosts, making it the smallest conventional subnet for this purpose. Larger masks waste addresses, and while /31 is an option in some modern implementations, the /30 remains the standard expected configuration for conserving address space on WAN links.

Answer

255.255.255.254

Answer

255.255.255.128

Answer

255.255.255.248

Question 6

A technician needs to connect a laptop to a Cisco router's console port to perform initial configuration. Which cable should be used for this task?

Accepted Answer

Rollover cable. A rollover cable (also called a console cable) is specifically wired to connect a computer's serial port (via a DB-9 or USB adapter) to a Cisco router's console port (RJ-45). The pinout is reversed end-to-end, which is why it is called a rollover cable. It is the standard cable for out-of-band initial configuration and password recovery.

Answer

Straight-through Ethernet cable

Answer

Crossover Ethernet cable

Answer

Single-mode fiber patch cord

Question 7

Users on a floor of an office building report that file transfers to a server are slow and sometimes stall. The technician suspects a duplex mismatch on the switch port connecting the server. Which TWO symptoms or outputs would confirm a duplex mismatch on that link? (Choose two.)

Accepted Answer

The switch interface shows a high number of FCS and CRC errors on received frames.. A duplex mismatch produces collisions on the half-duplex side while the full-duplex side keeps transmitting, corrupting frames in flight. The two clearest confirmations are late collisions counted on the half-duplex interface and CRC or FCS errors counted on received frames. Both counters rise steadily under load, and throughput drops because corrupted frames must be retransmitted by upper-layer protocols.

Answer

The switch logs show the port entering the err-disabled state repeatedly.

Answer

The switch port shows the line protocol as down while the physical link remains up.

Answer

The server's NIC reports a negotiated speed of 1000 Mb/s and full duplex.

Question 8

A company wants to ensure that even if an attacker steals a user's password, the attacker cannot log in without a second factor. Which authentication approach best meets this requirement?

Accepted Answer

Combining a password with a one-time code from an authenticator app. Multi-factor authentication requires two different categories of proof, such as something the user knows (password) and something the user has (an authenticator app generating one-time codes). A stolen password alone is useless without the second factor. Password complexity, lockout, and expiration all strengthen a single factor but do not prevent misuse of a stolen password.

Answer

Requiring a longer and more complex password

Answer

Locking accounts after three failed login attempts

Answer

Enforcing a password expiration policy every 30 days

Question 9

Which TWO characteristics distinguish the User Datagram Protocol (UDP) from the Transmission Control Protocol (TCP)?

Accepted Answer

UDP provides connectionless communication without a handshake.. The choice between TCP and UDP is a fundamental architectural decision based on the needs of the application. TCP provides reliability and flow control at the cost of overhead, while UDP prioritizes speed and efficiency. Understanding these differences allows network professionals to troubleshoot performance issues and optimize traffic for different types of data, such as streaming or file transfers.

Answer

UDP uses sequence numbers to reassemble data in the correct order.

Answer

UDP operates at the Network Layer of the OSI model.

Answer

UDP includes a three-way handshake to ensure delivery.

Question 10

Which Cisco feature is used to prevent Man-in-the-Middle attacks that rely on corrupting the ARP cache of connected hosts?

Accepted Answer

Dynamic ARP Inspection. ARP spoofing allows attackers to associate their MAC address with the IP address of a default gateway, effectively intercepting traffic. Dynamic ARP Inspection (DAI) uses the DHCP snooping database to validate ARP packets, ensuring that only legitimate mappings are allowed. This is a critical security feature in modern switches to prevent internal traffic interception, ensuring data privacy and integrity between hosts on the same Layer 2 domain.

Answer

DHCP Snooping

Answer

Port Security

Answer

IP Source Guard

Question 11

A network administrator must ensure that only specific management stations can reach the management VLAN on a Cisco switch, while ordinary user traffic on other VLANs flows unrestricted. The administrator wants a mechanism that filters traffic based on source IP addresses and can log denied attempts. Which feature should be configured?

Accepted Answer

An IP access control list applied to the management VLAN interface. Filtering by source IP address while leaving other VLANs untouched points to an IP access control list bound to the management switched virtual interface. The list permits only the designated management subnets and denies everything else, and log entries record rejected attempts. Layer 2 protections such as port security, Dynamic ARP Inspection, and BPDU Guard address different threats entirely.

Answer

Port security with sticky MAC address learning

Answer

Dynamic ARP Inspection on all user-facing ports

Answer

BPDU Guard enabled on access ports

Question 12

A user is unable to reach 'cisco.com' in their web browser but can successfully ping the IP address '72.163.4.161'. Which network service is most likely failing or misconfigured?

Accepted Answer

Domain Name System (DNS). This scenario highlights the distinction between basic connectivity and name resolution. If a user can reach a destination by IP but not by name, the underlying network path is functional, but the translation service is broken. Diagnosing DNS issues is a daily task for technicians, as it is often the root cause of 'internet is down' complaints when the connection is actually active.

Answer

Dynamic Host Configuration Protocol (DHCP)

Answer

Network Address Translation (NAT)

Answer

Address Resolution Protocol (ARP)

Question 13

A user reports intermittent connectivity to the internal server. Which TWO commands are most useful to identify if the issue is caused by physical layer flapping or interface errors?

Accepted Answer

show interfaces. Identifying physical layer issues requires inspecting interface statistics and state changes. 'show interfaces' reveals error counters like CRC, giants, and runts which signify physical layer degradation. 'show logging' provides a chronological history of interface state changes, allowing the technician to correlate connectivity drops with physical link flaps. Together, these tools provide a comprehensive view of the physical health of the connection between the host and the switch infrastructure.

Answer

show ip route

Answer

show ip arp

Answer

show ip protocols

Question 14

Refer to the exhibit. An administrator observes high error counts on a switch port. Based on the output, what is the most likely cause of the issue?

Accepted Answer

A duplex mismatch on the physical connection.. High error counts (CRC errors, late collisions, runts, giants) on a switch port are the classic signature of a duplex mismatch. When one side is set to full-duplex and the other to half-duplex, the full-duplex side transmits whenever it wants while the half-duplex side detects collisions and reports late collisions and FCS errors. The exhibit typically shows 'Late collisions' and 'CRC' counters incrementing.

Answer

A VLAN mismatch between the switch and the connected device.

Answer

The switch port has been disabled by Port Security.

Answer

An incorrect IP address assigned to the interface.

Question 15

A network administrator is configuring a Cisco switch and wants to ensure that only the MAC addresses of known devices are allowed to send traffic on a specific access port. The administrator wants to manually specify the allowed MAC addresses and have the port shut down if a violation occurs. Which feature should be configured?

Accepted Answer

Port security with static MAC addresses and violation mode shutdown. Port security is the correct feature to restrict a switch port to specific MAC addresses and take action on violation. Configuring static MAC addresses and setting the violation mode to shutdown ensures that only known devices can communicate, and any violation disables the port. Other features like DAI, 802.1X, and DHCP snooping serve different security purposes.

Answer

802.1X authentication

Answer

DHCP snooping

Answer

Dynamic ARP Inspection (DAI)

Question 16

Which field in an IPv4 header is used to prevent a packet from circulating indefinitely in the event of a routing loop?

Accepted Answer

Time to Live (TTL). The Time to Live (TTL) field in the IPv4 header is an 8-bit value that is decremented by one at each router hop. When it reaches zero, the router discards the packet and sends an ICMP Time Exceeded message back to the source, preventing packets from looping forever in the event of a routing loop.

Answer

Protocol Field

Answer

Header Checksum

Answer

Differentiated Services (DiffServ)

Question 17

A user discovers that all their files have been encrypted and a message is displayed demanding payment in exchange for the decryption key. What type of malware has infected the system?

Accepted Answer

Ransomware. Malware comes in many forms, each with unique characteristics and objectives. Ransomware has become one of the most significant threats to organizations, often leading to total operational shutdown. Recognizing the behavior of different malware types allows technicians to implement better defense strategies and respond more effectively when an infection is detected.

Answer

Computer worm

Answer

Trojan horse

Answer

Spyware

Question 18

When a router receives a packet, what action does it take if the destination network is not in its routing table and no default route is configured?

Accepted Answer

It drops the packet and sends an ICMP error message.. Routers operate based on explicit routing entries. If a destination network is missing and no default gateway (quad-zero route) exists, the router has no path information to forward the packet. It then drops the packet and sends an ICMP 'Destination Unreachable' message back to the sender. This is a vital diagnostic mechanism that informs hosts of connectivity failures.

Answer

It forwards the packet to all connected ports.

Answer

It stores the packet until a route is learned.

Answer

It sends a request to the DNS server for the path.

Question 19

A network administrator is evaluating a new campus LAN design. The design requires a Layer 2 protocol that prevents switching loops by placing redundant switch ports into a blocking state while still allowing automatic failover if the active path fails. Which protocol should the administrator select?

Accepted Answer

IEEE 802.1D Spanning Tree Protocol. Spanning Tree Protocol is the standard Layer 2 mechanism that builds a loop-free logical topology by blocking redundant ports and unblocking them after a failure. VLAN tagging, PoE, and wireless standards address different functions and cannot prevent switching loops, so STP is the appropriate selection for the stated design requirement.

Answer

IEEE 802.3af Power over Ethernet

Answer

IEEE 802.11ac

Answer

IEEE 802.1Q

Question 20

What is the primary function of the 'show running-config' command on a Cisco switch?

Accepted Answer

To view the active configuration stored in RAM.. The 'show running-config' command displays the current active configuration stored in RAM. This command is vital for verification, as it allows administrators to see exactly how the device is configured in real-time. Knowing how to interpret this output is essential for troubleshooting, as it reveals the current status of interfaces, security settings, and routing protocols before they are saved to the permanent startup configuration.

Answer

To save the current configuration to NVRAM.

Answer

To clear all existing configurations on the device.

Answer

To view the hardware version and serial number.