100-150 Practice Test 5 — 10 Questions

Question 1

A network administrator must ensure that only specific management stations can reach the management VLAN on a Cisco switch, while ordinary user traffic on other VLANs flows unrestricted. The administrator wants a mechanism that filters traffic based on source IP addresses and can log denied attempts. Which feature should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An IP access control list applied to the management VLAN interface. Filtering by source IP address while leaving other VLANs untouched points to an IP access control list bound to the management switched virtual interface. The list permits only the designated management subnets and denies everything else, and log entries record rejected attempts. Layer 2 protections such as port security, Dynamic ARP Inspection, and BPDU Guard address different threats entirely.

Answer

Port security with sticky MAC address learning

Answer

Dynamic ARP Inspection on all user-facing ports

Answer

BPDU Guard enabled on access ports

Question 2

A user is unable to reach 'cisco.com' in their web browser but can successfully ping the IP address '72.163.4.161'. Which network service is most likely failing or misconfigured?

Accepted Answer

Domain Name System (DNS). This scenario highlights the distinction between basic connectivity and name resolution. If a user can reach a destination by IP but not by name, the underlying network path is functional, but the translation service is broken. Diagnosing DNS issues is a daily task for technicians, as it is often the root cause of 'internet is down' complaints when the connection is actually active.

Answer

Dynamic Host Configuration Protocol (DHCP)

Answer

Network Address Translation (NAT)

Answer

Address Resolution Protocol (ARP)

Question 3

A user reports intermittent connectivity to the internal server. Which TWO commands are most useful to identify if the issue is caused by physical layer flapping or interface errors?

Accepted Answer

show interfaces. Identifying physical layer issues requires inspecting interface statistics and state changes. 'show interfaces' reveals error counters like CRC, giants, and runts which signify physical layer degradation. 'show logging' provides a chronological history of interface state changes, allowing the technician to correlate connectivity drops with physical link flaps. Together, these tools provide a comprehensive view of the physical health of the connection between the host and the switch infrastructure.

Answer

show ip route

Answer

show ip arp

Answer

show ip protocols

Question 4

Refer to the exhibit. An administrator observes high error counts on a switch port. Based on the output, what is the most likely cause of the issue?

Accepted Answer

A duplex mismatch on the physical connection.. High error counts (CRC errors, late collisions, runts, giants) on a switch port are the classic signature of a duplex mismatch. When one side is set to full-duplex and the other to half-duplex, the full-duplex side transmits whenever it wants while the half-duplex side detects collisions and reports late collisions and FCS errors. The exhibit typically shows 'Late collisions' and 'CRC' counters incrementing.

Answer

A VLAN mismatch between the switch and the connected device.

Answer

The switch port has been disabled by Port Security.

Answer

An incorrect IP address assigned to the interface.

Question 5

A network administrator is configuring a Cisco switch and wants to ensure that only the MAC addresses of known devices are allowed to send traffic on a specific access port. The administrator wants to manually specify the allowed MAC addresses and have the port shut down if a violation occurs. Which feature should be configured?

Accepted Answer

Port security with static MAC addresses and violation mode shutdown. Port security is the correct feature to restrict a switch port to specific MAC addresses and take action on violation. Configuring static MAC addresses and setting the violation mode to shutdown ensures that only known devices can communicate, and any violation disables the port. Other features like DAI, 802.1X, and DHCP snooping serve different security purposes.

Answer

802.1X authentication

Answer

DHCP snooping

Answer

Dynamic ARP Inspection (DAI)

Question 6

Which field in an IPv4 header is used to prevent a packet from circulating indefinitely in the event of a routing loop?

Accepted Answer

Time to Live (TTL). The Time to Live (TTL) field in the IPv4 header is an 8-bit value that is decremented by one at each router hop. When it reaches zero, the router discards the packet and sends an ICMP Time Exceeded message back to the source, preventing packets from looping forever in the event of a routing loop.

Answer

Protocol Field

Answer

Header Checksum

Answer

Differentiated Services (DiffServ)

Question 7

A user discovers that all their files have been encrypted and a message is displayed demanding payment in exchange for the decryption key. What type of malware has infected the system?

Accepted Answer

Ransomware. Malware comes in many forms, each with unique characteristics and objectives. Ransomware has become one of the most significant threats to organizations, often leading to total operational shutdown. Recognizing the behavior of different malware types allows technicians to implement better defense strategies and respond more effectively when an infection is detected.

Answer

Computer worm

Answer

Trojan horse

Answer

Spyware

Question 8

When a router receives a packet, what action does it take if the destination network is not in its routing table and no default route is configured?

Accepted Answer

It drops the packet and sends an ICMP error message.. Routers operate based on explicit routing entries. If a destination network is missing and no default gateway (quad-zero route) exists, the router has no path information to forward the packet. It then drops the packet and sends an ICMP 'Destination Unreachable' message back to the sender. This is a vital diagnostic mechanism that informs hosts of connectivity failures.

Answer

It forwards the packet to all connected ports.

Answer

It stores the packet until a route is learned.

Answer

It sends a request to the DNS server for the path.

Question 9

A network administrator is evaluating a new campus LAN design. The design requires a Layer 2 protocol that prevents switching loops by placing redundant switch ports into a blocking state while still allowing automatic failover if the active path fails. Which protocol should the administrator select?

Accepted Answer

IEEE 802.1D Spanning Tree Protocol. Spanning Tree Protocol is the standard Layer 2 mechanism that builds a loop-free logical topology by blocking redundant ports and unblocking them after a failure. VLAN tagging, PoE, and wireless standards address different functions and cannot prevent switching loops, so STP is the appropriate selection for the stated design requirement.

Answer

IEEE 802.3af Power over Ethernet

Answer

IEEE 802.11ac

Answer

IEEE 802.1Q

Question 10

What is the primary function of the 'show running-config' command on a Cisco switch?

Accepted Answer

To view the active configuration stored in RAM.. The 'show running-config' command displays the current active configuration stored in RAM. This command is vital for verification, as it allows administrators to see exactly how the device is configured in real-time. Knowing how to interpret this output is essential for troubleshooting, as it reveals the current status of interfaces, security settings, and routing protocols before they are saved to the permanent startup configuration.

Answer

To save the current configuration to NVRAM.

Answer

To clear all existing configurations on the device.

Answer

To view the hardware version and serial number.