100-150 Diagnosing Problems — 25 Questions

Question 1

Refer to the exhibit. A technician sees this status for a switch port. Which action should be taken first?

Accepted Answer

Verify the duplex and speed settings.. An interface status of 'up/down' (where the physical layer is up but the line protocol is down) typically indicates a Layer 1/Layer 2 issue such as a keepalive mismatch, clocking issue, or encapsulation mismatch. However, a duplex mismatch usually results in an 'up/up' status with high error rates (CRC/runts), not a 'down' line protocol. The most common cause for 'up/down' on a switch port is a keepalive failure or a mismatch in encapsulation/framing.

Answer

Replace the Ethernet cable.

Answer

Check the power supply of the switch.

Answer

Restart the spanning-tree process.

Question 2

A branch office router reports OSPF neighbor adjacency failures. Which THREE items should be verified to troubleshoot this issue?

Accepted Answer

Area ID. OSPF neighbor adjacency requires matching Area ID, Hello/Dead intervals, Authentication settings, and Subnet masks (for broadcast/point-to-point networks). The OSPF Process ID is locally significant and does not need to match between neighbors.

Answer

Router Priority

Answer

OSPF Process ID

Question 3

Which symptom is most indicative of a mismatched native VLAN on a trunk link between two Cisco switches?

Accepted Answer

Periodic 'native VLAN mismatch' syslog messages.. Cisco switches run CDP (Cisco Discovery Protocol), which detects native VLAN mismatches across trunk links and generates periodic syslog messages warning the administrator of the misconfiguration. Options A, C, and D are typically caused by physical layer issues, duplex mismatches, port security violations, or DHCP failures, not specifically a native VLAN mismatch.

Answer

Excessive CRC errors on the port.

Answer

The trunk port enters err-disabled state.

Answer

The switch fails to obtain an IP address.

Question 4

During a network audit, a technician finds that an interface is frequently transitioning between up and down states. Which feature should be configured to prevent unnecessary STP topology changes?

Accepted Answer

PortFast. While PortFast moves a port to the forwarding state immediately, it is the combination of PortFast and the fact that the port does not generate TCNs (Topology Change Notifications) when the link state changes that prevents STP topology recalculations. The explanation should explicitly mention that PortFast prevents the port from generating TCNs upon link state transitions.

Answer

BPDU Guard

Answer

Root Guard

Answer

EtherChannel

Question 5

A technician is diagnosing an intermittent connectivity issue between two switches. Which TWO commands would be most useful for identifying physical layer errors on a specific interface? (Choose two.)

Accepted Answer

show interfaces. To identify physical layer errors such as CRC errors, runts, giants, and framing errors, a technician must examine the interface statistics provided by the 'show interfaces' command. While 'show ip interface brief' is useful for a quick overview of interface status and IP addresses, it does not display error counters. (Note: Depending on the specific platform, 'show controllers' is also used for physical layer diagnostics, but among standard CCST-level options, 'show interfaces' is the primary choice. If only one command is primarily used for errors, the question or options may need adjustment, but assuming standard CCST scope, another operational command or specific syntax is often expected. However, let's correct option D to a better diagnostic command if applicable, or fix the error description).

Answer

show ip route

Answer

show running-config

Answer

show vlan brief

Question 6

A network administrator notices that a host connected to a Cisco Catalyst switch is experiencing extremely slow performance and high collision rates. The switch port is manually configured for 100 Mbps and Full Duplex, while the host is set to Auto-negotiation. Which condition is most likely causing this performance degradation?

Accepted Answer

Duplex mismatch. When a switch port is manually configured for speed and duplex, the connected host's auto-negotiation process fails to detect the duplex setting. According to IEEE 802.3 standards, when auto-negotiation fails to detect a duplex partner, it defaults to half-duplex. The switch port is set to full-duplex. This results in a duplex mismatch, where the switch expects full-duplex (no collision detection) and the host uses half-duplex (CSMA/CD), leading to late collisions and performance degradation.

Answer

Broadcast storm

Answer

VLAN mismatch

Answer

Cable length violation

Question 7

A network technician is troubleshooting why a workstation cannot connect to any network resources. The workstation's NIC shows a link light, and the switch port is not err-disabled. The technician runs ipconfig and sees an IP address of 169.254.10.20 with a subnet mask of 255.255.0.0. The technician then checks the DHCP server and confirms it is operational and has available addresses. Which is the most likely cause of the problem?

Accepted Answer

The switch port is configured with the wrong VLAN assignment.. The 169.254.x.x address is an APIPA address assigned when a DHCP server cannot be reached. Since the link light is on and the port is not err-disabled, physical connectivity is present. A common cause is that the switch port is assigned to a VLAN that does not have access to a DHCP server, either because the server is not on that VLAN or because DHCP relay is not configured. Thus, the workstation fails to obtain a lease and self-assigns an APIPA address.

Answer

The DHCP server is on a different VLAN and the router is not forwarding DHCP requests.

Answer

The workstation is configured with a static IP address in the 169.254.0.0/16 range.

Answer

The workstation's NIC driver is outdated.

Question 8

A network administrator notices that a switch interface is showing a high number of CRC errors and late collisions. The interface is connected to a server with a 1000BASE-T connection. Which is the most likely cause of these errors?

Accepted Answer

Faulty or damaged Ethernet cable.. CRC errors and late collisions on a Gigabit Ethernet link are most commonly caused by physical layer problems, such as a faulty cable, bad connectors, or electromagnetic interference. Since 1000BASE-T uses all four pairs, any damage can corrupt signals and cause checksum failures. Duplex mismatch is less likely on Gigabit, and VLAN or STP issues do not produce these error counters.

Answer

Duplex mismatch between the switch and the server.

Answer

Spanning Tree Protocol blocking the interface.

Answer

Incorrect VLAN configuration on the switch port.

Question 9

A network administrator observes that a workstation cannot ping its default gateway. The physical link light is active, and the local IP configuration appears correct. Which diagnostic step should be performed first to isolate the layer 2 connectivity issue?

Accepted Answer

Check the ARP table for the gateway IP address.. Verifying the ARP table is the most effective initial step when IP connectivity fails despite physical link status. It confirms whether the device can successfully resolve the MAC address of the default gateway, which is a prerequisite for layer 3 communication. If the ARP request fails, the issue is likely within the local broadcast domain, such as an incorrect VLAN assignment or a misconfigured trunk port on the connected switch.

Answer

Perform a traceroute to the internet gateway.

Answer

Flush the DNS cache on the workstation.

Answer

Reboot the switch connected to the workstation.

Question 10

A user reports intermittent connectivity to the internal server. Which TWO commands are most useful to identify if the issue is caused by physical layer flapping or interface errors?

Accepted Answer

show interfaces. Identifying physical layer issues requires inspecting interface statistics and state changes. 'show interfaces' reveals error counters like CRC, giants, and runts which signify physical layer degradation. 'show logging' provides a chronological history of interface state changes, allowing the technician to correlate connectivity drops with physical link flaps. Together, these tools provide a comprehensive view of the physical health of the connection between the host and the switch infrastructure.

Answer

show ip route

Answer

show ip arp

Answer

show ip protocols

Question 11

A user cannot reach a web server. You perform a ping and it fails, but a traceroute shows the packets reaching the last hop before the server. What does this indicate?

Accepted Answer

The destination server is likely unreachable or blocking ICMP.. A successful traceroute to the last hop before the destination, combined with a failed ping, indicates the path is intact up to that point but the final destination is not responding to ICMP echo requests. This commonly means the server is down, its firewall is blocking ICMP, or it is otherwise unreachable at Layer 3. The traceroute output confirms intermediate routers are forwarding traffic correctly, so the problem is localized to the destination host or its immediate network.

Answer

The intermediate router is down.

Answer

The default gateway is misconfigured.

Answer

The DNS server is down.

Question 12

Which tool is best suited for identifying a slow network segment caused by excessive broadcast traffic?

Accepted Answer

Protocol analyzer.. Broadcast storms or high volumes of traffic can severely degrade network performance. A protocol analyzer, or network sniffer, allows a technician to capture packets and examine the distribution of traffic types. By looking at the percentage of broadcast traffic compared to unicast traffic, one can identify if a specific segment is being overwhelmed by broadcast frames, which is critical for maintaining network latency and stability.

Answer

Cisco DNA Center.

Answer

SNMP Manager.

Answer

TDR cable tester.

Question 13

Refer to the exhibit. What is the most likely cause of poor performance on this link?

Accepted Answer

The link is experiencing excessive congestion.. The exhibit shows an input rate of 1000 Mbps on an interface with a bandwidth of only 100 Mbps. This indicates massive oversubscription and congestion. The interface is attempting to process ten times the amount of data it is capable of handling, leading to packet drops, buffer exhaustion, and significant latency. This is a capacity issue rather than a physical error or protocol mismatch, requiring a bandwidth upgrade or traffic shaping.

Answer

The interface has a duplex mismatch.

Answer

The cable is faulty and causing retransmissions.

Answer

The interface MTU is configured incorrectly.

Question 14

When a network administrator uses the 'ping' command to test connectivity, what is the primary purpose of the ICMP 'Echo Request' and 'Echo Reply' process?

Accepted Answer

To verify reachability and basic network connectivity.. ICMP is a control protocol used for reporting network conditions. The 'Echo Request' and 'Echo Reply' messages are specifically designed to verify end-to-end connectivity between two IP hosts. When a request is sent, the destination host replies, confirming that the path is active and the host is reachable. This is the simplest way to confirm that layers 1, 2, and 3 are functioning correctly.

Answer

To establish a TCP session for data transfer.

Answer

To resolve a hostname to an IP address.

Answer

To encrypt packets for secure communication.

Question 15

A network is experiencing high latency. The administrator finds that the switch has high CPU utilization. Which diagnostic step is most appropriate to identify the cause?

Accepted Answer

Run 'show processes cpu' to identify the top processes.. High CPU on a switch often indicates that the control plane is being overwhelmed by traffic that requires processing rather than hardware switching. By using the 'show processes cpu' command, the administrator can identify which specific process is consuming resources. This allows for distinguishing between legitimate traffic spikes, management overhead, or an ongoing denial-of-service attack, which helps in applying the correct mitigation strategy to restore network performance.

Answer

Check the ARP table for excessive entries.

Answer

Clear the interface statistics.

Answer

Disable spanning-tree on all ports.

Question 16

A network technician is troubleshooting a PC that cannot access internal network resources. Which TWO steps are recommended to verify if the PC is receiving a valid IP address?

Accepted Answer

Run ipconfig on the workstation.. Verifying the IP configuration is essential when network access fails. Using 'ipconfig' allows the technician to see if the PC has a valid address, subnet mask, and gateway. Checking the DHCP server configuration ensures that the scope is not exhausted and that the client is actually communicating with the server. These two steps confirm if the layer 3 addressing is correct before moving on to more complex layer 2 or routing issues.

Answer

Check the switch interface status.

Answer

Perform a traceroute to the local gateway.

Answer

Reset the switch configuration.

Question 17

Refer to the exhibit. Why is the router unable to reach the internet?

Accepted Answer

The default route is missing.. The routing table shows only local subnets and lacks a gateway of last resort, which is required for routing traffic to external networks like the internet. Without a default route (0.0.0.0/0), the router does not know where to send packets destined for non-local addresses. Configuring a static default route pointing to the ISP is the standard fix to enable internet access on this device.

Answer

The interface is shut down.

Answer

The subnet mask is incorrect.

Answer

The router has no IP address assigned.

Question 18

What is the primary function of a loopback interface in troubleshooting network devices?

Accepted Answer

To provide a stable interface for management and testing.. A loopback interface is a logical, virtual interface that is always 'up' as long as the router is running. It is primarily used for management, testing, and as a stable source IP for routing protocols like OSPF and BGP. Because it is never dependent on physical cable status, it provides a reliable point for testing connectivity and management access regardless of physical link failures.

Answer

To act as a physical bridge between two VLANs.

Answer

To increase the total bandwidth of the router.

Answer

To provide power over Ethernet to connected devices.

Question 19

A technician suspects a cable issue on a copper link. Which command should they use to check for electrical issues like shorts or opens?

Accepted Answer

test cable-diagnostics tdr interface <int>. The TDR (Time Domain Reflectometer) feature available on many modern Cisco switches allows the administrator to perform a diagnostic test on the physical copper cable. By sending a pulse of energy and measuring the reflection, the switch can accurately identify if there is an open or short circuit, or if the cable length is within operational limits, providing clear physical layer diagnostic data without additional hardware.

Answer

show cable status

Answer

ping -t <ip>

Answer

show interfaces summary

Question 20

A help desk technician is troubleshooting a user who can access internal network shares using an IP address but cannot reach the same shares using the server's hostname. Which network service should the technician investigate first?

Accepted Answer

DNS. DNS resolution translates human-readable hostnames into IP addresses required for routing across the network. When a user can reach internal services via IP but fails via hostname, the underlying network transport is functional, but the application-layer mapping service is failing. Diagnosing this involves checking the configured DNS server address on the client and verifying connectivity.

Answer

Default Gateway

Answer

DHCP

Answer

ARP