Multi-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination.
Start Scenario PracticeA small office wants to reduce the risk of malware arriving through email and malicious websites while keeping administration simple. Which two measures provide the strongest protection against these threats? (Choose two.)
Explanation: The strongest pairing couples host-level defense with network-level filtering. Endpoint antivirus catches payloads that reach the workstation, while a secure web gateway or DNS filtering service blocks the malicious domains that deliver those payloads. Together they cover both the email and web vectors named in the scenario without heavy administrative overhead, whereas disabling updates, permitting all outbound traffic, and sharing administrator accounts all increase exposure.
Which TWO of the following are primary security benefits of implementing an Access Control List (ACL) on a Cisco router interface?
Explanation: ACLs are essential tools for traffic filtering and network segmentation. By controlling which packets are permitted or denied based on source, destination, and protocol, administrators enforce security policies at the network edge or between VLANs. Understanding how ACLs manage traffic flow is critical for maintaining network integrity and preventing unauthorized data access, as they provide the fundamental mechanism for restricting communication between sensitive network segments in a controlled and highly audit-able manner.
A network designer is planning to use the 10.50.0.0/16 address space. Which TWO of the following represent valid network IDs for subnets created by further dividing this space into /24 segments?
Explanation: Options A (10.50.1.0) and B (10.50.255.0) are correct because when 10.50.0.0/16 is divided into /24 subnets, the third octet becomes the subnet identifier and the fourth octet must be 0, giving valid network IDs such as 10.50.0.0, 10.50.1.0, and 10.50.255.0, all of which fall within the 10.50.0.0–10.50.255.0 range. Option C (10.51.0.0) is outside the 10.50.0.0/16 block, since 10.51.x.x belongs to a different /16. Option D (10.50.0.255) is a host address within 10.50.0.0/24, not a network ID, because the host portion is non-zero. Option E (10.50.1.1) is also a host address in the 10.50.1.0/24 subnet, not a valid network ID.
Which TWO methods are considered effective for securing the control plane of Cisco networking devices? (Choose two.)
Explanation: Securing the control plane is essential to protect the CPU from resource exhaustion and unauthorized access. By limiting access to management interfaces and protecting the CPU from excessive traffic, administrators ensure the stability of the device routing and switching functions. These practices are critical because the control plane is the 'brain' of the network device; if it is compromised or overwhelmed, the entire network segment may experience service outages.
A network engineer is deploying a new Cisco switch and needs to configure it for remote management. The engineer wants to ensure that management traffic is isolated from user data traffic and that only authorized personnel can access the switch. Which two configuration steps should the engineer perform? (Choose two.)
Explanation: To enable secure remote management, the switch needs an IP address on a management VLAN interface, and remote access should use SSH while Telnet is disabled. These steps provide a reachable management address and ensure that management sessions are encrypted. Other options, like port security or DHCP snooping, address different security concerns and do not fulfill the specific requirements.
+15 more scenario questions available
Practice all Select Two (Multi-Select) QuestionsMulti-select questions tell you to 'Choose TWO' or 'Choose THREE'. Getting partial credit is not a thing — you must select all correct answers with no incorrect ones. The stem always states how many to choose, so trust it. These questions require precision, not best-guess elimination. These appear throughout the 100-150 and require you to apply your knowledge, not just recall facts.
Cisco doesn't publish an exact breakdown, but scenario-based questions (especially exhibit and command-output formats) make up a significant portion of the 100-150. Practicing each scenario type ensures you're ready for any format.
Yes. Courseiva provides free 100-150 scenario practice across all official exam domains. The platform includes scenario-based questions, command-output interpretation, topic-based practice, mock exams, and readiness tracking — no account required.
Launch a full Select Two (Multi-Select) Questions session with instant scoring and detailed explanations.
Start Scenario Practice →