CCNA Network Services and Security Practice Question
A host at 192.168.50.10/24 needs to send traffic to 192.168.60.20. Which MAC address will it normally place in the Ethernet destination field for the first frame?
⚠ Common exam trap
A frequent exam trap is selecting the remote host’s MAC address as the Ethernet destination for off-subnet traffic. This is incorrect because ARP requests cannot resolve MAC addresses beyond the local subnet. Candidates may confuse IP routing with MAC addressing and assume direct frame delivery to the remote device. The trap lies in overlooking the default gateway’s role as the local next-hop device that receives frames destined for remote IPs. Remember, the host always sends the frame to the gateway’s MAC, not the remote host’s MAC, when the destination is outside the local subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The MAC address of its configured default gateway
When a host wants to send traffic to a different IP subnet, it does not send the frame directly to the remote device’s MAC address. In plain language, the host knows the destination IP is off its local network, so it hands the traffic to the local router. That means the Ethernet frame is addressed to the default gateway’s MAC address, while the IP packet inside still carries the final remote IP destination. A host uses ARP to learn MAC addresses on its own LAN. Since the remote host is not local, the sender does not ARP for the remote host’s MAC. Instead, it ARPs for the gateway interface on the same subnet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The MAC address of the remote host at 192.168.60.20
Why it's wrong here
The remote host at 192.168.60.20 is located on a different IP subnet, so it cannot be reached by a direct Ethernet frame. ARP requests are sent as Layer 2 broadcasts and are never forwarded across a router to another subnet — each interface has its own ARP table. Therefore, the host at 192.168.50.10 never even learns the MAC address of 192.168.60.20; even if it somehow did, placing that MAC as the destination would cause the router to drop the frame because the router's interface MAC is the required next-hop address.
When this WOULD be correct
In a scenario where both hosts are on the same subnet (e.g., 192.168.50.0/24), a question might ask what MAC address a host would use to communicate directly with another host on the same network. In that case, the MAC address of the remote host at 192.168.60.20 would be correct.
- ✗
The broadcast MAC address only
Why it's wrong here
The broadcast MAC address (FF-FF-FF-FF-FF-FF) is only used as the destination in an ARP request frame when the host is asking 'who has this IP?', which occurs to find the gateway's MAC. It is never the destination MAC of the actual data packet carrying the IP traffic. Using the broadcast address for the data frame would send the unicast frame to every host on the segment, defeating unicast routing and causing unnecessary processing and drops on stations not designed to accept that broadcast frame.
When this WOULD be correct
In a scenario where a host is broadcasting a message to all devices on the local network segment, such as an ARP request to discover the MAC address of 192.168.60.20, the broadcast MAC address (FF:FF:FF:FF:FF:FF) would be the correct choice.
- ✓
The MAC address of its configured default gateway
Why this is correct
When a host must send traffic to an IP address outside its local subnet (like 192.168.60.x from 192.168.50.0/24), it cannot resolve that remote IP to a MAC address via ARP, since ARP is confined to the local broadcast domain. Instead, the host looks up its routing table, identifies the configured default gateway as the next hop, and ARPs for that gateway's IP address to obtain its MAC. The resulting Ethernet frame then uses the gateway's MAC as the destination L2 address, while the destination IP remains the remote host's address, relying on the router to perform Layer 3 forwarding.
- ✗
Its own source MAC address
Why it's wrong here
A host always uses its own MAC address as the source address in an Ethernet frame, since the frame is generated by that host — it never appears in the destination field. The destination MAC must point to the immediate next-hop device, which for off-subnet traffic is the default gateway's interface on the local network. If the host put its own MAC in the destination, the frame would be received and discarded by its own network stack as if it were a looped-back frame, and the traffic would never leave the local host.
When this WOULD be correct
In a different question where a host needs to send traffic to a device on the same local network, and the question specifies that the destination is reachable directly, the host would place its own MAC address in the source field while the destination MAC would be that of the intended recipient.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The MAC address of its configured default gatewayCorrect answer▾
Why this is correct
When a host must send traffic to an IP address outside its local subnet (like 192.168.60.x from 192.168.50.0/24), it cannot resolve that remote IP to a MAC address via ARP, since ARP is confined to the local broadcast domain. Instead, the host looks up its routing table, identifies the configured default gateway as the next hop, and ARPs for that gateway's IP address to obtain its MAC. The resulting Ethernet frame then uses the gateway's MAC as the destination L2 address, while the destination IP remains the remote host's address, relying on the router to perform Layer 3 forwarding.
✗The MAC address of the remote host at 192.168.60.20Wrong answer — click to see why▾
Why this is wrong here
This option is wrong because the host at 192.168.50.10 cannot directly resolve the MAC address of 192.168.60.20, as they are on different subnets and require the default gateway for routing.
★ When this WOULD be the correct answer
In a scenario where both hosts are on the same subnet (e.g., 192.168.50.0/24), a question might ask what MAC address a host would use to communicate directly with another host on the same network. In that case, the MAC address of the remote host at 192.168.60.20 would be correct.
Why candidates choose this
Candidates may choose this option due to a misunderstanding of MAC address resolution, thinking that the destination MAC address is always needed for any communication, regardless of subnetting.
✗The broadcast MAC address onlyWrong answer — click to see why▾
Why this is wrong here
This option is wrong because the host at 192.168.50.10 cannot directly send frames to 192.168.60.20 without knowing its MAC address, and it will first send the frame to its default gateway instead.
★ When this WOULD be the correct answer
In a scenario where a host is broadcasting a message to all devices on the local network segment, such as an ARP request to discover the MAC address of 192.168.60.20, the broadcast MAC address (FF:FF:FF:FF:FF:FF) would be the correct choice.
Why candidates choose this
Candidates might choose this option because they recall that broadcast messages are used for network discovery and may confuse it with the need to reach a host outside the local subnet.
✗Its own source MAC addressWrong answer — click to see why▾
Why this is wrong here
This option is wrong because the host cannot send a frame directly to the MAC address of 192.168.60.20 without first resolving it through the ARP protocol, as it is on a different subnet.
★ When this WOULD be the correct answer
In a different question where a host needs to send traffic to a device on the same local network, and the question specifies that the destination is reachable directly, the host would place its own MAC address in the source field while the destination MAC would be that of the intended recipient.
Why candidates choose this
Candidates may choose this option because they might confuse the source MAC address with the destination MAC address, thinking that the host would use its own address in the Ethernet frame for communication.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Device File Management with SFTP and SCP
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
Default gateway
A default gateway is a network device, typically a router, that acts as the exit point for traffic from a local network to other networks, including the internet.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.