CCNA Network Infrastructure and Connectivity Practice Question
A host sends traffic to a web server on another subnet. Which address is used as the destination MAC address in the first Ethernet frame sent by the host?
⚠ Common exam trap
Remember that the destination MAC address for remote communication is the default gateway's, not the remote host's.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The MAC address of the local default gateway
When a host wants to communicate with a device on a different subnet, it cannot reach that device directly. The host must send the frame to its default gateway, which is the router that connects to other subnets. Therefore, the destination MAC address in the first Ethernet frame is the MAC address of the local default gateway, not the remote web server (A). The DNS server (C) is used for name resolution, not for forwarding traffic. The broadcast MAC address (D) would send the frame to all devices on the local subnet, which is not appropriate for unicast communication to a remote destination.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The MAC address of the remote web server
Why it's wrong here
The remote web server is on a different subnet, so its MAC address is not reachable at Layer 2. The host cannot determine the remote MAC via ARP because ARP requests are limited to the local subnet. To send traffic off-subnet, the host encapsulates the IP packet in a frame addressed to the local default gateway's MAC, which then routes it across the network. The remote server's MAC is only used on its own local segment, not in the original frame sent by the host.
When this WOULD be correct
In a different scenario where a question asks about the MAC address used in a direct communication between two devices on the same local network, the MAC address of the remote web server would be the correct answer if both devices are on the same subnet and can communicate directly.
- ✓
The MAC address of the local default gateway
Why this is correct
The host's routing table indicates that the destination IP is not on the local subnet, so the packet must be sent to the default gateway. The destination MAC in the Ethernet frame is therefore the gateway's interface MAC, resolved via ARP, while the destination IP address remains that of the web server. The gateway then strips the frame and forwards the packet toward the remote subnet, changing the frame headers at each hop while preserving the IP addresses.
- ✗
The MAC address of the DNS server
Why it's wrong here
The DNS server's MAC address is used only when the host sends DNS queries. For the actual web request destined to another subnet, the host must forward the IP packet to the default gateway; the DNS server's MAC is never placed in the frame header of that web traffic. Even if DNS resolution just occurred, the resulting web packet uses the gateway's MAC, not the DNS server's.
When this WOULD be correct
In a different exam scenario, if the question asked about the MAC address used when a host is sending a DNS query to a DNS server within the same local subnet, then the correct answer would be the MAC address of the DNS server, as the host would communicate directly with it without needing to go through a gateway.
- ✗
The broadcast MAC address
Why it's wrong here
A broadcast MAC address (FF:FF:FF:FF:FF:FF) would flood the frame to every device on the local LAN, causing unnecessary processing and security exposure. Broadcast frames are not forwarded by IP routers, so the packet would never leave the local subnet. Broadcast is appropriately reserved for ARP requests and DHCP discovery, not for ordinary unicast forwarding to a remote destination.
When this WOULD be correct
If the question were to ask about the initial frame sent by a host to discover all devices on the local network, such as during an ARP request for an IP address, the destination MAC address would be the broadcast MAC address (FF:FF:FF:FF:FF:FF).
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓The MAC address of the local default gatewayCorrect answer▾
Why this is correct
The host's routing table indicates that the destination IP is not on the local subnet, so the packet must be sent to the default gateway. The destination MAC in the Ethernet frame is therefore the gateway's interface MAC, resolved via ARP, while the destination IP address remains that of the web server. The gateway then strips the frame and forwards the packet toward the remote subnet, changing the frame headers at each hop while preserving the IP addresses.
✗The MAC address of the remote web serverWrong answer — click to see why▾
Why this is wrong here
The remote web server is on a different subnet, so its MAC address is not reachable on the local LAN. The host must send the frame to the default gateway, not directly to the remote server.
★ When this WOULD be the correct answer
In a different scenario where a question asks about the MAC address used in a direct communication between two devices on the same local network, the MAC address of the remote web server would be the correct answer if both devices are on the same subnet and can communicate directly.
Why candidates choose this
Students may think that the destination MAC address should always be the final destination's MAC, but this is only true for devices on the same subnet. For off-subnet traffic, the MAC address of the default gateway is used.
✗The MAC address of the DNS serverWrong answer — click to see why▾
Why this is wrong here
The DNS server is used to resolve domain names to IP addresses, but it does not participate in the Layer 2 forwarding of data frames. The destination MAC address for the first frame is determined by the next-hop IP address (default gateway), not the DNS server.
★ When this WOULD be the correct answer
In a different exam scenario, if the question asked about the MAC address used when a host is sending a DNS query to a DNS server within the same local subnet, then the correct answer would be the MAC address of the DNS server, as the host would communicate directly with it without needing to go through a gateway.
Why candidates choose this
Students might confuse the role of DNS in name resolution with the process of determining the next-hop MAC address. They may think that the DNS server provides the MAC address or is involved in the forwarding decision.
✗The broadcast MAC addressWrong answer — click to see why▾
Why this is wrong here
A broadcast MAC address (FF:FF:FF:FF:FF:FF) is used to send frames to all devices on the local network, such as in ARP requests. For unicast traffic to a remote server, the host uses the MAC address of the default gateway, not a broadcast address.
★ When this WOULD be the correct answer
If the question were to ask about the initial frame sent by a host to discover all devices on the local network, such as during an ARP request for an IP address, the destination MAC address would be the broadcast MAC address (FF:FF:FF:FF:FF:FF).
Why candidates choose this
Students may recall that ARP uses broadcast to find the MAC address of the default gateway, but the actual data frame uses the learned unicast MAC address, not a broadcast. They might mistakenly think the data frame itself is broadcast.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
IPv4 Address Class Summary
| Class | First Octet Range | Default Mask | Networks | Hosts per Network |
|---|---|---|---|---|
| A | 1–126 | /8 (255.0.0.0) | 126 | 16,777,214 |
| B | 128–191 | /16 (255.255.0.0) | 16,384 | 65,534 |
| C | 192–223 | /24 (255.255.255.0) | 2,097,152 | 254 |
| D | 224–239 | N/A | Multicast groups | — |
| E | 240–255 | N/A | Reserved / experimental | — |
127.x.x.x is reserved for loopback. Modern networks use CIDR (classless) rather than classful addressing.
Go deeper
Related to this question
Learn chapter
IPv4 Addressing and Address Classes
Key term
Frame
A frame is a unit of data at the Data Link layer of networking, containing header, payload, and trailer information for local network delivery.
Key term
Default gateway
A default gateway is a network device, typically a router, that acts as the exit point for traffic from a local network to other networks, including the internet.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.