Courseiva

CCNA 200-301 v2 (200-301) — Questions 751825

1389 questions total · 19pages · All types, answers revealed

Page 10

Page 11 of 19

Page 12
751
MCQhard

A router learns 172.16.0.0/16 from OSPF and 172.16.10.0/24 from a static route. Which route is used for traffic to 172.16.10.55?

A.The OSPF /16 route
B.The static /24 route
C.The default route
D.Neither route because the prefixes overlap
AnswerB

The static /24 route is correct because the destination 172.16.10.55 matches its prefix length of 24 bits (172.16.10.0/24), whereas the OSPF /16 route only matches the first 16 bits. Routers use longest prefix match (LPM) to select the most specific route, and the /24 is more specific than both the /16 and any default route. Even though OSPF may have a lower administrative distance, prefix length takes precedence over AD for route selection when prefixes differ, so the static /24 is installed in the forwarding table for this destination.

Why this answer

The static /24 route is used because it is more specific than the OSPF /16 route. In plain language, even though OSPF is a dynamic source and the /16 covers the destination broadly, the router prefers the entry that describes the exact destination range more precisely. Since 172.16.10.55 falls within 172.16.10.0/24, that route wins under longest-prefix match.

This is a classic example of route specificity taking priority before broader route-source comparisons would matter between equal prefix lengths.

Exam trap

A frequent exam trap is assuming that the dynamic OSPF route will always be preferred over a static route, regardless of prefix length. Many candidates overlook that the router prioritizes the longest-prefix match before considering administrative distance or route source. Because 172.16.10.0/24 is more specific than 172.16.0.0/16, the router uses the static route for traffic to 172.16.10.55.

Misunderstanding this can lead to incorrect answers, especially when both routes overlap. Remember, overlapping routes are common and resolved by prefix specificity, not by route type alone.

Why the other options are wrong

A

The OSPF /16 route is less specific than the static /24 route. Although OSPF is a dynamic routing protocol, the router prefers the route with the longer prefix length, so this option is incorrect.

C

The default route is only used when no specific matching route exists. Since both OSPF and static routes cover the destination, the default route is not used here, so this option is incorrect.

D

Overlapping prefixes are normal in routing tables and do not prevent route selection. The router resolves overlaps using longest-prefix match, so this option is incorrect.

When would these options actually be correct?

A

In a different scenario where the static route is removed or not configured, the OSPF /16 route would be the only available route for traffic to 172.16.10.55. Thus, the OSPF route would be the correct answer in that case.

C

In a different question where the router has no specific routes for the destination IP address and only a default route configured, traffic to an unknown destination would use the default route. For example, if the question stated that the router only had a default route and no other specific routes for 172.16.10.55, then the default route would be correct.

D

In a scenario where a question states that both routes are configured but the static route is incorrectly defined as 172.16.0.0/24 instead of /16, the option D would be correct, as both routes would overlap and cause ambiguity in routing decisions.

Why candidates pick the wrong answer

A

Students may think OSPF is preferred over static routes due to lower administrative distance, but they forget that longest-prefix match is evaluated first. The /16 route covers the destination but is not the most specific match.

C

Students might think that if a route is learned via OSPF and a static route exists, the router might fall back to a default route. However, the presence of any matching route (even a static one) prevents the default route from being used.

D

Some students may incorrectly believe that overlapping prefixes cause a routing loop or error, but routers handle overlapping routes by choosing the most specific match. This is a fundamental concept in IP routing.

752
Matchingmedium

Match each service or visibility technology to the most appropriate use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Collecting device events and messages centrally

Reading interface status and counters from devices

Finding which hosts are using the most bandwidth

Keeping event timelines consistent across systems

Why these pairings

Syslog collects device events and messages centrally, providing a centralized log repository. SNMP reads interface status and counters from devices, offering real-time device monitoring. NetFlow analyzes network traffic to identify bandwidth usage by host, making it ideal for finding top talkers.

NTP synchronizes clocks across systems to maintain consistent event timelines. Each technology is matched to its primary use case.

Exam trap

The trap here is that many technologies have overlapping capabilities (e.g., SNMP can also monitor interface traffic, but it is not a traffic analysis tool like NetFlow). Candidates must focus on the primary, most specific use case for each technology as defined in Cisco documentation.

When would these options actually be correct?

C

If the question asked to match technologies to incorrect but plausible roles in a legacy network where SNMP was misused for log collection and Syslog for device monitoring, this mapping could be presented as a distractor.

D

This option would be correct if the question asked to match technologies to use cases in a reversed or scrambled order, such as 'SNMP for performance measurement' in a scenario where SNMP is used to measure response times via custom MIBs, and 'NetFlow for logs' if NetFlow is used to export flow logs to a collector.

Why candidates pick the wrong answer

B

Candidates might pick this if they confuse SNMP's ability to monitor interface traffic (via counters) with actual traffic analysis, or if they think NetFlow provides device-level metrics like CPU usage.

C

Candidates may confuse the functions of SNMP and Syslog, or think IP SLA is for traffic analysis due to its name, leading to mismatching based on superficial understanding.

D

Candidates may confuse the primary functions of SNMP, NetFlow, Syslog, and IP SLA due to overlapping use cases (e.g., SNMP can monitor performance metrics, leading to misassignment as a performance measurement tool).

753
Drag & Dropmedium

Drag and drop the following steps into the correct order to configure and verify HSRP on a router interface.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
6Step 6
7Step 7

Why this order

The correct order begins by entering interface configuration mode, because all HSRP commands are applied at the interface level. Next, assign a physical IPv4 address to the interface, as HSRP requires a Layer 3 interface with an IP address to function. Set HSRP version 2 before defining the HSRP group to ensure compatibility with extended group numbers and newer features.

Then configure the HSRP group number and virtual IP address to create the standby group. After that, set the router’s priority and enable preemption; these steps customize the active/standby election process. Finally, verify the configuration with the show standby command to confirm HSRP operation.

754
MCQhard

An internal server must always be reachable from outside using the same public IP address. Which translation approach is most appropriate?

A.Static NAT
B.PAT overload
C.No NAT
D.DHCP relay
AnswerA

Static NAT creates a one-to-one fixed mapping between an inside private IP and an inside global public IP. This ensures the server's public address never changes, so inbound connections from the Internet to that address are always translated to the same internal server. It also allows the server to initiate outbound traffic with a consistent source address. This is required for an internal server to be reachable from outside.

Why this answer

A static NAT mapping is the most appropriate approach. In plain language, the outside world needs a stable public address that always represents the same internal server. Static NAT provides that fixed one-to-one relationship, which makes the service reachable predictably.

PAT is better suited for many outbound users sharing one public address, not for presenting one inside server with a consistent external identity. The correct answer is the one that provides a permanent mapping.

Exam trap

A common exam trap is selecting PAT overload instead of static NAT for a server that must be reachable from outside using the same public IP. PAT overload is designed for many internal hosts sharing a single public IP for outbound connections, not for providing a fixed public IP for inbound access. This misunderstanding leads to incorrect assumptions about how inbound traffic is handled.

The exam tests your ability to distinguish between dynamic port-based translation and static one-to-one mappings, so confusing these concepts can cause you to choose the wrong NAT approach.

Why the other options are wrong

B

PAT overload is incorrect because it allows multiple internal hosts to share a single public IP for outbound traffic but does not provide a stable public IP for inbound connections to a specific server.

C

No NAT is incorrect because private IP addresses are not routable on the Internet, so the internal server would not be reachable from outside without address translation.

D

DHCP relay is unrelated to NAT or external reachability; it only forwards DHCP requests between clients and servers across subnets and does not affect how the server is accessed externally.

When would these options actually be correct?

B

If the question stated that multiple internal servers need to be accessible from the outside using a single public IP address, and the focus was on conserving IP addresses while allowing multiple connections, PAT overload would be the correct answer. This would apply in scenarios where port numbers can differentiate between connections.

C

In a scenario where the question asks for a method to connect internal devices directly to the internet without any IP address translation, 'No NAT' would be the correct answer. This could involve a setup where all devices are assigned public IPs directly, eliminating the need for NAT.

D

If the question asked about ensuring that DHCP clients can receive IP addresses from a remote DHCP server while maintaining connectivity across different subnets, DHCP relay would be the correct answer. This scenario would focus on the management of IP address assignment rather than NAT.

Why candidates pick the wrong answer

B

Students might confuse PAT with static NAT because both involve translating private addresses to public ones. However, PAT is primarily designed for many-to-one outbound translations, not for providing a fixed inbound mapping for a server.

C

Some students might think that if a server is directly connected to the internet with a public IP, no NAT is needed. However, the question specifies an internal server, implying it uses a private IP, so translation is required.

D

The term 'relay' might be confused with 'translation' or 'forwarding' in the context of network address translation. However, DHCP relay is a completely different function related to IP address assignment, not persistent external access.

755
Matchingmedium

Drag and drop the VLAN/trunking commands and terms on the left to their correct descriptions or functions on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Enables 802.1Q trunking on a switch interface

Assigns an access port to VLAN 10

VLAN that carries untagged traffic on a trunk link; default is VLAN 1

Changes the native VLAN on a trunk to VLAN 99

Uses subinterfaces on a single router interface to route between VLANs

Why these pairings

These pairings match common VLAN/trunking commands and terms to their correct descriptions.

Exam trap

Do not confuse the commands for access and trunk ports. Remember that 'switchport mode access' places the port in access mode, while 'switchport mode trunk' places it in trunk mode. Also, the native VLAN and VLAN 1 are related to trunking and default settings, not to the configuration of an access port.

756
Multi-Selectmedium

Which three of the following are characteristics of wireless LAN (WLAN) operation in the 2.4 GHz and 5 GHz bands? (Choose three.)

Select 3 answers
.The 5 GHz band offers more non-overlapping channels than the 2.4 GHz band.
.The 2.4 GHz band generally provides longer range than 5 GHz for the same transmit power.
.Both bands can be used simultaneously by dual-band access points.
.The 2.4 GHz band supports higher data rates than the 5 GHz band.
.The 5 GHz band experiences more interference from Bluetooth devices.
.Both bands require a license for operation in enterprise environments.

Why this answer

The 5 GHz band offers more non-overlapping channels (up to 23 or 25, depending on regulatory domain) compared to the 2.4 GHz band, which has only three non-overlapping channels (1, 6, 11). The 2.4 GHz band generally provides longer range due to better propagation characteristics and lower attenuation through obstacles. Dual-band access points can operate simultaneously on both bands, allowing clients to connect on either frequency.

Exam trap

Cisco often tests the misconception that the 2.4 GHz band has more channels or that 5 GHz always provides longer range, but the correct understanding is that 5 GHz has more non-overlapping channels and 2.4 GHz offers better range due to lower frequency propagation.

757
Multi-Selectmedium

Which TWO statements accurately describe the characteristics and deployment considerations for fiber optic cabling in a modern enterprise network?

Select 2 answers
A.Single-mode fiber (SMF) typically uses a larger core diameter than multimode fiber (MMF).
B.Multimode fiber (MMF) is generally preferred for longer-distance links, such as between buildings on a campus network.
C.A 1000BASE-LX SFP transceiver operating over single-mode fiber can support distances up to 10 km.
D.When using a 10GBASE-SR SFP+ transceiver over OM3 multimode fiber, the maximum supported distance is 300 meters.
E.Fiber optic cabling is immune to electromagnetic interference (EMI), making it ideal for environments with high electrical noise.
AnswersD, E

Under IEEE 802.3ae, a 10GBASE-SR SFP+ transceiver operating over OM3 multimode fiber supports a maximum link length of 300 meters. OM3 is a laser-optimized 50/125 µm fiber with an effective modal bandwidth of 2000 MHz·km at 850 nm, which is the wavelength used by the short-range VCSEL optic in 10GBASE-SR. This 300-meter limit specifically applies to OM3; OM4 raises the distance to 400 meters, while OM2 supports only about 82 meters at 10 Gbps.

Why this answer

The correct statements are that 10GBASE-SR over OM3 multimode fiber supports up to 300 meters and that fiber optic cabling is immune to electromagnetic interference (EMI), making it ideal for electrically noisy environments. Single-mode fiber actually has a smaller core diameter than multimode, making option A incorrect. Multimode fiber is designed for shorter links, so option B is wrong.

Standard 1000BASE-LX SFP transceivers over single-mode fiber are limited to 5 km, not 10 km, so option C is inaccurate.

Exam trap

Cisco often tests the misconception that single-mode fiber has a larger core diameter than multimode fiber, when in fact the opposite is true, and that multimode fiber is suitable for long-haul links, whereas it is actually limited to shorter distances due to modal dispersion.

Why the other options are wrong

A

Single-mode fiber has a smaller core diameter (typically 9 microns) than multimode (50 or 62.5 microns), so this reverses the relationship.

B

Multimode fiber’s larger core introduces modal dispersion, limiting it to shorter distances; long-distance links use single-mode fiber.

C

IEEE 1000BASE-LX specifies a maximum distance of 5 km over single-mode fiber; 10 km is beyond the standard CCNA curriculum.

When would these options actually be correct?

C

In enterprise networks, 1000BASE-LX SFP transceivers are commonly used for long-haul links over single-mode fiber, supporting distances up to 10 km. This makes them ideal for connecting geographically separated buildings or campus backbones where cost-effective gigabit connectivity over several kilometers is required.

Why candidates pick the wrong answer

A

Students may confuse the terms 'single-mode' and 'multimode', incorrectly assuming that single-mode implies a larger core to carry a single light path, whereas the opposite is true.

B

Test-takers might think that because MMF supports multiple light modes, it can transmit over longer distances, but in reality, modal dispersion limits its reach.

758
MCQmedium

Why is JSON often preferred over completely unstructured text in API responses?

A.Because JSON provides structured, machine-readable data that software can parse consistently.
B.Because JSON automatically encrypts the payload.
C.Because JSON replaces the need for authentication.
D.Because JSON is the same thing as HTTPS.
AnswerA

JSON provides a standard, hierarchical model using objects, arrays, and primitive values that every conforming parser maps to native language data structures in a deterministic way. Because the grammar is rigorously specified, automation scripts and network controllers can rely on the same interpretation of a payload across different platforms, eliminating the ambiguity inherent in free-form text. This machine-readability underpins programmatic workflows such as intent-based networking, where devices must reliably consume configuration data to enforce policy.

Why this answer

JSON is preferred because it gives software a predictable structure to parse. In practical terms, an application can look for keys, values, arrays, and objects instead of trying to interpret a free-form text paragraph meant mainly for human readers. That makes programmatic processing far more reliable.

This is one of the main reasons JSON is so common in controller APIs and automation tools. It is about structure and machine readability, not encryption, authentication, or HTTPS.

Exam trap

A frequent exam trap is assuming JSON automatically provides encryption or replaces authentication mechanisms. Candidates might incorrectly believe JSON secures data or manages access control, which is false. JSON is solely a structured data format and does not handle security functions.

Confusing JSON with HTTPS or other security protocols leads to misunderstandings about network automation and API behavior. This mistake can cause incorrect answers about how data is protected or transmitted in Cisco automation environments.

Why the other options are wrong

B

Option B is incorrect because JSON is a data format and does not provide encryption. Encryption is handled by protocols like TLS or HTTPS, not by JSON itself, so this option confuses data formatting with security.

C

Option C is wrong since JSON does not replace authentication. Authentication and access control are separate concerns managed by security protocols or API gateways, not by the data format used in responses.

D

Option D is false because JSON is a data format, whereas HTTPS is a transport and security protocol. They serve different purposes and are not interchangeable concepts.

When would these options actually be correct?

B

If the exam question asked about data formats that include built-in security features, such as encrypted data formats or protocols that automatically encrypt data, then this option could be correct. For example, a question about formats that ensure confidentiality would make this statement valid.

C

If the exam question asked about the benefits of using JSON in a context where authentication is not required, or if it specifically addressed a scenario where JSON is used in a system that inherently trusts all requests, this option could be seen as correct.

D

If the question were about the relationship between data formats and protocols, asking which data format is commonly used with secure transmission protocols, then stating that JSON is the same as HTTPS could be misleadingly interpreted as correct in a context that conflates data formats with transmission methods.

Why candidates pick the wrong answer

B

Students might confuse JSON with secure data formats or think that structured data implies security, but encryption is a separate concern.

C

A test-taker might incorrectly assume that using a standard format like JSON simplifies security, but authentication is a distinct requirement.

D

Both are commonly used in web APIs, leading to confusion. A student might think JSON is part of HTTPS or that they are interchangeable, but they are complementary technologies.

759
MCQmedium

Exhibit: A wireless client can see the SSID and associates successfully, but it never gets network access. Other users on the same SSID work. Which issue is the best fit?

A.The AP is advertising the wrong channel width
B.The client failed to obtain a valid IP address from DHCP
C.The SSID must be changed from broadcast to hidden
D.WPA2 automatically blocks clients until NTP is configured
AnswerB

The client successfully completes Layer 2 association and authentication, but without a valid DHCP lease it has no IP address, subnet mask, default gateway, or DNS servers. This leaves the client appearing connected to the Wi-Fi network yet unable to reach any external resources, which is the classic symptom of DHCP failure after association.

Why this answer

Successful association means the radio connection is up. If only one client fails to get network access while others work, the most likely issue is a client-specific addressing problem such as not obtaining a valid DHCP lease. Option A is incorrect because channel width affects all clients, not just one.

Option C is incorrect because hiding the SSID does not affect network access after association. Option D is incorrect because WPA2 does not block clients due to NTP; NTP is unrelated to client authentication.

Exam trap

Don't confuse association issues with post-association network access problems. Ensure you understand the difference between connecting to the SSID and obtaining network access.

Why the other options are wrong

A

Channel width affects all clients on the AP, not just a single client.

C

Hiding the SSID only prevents the SSID from being broadcast; it does not impact network access after association.

D

WPA2 does not require NTP for client authentication; NTP is for time synchronization, not client access control.

When would these options actually be correct?

A

In a different scenario where a question involves a client unable to connect to an AP due to interference or performance issues caused by an incorrect channel width setting, this option could be correct. For example, if multiple clients are experiencing poor performance or disconnections due to a misconfigured channel width, this would be a valid answer.

C

In a different scenario, if a question describes a situation where a client cannot see the SSID at all, and the network administrator wants to restrict visibility for security reasons, then changing the SSID from broadcast to hidden would be the correct answer.

D

In a different question, if a client is unable to connect to a network due to time synchronization issues that affect the WPA2 authentication process, then this option could be correct. For instance, if the question specifies that clients are being denied access due to mismatched timestamps, this would validate the answer.

Why candidates pick the wrong answer

A

Channel width misconfiguration is a common wireless issue, but it typically impacts multiple clients or overall throughput, not a single client's ability to get network access after association.

C

Students may confuse SSID hiding with a security measure that could affect client connectivity, but it only affects visibility, not post-association network access.

D

Some students might think that time synchronization is required for authentication protocols like 802.1X, but WPA2-PSK does not require NTP, and even with 802.1X, NTP issues would not cause a client to associate but fail to get an IP address.

760
Multi-Selectmedium

Which TWO statements correctly describe OSPFv2 router-id selection and verification in a single-area configuration?

Select 2 answers
A.The OSPF router-id is automatically derived from the MAC address of the first Ethernet interface.
B.If the router-id is changed using the 'router-id' command, the change takes effect immediately without any additional action.
C.The router-id must be the same on all routers in a single OSPF area.
D.When no 'router-id' is configured, a loopback interface with the highest IP address is preferred over a physical interface for the router-id.
E.The 'show ip ospf' command displays the current OSPF router-id.
AnswersD, E

When no explicit 'router-id' command is configured, OSPF determines the router ID by first preferring the IP address of any loopback interface, choosing the highest numeric loopback address, and only then falling back to the highest IP address on a physical interface. Loopback interfaces are always up and do not depend on physical link state, making them stable and thus preferred for router ID selection. This behavior is defined by the OSPF RFC and is a well-known practical rule.

Why this answer

OSPFv2 selects the router-ID based on the highest IP address of any loopback interface when no explicit 'router-id' is configured, making D correct. The 'show ip ospf' command displays the current router-ID, verifying choice E. Option A is incorrect because the router-ID is derived from IP addresses, not MAC addresses.

Option B fails because changing the router-ID requires a reload or clearing the OSPF process to take effect. Option C is wrong because each router must have a unique router-ID; they do not need to match across the area.

Exam trap

Cisco often tests the misconception that changing the router-id takes effect immediately, but in reality, you must clear the OSPF process or reload the router for the change to apply.

Why the other options are wrong

A

The router-ID is derived from the highest IP address on a loopback or physical interface, never from a MAC address.

B

A router-id change does not take effect immediately; you must clear the OSPF process or reload the router.

C

Router-IDs must be unique per router, not identical across all routers in the area.

Why candidates pick the wrong answer

A

Students may confuse OSPF router-id selection with other protocols like OSPFv3 or EIGRP that use MAC addresses, or mistakenly think MAC is used for uniqueness.

B

Students may assume that configuration changes take effect immediately, not realizing that OSPF router-id is selected at process startup and requires a reset to change.

C

Students might think that within a single area, router-ids can be the same because they are not used for routing decisions, but OSPF requires uniqueness for neighbor identification.

761
MCQmedium

A network engineer checks EtherChannel status on a switch and sees the following output: Group Port-channel Protocol Ports ------+-------------+---------+----------------------------- 1 Po1(SD) LACP Gi1/0/1(s) Gi1/0/2(I) What is the most likely reason the EtherChannel is not forwarding traffic?

A.The member interfaces have mismatched speed or duplex settings
B.The port channel is Layer 3 instead of Layer 2
C.At least one member interface is not bundled correctly, so the logical channel is down
D.LACP requires exactly four links to form a bundle
AnswerC

Correct. This is correct. The logical EtherChannel is down because the physical members are not properly bundled. The status display is telling you that the switch did not build a working aggregated link, so the port-channel cannot carry traffic as intended.

Why this answer

The safest conclusion from this output is that the member interfaces are not successfully participating in the bundle, so the logical port-channel is down. Cisco exam questions often test whether you can read the status flags without overcommitting to a very specific root cause that the exhibit does not explicitly prove. One member is suspended and another is not bundled into the channel correctly, so the EtherChannel never reaches a healthy forwarding state.

In the real world, that can happen because of trunk mismatches, allowed VLAN mismatches, native VLAN problems, inconsistent channel-group settings, or negotiation issues. The key exam skill is recognizing that the bundle itself failed, not guessing one hidden configuration line that is not shown.

Exam trap

Avoid assuming the problem is due to physical layer issues like speed or duplex when the output suggests a configuration mismatch.

Why the other options are wrong

A

The output shows individual port statuses (s) and (I), which indicate LACP negotiation states, not speed/duplex mismatches. While speed/duplex mismatches can cause EtherChannel issues, the specific flags in the exhibit point to a bundling problem, not a mismatch.

B

A Layer 3 port-channel can function correctly if configured properly. The output does not indicate any Layer 2 vs Layer 3 mismatch; the problem is that the member interfaces are not successfully bundling into the logical channel, as shown by the (s) and (I) status flags.

D

LACP does not require exactly four links; it can form bundles with 2 to 8 active links (and up to 16 total with standby). The exhibit shows only two member ports, which is perfectly valid for an EtherChannel.

When would these options actually be correct?

A

In a different scenario, if a question presented an EtherChannel configuration where the interfaces were explicitly set to different speeds or duplex modes, leading to a negotiation failure, this option would be correct. For example, if the question stated that Gi1/0/1 was set to 100Mbps full duplex and Gi1/0/2 was set to 1Gbps half duplex, it would lead to a mismatch.

B

In a different scenario, if a question specifies that an EtherChannel is configured as Layer 3 and the interfaces are expected to be Layer 2, then selecting this option would be correct. For example, if the question states that the EtherChannel is not forwarding traffic due to incorrect Layer 3 configuration, this option would apply.

D

In a different question, if it specified that an EtherChannel configuration must have exactly four links to be valid, and the output showed only two links, then this option would be correct. For instance, a question could state that a network engineer is troubleshooting a configuration that mandates four links for LACP to function properly.

Why candidates pick the wrong answer

A

Students often associate EtherChannel failures with speed/duplex mismatches because that is a common cause in general networking. However, the output here provides direct evidence of LACP negotiation issues, making this option a guess rather than a conclusion supported by the exhibit.

B

Test-takers may confuse the 'SD' (shutdown) state of the port-channel with a Layer 3 misconfiguration, but 'SD' simply means the logical interface is down due to member issues, not because of the layer at which it operates.

D

Some students might recall that LACP has a maximum of 8 active links and mistakenly think a minimum of 4 is required, but no such minimum exists. The confusion may arise from the fact that many real-world designs use 4 links for load balancing, but that is not a protocol requirement.

762
MCQhard

A host address is 192.168.1.14/29. Which address is the broadcast address for that host’s subnet?

A.192.168.1.7
B.192.168.1.14
C.192.168.1.15
D.192.168.1.16
AnswerC

A /29 prefix (255.255.255.248) creates subnets with 8 addresses each. The host 192.168.1.14 falls in the subnet from 192.168.1.8 to 192.168.1.15, where the first address is the network ID and the last is the directed broadcast. Therefore, 192.168.1.15 is the broadcast address for this subnet, and .14 is the last usable host address.

Why this answer

A /29 uses blocks of 8 addresses. In plain language, the subnets in the last octet move in increments of 8: 0–7, 8–15, 16–23, and so on. Since the host address ends in 14, it belongs to the 8–15 block. In that block, the last address is the broadcast address, so the broadcast is 192.168.1.15.

This is a classic subnetting pattern because it requires you to place the host inside the correct block and then identify the last address in that block rather than guessing based on the host value itself.

Exam trap

Be careful not to confuse the network address or the next subnet's network address with the broadcast address.

Why the other options are wrong

A

192.168.1.7 is the broadcast address for the /29 block 0–7, which does not contain host .14. The host .14 is in the block 8–15, so its broadcast is .15.

B

192.168.1.14 is the host address itself, not the broadcast address. The broadcast address is always the last address in the subnet, which is .15 for the block 8–15.

D

192.168.1.16 is the network address of the next /29 block (16–23), not the broadcast address for the block containing .14. The broadcast address must be the last address in the same block as the host.

When would these options actually be correct?

A

If the question asked for the broadcast address of the subnet 192.168.1.0/29 instead, then 192.168.1.7 would be the correct answer, as it would be the highest address in that specific subnet range.

B

In a different question setup where the question asks for the host address of a specific device within a subnet, and the subnet is defined as 192.168.1.14/29, option B could be correct if the question specifically inquires about the address assigned to that device.

D

In a different scenario where the subnet mask is changed to /28, the subnet would range from 192.168.1.0 to 192.168.1.15. In this case, if the host address was 192.168.1.14, the broadcast address would indeed be 192.168.1.16.

Why candidates pick the wrong answer

A

Students often miscalculate the block size or confuse the network address with the broadcast address. They might think .7 is the broadcast because it is the last address in the first block, but they forget to check which block contains .14.

B

Some students think the broadcast address is the same as the host address or that the host address itself can be used for broadcasting. They may not understand that the broadcast address is a special reserved address.

D

A common mistake is to add the block size (8) to the host address and assume that is the broadcast. For example, 14 + 8 = 22, but .16 is not the broadcast; it is the next network address. Students may also confuse broadcast with network address.

763
Drag & Dropmedium

Drag and drop the following steps into the correct order to configure OSPFv3 for IPv6 on a Cisco router.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

After entering global config, create the OSPFv3 process, set a router ID, then enable OSPFv3 on the desired interfaces under interface configuration.

Exam trap

Remember that OSPFv3 requires a router ID to be explicitly configured (or derived from an IPv4 address) before enabling it on interfaces. The process must be created first, then the router ID, then interface enablement.

Why candidates pick the wrong answer

B

Candidates might think that interface configuration can be done first, similar to other protocols, but OSPFv3 requires the process to exist first.

C

Candidates might think the router ID can be configured later, but OSPFv3 requires it early to avoid adjacency issues.

D

Candidates might think the router ID is a global parameter, but it is actually part of the OSPFv3 process configuration.

764
MCQhard

A host receives a correct IP address and subnet mask from DHCP but still cannot reach remote networks. Local subnet communication works. Which missing DHCP option is the strongest suspect?

A.Default gateway information
B.An STP root bridge ID
C.A voice VLAN value
D.A router ID
AnswerA

Without a default gateway, a host can determine that a destination is off-subnet via its own IP and mask, but it has no next-hop IP address to which to forward the packets. DHCP typically delivers the default gateway via option 3, and its absence means local-link traffic works while remote traffic remains unanswered. Therefore, this is the missing required information for off-subnet connectivity.

Why this answer

The strongest suspect is the default gateway option. In practical terms, the host can already identify local destinations because the subnet mask is present. That is why local communication still works. What it does not have is the next hop needed for off-subnet traffic. Without a default gateway, remote communication usually fails.

This is a very common host-troubleshooting scenario. It separates basic local addressing from the additional information required for off-subnet reachability.

Exam trap

A common exam trap is selecting options like STP root bridge ID or voice VLAN as the cause of remote connectivity failure. These options relate to Layer 2 switching or voice VLAN segmentation and do not affect IP routing or host reachability to remote networks. Candidates might confuse DHCP options that influence Layer 2 behavior with those critical for Layer 3 routing.

The key mistake is overlooking the default gateway option, which is essential for off-subnet traffic forwarding. This trap tests the candidate’s understanding of DHCP’s role in providing routing information, not just IP addressing.

Why the other options are wrong

B

An STP root bridge ID is irrelevant to host IP reachability because it pertains to Layer 2 spanning tree topology and does not affect IP routing or DHCP configuration for hosts.

C

A voice VLAN value is specific to voice traffic segmentation on switches and does not influence a host’s ability to route IP packets to remote networks, making it unrelated to the connectivity issue.

D

A router ID is a concept used in routing protocols like OSPF and does not apply to DHCP or host IP configuration, so it cannot cause the described connectivity problem.

When would these options actually be correct?

B

In a different scenario, if the question asked about a network topology issue where a host is unable to communicate due to improper STP configuration, then identifying the STP root bridge ID could be crucial for resolving the problem. This would be relevant in a question focused on Layer 2 connectivity issues.

C

In a question focused on configuring a network for VoIP services, if the scenario specifies that devices must communicate over a dedicated voice VLAN for quality of service, the absence of a voice VLAN value could lead to issues in voice communication, making this option correct.

D

In a question about OSPF configuration, if a host is unable to establish OSPF adjacency with other routers, and the question asks about missing configuration elements, the absence of a router ID could be the correct answer, as it is essential for OSPF operation.

Why candidates pick the wrong answer

B

Students might confuse STP with routing or think that any missing protocol information could cause connectivity issues, but STP is irrelevant to host IP communication.

C

A test-taker might associate DHCP options with VLANs or think that missing VLAN information could cause routing problems, but voice VLANs are specific to VoIP phones and do not affect general IP routing.

D

The term 'router ID' sounds similar to 'default gateway' or 'router address,' leading students to think it might be necessary for routing. However, router ID is an internal router concept unrelated to host configuration.

765
PBQhard

You are troubleshooting a wireless client association failure on a Cisco WLC. The client is unable to connect to the corporate SSID 'CorpNet' and reports an authentication error. Review the WLC configuration and fix the issue so that the client can associate and obtain an IP address from VLAN 100. The WLC management IP is 192.168.1.10/24.

Hints

  • Check the security settings — the client may not support WPA3.
  • Verify if the SSID is hidden — the client cannot scan for it.
  • Ensure the VLAN assigned to the WLAN matches the client's subnet.
A.Change the WLAN security to WPA2, enable SSID broadcast, and configure the WLAN interface to use VLAN 100 with a DHCP scope on that VLAN.
B.Change the WLAN security to WPA3 only, enable SSID broadcast, and change the management interface IP to 192.168.100.10/24.
C.Keep WPA3, disable SSID broadcast for security, and configure the WLAN interface to use VLAN 100 with a DHCP scope on VLAN 1.
D.Change the WLAN security to WPA2, keep SSID broadcast disabled, and configure the WLAN interface to use VLAN 1.
AnswerA
solution
! WLC
configure terminal
wlan CorpNet 1 CorpNet
security wpa2
security wpa akm psk
security wpa psk ascii 7 1234567890abcdef
no security wpa3-sae
broadcast-ssid enable
interface wlan 1
vlan 100
end

Why this answer

The client authentication and DHCP issues are caused by: (1) WPA3 being configured while the client only supports WPA2, (2) SSID broadcast disabled, preventing client discovery, and (3) the WLAN's client VLAN (100) lacking a DHCP server or scope. The management interface VLAN (1) does not interfere with client DHCP. To resolve, change security to WPA2, enable SSID broadcast, and ensure the WLAN is associated with the correct VLAN (100) and a DHCP scope exists on that VLAN.

Exam trap

Be careful not to confuse the management interface VLAN with the client data VLAN. Also, remember that SSID broadcast must be enabled for clients to discover the network, and security settings must match client capabilities. Always verify DHCP scope placement matches the client VLAN.

Why the other options are wrong

B

The specific factual error is that WPA3-only security may not be supported by the client, and changing the management interface IP does not resolve the client VLAN assignment issue.

C

The specific factual errors are: WPA3 may not be compatible, disabling SSID broadcast hides the network, and DHCP scope must be on the same VLAN as the client (VLAN 100).

D

The specific factual errors are: SSID broadcast must be enabled for client discovery, and the WLAN interface must be mapped to VLAN 100, not VLAN 1.

Why candidates pick the wrong answer

B

Candidates might think that since the management IP is on VLAN 1, changing it to a different subnet could help, but the management interface is separate from the WLAN interface used for client data.

C

Candidates might believe that disabling SSID broadcast improves security and that DHCP can be served from a different VLAN, but in this scenario the client cannot get an IP from a different subnet.

D

Candidates might think that since the management interface is on VLAN 1, using VLAN 1 for clients is simpler, but the requirement specifies VLAN 100 for client traffic.

766
MCQhard

A network engineer is troubleshooting an issue where a Windows 10 workstation (Host-A) cannot reach the internet, but can ping the local default gateway. The engineer runs 'ipconfig /all' on Host-A and reviews the output. What is the most likely cause of the problem?

A.The subnet mask is incorrect.
B.The default gateway is missing or incorrect.
C.The DNS server is configured as a public DNS server that may be unreachable due to network policy or firewall.
D.The host has obtained an APIPA address (169.254.x.x).
AnswerC

The DNS server is 8.8.8.8, which is a public Google DNS server outside the local network domain. In many enterprise or restrictive network environments, outbound UDP/TCP port 53 to public DNS servers is blocked by firewall policy or requires an internal DNS forwarder. Without reachable DNS, the host cannot resolve domain names, causing connectivity failures even though IP addressing, subnet mask, and default gateway are all correct; this makes DNS misconfiguration the most plausible cause.

Why this answer

Host-A can ping the default gateway, which confirms that Layer 3 connectivity to the local network is working and that the subnet mask and default gateway are correctly configured. The inability to reach the internet despite this connectivity points to a name resolution failure, likely caused by an incorrect or unreachable DNS server. A public DNS server (e.g., 8.8.8.8) may be blocked by corporate firewall policy, preventing Host-A from resolving internet domain names.

Exam trap

The trap here is that candidates assume a successful ping to the gateway means all Layer 3 connectivity is fine, overlooking that DNS is a separate service that can fail even when IP connectivity is intact.

Why the other options are wrong

A

The subnet mask 255.255.255.0 is correct for a /24 network, so it is not the cause of the problem.

B

The default gateway is correctly set to 192.168.1.1, and the host can ping it, so the gateway is not missing or incorrect.

D

The IPv4 address is 192.168.1.100, which is a valid private address, not an APIPA address (169.254.x.x). APIPA addresses are used when DHCP fails, but here the host has a proper address.

Why candidates pick the wrong answer

A

Students often suspect subnet mask issues when connectivity fails, but here the mask is correct and the host can ping the gateway, indicating local connectivity works.

B

A missing or incorrect default gateway is a common cause of internet connectivity loss, but since the host can ping the gateway, this is not the issue.

D

APIPA addresses are a common cause of connectivity issues when DHCP fails, but the host's IP address is not in the APIPA range, so this is not the problem.

767
MCQmedium

Why are tokens commonly used in API workflows instead of sending raw credentials with every request?

A.They allow controlled repeated API access without resending raw credentials on every request.
B.They replace the need for HTTPS.
C.They automatically assign IP addresses to controllers.
D.They convert API data into VLAN tags.
AnswerA

Token-based authentication lets a client exchange credentials once for a signed or opaque token, then reuse that token for subsequent requests. This avoids exposing raw passwords on every call and allows fine-grained controls like scopes, expiry, and revocation, which are essential for unattended automation workflows. Tokens are typically sent in an Authorization header rather than in request bodies.

Why this answer

Tokens are commonly used because they provide a more controlled and practical way to manage repeated API access. In practical terms, a client can authenticate, receive a token, and then present that token on later requests instead of resending a username and password every time. That makes automation workflows easier to operate while still fitting into an access-control model.

This does not eliminate the need for transport security or authorization. It simply provides a common mechanism for controlled repeated API access.

Exam trap

A common exam trap is selecting an answer that claims tokens replace HTTPS or perform network functions like IP address assignment or VLAN tagging. Candidates may incorrectly believe tokens provide transport security or network infrastructure services. However, tokens only manage authentication and authorization at the application layer and do not replace encryption or secure transport protocols.

Misunderstanding this distinction leads to choosing incorrect options that confuse token functionality with unrelated network operations.

Why the other options are wrong

B

Incorrect because tokens do not replace HTTPS; transport security remains necessary to protect data and tokens during transmission.

C

Incorrect as token usage is unrelated to IP address assignment, which is managed by protocols like DHCP or static configuration, not authentication tokens.

D

Incorrect because tokens do not convert API data into VLAN tags; VLAN tagging is a Layer 2 network function unrelated to API authentication mechanisms.

When would these options actually be correct?

B

In a question focused on the security aspects of API communications, where the context is about reducing the risk of credential exposure, an option stating that tokens replace the need for HTTPS could be correct if it is framed as a theoretical scenario where the use of tokens alone is considered sufficient for secure communication.

C

In a question focused on network management or DHCP protocols, an option about assigning IP addresses could be correct. For example, if the question asked about how devices obtain IP addresses automatically on a network, this option could accurately describe that process.

D

This option could be correct in a question that asks about the role of tokens in network protocols where VLAN tagging is relevant, such as in a scenario discussing how tokens might be used to manage network traffic in a virtualized environment.

Why candidates pick the wrong answer

B

Students might think that since tokens provide security, they could replace HTTPS. However, tokens are for authentication, not for securing the transport layer, which is the role of HTTPS.

C

A student might confuse tokens with DHCP or other network services that assign addresses, especially if they are new to API concepts and think tokens have a network-layer function.

D

The word 'token' might be confused with 'tag' in VLAN context. A student with partial knowledge might think tokens are similar to VLAN tags because both are used for identification, but they serve completely different purposes.

768
PBQhard

You are connected to SW1 via the console. SW1 is a Layer 2 switch with two links to SW2 configured as an EtherChannel using LACP. The EtherChannel is not coming up. Interface G0/2 was accidentally configured as an access port in VLAN 10, while G0/1 is configured as a trunk. The administrator wants to use LACP to bundle the links. Troubleshoot and fix the configuration to bring up the EtherChannel.

Hints

  • All interfaces in an EtherChannel must have identical configuration.
  • Check if the interfaces are in the same VLAN or trunk mode.
  • LACP active mode requires matching configurations on both ends.
A.Change interface G0/2 to trunk mode and ensure both interfaces have the same allowed VLAN list.
B.Change interface G0/1 to access VLAN 10 to match G0/2.
C.Remove the access VLAN configuration from G0/2 and leave it as a default switchport (dynamic desirable).
D.Change the EtherChannel mode from LACP to PAgP on both switches.
AnswerA
solution
! SW1
interface GigabitEthernet0/2
no switchport access vlan 10
switchport mode trunk

Why this answer

The EtherChannel was down because interface G0/2 was an access port in VLAN 10, while G0/1 was a trunk. For LACP to bundle the links, all member interfaces must have the same configuration, including VLAN and trunk settings. Changing G0/2 to trunk mode resolved the issue.

Exam trap

Do not confuse the requirement for consistent interface configurations with the negotiation protocol. The most common cause of EtherChannel failure is mismatched VLAN or trunk settings, not the protocol (LACP vs PAgP). Always verify that all member ports have identical configurations.

Why the other options are wrong

B

The specific factual error is that changing G0/1 to access VLAN 10 would not resolve the mismatch if the intended configuration is trunking. It would only create a different mismatch if the other side expects trunking.

C

The specific factual error is that dynamic desirable mode does not ensure trunking; it relies on DTP negotiation, which may fail if the other side is set to trunk. Additionally, the VLAN mismatch (access vs trunk) would still prevent EtherChannel formation.

D

The specific factual error is that the protocol does not affect the requirement for consistent interface configurations. Both LACP and PAgP require identical VLAN and trunk settings on all member ports.

Why candidates pick the wrong answer

B

Candidates might think that making both interfaces access ports in the same VLAN would satisfy the configuration consistency requirement, but they overlook the intended use of trunking for multiple VLANs.

C

Candidates might think that dynamic desirable is a safe default that will automatically negotiate trunking, but they forget that LACP requires consistent switchport modes and that DTP negotiation is not always successful.

D

Candidates might think that switching protocols could fix negotiation issues, but they miss the fundamental configuration mismatch that must be corrected regardless of the protocol.

769
PBQhard

You are connected to R1. The link between R1 and R2 is experiencing intermittent connectivity and poor performance. Review the provided show interface output to identify the root cause(s) of the issue, then apply the necessary configuration changes to resolve the problem and restore full connectivity. Output from R1: ``` GigabitEthernet0/0 is up, line protocol is up (connected) Hardware is Gigabit Ethernet, address is aaaa.bbbb.cccc (bia aaaa.bbbb.cccc) Internet address is 192.168.1.1/30 MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Half-duplex, 100Mb/s, link type is auto, media type is RJ45 output flow-control is unsupported, input flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:01, output 00:00:01, output hang never Last clearing of "show interface" counters 00:01:23 Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 150 packets input, 1500 bytes, 0 no buffer Received 0 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 150 input errors, 150 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast, 0 pause input 0 input packets with dribble condition detected 200 packets output, 2000 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out ```

Hints

  • CRC errors often indicate a duplex mismatch between the two connected devices.
  • Check the current duplex setting on R1's interface—it is set to auto, but the high error count suggests the other end is not negotiating correctly.
  • To fix, manually set both speed and duplex on the interface to match the expected settings of the neighbor.
A.Configure the interface with 'speed 1000' and 'duplex full' to match R2's settings, then clear counters.
B.Replace the faulty cable between R1 and R2 to eliminate CRC errors caused by physical layer issues.
C.Disable autonegotiation on the interface with 'no negotiation auto' to force the link to use the configured speed and duplex.
D.Increase the interface MTU to reduce fragmentation and improve performance on the link.
AnswerA
solution
! R1
interface GigabitEthernet0/0
speed 1000
duplex full

Why this answer

The show interface output reveals that R1's GigabitEthernet0/0 is operating at half-duplex, 100 Mb/s, yet it is accumulating a high number of CRC errors (150 in 1 minute 23 seconds). This indicates a speed/duplex mismatch with R2, which is likely set to full-duplex at 1000 Mb/s. To resolve, you must manually configure R1 to match R2's proper settings by issuing the 'speed 1000' and 'duplex full' commands, then clearing the counters to start fresh monitoring.

The other options are incorrect because they do not address the mismatch: replacing the cable would not fix a configuration issue; disabling autonegotiation alone may not fix the mismatch if the hard-coded values are still wrong; and increasing the MTU does not affect CRC errors caused by duplex mismatch.

Exam trap

CRC errors on a link are often misinterpreted as faulty cabling, but the presence of CRC errors on an interface that is up/up but operating at a mismatched speed or duplex strongly indicates a configuration mismatch between the two ends.

Why the other options are wrong

B

Replacing the cable does not solve a duplex/speed mismatch because the errors are caused by configuration, not physical layer damage.

C

Disabling autonegotiation alone does not guarantee the interface will use the correct speed and duplex; it still requires manual configuration of the correct values.

D

Increasing the MTU addresses fragmentation issues, not CRC errors resulting from duplex or speed mismatches.

Why candidates pick the wrong answer

B

Candidates pick this because CRC errors can be caused by bad cabling, but the context of intermittent performance and full-duplex setting points to mismatch.

C

Candidates pick this because they know autonegotiation can cause issues, but they forget that manual configuration of both parameters is required.

D

Candidates pick this because they confuse performance issues with error causes, thinking larger MTU reduces overhead.

770
MCQmedium

A network team wants routers and switches to have consistent timestamps in logs so event correlation is accurate during an outage. Which service should they verify first?

A.DNS
B.NTP
C.SNMP
D.CDP
AnswerB

NTP is the correct choice because it synchronizes the system clocks of routers and switches across the network, ensuring consistent timestamps for logging, troubleshooting, and event correlation. Without NTP, device clocks drift independently, making it impossible to accurately sequence or compare events from different devices, which is critical for network monitoring and security forensics.

Why this answer

Consistent timestamps depend on synchronized clocks. NTP is the service used to keep network devices aligned to the same time reference, which makes syslog analysis and troubleshooting much more reliable.

Exam trap

Don't confuse protocols with similar acronyms or those related to network management. Focus on the specific function of time synchronization.

Why the other options are wrong

A

DNS (Domain Name System) resolves hostnames to IP addresses and has no role in time synchronization. DNS does not provide timestamp information or clock setting capabilities. Verifying DNS would not help ensure consistent timestamps in logs.

C

SNMP (Simple Network Management Protocol) is used for monitoring and managing network devices, not for time synchronization. While SNMP can retrieve device uptime or timestamps from MIBs, it does not set or synchronize clocks. Relying on SNMP for time consistency would not correct clock drift.

D

CDP (Cisco Discovery Protocol) is a Layer 2 protocol used to discover neighboring Cisco devices and their capabilities. It does not provide time synchronization or affect timestamps in logs. CDP is irrelevant for ensuring consistent timestamps.

When would these options actually be correct?

A

If the exam question asked about ensuring that devices can resolve hostnames to IP addresses for logging purposes, then DNS would be the correct answer. For instance, a scenario focusing on troubleshooting connectivity issues due to incorrect hostname resolution would make DNS relevant.

C

If the question were about monitoring network performance and gathering statistics from devices, then SNMP would be the correct answer, as it provides valuable data for network management and troubleshooting.

D

If the exam question asked which protocol is essential for network device discovery and management in a Cisco environment, CDP would be the correct answer. This scenario would focus on identifying devices and their capabilities rather than time synchronization.

Why candidates pick the wrong answer

A

Students may think DNS is involved because some logging systems use DNS for reverse lookups, but this does not affect timestamp accuracy. The similarity in acronyms (DNS vs. NTP) can also cause confusion.

C

Students might confuse SNMP with NTP because both are network management protocols. SNMP is often associated with monitoring and logging, leading to the mistaken belief that it handles timestamps.

D

Students might associate CDP with device discovery and assume it also synchronizes time, or confuse CDP with NTP due to both being Cisco-related protocols. However, CDP has no time-related functionality.

771
MCQmedium

A network engineer is evaluating monitoring technologies for a large enterprise network that requires high-frequency, low-latency traffic data collection with support for custom fields. The solution must also support encryption and authentication to prevent tampering. Which technology best meets these requirements?

A.Configure SNMPv2c with community strings and polling every 30 seconds.
B.Implement streaming telemetry using gRPC with TLS and YANG data models.
C.Deploy NetFlow v9 with custom flow records and SNMPv3 for encryption.
D.Use IPFIX with UDP export and add authentication via MD5 hashing.
AnswerB

Streaming telemetry with gRPC over TLS delivers continuous, high-frequency push updates, avoiding the overhead of repeated polling requests and reducing latency to near-real-time. The use of YANG data models provides a structured, vendor-neutral schema that supports custom fields and hierarchical data, unlike fixed-format flow records. TLS ensures both encryption and authentication, protecting the data stream in transit, which makes this the correct choice for modern scalable network monitoring.

Why this answer

Streaming telemetry using gRPC with TLS and YANG data models is correct because it provides high-frequency, low-latency push-based data collection, supports custom fields via YANG models, and ensures encryption and authentication through TLS. This meets all the requirements, unlike polling-based or unencrypted alternatives.

Exam trap

Cisco often tests the misconception that SNMPv3 or NetFlow with custom records can provide both high-frequency push data and encryption, when in fact streaming telemetry with gRPC and TLS is the only solution that natively combines push-based collection, custom fields, and transport-layer security.

Why the other options are wrong

A

SNMPv2c uses community strings transmitted in plain text, lacking encryption and authentication. Polling every 30 seconds is low-frequency and cannot provide high-frequency, low-latency data collection required for real-time monitoring.

C

NetFlow v9 is export-based and not a real-time push mechanism; it typically sends data in batches, introducing latency. SNMPv3 encryption does not apply to NetFlow data, so the combination does not provide secure, high-frequency streaming.

D

IPFIX over UDP lacks built-in encryption, making data vulnerable to interception. MD5 hashing provides integrity but not encryption or authentication for the entire data stream, failing to meet the security requirements.

Why candidates pick the wrong answer

A

Students may confuse SNMP polling with streaming telemetry, thinking that frequent polling can achieve similar results, but polling introduces latency and overhead, and SNMPv2c lacks security.

C

NetFlow is a well-known monitoring technology, and students might think combining it with SNMPv3 adds security, but NetFlow itself does not support streaming telemetry's low-latency push model.

D

IPFIX is an extension of NetFlow and supports custom fields, so students may assume it can be secured with hashing, but UDP transport and lack of encryption make it unsuitable for tamper-proof monitoring.

772
MCQhard

A router is configured with a static NAT mapping for an internal server. What is the main operational advantage of this design for outside clients?

A.The server is represented by a fixed public address that outside clients can reach predictably
B.The server automatically shares its public address with all inside users through overload
C.The server no longer needs an IP address on the internal network
D.The mapping removes the need for routing to the server
AnswerA

Static NAT creates a permanent, explicit one-to-one binding between the server's private inside local address and a designated public inside global address. This fixed mapping remains constant and is not dynamically reassigned, which allows outside clients to reach the server using the same predictable public address each time. Since the mapping is preconfigured, inbound connections are consistently forwarded to that internal server without requiring any port translation or dynamic address selection.

Why this answer

The main operational advantage is predictability. In plain language, outside clients always know which public IP address represents the internal server. That stable one-to-one mapping makes the server easier to reach consistently from external networks. This is exactly why static NAT is commonly used for inside services that need outside reachability.

This differs from PAT, which is optimized for many outbound user sessions sharing fewer public addresses. Static NAT is valuable when a specific device or service must have a stable external identity.

Exam trap

A frequent exam trap is confusing static NAT with PAT (Port Address Translation). While PAT allows many internal devices to share one public IP by using different port numbers, static NAT assigns a fixed public IP to a single internal device. Selecting an answer that suggests the server shares its public address with all inside users (like option B) is incorrect because static NAT does not perform address overload.

Another trap is assuming static NAT removes the need for routing; however, routing is still required to forward packets to the internal server. Misunderstanding these differences can lead to incorrect answers about NAT behavior and design advantages.

Why the other options are wrong

B

This option is incorrect because it describes PAT behavior, where multiple inside users share a public IP via port overload. Static NAT does not share the public address among users.

C

This option is incorrect because the internal server still requires a valid IP address on the internal network for routing and communication; static NAT does not remove this requirement.

D

This option is incorrect because NAT translates addresses but does not eliminate the need for routing. Proper routing is still necessary to deliver packets to the internal server.

When would these options actually be correct?

B

If the question were about a dynamic NAT configuration with overload (PAT), where multiple internal devices share a single public IP address, then option B would be correct as it describes how the public address is shared among internal users.

C

In a different question scenario where the focus is on a network design that utilizes a virtual IP address for load balancing or failover, stating that a server does not need an internal IP could be correct if it is being accessed solely through a proxy or load balancer that abstracts the internal addressing.

D

In a scenario where a question asks about a network design that uses a transparent proxy or a load balancer that abstracts the server's location, this option could be correct. In that case, the mapping could imply that clients do not need to know the internal routing details to access the server.

Why candidates pick the wrong answer

B

Students often confuse static NAT with PAT because both are types of NAT, and the term 'overload' is commonly associated with NAT. However, overload is specifically a PAT feature, not a characteristic of static NAT.

C

A common misconception is that NAT eliminates the need for internal IP addresses, but NAT only translates addresses; the internal device still requires an IP address for network communication.

D

Some students think that NAT simplifies network design to the point where routing is unnecessary, but routing remains fundamental for packet delivery, and NAT only modifies address information.

773
Multi-Selectmedium

Which TWO statements correctly describe aspects of interpreting packet capture output for Layer 2/3 troubleshooting using Wireshark or embedded packet capture on IOS-XE?

Select 2 answers
A.A DHCP Discover packet in a Wireshark capture shows a unicast destination MAC address to the DHCP server.
B.A large number of ARP requests for the same IP address in a packet capture suggests a possible Layer 3 connectivity issue, such as a missing default gateway.
C.A TCP SYN-ACK packet in a capture indicates that the three-way handshake failed and the destination is unreachable.
D.When using embedded packet capture on IOS-XE, you can capture packets on both ingress and egress directions to see if a router is dropping or modifying packets.
E.The TTL value in a captured IP packet always shows the original TTL set by the source host.
AnswersB, D

Repeated ARP requests for the same target IP mean the host is trying to resolve a next-hop MAC but receives no reply. This frequently occurs when the target is down, a firewall silently drops the traffic, or the host's default gateway is misconfigured/unreachable. Because ARP operates at Layer 2 to find a Layer 3 address, the persistence of unanswered requests points to a connectivity failure at or below the IP layer, making it a useful diagnostic clue.

Why this answer

A large number of ARP requests for the same IP address indicates that the device is repeatedly trying to resolve the Layer 3 address to a Layer 2 MAC address, but no device is responding. This often happens when the target IP (e.g., the default gateway) is unreachable or misconfigured, pointing to a Layer 3 connectivity issue. Option D is correct because IOS-XE embedded packet capture supports both ingress and egress capture directions, allowing you to verify whether a router is dropping or modifying packets as they transit.

Option A is incorrect: DHCP Discover is broadcast, not unicast, because the client does not yet know the server’s MAC address. Option C is incorrect: a SYN-ACK is part of a successful three-way handshake (SYN, SYN-ACK, ACK) and indicates the server is reachable; if the handshake failed, you would see only SYN packets or RST packets. Option E is incorrect: the TTL value in a captured packet shows the current TTL after decrementing by each hop; the original TTL is not preserved in the packet.

Exam trap

Cisco often tests the distinction between broadcast and unicast in DHCP and ARP operations, and the trap here is that candidates may assume DHCP Discover is unicast to the server or that a SYN-ACK indicates failure, when in fact it confirms reachability.

Why the other options are wrong

A

DHCP Discover is always broadcast (destination FF:FF:FF:FF:FF:FF), not unicast, because the client does not know the DHCP server's MAC address.

C

A TCP SYN-ACK indicates the server received the SYN and is willing to establish the connection; it is part of a successful three-way handshake, not a failure.

E

The TTL in a captured packet is the value after decrementing at each hop; the original TTL is set by the source but is not preserved in the packet header.

774
MCQhard

Refer to the exhibit. A network engineer is troubleshooting DHCP issues on a branch office network. Several users report that new devices are unable to obtain IP addresses, even though the DHCP pool configured on R1 appears to have sufficient free addresses. The engineer executes the show ip dhcp conflict command and observes the output. Based on the output, what is the most likely cause of the problem?

A.The DHCP scope is misconfigured with an exclusion range that includes 192.168.1.50 to 192.168.1.59.
B.The ping timeout on the DHCP server is set too low, causing it to falsely detect conflicts.
C.Several hosts on the network are using static IP addresses from the DHCP pool range, causing the DHCP server to mark those addresses as conflicts and depleting the available pool.
D.The DHCP server is not properly releasing expired leases, causing the conflict table to fill up.
AnswerC

Each conflict entry with detection method 'Ping' indicates the server attempted to verify the address and received a reply, meaning a device is already using that IP statically or from another source. The server then marks it as a conflict and withdraws it from the pool, shrinking the pool until no addresses remain free.

Why this answer

The output of 'show ip dhcp conflict' lists IP addresses that the DHCP server detected as already in use via ping or gratuitous ARP. When hosts use static IP addresses from the DHCP pool range, the server marks those addresses as conflicts and removes them from the available pool, effectively depleting the pool even though the scope shows free addresses. This matches the scenario where new devices cannot obtain IP addresses despite the pool appearing to have sufficient free addresses.

Exam trap

Cisco often tests the distinction between a DHCP exclusion range (which prevents addresses from being offered) and a DHCP conflict (which occurs after an address is offered but found to be in use), tempting candidates to confuse the two concepts.

Why the other options are wrong

A

Candidates may confuse administratively excluded addresses with dynamically detected conflicts.

B

The misconception is that aggressive ping settings create false conflicts, when in fact a conflict entry proves a reply was received.

D

Candidates might think that conflicts represent stale entries, but a conflict is a permanent record of a detected collision, not a lease state.

775
MCQhard

SW2 receives the following STP details for VLAN 10: The root bridge ID is 32768:0001.0001.0001 (SW1), and SW2's bridge ID is 32768:0002.0002.0002. Its interface Gi0/1 has a path cost of 4 to the root, while Gi0/2 has a path cost of 19. Based on this information, which statement is correct?

A.SW2 is the root bridge for VLAN 10.
B.Gi0/1 on SW2 is the root port.
C.All SW2 ports in VLAN 10 must be designated ports.
D.STP is disabled because the priorities are equal.
AnswerB

Gi0/1 is the root port because STP selects the port with the lowest root path cost to reach the root bridge, and the received BPDU lists the root as reachable through Port 1. On SW2, Port 1 maps to Gi0/1, so that interface assumes the root port role. A root port is the non-root switch's closest path to the root, and it remains in forwarding state.

Why this answer

The root bridge has the lowest bridge ID. SW1 is the root because its bridge ID is lower than SW2's local bridge ID. On a non-root switch, the port with the best path toward the root becomes the root port, so Gi0/1 is the root port here.

Exam trap

A common exam trap is to incorrectly conclude that STP is disabled when bridge priorities are equal. Candidates may mistakenly believe that equal priorities cause STP to fail or not elect a root bridge. However, STP always elects a root bridge by comparing the MAC addresses as a tiebreaker when priorities match.

Another trap is assuming all ports on a non-root switch must be designated ports, ignoring the existence of a root port that leads toward the root bridge. Misreading the root port can lead to incorrect answers about port roles and network topology.

Why the other options are wrong

A

This option is incorrect because the root bridge ID shown in the STP details differs from SW2's local bridge ID, indicating SW2 is not the root bridge for VLAN 10.

C

This option is wrong since a non-root switch does not have all ports as designated ports; it must have one root port and may have other ports as designated or blocked.

D

This is incorrect because equal priorities do not disable STP; the protocol uses the MAC address portion of the bridge ID to break ties and continue operation.

When would these options actually be correct?

A

In a different question scenario where the exhibit shows that SW2 has the lowest bridge ID among all switches in the VLAN, candidates would correctly identify that SW2 is the root bridge for VLAN 10, confirming its role in the STP topology.

C

In a different scenario where the question states that SW2 is the root bridge for VLAN 10, and all other switches in the topology have designated ports leading to SW2, then this option would be correct. This would imply that SW2's ports are indeed all designated due to its root bridge status.

D

In a different exam scenario where the question specifies that all switches in the network have identical bridge priorities and no unique MAC addresses, one could conclude that STP is effectively disabled due to the lack of a definitive root bridge. The question would need to emphasize that no other STP parameters are available to break the tie.

Why candidates pick the wrong answer

A

Candidates might choose this option due to a misunderstanding of STP roles, mistakenly believing that receiving STP details indicates that the switch is the root bridge, rather than recognizing the importance of bridge IDs in determining the root.

C

Candidates may choose this option because they might confuse the roles of ports in STP, thinking that if a switch is functioning properly, all its ports must be designated. This reflects a misunderstanding of STP roles and their requirements.

D

Candidates may find this option tempting because they might misunderstand how STP operates and assume that equal priorities automatically lead to STP being disabled, overlooking the need for a tie-breaking mechanism.

776
PBQhard

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to two other switches (SW2 and SW3) via redundant links. All switches run IEEE 802.1D Spanning Tree Protocol. The network administrator wants SW1 to become the root bridge for VLAN 1. Currently, the root bridge is SW2. Configure SW1 to achieve this and ensure that port G0/1, which connects to an end device, immediately transitions to forwarding state upon link up and is protected from BPDU attacks.

Network Topology
G0/1 to PCSW2SW1SW3

Hints

  • The 'root primary' macro sets the priority lower than any other switch.
  • PortFast allows a port to skip listening/learning states.
  • BPDU Guard err-disables the port if a BPDU is received.
A.Configure 'spanning-tree vlan 1 root primary' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'.
B.Configure 'spanning-tree vlan 1 priority 4096' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree guard root'.
C.Configure 'spanning-tree vlan 1 root secondary' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpduguard enable'.
D.Configure 'spanning-tree vlan 1 priority 32768' globally, and on interface G0/1 configure 'spanning-tree portfast' and 'spanning-tree bpdufilter enable'.
AnswerA
solution
! SW1
spanning-tree vlan 1 root primary
interface GigabitEthernet0/1
spanning-tree portfast
spanning-tree bpduguard enable

Why this answer

The 'spanning-tree vlan 1 root primary' command reduces the bridge priority to 24576 (or lower) to ensure SW1 becomes root for VLAN 1. PortFast on G0/1 speeds up access port convergence, and BPDU Guard protects against rogue switches by disabling the port upon BPDU reception.

Exam trap

Do not confuse 'root primary' with 'root secondary' or manual priority settings. Also, remember that BPDU Guard is for access port security, while Root Guard protects the root bridge position. BPDU Filter suppresses BPDUs and is not a security feature.

Why the other options are wrong

B

The specific factual error: 'spanning-tree guard root' is a root guard feature, not BPDU guard. Also, manually setting priority to 4096 may not guarantee root if another switch has lower priority.

C

The specific factual error: 'root secondary' is for backup root, not primary. It sets priority to 28672, which is higher than the default priority of 32768 but not low enough to become root if another switch has a lower priority.

D

The specific factual error: priority 32768 is default and does not change root status. BPDU filter is not a security feature against BPDU attacks; it suppresses BPDUs entirely.

Why candidates pick the wrong answer

B

Candidates might think setting a low priority manually is equivalent to 'root primary', and confuse root guard with BPDU guard.

C

Candidates may confuse 'root primary' and 'root secondary', thinking 'secondary' might still become root if the current root fails, but the question asks to make SW1 root now.

D

Candidates might think any low priority works, and confuse BPDU filter with BPDU guard. BPDU filter is sometimes used on access ports but does not provide the same protection.

777
PBQhard

You are troubleshooting connectivity between R1 and R2. The link is down, and you need to identify and fix the issue. Examine the provided 'show interfaces' output and running configuration, then apply the necessary commands to restore connectivity.

Network Topology
G0/010.0.0.1/30G0/010.0.0.2/30linkR1R2

Hints

  • Check the running configuration for the 'shutdown' command.
  • The interface status shows 'administratively down' if it is shutdown.
  • Use the 'no shutdown' command under the interface configuration mode.
A.Enter interface configuration mode for the down interface and issue the 'no shutdown' command.
B.Enter global configuration mode and issue the 'interface reset' command to reset the interface counters.
C.Enter interface configuration mode and issue the 'speed' command to set the interface speed to match the connected device.
D.Enter interface configuration mode and issue the 'no keepalive' command to disable keepalives.
AnswerA
solution
! R1
interface gigabitEthernet 0/0
no shutdown

Why this answer

The interface is administratively down because the 'shutdown' command is present. The line protocol is down because the interface is disabled. To fix this, you must issue the 'no shutdown' command on the interface.

After that, the interface will come up, and the line protocol will become up if the other side is properly configured.

Exam trap

The trap is that candidates may focus on physical layer issues (speed/duplex) or protocol issues (keepalives) instead of recognizing the clear 'administratively down' indication. Always check the interface status first: if it says 'administratively down', the solution is 'no shutdown'.

Why the other options are wrong

B

The specific factual error: 'interface reset' is not a real command; the correct command to reset counters is 'clear counters'.

C

The specific factual error: speed mismatch causes line protocol issues but not administrative down state.

D

The specific factual error: 'no keepalive' affects line protocol detection but does not change administrative state.

Why candidates pick the wrong answer

B

Candidates might confuse resetting counters with re-enabling the interface, thinking a reset will fix the issue.

C

Candidates may think that speed/duplex mismatches are common causes of interface down and overlook the administrative shutdown.

D

Candidates might think that keepalives are causing the interface to stay down, but the issue is administrative shutdown.

778
Multi-Selectmedium

Which two statements accurately describe why NTP and Syslog are often configured together?

Select 2 answers
A.Syslog provides event visibility, while NTP helps keep timestamps consistent across devices.
B.Consistent time improves the usefulness of centralized logs and event correlation.
C.NTP replaces the need for any event logging.
D.Syslog automatically assigns the NTP server address to all devices.
E.Both services can be used only on routers, not switches.
AnswersA, B

Syslog is a client/server protocol that forwards network device log messages to a central collector, giving administrators event visibility. NTP synchronizes device clocks so every logged event has a consistent, reliable timestamp. They work together because syslog provides the audit trail while NTP makes the timestamps in that trail trustworthy.

Why this answer

NTP and Syslog are often configured together because logs become much more useful when the device clocks are aligned. In practical terms, Syslog provides the event messages, while NTP helps ensure that the timestamps on those messages are consistent across the environment. That makes troubleshooting and incident analysis more reliable.

This is a very practical operations concept and comes up often in real troubleshooting workflows.

Exam trap

A common exam trap is selecting the option that NTP replaces the need for event logging or that Syslog automatically configures NTP server addresses. Candidates might confuse time synchronization with logging functionality, but NTP only provides accurate time, not event data. Similarly, Syslog collects logs but does not manage NTP settings.

Misunderstanding these roles can lead to incorrect answers, as the two services complement each other but serve distinct purposes in network management.

Why the other options are wrong

C

This option is incorrect because NTP only synchronizes time and does not replace the need for event logging, which is handled by Syslog or other logging mechanisms.

D

This option is incorrect because Syslog does not configure NTP server addresses or manage time synchronization; these are separate configuration tasks.

E

This option is incorrect because both NTP and Syslog are widely used on various network devices, including routers and switches, not limited to routers alone.

When would these options actually be correct?

C

If the exam question were to ask about a scenario where NTP is implemented in a system that does not require event logging due to its design (e.g., a simple device that only needs time synchronization), then this option could be considered correct.

D

If the exam question were to ask about a hypothetical network management tool that integrates both Syslog and NTP functionalities, allowing automatic configuration of NTP settings based on Syslog messages, then this option could be correct.

E

In a question asking about the compatibility of network services with specific hardware types, if it were stated that only routers support NTP and Syslog, then option E would be correct in that context, as it would reflect a misunderstanding of device capabilities.

Why candidates pick the wrong answer

C

Candidates might choose this option due to a misunderstanding of the roles of NTP and logging; they may incorrectly believe that accurate time synchronization eliminates the need for logs, especially in simplified network environments.

D

Candidates may choose this option due to a misunderstanding of network management tools, thinking that Syslog's logging capabilities could extend to configuration tasks like assigning NTP addresses.

E

Candidates might choose this option due to a common misconception that certain protocols are exclusive to specific devices, leading them to incorrectly generalize the capabilities of NTP and Syslog.

779
MCQmedium

Exhibit: PCs in VLAN 20 are not receiving addresses from a DHCP server in another subnet. The switch SVI for VLAN 20 is up, and routing is working. Which configuration is most likely missing on the gateway for VLAN 20?

A.ip default-gateway 10.20.20.1
B.ip helper-address 10.99.99.10
C.switchport trunk allowed vlan 20
D.spanning-tree portfast default
AnswerB

DHCP relies on broadcast discovery, and broadcasts do not cross Layer 3 boundaries. The PCs in VLAN 20 cannot reach the DHCP server on a different subnet unless the VLAN 20 SVI has ip helper-address 10.99.99.10 configured. That command converts the client broadcast into a unicast relayed to the server, while also inserting the SVI IP as the giaddr so the server can scope an appropriate address. Therefore, this is the missing configuration.

Why this answer

DHCP Discover messages are broadcasts and do not cross routers by default. An ip helper-address on the client gateway interface relays those requests to a remote DHCP server.

Exam trap

A frequent exam trap is selecting the ip default-gateway command as the solution for DHCP relay issues. This command only applies to Layer 2 switches for their own management traffic and does not forward DHCP broadcasts across routed interfaces. Candidates may also mistakenly focus on VLAN trunking or spanning-tree settings, which do not affect DHCP relay functionality.

The key is to recognize that DHCP broadcasts must be explicitly forwarded by the router or Layer 3 switch interface using ip helper-address to reach a DHCP server in another subnet.

Why the other options are wrong

A

The ip default-gateway command configures the default gateway for a Layer 2 switch’s management interface and does not forward DHCP broadcasts. Since the question involves DHCP relay across routed VLANs, this command is irrelevant.

C

The switchport trunk allowed vlan 20 command controls VLAN traffic allowed on a trunk link but does not influence DHCP relay or routing between VLANs. The issue is DHCP relay, not VLAN trunk configuration.

D

The spanning-tree portfast default command enables PortFast on switch ports to speed up STP convergence and does not affect DHCP relay or routing. It is unrelated to the problem of clients not receiving DHCP addresses.

When would these options actually be correct?

A

In a different question setup where the focus is on configuring a standalone host or a router that needs to reach a default gateway for local traffic, the option 'ip default-gateway 10.20.20.1' would be correct. For example, if the question asked about configuring a PC in VLAN 20 to communicate with a router in the same subnet, this command would be appropriate.

C

In a scenario where the question asks about ensuring that a trunk port is correctly configured to allow VLAN 20 traffic to pass between switches, 'switchport trunk allowed vlan 20' would be the correct answer. This would be relevant if the question focused on VLAN propagation across trunk links.

D

In a scenario where the question asks about optimizing the DHCP response time for end devices connected to access ports in a VLAN, 'spanning-tree portfast default' would be correct. This would apply if the focus was on reducing the time it takes for devices to start communicating on the network after being powered on.

Why candidates pick the wrong answer

A

Candidates may find this option tempting because it relates to gateway configuration, which is a common task in network setups. They might mistakenly believe that any gateway-related command would be relevant to the DHCP issue presented.

C

Candidates may choose this option because they recognize the importance of VLAN configurations in switch operations, leading them to mistakenly associate trunking with the DHCP issue instead of focusing on the need for a helper address.

D

Candidates might choose this option due to a misunderstanding of the role of spanning-tree in network configurations, believing that it directly impacts DHCP functionality without recognizing the specific need for DHCP relay settings.

780
MCQhard

Refer to the exhibit. An administrator is trying to access a web server in the DMZ at 192.168.1.10 using HTTPS, but the connection times out. The web server is confirmed to be running and listening on both port 80 and port 443. The administrator examines the access list configuration on the perimeter router. Based on the output of the show access-lists command, what is the most likely cause of the failure?

A.The access list does not include a permit statement for TCP port 443.
B.The access list is applied in the wrong direction on the interface.
C.The web server is not actually listening on TCP port 443, despite the configuration.
D.The 'deny ip any any log' statement at the end of the access list is blocking the HTTPS traffic, so it must be removed.
AnswerA

The access list only has a single permit statement for the 192.168.1.0/24 network, and it matches 'eq www', which is TCP port 80. Because HTTPS uses TCP port 443, no forwarded traffic to that port is explicitly permitted, so it is dropped by the implicit deny-all rule at the end of the ACL. Even if the server is listening, the router's ACL prevents the packets from ever reaching it.

Why this answer

The access list shown in the exhibit permits TCP port 80 (HTTP) but does not include a permit statement for TCP port 443 (HTTPS). Since the administrator is trying to access the web server using HTTPS, which uses port 443, the traffic is implicitly denied by the final 'deny ip any any log' statement. This causes the connection to time out because the packets are dropped before reaching the server.

Exam trap

Cisco often tests the distinction between HTTP (port 80) and HTTPS (port 443) in ACLs, trapping candidates who assume that allowing HTTP automatically allows HTTPS or that the implicit deny only applies to non-TCP traffic.

Why the other options are wrong

B

Candidates may assume the ACL is not applied correctly, but without interface details this conclusion cannot be drawn from the given output.

C

Candidates might blame the server configuration rather than the network ACL, but the question stem provides the server state to rule this out.

D

This is a common misconception: the explicit deny is not the root cause; the missing permit is the real issue. Removing the deny without adding a permit for HTTPS would still result in the traffic being blocked by the implicit deny.

781
MCQhard

An administrator wants to prevent users from browsing to one specific web server while still allowing them to reach other web destinations. Which ACL design principle is most important here?

A.Use the narrowest possible match so only the intended traffic is denied.
B.Always deny all IP traffic to the destination subnet first.
C.Use a standard ACL because destination details never matter.
D.Place the ACL only where no routing exists.
AnswerA

Using the narrowest possible match—such as a specific extended ACL entry with the exact destination IP, protocol, and port—ensures that only packets destined for that one web server are denied, leaving all other traffic untouched. This precision prevents accidental blocking of other services or hosts sharing the same subnet, which is the core principle of least-privilege ACL design.

Why this answer

The most important principle is to write the ACL as narrowly as possible so it matches only the unwanted traffic and does not overblock unrelated traffic. In practical terms, the rule should target the specific destination and service being denied rather than using a broader deny that unintentionally blocks other communication.

This is a precision-and-scope question. Good ACL design is as much about what you avoid blocking as what you intend to block.

Exam trap

Avoid using broad deny statements that block more than necessary. Focus on precision by targeting both IP and port.

Why the other options are wrong

B

This option is wrong because denying all IP traffic to the destination subnet would block all traffic to that subnet, not just the specific web server, which contradicts the requirement to allow access to other web destinations.

C

Using a standard ACL ignores the importance of destination details, which are crucial for selectively denying access to one specific web server while allowing others. This approach would lead to broader access restrictions than intended.

D

Placing the ACL only where no routing exists is incorrect because it does not address the requirement of selectively blocking traffic to a specific web server while allowing access to others. ACLs must be strategically placed to control traffic flow effectively based on routing paths.

When would these options actually be correct?

B

In a scenario where an administrator needs to implement a security policy that restricts all traffic to a specific subnet due to security concerns, such as isolating a compromised server, this option would be correct as it ensures no traffic reaches that subnet.

C

In a scenario where an exam question asks about a network setup that only requires filtering based on source IP addresses, a standard ACL would be appropriate. For instance, if the question specifies that all traffic from a certain subnet should be denied regardless of the destination, then using a standard ACL would be the correct choice.

D

In a scenario where a network design requires an ACL to be applied on a switch port that does not route traffic but still needs to control access to specific devices, placing the ACL at that point could be correct. For example, if the question specifies controlling access to a printer on a VLAN without routing, this option would apply.

Why candidates pick the wrong answer

B

Candidates may find this option tempting because it suggests a comprehensive approach to security by blocking all traffic to a problematic subnet, which can seem like a straightforward method to enforce access control.

C

Candidates may be tempted by this option because standard ACLs are simpler and easier to implement, leading them to believe that they can effectively manage access without considering destination specifics.

D

Candidates might be tempted by this option because it suggests a simplistic approach to ACL placement, assuming that any location without routing would suffice for access control, which can seem intuitive without deeper understanding of ACL functionality.

782
Multi-Selectmedium

A router learns a route to 172.16.0.0/16 via OSPF (administrative distance 110) and a route to 172.16.10.0/24 via EIGRP (administrative distance 90). No other overlapping routes exist. Which TWO statements about how the router handles these routes are correct?

Select 2 answers
A.The router installs only the EIGRP route because it has a lower administrative distance.
B.Both the OSPF and EIGRP routes are installed in the routing table.
C.Traffic to 172.16.10.100 is forwarded using the OSPF route.
D.The EIGRP route is used for all traffic destined to any address within 172.16.0.0/16.
E.The OSPF route is used for destinations within 172.16.0.0/16 that are not part of the 172.16.10.0/24 subnet.
AnswersB, E

Because 172.16.0.0/16 and 172.16.10.0/24 are not identical prefixes, the router treats them as separate destinations in the routing table. The RIB can hold a less-specific covering route and a more-specific route simultaneously, regardless of administrative distance. Longest-prefix matching during packet forwarding then determines which route is used for a given destination.

Why this answer

B is correct because the router installs both routes in the routing table when they have different prefix lengths. The EIGRP route to 172.16.10.0/24 (AD 90) is more specific than the OSPF route to 172.16.0.0/16 (AD 110). The router uses the longest prefix match rule for forwarding, so both routes coexist without conflict.

Exam trap

Cisco often tests the misconception that administrative distance alone determines which route is installed, ignoring the critical role of prefix length in the longest prefix match rule.

Why the other options are wrong

A

The router does not discard the OSPF route; it installs both /16 and /24 entries because they represent different network-specific entries.

C

The traffic matches the /24 route, not the /16, so it would be forwarded via the EIGRP next-hop.

D

The /24 is a subset; traffic outside 172.16.10.0/24 matches only the /16 OSPF route.

783
Matchingmedium

Match each controller or automation term to its most accurate description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Central platform used to coordinate policy and management

Application-facing interface used to communicate with the controller

Lightweight structured data format used in API payloads

Secure transport commonly used for API communication

Why these pairings

PLC (Programmable Logic Controller) is an industrial computer for automating electromechanical processes. SCADA (Supervisory Control and Data Acquisition) is a system for remote monitoring and control. DCS (Distributed Control System) controls production processes within a plant.

RTU (Remote Terminal Unit) interfaces with sensors and actuators in remote locations. All given pairings are correct.

Exam trap

Do not confuse SCADA with DCS; SCADA is for geographically dispersed assets, while DCS is for localized plant control. PLCs are basic controllers; RTUs are remote interfaces often used in SCADA systems.

784
Multi-Selecthard

An engineer wants all devices to send logs to 10.10.10.50 and also stamp those logs with consistent time from 10.10.10.60. Which two configurations are required on a Cisco device?

Select 2 answers
A.logging host 10.10.10.50
B.ntp server 10.10.10.60
C.ip helper-address 10.10.10.50
D.snmp-server host 10.10.10.60
E.service timestamps log localtime
AnswersA, B

The logging host 10.10.10.50 command designates a remote syslog server to receive all generated log messages. This is the primary mechanism for sending logs to a collector, as the device will forward syslog messages at the configured severity levels. Without this statement, logs are only stored locally, so this command directly fulfills the requirement to send logs to 10.10.10.50.

Why this answer

One configuration points the device to the syslog collector, and the other points it to the NTP server. The requirement is about centralized logging and accurate timestamps, so both services must be configured. Option E, 'service timestamps log localtime', is a valid command but it only sets the timestamp format to local time; without an NTP server, timestamps will not be consistent across devices.

Exam trap

A common exam trap is selecting commands related to SNMP or DHCP relay, such as 'snmp-server host' or 'ip helper-address', mistakenly believing they configure logging or time synchronization. Candidates may also choose 'service timestamps log localtime' expecting it to standardize timestamps, but without NTP synchronization, timestamps remain inconsistent across devices. The trap lies in confusing the purpose of these commands with syslog and NTP functions.

The question specifically requires centralized logging and consistent timestamps, which only 'logging host' and 'ntp server' commands fulfill together.

Why the other options are wrong

C

'ip helper-address 10.10.10.50' is incorrect because it is used to relay broadcast traffic like DHCP requests, not for syslog or time synchronization.

D

'snmp-server host 10.10.10.60' is incorrect because SNMP manages network monitoring and traps, but does not synchronize device time or configure syslog destinations.

E

'service timestamps local' is insufficient alone because it adds timestamps but does not synchronize time across devices, so timestamps may remain inconsistent without NTP.

When would these options actually be correct?

C

In a scenario where the question asks for configurations to enable DHCP relay for clients on a different subnet, specifying 'ip helper-address 10.10.10.50' would be correct if 10.10.10.50 were the DHCP server's address.

D

If the question asked for configuring SNMP monitoring for devices to report to a management server at 10.10.10.60, then this option would be correct. For instance, a question could specify that the engineer needs to set up SNMP traps for monitoring device health.

E

In a different scenario where the requirement is to configure local logging with timestamps for troubleshooting purposes, a question might ask for the command to enable local timestamps on log messages without needing to send logs to a remote server or synchronize time from another device.

Why candidates pick the wrong answer

C

Candidates may confuse the need for log forwarding with the use of 'ip helper-address' due to familiarity with network address forwarding concepts, leading them to incorrectly associate it with the logging requirement.

D

Candidates may choose this option because they recognize the importance of SNMP in network management and mistakenly associate it with logging and time synchronization tasks.

E

Candidates might choose this option because they recognize the importance of timestamps in logging and assume that configuring local timestamps is relevant to log management, leading to confusion about the specific requirements of the question.

785
MCQhard

A user can authenticate successfully to a network device but is denied access to certain commands. Which statement best explains the situation?

A.Authentication succeeded, but authorization limits the user's command access.
B.The device lost all routing information after login.
C.The subnet mask on the user workstation is incorrect.
D.Syslog is blocking the commands for security reasons.
AnswerA

In AAA architecture, authentication verifies the user's identity, while authorization independently determines which commands the authenticated user may execute. Since login succeeded but command access is restricted, the failure occurs at the authorization stage, not at authentication. TACACS+ or RADIUS attributes, or local privilege levels, enforce these per-command limits.

Why this answer

The situation is best explained by authorization controls. In practical terms, authentication confirms who the user is, but authorization determines what that user can do after login. A successful login followed by restricted command access means the identity is valid but the permission set is limited.

This is one of the most important practical distinctions within AAA.

Exam trap

A common exam trap is assuming that successful authentication means unrestricted access to all device commands. Candidates often confuse authentication with authorization, thinking that if a user can log in, they should have full command privileges. This misunderstanding leads to incorrect answers suggesting routing issues or workstation configuration problems as causes for command denial.

However, Cisco devices distinctly separate authentication (identity verification) from authorization (permission enforcement). Authorization policies can restrict command access even after a successful login, which is the correct explanation in this scenario.

Why the other options are wrong

B

This option is incorrect because losing routing information after login does not selectively deny commands. Routing issues affect packet forwarding, not user command permissions, so it does not explain the selective command denial.

C

This option is invalid because an incorrect subnet mask on the user's workstation would affect network connectivity, not command access on the device after successful login. It does not relate to authorization or command restrictions.

D

This option is wrong since Syslog is a logging mechanism that records events but does not block or restrict user commands. It provides visibility but does not enforce command authorization or deny access.

When would these options actually be correct?

B

If the question were framed to ask about a scenario where a user logs in but cannot access the network due to a complete loss of routing information, then option B would be correct. For example, if the question specified that the user could not reach any network resources post-login, this would imply routing issues.

C

In a different scenario where a user is attempting to access a network device but cannot connect at all, a question could ask why the user is unable to reach the device. If the context indicated that the user was on the same network but had an incorrect subnet mask, this option would be correct.

D

In a different scenario, if a question stated that a user is unable to execute commands due to security policies implemented via syslog configurations, then this option could be correct. For example, if specific commands were logged and restricted based on security settings, it would make sense.

Why candidates pick the wrong answer

B

Candidates may choose this option due to a misunderstanding of the relationship between authentication and routing; they might think that a successful login implies full access to the network, overlooking the possibility of routing issues affecting command access.

C

Candidates might choose this option due to a misunderstanding of network fundamentals, believing that connectivity issues directly correlate with command access problems, especially if they are not familiar with the distinction between authentication and authorization.

D

Candidates might choose this option due to a misunderstanding of syslog's role in network security, confusing logging with access control. They may also recall scenarios where logging is associated with security measures, leading to this incorrect assumption.

786
MCQmedium

A network technician is troubleshooting a connectivity issue where a host cannot communicate with a remote server. The technician notices that frames are being dropped at an intermediate switch. At which OSI model layer does the switch primarily operate, and what is the Protocol Data Unit (PDU) used at that layer?

A.Layer 1; bits
B.Layer 2; frames
C.Layer 3; packets
D.Layer 4; segments
AnswerB

Switches are Layer 2 devices that forward frames. When a frame arrives, the switch parses its Data Link header, reads the destination MAC address, and looks up that address in its MAC address table to determine the egress port. It then forwards the entire frame out the appropriate interface (or floods it if the address is unknown), making 'Layer 2; frames' the correct answer.

Why this answer

Switches primarily operate at Layer 2 (Data Link layer) of the OSI model, where they make forwarding decisions based on MAC addresses. The Protocol Data Unit (PDU) at this layer is the frame, which includes the MAC header, payload, and trailer. When frames are dropped at an intermediate switch, it indicates a Layer 2 issue such as a MAC address table problem, VLAN mismatch, or duplex mismatch.

Exam trap

Cisco often tests the distinction that a standard switch operates at Layer 2, but candidates may incorrectly choose Layer 3 because they associate switches with VLANs or IP routing, forgetting that basic switching is a Layer 2 function.

Why the other options are wrong

A

Switches do not operate at Layer 1; hubs and repeaters do.

C

While some multilayer switches can route, the basic switch in this scenario operates at Layer 2.

D

Segments are used by transport layer protocols, not by switches.

787
Multi-Selectmedium

Which TWO statements about IPv4 and IPv6 static routes, including floating static routes, are correct?

Select 2 answers
A.A floating static route uses a higher administrative distance than the primary route to provide backup connectivity.
B.An IPv6 static route using a link-local next-hop address must include both the next-hop address and the outgoing interface.
C.In IPv6, the default route prefix is 0.0.0.0/0.
D.For a floating static route to be installed in the routing table, it must have an administrative distance lower than that of the primary route.
E.An IPv4 static route will only be inserted into the routing table if its next-hop IP address belongs to a directly connected subnet.
AnswersA, B

A floating static route acts as a backup by intentionally using an administrative distance (AD) that is higher than that of the primary route. Since routing protocols and static routes are selected by lowest AD, the floating route remains out of the routing table while the primary route is active. Only when the primary route is removed due to failure does the router install the floating route, providing connectivity.

Why this answer

A floating static route is configured with a higher administrative distance (AD) than the primary route. This ensures the floating route is only used when the primary route fails, as the router prefers routes with lower AD values. For example, if the primary route has an AD of 1 (static route default), the floating static route might be set to AD 200, making it a backup.

Exam trap

Cisco often tests the distinction between IPv4 and IPv6 default route prefixes (0.0.0.0/0 vs ::/0) and the requirement for specifying the outgoing interface with IPv6 link-local next-hop addresses, which candidates frequently confuse.

Why the other options are wrong

C

0.0.0.0/0 is the IPv4 default route; the correct IPv6 default prefix is ::/0.

D

A floating static route must have a higher AD, not lower, so that it is less preferred and only installed when the primary (lower AD) route is lost.

E

Cisco IOS requires the next-hop to be reachable, but it does not have to be directly connected. As long as a route exists to reach that next-hop (even recursively), the static route can be installed.

788
MCQhard

A switch receives superior BPDUs on a port where the design requires that no downstream device ever become the root path for that segment. Which feature is the best fit for that requirement?

A.Root guard
B.BPDU Guard
C.Port security
D.DHCP Snooping
AnswerA

Root guard is the correct STP protection mechanism for this scenario. When a port configured with root guard receives a superior BPDU (one advertising a better bridge ID or lower root path cost), it transitions the port to a root-inconsistent state, effectively blocking it. This prevents the port from becoming a root port and stops an unauthorized switch from hijacking the root bridge role, thereby preserving the intended spanning-tree topology.

Why this answer

Root guard is the best fit because it is designed to prevent a port from becoming the path toward a new root bridge when superior BPDUs are received. In practical terms, it protects the intended STP topology by keeping that port from taking on a root-related forwarding role when the design says it should not.

This is different from BPDU Guard, which is more commonly used on edge ports to disable them entirely if BPDUs appear. Root guard is about protecting topology roles, not just edge-port assumptions.

Exam trap

A common exam trap is selecting BPDU guard instead of root guard because both involve BPDU handling. BPDU guard disables a port immediately upon receiving any BPDU, which is suitable for edge ports but not for ports where topology control is required. Root guard, on the other hand, only blocks ports that receive superior BPDUs, allowing normal BPDUs from the current root bridge.

Confusing these features can lead to incorrect answers, as BPDU guard does not protect the root path role but rather protects against unauthorized devices on edge ports.

Why the other options are wrong

B

BPDU guard is incorrect because it disables a port upon receiving any BPDU, which is suitable for edge ports but does not control root path roles or topology changes.

C

Port security is unrelated to STP root path control; it manages MAC address access on a port and does not affect BPDU processing or root bridge election.

D

DHCP snooping protects against rogue DHCP servers by filtering DHCP messages and does not interact with STP or root bridge election mechanisms.

When would these options actually be correct?

B

In a scenario where the question asks about protecting edge ports from receiving BPDUs while allowing them to remain operational, BPDU Guard would be the correct answer. For example, if the question specified that the goal was to prevent accidental topology changes on access ports, BPDU Guard would fit.

C

In a scenario where the question asks about securing a switch port against unauthorized devices connecting, while ensuring that only specific MAC addresses are allowed, port security would be the correct answer. This could involve a network segment where only known devices should be permitted to communicate.

D

In a scenario where a question asks about securing a network against rogue DHCP servers and ensuring that only trusted DHCP servers can assign IP addresses, DHCP Snooping would be the correct answer. This would involve configuring the switch to allow DHCP responses only from specific trusted ports.

Why candidates pick the wrong answer

B

Candidates may confuse BPDU Guard with Root Guard due to their similar functions in protecting the network topology, leading them to mistakenly believe that BPDU Guard can also prevent a downstream device from becoming the root bridge.

C

Candidates may confuse port security with STP features, thinking that limiting MAC addresses could also prevent topology changes. This misunderstanding can lead them to select port security when they are actually looking for a solution related to STP behavior.

D

Candidates might confuse DHCP Snooping with general network security features, thinking it could relate to controlling device roles in STP due to its focus on preventing unauthorized access, leading them to mistakenly select it.

789
MCQhard

A network administrator wants to receive an immediate notification from a device when a significant event occurs, rather than polling the device repeatedly. Which SNMP feature is most associated with that requirement?

A.SNMP traps
B.Syslog severity 7
C.DHCP relay
D.NetFlow exporters
AnswerA

An SNMP trap is an unsolicited, event-driven message that a managed device sends directly to a network management station (NMS) to alert it of a fault, status change, or security incident. Unlike SNMP polling, which requires the NMS to request information, traps are pushed immediately when the triggering event occurs, enabling real-time notification without waiting for a poll cycle. This is exactly the behavior described by the requirement to receive an immediate notification from a device.

Why this answer

SNMP traps are the correct answer because they are an SNMP feature that sends unsolicited, event-driven notifications from the device to the management system when a significant event occurs, eliminating the need for polling. Option B (syslog severity 7) is incorrect because syslog is a separate protocol for logging; while syslog messages are also sent unsolicited, the question specifically asks for an SNMP feature. Options C (DHCP relay) and D (NetFlow exporters) are unrelated to immediate event notifications: DHCP relay forwards broadcast requests, and NetFlow exports traffic flow data for analysis.

Exam trap

A frequent exam trap is mistaking syslog messages or NetFlow exporters as the mechanism for immediate event notifications in SNMP. Syslog severity levels, such as severity 7, relate to logging detail but do not trigger unsolicited alerts to management stations. Similarly, NetFlow exporters focus on traffic flow analysis rather than event-driven notifications.

Candidates may also confuse DHCP relay, which is unrelated to SNMP, with notification features. The key is to remember that only SNMP traps send unsolicited, immediate notifications, distinguishing them from polling or other monitoring tools.

Why the other options are wrong

B

Syslog severity 7 refers to debug-level logging detail but does not trigger unsolicited alerts; syslog messages require polling or log monitoring and are not part of SNMP's event-driven notification.

C

DHCP relay is a mechanism to forward DHCP requests across networks and has no role in SNMP or event-driven notifications, making it irrelevant to the question.

D

NetFlow exporters provide detailed traffic flow information for analysis but do not send immediate event notifications; they are unrelated to SNMP traps or polling mechanisms.

When would these options actually be correct?

B

If the exam question asked about logging mechanisms for troubleshooting and monitoring network devices, specifically focusing on the level of detail in logs, then Syslog severity 7 would be the correct answer as it indicates the most granular logging level.

C

If the question were about configuring a network to ensure that DHCP requests are properly forwarded to a remote server, then DHCP relay would be the correct answer. This would involve scenarios where devices are on different subnets and need to communicate with a centralized DHCP server.

D

If the exam question asked about monitoring network traffic and the need to analyze flow data for performance or security purposes, then NetFlow exporters would be the correct answer, as they facilitate the export of flow information to a collector for analysis.

Why candidates pick the wrong answer

B

Candidates may confuse the need for immediate notifications with the detailed logging provided by syslog, thinking that severity levels can also trigger alerts, leading them to choose this option.

C

Candidates may confuse DHCP relay with network monitoring concepts, thinking that it plays a role in event notifications due to its involvement in network communication. This confusion can lead them to select it mistakenly.

D

Candidates might choose this option because they associate network monitoring with flow data collection, thinking that NetFlow exporters could somehow relate to event notifications, despite the lack of real-time alerting capabilities.

790
PBQmedium

You are connected to SW1, a Cisco switch that is experiencing intermittent connectivity issues. The network administrator suspects a duplex mismatch between SW1 and the connected router R1. Use CDP to verify the status and check interface statistics.

Network Topology
G0/0G0/1linkR1SW1

Hints

  • CDP shows the remote device's capabilities and interface details.
  • Look at the duplex settings on both sides; a mismatch often causes CRC errors.
  • The interface counters show late collisions if duplex mismatch exists.
A.The switch port is set to half duplex, and the router is set to full duplex, causing CRC errors and late collisions.
B.The switch port is set to full duplex, and the router is set to half duplex, causing runts and FCS errors.
C.The switch port and router are both set to half duplex, but the cable is faulty, causing CRC errors.
D.The switch port is set to auto-negotiation, and the router is set to half duplex, causing late collisions.
AnswerA
solution
! SW1
show cdp neighbors GigabitEthernet0/1 detail
show interfaces GigabitEthernet0/1
show interfaces GigabitEthernet0/1 counters errors

Why this answer

The switch port is manually set to half duplex while the router likely negotiates to full duplex, causing a mismatch. CDP output from the switch will show the router's duplex as full. Interface statistics will show increasing CRC errors and late collisions.

The solution is to set the switch port to auto-negotiation or match the duplex setting with the router.

Exam trap

The exam trap is that candidates may confuse the symptoms of duplex mismatch (CRC errors and late collisions) with other issues like cable faults or speed mismatches. Also, they might forget that CDP can be used to verify the duplex setting of a neighbor. Always check CDP output and interface error counters when troubleshooting connectivity issues.

Why the other options are wrong

B

The specific factual error is that the switch port is manually set to half duplex, not full duplex. Also, runts and FCS errors are not the primary indicators of a duplex mismatch.

C

The specific factual error is that a duplex mismatch requires different duplex settings; both half duplex would not cause a mismatch. Faulty cables are a different issue.

D

The specific factual error is that auto-negotiation would likely result in half duplex on both sides, avoiding a mismatch. The scenario states the switch port is manually set to half duplex, not auto.

Why candidates pick the wrong answer

B

Candidates might pick this because they know duplex mismatches cause errors, but they confuse the direction of the mismatch or the specific error types.

C

Candidates might pick this because CRC errors are common in both duplex mismatches and cable faults, and they may overlook the CDP verification step.

D

Candidates might pick this because they know auto-negotiation can cause issues if one side is manually configured, but they forget that auto-negotiation will match the manually set speed/duplex if possible.

791
MCQmedium

A switchport should automatically disable itself if too many MAC addresses are learned beyond the configured secure limit. Which port-security violation mode causes that behavior?

A.shutdown
B.protect
C.restrict
D.dynamic
AnswerA

In port-security violation mode 'shutdown', the switchport is immediately placed into the error-disabled state upon a MAC address violation. This is the default and most restrictive violation mode, effectively disabling the port until an administrator manually issues the 'shutdown' and 'no shutdown' commands or the port is configured for auto-recovery via errdisable recovery. It fully blocks all traffic and generates a syslog/SNMP message.

Why this answer

Shutdown is the violation mode that error-disables the port. In plain language, when the switch sees a port-security violation under shutdown mode, it reacts by taking the interface out of service rather than simply dropping frames quietly. That behavior is useful when the administrator wants a clear and strong response to unauthorized devices.

This matters because port security has several violation modes and they do not behave the same way. Restrict and protect can keep the interface up, while shutdown is the mode associated with the most visible response.

Exam trap

Be aware that not all port-security violation modes disable the port. Only Shutdown mode does this.

Why the other options are wrong

B

The 'protect' mode does not disable the port when the secure MAC address limit is exceeded; instead, it drops packets from unknown MAC addresses without generating a notification. This behavior does not match the requirement of the question.

C

The 'restrict' mode allows traffic to pass but drops packets from unknown MAC addresses, without disabling the port. This does not meet the requirement of automatically disabling the port when the MAC address limit is exceeded.

D

The 'dynamic' option is incorrect because it does not refer to a specific port-security violation mode that disables the port when the MAC address limit is exceeded. Instead, it implies the dynamic learning of MAC addresses without enforcing a security limit.

When would these options actually be correct?

B

In a different scenario, if the question asked which port-security mode allows traffic from known MAC addresses while silently dropping traffic from unknown MAC addresses without shutting down the port, 'protect' would be the correct answer.

C

In a scenario where the question asks which port-security violation mode allows traffic to continue while limiting the number of MAC addresses, 'restrict' would be the correct answer. For example, if the question specifies that the goal is to maintain network connectivity while preventing excessive MAC address learning, 'restrict' fits that requirement.

D

In a different question asking about the behavior of a switchport that learns MAC addresses dynamically and can adjust its settings based on traffic patterns, 'dynamic' could be the correct answer. For example, if the question focused on how a port can adapt to changing network conditions without manual configuration, 'dynamic' would apply.

Why candidates pick the wrong answer

B

Candidates may choose 'protect' because they understand it limits traffic based on MAC addresses, leading them to mistakenly associate it with security measures that involve disabling the port.

C

Candidates may choose 'restrict' because it sounds like a security measure that limits access, leading them to believe it could also involve disabling the port, creating confusion with the intended functionality.

D

Candidates may choose 'dynamic' because it sounds like a proactive approach to managing MAC addresses, leading them to mistakenly associate it with automatic security measures rather than the specific disabling behavior required by the question.

792
MCQhard

A user can connect to the employee SSID and receive the correct employee IP subnet, but access to one internal application fails only for that WLAN while wired users succeed. Which troubleshooting area is the strongest first focus?

A.A WLAN-specific policy or filtering rule affecting access to that application
B.The SSID broadcast setting
C.Whether the access point has a valid hostname
D.Whether the client is using PPP instead of Ethernet
AnswerA

The user successfully associates with the employee SSID and obtains an IP address, proving that physical connectivity, authentication, and DHCP are functioning. A failure isolated to one application on that specific WLAN points to a WLAN-level ACL, application filter, or policy applied on the wireless LAN controller that is dropping or denying that app's traffic. This is consistent with a selective deny rather than an infrastructure fault.

Why this answer

The strongest first focus is the policy or filtering path specific to that WLAN or traffic class. In practical terms, the user has already shown that the correct WLAN join, authentication, and subnet assignment are working. Because wired users succeed and only one application fails from that WLAN, the most likely issue is a WLAN-specific policy, ACL, firewall rule, or path treatment affecting that application.

This is a realistic selective-access troubleshooting scenario and tests whether the candidate narrows the fault domain correctly.

Exam trap

Avoid assuming the problem is with the user's device or general network settings when the issue is isolated to a specific WLAN.

Why the other options are wrong

B

The SSID broadcast setting does not directly impact the ability of users to connect to an internal application once they are authenticated and assigned an IP address. Since wired users can access the application, the issue is likely related to WLAN-specific configurations rather than SSID visibility.

C

The access point's hostname does not directly impact application access; it primarily affects network identification and management. Since the issue is specific to WLAN access and not present for wired users, the hostname is unlikely to be the cause.

D

This option is wrong because the issue pertains to application access over a specific WLAN, not the type of connection (PPP vs. Ethernet). The problem likely lies in WLAN configuration rather than the protocol used by the client device.

When would these options actually be correct?

B

In a different scenario where the question specifies that users cannot see the SSID at all, leading to connection issues, the SSID broadcast setting could be the correct focus. For example, if users are unable to connect to the WLAN due to it being hidden, this option would be relevant.

C

In a scenario where a question asks about connectivity issues related to DNS resolution for a specific application, and the problem is identified as being due to the access point not having a valid hostname registered in the DNS, this option would be correct.

D

In a scenario where a question asks about a client device that is unable to connect to a network due to using PPP instead of Ethernet, and the focus is on connectivity issues related to protocol compatibility, this option would be correct.

Why candidates pick the wrong answer

B

Candidates might choose this option because they associate SSID visibility with connectivity issues, leading them to believe it could affect application access, even when the user is already connected.

C

Candidates may confuse hostname validity with connectivity issues, thinking that if the hostname is incorrect, it could lead to application access failures, especially if they lack understanding of how WLAN and wired connections differ in this context.

D

Candidates may choose this option due to a misunderstanding of how different connection types can affect network access, leading them to believe that the protocol used could be the root cause of application access issues.

793
MCQhard

A subnet must support 30 usable IPv4 host addresses. Which prefix is the smallest that meets the requirement?

A./28
B./27
C./26
D./25
AnswerB

A /27 prefix has a subnet mask of 255.255.255.224, which creates 32 total addresses. After reserving the network address and broadcast address, exactly 30 usable host addresses remain, making it the smallest prefix that satisfies the requirement of 30 usable IPv4 hosts. Thus, /27 is the correct choice because it provides the precise number of needed addresses without wasting space.

Why this answer

A /27 is the smallest valid prefix. In plain language, a /27 provides 32 total addresses, and after subtracting the network and broadcast addresses, 30 usable host addresses remain. A /28 would be too small because it provides only 14 usable hosts.

This is a classic minimum-prefix question because it checks whether you can work backward from a host requirement and choose the smallest subnet that fits without over-allocating more space than necessary.

Exam trap

A frequent exam trap is choosing a /28 prefix because it appears to be the closest to supporting 30 hosts. However, a /28 subnet only provides 16 total addresses, of which 14 are usable for hosts after excluding the network and broadcast addresses. This mistake arises from confusing total addresses with usable hosts or failing to subtract the reserved addresses.

Selecting a /28 leads to insufficient host capacity, causing network issues or exam failure. Always remember that usable hosts equal total addresses minus two, which is critical when calculating subnet sizes for CCNA questions.

Why the other options are wrong

A

Option A (/28) is incorrect because a /28 subnet provides only 16 total addresses, which results in 14 usable host addresses after subtracting the network and broadcast addresses. This is insufficient to support 30 hosts.

C

Option C (/26) is incorrect because although it supports 62 usable hosts, it is larger than necessary for 30 hosts, leading to inefficient IP address allocation.

D

Option D (/25) is incorrect because it provides 126 usable host addresses, which is far more than required, resulting in significant address space waste.

When would these options actually be correct?

A

If the question specified a requirement for 14 usable IPv4 host addresses instead of 30, then a /28 subnet would be the correct answer, as it meets that specific need.

C

If the exam question required a subnet that supports at least 62 usable addresses, then /26 would be the correct answer, as it provides the necessary capacity while still being a valid subnet size.

D

If the exam question specified a requirement for a subnet that supports up to 126 usable addresses, then /25 would be the correct choice, as it would provide sufficient capacity for that scenario.

Why candidates pick the wrong answer

A

Candidates may choose /28 due to a misunderstanding of subnetting calculations, mistakenly believing that a smaller subnet can still accommodate more hosts than it actually can.

C

Candidates may choose /26 due to a misunderstanding of subnetting, mistakenly believing that a larger subnet is always acceptable without considering the requirement for the smallest prefix.

D

Candidates may choose /25 due to a misunderstanding of subnetting, thinking that a larger subnet is always acceptable, or they might miscalculate the number of usable addresses needed for the given requirement.

794
MCQhard

Exhibit: A standard ACL meant to block host 10.10.10.50 from reaching any remote network was applied inbound on the branch router's LAN interface, but users report that all local traffic from that host is now blocked. What is the better placement?

A.Leave it inbound on the LAN because standard ACLs belong near the source
B.Move it outbound on the WAN-facing interface closer to the destination
C.Convert it to a VTY access-class
D.Apply it inbound on all switch access ports
AnswerB

A standard ACL filters only on source IP address, so it should be applied outbound on the WAN-facing interface, as far from the source as the destination path allows. This placement blocks host 10.10.10.50 from reaching the WAN/remote side with a single rule, avoiding unnecessary processing on internal LAN interfaces. It is the recommended best practice for standard ACLs.

Why this answer

A standard ACL matches only the source address. If it is placed near the source, it can block that host from reaching destinations you did not intend to affect. Standard ACLs are best placed close to the destination.

Exam trap

A frequent exam trap is believing that standard ACLs should always be applied inbound near the source to block unwanted traffic early. Since standard ACLs filter only by source IP, placing them inbound on a LAN interface can block all traffic from that host, including local communications within the LAN. This leads to unintended network outages and user complaints.

The trap is confusing the ACL placement rule for extended ACLs, which are placed near the source, with the rule for standard ACLs, which should be placed near the destination to avoid over-blocking.

Why the other options are wrong

A

Leaving the standard ACL inbound on the LAN interface is incorrect because standard ACLs filter only by source IP, which causes all traffic from that host, including local LAN traffic, to be blocked. This disrupts local communications and is not best practice.

C

Converting the ACL to a VTY access-class is irrelevant to the question because VTY access-classes control remote management access to the router, not general traffic filtering from a host to remote networks.

D

Applying the ACL inbound on all switch access ports is impractical and inefficient. It would block traffic at multiple points unnecessarily and does not address the specific need to filter traffic from the host to remote networks.

When would these options actually be correct?

A

In a different scenario where the question asks about the best practice for applying standard ACLs to control traffic from multiple hosts on a LAN, stating that standard ACLs belong near the source could be correct if the goal is to restrict access to a specific resource without affecting local traffic flow.

C

In a scenario where the question asks how to restrict remote access to a router's management interface (VTY) from a specific IP address, converting an ACL to a VTY access-class would be the correct approach. This would effectively block that host from accessing the router's management functions while allowing other traffic.

D

In a scenario where the question specifies that all devices connected to the switch ports should be restricted from accessing a specific remote network, applying the ACL inbound on all switch access ports would be the correct approach to enforce that restriction.

Why candidates pick the wrong answer

A

Candidates may find this option appealing because it aligns with the general principle that ACLs should be placed close to the source of traffic to minimize unnecessary processing, leading to a misconception about their placement in this specific context.

C

Candidates may find this option tempting because they might confuse the purpose of VTY access-classes with the need to control access to network resources, leading them to think it could solve the problem of blocking a specific host.

D

Candidates may choose this option because they might confuse the need for access control on switch ports with the requirement to block a specific host's access, leading them to think that applying the ACL broadly would achieve the desired outcome.

795
MCQmedium

R1 has the following static route configured: ip route 0.0.0.0 0.0.0.0 203.0.113.1 What does this route accomplish?

A.It blocks unknown destinations from leaving the router.
B.It creates a host route to 203.0.113.1 only.
C.It advertises all connected routes into OSPF.
D.It creates a default route used when no more specific route exists.
AnswerD

This static route has a destination of 0.0.0.0 and a mask of 0.0.0.0, which is the IPv4 default route. It matches any IP packet whose destination does not have a more specific (longer-prefix) match in the routing table, so it acts as the gateway of last resort. Next hop 203.0.113.1 is where all unmatched traffic is forwarded.

Why this answer

This command creates a default static route. In everyday terms, it tells the router, “If you do not know a more specific way to reach a destination, send the traffic to 203.0.113.1.” That next-hop address usually points toward an upstream router or ISP edge. The command does not describe one specific remote network; it represents every destination not otherwise matched by a more specific entry.

At the routing-table level, `0.0.0.0 0.0.0.0` is the broadest possible IPv4 prefix. Because it matches everything, it is used only when nothing more specific exists.

Exam trap

Do not confuse default routes with specific network routes or access control lists; focus on the 0.0.0.0/0 prefix.

Why the other options are wrong

A

This option is incorrect because static routes do not inherently block traffic; they simply define paths for routing packets. A static route allows traffic to specific destinations, rather than blocking unknown ones.

B

This option is wrong because the static route configured does not limit routing to a single host; instead, it typically defines a broader range or a default route for multiple destinations.

C

This option is wrong because static routes do not inherently advertise routes into OSPF; they simply define a path to a specific destination. The question specifically asks about the function of a static route, which does not involve OSPF route advertisement.

When would these options actually be correct?

A

In a different question context, if the question asked about a router's access control list (ACL) or firewall rules that specifically deny traffic to unknown destinations, then this option would be correct, as those configurations can block such traffic.

B

If the exam question specified that the static route was configured with a subnet mask of 255.255.255.255 for the IP address 203.0.113.1, then it would create a host route to that specific IP address, making this option correct.

C

If the question were about a router configuration that includes both static routes and OSPF, and it asked how static routes can be redistributed into OSPF, then this option could be correct. In that context, a static route could be configured to be advertised into OSPF through redistribution commands.

Why candidates pick the wrong answer

A

Candidates might choose this option due to a misunderstanding of static routes and their role in routing; they may confuse routing with access control mechanisms that manage traffic flow based on destination addresses.

B

Candidates may be tempted by this option because they might confuse the concept of a static route with host routes, leading them to believe that a specific IP address configuration implies a host route.

C

Candidates may find this option tempting because they might confuse static routes with dynamic routing protocols like OSPF, leading them to mistakenly believe that static routes can automatically participate in OSPF route advertisements.

796
MCQhard

Why is the combination of strong authentication and centralized logging better than either control by itself?

A.Authentication improves prevention, while centralized logging improves visibility and investigation.
B.They are redundant because both perform exactly the same task.
C.Centralized logging makes authentication unnecessary.
D.Strong authentication removes the need for any event records.
AnswerA

Strong authentication (e.g., MFA, certificates) enforces identity verification before access is granted, thereby reducing the likelihood of unauthorized entry—this is a preventive control. Centralized logging, by contrast, aggregates security events from diverse systems into a single repository, enabling real-time monitoring, forensic analysis, and post-incident investigation. Together they form a defense-in-depth strategy: one blocks initial compromise, while the other provides the visibility needed to detect, respond to, and learn from attempted or successful attacks.

Why this answer

The combination is better because strong authentication helps prevent unauthorized access, while centralized logging helps detect, review, and investigate what happened across the environment. In practical terms, one control is stronger on prevention, and the other is stronger on visibility and accountability. Together they provide broader protection than either one alone.

This reflects a real security principle: mature security depends on layers of control, not one mechanism trying to do every job.

Exam trap

A common exam trap is believing that strong authentication alone is enough to secure a network, leading to the misconception that event logging is unnecessary. Candidates may also incorrectly assume that centralized logging can replace authentication by simply recording events without preventing unauthorized access. This misunderstanding overlooks the complementary roles these controls play: authentication stops unauthorized users upfront, while logging provides the visibility needed to detect and investigate incidents.

Ignoring either control weakens overall security and can cause candidates to select incorrect answers that underestimate the importance of layered defenses.

Why the other options are wrong

B

This option is incorrect because authentication and logging serve different purposes; authentication controls access, while logging records events. They are not redundant but complementary.

C

This option is wrong because centralized logging only records events and does not prevent unauthorized access, so it cannot replace strong authentication.

D

This option is incorrect because even with strong authentication, event records remain essential for auditing, troubleshooting, and investigating security incidents.

When would these options actually be correct?

B

In a question that asks about the efficiency of security measures in a highly controlled environment, where both strong authentication and logging are implemented to achieve the same goal of access control, option B could be correct if the context implies that they are used interchangeably without recognizing their distinct roles.

C

If the exam question were to ask about a scenario where centralized logging is implemented in a highly secure environment that relies solely on logging for access control, then this option could be considered correct. For example, a question might describe a system where access is granted based on log entries rather than traditional authentication methods.

D

In a scenario where the exam question specifically states that strong authentication methods are infallible and cannot be bypassed, one might argue that event records are redundant. This would imply that if authentication is always successful, there is no need to log events.

Why candidates pick the wrong answer

B

Candidates may choose this option due to a misunderstanding of security concepts, believing that if both controls aim to enhance security, they must be performing the same function, leading to confusion about their specific roles.

C

Candidates might choose this option due to a misunderstanding of the roles of authentication and logging, believing that logging alone can suffice for security, especially if they have encountered scenarios where logging is emphasized without adequate authentication.

D

Candidates may find this option tempting because they might believe that robust authentication alone could sufficiently secure a system, leading them to overlook the importance of logging for monitoring and incident response.

797
MCQmedium

A phone and a PC are attached to the same switchport. The intended data VLAN is VLAN 10, and the phone uses voice VLAN 20. The switchport currently has `switchport voice vlan 20` configured. The phone works, but the PC cannot reach the data network. Which command is most likely missing?

A.switchport mode dynamic auto
B.switchport voice vlan 20
C.switchport access vlan 10
D.spanning-tree guard root
AnswerC

The PC fails to reach the network because it is untagged on the access port while the switchport is likely in its default VLAN 1 or a mismatched VLAN. Issuing 'switchport access vlan 10' explicitly assigns the data VLAN to the port, ensuring the PC's traffic is placed in the correct Layer 2 domain. The phone can still tag its voice traffic with VLAN 20 via the voice VLAN feature, but the access VLAN governs the untagged PC traffic.

Why this answer

When a Cisco IP phone and a PC share one port, the switchport often needs both a data VLAN and a voice VLAN. If the voice VLAN exists but the data access VLAN is wrong or missing, the phone can work while the PC fails.

Exam trap

Ensure both data and voice VLANs are configured when devices share a port. Don't confuse duplex or trunk settings with VLAN issues.

Why the other options are wrong

A

The phone works but the PC cannot reach the data network, indicating the PC is not in the correct VLAN. 'switchport mode dynamic auto' sets the port to negotiate trunking via DTP, which does not assign a data VLAN to the PC.

B

The PC cannot reach the data network because the switchport is likely configured as a voice VLAN only, but the data VLAN (access VLAN) is missing. Option B configures the voice VLAN, which is correct for the phone, but does not set the access VLAN for the PC.

D

The issue is that the PC cannot reach the data network, which is typically configured via the access VLAN. Spanning-tree guard root is unrelated to VLAN assignment; it prevents a switch from becoming the root bridge, not connectivity issues on a specific VLAN.

When would these options actually be correct?

A

This command would be correct when the question asks for a switchport configuration that allows dynamic trunk negotiation with a neighboring switch, such as in a scenario where you want the port to become a trunk if the neighbor is set to 'dynamic desirable' or 'trunk'.

B

In a scenario where a phone and PC are connected to the same switchport, and the phone works but the PC cannot reach the data network, the missing setting is the access VLAN for the PC. Option C (switchport access vlan 10) would be correct if VLAN 10 is the data VLAN.

D

A question where a switchport is connected to a switch that should not become the root bridge, and the network experiences instability due to rogue root bridge elections. The correct answer would be to enable root guard on that port.

Why candidates pick the wrong answer

A

Candidates may confuse dynamic trunking protocols with VLAN assignment, thinking that 'dynamic auto' will automatically assign the PC to the correct VLAN, but it only affects trunking mode, not access VLAN.

B

Candidates may think that since the phone works, the voice VLAN is correctly configured, and they might overlook that the PC needs a separate data VLAN. They might assume the voice VLAN setting is the missing piece, but it is already present.

D

Candidates may confuse root guard with other security features or think that spanning-tree issues could cause connectivity loss for the PC, but the symptom here is VLAN-specific, not spanning-tree related.

798
Multi-Selecthard

Users can browse websites by IP address but not by hostname. The default gateway is reachable and general internet connectivity works. Which two causes are the most likely?

Select 2 answers
A.The clients are missing a valid DNS server setting
B.DNS queries may be blocked somewhere along the path
C.The routers are missing NTP configuration
D.The switch access ports should be changed to dynamic desirable
AnswersA, B

Without a valid DNS server setting, the client's resolver has no IP address to send hostname queries to, so name resolution returns a 'server not found' or timeout error. Browsing by IP address works because HTTP requests target the IP directly and never invoke the DNS lookup process. This is a classic missing-DNS configuration issue at the client or DHCP scope.

Why this answer

If IP connectivity works but hostnames fail, the problem is usually DNS configuration or DNS reachability, not general routing.

Exam trap

A frequent exam trap is to assume that if users cannot browse websites by hostname, the problem must be with routing or the default gateway. However, the question states the default gateway is reachable and general internet connectivity works, which rules out routing issues. Another trap is to confuse unrelated configurations like NTP or switch port settings as causes for DNS failures.

The key is to focus on DNS-specific causes: missing DNS server settings on clients or DNS traffic being blocked. Misinterpreting these symptoms leads to incorrect answers that do not address the root cause of hostname resolution failure.

Why the other options are wrong

C

Incorrect. NTP configuration affects time synchronization but does not impact DNS resolution or hostname-based browsing, so it is unrelated to this issue.

D

Incorrect. Changing switch access ports to dynamic desirable affects VLAN trunk negotiation (DTP) but does not influence DNS resolution or hostname connectivity.

When would these options actually be correct?

C

In a question where devices fail to authenticate or certificates are rejected, and the symptom is time-related errors (e.g., 'certificate expired' or 'authentication fails'), missing NTP configuration would be a likely cause.

D

This option would be correct in a question about a switch not forming a trunk with another switch, where the access port mode prevents trunk negotiation. For example: 'Two switches fail to establish a trunk link; which configuration change could resolve the issue?'

Why candidates pick the wrong answer

C

Candidates may confuse NTP with DNS because both involve network services, or they might think time sync is required for all network operations, overlooking that DNS is the specific service needed for hostname resolution.

D

Candidates may confuse 'dynamic desirable' with a general 'dynamic' setting that seems like it could fix connectivity, or they might think changing port modes can resolve any network issue without understanding DTP's specific role.

799
Multi-Selectmedium

Which two statements accurately describe why DNS issues can look like general connectivity problems to users?

Select 2 answers
A.Users often access services by name, so failed name resolution can feel like total connectivity loss.
B.Testing by IP address versus hostname can help distinguish DNS issues from raw path issues.
C.DNS failure automatically means the default gateway is missing.
D.If DNS fails, DHCP and NTP must also fail immediately.
E.DNS replaces the need for routing between subnets.
AnswersA, B

DNS translates human-friendly domain names into IP addresses, so when name resolution fails, client applications cannot even initiate a session to a server. Because users rarely type raw IP addresses, every attempted connection appears to fail, making a single DNS outage feel identical to a complete network outage. The data path may be fully operational, but the user perceives total connectivity loss.

Why this answer

DNS issues can look like general connectivity problems because many users think in terms of names, not IP addresses. In practical terms, they may report that 'the network is down' when the actual routed path works but hostname resolution does not. That is why testing by IP versus name is such a useful troubleshooting step.

The distinction between transport reachability and naming is critical in user-facing support.

Exam trap

A common exam trap is assuming that DNS failure means the default gateway or other network infrastructure is missing or malfunctioning. Candidates might incorrectly link DNS issues to routing failures or DHCP and NTP outages, which are separate services. This misunderstanding leads to wasted troubleshooting effort on routing tables or gateway configurations when the real problem lies in DNS server availability or client resolver settings.

The exam tests your ability to isolate DNS as an application-layer service distinct from network-layer connectivity.

Why the other options are wrong

C

Incorrect because DNS failure does not imply the default gateway is missing. Routing and DNS are separate functions, and gateway issues are unrelated to DNS resolution.

D

Incorrect because DHCP and NTP are independent IP services. DNS failure does not cause these services to fail immediately or automatically.

E

Incorrect because DNS does not replace routing. DNS resolves names to IP addresses, while routing protocols determine packet forwarding between subnets.

When would these options actually be correct?

C

In a question that specifically asks about scenarios where DNS failures directly impact the default gateway's functionality, such as in a misconfigured network where DNS settings are tied to gateway operations, this option could be correct. For instance, if a network's routing relies on DNS resolution for gateway identification, a DNS failure could indeed lead to a perceived loss of the default gateway.

D

If the exam question asked about the dependencies between network services and specified a scenario where DNS, DHCP, and NTP were configured on the same server, and that server experienced a complete failure, then this option could be correct. In that case, the failure of DNS could imply a broader service outage affecting DHCP and NTP.

E

In a question focused on the role of DNS in network architecture, if it asked whether DNS can eliminate the need for routing protocols in specific scenarios, option E could be correct if discussing a hypothetical network design that relies solely on DNS for service discovery within a single subnet.

Why candidates pick the wrong answer

C

Candidates may choose this option due to a misunderstanding of how network layers interact, leading them to believe that DNS issues must affect all aspects of connectivity, including the default gateway.

D

Candidates might choose this option due to a misunderstanding of how network services interact, mistakenly believing that all services dependent on DNS must fail together, reflecting a common misconception about service dependencies.

E

Candidates might choose this option due to a misunderstanding of DNS's role in network communication, mistakenly believing that DNS can handle routing tasks, leading to confusion about the functions of different network components.

800
MCQmedium

Two switches are connected with EtherChannel using LACP. One side is configured with mode active and the other side with mode passive. What happens?

A.The channel forms successfully
B.The channel stays down because both sides must be active
C.The channel forms only if PAgP is also enabled
D.The channel becomes a static Port-Channel
AnswerA

LACP's active/passive mode is a standard, valid combination. The active switch actively sends LACP PDUs (protocol data units) to negotiate the link, while the passive switch listens and responds, allowing the port-channel to form. Since one side is active, the negotiation completes and the EtherChannel becomes operational as a dynamic LACP bundle.

Why this answer

LACP forms an EtherChannel when at least one side actively negotiates. Active plus passive is a valid combination, so the bundle comes up if the physical settings match.

Exam trap

A frequent exam trap is believing that both sides of an LACP EtherChannel must be configured in active mode for the channel to form. This misconception leads to the incorrect assumption that active-passive combinations will fail. In reality, LACP requires only one side to be active to initiate negotiation, while the other side can be passive and respond.

Another trap is confusing LACP with PAgP, expecting that enabling PAgP alongside LACP will help form the channel, which is false because these protocols are incompatible. Understanding these nuances prevents misinterpretation of EtherChannel negotiation behavior on the exam.

Why the other options are wrong

B

This option is incorrect because both sides do not need to be active. One side active and the other passive is sufficient for LACP negotiation and channel formation.

C

This option is incorrect because PAgP is a different, Cisco proprietary protocol and does not work alongside LACP. Enabling PAgP does not affect LACP negotiation.

D

This option is incorrect because configuring one side as active and the other as passive uses LACP negotiation, not a static Port-Channel. Static Port-Channels require manual configuration on both ends without negotiation.

When would these options actually be correct?

B

If the question specified that both switches were configured with LACP but required both to be in active mode for the channel to form, then this option would be correct. For example, a question could state that both switches must be in active mode for LACP to function properly.

C

In a different scenario where the question specifies that both switches are configured for PAgP and that LACP is not supported or enabled, the answer could be correct if the exam asks about the necessity of PAgP for channel formation.

D

This option would be correct in a scenario where both switches are configured to use static EtherChannel without LACP or PAgP. In that case, if one side is set to dynamic negotiation, it would not form a channel, and the static configuration would prevail.

Why candidates pick the wrong answer

B

Candidates may choose this option due to a misunderstanding of LACP's operational modes, mistakenly believing that both sides must actively negotiate for the channel to form, leading to confusion about the requirements for successful EtherChannel setup.

C

Candidates may choose this option due to confusion between LACP and PAgP, mistakenly believing that both protocols must be enabled simultaneously for EtherChannel to function properly.

D

Candidates may find this option tempting because they might confuse the negotiation modes of LACP with static configurations, leading them to believe that a mismatch in modes would default to a static setup.

801
MCQhard

R1 and R2 are connected via Ethernet and are configured with OSPF, but they fail to form an adjacency. Upon checking the interface configurations, you see that R1’s interface is in OSPF area 0 while R2’s interface is in area 1, and both interfaces use default timers and are in the same subnet. What is the most likely reason?

A.The OSPF areas do not match on the shared segment.
B.The routers must use the same process ID.
C.The interfaces are in different IPv4 subnets.
D.OSPF cannot run on Ethernet interfaces.
AnswerA

OSPF requires both neighbors to agree on the area ID for a given link; a mismatch prevents the formation of adjacency because the Hello packets carry the area ID and a mismatch causes the receiving router to drop them. Even if subnets and timers match, an area mismatch leaves the neighbor state stuck in Down or Attempt.

Why this answer

The most likely cause is an OSPF area mismatch on the shared segment. R1 and R2 are in the same IP subnet and use default hello/dead timers, so neither subnet mismatch nor timer mismatch is the problem. OSPF can run on Ethernet interfaces.

However, OSPF requires neighbors on the same link to agree on the area ID; here they differ, preventing adjacency. Option B is incorrect because OSPF process IDs are locally significant and do not need to match.

Exam trap

A common mistake is believing that OSPF process IDs must match between routers to form an adjacency; process IDs are locally significant and do not need to match.

Why the other options are wrong

B

This option is incorrect because OSPF process IDs are locally significant and do not need to match between routers. Different process IDs do not prevent adjacency formation.

C

This option is incorrect because the interfaces are in the same IPv4 subnet (10.1.50.0/24), which is a prerequisite for OSPF adjacency on broadcast networks.

D

This option is incorrect because OSPF commonly runs on Ethernet interfaces. Ethernet is a supported media type for OSPF neighbor discovery and adjacency formation.

When would these options actually be correct?

B

In a different scenario where the question specifies that the routers are configured with multiple OSPF processes and the exam asks about the necessity of matching process IDs for adjacency, this option would be correct. For example, if the question involved multiple OSPF instances on the same router, it would be relevant.

C

In a different question setup, if the exam asked about OSPF adjacency issues where the interfaces of R1 and R2 are indeed in different IPv4 subnets, this option would be correct. For example, if the question specified that R1's interface is in 192.168.1.0/24 and R2's interface is in 192.168.2.0/24, then this option would apply.

D

In a different exam scenario, if the question stated that R1 and R2 were configured on a non-Ethernet interface type, such as a serial link, and asked about OSPF compatibility, then this option could be correct if the context implied that OSPF was not supported on that specific interface type.

Why candidates pick the wrong answer

B

Candidates may find this option tempting because they might confuse OSPF process IDs with the requirement for matching OSPF configurations, leading them to believe that process IDs play a critical role in forming adjacencies.

C

Candidates may choose this option due to a misunderstanding of OSPF requirements, believing that adjacency cannot be formed if routers are on different subnets, which is a common misconception.

D

Candidates may find this option tempting because they might recall that certain routing protocols have limitations on specific interface types, leading to confusion about OSPF's compatibility with Ethernet.

802
PBQhard

You are connected to R1, a multilayer switch acting as a DNS forwarder for two VLANs. Users on VLAN 10 report that they cannot resolve 'files.example.com' while VLAN 20 works fine. The DNS server 198.51.100.53 is reachable but returns SERVFAIL for queries from subnet 192.168.10.0/24, while server 203.0.113.53 responds correctly for both VLANs. Diagnose and fix the DNS resolution issue using nslookup and dig, then adjust the IOS-XE configuration to ensure proper name resolution. Choose the best fix that permanently resolves the problem.

Network Topology
G0/0/010.0.0.1/30198.51.100.53linkG0/0/1.10192.168.10.1/24G0/0/1.20192.168.20.1/24R1DNS ServersVLAN 10VLAN 20

Hints

  • The first DNS server returns SERVFAIL for the A record query.
  • The second DNS server resolves the name correctly.
  • Use 'no ip name-server <ip>' to remove a faulty server.
A.Remove the faulty primary DNS server using 'no ip name-server 198.51.100.53' and keep the working secondary server 203.0.113.53.
B.Add a static DNS entry for 'files.example.com' using 'ip host files.example.com 10.0.0.1' on R1.
C.Change the DNS server order so that the working server is primary using 'ip name-server 203.0.113.53 198.51.100.53'.
D.Configure the router to use only the faulty server by removing the working server with 'no ip name-server 203.0.113.53'.
AnswerA
solution
! R1
configure terminal
no ip name-server 198.51.100.53
end

Why this answer

The faulty DNS server 198.51.100.53 returns SERVFAIL for the A record query, indicating a misconfiguration or missing record on that server. Although reordering (Option C) would allow resolution to work by querying the functional server first, it is not the optimal fix because the broken server remains in the list and could still be used if the primary times out or for future queries. The best practice is to completely remove the faulty server using 'no ip name-server 198.51.100.53'.

Option B adds a static entry that only helps one domain and does not address the root cause. Option D would make the router use only the broken server, worsening the problem.

Exam trap

Do not confuse a reachable DNS server with a functional one. SERVFAIL means the server is responding but cannot resolve the query. The solution is to remove the faulty server, not reorder or add static entries.

Why the other options are wrong

C

Reordering the name servers works around the issue temporarily but leaves the faulty server in the configuration, which is not a permanent solution and violates best practice of removing misconfigured DNS servers.

Why candidates pick the wrong answer

B

Candidates might think that adding a static entry is a quick fix for resolution failures, but this does not address the root cause and would not help with other domain queries.

C

Candidates may think that making the working server primary will solve the issue, but they overlook that the router still tries the faulty server first and may not fall back if the response is an error.

D

Candidates might misinterpret the diagnostic output and think the faulty server is the correct one to keep, but this would cause complete resolution failure.

803
MCQeasy

A small office wants branch routers to automatically hand out IP addresses, default gateway values, and DNS servers to clients. Which service should be configured?

A.DNS
B.DHCP
C.NTP
D.TACACS+
AnswerB

DHCP automatically assigns IP addresses, subnet masks, default gateways, DNS servers, and other network parameters from a defined scope. This eliminates the need for manual static configuration, ensuring that each client receives valid, non-conflicting addressing. In a small office, the branch router can act as a DHCP server or BOOTP relay agent to dynamically hand out IPs to hosts.

Why this answer

DHCP is built for this exact job. It centrally provides addressing details so endpoints do not need to be configured by hand.

Exam trap

A common exam trap is confusing DHCP with other network services like DNS, NTP, or TACACS+. DNS only resolves domain names to IP addresses and does not assign IP addresses or default gateways. NTP synchronizes time across devices but does not handle IP addressing.

TACACS+ is an AAA protocol used for authentication and authorization, not for assigning IP addresses or network parameters. Selecting any of these instead of DHCP leads to incorrect answers because they do not fulfill the requirement of automatically handing out IP addresses and related network configuration to clients.

Why the other options are wrong

A

DNS resolves domain names to IP addresses but does not assign IP addresses, default gateways, or DNS server settings to clients. It is not responsible for automatic IP configuration, so it is incorrect for this question.

C

NTP synchronizes time across network devices and does not provide IP addressing or network configuration parameters to clients, making it irrelevant for this question.

D

TACACS+ is an AAA protocol used for authentication, authorization, and accounting. It does not handle IP address assignment or network parameter distribution, so it is not the correct service here.

When would these options actually be correct?

A

If the question asked about a service that resolves domain names for clients in a network, such as 'Which service translates domain names into IP addresses for client devices?', then DNS would be the correct answer.

C

In a scenario where the question asks about synchronizing time across devices in a network, such as ensuring that all routers and servers have the same time for logging and security purposes, NTP would be the correct answer.

D

If the question asked about securing access to network devices and managing user permissions, then TACACS+ would be the correct answer. For example, a scenario might involve configuring user access controls for routers and switches in a corporate environment.

Why candidates pick the wrong answer

A

Candidates may confuse DNS with DHCP due to their roles in network configuration, thinking that both are involved in providing necessary information to clients, leading them to mistakenly select DNS.

C

Candidates may confuse NTP with DHCP due to both being essential network services, leading them to mistakenly believe that NTP could also handle IP address assignment tasks.

D

Candidates might confuse TACACS+ with DHCP due to both being related to network management, leading them to mistakenly believe that TACACS+ could also handle IP address assignment tasks.

804
MCQhard

Two switches are connected using four Gigabit Ethernet interfaces configured as an EtherChannel with LACP. The network administrator notices that only two of the four interfaces are active in the port-channel, and the other two are in a suspended state. Upon further investigation, the administrator finds that the two inactive interfaces correspond to remote interfaces that are configured with the 'on' mode, while the active ones correspond to remote interfaces configured with LACP active/passive. The administrator also verifies that all local interfaces have the same speed, duplex, and VLAN. What is the most likely cause of the suspended interfaces?

A.The interfaces are in err-disabled state due to a spanning-tree loop.
B.The remote switch interfaces corresponding to the suspended local interfaces are configured with the 'on' mode instead of 'active' or 'passive' for LACP.
C.The port-channel interface is shutdown.
D.There is a mismatch in the allowed VLANs on the member interfaces.
AnswerB

When one switch has LACP active/passive and the other has 'on' (static), LACP negotiation fails, and the ports become suspended. Changing the remote switch to 'active' or 'passive' allows LACP to negotiate and bundle the ports.

Why this answer

LACP requires both ends of a link to be configured in either 'active' or 'passive' mode to negotiate an EtherChannel. If some remote interfaces are set to 'on' mode (static EtherChannel), LACP negotiation fails on those links, causing the corresponding local LACP-enabled interfaces to remain in a suspended state. The local switch detects that LACP PDUs are not received on those interfaces and suspends them to prevent misconfiguration.

The other two interfaces with correctly configured remote peers form the EtherChannel successfully.

Exam trap

Cisco often tests the misconception that all interfaces must match in speed, duplex, and VLAN to form an EtherChannel, but the trap here is that the LACP mode mismatch (active/passive vs. on) is the specific cause of suspended interfaces even when other parameters are consistent.

Why the other options are wrong

A

The exhibit shows the ports as suspended, not err-disabled. Spanning-tree loops typically cause err-disable, not suspension.

C

The port-channel is up (U), so it is not shutdown.

D

The scenario explicitly states that all interfaces are configured with the same VLAN, so this is not the cause.

805
Drag & Dropmedium

Drag and drop the following steps into the correct order to describe the router's routing table lookup process for a destination IP address, including the best-path selection logic (longest prefix match, then administrative distance, then metric) and the final forwarding decision.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The router applies longest prefix match first, then administrative distance, then metric, in that order, to select the best path and forward the packet.

Exam trap

Do not confuse the order of tiebreakers: longest prefix match always comes first, then administrative distance, then metric. Many candidates mistakenly swap AD and metric or think metric is compared first.

Why candidates pick the wrong answer

B

Candidates may think AD is more important than prefix length because it determines route preference between different routing protocols.

C

Candidates may confuse the order of tiebreakers, thinking metric is compared first because it is often used within a routing protocol.

D

Candidates may think metric is more granular and thus compared first, but AD is the higher-level tiebreaker.

806
PBQhard

You are connected to R1. The inside network 192.168.1.0/24 must be able to reach the internet via PAT (overload) using the public IP 203.0.113.1 on interface GigabitEthernet0/1. Additionally, a web server at 192.168.1.10 must be reachable from the internet via static NAT to 203.0.113.10. The current configuration is not working. Identify and fix all issues.

Hints

  • Check the ACL for the correct inside network.
  • The PAT command is missing a keyword to enable port address translation.
  • Ensure the 'overload' keyword is present in the ip nat inside source list command.
A.Change ACL 100 to permit 192.168.1.0 0.0.0.255, add 'overload' to the ip nat inside source list command, and verify with 'show ip nat translations'.
B.Change ACL 100 to permit 192.168.1.0 0.0.0.255 and add the 'overload' keyword to the ip nat inside source list command.
C.Add the 'overload' keyword to the ip nat inside source list command and verify with 'show ip nat translations'.
D.Change ACL 100 to permit 192.168.1.0 0.0.0.255 and verify with 'show ip nat translations'.
AnswerA
solution
! R1
conf t
no access-list 100
access-list 100 permit 192.168.1.0 0.0.0.255
ip nat inside source list 100 interface GigabitEthernet0/1 overload
end

Why this answer

The configuration has two issues: (1) ACL 100 permits 192.168.2.0/24 instead of 192.168.1.0/24, so the inside traffic is not matched for PAT. (2) The 'ip nat inside source list' command lacks the 'overload' keyword, preventing port address translation. The static NAT entry for the web server is correctly configured and does not depend on the ACL; it will work once the ACL is fixed. To resolve: change ACL 100 to permit 192.168.1.0 0.0.0.255, add 'overload' to the ip nat inside source list command, and verify with 'show ip nat translations'.

Exam trap

Candidates often overlook that the ACL must match the inside network exactly, and that 'overload' is required for PAT. Additionally, they may forget to verify with 'show ip nat translations' to confirm the configuration is working.

Why the other options are wrong

B

The answer fails to include the verification step, which is a critical part of troubleshooting and ensuring the configuration is applied correctly.

C

The ACL must match the correct inside network; without fixing it, PAT will not apply to the intended traffic.

D

The 'overload' keyword is essential for PAT; omitting it means the router will perform dynamic NAT without port translation, which is insufficient for multiple hosts.

Why candidates pick the wrong answer

B

Candidates might think only the configuration changes are needed, overlooking the importance of verifying with 'show ip nat translations'.

C

Candidates might focus only on the missing 'overload' keyword and forget that the ACL is also misconfigured.

D

Candidates might think fixing the ACL is enough, not realizing that PAT requires the 'overload' keyword.

807
PBQmedium

You are connected to SW1 via console. SW1 is a Layer 2 switch connected to two other switches (SW2 and SW3) via trunk links. The network administrator wants to ensure that SW1 becomes the root bridge for VLAN 10 and VLAN 20. Currently, SW2 is the root for both VLANs. Configure SW1 to become the root bridge for these VLANs using the Cisco-recommended macro STP commands.

Network Topology
trunktrunkSW2SW1SW3

Hints

  • Use the 'root primary' macro to set the bridge priority to 24576.
  • Ensure VLANs 10 and 20 exist on SW1.
A.spanning-tree vlan 10 root primary; spanning-tree vlan 20 root primary
B.spanning-tree vlan 10 root secondary; spanning-tree vlan 20 root secondary
C.spanning-tree vlan 10 priority 4096; spanning-tree vlan 20 priority 4096
D.spanning-tree vlan 10 root; spanning-tree vlan 20 root
AnswerA
solution
! SW1
spanning-tree vlan 10 root primary
spanning-tree vlan 20 root primary

Why this answer

The 'spanning-tree vlan <vlan> root primary' command is the Cisco-recommended macro that sets the bridge priority to 24576, which is lower than the default 32768, making SW1 the root bridge for those VLANs. Option A correctly uses this macro. Option C, while it could achieve the same goal by setting priority to 4096, is not the macro command and would be considered a static configuration; the question specifically asks for the appropriate macro commands.

Option B sets priority to 28672 as a secondary root, and Option D is invalid syntax.

Exam trap

Do not confuse 'root primary' with 'root secondary'. 'root primary' sets priority to 24576 to become root; 'root secondary' sets priority to 28672 to act as backup. Also, remember that the 'root' keyword must be followed by 'primary' or 'secondary'.

Why the other options are wrong

B

Option B uses 'root secondary', which sets the priority to 28672, making SW1 a backup root, not the primary root bridge.

C

Option C uses a static priority assignment of 4096, which would also make SW1 root, but the question expects the Cisco-recommended macro command 'root primary'.

D

Option D uses incomplete syntax 'spanning-tree vlan 10 root' without 'primary' or 'secondary', which is invalid.

Why candidates pick the wrong answer

B

Candidates may confuse 'root primary' and 'root secondary', thinking 'secondary' is needed to become the root, or they may misremember the command syntax.

C

Candidates might think manually setting a very low priority is the best way, but the 'root primary' command is the recommended and simpler approach.

D

Candidates may abbreviate or forget the full syntax, assuming 'root' alone is sufficient to make the switch root.

808
MCQhard

A router has a connected route to 192.168.1.0/24 and also has a default route. Which route is used for traffic to 192.168.1.55?

A.The connected route to 192.168.1.0/24
B.The default route
C.Both routes equally
D.Neither route
AnswerA

This is correct because the destination falls within the directly connected subnet.

Why this answer

The connected route is used because it is both directly attached and more specific than the default route. In plain language, the router already knows that the destination belongs to one of its local interface networks, so it has no reason to send that traffic to a fallback route.

This is one of the most basic route-selection behaviors. Default routes matter only when no better match exists. Here, a directly connected, exact matching network is already present.

Exam trap

A common exam trap is assuming that the default route will be used for all traffic not explicitly configured, including traffic destined for directly connected subnets. Candidates may mistakenly select the default route because it appears as a fallback path, ignoring that connected routes always take precedence due to their specificity and administrative distance. Another trap is thinking that both routes could be used simultaneously or load-balanced, which is incorrect because the router selects only the best matching route based on prefix length and administrative distance.

Why the other options are wrong

B

Incorrect. The default route is less specific and only used when no matching connected or static route exists. Since a connected route matches, the default route is ignored.

C

Incorrect. The router does not load-balance equally between a connected route and a default route. It selects the single best route based on prefix length and administrative distance.

D

Incorrect. The router clearly has a matching connected route for the destination subnet, so it will use that route rather than discarding the traffic.

When would these options actually be correct?

B

If the question stated that the router had no connected routes and only a default route configured, then the default route would be used for any traffic, including to 192.168.1.55. This would make option B the correct answer.

C

In a different scenario where a router has two equal-length routes to the same destination, such as two connected routes to 192.168.1.0/24 and 192.168.1.0/24 with different interfaces, the router might use both routes equally for load balancing, making this option correct.

D

This option would be correct in a scenario where the router has no valid routes for the destination IP address, such as when the connected route is down or misconfigured, and the default route is not set up to handle that specific traffic.

Why candidates pick the wrong answer

B

Candidates may choose this option if they misunderstand the concept of routing priorities, thinking that the default route is always used for all traffic unless specified otherwise, leading them to overlook the specificity of connected routes.

C

Candidates may choose this option due to a misunderstanding of routing priorities, believing that multiple routes can be used simultaneously without considering the specificity of the routes.

D

Candidates may choose this option due to a misunderstanding of routing priorities, mistakenly believing that a default route would be used even when a more specific connected route exists.

809
Drag & Dropmedium

Drag and drop the following steps into the correct order to install a new fiber optic link between two switches, including SFP insertion and basic troubleshooting.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

The correct installation order follows best practice: insert the SFP and connect the cable on one switch before moving to the other. This minimizes the time the SFP module is exposed and prevents potential damage. Option A is the only correct sequence.

Option B exposes both SFPs before cabling, increasing risk of contamination. Option C attempts to connect cables before inserting SFPs, which is impractical and can cause damage. Option D verifies link on Switch A before the other end is connected, which will show a down state and is not a valid step sequence.

Exam trap

The exam trap is that candidates may think it is acceptable to insert both SFPs first or to verify the link on one switch before the other end is connected. Remember that fiber optic installation requires careful handling: insert SFP, then cable, and only verify after both ends are complete.

Why candidates pick the wrong answer

B

Candidates might think it is more efficient to insert both SFPs first before connecting cables, but this overlooks best practices for fiber optic handling.

C

Candidates might think that connecting the cable to the SFP first is easier, but they forget that the SFP is designed to be inserted into the switch before cabling.

D

Candidates might think it is good to verify each step, but they misunderstand that the link cannot be established until both ends are connected.

810
PBQhard

You are connected to a multilayer switch MLS1. Configure Root Guard on switchport GigabitEthernet 0/1 (connected to an unauthorized switch) so that if a superior BPDU is received, the port is blocked instead of causing a topology change. Also enable Loop Guard on uplink GigabitEthernet 0/2 (connected to the root bridge) to prevent unidirectional link issues. Finally, enable BPDU Guard on PortFast-enabled access port GigabitEthernet 0/3 (connected to a host) so that if a BPDU is received, the port goes err-disabled. After configuration, a superior BPDU is received on G0/1 and the port is blocked; a BPDU is received on G0/3 and the port goes err-disabled. Verify these protections are active.

Hints

  • Root Guard is configured per interface under interface configuration mode using 'spanning-tree guard root'.
  • Loop Guard is configured per interface using 'spanning-tree guard loop'.
  • BPDU Guard is enabled on PortFast ports with 'spanning-tree bpduguard enable'.
A.Root Guard on G0/1, Loop Guard on G0/2, BPDU Guard on G0/3
B.Root Guard on G0/1, UplinkFast on G0/2, BPDU Guard on G0/3
C.BPDU Guard on G0/1, Loop Guard on G0/2, Root Guard on G0/3
D.Root Guard on G0/1, Loop Guard on G0/2, PortFast on G0/3
AnswerA
solution
! MLS1
interface GigabitEthernet0/1
spanning-tree guard root
interface GigabitEthernet0/2
spanning-tree guard loop
interface GigabitEthernet0/3
spanning-tree portfast
spanning-tree bpduguard enable

Why this answer

Root Guard was correctly configured on G0/1, so when a superior BPDU arrived, the port entered root-inconsistent state instead of becoming root port. Loop Guard on G0/2 prevents alternate port from becoming root if BPDUs stop. BPDU Guard on G0/3 correctly triggered err-disable upon receiving a BPDU on a PortFast port.

To restore G0/3, use 'shutdown' then 'no shutdown' after removing the BPDU source. Verification commands confirm the protections are working.

Exam trap

Trap: Mixing up which protection goes where. Root Guard is for ports that should never become root (e.g., facing unauthorized switches). Loop Guard is for ports that are alternate or root ports (uplinks).

BPDU Guard is for PortFast-enabled access ports. Also, remember that BPDU Guard triggers err-disable, while Root Guard triggers root-inconsistent (blocking) state.

Why the other options are wrong

B

UplinkFast is not designed to detect or prevent unidirectional links; it only accelerates failover.

C

The protections are applied to the wrong ports: BPDU Guard should be on access ports, Root Guard on ports facing potential rogue switches, and Loop Guard on uplinks.

D

PortFast does not prevent BPDU reception; it only skips the listening and learning states. Without BPDU Guard, the port would still process BPDUs and could become a root port.

Why candidates pick the wrong answer

B

Candidates may confuse UplinkFast with Loop Guard because both are STP enhancement features, but they serve different purposes.

C

Candidates may know the features but misapply them to the wrong interfaces due to confusion about where each protection is appropriate.

D

Candidates may think PortFast is sufficient for access ports, but it must be paired with BPDU Guard to provide security against rogue switches.

811
Drag & Dropmedium

Drag and drop the following steps into the correct order to troubleshoot and resolve excessive interface errors caused by a duplex mismatch on a Cisco switch interface.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order starts with identifying symptoms using show interfaces to see error counters like CRC and late collisions. Next, check the local interface speed and duplex with show interfaces status. Then discover the neighbor's speed and duplex, for instance via show cdp neighbors detail, to confirm a mismatch.

After identifying the mismatch, configure the interface with the correct settings (e.g., speed and duplex commands). Finally, verify the resolution by running show interfaces again to ensure errors are no longer incrementing.

812
PBQeasy

You are connected to SW1 via the console. SW1 is a Layer 2 switch connected to multiple PCs. The network administrator wants to implement port security on port G0/1 to allow only one MAC address and to shut down the port if a violation occurs. Additionally, the administrator wants the MAC address to be learned dynamically and added to the running configuration as sticky. Configure port security on G0/1 accordingly.

Network Topology
G0/1PC1SW1

Hints

  • Port security must be enabled on the interface first.
  • Sticky MAC automatically adds learned MAC addresses to the running config.
  • The violation mode 'shutdown' places the port in err-disabled state.
A.SW1(config)# interface G0/1 SW1(config-if)# switchport port-security SW1(config-if)# switchport port-security maximum 1 SW1(config-if)# switchport port-security mac-address sticky SW1(config-if)# switchport port-security violation shutdown
B.SW1(config)# interface G0/1 SW1(config-if)# switchport port-security SW1(config-if)# switchport port-security maximum 1 SW1(config-if)# switchport port-security mac-address sticky SW1(config-if)# switchport port-security violation protect
C.SW1(config)# interface G0/1 SW1(config-if)# switchport port-security SW1(config-if)# switchport port-security maximum 1 SW1(config-if)# switchport port-security mac-address 0000.1111.2222 SW1(config-if)# switchport port-security violation shutdown
D.SW1(config)# interface G0/1 SW1(config-if)# switchport port-security SW1(config-if)# switchport port-security maximum 1 SW1(config-if)# switchport port-security mac-address sticky SW1(config-if)# switchport port-security violation restrict
AnswerA
solution
! SW1
interface GigabitEthernet0/1
switchport port-security
switchport port-security maximum 1
switchport port-security violation shutdown
switchport port-security mac-address sticky

Why this answer

Port security restricts access by limiting MAC addresses. With sticky learning, the first dynamically learned MAC is saved to the config. If another MAC attempts to connect, the port shuts down, preventing unauthorized access.

Exam trap

Pay close attention to the specific violation modes: 'shutdown' disables the port, 'restrict' drops frames and logs, 'protect' drops frames silently. Also, distinguish between static MAC assignment and sticky learning: sticky uses the 'mac-address sticky' command, not a manual MAC address.

Why the other options are wrong

B

The violation mode 'protect' silently drops frames from unknown MACs without disabling the port, which contradicts the requirement to shut down the port.

C

The 'mac-address' command with a specific address statically assigns that MAC, which is not dynamic. Sticky learning uses the 'mac-address sticky' command to dynamically learn and save the first MAC.

D

The 'restrict' mode does not disable the port; it only drops offending frames and logs the violation. The requirement explicitly states to shut down the port, which requires the 'shutdown' violation mode.

Why candidates pick the wrong answer

B

Candidates may confuse the violation modes or think 'protect' is sufficient because it blocks unauthorized traffic, but they overlook the specific requirement to shut down the port.

C

Candidates might think that manually entering a MAC address is acceptable, but the requirement explicitly asks for dynamic learning with sticky. Also, they may not know the difference between static and sticky MAC addresses.

D

Candidates may think 'restrict' is more secure than 'protect' because it logs violations, but they miss the specific requirement to shut down the port. Also, 'restrict' is a common violation mode that can be confused with 'shutdown'.

813
PBQhard

You are connected to Switch1. Configure an LACP EtherChannel between Switch1 and Switch2 using interfaces GigabitEthernet0/1 and GigabitEthernet0/2. The channel must be in active mode on both sides, and the port-channel interface must have VLAN 10 as the access VLAN. The current configuration has a speed/duplex mismatch and inconsistent VLAN assignments preventing the channel from forming. Verify the channel is up using 'show etherchannel summary'.

Network Topology
Gi0/1Gi0/1EtherChannelSwitch1Switch2

Hints

  • Check that all member interfaces have the same speed and duplex settings.
  • Ensure all interfaces (including the port-channel) are in the same VLAN.
  • Both sides must use LACP active mode for the channel to form.
A.Set speed auto on Gi0/1 and Gi0/2, set duplex auto on both, change access VLAN on Gi0/2 to 10, change access VLAN on Port-channel1 to 10, and set channel-group mode active on both interfaces.
B.Set speed 1000 on Gi0/1, set duplex full on Gi0/1, change access VLAN on Gi0/1 to 20, change access VLAN on Port-channel1 to 20, and set channel-group mode passive on both interfaces.
C.Set speed 100 on Gi0/2, set duplex half on Gi0/2, change access VLAN on Gi0/1 to 20, change access VLAN on Port-channel1 to 20, and set channel-group mode desirable on both interfaces.
D.Set speed auto on Gi0/1 and Gi0/2, set duplex auto on both, change access VLAN on Gi0/1 to 10, change access VLAN on Port-channel1 to 10, and set channel-group mode active on Gi0/1 and passive on Gi0/2.
AnswerA
solution
! Switch1
interface gigabitethernet0/1
speed auto
duplex auto
channel-group 1 mode active
exit
interface gigabitethernet0/2
speed auto
duplex auto
switchport access vlan 10
channel-group 1 mode active
exit
interface port-channel 1
switchport access vlan 10
end

Why this answer

The EtherChannel is not forming due to three issues: (1) Speed mismatch: Gi0/1 is set to 100 Mbps while Gi0/2 is 1000 Mbps; both must match (e.g., auto). (2) Duplex mismatch: Gi0/1 is half-duplex, Gi0/2 is full-duplex; both must be the same (e.g., full). (3) VLAN mismatch: Gi0/1 is in VLAN 10, Gi0/2 in VLAN 20, and Port-channel1 is in VLAN 1; all access VLANs must be consistent (set to VLAN 10). Additionally, the channel-group mode should be 'active' on both interfaces for LACP. The solution involves setting speed and duplex to auto, changing the access VLAN on Gi0/2 and the port-channel to VLAN 10, and setting channel-group mode to active.

Exam trap

The exam trap here is that candidates may focus only on resolving the speed/duplex and VLAN mismatches but forget to check the LACP mode requirement. Also, they might confuse LACP modes (active/passive) with PAgP modes (desirable/auto). Always verify that the mode matches the protocol and the requirement.

Why the other options are wrong

B

The specific factual error: passive mode on both sides will not form an LACP EtherChannel because neither side initiates negotiation; at least one side must be active.

C

The specific factual error: 'desirable' is a PAgP mode; LACP uses 'active' or 'passive'. Using 'desirable' would not form an LACP EtherChannel.

D

The specific factual error: the requirement explicitly states 'active mode on both sides', so setting one side to passive violates the requirement, even though the channel might still form.

Why candidates pick the wrong answer

B

Candidates pick this because they know speed/duplex must match but may incorrectly assume forcing a specific speed is acceptable, and they may confuse passive with active mode.

C

Candidates pick this because they may confuse PAgP and LACP modes, or think 'desirable' is a valid LACP mode. Also, they might think matching to the slower speed is acceptable.

D

Candidates pick this because they know that an active/passive combination works for LACP, but they overlook the explicit requirement for both sides to be active.

814
MCQhard

Refer to the exhibit. A network administrator is troubleshooting an NTP synchronization issue on R1. The router is configured with the command ntp server 10.1.1.100, but the clock remains unsynchronized. The administrator issues the show ntp status command. What is the most likely cause of the problem?

A.The NTP authentication key configured on R1 does not match the one on the server.
B.The system time on R1 is set to an epoch that is too far from the server's time, causing NTP to refuse to synchronize.
C.The NTP service is not enabled on R1; the 'ntp server' command only defines a server but does not start the NTP process.
D.The router cannot reach the NTP server 10.1.1.100 at UDP port 123 due to a routing issue or an access list.
AnswerD

The exhibit clearly shows 'no reference clock' and stratum 16, which indicates that R1 has not received any NTP packets from the configured server. This is a classic symptom of network unreachability—the router’s NTP requests are not making it to the server or responses are not coming back, often caused by a missing route or an ACL filtering UDP 123.

Why this answer

The `show ntp status` output would show the clock as unsynchronized if R1 cannot communicate with the NTP server at 10.1.1.100. NTP uses UDP port 123, and a routing issue or an access list blocking this port would prevent the exchange of NTP packets, leaving the clock unsynchronized. The `ntp server` command configures R1 as a client to request synchronization, but it does not guarantee reachability.

Exam trap

Cisco often tests the misconception that the `ntp server` command alone is insufficient and that an additional 'ntp enable' command is needed, but in reality, the client process is automatically started by the `ntp server` command.

Why the other options are wrong

A

Candidates often confuse unsynchronized status with authentication issues, but authentication failures do not prevent reception of packets; they just discard them after arrival.

B

A common myth is that NTP cannot sync if the clocks are too far apart. While extreme offsets may delay sync, they do not prevent the router from hearing the server, so the reference clock field would still show the server’s IP or clock ID.

C

Some candidates mistakenly believe that a separate 'ntp enable' command is required. In IOS, configuring an ntp server automatically enables NTP, so the service is active.

815
PBQhard

You are connected to R1 via console. R1 is directly connected to R2 over a 1000BASE-T link that is failing to come up. Configure interface GigabitEthernet0/0 on R1 with the correct speed and duplex settings to match R2's configuration, and then verify the link is operational. Additionally, determine the appropriate SFP type for a new 40 km fiber link between R1 and R2.

Network Topology
G0/010.0.0.1/30G0/010.0.0.2/30linkR1R2

Hints

  • Check R2's running config to see if speed and duplex are manually set.
  • Auto-negotiation failure can occur when one side is set to auto and the other to fixed settings.
  • For distances over 10 km on fiber, you typically need a 1000BASE-ZX SFP.
A.Configure interface GigabitEthernet0/0 with 'speed 1000' and 'duplex full'. For the new fiber link, use a 1000BASE-ZX SFP.
B.Configure interface GigabitEthernet0/0 with 'speed auto' and 'duplex auto'. For the new fiber link, use a 1000BASE-SX SFP.
C.Configure interface GigabitEthernet0/0 with 'speed 1000' and 'duplex half'. For the new fiber link, use a 1000BASE-LX SFP.
D.Configure interface GigabitEthernet0/0 with 'speed 100' and 'duplex full'. For the new fiber link, use a 1000BASE-EX SFP.
AnswerA
solution
! R1
interface GigabitEthernet0/0
speed 1000
duplex full

Why this answer

The link is down because R1 is set to auto-negotiate speed and duplex while R2 is hardcoded to 1000 Mbps full duplex. This mismatch causes the link to fail. To fix, configure R1's GigabitEthernet0/0 with 'speed 1000' and 'duplex full'.

For the new 40 km fiber link, a 1000BASE-ZX SFP is required as it supports distances up to 70 km. (1000BASE-LX supports only up to 10 km and is insufficient for 40 km.) Verify with 'show interfaces GigabitEthernet0/0' to see the link state change to up/up.

Exam trap

Do not assume auto-negotiation always works; when one side is hardcoded, the other must match. Also, know the distance limitations of SFP types: SX (short), LX (long, 10 km), ZX (extended, 70 km).

Why the other options are wrong

B

Auto-negotiation cannot match a hardcoded speed/duplex; 1000BASE-SX is for short distances (up to 550 m).

C

Gigabit Ethernet does not support half duplex; 1000BASE-LX maximum distance is 10 km.

D

Speed mismatch (100 vs 1000) will cause link failure; 1000BASE-EX is not an IEEE standard (ZX is used for extended reach).

Why candidates pick the wrong answer

B

Candidates may think auto-negotiation is always best and confuse SX (short) with long-range SFPs.

C

Candidates may think half duplex is acceptable or that LX can be extended beyond its standard range.

D

Candidates may confuse EX with extended reach or think a lower speed might work.

816
MCQmedium

Which security concept gives a user only the permissions required to perform assigned tasks and nothing more?

A.Defense in depth
B.Least privilege
C.Segmentation
D.Availability
AnswerB

Correct. Users receive only the access they need.

Why this answer

Least privilege is the security principle that grants users only the specific permissions necessary to perform their job functions, minimizing potential damage from errors or malicious actions. Defense in depth is a layered security strategy using multiple controls, not a principle of limiting permissions. Segmentation divides a network into isolated segments to contain threats, but does not directly govern individual user permissions.

Availability ensures systems and data are accessible when needed, which is unrelated to restricting access rights.

Exam trap

Don't confuse access control methods like RBAC, DAC, or MAC with the principle of least privilege, which specifically minimizes permissions.

Why the other options are wrong

A

Defense in depth refers to a layered security approach that employs multiple security measures to protect information. It does not specifically address the principle of granting users only the necessary permissions for their tasks.

C

Segmentation refers to dividing a network into segments to enhance security and manageability, rather than limiting user permissions. It does not directly address the concept of granting only necessary permissions to users.

D

Availability refers to ensuring that systems and data are accessible when needed, which does not relate to limiting user permissions for task completion. This option does not address the principle of restricting access based on necessity.

When would these options actually be correct?

A

If the exam question asked about a comprehensive security strategy that includes various protective measures, such as firewalls, intrusion detection systems, and access controls, then 'Defense in depth' would be the correct answer, as it emphasizes multiple layers of security.

C

If the question asked about a security strategy that involves isolating different parts of a network to limit access and reduce risk, then segmentation would be the correct answer. For instance, a question might focus on methods to prevent lateral movement in a network breach.

D

If the question were to ask about the primary goal of a security framework designed to ensure that systems remain operational and accessible to authorized users, 'Availability' would be the correct answer. For example, a question might ask about the key objectives of the CIA triad, where availability is one of the core principles.

Why candidates pick the wrong answer

A

Candidates may choose this option because they recognize that a robust security posture involves multiple strategies, leading them to mistakenly associate defense in depth with the principle of least privilege.

C

Candidates may confuse segmentation with the principle of least privilege, as both aim to enhance security; however, segmentation focuses on network structure rather than user permissions, leading to misconceptions.

D

Candidates may confuse availability with access control concepts due to their overlapping roles in security. The term 'availability' might seem relevant when considering user permissions, leading to an incorrect assumption that it relates to limiting access.

817
PBQhard

You are managing a Cisco WLC (192.168.1.10) via its web UI. The wireless network 'CorpSecure' has been configured but clients cannot associate. Some report 'wrong password' errors; others see the SSID but fail to connect. Additionally, management access to the WLC web UI is intermittent. Identify and resolve the issues so that wireless clients can successfully associate with 'CorpSecure' using WPA3-Personal and the WLC web UI is reliably accessible from the management VLAN (VLAN 10).

Hints

  • Check the security settings on the WLAN; clients expecting WPA3 will fail with WPA2 configured.
  • An SSID that is hidden (Broadcast disabled) may not appear in client scans unless manually entered.
  • Management access issues might be unrelated to the WLAN config; verify the management interface IP and default gateway are correct.
A.Configure the SSID with WPA3-Personal; verify management interface is on VLAN 10 with correct gateway.
B.Change the SSID security to WPA2-PSK and disable SSID broadcast; reset the WLC to factory defaults.
C.Update the WLC firmware to the latest version and change the management VLAN to VLAN 1.
D.Reconfigure the SSID with WPA3-Enterprise and enable SSID broadcast; set the management interface to use DHCP.
AnswerA
solution
! WLC
Navigate to WLANs > Edit CorpSecure > Security > Layer 2 > Select WPA3-Personal (AES) > Apply
Navigate to WLANs > Edit CorpSecure > SSID > Enable Broadcast SSID > Apply

Why this answer

The primary issue is a security mismatch: the SSID is set to WPA2-PSK while clients expect WPA3, causing 'wrong password' errors. Since clients can see the SSID, broadcast is already enabled; the secondary connection failures may be due to incompatible devices, but the correct fix is to change the security to WPA3-Personal (AES). Additionally, verify that the management interface is on VLAN 10 with the correct gateway to ensure reliable WLC web UI access.

Exam trap

Candidates might mistakenly conclude the SSID broadcast is disabled and enable it unnecessarily, overlooking that the visible SSID indicates broadcast is already on, or they might ignore the management VLAN configuration.

Why the other options are wrong

B

The specific factual error: WPA2-PSK is not compatible with clients expecting WPA3-Personal, and hiding the SSID prevents clients from seeing it.

C

The specific factual error: VLAN 1 is the default and often discouraged for management; the issue is not firmware-related but configuration-based.

D

The specific factual error: WPA3-Enterprise is not appropriate without a RADIUS server, and DHCP for management can lead to unreliable access.

Why candidates pick the wrong answer

B

Candidates might think resetting the WLC is a quick fix, or they may confuse WPA2 and WPA3 requirements.

C

Candidates may assume a firmware bug causes intermittent access, or they may think VLAN 1 is always correct for management.

D

Candidates might confuse WPA3-Personal with WPA3-Enterprise, or think DHCP is more reliable than static IP for management.

818
MCQhard

An EtherChannel between two switches is configured for LACP. One switch shows the member interfaces as bundled, while the other shows them as individual interfaces. Which explanation is most likely if both sides are using LACP?

A.The member interface settings do not match closely enough for bundling, even though both sides use LACP.
B.LACP always requires one side to use PAgP as a backup.
C.EtherChannel cannot operate on switch trunks.
D.One switch must disable STP before EtherChannel can form.
AnswerA

LACP negotiation alone does not guarantee bundling; the member interfaces must also share identical physical and logical parameters such as speed, duplex, VLAN membership, native VLAN, and trunk mode. If any of these settings differ, the LACP control plane will detect the mismatch and keep the ports in a standalone state. Thus, even with LACP active on both ends, inconsistent interface configurations prevent the EtherChannel from forming.

Why this answer

The most likely explanation is that some other interface settings do not match, even though both sides are using the same EtherChannel protocol. In practical terms, LACP alone is not enough. The candidate member interfaces also need to agree on characteristics such as speed, duplex, switchport mode, allowed VLANs where relevant, and other channel-related settings. If they do not, one side may treat the links as separate instead of bundling them.

This is a common troubleshooting pattern because it tests whether you know that EtherChannel success depends on more than just the negotiation protocol name.

Exam trap

Don't assume LACP alone ensures bundling; check all interface settings for consistency.

Why the other options are wrong

B

This option is incorrect because LACP (Link Aggregation Control Protocol) does not require PAgP (Port Aggregation Protocol) as a backup; they are separate protocols. LACP can operate independently without needing PAgP on either side of the EtherChannel.

C

This option is incorrect because EtherChannel can indeed operate on switch trunks, allowing multiple VLANs to be carried over a single logical link. The issue in the question pertains to LACP configuration mismatches, not trunking capabilities.

D

This option is incorrect because Spanning Tree Protocol (STP) does not need to be disabled for EtherChannel to form; EtherChannel can operate alongside STP. Disabling STP can lead to network loops and is not a requirement for EtherChannel functionality.

When would these options actually be correct?

B

In a different scenario, a question might state that a switch is configured to use LACP but has a fallback mechanism that defaults to PAgP if LACP fails. In this case, the option would be correct as it describes a situation where LACP requires PAgP as a backup protocol.

C

If a question asked about the limitations of EtherChannel configurations specifically in relation to VLANs and trunking, stating that EtherChannel cannot operate on switch trunks would be correct. For example, if the question specified that both switches were configured as access ports only, this option could be valid.

D

In a different scenario where the question specifies that a network design mandates disabling STP to prevent loops in a specific topology, and the exam asks about prerequisites for EtherChannel formation under those conditions, this option could be correct.

Why candidates pick the wrong answer

B

Candidates may find this option tempting because they might confuse LACP with PAgP, thinking that both protocols can work together or that one is required as a fallback for the other, leading to misconceptions about their operational requirements.

C

Candidates may choose this option due to a common misconception that EtherChannel configurations are incompatible with trunking, leading to confusion about the requirements for successful EtherChannel setups.

D

Candidates might choose this option due to a common misconception that STP must be disabled to allow for EtherChannel, especially if they have encountered configurations where STP issues caused problems in bundled interfaces.

819
Multi-Selectmedium

Which three of the following statements about the routing table lookup process on a Cisco router are true? (Choose three.)

Select 3 answers
A.The router performs a longest prefix match to select the most specific route for a destination IP.
B.If an exact match is found for the destination network, the router will forward the packet regardless of any more specific routes.
C.A default route (0.0.0.0/0) is used only when no other route matches the destination IP.
D.The router does not perform recursive resolution when the next-hop IP address is not directly connected.
E.The router always prefers routes with a higher administrative distance over those with a lower administrative distance.
F.A directly connected route is automatically installed in the routing table when an interface is configured with an IP address and is up/up.
AnswersA, C, F

When a router receives a packet, it examines the destination IP address and searches its routing table for the route with the longest prefix length, meaning the highest number of matching bits in the network portion. This ensures that the most specific route, such as a /24, is chosen over a less specific one, like a /16, even if both entries could theoretically match. The longest prefix match algorithm is fundamental to IP routing because it enables precise path selection in networks with overlapping routes.

Why this answer

The routing table uses longest prefix match (A) to find the most specific route. The default route (C) is used only when no other route matches. Directly connected routes (F) are automatically installed when the interface is up/up.

Option D is incorrect because the router does recursively resolve the next‑hop IP when it is not directly connected.

Exam trap

Cisco often tests the misconception that an exact match overrides a more specific route, but the longest prefix match rule always selects the route with the longest subnet mask, regardless of administrative distance or metric.

Why the other options are wrong

D

When the next-hop IP is not directly connected, the router does recursively resolve the address to determine the outgoing interface.

820
MCQhard

Exhibit: SW2 receives superior BPDUs on both uplinks. One uplink becomes the root port and the other becomes alternate. Which factor is considered first when SW2 chooses the root port?

A.Lowest local interface MAC address
B.Lowest root path cost
C.Highest duplex setting
D.Lowest configured VLAN number
AnswerB

The spanning-tree root port election first compares the cumulative root path cost advertised in each received BPDU. The port with the lowest root path cost to the root bridge is selected as the root port, because it offers the most efficient shortest path toward the root. Only when costs are equal does STP proceed to other tie-breakers such as the sender bridge ID and sender port ID.

Why this answer

STP chooses the best path to the root bridge based first on the lowest root path cost. If the cost ties, it then checks the sender bridge ID and sender port ID as tie-breakers.

Exam trap

Remember that STP prioritizes root path cost first, not bridge or port IDs. Misunderstanding the order of evaluation can lead to incorrect answers.

Why the other options are wrong

A

This option is wrong because the selection of the root port is based on the lowest root path cost, not the local interface MAC address. The MAC address is not a factor in determining the root port in the Spanning Tree Protocol (STP) process.

C

This option is wrong because the selection of the root port in Spanning Tree Protocol (STP) is based on the lowest root path cost, not the duplex settings of the interfaces. Duplex settings do not influence the port selection process in STP.

D

The lowest configured VLAN number is not a factor in determining the root port in Spanning Tree Protocol (STP). The selection process prioritizes path cost, not VLAN configuration.

When would these options actually be correct?

A

In a different question setup where the focus is on determining the primary interface for a device based on MAC addresses (e.g., a scenario involving MAC address-based load balancing), the lowest local interface MAC address could be the correct criterion for selection.

C

In a different question context where the focus is on interface capabilities, such as determining which port to use for data transmission based on performance metrics, the highest duplex setting could be considered. For example, a question might ask which port should be prioritized for traffic if all other factors are equal.

D

In a different scenario where the question asks about VLAN prioritization in a multi-VLAN environment, the lowest configured VLAN number could be relevant. For example, if the question focuses on how VLAN IDs impact traffic flow or STP behavior in a specific VLAN context, this option could be correct.

Why candidates pick the wrong answer

A

Candidates may find this option tempting because they might confuse the MAC address with the criteria used in other networking protocols, leading them to believe it plays a role in STP root port selection.

C

Candidates may find this option tempting because they might confuse physical layer characteristics, such as duplex settings, with logical layer decisions in network protocols, leading to an assumption that performance metrics influence port selection.

D

Candidates may confuse VLAN configuration with STP operations, mistakenly believing that VLAN IDs influence port selection. This confusion can lead them to select this option, thinking it relates to network topology management.

821
MCQhard

Exhibit: R1 has the static route 'ip route 0.0.0.0 0.0.0.0 192.0.2.2 200' and also learns a default route from OSPF. Which default route will be installed while the OSPF route is present?

A.The static default route
B.The OSPF default route
C.Both default routes with per-packet load balancing
D.Neither route because floating statics suppress dynamic defaults
AnswerB

The OSPF default route is the preferred route because it has a lower administrative distance (110) than the floating static default route, which is configured with a higher AD (e.g., 200) to serve as a backup. OSPF injects the default via 'default-information originate', and the routing table installs only the OSPF route for 0.0.0.0/0. The static route remains in the configuration but is not used until the OSPF route disappears.

Why this answer

The OSPF external default route wins because its administrative distance is 110, which is lower than the floating static route's distance of 200. The static route is intentionally given a higher AD so it is used only as a backup.

Exam trap

A common exam trap is assuming that static routes always override dynamic routes because static routes have a default administrative distance of 1. However, in this question, the static route is configured with an administrative distance of 200, making it less preferred than the OSPF route with an AD of 110. This floating static route is intended as a backup and will not be installed while the OSPF route is present.

Misreading the static route’s AD or ignoring it leads to the incorrect conclusion that the static route will be used, which is a frequent mistake in CCNA routing questions.

Why the other options are wrong

A

The static default route has an administrative distance of 200, which is higher than OSPF’s 110. Therefore, it is less preferred and will not be installed while the OSPF route is present, making this option incorrect.

C

Cisco routers do not perform per-packet load balancing between routes with different administrative distances. The route with the lowest AD is installed exclusively, so this option is incorrect.

D

Floating static routes do not suppress dynamic routes; instead, they serve as backups when dynamic routes are unavailable. Therefore, neither route is not installed is incorrect because the OSPF route will be installed.

When would these options actually be correct?

A

In a different scenario where the OSPF route is not present or is down, the static default route would be the only available route to the default gateway, making it the correct answer for a question asking which default route would be installed.

C

In a different scenario where both routes have the same administrative distance, such as if the static route's distance is changed to match that of OSPF, the router could perform per-packet load balancing between the two default routes.

D

In a different scenario where the static route has an administrative distance lower than the OSPF route (e.g., 110), the static route would take precedence. The question could specify that the static route is configured with a lower administrative distance than the OSPF route, making this option correct.

Why candidates pick the wrong answer

A

Candidates may choose this option because they might overlook the administrative distance concept, mistakenly believing that static routes always take precedence over dynamic routes regardless of the routing protocol's state.

C

Candidates may choose this option due to a misunderstanding of how routing protocols interact, leading them to believe that multiple default routes can be utilized simultaneously for load balancing.

D

Candidates may find this option tempting because they might confuse the concept of administrative distances and assume that static routes always take precedence over dynamic routes without considering their specific values.

822
Matchingmedium

Match each automation transport or interaction term to its most accurate description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Encrypted transport commonly used for API communication

Architectural style often using HTTP methods

Structured data format commonly used in API payloads

Credential-like value often used to control API access

Why these pairings

Options A and B are correct. RESTCONF is a stateless, HTTP-based protocol that supports both XML and JSON encoding. NETCONF is a stateful, RPC-based protocol that uses XML encoding and operates over SSH or TLS.

Option C is incorrect because gRPC is an RPC framework that can support both stateless and stateful interactions, but it is not stateless; it uses HTTP/2 and Protocol Buffers. Option D is incorrect because SSH is a stateful protocol that establishes an encrypted session for secure remote access and file transfers.

Exam trap

Be careful not to confuse RESTCONF (stateless) with NETCONF (stateful). Also, remember that gRPC and SSH are stateful protocols.

When would these options actually be correct?

C

A question asking: 'Which protocol uses HTTP/2 and Protocol Buffers for efficient, high-performance remote procedure calls?' would make gRPC the correct answer.

D

In a question asking 'Which protocol provides encrypted remote CLI access to network devices and supports secure file transfer using SCP or SFTP?', SSH would be the correct answer.

Why candidates pick the wrong answer

C

Candidates may confuse gRPC's use of HTTP/2 with HTTP-based REST protocols, or mistakenly think gRPC is stateless due to its high-performance design, overlooking its support for stateful streams.

D

Candidates may confuse SSH's secure shell capabilities with automation transports, or mistakenly think SSH is stateless because it can be used for quick commands, overlooking its session-based stateful nature.

823
MCQhard

R1 and R2 should form an OSPF adjacency on their shared GigabitEthernet link, but they remain stuck in EXSTART. What is the most likely cause?

A.The routers are using different OSPF areas.
B.The interface MTU values do not match.
C.One side is configured as passive-interface.
D.The subnet mask on the link is incorrect.
AnswerB

A mismatch in interface MTU is the classic cause of OSPF neighbors becoming stuck in EXSTART or EXCHANGE. During the Database Description (DBD) packet exchange, each router includes its MTU in the DBD header; if the receiving router sees a larger MTU than its own, it drops the packet, so the neighbor state never progresses past EXSTART. This correctly explains why the adjacency fails to reach FULL.

Why this answer

The MTU values do not match. OSPF neighbors can discover each other and even move through earlier states, but an MTU mismatch commonly leaves them stuck in EXSTART or EXCHANGE because the routers do not agree on database description packet sizing. Area mismatch, network mismatch, and passive-interface issues usually prevent a much earlier stage of adjacency formation.

Exam trap

A common exam trap is selecting area mismatch or passive-interface as the cause of OSPF adjacency stuck in ExStart. While area mismatch prevents neighbor formation entirely, and passive-interface stops hello packets, these issues cause earlier failures, not ExStart stalls. The ExStart state specifically involves negotiating database description packets, which requires matching MTU values.

Candidates often overlook MTU mismatches because neighbors appear in the topology, misleading them to suspect other configuration errors. Understanding that MTU mismatch allows neighbor discovery but blocks database synchronization is key to avoiding this trap.

Why the other options are wrong

A

Both routers are configured in area 0, so area mismatch is not the cause. Area mismatches prevent neighbor discovery, which would stop adjacency formation before ExStart.

C

If one interface is passive, OSPF hello packets are not sent, preventing neighbor formation altogether. This would stop adjacency formation earlier than ExStart.

D

The subnet mask is consistent on both sides, allowing neighbor discovery. Incorrect subnet masks would prevent neighbors from recognizing each other, blocking adjacency before ExStart.

When would these options actually be correct?

A

In a different scenario where the question specifies that both routers are in the same OSPF area but are unable to establish adjacency, this option would be correct if the routers were configured to use different OSPF area IDs, preventing adjacency formation.

C

In a different scenario, if the question stated that OSPF adjacency was not forming at all and one router was configured with a passive-interface command on the shared link, then this option would be correct as it would directly prevent OSPF from establishing a neighbor relationship.

D

In a different scenario, if the question were about OSPF failing to establish an adjacency due to incorrect IP addressing, including a mismatched subnet mask, this option would be correct. For example, if R1 and R2 were on different subnets, OSPF would not form an adjacency.

Why candidates pick the wrong answer

A

Candidates may choose this option due to a common misconception that OSPF requires routers to be in the same area for adjacency, leading them to overlook other factors like MTU mismatches that can cause EXSTART issues.

C

Candidates might choose this option because they recall that passive-interface settings can disrupt OSPF adjacencies, leading them to mistakenly assume it applies in this situation without considering the specific EXSTART state.

D

Candidates may choose this option because they associate subnet mask issues with general connectivity problems, leading them to believe it could affect OSPF adjacency formation.

824
PBQhard

You are connected to WLC-1 via SSH. A new SSID 'CorpSecure' must be configured for 5 GHz clients using WPA3-Personal. However, after creation, clients can see the SSID but fail to associate. Review the WLC configuration and fix the issue so that clients can successfully associate and obtain an IP address from VLAN 100 (subnet 10.0.100.0/24).

Network Topology
G0/0192.168.1.10/24G0/110.0.0.1/30G0/210.0.100.1/24SwitchManagementWLC-1Upstream RouterClient VLAN 100

Hints

  • Check the current security settings on the WLAN; they are using WPA2, not WPA3.
  • The radio policy is not set — clients may try to connect on 2.4 GHz, but the SSID should be 5 GHz only.
  • Ensure the WLAN is enabled after changes.
A.Change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, set the radio policy to 5 GHz, and ensure the WLAN is mapped to the dynamic interface for VLAN 100.
B.Change the WLAN security to WPA2-Personal, enable TKIP encryption, and set the radio policy to 5 GHz.
C.Change the WLAN security to WPA3-Personal, enable AES-CCMP, but leave the radio policy as 'All' (both 2.4 GHz and 5 GHz).
D.Change the WLAN security to WPA3-Personal, enable AES-CCMP, set the radio policy to 5 GHz, but do not enable the WLAN after changes.
AnswerA
solution
! WLC-1
config wlan security wpa3 1 enable
config wlan security wpa3 psk 1 set ascii CorpSecurePass123
config wlan radio-policy 1 5ghz
config wlan enable 1
config wlan security wpa3 ciphers 1 aes-ccmp

Why this answer

The SSID was configured with WPA2 instead of WPA3. The WLC also had no radio policy set for 5 GHz only. To fix, change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, and set the radio policy to 5 GHz.

Additionally, ensure the WLAN is mapped to the appropriate dynamic interface for VLAN 100, not the management interface, and that client VLAN 100 is reachable. The commands to modify the WLAN are: config wlan security wpa3 1 enable, config wlan security wpa3 psk ascii CorpSecurePass123 1, config wlan radio policy 802.11a-only 1, and config wlan enable 1.

Exam trap

Students often forget to change the radio policy from 'All' to a specific band, or they confuse WPA2 with WPA3. Also, they may overlook enabling the WLAN after configuration. Ensure you understand the specific requirements for WPA3 and the need to match the radio policy to the client band.

Why the other options are wrong

B

The specific factual error is that WPA2-Personal with TKIP does not meet the WPA3-Personal requirement; WPA3 mandates AES-CCMP.

C

The specific factual error is that the radio policy must be set to 5 GHz only, not 'All', to restrict access to 5 GHz clients.

D

The specific factual error is that the WLAN remains disabled, so clients cannot associate even if other settings are correct.

Why candidates pick the wrong answer

B

Candidates might pick this because they are more familiar with WPA2 and may not realize that WPA3 is required, or they confuse TKIP with AES.

C

Candidates might pick this because they think 'All' is acceptable or they forget to change the radio policy, assuming it defaults correctly.

D

Candidates might pick this because they focus only on security and radio settings, forgetting the final step of enabling the WLAN, which is a common oversight.

825
MCQhard

A router shows the following route: O 10.10.40.0/24 [110/20] via 192.0.2.2, 00:00:12, GigabitEthernet0/0 What does the value 110 represent?

A.The OSPF cost to the destination
B.The administrative distance of OSPF
C.The number of hops to the destination
D.The route age in seconds
AnswerB

In OSPF, the first number within the brackets of an IP routing table entry is the administrative distance (AD). For OSPF, this is a fixed default of 110, which represents the protocol's trustworthiness compared to other routing sources. The router uses this value to select the best route when multiple protocols offer paths to the same destination, with lower AD being preferred. Here, the '110' matches OSPF's standard AD, confirming this is the correct interpretation.

Why this answer

In Cisco route output, the value in brackets is [administrative distance/metric].

Exam trap

A frequent exam trap is mistaking the administrative distance value for the OSPF cost or metric. The number 110 in the route output is the administrative distance, not the cost to reach the destination. The OSPF cost is the second number inside the brackets, which in this example is 20.

Confusing these values can lead to incorrect assumptions about route preference and path selection. Remember, administrative distance compares trustworthiness between routing protocols, while the metric determines the best path within a single protocol.

Why the other options are wrong

A

The OSPF cost to the destination is not represented by the first number in brackets; it is the second number. Therefore, 110 cannot be the OSPF cost.

C

The number of hops is not indicated by the value 110. OSPF does not use hop count as its metric, so this option is incorrect.

D

The route age is shown separately after the next-hop IP address and interface, not inside the brackets. Thus, 110 does not represent route age.

When would these options actually be correct?

A

In a question asking about the OSPF cost to a specific destination, where the context is focused on OSPF metrics and path selection, this option could be correct. For example, if the question provided a route with an OSPF cost value instead of an administrative distance, then option A would be valid.

C

In a different question, if it asked for the number of hops in a routing protocol that uses hop count as its metric, such as RIP, and provided a route with a hop count value, then this option would be correct.

D

In a different question, if it asked for the age of a route in a routing table output that specifically included a field for route age, such as 'Route age: 00:00:12,' then the option could be correct if it explicitly stated that the age was represented in seconds.

Why candidates pick the wrong answer

A

Candidates might confuse the administrative distance with OSPF cost due to their close association in routing protocols, leading them to mistakenly select this option when they recall that OSPF uses costs for path metrics.

C

Candidates may confuse the concept of administrative distance with hop count, especially if they have encountered routing protocols that use hops as a metric, leading them to mistakenly select this option.

D

Candidates may find this option tempting because they might confuse route age with the time since the route was last updated, leading them to mistakenly associate the time format with the value 110.

Page 10

Page 11 of 19

Page 12