CCNA Switching and Network Access Practice Question
Which TWO statements accurately describe the use of packet capture tools for troubleshooting Layer 2/3 issues?
⚠ Common exam trap
Cisco often tests the distinction between Layer 2 and Layer 3 troubleshooting by making candidates incorrectly attribute ARP failures to Layer 3 routing issues, when ARP is strictly a Layer 2 protocol used for MAC address resolution within the same subnet.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A packet capture that shows frames with the same source and destination MAC addresses but different 802.1Q VLAN tags indicates a possible trunk misconfiguration.
Frames with identical source and destination MAC addresses but different 802.1Q VLAN tags indicate the same device is reachable on multiple VLANs, which commonly results from a misconfigured trunk (e.g., native VLAN mismatch or inconsistent allowed VLAN lists). Option D is correct because seeing ICMP echo requests leave a router but no echo replies return suggests the reply is blocked or dropped at some intermediate Layer 3 hop, pointing to a routing problem rather than a Layer 2 issue. Option A is wrong: ARP requests without replies point to a Layer 2 problem (e.g., unreachable destination or filtering), not a Layer 3 routing issue. Option C is wrong: ICMP echo requests without replies could have many causes (ACLs, firewalls, routing) – a switching loop would typically generate excessive broadcasts, not just missing replies. Option E is wrong: TCP SYN without SYN-ACK typically indicates a Layer 4 filtering or unreachable server issue, or possibly a Layer 3 routing problem, not a pure Layer 1 physical fault.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A packet capture that shows ARP requests with no ARP replies indicates a Layer 3 routing issue.
Why it's wrong here
ARP operates at Layer 2 (Data Link layer) to resolve IP addresses to MAC addresses within the same broadcast domain. If ARP requests are sent but no ARP replies are received, the issue lies with Layer 2 connectivity—such as a wrong VLAN assignment, a bad cable, or a switch port in the wrong state—not with Layer 3 routing. Routing would only come into play after ARP resolves, so a complete absence of ARP replies indicates the frames cannot be delivered at Layer 2.
- ✓
A packet capture that shows frames with the same source and destination MAC addresses but different 802.1Q VLAN tags indicates a possible trunk misconfiguration.
Why this is correct
Normal trunking behavior requires consistent 802.1Q tags for frames between the same source and destination MAC addresses along a given path. If captures show identical MAC pairs with differing VLAN tags, the switchports are likely mismatched—for example, one side has the VLAN removed from the allowed list, or native VLAN settings are inconsistent. This misconfiguration causes frames to be placed on the wrong VLAN or dropped entirely, leading to connectivity failures and possible inter-VLAN leakage.
- ✗
A packet capture that shows ICMP echo requests but no echo replies confirms a Layer 2 switching loop.
Why it's wrong here
A Layer 2 switching loop is characterized by broadcast storms, duplicate frames, and MAC address table instability, not by unidirectional ICMP traffic. ICMP echo requests with no replies typically point to a Layer 3 problem—such as a missing return route or a firewall dropping the replies—or to a host that is down. Without additional symptoms like high CPU usage or repeated identical frames, a loop is not the correct conclusion.
- ✓
A packet capture that shows ICMP echo requests leaving a router but no echo replies returning suggests a Layer 3 routing problem.
Why this is correct
If ICMP echo requests are successfully forwarded out of a router, the Layer 1 and Layer 2 paths toward the destination are functioning at least up to that point. No returning echo reply indicates the request reached the destination or an intermediate device, but the reply could not be routed back—either because the destination lacks a return route, a reverse path filtering rule is dropping it, or a downstream router is discarding the reply. This is a classic Layer 3 routing and reachability problem.
- ✗
A packet capture that shows TCP SYN packets with no SYN-ACK replies indicates a Layer 1 physical issue.
Why it's wrong here
Layer 1 physical issues completely prevent communication, so TCP SYN packets would not be visible in a capture at all; the link would be down or have excessive errors. Seeing a SYN with no SYN-ACK implies the packet reached a device, but the response is being blocked or ignored—commonly due to an access control list, a firewall rule, or an application that is not listening. These are Layer 4–7 or path-selection issues, not a physical layer fault.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓A packet capture that shows frames with the same source and destination MAC addresses but different 802.1Q VLAN tags indicates a possible trunk misconfiguration.Correct answer▾
Why this is correct
Normal trunking behavior requires consistent 802.1Q tags for frames between the same source and destination MAC addresses along a given path. If captures show identical MAC pairs with differing VLAN tags, the switchports are likely mismatched—for example, one side has the VLAN removed from the allowed list, or native VLAN settings are inconsistent. This misconfiguration causes frames to be placed on the wrong VLAN or dropped entirely, leading to connectivity failures and possible inter-VLAN leakage.
✗A packet capture that shows ARP requests with no ARP replies indicates a Layer 3 routing issue.Wrong answer — click to see why▾
Why this is wrong here
ARP operates at Layer 2 (Data Link layer) and is used to resolve IP addresses to MAC addresses. A lack of ARP replies indicates a Layer 2 connectivity issue, such as a misconfigured VLAN, incorrect cabling, or a switch port problem, not a Layer 3 routing issue.
Why candidates choose this
Students may confuse ARP with routing protocols or think that ARP is part of IP (Layer 3), leading them to incorrectly associate ARP failures with routing problems.
✗A packet capture that shows ICMP echo requests but no echo replies confirms a Layer 2 switching loop.Wrong answer — click to see why▾
Why this is wrong here
ICMP echo requests without replies typically indicate a Layer 3 issue, such as no route back to the source, or a firewall blocking the replies. Layer 2 loops cause broadcast storms, duplicate frames, and MAC address flapping, not a simple lack of ICMP replies.
Why candidates choose this
Students may think that any connectivity issue is due to a loop, especially when they hear 'no replies' and associate it with network problems. However, loops manifest differently in packet captures.
✗A packet capture that shows TCP SYN packets with no SYN-ACK replies indicates a Layer 1 physical issue.Wrong answer — click to see why▾
Why this is wrong here
TCP SYN packets without SYN-ACK replies often indicate a firewall blocking the connection, a service not listening on the destination port, or a Layer 4-7 issue. Layer 1 physical issues would typically result in no packets being received at all, not just missing SYN-ACKs.
Why candidates choose this
Students may assume that any lack of response is due to a physical problem, but TCP handshake failures are more commonly caused by higher-layer issues like access control lists or server configuration.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Interpreting Packet Capture Output for Layer 2/3 Troubleshooting
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
Key term
ICMP
ICMP is a network-layer protocol used by network devices to send error messages and operational information about network connectivity.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.