CCNA Switching and Network Access Practice Question
Which TWO statements correctly describe aspects of interpreting packet capture output for Layer 2/3 troubleshooting using Wireshark or embedded packet capture on IOS-XE?
⚠ Common exam trap
Cisco often tests the distinction between broadcast and unicast in DHCP and ARP operations, and the trap here is that candidates may assume DHCP Discover is unicast to the server or that a SYN-ACK indicates failure, when in fact it confirms reachability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A large number of ARP requests for the same IP address in a packet capture suggests a possible Layer 3 connectivity issue, such as a missing default gateway.
A large number of ARP requests for the same IP address indicates that the device is repeatedly trying to resolve the Layer 3 address to a Layer 2 MAC address, but no device is responding. This often happens when the target IP (e.g., the default gateway) is unreachable or misconfigured, pointing to a Layer 3 connectivity issue. Option D is correct because IOS-XE embedded packet capture supports both ingress and egress capture directions, allowing you to verify whether a router is dropping or modifying packets as they transit. Option A is incorrect: DHCP Discover is broadcast, not unicast, because the client does not yet know the server’s MAC address. Option C is incorrect: a SYN-ACK is part of a successful three-way handshake (SYN, SYN-ACK, ACK) and indicates the server is reachable; if the handshake failed, you would see only SYN packets or RST packets. Option E is incorrect: the TTL value in a captured packet shows the current TTL after decrementing by each hop; the original TTL is not preserved in the packet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A DHCP Discover packet in a Wireshark capture shows a unicast destination MAC address to the DHCP server.
Why it's wrong here
A DHCP Discover is always an L2 broadcast because the client does not yet know the DHCP server's MAC address (or even its IP), so the destination MAC is FF:FF:FF:FF:FF:FF. Sending it unicast would require prior knowledge of the server's MAC, which defeats DHCP's bootstrap purpose. If you see a unicast destination in the DHCP Discover, it is not a valid Discover packet or the capture was taken after the offer/request phase.
- ✓
A large number of ARP requests for the same IP address in a packet capture suggests a possible Layer 3 connectivity issue, such as a missing default gateway.
Why this is correct
Repeated ARP requests for the same target IP mean the host is trying to resolve a next-hop MAC but receives no reply. This frequently occurs when the target is down, a firewall silently drops the traffic, or the host's default gateway is misconfigured/unreachable. Because ARP operates at Layer 2 to find a Layer 3 address, the persistence of unanswered requests points to a connectivity failure at or below the IP layer, making it a useful diagnostic clue.
- ✗
A TCP SYN-ACK packet in a capture indicates that the three-way handshake failed and the destination is unreachable.
Why it's wrong here
A TCP SYN-ACK is the second step of the three-way handshake: the server received the client's SYN and responds with SYN-ACK to agree to the connection. Its presence in a capture proves the destination is reachable and willing to open a session; it does not indicate failure. A handshake failure would instead show repeated SYN retransmissions with no corresponding SYN-ACK, or an RST from the destination.
- ✓
When using embedded packet capture on IOS-XE, you can capture packets on both ingress and egress directions to see if a router is dropping or modifying packets.
Why this is correct
IOS-XE embedded packet capture (EPC) lets you create a capture point that can be attached to an interface in either the ingress or egress direction, or both. By comparing the captured packets before and after routing/forwarding decisions, you can identify whether the router is dropping packets, altering headers, or applying policy. This bidirectional visibility is especially useful for verifying NAT, ACLs, or QoS operations in a live network.
- ✗
The TTL value in a captured IP packet always shows the original TTL set by the source host.
Why it's wrong here
The TTL field in a captured IP packet is the value remaining when the packet was intercepted, not the original value set by the source. Each router along the path decrements TTL by at least 1, so a captured TTL closer to the default (e.g., 128 for Windows, 64 for Linux) indicates fewer hops traveled. If the capture is far from the source, the TTL will be significantly lower, and misinterpreting it can lead to incorrect hop-count or path-length conclusions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓A large number of ARP requests for the same IP address in a packet capture suggests a possible Layer 3 connectivity issue, such as a missing default gateway.Correct answer▾
Why this is correct
Repeated ARP requests for the same target IP mean the host is trying to resolve a next-hop MAC but receives no reply. This frequently occurs when the target is down, a firewall silently drops the traffic, or the host's default gateway is misconfigured/unreachable. Because ARP operates at Layer 2 to find a Layer 3 address, the persistence of unanswered requests points to a connectivity failure at or below the IP layer, making it a useful diagnostic clue.
✗A DHCP Discover packet in a Wireshark capture shows a unicast destination MAC address to the DHCP server.Wrong answer — click to see why▾
Why this is wrong here
DHCP Discover uses broadcast to find a DHCP server; it is never unicast to a specific MAC.
✗A TCP SYN-ACK packet in a capture indicates that the three-way handshake failed and the destination is unreachable.Wrong answer — click to see why▾
Why this is wrong here
A SYN-ACK means the destination is reachable and responding; a failure would show no response or a RST packet.
✗The TTL value in a captured IP packet always shows the original TTL set by the source host.Wrong answer — click to see why▾
Why this is wrong here
The original TTL is set by the source (e.g., 128 for Windows, 64 for Linux), but the captured value reflects the remaining hops after routing.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Interpreting Packet Capture Output for Layer 2/3 Troubleshooting
Key term
MAC
MAC (Media Access Control) is a unique hardware identifier assigned to network interfaces for communication on a local network segment.
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.