CCNA Network Infrastructure and Connectivity Questions — Page 1 of 4

Multi-Selectmedium

Which TWO statements correctly describe interface errors and duplex mismatches on Cisco switches?

Select 2 answers

A.Runts are typically caused by CRC errors on the transmitting device.

B.Late collisions on a half-duplex interface can indicate a duplex mismatch with the connected device.

C.The 'show interfaces' command displays the number of CRC errors and runts on an interface.

D.Full-duplex interfaces use CSMA/CD to detect collisions before transmitting.

E.Auto-MDIX can resolve a duplex mismatch by renegotiating the speed and duplex settings.

AnswersB, C

In half-duplex Ethernet, a late collision occurs after the first 512 bits have been transmitted, meaning the sending station has already finished its collision window. When one device is full-duplex and the other half-duplex, the full-duplex side never defers to traffic, transmitting while the half-duplex side is sending, causing a collision that the half-duplex side detects too late. This timing signature is a classic indicator of a duplex mismatch.

Why this answer

Late collisions occur when a frame is transmitted onto the wire and collides after the first 512 bit-times of the frame. In a half-duplex Ethernet segment, a duplex mismatch causes the full-duplex side to never defer and transmit at any time, while the half-duplex side expects to detect collisions only during the collision window. When the full-duplex device sends a frame while the half-duplex device is already transmitting, the half-duplex device detects a collision after the 512-bit window, resulting in a late collision.

Exam trap

Cisco often tests the distinction between late collisions (which occur after the 64-byte window and indicate a duplex mismatch) and early collisions (which occur within the window and are normal in half-duplex), and candidates mistakenly think that all collisions are normal or that CRC errors are the primary cause of runts.

Why the other options are wrong

Runts result from collisions on half-duplex links or faulty network interface cards, not from CRC errors.

CSMA/CD is only used in half-duplex environments; full-duplex disables collision detection entirely.

Auto-MDIX does not participate in speed or duplex negotiation; that function is handled by auto-negotiation (IEEE 802.3u).

Practice this question →

MCQhard

An interface is configured with 10.24.7.158/27. What is the broadcast address of that subnet?

A.10.24.7.159

B.10.24.7.191

C.10.24.7.127

D.10.24.7.160

AnswerA

The /27 CIDR notation indicates a subnet mask of 255.255.255.224, leaving 5 host bits. This defines subnet blocks of 32 addresses each. For the fourth octet, the given IP address 158 falls within the subnet range starting at 128 (10.24.7.128) and ending at 159 (10.24.7.159). The broadcast address is always the last address in a subnet, where all host bits are set to one. Therefore, 10.24.7.159 correctly identifies the broadcast address for the 10.24.7.158/27 interface.

Why this answer

A /27 uses blocks of 32 addresses. The block containing .158 is 10.24.7.128 through 10.24.7.159, so .159 is the broadcast address.

Exam trap

A frequent exam trap is mistaking the broadcast address for the network address of the next subnet or the last address of a different subnet block. For example, 10.24.7.160 is the network address of the next /27 subnet, not the broadcast address of the current subnet. Candidates often confuse the last usable host address with the broadcast address or select an address from an adjacent subnet block.

This mistake leads to incorrect subnetting answers and can cause interface misconfigurations in real networks, resulting in communication failures.

Why the other options are wrong

Incorrect. 10.24.7.191 is the last address of a larger /26 subnet block, not the /27 block containing 10.24.7.158, so it cannot be the broadcast address here.

Incorrect. 10.24.7.127 is the broadcast address of the previous /27 subnet block (10.24.7.96/27), not the one containing 10.24.7.158.

Incorrect. 10.24.7.160 is the network address of the next /27 subnet block after 10.24.7.128/27, not the broadcast address of the current subnet.

Practice this question →

Multi-Selectmedium

Which three statements about the Spanning Tree Protocol (STP) are true? (Choose three.)

Select 3 answers

.STP uses Bridge Protocol Data Units (BPDUs) to exchange topology information.

.STP elects a root bridge based on the lowest bridge ID.

.STP places redundant ports in blocking state to prevent loops.

.STP always uses the highest port cost to select the root port.

.STP converges instantly after a topology change.

.STP is used to increase the number of broadcast domains.

Why this answer

All three statements are correct because STP relies on Bridge Protocol Data Units (BPDUs) to share topology information between switches, elects a root bridge by comparing bridge IDs (a combination of priority and MAC address, with the lowest value winning), and prevents loops by placing redundant ports into a blocking state (discarding state in Rapid PVST+). These are fundamental behaviors of the 802.1D Spanning Tree Protocol.

Exam trap

Cisco often tests the fact that STP does not use timers to elect the root bridge (it uses bridge ID comparison) and that blocking state is the mechanism for loop prevention, not disabling the port entirely or relying on TCN BPDUs alone.

Practice this question →

Multi-Selectmedium

Which TWO statements correctly compare 802.11ac and 802.11ax features?

Select 2 answers

A.802.11ax uses OFDMA, while 802.11ac uses OFDM.

B.Both 802.11ac and 802.11ax support 1024-QAM modulation.

C.WPA3 is mandatory for 802.11ax and optional for 802.11ac.

D.Both standards use only the 5 GHz band.

E.802.11ac uses 80 MHz channels, while 802.11ax uses 160 MHz channels exclusively.

AnswersA, C

Orthogonal Frequency-Division Multiple Access (OFDMA) is a key 802.11ax feature that subdivides the channel into smaller resource units, allowing multiple clients to transmit concurrently in the same frame. In contrast, 802.11ac relies on Orthogonal Frequency-Division Multiplexing (OFDM), where a single client can use the entire set of subcarriers during its transmission slot. OFDMA reduces contention and overhead in dense networks, and this is the central PHY-layer difference between the two standards.

Why this answer

802.11ax (Wi‑Fi 6) introduces Orthogonal Frequency Division Multiple Access (OFDMA), which allows multiple users to share subcarriers simultaneously, improving efficiency in dense environments. In contrast, 802.11ac (Wi‑Fi 5) uses Orthogonal Frequency Division Multiplexing (OFDM), where each transmission occupies the entire channel for a single user, leading to less efficient channel utilization. Option C is correct: WPA3 is mandatory for Wi‑Fi 6 (802.11ax) certification, while for 802.11ac it is optional—devices can still obtain Wi‑Fi 5 certification with WPA2 only.

Option B is incorrect because 802.11ac supports a maximum of 256‑QAM; 1024‑QAM is first introduced with 802.11ax. Option D is wrong: 802.11ac operates exclusively in the 5 GHz band, but 802.11ax operates in both 2.4 GHz and 5 GHz. Option E is false: both standards support 20, 40, 80, and 160 MHz channel widths; 802.11ac does not exclusively use 80 MHz, and 802.11ax does not use 160 MHz exclusively.

Exam trap

Cisco often tests the misconception that higher QAM values (like 1024-QAM) are backward-compatible across Wi-Fi generations, but 802.11ac is limited to 256-QAM, and 802.11ax is the first to support 1024-QAM.

Why the other options are wrong

802.11ac supports only up to 256‑QAM; 1024‑QAM is introduced with 802.11ax.

802.11ac operates only in the 5 GHz band, but 802.11ax operates in both 2.4 GHz and 5 GHz.

Both 802.11ac and 802.11ax support a range of channel widths, including 20, 40, 80, and 160 MHz; neither standard restricts to a single channel width.

Practice this question →

Matchingmedium

Drag and drop the 802.11 standards on the left to their correct frequency band and maximum throughput on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

2.4 GHz, 11 Mbps

5 GHz, 54 Mbps

2.4 GHz, 54 Mbps

2.4/5 GHz, 600 Mbps

5 GHz, 6.9 Gbps

Why these pairings

Each 802.11 standard operates in specific frequency bands and has a maximum theoretical throughput. 802.11a uses 5 GHz at 54 Mbps, 802.11b uses 2.4 GHz at 11 Mbps, 802.11g uses 2.4 GHz at 54 Mbps, 802.11n uses both 2.4 and 5 GHz up to 600 Mbps, 802.11ac uses 5 GHz up to 6.9 Gbps, and 802.11ax uses 2.4, 5, and 6 GHz up to 9.6 Gbps.

Exam trap

A common trap is confusing 802.11a with 802.11g because both have 54 Mbps throughput, but they operate in different frequency bands. Remember that 802.11a uses 5 GHz exclusively, while 802.11g uses 2.4 GHz.

Practice this question →

PBQhard

You are connected to R1. Configure IPv4 and IPv6 addressing on R1's GigabitEthernet0/0 and GigabitEthernet0/1 interfaces so that R1 can ping both R2's IPv4 address (203.0.113.2) and R2's IPv6 address (2001:db8:1::2). The current configuration has an incorrect subnet mask on G0/0, missing default gateway, and R1's G0/1 has a duplicate IPv4 address with R3. Also, use EUI-64 for IPv6 on G0/0 and static IPv6 assignment on G0/1. Ensure all issues are resolved and connectivity verified.

Network Topology

Hints

•Check the subnet mask on G0/0; it should match R2's /30.
•G0/1's IPv4 address conflicts with R3; use an unused address like .254.
•Enable IPv6 globally with 'ipv6 unicast-routing' before configuring interface IPv6 addresses.

A.Change G0/0 subnet mask to 255.255.255.252, add default gateway 203.0.113.2, change G0/1 IPv4 to 192.168.1.254, enable IPv6 routing, configure G0/0 with ipv6 address 2001:db8:1::/64 eui-64, and G0/1 with ipv6 address 2001:db8:2::1/64.

B.Change G0/0 subnet mask to 255.255.255.0, add default gateway 203.0.113.1, change G0/1 IPv4 to 192.168.1.254, enable IPv6 routing, configure G0/0 with ipv6 address 2001:db8:1::1/64, and G0/1 with ipv6 address 2001:db8:2::1/64.

C.Change G0/0 subnet mask to 255.255.255.252, add default gateway 203.0.113.2, change G0/1 IPv4 to 192.168.1.1, enable IPv6 routing, configure G0/0 with ipv6 address 2001:db8:1::/64 eui-64, and G0/1 with ipv6 address 2001:db8:2::1/64.

D.Change G0/0 subnet mask to 255.255.255.252, add default gateway 203.0.113.2, change G0/1 IPv4 to 192.168.1.254, enable IPv6 routing, configure G0/0 with ipv6 address 2001:db8:1::1/64, and G0/1 with ipv6 address 2001:db8:2::/64 eui-64.

AnswerA

solution

! R1
configure terminal
interface gigabitethernet0/0
ip address 203.0.113.1 255.255.255.252
ipv6 address 2001:db8:1::/64 eui-64
exit
interface gigabitethernet0/1
ip address 192.168.1.254 255.255.255.0
ipv6 address 2001:db8:2::1/64
exit
ip route 0.0.0.0 0.0.0.0 203.0.113.2
end

Why this answer

The subnet mask on G0/0 was incorrectly set to /24 instead of /30. While a /24 mask on 203.0.113.1 would include 203.0.113.2 in the same subnet from R1's perspective, the mismatch with R2's /30 mask leads to inconsistent subnet definitions and potential ARP or routing issues. Additionally, no default gateway was configured, so traffic to remote networks would fail.

On G0/1, the IPv4 address 192.168.1.1 was already used by R3, causing a duplicate IP conflict. IPv6 was not configured on either interface. The fix involved correcting the subnet mask on G0/0 to 255.255.255.252, adding a default gateway (203.0.113.2), assigning a unique IPv4 address to G0/1 (192.168.1.254), enabling IPv6 routing globally with `ipv6 unicast-routing`, configuring EUI-64 on G0/0 (`ipv6 address 2001:db8:1::/64 eui-64`), and static IPv6 on G0/1 (`ipv6 address 2001:db8:2::1/64`).

Exam trap

Watch out for subnet mask mismatches (e.g., /24 vs /30) and duplicate IP addresses. Also, note the specific IPv6 addressing requirements: EUI-64 on one interface and static on the other. Don't assume a default gateway can be any IP in the subnet; it must be the neighbor's IP.

Why the other options are wrong

The subnet mask /24 is too large, causing a mismatch with R2's /30; the default gateway must be R2's IP (203.0.113.2); EUI-64 is not used on G0/0.

The duplicate IPv4 address on G0/1 is not resolved; it still uses 192.168.1.1 which is already assigned to R3.

EUI-64 is required on G0/0, not G0/1; static IPv6 is required on G0/1, not G0/0.

Practice this question →

MCQhard

What prefix length corresponds to the subnet mask 255.255.255.224?

A./26

B./27

C./28

D./29

AnswerB

The subnet mask 255.255.255.224 converts to binary as 11111111.11111111.11111111.11100000, where the last octet indicates 3 additional network bits beyond the default /24. Adding 24 + 3 gives a prefix length of /27, which is the correct match. This leaves 5 host bits, providing 2^5 - 2 = 30 usable IP addresses per subnet.

Why this answer

The subnet mask 255.255.255.224 corresponds to /27. In plain language, the first three octets contribute 24 network bits, and 224 in binary is 11100000, which contributes 3 more network bits. That gives a total of 27 network bits.

This is a common prefix-conversion question because it checks whether you can move between dotted-decimal masks and prefix lengths confidently.

Exam trap

Be cautious not to confuse the binary values of different subnet masks. Always convert the last octet to binary to determine the correct prefix length.

Why the other options are wrong

The /26 prefix corresponds to subnet mask 255.255.255.192, which has 64 addresses per subnet, not 32. The mask 255.255.255.224 has 27 network bits, not 26.

The /28 prefix corresponds to subnet mask 255.255.255.240, which provides 16 addresses per subnet (14 usable). The mask 255.255.255.224 has 32 addresses per subnet, so /28 is incorrect.

The /29 prefix corresponds to subnet mask 255.255.255.248, which provides 8 addresses per subnet (6 usable). The mask 255.255.255.224 has 32 addresses, so /29 is incorrect.

Practice this question →

MCQhard

A network technician is troubleshooting a newly installed fiber link between two Cisco Catalyst 9300 switches. The link is up, but the interface shows excessive CRC errors and input errors. The technician runs 'show interfaces' and 'show interfaces transceiver details' on the suspect interface. Based on the output, what is the most likely cause of the errors?

A.The interface is configured for full duplex but the switchport is set to auto-negotiation, causing a duplex mismatch.

B.The SFP transceiver is faulty because the transmit power is too low at -3.5 dBm.

C.The fiber cable is too long for the SX SFP, exceeding the distance limit.

D.The receive power is too low, likely due to a dirty or damaged fiber connector or excessive attenuation.

AnswerD

The receive power of -20.1 dBm falls below the low alarm threshold of -17.0 dBm, while the transmit power is normal, indicating a problem in the optical path rather than the transceiver. Weak RX power causes CRC errors because the receiver has difficulty distinguishing 1s and 0s from the noise floor. Dirty or damaged fiber connectors, excessive splices, or high attenuation in the cable are the most likely culprits. Cleaning endfaces and checking patch panels should be the first troubleshooting steps.

Why this answer

The output from 'show interfaces transceiver details' would show the receive power level. A receive power that is too low (e.g., below the receiver sensitivity threshold) indicates excessive signal loss, often due to dirty or damaged fiber connectors, poor splices, or excessive cable attenuation. This causes bit errors that manifest as CRC and input errors, even though the link is physically up.

Option D correctly identifies this as the most likely cause.

Exam trap

Cisco often tests the distinction between transmit power and receive power, trapping candidates who assume a low transmit power is the root cause, when in fact the receive power is the critical metric for signal integrity at the far end.

Why the other options are wrong

The interface shows Full Duplex and 1000 Mbps with no collisions or late collisions, which indicates no duplex mismatch. Duplex mismatch typically causes collisions and late collisions, which are absent here.

The transmit power of -3.5 dBm is within the normal range for SX SFP (-1.0 to -9.5 dBm), so the SFP is transmitting correctly. Low transmit power would not cause CRC errors if it is within specifications.

The SX SFP supports up to 550m on OM3 fiber, and the link is operational, so distance is not the issue. Excessive CRC errors due to distance would typically cause the link to be down or unstable.

Practice this question →

Matchingmedium

Match each address-related concept to its most accurate meaning.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Indicates network versus host portions of an IPv4 address

Next-hop path used for off-subnet traffic

Address used to reach all hosts in the local broadcast domain

Address that identifies the subnet itself

Why these pairings

The subnet mask is used to distinguish the network portion from the host portion of an IPv4 address. The default gateway is the next-hop router that forwards traffic destined for off-subnet networks. The broadcast address sends packets to all hosts within the local broadcast domain, while the network address identifies the subnet itself and is the first address in the subnet range.

Exam trap

The exam often tests your ability to differentiate between IP addresses, MAC addresses, subnet masks, and default gateways. Be careful not to confuse the function of each, especially since they are all related to addressing and routing.

Practice this question →

Multi-Selectmedium

Which TWO statements are true about IPv6 link-local addresses?

Select 2 answers

A.They are automatically configured on all IPv6-enabled interfaces.

B.They are routable across the entire IPv6 internet.

C.They always use the EUI-64 format for the interface ID.

D.They are used as the default gateway address for IPv6 hosts.

E.They are identified by the prefix fe80::/10.

AnswersA, E

IPv6-enabled interfaces automatically generate a link-local address, even if no other IPv6 address is configured.

Why this answer

IPv6 link-local addresses (fe80::/10) are automatically generated on every IPv6-enabled interface using Stateless Address Autoconfiguration (SLAAC) as defined in RFC 4862. This ensures that each interface has a unique local address for neighbor discovery and other link-local operations without requiring manual configuration or a DHCPv6 server.

Exam trap

Cisco often tests the misconception that link-local addresses are routable or that they always use EUI-64, when in fact they are strictly link-scoped and can use privacy extensions to randomize the interface ID.

Why the other options are wrong

Link-local addresses are not routable; they are confined to a single link or network segment. Routers will not forward packets with a link-local source or destination address beyond the local subnet.

While EUI-64 is one method for generating the interface ID, link-local addresses can also use randomly generated identifiers (privacy extensions) or be manually configured. The statement that they always use EUI-64 is incorrect.

The default gateway for IPv6 hosts is typically a global unicast or unique local address, not a link-local address. While routers may send Router Advertisements with a link-local source, the default gateway address learned by hosts is the router's link-local address, but the host uses that link-local address as the next-hop, not as the default gateway address itself. The statement is misleading because the default gateway is often the link-local address of the router, but the host uses it as the next-hop, not as a routable address.

Practice this question →

MCQhard

A network administrator is troubleshooting a wireless connectivity issue in a large office. Users on the 5 GHz band report intermittent disconnections and slow performance, while 2.4 GHz clients are unaffected. The office uses a Cisco 9800 WLC with APs that support 802.11ac Wave 2. The administrator checks the WLC's RF profile and notices a high number of channel utilization reports on channel 36. What is the most likely cause of the problem?

A.Enable DFS channels to avoid radar interference.

B.Change some APs to use channels 40, 44, or 48 to reduce co-channel interference.

C.Increase the channel width to 160 MHz to improve throughput.

D.Disable the 2.4 GHz radios to force all clients to 5 GHz.

AnswerB

Co-channel interference (CCI) occurs when multiple APs with overlapping coverage use the same 5 GHz channel, causing them to contend for the same half-duplex medium. By changing some APs to channels 40, 44, or 48, you spread the cells across the four non-overlapping UNII-1/UNII-3 channels, reducing contention and enabling more efficient airtime use. This directly mitigates the excessive retries and throughput degradation shown in the exhibit.

Why this answer

Channel 36 is a 20 MHz channel in the 5 GHz band. When many APs use the same channel (channel 36), they share the same medium, leading to co-channel interference (CCI). This causes intermittent disconnections and slow performance for 5 GHz clients because they must contend for airtime.

Spreading APs across non-overlapping channels like 40, 44, or 48 reduces CCI and improves performance.

Exam trap

Cisco often tests the misconception that DFS channels are the solution for any 5 GHz interference issue, but the trap here is that high channel utilization on a non-DFS channel (36) indicates co-channel interference, not radar avoidance.

Why the other options are wrong

DFS channels are used to avoid radar interference, but the problem described is co-channel interference on channel 36, not radar events. The exhibit shows no radar events, so enabling DFS channels would not address the high channel utilization.

Increasing channel width to 160 MHz would actually increase the likelihood of co-channel interference because fewer non-overlapping channels are available, and it would not solve the existing high utilization on channel 36.

Disabling 2.4 GHz radios would force all clients to 5 GHz, potentially worsening the co-channel interference on channel 36 by adding more clients to an already congested channel. The 2.4 GHz band is not the source of the problem.

Practice this question →

Multi-Selectmedium

Which two statements accurately compare TCP and UDP? (Choose two.)

Select 2 answers

A.TCP provides connection-oriented transport

B.UDP guarantees delivery through acknowledgments

C.UDP has lower overhead than TCP

D.TCP does not use port numbers

E.UDP is always faster because it avoids congestion

AnswersA, C

TCP establishes a reliable, connection-oriented session by utilising a three-way handshake before any data transmission commences. This fundamental mechanism ensures a logical connection is set up and maintained between the communicating hosts, providing statefulness and ordered delivery. This precise characteristic directly contrasts with UDP's connectionless nature, making it an accurate comparison between the two protocols and satisfying the question's requirement for a distinguishing statement.

Why this answer

TCP is connection-oriented and uses sequencing, acknowledgments, and related controls. UDP is simpler and has lower overhead, but it does not guarantee delivery.

Exam trap

Be careful not to confuse the connection-oriented nature of TCP with UDP's connectionless design. Remember that TCP is about reliability, while UDP focuses on speed and simplicity.

Why the other options are wrong

UDP is a connectionless protocol that does not use acknowledgments, sequence numbers, or retransmissions; it simply sends datagrams without any guarantee of delivery. Reliable delivery mechanisms like acknowledgments are a feature of TCP, not UDP.

TCP uses port numbers extensively to identify source and destination applications, just like UDP. Port numbers are a fundamental part of both TCP and UDP headers, enabling multiplexing of multiple services on a single host.

While UDP has lower overhead and can be faster in some scenarios, it is not 'always faster' because network congestion, packet loss, and application behavior can affect performance. Additionally, UDP does not inherently avoid congestion; it simply does not implement congestion control, which can lead to network congestion if used aggressively.

Practice this question →

MCQhard

A host address is 172.31.9.200/27. Which address is the first usable host in that subnet?

A.172.31.9.193

B.172.31.9.192

C.172.31.9.223

D.172.31.9.201

AnswerA

172.31.9.193 is the first usable host address in the 172.31.9.192/27 subnet. The /27 prefix length yields a 32-address block (256–224 = 32 hosts per subnet), so with a network address of .192, the valid host range begins at .193 and ends at .222 (broadcast .223). Since 172.31.9.200 falls within this subnet, .193 is the lowest usable address in that same range.

Why this answer

A /27 subnet has a block size of 32. In practical terms, the relevant last-octet blocks are 0-31, 32-63, 64-95, 96-127, 128-159, 160-191, 192-223, and 224-255. Because 200 falls within the 192-223 block, the network address is 172.31.9.192 and the first usable host is 172.31.9.193.

This is a host-range interpretation problem rather than just network-or-broadcast recognition.

Exam trap

Be careful not to confuse the network address with the first usable host address.

Why the other options are wrong

172.31.9.192 is the network address of the subnet, which is reserved and cannot be assigned to any host. In IPv4, the network address is used to identify the subnet itself, not as a host address.

172.31.9.223 is the broadcast address of the subnet, which is reserved for sending traffic to all hosts in the subnet. It cannot be assigned to a host.

172.31.9.201 is a valid host address in the subnet, but it is not the first usable host. The first usable host is .193, which comes after the network address .192.

Practice this question →

PBQhard

You are connected to R1 via console. R1 and R2 are directly connected via GigabitEthernet0/0. Your task is to configure IPv4 and IPv6 addressing on both routers so that they can ping each other's IPv4 and IPv6 addresses. The current configuration has intentional faults: R1's IPv4 subnet mask is incorrect, R2 is missing its default gateway, and R1's IPv6 address uses EUI-64 but is not working due to a duplicate IP. Correct the IPv4 mask on R1, assign a static IPv6 address on R2, and ensure both routers can reach each other.

Network Topology

Hints

•Check the subnet mask on R1's G0/0 — the link between two routers typically uses a /30 mask.
•R2 has no IPv6 address configured — assign one manually.
•R2 cannot reach R1's IPv4 address because they are on different subnets and R2 has no default gateway.

A.On R1, change the IPv4 mask to 255.255.255.252; on R2, assign IPv4 address 192.0.2.2/30 and IPv6 address 2001:db8:1::2/64; configure a default route on R2 pointing to 192.0.2.1.

B.On R1, change the IPv4 mask to 255.255.255.0; on R2, assign IPv4 address 192.0.2.2/24 and IPv6 address 2001:db8:1::2/64; no default route needed.

C.On R1, change the IPv4 mask to 255.255.255.252; on R2, assign IPv4 address 192.0.2.2/28 and IPv6 address 2001:db8:1::2/64; configure a default route on R2 pointing to 192.0.2.1.

D.On R1, change the IPv4 mask to 255.255.255.252; on R2, assign IPv4 address 192.0.2.2/30 and IPv6 address 2001:db8:1::1/64; configure a default route on R2 pointing to 192.0.2.1.

AnswerA

solution

! R1
configure terminal
interface GigabitEthernet0/0
ip address 192.0.2.1 255.255.255.252
end

! R2
configure terminal
interface GigabitEthernet0/0
ip address 192.0.2.2 255.255.255.252
ipv6 address 2001:db8:1::2/64
exit
ip route 0.0.0.0 0.0.0.0 192.0.2.1
end

Why this answer

R1's IPv4 mask was /28, but the correct mask for the link should be /30 to avoid overlapping subnets (192.0.2.0/28 includes both .1 and .14, but they are on the same link). R2 had no IPv6 address configured. Additionally, R1's EUI-64 address was valid but R2 needed a static IPv6 address.

The solution: on R1, change the mask to 255.255.255.252; on R2, assign an IPv4 address with mask /30 and a static IPv6 address 2001:db8:1::2/64; also add a default route on R2 pointing to 192.0.2.1 for IPv4. After these changes, both routers can ping each other's IPv4 and IPv6 addresses.

Exam trap

Watch out for subnet mask mismatches and duplicate IPv6 addresses. Always use /30 for point-to-point links and ensure each router has a unique IPv6 address on the same link.

Why the other options are wrong

The specific factual error: Using a /24 mask on a point-to-point link wastes addresses and may cause subnet overlap; also, R2 needs a default route to reach R1's IPv4 address if the mask is /30, but with /24 they are in the same subnet so no default route is needed, but the mask is still wrong.

The specific factual error: R2's IPv4 mask must match R1's mask to ensure both routers agree on the subnet boundary. Using /28 on R2 while R1 uses /30 creates a mismatch.

The specific factual error: Assigning the same IPv6 address to both routers causes a duplicate address conflict, preventing communication.

Practice this question →

MCQhard

A network engineer replaces a failed 1000BASE-LX SFP on a core switch with a new transceiver of the same type. After connecting the single-mode fiber, the link remains down and a 'show interfaces gig1/0/49 transceiver' reveals an Rx power of –30 dBm, while the far-end SFP is transmitting at –3 dBm over a 2 km span. The fiber patch cord shows no visible damage.

A.The new SFP is a counterfeit Cisco transceiver that cannot establish a stable link.

B.The SFP is not fully seated in the switch port, causing an intermittent optical connection.

C.Excessive attenuation due to a dirty or damaged fiber connector is preventing the link from coming up.

D.The single-mode fiber distance exceeds the 10 km maximum for 1000BASE-LX, leading to severe signal dispersion.

AnswerC

A –30 dBm Rx power with a transmit level of –3 dBm over a 2 km single-mode span represents a 27 dB loss, far exceeding the expected 0.5–1 dB. Such high loss is typical of contaminated end faces, poor mating, or a tight bend, and it pushes the signal below the receiver sensitivity threshold (around –25 dBm), causing the link to stay down.

Why this answer

The measured Rx power of –30 dBm is far below the receive sensitivity threshold for 1000BASE-LX (typically –19 to –22 dBm), even though the transmitter is outputting a healthy –3 dBm over only 2 km. This indicates excessive loss in the optical path, most commonly caused by a dirty or damaged fiber connector. Cleaning the connector ends with an appropriate fiber cleaning tool and inspecting with a microscope would likely resolve the issue.

Exam trap

Cisco often tests the concept that a link can fail due to excessive optical loss even when the fiber distance is well within the rated maximum, leading candidates to incorrectly blame distance or counterfeit hardware instead of connector cleanliness or damage.

Why the other options are wrong

Low Rx power points to a physical signal issue, not a counterfeit detection problem.

A partially seated SFP would likely prevent any light from entering, not show a measurable but weak signal.

Distance would not cause a 27 dB loss over such a short path, and dispersion is not measured as a reduction in optical power on the DOM readout.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to troubleshoot a Windows client that is unable to reach a remote server.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

6Step 6

Why this order

The correct troubleshooting order starts with verifying the client's IP configuration using ipconfig /all (A) to ensure the device has proper addressing. Next, test the TCP/IP stack by pinging the loopback address 127.0.0.1 (B). Then, ping the client's own IP address (C) to confirm the network interface card is operational.

After that, ping the default gateway (D) to verify local network connectivity. If successful, ping the remote server (E) to test end-to-end connectivity. If that fails, use tracert (F) to identify where the path breaks.

This bottom-up approach isolates the problem starting from the local host outwards.

Practice this question →

MCQhard

A network engineer notices that a switch port connected to a legacy server is experiencing late collisions and the server reports excessive retransmissions. The switch port is configured for auto-negotiation and shows a negotiated speed of 100 Mbps and duplex full. The server's NIC is manually set to 100 Mbps and half-duplex. What is the most likely cause?

A.The switch port is incorrectly configured for auto-negotiation and should be manually set to match the server's NIC.

B.The server's NIC is failing, causing cyclic redundancy check (CRC) errors and forcing retransmissions.

C.A duplex mismatch exists between the switch port and the server NIC.

D.The switch port is overloaded by a broadcast storm, causing an excessive number of collisions.

AnswerC

The switch port negotiated full-duplex at 100 Mbps (as shown in the switch output), while the server NIC is hard-coded to half-duplex. This mismatch causes exactly the observed symptoms: late collisions on the full-duplex switch port and excessive retransmissions on the half-duplex server.

Why this answer

The switch port is auto-negotiating to full-duplex while the server's NIC is manually set to half-duplex. This creates a duplex mismatch: the switch transmits expecting no collisions (full-duplex), but the server, operating in half-duplex, detects collisions when the switch sends frames while the server is transmitting. Late collisions occur because the collision is detected after the first 64 bytes of the frame, and the server's half-duplex CSMA/CD logic forces retransmissions, matching the symptoms described.

Exam trap

Cisco often tests the concept that auto-negotiation mismatches (e.g., one side set to manual) cause duplex mismatches, and candidates mistakenly think the issue is speed mismatch or that both sides must be manually set, but the trap here is that the server's manual half-duplex setting overrides the auto-negotiation result, creating a duplex mismatch that produces late collisions.

Why the other options are wrong

Misunderstanding that auto-negotiation always causes duplex mismatches, when in fact a mismatch occurs because one side is manually configured while the other uses auto-negotiation to negotiate an incompatible mode.

Confusing CRC errors with late collisions. Late collisions are a layer-1 timing issue, not a data integrity problem.

Attributing all network performance problems to broadcast storms, ignoring the specific error counter 'late collisions' that points directly to a duplex mismatch.

Practice this question →

MCQhard

A network technician replaced a faulty SFP transceiver on a switch port. After replacement, the port remains in a down/down state. The technician verifies the fiber cable is securely connected at both ends and observes that the remote switch port is also in a down/down state. What should the technician do next?

A.Verify that the speed and duplex settings are set to auto-negotiation.

B.Check whether the SFP module type is incompatible with the switch.

C.Verify the VLAN assignment on the port.

D.Check the running configuration for the no shutdown command on the interface.

AnswerD

This is the most immediate and logical next step. A shut-down interface displays as down/down (or administratively down/down), and without verifying the administrative state, all other troubleshooting is premature. The technician has already addressed physical connectivity, so a configuration oversight must be ruled out.

Why this answer

The most common cause of a port remaining in a down/down state after replacing a faulty SFP is that the interface is administratively down. The 'no shutdown' command must be applied to bring the interface up. Since the technician already verified physical connectivity and both ends show down/down, the issue is likely at the configuration layer, not the physical layer.

Exam trap

Cisco often tests the distinction between physical layer issues (cable, SFP) and administrative state issues (shutdown), where candidates mistakenly focus on hardware compatibility or VLAN settings when the port is simply disabled via configuration.

Why the other options are wrong

Candidates assume a speed mismatch must be the problem due to the down/down state, overlooking that a shutdown interface also appears down/down (without the 'administratively' prefix in some outputs) and that the physical check was already done.

The urgency to blame the newly installed hardware leads many to skip the quick-win config check, potentially wasting time on hardware replacement when the fix is a single command.

Candidates often confuse link status with connectivity issues that occur after the link is up, mistakenly targeting a Layer 2 problem for a Layer 1 symptom.

Practice this question →

PBQmedium

You are connected via the console to R1, a Cisco ISR 4331 router. The network administrator reports that the link between R1's GigabitEthernet0/0 and a switch is experiencing high error rates and intermittent connectivity. Upon inspection, you notice that the interface is configured with speed 1000 and duplex full. The switch port is set to auto-negotiate. Your task is to resolve the duplex mismatch by configuring the router interface to match the switch's settings.

Network Topology

Hints

•The switch port is set to auto-negotiate.
•Duplex mismatch occurs when one side is set manually and the other auto.
•Use the 'speed auto' and 'duplex auto' commands.

A.Configure the router interface with 'speed 1000' and 'duplex full'.

B.Configure the router interface with 'no speed' and 'no duplex' to restore defaults, then set 'speed 1000' and 'duplex full'.

C.Configure the router interface with 'no speed' and 'no duplex' to restore defaults, then set 'speed 1000' and 'duplex half'.

D.Configure the router interface with 'no speed' and 'no duplex' to restore defaults, then set 'speed auto' and 'duplex auto'.

AnswerD

solution

! R1
interface GigabitEthernet0/0
speed auto
duplex auto

Why this answer

The duplex mismatch was caused by manually forcing speed and duplex on the router while the switch was set to auto-negotiate. Changing the router to auto-negotiate allows both sides to negotiate the best duplex (full duplex) and speed, eliminating errors.

Exam trap

A common trap is to think that manually setting the router to the same speed and duplex as the switch's negotiated settings will fix the issue. However, if the switch is set to auto-negotiate, it will not successfully negotiate with a manually configured interface. The only way to ensure a match is to enable auto-negotiation on both sides.

Why the other options are wrong

The specific factual error is that manually setting speed and duplex on one side while the other side is set to auto-negotiate can lead to a duplex mismatch because auto-negotiation relies on both ends participating.

The specific factual error is that manually setting speed and duplex after restoring defaults still disables auto-negotiation on the router, which does not resolve the mismatch.

The specific factual error is that setting duplex half on the router while the switch auto-negotiates will likely result in the switch negotiating to full duplex, causing a mismatch.

MCQhard

A host has the address 10.10.10.94/27. Which subnet contains that host?

A.10.10.10.32/27

B.10.10.10.64/27

C.10.10.10.96/27

D.10.10.10.0/27

AnswerB

A /27 prefix length creates 32-address subnets. To find the subnet containing 10.10.10.94, divide 94 by 32, which gives 2.9375; the network address is the floor of that quotient multiplied by 32, i.e., 2 × 32 = 64. Thus 10.10.10.64/27 covers 64 through 95, and 94 is a valid host in that range (usable addresses 65–94, broadcast 95).

Why this answer

A /27 mask creates subnets in blocks of 32 addresses. In plain language, that means the fourth-octet ranges are 0–31, 32–63, 64–95, 96–127, and so on. Since the host address ends in 94, it falls inside the 64–95 block. That means the subnet is 10.10.10.64/27.

This is a classic subnetting task because it checks whether you can move from prefix length to block size and then locate the host inside the correct range. The key skill is recognizing the increment boundary and not guessing based only on the nearest familiar address.

Exam trap

Avoid guessing based on familiar numbers; calculate the subnet range using the block size.

Why the other options are wrong

The subnet 10.10.10.32/27 covers addresses 10.10.10.32 through 10.10.10.63. The host address 10.10.10.94 is not within this range, so this subnet is incorrect.

The subnet 10.10.10.96/27 covers addresses 10.10.10.96 through 10.10.10.127. The host address 10.10.10.94 is below the starting address of this subnet, so it is not included.

The subnet 10.10.10.0/27 covers addresses 10.10.10.0 through 10.10.10.31. The host address 10.10.10.94 is far outside this range, so this subnet is incorrect.

Practice this question →

MCQmedium

A junior network engineer is configuring a new Windows 10 workstation to connect to the corporate network. The network uses a /24 subnet mask and has a default gateway of 192.168.1.1. The workstation obtains its IP address automatically from a DHCP server, but the engineer needs to manually set a static IPv4 address of 192.168.1.50 and ensure the workstation can reach the internet. Which configuration step must the engineer take to satisfy these requirements?

A.Set the subnet mask to 255.255.0.0 and the default gateway to 192.168.1.1

B.Set the subnet mask to 255.255.255.0 and the default gateway to 192.168.1.1

C.Set the subnet mask to 255.255.255.0 and leave the default gateway blank

D.Set the subnet mask to 255.255.255.0 and the default gateway to 192.168.1.50

AnswerB

This is the correct configuration. The subnet mask 255.255.255.0 corresponds to a /24 prefix, which matches the network. The default gateway 192.168.1.1 is the router's IP on the same subnet, allowing the workstation to reach the internet.

Why this answer

A /24 subnet mask (255.255.255.0) matches the network prefix of the default gateway 192.168.1.1, ensuring the workstation can route traffic to the internet via that gateway. Option A fails because a /16 mask (255.255.0.0) does not match the corporate /24 network, causing incorrect network identification and potential routing issues. Option C fails because leaving the default gateway blank means the host cannot reach any network beyond its local subnet, so internet access is impossible.

Option D fails because using the host's own IP (192.168.1.50) as the default gateway would cause the host to attempt to route traffic to itself, never reaching the actual gateway.

Exam trap

Cisco often tests the requirement that the default gateway must be on the same subnet as the host's IP address, and a common trap is to confuse the gateway address with the host's own IP or to use an incorrect subnet mask that still allows local communication but breaks routing.

Why the other options are wrong

Using a /16 subnet mask (255.255.0.0) does not match the corporate /24 network, leading to incorrect network identification and potential routing issues.

Leaving the default gateway blank prevents the host from reaching any network beyond its own subnet, so internet access is impossible.

Setting the default gateway to the host's own IP address (192.168.1.50) would cause traffic to be sent to itself, never reaching the actual gateway.

Practice this question →

MCQhard

A subnet uses network address 192.168.200.96/28. Which range contains the usable host addresses?

A.192.168.200.97 to 192.168.200.110

B.192.168.200.96 to 192.168.200.111

C.192.168.200.98 to 192.168.200.111

D.192.168.200.81 to 192.168.200.94

AnswerA

The /28 prefix length translates to subnet mask 255.255.255.240, giving a 16-address block. Since 192.168.200.96 is the network address (last octet 0110 0000), the broadcast address is .111 (0110 1111). Consequently, the only addresses available to hosts are .97 through .110 inclusive, yielding 14 usable addresses while excluding both reserved endpoints.

Why this answer

A /28 block contains 16 addresses. In practical terms, the block starting at 192.168.200.96 runs through 192.168.200.111. The first address is the network address and the last address is the broadcast address. That means the usable host range is 192.168.200.97 through 192.168.200.110.

This question checks whether you can calculate the correct block and then exclude the two reserved boundary addresses.

Exam trap

Remember to exclude the network and broadcast addresses when determining usable host ranges.

Why the other options are wrong

This range includes the network address (.96) and the broadcast address (.111), which cannot be assigned to hosts. Usable host addresses must exclude these two addresses.

This range starts at .98, which excludes the valid host .97, and ends at .111, which includes the broadcast address. The correct usable range is .97 to .110.

This range (192.168.200.81 to .94) belongs to a different subnet. For a /28 subnet starting at .96, the valid host range is .97 to .110. This range is from a previous subnet (e.g., 192.168.200.80/28).

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to diagnose and resolve a duplex/speed mismatch causing interface errors on a Cisco switch.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

6Step 6

Why this order

The correct diagnostic process begins by collecting interface statistics with 'show interfaces' to detect anomalies (step 1). If CRC errors, runts, and late collisions are present, these indicate a duplex mismatch (step 2). Next, check the current duplex and speed configuration for that interface using 'show interfaces <int>' (step 3).

Compare this setting with the expected configuration or with the remote device's interface (step 4) to confirm the mismatch. Based on the findings, apply the correct duplex and speed commands to align both ends (step 5). Finally, verify that the error counters stop incrementing after the fix (step 6).

Practice this question →

MCQmedium

A network administrator receives a call from a user who cannot access any external websites from their wired workstation. The user can ping the default gateway successfully, but fails to ping 8.8.8.8. The administrator runs ipconfig /all on the workstation and sees an IP address of 192.168.1.50, subnet mask 255.255.255.0, and default gateway 192.168.1.1. What is the most likely cause of this issue?

A.The workstation has an incorrect default gateway configured.

B.The workstation has a duplicate IP address on the network.

C.The workstation is connected to the wrong VLAN.

D.The workstation has a DNS misconfiguration.

AnswerA

The user can ping the default gateway (192.168.1.1) but cannot ping 8.8.8.8, indicating local connectivity works but external routing fails. If the actual network gateway is different (e.g., 192.168.1.254), the workstation's configured gateway would be incorrect, preventing traffic from being forwarded to external networks.

Why this answer

The user can successfully ping 192.168.1.1, proving local IP connectivity to that device. However, the device at 192.168.1.1 may not be the correct default gateway for reaching external networks; the actual gateway router might be at a different IP (e.g., 192.168.1.254). This misconfiguration explains why pings to 8.8.8.8 fail even though the local gateway responds, as the workstation sends external traffic to the wrong next-hop address.

Exam trap

This question tests the ability to differentiate between local connectivity issues and routing issues. A common trap is to assume DNS is the problem when users cannot access websites, but the failure to ping an external IP indicates a routing problem, not a name resolution problem. Also, successful ping to the gateway eliminates many Layer 2 or IP configuration issues.

Why the other options are wrong

A duplicate IP would cause intermittent or lost connectivity and likely prevent a consistent reply from the gateway.

Being on the wrong VLAN would typically prevent the workstation from receiving an IP in the 192.168.1.0/24 subnet and reaching the gateway at 192.168.1.1.

DNS is only used for name resolution; pinging an IP address directly does not involve DNS, so a DNS misconfiguration cannot cause the ping failure to 8.8.8.8.

Practice this question →

Multi-Selectmedium

A switch port was configured for sticky MAC learning. Which two statements accurately describe how the feature behaves?

Select 2 answers

A.The switch can dynamically learn MAC addresses and add them to the running configuration as secure MAC addresses.

B.Sticky learning removes the need to enable port security on the interface.

C.Saved sticky addresses can become part of the startup configuration if the running configuration is saved.

D.Sticky learning automatically converts the interface into a trunk port.

E.Sticky learning prevents the maximum secure MAC limit from being enforced.

AnswersA, C

This is correct because sticky MAC learning lets the switch observe source MAC addresses arriving on the port and then record them as secure MAC entries. That gives the convenience of dynamic discovery with the control of port security.

Why this answer

Sticky MAC learning is Cisco’s way of letting a port learn device MAC addresses automatically, while still treating them as secure addresses under port security. In everyday language, it saves the administrator from typing each allowed MAC address by hand. As devices connect, the switch can learn their MAC addresses and place them into the running configuration as sticky secure MACs.

If the administrator later saves the configuration, those learned entries can also be written into startup-config and survive a reboot. The feature does not replace port security; it works as part of port security. It also does not change the port into a trunk or disable the maximum address count.

So the two correct ideas are dynamic secure learning and the ability to preserve those learned MACs by saving the configuration.

Exam trap

Remember, sticky MAC learning is a feature of port security, not a replacement or a mode change.

Why the other options are wrong

Sticky MAC learning is a feature of port security and cannot function without port security being enabled on the interface. The command 'switchport port-security' must be configured first, and then 'switchport port-security mac-address sticky' enables sticky learning.

Sticky MAC learning is a port security feature that operates on access ports and does not affect the interface's operational mode. Trunk ports are configured separately using 'switchport mode trunk' and are used for carrying multiple VLANs, which is unrelated to MAC address learning behavior.

Sticky MAC learning does not override the maximum secure MAC address limit configured with 'switchport port-security maximum'. If the number of learned sticky addresses reaches the limit, additional MAC addresses will trigger a security violation, just like with dynamically learned addresses.

Practice this question →

Multi-Selectmedium

Which TWO interface error counters indicate a Layer 1 issue?

Select 2 answers

A.CRC errors

B.Output queue drops

C.Runts

D.Input errors

E.Ignored packets

AnswersA, C

CRC errors occur when the receiving interface computes the frame check sequence and finds it does not match the value sent by the sender, proving that bits were corrupted during transmission. This is a classic Layer 1 symptom, typically caused by bad cabling, loose connectors, electromagnetic interference, or a failing transceiver. Because the corruption happens on the physical medium, CRC errors directly identify a Layer 1 problem.

Why this answer

CRC errors occur when the cyclic redundancy check computed at the receiver does not match the value appended by the sender, indicating that the frame was corrupted during transmission. This corruption is typically caused by physical-layer problems such as faulty cabling, bad connectors, or excessive electrical noise. Runts are frames that are smaller than the minimum Ethernet frame size of 64 bytes (excluding preamble), and they often result from collisions or transceiver issues that are Layer 1 phenomena.

Both counters directly point to physical-layer impairments rather than logical or congestion-related issues.

Exam trap

Cisco often tests the distinction between Layer 1 errors (CRC, runts, giants, frame errors) and Layer 2/3 congestion indicators (output drops, input drops, ignored counts), so the trap is that candidates mistakenly associate any 'drop' or 'error' counter with the physical layer without understanding the underlying cause.

Why the other options are wrong

Output queue drops occur when the transmit queue is full due to congestion, typically at Layer 3 (IP) or Layer 2 (switching). They are not caused by physical layer issues but by traffic overload or insufficient buffer space.

Input errors is a catch-all counter that includes CRC, runts, giants, and framing errors. While it can indicate Layer 1 issues, it is not specific to Layer 1 because it also includes errors from higher layers (e.g., alignment errors). The question asks for counters that indicate a Layer 1 issue, and input errors is too broad.

Ignored packets are dropped due to buffer overflow, often from high traffic or hardware limitations, not specifically a Layer 1 error. They are typically caused by congestion at Layer 2 or Layer 3, not physical layer faults.

Practice this question →

MCQhard

A host is configured with 172.16.10.62/27. Which address is the broadcast address for that subnet?

A.172.16.10.31

B.172.16.10.32

C.172.16.10.63

D.172.16.10.64

AnswerC

This is correct because the host is in the 32–63 /27 block, whose broadcast is .63.

Why this answer

A /27 uses blocks of 32 addresses. In plain language, the last-octet ranges are 0–31, 32–63, 64–95, and so on. Since the host address ends in 62, it belongs to the 32–63 block. The last address in that block is the broadcast address, so the broadcast is 172.16.10.63.

This is a classic subnetting question because it requires you to place the host inside the correct block and then identify the last address in that block rather than guessing based on the host value alone.

Exam trap

Be careful not to confuse the broadcast address with the network address or the start of the next subnet.

Why the other options are wrong

The address 172.16.10.31 is the broadcast address for the /27 subnet 172.16.10.0–31, not for the subnet containing host 172.16.10.62. Since the host's IP is in the 32–63 range, the broadcast is .63, not .31.

172.16.10.32 is the network address (subnet ID) of the /27 subnet that includes hosts 32–63. It is not the broadcast address; the broadcast is the last address in the subnet, which is .63.

172.16.10.64 is the network address of the next /27 subnet (64–95), not the broadcast address for the subnet containing .62. The broadcast for the subnet containing .62 is .63.

Practice this question →

MCQhard

A host uses the subnet mask 255.255.255.192. How many usable host addresses exist in each subnet?

A.30

B.62

C.126

D.254

AnswerB

This is the correct answer because the subnet mask 255.255.255.192 translates to a /26 prefix, leaving 32 - 26 = 6 bits for host addressing. With 6 host bits, the total number of addresses in each subnet is 2^6 = 64, and from that total the network address (all host bits zero) and the broadcast address (all host bits one) must be subtracted. This yields 64 - 2 = 62 usable host addresses, which matches the requirement for a /26 subnet.

Why this answer

The mask 255.255.255.192 corresponds to /26. That leaves 6 host bits, which means each subnet contains 64 total addresses. After excluding the network and broadcast addresses, 62 usable host addresses remain.

This is a standard host-capacity question. The safest approach is to convert the mask to the prefix, determine the total addresses from the number of host bits, and then subtract the two reserved addresses.

Exam trap

Be careful not to confuse total addresses with usable addresses; always subtract the network and broadcast addresses.

Why the other options are wrong

The subnet mask 255.255.255.192 is /26, which provides 64 total addresses per subnet. Subtracting the network and broadcast addresses leaves 62 usable hosts, not 30. 30 usable hosts corresponds to a /27 subnet mask (255.255.255.224).

126 usable hosts would require a /25 subnet mask (255.255.255.128), which provides 128 total addresses. The given mask /26 provides only 64 total addresses, so 126 is incorrect.

254 usable hosts corresponds to a /24 subnet mask (255.255.255.0), which provides 256 total addresses. The mask 255.255.255.192 is /26, which is two bits longer, resulting in only 64 total addresses.

Practice this question →

MCQhard

A subnet uses the mask 255.255.255.252. How many usable host addresses are available in each subnet?

A.2

B.4

C.6

D.14

AnswerA

Correct. A /30 subnet (255.255.255.252) has 2 host bits because 32-30=2. The total number of addresses is 2^2 = 4, which includes one network address and one broadcast address. Subtracting these two reserved addresses leaves exactly 4-2 = 2 usable host addresses. This is the standard point-to-point link subnet size.

Why this answer

The mask 255.255.255.252 corresponds to /30. In practical terms, that gives 4 total addresses per subnet. After subtracting the network and broadcast addresses, 2 usable host addresses remain.

This is a classic small-subnet calculation that often appears in point-to-point addressing scenarios.

Exam trap

Remember to exclude network and broadcast addresses when calculating usable host addresses.

Why the other options are wrong

The /30 subnet provides a total of 4 addresses, but one is the network address and one is the broadcast address, leaving only 2 usable host addresses. Saying 4 is incorrect because it counts the network and broadcast addresses as usable.

A /30 subnet has only 2 bits for host addresses, yielding 2^2 = 4 total addresses, of which 2 are usable. 6 usable hosts would require at least 3 host bits (2^3 - 2 = 6), which corresponds to a /29 subnet.

14 usable hosts correspond to a /28 subnet (255.255.255.240), which has 4 host bits (2^4 - 2 = 14). A /30 subnet has only 2 host bits, so it cannot provide 14 usable hosts.

Practice this question →

Matchingmedium

Drag and drop the cable/transceiver types on the left to the correct descriptions on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Supports 1000BASE-T up to 100 meters with auto-negotiation for speed/duplex

Supports up to 5 km (or more with longer optics) using 1310 nm laser

Supports up to 300 meters over OM3 fiber at 10 Gbps

Single-mode transceiver for 10 Gbps links up to 10 km

1000BASE-T copper SFP transceiver for up to 100 meters on CAT5e/CAT6

Why these pairings

Cat5e supports up to 1 Gbps at 100 MHz, standard for 1000BASE-T over 100 meters. Cat6 supports up to 10 Gbps at 250 MHz but is limited to 55 meters for 10GBASE-T. Cat6a supports 10 Gbps at 500 MHz over full 100 meters.

Single-mode fiber uses laser light for long distances, typically beyond 1 km.

Exam trap

A common mistake is confusing Cat6 and Cat6a: Cat6 only supports 10 Gbps up to 55 meters, while Cat6a supports it over the full 100 meters. Also, single-mode fiber is often misidentified as using LED light (it uses laser), and multimode uses LED or VCSEL.

Practice this question →

MCQhard

A subnet must support at least 126 usable IPv4 host addresses. Which prefix is the longest that meets the requirement?

A./26

B./25

C./24

D./27

AnswerB

This is correct because /25 provides 126 usable host addresses.

Why this answer

A /25 is the smallest valid answer. In practical terms, a /25 provides 128 total addresses. After subtracting the network and broadcast addresses, 126 usable hosts remain. A /26 would be too small because it supports only 62 usable hosts.

This is a typical minimum-prefix question. The goal is to choose the smallest subnet that satisfies the host requirement without wasting more address space than necessary.

Exam trap

Be careful not to confuse total addresses with usable addresses. Always subtract the network and broadcast addresses when calculating usable hosts.

Why the other options are wrong

A /26 prefix provides 2^(32-26) - 2 = 64 - 2 = 62 usable host addresses, which is insufficient for the requirement of at least 126 usable hosts.

A /24 prefix provides 2^(32-24) - 2 = 256 - 2 = 254 usable host addresses, which is more than required. While it works, it is not the smallest prefix that meets the requirement, wasting IP address space.

A /27 prefix provides 2^(32-27) - 2 = 32 - 2 = 30 usable host addresses, far below the required 126. This is insufficient for the subnet.

Practice this question →

MCQhard

What prefix length corresponds to the subnet mask 255.255.255.248?

A./28

B./29

C./30

D./27

AnswerB

This is correct because 255.255.255.248 equals 29 network bits.

Why this answer

The mask 255.255.255.248 corresponds to /29. In practical terms, the first three octets provide 24 network bits, and the value 248 in the last octet is 11111000 in binary, which contributes 5 more network bits. That gives a total prefix length of 29.

This is a standard dotted-decimal to prefix conversion question. It matters because subnetting often requires you to move comfortably between both forms.

Exam trap

Be careful not to confuse the binary values of subnet masks. Ensure you understand how to convert between dotted-decimal and CIDR notation.

Why the other options are wrong

The subnet mask 255.255.255.240 corresponds to a /28 prefix length, not /29. This mask has 28 network bits, leaving 4 host bits, which yields 14 usable hosts per subnet.

The subnet mask 255.255.255.252 corresponds to a /30 prefix length, not /29. A /30 mask has 30 network bits and only 2 host bits, providing 2 usable addresses, typically used for point-to-point links.

The subnet mask 255.255.255.224 corresponds to a /27 prefix length, not /29. A /27 mask has 27 network bits and 5 host bits, providing 30 usable hosts per subnet.

Practice this question →

MCQhard

A host is configured with IP address 172.16.100.222/27. Which address is the broadcast address for its subnet?

A.172.16.100.191

B.172.16.100.223

C.172.16.100.224

D.172.16.100.255

AnswerB

The /27 subnet mask indicates 27 network bits, leaving 5 host bits. This creates subnet blocks of 32 addresses. For the host 172.16.100.222, its subnet begins at 172.16.100.192. The broadcast address is the final address in this subnet range, immediately preceding the next network address (172.16.100.224). Therefore, 172.16.100.223 correctly serves as the broadcast address for the subnet defined by the host's /27 configuration.

Why this answer

A /27 uses address blocks of 32. In practical terms, the fourth-octet ranges are 0–31, 32–63, 64–95, 96–127, 128–159, 160–191, 192–223, and 224–255. Since 222 falls inside the 192–223 block, the broadcast address is the last address in that block, which is 172.16.100.223.

This is a classic subnet-boundary question because it tests whether you can place a host in the correct block and then identify the final address in that block as the broadcast.

Exam trap

Avoid assuming the broadcast address is always .255 or miscalculating subnet ranges.

Why the other options are wrong

172.16.100.191 is the broadcast address of the previous /27 subnet (172.16.100.160/27), not the subnet containing .222. The host .222 is in the 172.16.100.192/27 subnet, so its broadcast is .223.

172.16.100.224 is the network address of the next /27 subnet (172.16.100.224/27), not a broadcast address. Broadcast addresses are always the last address in a subnet, not the first.

172.16.100.255 is the broadcast address of the entire /24 subnet (172.16.100.0/24), not the /27 subnet containing .222. The /27 subnet has a smaller range, so its broadcast is .223.

Practice this question →

Multi-Selectmedium

Which TWO commands would a network administrator use to verify that a client has received a valid IP address from a DHCP server and can resolve domain names to IP addresses?

Select 2 answers

A.ipconfig /all

B.ping 127.0.0.1

C.tracert 8.8.8.8

D.nslookup www.courseiva.com

E.arp -a

AnswersA, D

`ipconfig /all` provides comprehensive details about a client's network configuration. It explicitly displays the IP address, subnet mask, default gateway, and crucially, the DHCP server's IP address and lease information, directly confirming successful DHCP assignment. Furthermore, it lists the configured DNS server addresses, which are essential for the client's ability to resolve domain names to IP addresses. This command thus satisfies both verification requirements outlined in the question.

Why this answer

(ipconfig /all) is correct because it displays the full TCP/IP configuration for all network adapters, including whether DHCP is enabled, the assigned IP address, subnet mask, default gateway, and the DHCP server address. This allows the administrator to confirm that the client received a valid IP address from the DHCP server. Option D (nslookup www.courseiva.com) is correct because it queries the configured DNS server to resolve the domain name to an IP address, verifying that name resolution is working.

Option B (ping 127.0.0.1) only tests the local TCP/IP stack and does not verify DHCP assignment or DNS resolution. Option C (tracert 8.8.8.8) uses an IP address directly and does not test domain-name resolution. Option E (arp -a) displays the ARP cache, which is unrelated to DHCP or DNS.

Exam trap

Cisco often tests the distinction between verifying local IP stack functionality (ping 127.0.0.1) versus verifying DHCP address assignment and DNS resolution, leading candidates to mistakenly choose loopback or traceroute commands that do not validate the specific requirements.

Why the other options are wrong

ping 127.0.0.1 only tests the local TCP/IP stack and does not verify DHCP address assignment or DNS resolution.

tracert 8.8.8.8 uses an IP address directly and does not test domain-name resolution.

arp -a displays the ARP cache, which is unrelated to DHCP or DNS.

Practice this question →

Drag & Dropmedium

Drag and drop the following troubleshooting steps into the correct order to diagnose a client connectivity issue using the OSI bottom-up method. The client cannot access a web server by its FQDN.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The bottom-up OSI troubleshooting approach starts at Layer 1 (physical) and moves upward. For this scenario (client cannot access web server by FQDN), the correct order is: first check physical connectivity (Layer 1), then check data link layer (Layer 2) for MAC and VLAN issues, then check network layer (Layer 3) for IP configuration, and finally check application layer (Layer 7) for DNS resolution. This systematic approach ensures lower-layer issues are ruled out before investigating higher-layer problems.

Exam trap

The trap is that candidates often jump to DNS or IP configuration because the symptom involves an FQDN, but the bottom-up method requires starting at Layer 1. Remember: always start at the bottom of the OSI model when using this approach.

Practice this question →

MCQhard

Which prefix length corresponds to the subnet mask 255.255.255.192?

A./25

B./26

C./27

D./28

AnswerB

The subnet mask 255.255.255.192 has a binary pattern of 11111111.11111111.11111111.11000000, which places two additional network bits in the fourth octet beyond the standard /24. Adding those two bits to the 24 bits of the first three octets yields 26 network bits, so the only correct prefix length is /26. This mask provides 64 total addresses per subnet and 62 usable host addresses.

Why this answer

The mask 255.255.255.192 corresponds to /26. In practical terms, the first three octets contribute 24 network bits, and 192 in binary is 11000000, which contributes 2 more network bits. That totals 26 network bits.

This is a standard conversion skill that matters in subnetting, ACL design, and route interpretation.

Exam trap

Be careful not to confuse similar subnet masks or miscount the number of bits in the binary representation.

Why the other options are wrong

The /25 prefix length corresponds to subnet mask 255.255.255.128, not 255.255.255.192. The mask 255.255.255.128 has 128 in the last octet, while 255.255.255.192 has 192, indicating a different number of host bits.

The /27 prefix length corresponds to subnet mask 255.255.255.224, not 255.255.255.192. The mask 255.255.255.224 has 224 in the last octet, which provides 30 usable hosts per subnet, whereas 255.255.255.192 provides 62 usable hosts.

The /28 prefix length corresponds to subnet mask 255.255.255.240, not 255.255.255.192. The mask 255.255.255.240 has 240 in the last octet, which supports 14 usable hosts, while 255.255.255.192 supports 62 usable hosts.

Practice this question →

MCQmedium

A network administrator is troubleshooting a user's wired workstation that cannot access the internet. The user reports that the workstation was working earlier today. The administrator runs 'ipconfig /all' on the workstation and sees an IP address of 169.254.10.55. What is the most likely cause of this issue?

A.The workstation has a duplicate IP address conflict with another device.

B.The workstation is unable to communicate with a DHCP server due to a faulty network cable.

C.The workstation's DNS server settings are misconfigured.

D.The workstation is connected to the wrong VLAN, causing it to receive an incorrect IP address.

AnswerB

A faulty network cable prevents the workstation from establishing physical layer connectivity, which means it cannot send or receive any frames, including DHCP discover messages. Without receiving a DHCP offer, the workstation's DHCP client times out and automatically assigns itself an APIPA address from the 169.254.0.0/16 range. This is the classic symptom of a DHCP server being unreachable due to a Layer 1 issue: the client has no IP configuration and falls back to link-local addressing. The workstation will also show a network cable unplugged or limited connectivity notification, confirming the physical fault rather than a logical misconfiguration.

Why this answer

The IP address 169.254.10.55 falls within the Automatic Private IP Addressing (APIPA) range (169.254.0.0/16, RFC 3927). This address is assigned by the operating system when a DHCP client fails to receive a response from a DHCP server. A faulty network cable would prevent the workstation from communicating with the DHCP server, causing the client to self-assign an APIPA address after the DHCP discovery process times out.

Exam trap

Cisco often tests the concept that APIPA addresses are only generated when the DHCP client cannot communicate with any DHCP server, not when there is a configuration mismatch or server-side issue that still allows Layer 2 connectivity.

Why the other options are wrong

A duplicate IP address conflict would generate an error message and the workstation would still attempt to use the conflicting IP, not fall back to APIPA. The workstation would retain its DHCP-assigned address and display a conflict notification.

DNS misconfiguration would affect name resolution, but the workstation would still obtain a valid IP address from DHCP, not an APIPA address. APIPA is only triggered when DHCP discovery fails entirely.

Being on the wrong VLAN would likely result in an IP from a different subnet, not an APIPA address, unless the DHCP server for that VLAN is unreachable. APIPA occurs only when no DHCP server is reachable at all.

Practice this question →

PBQmedium

You are connected to the console of R1. The network administrator reports that users cannot communicate with the server at 192.168.2.10. R1 is connected to R2 via a serial link (S0/0/0) with IP 10.0.0.1/30 on R1 and 10.0.0.2/30 on R2. The network uses OSPF for routing. You suspect an interface issue on the serial link.

Network Topology

Hints

•Check the interface status and line protocol.
•Serial links require a clock rate on the DCE end.
•Ensure the encapsulation matches on both ends.

A.Use the show interfaces serial0/0/0 command to verify the interface status and check for encapsulation mismatch.

B.Use the show ip route command to verify that the route to 192.168.2.0/24 is present in the routing table.

C.Use the ping 10.0.0.2 command to test Layer 3 connectivity to the neighbor router.

D.Use the show running-config interface serial0/0/0 command to check the configuration of the serial interface.

AnswerA

solution

! R1
interface Serial0/0/0
clock rate 64000
no shutdown
encapsulation ppp

Why this answer

The serial interface may be administratively down or have incorrect encapsulation. Setting the clock rate on the DCE side and ensuring PPP encapsulation matches the neighbor resolves the issue.

Exam trap

Do not confuse troubleshooting steps: when a specific interface issue is suspected, use interface-level commands like show interfaces, not routing or ping commands. The show interfaces command is the go-to for verifying interface status and encapsulation.

Why the other options are wrong

The show ip route command does not provide interface-level details such as encapsulation or clock rate; it only shows routing information.

Ping does not provide detailed interface status or configuration information; it only indicates whether the neighbor is reachable, not why it is not.

The running-config shows the intended configuration but not the current operational state; for example, it won't show if the interface is administratively down unless you check the shutdown command.

Multi-Selectmedium

Which TWO statements accurately describe the encapsulation process in the TCP/IP model as data moves from the application layer to the network access layer?

Select 2 answers

A.At the application layer, the PDU is called a segment and includes a transport layer header.

B.At the transport layer, the PDU is called a segment (for TCP) and includes source and destination port numbers.

C.At the network layer, the PDU is called a frame and includes source and destination MAC addresses.

D.At the network layer, the PDU is called a packet and includes source and destination IP addresses.

E.At the data link layer, the PDU is called a packet and includes source and destination IP addresses.

AnswersB, D

The transport layer PDU for TCP is a segment, and its header carries source and destination port numbers to identify the sending and receiving applications, along with sequence and acknowledgment numbers for reliability. This segmentation prepares data for network-layer encapsulation. For UDP, the equivalent PDU is called a datagram, so the term segment specifically applies to TCP.

Why this answer

At the transport layer, TCP creates segments that include source and destination port numbers (B correct). At the network layer, the PDU is a packet containing source and destination IP addresses (D correct). Option A is wrong because the application layer generates data, not segments, and transport headers are added later.

Option C mislabels the network layer PDU; it is a packet, not a frame, and MAC addresses belong to frames. Option E is wrong because the data link layer PDU is a frame, not a packet, and it uses MAC addresses, not IP addresses.

Exam trap

Cisco often tests the specific PDU naming conventions (segment, packet, frame) and the layer at which each header is added, causing candidates to confuse the network layer packet with the data link layer frame or to misidentify the transport layer PDU.

Why the other options are wrong

The application layer PDU is just data; no transport header is added at this stage.

At the network layer, the PDU is a packet with IP addresses; MAC addresses are added at the data link layer.

The data link layer PDU is a frame, not a packet, and it contains source and destination MAC addresses.

Practice this question →

PBQhard

You are connected to R1 via console. R1's GigabitEthernet0/1 interface connects to a remote site switch over a 2 km fiber link. The current configuration shows speed and duplex set to 1000 Mbps and full, but the interface is down/down due to an SFP mismatch. Review the exhibit, identify the problem, and correct it so that the interface comes up and communicates at the correct speed and duplex. Additionally, ensure the interface is configured to auto-negotiate properly for future cable replacements.

Network Topology

Hints

•Hard-coded speed and duplex can prevent auto-negotiation and cause link failure with fiber SFPs.
•The interface is administratively down; check for the 'shutdown' command in the running config.
•For distances over 550 m, a 1000BASE-LX SFP is needed instead of 1000BASE-SX.

A.Replace the SFP with a 1000BASE-LX module, remove the manual speed and duplex settings, and issue the no shutdown command.

B.Replace the SFP with a 1000BASE-SX module, keep the manual speed 1000 and duplex full, and issue the no shutdown command.

C.Keep the existing SFP, change the speed to 100 and duplex to half, and issue the no shutdown command.

D.Replace the SFP with a 1000BASE-LX module, keep the manual speed 1000 and duplex full, and issue the no shutdown command.

AnswerA

solution

! R1
interface GigabitEthernet0/1
no speed
no duplex
no shutdown

Why this answer

The interface was administratively shut down (shutdown command) and had hard-coded speed 1000 and duplex full, which is incompatible with the 2 km fiber link requiring a long-haul SFP (e.g., 1000BASE-LX). The correct fix is to remove the manual speed/duplex settings, enable auto-negotiation (which is default but overridden), and then no shutdown. For a 2 km link, a 1000BASE-LX SFP is required; the existing SFP (likely 1000BASE-SX, max 550 m) caused the link to be down.

After replacing with the correct SFP, the interface should come up. Commands: interface Gi0/1, no speed, no duplex, no shutdown.

Exam trap

Trap: Candidates may focus only on the SFP replacement and forget to remove manual speed/duplex settings, or they may choose an SFP with insufficient distance. Remember that Gigabit Ethernet fiber interfaces should use auto-negotiation, and manual settings are only for troubleshooting or specific legacy scenarios.

Why the other options are wrong

The specific factual error is that 1000BASE-SX cannot support 2 km distances; it is limited to 550 m.

The specific factual error is that Gigabit Ethernet interfaces cannot be set to 100 Mbps; they only support 1000 Mbps or auto-negotiation.

The specific factual error is that manual speed/duplex settings should be removed to allow auto-negotiation; they are not recommended for fiber interfaces.

Practice this question →

MCQmedium

A network administrator is troubleshooting a Windows 10 client that cannot access a web server at 192.168.1.100. The client has an IP address of 192.168.1.50/24 and can ping its default gateway (192.168.1.1) successfully, but ping to 192.168.1.100 fails. Which command should the administrator run next to verify the client's current network connections and identify potential issues with active sessions?

A.ipconfig /all

B.netstat -a

C.tracert 192.168.1.100

D.ping -t 192.168.1.100

AnswerB

This command shows all active TCP connections and listening ports on the client, allowing the administrator to see if there are any established sessions to the web server or if the web server's port is being blocked or not responding.

Why this answer

The `netstat -a` command displays all active TCP/UDP connections and listening ports, which is the most direct way to verify current network sessions and identify issues such as blocked ports, half-open connections, or failed connection attempts. While ping failure could result from network-layer filtering (e.g., ACLs blocking ICMP), `netstat -a` reveals whether the client has initiated a TCP connection to 192.168.1.100 and its current state (e.g., SYN_SENT, ESTABLISHED, TIME_WAIT), helping to isolate transport-layer or application-layer problems.

Exam trap

Cisco often tests the distinction between Layer 3 connectivity (ping/tracert) and Layer 4 session verification (netstat), trapping candidates who assume that successful ping implies full application-layer connectivity.

Why the other options are wrong

The ipconfig /all command displays detailed IP configuration, including DNS servers and MAC addresses, but does not show active network connections or sessions. Since the client can ping the gateway, IP configuration is likely correct, and this command does not help identify issues with active sessions to the web server.

The tracert command performs a route trace to the destination, which requires Layer 3 reachability. Since ping to 192.168.1.100 already failed, tracert will likely also fail and does not provide information about active connections or listening ports. It is useful for identifying where packets are dropped along the path, but not for verifying active sessions.

The ping -t command sends continuous ICMP echo requests to test reachability over time, but it does not reveal connection states or listening ports. Since ping already failed, continuous pings will also fail and do not help identify issues with active TCP sessions to the web server.

Practice this question →

Multi-Selectmedium

Which TWO symptoms are most likely to appear in the output of 'show interfaces' when a duplex mismatch exists between a switch port and a connected host?

Select 2 answers

A.Excessive collisions and CRC errors on the interface

B.Runts and frame errors on the interface

C.Auto-negotiation failed message in the interface output

D.High input rate on the interface

E.Line protocol is down

AnswersA, B

In a duplex mismatch, the side forced to half-duplex continues to use CSMA/CD and expects to transmit only when the medium is clear. Because the full-duplex peer transmits without first performing carrier sense, the half-duplex side experiences collisions on nearly every frame. These collisions are reported as excessive collisions in the interface output, and the frames that are truncated or otherwise corrupted during the collisions fail the FCS, resulting in CRC errors. Thus, excessive collisions and CRC errors are the hallmark symptoms on the half-duplex side of a mismatch.

Why this answer

A duplex mismatch causes collisions on the half-duplex side, resulting in excessive collisions and CRC errors (option A). On the full-duplex side, the host receives truncated frames from the half-duplex side's collisions, leading to runts and frame errors (option B). Option C is incorrect because 'Auto-negotiation failed' would appear only if negotiation itself failed, not from a mismatch after successful negotiation.

Option D is wrong because a duplex mismatch typically reduces throughput and causes errors, not a high input rate. Option E is incorrect because the line protocol remains up; duplex mismatch does not bring the line protocol down.

Exam trap

Cisco often tests the distinction that 'runts' and 'frame errors' are symptoms of duplex mismatch on the full-duplex side, while 'excessive collisions' and 'CRC errors' appear on the half-duplex side, and candidates may incorrectly assume both symptoms appear on the same interface.

Why the other options are wrong

A duplex mismatch occurs after auto-negotiation completes; no 'auto-negotiation failed' message appears on the interface.

Duplex mismatch causes errors and retransmissions, usually reducing the effective input rate, not increasing it.

Duplex mismatch keeps the line protocol up; it affects data integrity but not the Layer 1/2 link state.

Practice this question →

PBQhard

You are connected to R1 via the console. R1 has two directly connected routers: R2 and R3. Currently, R1 cannot reach R2's loopback interface (203.0.113.1/32). Additionally, R3 is IPv6-only and must be reachable from R1 using a statically assigned global unicast address. Configure R1's interfaces and static routes so that: (1) R1 can ping R2's loopback, (2) R1 can ping R3's IPv6 address 2001:db8:acad:2::1/64, and (3) R1's IPv6 address on the link to R3 is derived using EUI-64.

Hints

•Check the subnet of the IPv6 address on R1's G0/1; it should match R3's subnet.
•R2's loopback is not directly connected; a static route is needed.
•EUI-64 uses the MAC address; ensure the prefix is correct.

A.Configure R1's G0/0 with IP 192.168.1.1/24 and add a static route to 203.0.113.1/32 via 192.168.1.2. Configure R1's G0/1 with IPv6 address 2001:db8:acad:2::/64 eui-64.

B.Configure R1's G0/0 with IP 192.168.1.1/24 and add a static route to 203.0.113.0/24 via 192.168.1.2. Configure R1's G0/1 with IPv6 address 2001:db8:acad:1::/64 eui-64.

C.Configure R1's G0/0 with IP 192.168.1.1/24 and add a static route to 203.0.113.1/32 via 192.168.1.2. Configure R1's G0/1 with IPv6 address 2001:db8:acad:2::1/64.

D.Configure R1's G0/0 with IP 192.168.1.1/24 and add a static route to 203.0.113.1/32 via 192.168.1.2. Configure R1's G0/1 with IPv6 address 2001:db8:acad:1::/64 eui-64.

AnswerA

solution

! R1
interface GigabitEthernet0/1
ipv6 address 2001:db8:acad:2::/64 eui-64
exit
ip route 203.0.113.1 255.255.255.255 192.168.1.2

Why this answer

The ping to R2's loopback fails because R1's G0/0 is configured with a /24 mask, but the network should be /24 (which is correct), but the loopback is on a different subnet (203.0.113.0/24 vs 192.168.1.0/24). Actually the issue is that R1 has no route to 203.0.113.1. The solution is to add a static route on R1 pointing to R2's G0/0 IP.

For IPv6, R1's EUI-64 address is on the wrong subnet (2001:db8:acad:1::/64) but R3 is on 2001:db8:acad:2::/64. The fix is to change the IPv6 address on R1's G0/1 to 2001:db8:acad:2::/64 eui-64. Then add an IPv6 static route if needed (but R1 and R3 are directly connected, so after fixing the subnet, ping should work).

Exam trap

Watch out for subnet mismatches in IPv6 and the requirement to use EUI-64. Many candidates forget that EUI-64 requires the 'eui-64' keyword, not a manual interface ID. Also, ensure static routes point to the exact host (/32) when the destination is a loopback.

Why the other options are wrong

The IPv6 subnet mismatch prevents direct connectivity; R1 and R3 must be on the same subnet for a ping to work without additional routing.

The requirement explicitly states that the IPv6 address must be derived using EUI-64; a manually specified interface ID violates this.

The IPv6 subnet must be the same as R3's for direct connectivity; using a different subnet requires additional routing, which is not configured.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to describe the encapsulation of data as it passes down the TCP/IP stack for transmission.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

The encapsulation process starts with the application layer generating data. The transport layer packages data into segments (TCP) or datagrams (UDP). The network layer adds an IP header, creating a packet.

The data link layer adds a frame header and trailer (frame). Finally, the physical layer converts the frame into bits for transmission.

Practice this question →

MCQhard

A host address is 192.168.22.145/28. Which subnet contains that host?

A.192.168.22.128/28

B.192.168.22.144/28

C.192.168.22.160/28

D.192.168.22.148/28

AnswerB

A /28 prefix length uses subnet mask 255.255.255.240, which creates blocks of 16 addresses. Dividing the fourth octet 145 by 16 gives 9.0625, so the network boundary is 9 × 16 = 144. Therefore, the subnet containing 192.168.22.145 is 192.168.22.144/28, which spans usable hosts .145 through .158 and has a broadcast address of .159. This matches the host being the first usable address in that range.

Why this answer

A /28 prefix creates address blocks of 16. In practical terms, the fourth-octet ranges are 0–15, 16–31, 32–47, and so on. Because 145 falls inside the 144–159 range, the network address of the containing subnet is 192.168.22.144/28.

This type of question checks whether you can move from prefix length to block size and then place a host into the correct interval. The common mistake is choosing a nearby familiar number instead of calculating the actual block boundary.

Exam trap

Avoid assuming a host belongs to a subnet without calculating the exact range. Always verify the block size and boundaries.

Why the other options are wrong

The subnet 192.168.22.128/28 includes addresses 192.168.22.128 to 192.168.22.143. The host address 192.168.22.145 is outside this range, so it does not belong to this subnet.

The subnet 192.168.22.160/28 includes addresses 192.168.22.160 to 192.168.22.175. The host address 192.168.22.145 is below this range, so it cannot be in this subnet.

The subnet 192.168.22.148/28 is not a valid subnet because the network address must be a multiple of the subnet size (16). Valid network addresses for /28 are 0, 16, 32, 48, etc. 148 is not a multiple of 16, so this is not a valid subnet.

Practice this question →

MCQhard

A host is configured with 10.10.10.130/25. What is the network address of its subnet?

A.10.10.10.0

B.10.10.10.64

C.10.10.10.128

D.10.10.10.255

AnswerC

A /25 mask (255.255.255.128) partitions the last octet into two equal blocks of 128 addresses: .0–.127 and .128–.255. The address 10.10.10.130 falls in the upper block because its last octet binary begins with a 1 (10000010). Therefore, the network address is the first address of that block, 10.10.10.128, and this is the correct answer.

Why this answer

A /25 divides the address space into two blocks of 128 addresses. In plain language, the ranges are 0–127 and 128–255. Since the host ends in 130, it belongs to the 128–255 half. That means the network address is 10.10.10.128.

This is a common subnet-boundary question because it tests whether you can map a host address into the correct prefix block quickly and confidently.

Exam trap

Be careful not to confuse the subnet mask with /24 or mistake the broadcast address for the network address.

Why the other options are wrong

10.10.10.0 is the network address of the 10.10.10.0/25 subnet (range 0-127), but the host IP 10.10.10.130 is not in that range. The /25 mask creates two subnets: 10.10.10.0/25 and 10.10.10.128/25, and .130 belongs to the latter.

10.10.10.64 is not a valid network address for any /25 subnet derived from 10.10.10.0/24. A /25 subnet has a block size of 128, so the network addresses are multiples of 128: 0 and 128. 64 is a multiple of 64, which would be a /26 boundary, not /25.

10.10.10.255 is the broadcast address for the 10.10.10.128/25 subnet, not the network address. The broadcast address is the last address in the subnet (all host bits set to 1), while the network address is the first address (all host bits set to 0).

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to isolate CRC errors, duplex mismatches, and flapping on a Cisco IOS-XE interface.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

First enter configuration mode, then enable debugs to capture errors, monitor logs, analyze the data, and finally apply fixes and verify.

Exam trap

Do not confuse the order of enabling debugs and monitoring logs. Debuffs must be enabled before you can monitor the debug output. Also, configuration mode is typically entered first to set up logging parameters or debug conditions.

Practice this question →

PBQhard

You are troubleshooting a client connectivity issue on PC1, which is connected to switch SW1. PC1 reports that it cannot access the internet, but it can ping its default gateway (192.168.1.1). The network uses VLAN 10 for the client subnet. Examine the following show outputs: On PC1, ipconfig shows IP 192.168.1.10, default gateway 192.168.1.1, DNS server 192.168.1.1. On SW1, show running-config includes 'interface Vlan10' with IP 192.168.1.1 255.255.255.0, but no 'ip dns server' and no 'ip name-server' commands. SW1's show ip route displays a default route via 203.0.113.1. Identify the root cause. Configure the necessary fix on the appropriate device to restore full connectivity.

Network Topology

Hints

•Check DNS configuration on the switch.
•The PC's DNS server is likely the default gateway (switch).
•The switch needs to be configured to forward DNS queries.

A.Configure 'ip dns server' and 'ip name-server 8.8.8.8' on SW1.

B.Configure 'ip default-gateway 192.168.1.1' on SW1.

C.Configure 'ip route 0.0.0.0 0.0.0.0 203.0.113.1' on SW1.

D.Configure 'ip domain-lookup' on SW1.

AnswerA

solution

! SW1
ip name-server 8.8.8.8

Why this answer

PC1 is configured with DNS server 192.168.1.1, which is the switch SW1. However, SW1 lacks DNS forwarding capability. To enable DNS relay on the switch, both the 'ip dns server' command (to activate the DNS forwarder) and 'ip name-server 8.8.8.8' (to point to an upstream resolver) are required.

Option A provides the necessary configuration to restore DNS resolution and internet connectivity.

Exam trap

Do not assume that internet connectivity issues are always routing problems. When a client can ping the gateway but cannot access websites, the issue is often DNS. Also, remember that 'ip name-server' configures DNS servers, while 'ip domain-lookup' only enables the DNS client feature.

Why the other options are wrong

A default gateway is needed only for management traffic from the switch itself, not for DNS forwarding; the switch already communicates with the router via its default route.

A static default route is already present and unrelated to DNS resolution; adding another route would not solve the name resolution failure.

The 'ip domain-lookup' command only enables the DNS client on the switch itself, not DNS forwarding for clients like PC1.

Practice this question →

MCQhard

A network technician is troubleshooting a connectivity issue for a PC connected to switch port Gi1/0/12. The PC can ping its default gateway (192.168.10.1) but cannot ping a server at 192.168.20.10. The switch is configured with VLAN 10 for the access port and is connected to a router-on-a-stick. The technician runs 'show vlan brief' and 'show interfaces trunk' on the switch. What is the most likely cause of the problem?

A.The trunk port Gi1/0/24 is not in trunking mode.

B.The router is missing a subinterface for VLAN 20.

C.The switch port Gi1/0/12 is not assigned to VLAN 10.

D.The PC has a duplicate IP address with the server.

AnswerB

This is the correct answer because the router is configured for router-on-a-stick inter-VLAN routing but only has a subinterface for VLAN 10. Since the router lacks a subinterface with the appropriate 802.1Q encapsulation and an IP address in the VLAN 20 subnet, it simply drops or ignores VLAN 20 frames arriving over the trunk. Even though the switch and trunk are configured correctly, VLAN 20 hosts have no default gateway on the router and therefore cannot route traffic to VLAN 10 or any other network.

Why this answer

The PC can ping its default gateway (192.168.10.1) but not the server at 192.168.20.10, indicating Layer 3 routing is failing between VLANs. Since the switch is configured with VLAN 10 for the access port and uses a router-on-a-stick, the router must have a subinterface for VLAN 20 to route traffic to the server's subnet. The absence of a subinterface for VLAN 20 prevents the router from forwarding packets from VLAN 10 to VLAN 20, making option B correct.

Exam trap

Cisco often tests the misconception that a trunk misconfiguration (option A) is the cause, but the PC's ability to ping the gateway confirms the trunk is working for VLAN 10, so the real issue is the missing subinterface for the destination VLAN.

Why the other options are wrong

The trunk port Gi1/0/24 is in 'on' mode and trunking, as shown in 'show interfaces trunk'. Therefore, the trunk is operational and not the cause of the issue.

The 'show vlan brief' output shows that port Gi1/0/12 is assigned to VLAN 10, so the PC is in the correct VLAN. This is not the issue.

A duplicate IP address would cause connectivity issues to the gateway as well, but the PC can ping the gateway successfully. Therefore, duplicate IP is not the problem.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to describe the TCP three-way handshake process between a client and a server.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The TCP three-way handshake begins with the client sending a SYN (A) to initiate the connection. The server replies with a SYN-ACK (B) to acknowledge the client's SYN and provide its own sequence number. Finally, the client sends an ACK (C) to confirm the server's SYN, completing the handshake.

Option D, "Server sends ACK (ack=x+1)," is not part of the three-way handshake; an ACK from the server would be redundant at this stage and actually occurs during the four-way connection termination, not establishment.

Exam trap

The most common trap is confusing the order of the handshake or thinking the server sends a plain ACK instead of a SYN-ACK. Remember: the client always initiates with SYN, the server replies with SYN-ACK, and the client finishes with ACK.

Practice this question →

MCQhard

A host is configured with IP address 10.10.40.78/28. Which subnet contains that host?

A.10.10.40.48/28

B.10.10.40.64/28

C.10.10.40.72/28

D.10.10.40.80/28

AnswerB

With a /28 prefix length, the subnet mask is 255.255.255.240, and each subnet contains 16 addresses. The network address .64 starts the block .64–.79, where .64 is the network ID and .79 is the broadcast address. The host .78 is between these two, making it a valid host address within this subnet. Therefore, 10.10.40.64/28 is the correct network that contains .78.

Why this answer

A /28 subnet has a block size of 16. In simple terms, the fourth-octet ranges are 0–15, 16–31, 32–47, 48–63, 64–79, 80–95, and so on. Because 78 falls inside the 64–79 block, the network address for this host’s subnet is 10.10.40.64/28.

This style of subnetting question checks whether you can move from prefix length to block size and then place the host into the correct range. The common mistake is choosing the nearest familiar-looking number instead of the actual block boundary.

Exam trap

Avoid selecting a subnet range based on the nearest familiar-looking number; always calculate the correct block boundary.

Why the other options are wrong

The subnet 10.10.40.48/28 includes addresses 10.10.40.48 through 10.10.40.63. The host address 10.10.40.78 is outside this range, so it does not belong to this subnet.

The subnet 10.10.40.72/28 is not a valid subnet because /28 subnets have boundaries that are multiples of 16. The valid subnet starting addresses for /28 are 0, 16, 32, 48, 64, 80, etc. 72 is not a multiple of 16, so this is not a valid network address.

The subnet 10.10.40.80/28 includes addresses 10.10.40.80 through 10.10.40.95. The host address 10.10.40.78 is below this range, so it does not belong to this subnet.

Practice this question →

MCQhard

A host is configured with 192.168.60.33/26. Which address is the network address of its subnet?

A.192.168.60.0

B.192.168.60.32

C.192.168.60.64

D.192.168.60.63

AnswerA

The /26 prefix length corresponds to a 255.255.255.192 subnet mask, dividing the fourth octet into blocks of 64 addresses. Since the host address 192.168.60.33 falls within the range 0 through 63, the network address for this block is 192.168.60.0, where all host bits are zero. Valid /26 network boundaries occur at multiples of 64: .0, .64, .128, and .192, so .0 is the only correct network address for this host.

Why this answer

A /26 uses blocks of 64 addresses. In practical terms, the fourth-octet ranges are 0–63, 64–127, 128–191, and 192–255. Since 33 falls within the 0–63 block, the network address is 192.168.60.0.

This is a straightforward boundary-identification question, but it catches people who memorize masks without understanding block sizes. The right approach is to find the correct block first, then take the first address in that block as the network address.

Exam trap

Avoid confusing the first usable host address with the network address. Always identify the block range first.

Why the other options are wrong

The /26 subnet mask has a block size of 64, not 32. The network addresses for /26 are 0, 64, 128, and 192. 192.168.60.32 is not a valid network address because it is not a multiple of 64.

192.168.60.64 is the network address of the next /26 subnet (64–127). The host address 192.168.60.33 belongs to the 0–63 range, not the 64–127 range.

192.168.60.63 is the broadcast address of the 192.168.60.0/26 subnet, not the network address. The network address is always the first address in the subnet (all host bits set to 0).

Practice this question →

Multi-Selectmedium

Which three statements are true about the operation of Dynamic Host Configuration Protocol (DHCP) in an enterprise network? (Choose three.)

Select 3 answers

.A DHCP client sends a DHCPDISCOVER message as a broadcast to locate a DHCP server.

.A DHCP server uses the client's MAC address to uniquely identify and assign an IP address.

.DHCP options, such as default gateway and DNS server, are included in DHCPOFFER and DHCPACK messages.

.A DHCP relay agent is required only if the client and server are on the same subnet.

.The DHCPREQUEST message is always sent as a unicast directly to the DHCP server.

.DHCP ensures that IP addresses are permanently assigned and never expire.

Why this answer

The DHCP client sends a DHCPDISCOVER message as a broadcast (destination IP 255.255.255.255) because it does not yet know the IP address of any DHCP server. The server uses the client's MAC address (from the CHADDR field) to uniquely identify the client and assign an IP address. DHCP options like default gateway and DNS server are carried in the DHCPOFFER and DHCPACK messages as part of the Options field, allowing the server to provide essential network configuration parameters.

Exam trap

Cisco often tests the misconception that DHCPREQUEST is always unicast, but in the initial DORA exchange, it is broadcast until the client receives an ACK and configures its IP; the trap here is confusing the renewal process with the initial lease acquisition.

Practice this question →

PBQhard

You are troubleshooting a wireless client connectivity issue on the Cisco WLC at 192.168.1.100. The client reports it can see the SSID 'CorpNet' and successfully associates, but cannot obtain an IP address or reach network resources. The WLAN is already configured with WPA3 security, and the SSID should remain hidden. Identify and correct the configuration issue.

Hints

•Check which interface the WLAN is mapped to.
•The management interface is not meant for client data traffic.
•Use the 'config wlan interface' command to change the binding.

A.The WLAN is mapped to the management interface. Use 'config wlan interface 1 CorpNet_VLAN' to assign the correct interface.

B.The SSID is not hidden. Use 'config wlan disable-broadcast-ssid 1 enable' to hide the SSID.

C.WPA3 is not enabled on the WLAN. Use 'config wlan security wpa akm 6 enable' to enable WPA3.

D.The WLAN is disabled. Use 'config wlan enable 1' to enable the WLAN.

AnswerA

solution

! WLC
config wlan interface 1 CorpNet_VLAN

Why this answer

The WLAN is incorrectly mapped to the management interface, which places client traffic in the management VLAN instead of the correct CorpNet_VLAN. As a result, clients cannot obtain IP addresses or communicate beyond the WLC. Reassigning the WLAN to the CorpNet_VLAN interface with 'config wlan interface 1 CorpNet_VLAN' resolves the issue by placing client data in the proper VLAN.

Exam trap

Clients seeing the SSID indicates the WLAN is enabled and broadcasting; association can complete even on the wrong interface. The actual symptom is a lack of IP connectivity, not an association failure. Always check the WLAN-to-interface mapping when clients associate but cannot reach network services.

Why the other options are wrong

Hiding the SSID is already satisfied; changing broadcast settings would make the SSID visible, contradicting the requirement.

WPA3 is already enabled on the WLAN, so there is no need to configure security. The client associates successfully, proving security is not the issue.

The WLAN is enabled because the client can see the SSID and associates; enabling it again would not fix the VLAN mismatch.

Practice this question →

Multi-Selectmedium

Which two statements accurately compare SLAAC and DHCPv6?

Select 2 answers

A.SLAAC allows a host to form its own address using information from router advertisements.

B.DHCPv6 can be used to provide host configuration in a more server-driven way.

C.SLAAC requires NAT to function.

D.DHCPv6 replaces the need for router advertisements completely.

E.Neither SLAAC nor DHCPv6 can provide any addressing information to hosts.

AnswersA, B

SLAAC (Stateless Address Autoconfiguration) enables a host to automatically configure its own IPv6 address by using the prefix information contained in router advertisements sent by a local router. The host generates the interface identifier portion of the address, typically using EUI-64 or a random value, and combines it with the advertised prefix to create a unique global or link-local address. This process is stateless because the router does not track or assign individual addresses to hosts.

Why this answer

SLAAC and DHCPv6 are both IPv6 host-configuration approaches, but they are not the same. In practical terms, SLAAC lets a host build its own address using router advertisements and the advertised prefix, while DHCPv6 can be used to provide addressing information or other configuration in a more server-driven way. Depending on design, IPv6 networks can use one, the other, or a mixture of behaviors.

The key is not to oversimplify. SLAAC is not “IPv6 DHCP,” and DHCPv6 is not the only way IPv6 hosts learn how to operate. Router advertisements remain very important.

Exam trap

Do not assume DHCPv6 is the only way to configure IPv6 addresses or settings; SLAAC also plays a crucial role.

Why the other options are wrong

SLAAC does not require NAT because IPv6 has a vast address space, eliminating the need for address translation. NAT is a workaround for IPv4 address exhaustion and is not used in native IPv6 networks. SLAAC relies on router advertisements to provide prefix information, and hosts generate their own addresses without any translation.

DHCPv6 does not replace router advertisements; in fact, router advertisements are still required for hosts to determine the default gateway and other network parameters. Even when DHCPv6 is used, hosts rely on RAs to learn the on-link prefix and to decide whether to use stateful or stateless configuration.

Both SLAAC and DHCPv6 can provide addressing information to hosts. SLAAC allows hosts to form their own addresses from prefix information in RAs, while DHCPv6 can assign addresses and other configuration parameters. Therefore, the statement that neither can provide addressing information is false.

Practice this question →

MCQhard

A host is configured with 10.10.10.33/27. What is the broadcast address of its subnet?

A.10.10.10.31

B.10.10.10.63

C.10.10.10.32

D.10.10.10.64

AnswerB

10.10.10.63 is correct because the /27 prefix length gives a block size of 2^(32-27)=32 addresses, meaning subnets align on boundaries of 32 in the last octet. The host 10.10.10.33 falls within the 10.10.10.32 to 10.10.10.63 range, and the broadcast address is always the highest (last) address in that subnet block, which is 10.10.10.63. This matches the definition of a directed broadcast for that subnet.

Why this answer

A /27 uses address blocks of 32. In practical terms, the ranges are 0–31, 32–63, 64–95, and so on. Because .33 falls inside the 32–63 block, the broadcast address is the last address in that block, which is 10.10.10.63.

This is a classic subnet-boundary question. The trick is to identify the correct block first and then choose its last address as the broadcast.

Exam trap

Don't confuse the network address or the next subnet's start with the broadcast address. Always calculate the correct range first.

Why the other options are wrong

10.10.10.31 is the broadcast address of the previous /27 subnet (10.10.10.0–10.10.10.31), not the subnet containing .33.

10.10.10.32 is the network address (subnet ID) of the subnet containing .33, not the broadcast address. The network address is the first address in the block.

10.10.10.64 is the network address of the next /27 subnet (10.10.10.64–10.10.10.95), not the broadcast address of the subnet containing .33.

Practice this question →

Matchingmedium

Drag and drop the wireless terms on the left to the correct descriptions on the right. Options: A: SSID: The network name broadcast by an access point to identify the wireless network. B: BSSID: The MAC address of the access point's radio interface, used to uniquely identify a BSS. C: RSSI: A measurement of the power level of the received radio signal, indicating signal strength. D: DFS: A mechanism that allows wireless devices to avoid interference with radar systems by dynamically selecting channels.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Uses only the 5 GHz band and supports up to 160 MHz channel bonding

Introduces OFDMA and supports both 2.4 GHz and 5 GHz bands

Uses Simultaneous Authentication of Equals (SAE) for secure pre-shared key authentication

A single AP and its associated clients, identified by a BSSID

Centralized management device that handles AP configuration, roaming, and security policies

Why these pairings

SSID (Service Set Identifier) is the network name broadcast by an access point to identify the wireless network, allowing clients to distinguish between different networks. BSSID (Basic Service Set Identifier) is the MAC address of the AP's radio interface, uniquely identifying a specific BSS. RSSI (Received Signal Strength Indicator) measures the power level of the received radio signal, indicating signal strength.

DFS (Dynamic Frequency Selection) is a mechanism that allows wireless devices to avoid interference with radar systems by dynamically selecting channels. Each term correctly matches the provided description.

Exam trap

A common mistake is confusing BSSID with SSID—BSSID is the MAC address, not the network name. Another trap is thinking RSSI is a percentage, but it is a relative measurement of signal power, often represented as a negative dBm value.

Practice this question →

PBQhard

You are connected to R1. Configure IPv4 and IPv6 addressing on interfaces G0/0 and G0/1 so that R1 can reach R2's loopback0 (198.51.100.1/32) and R2 can reach R1's loopback0 (203.0.113.1/32). The current configuration has a wrong subnet mask on R1 G0/0 and a missing default gateway on R2, causing reachability failures. Additionally, configure IPv6 using EUI-64 on R1 G0/1 and static IPv6 on R2 G0/1 to enable IPv6 ping between the two routers. All devices are routers.

Network Topology

Hints

•Check the subnet mask on R1 G0/0: it does not match R2's /30.
•R2 has no route to reach R1's loopback or the 192.168.1.0/24 network; it needs a default gateway.
•R2's IPv6 address is on a different subnet (2001:db8:2::/64) than R1's (2001:db8:1::/64); they must be on the same subnet.

A.On R1 G0/0, change subnet mask to 255.255.255.252; on R2, add ip route 0.0.0.0 0.0.0.0 10.0.0.1; for IPv6, on R2 G0/1 change address to 2001:db8:1::2/64.

B.On R1 G0/0, change subnet mask to 255.255.255.0; on R2, add ip route 0.0.0.0 0.0.0.0 10.0.0.1; for IPv6, on R2 G0/1 change address to 2001:db8:1::2/64.

C.On R1 G0/0, change subnet mask to 255.255.255.252; on R2, add ip route 0.0.0.0 0.0.0.0 10.0.0.2; for IPv6, on R2 G0/1 change address to 2001:db8:2::2/64.

D.On R1 G0/0, change subnet mask to 255.255.255.252; on R2, add ip route 0.0.0.0 0.0.0.0 10.0.0.1; for IPv6, on R2 G0/1 change address to 2001:db8:1::2/64 and on R1 G0/1 use static IPv6 instead of EUI-64.

AnswerA

solution

! R1
interface GigabitEthernet0/0
ip address 10.0.0.1 255.255.255.252
exit
interface GigabitEthernet0/1
ipv6 address 2001:db8:1::/64 eui-64
exit

! R2
interface GigabitEthernet0/1
ip address 192.168.1.2 255.255.255.0
ipv6 address 2001:db8:1::2/64
exit
ip route 0.0.0.0 0.0.0.0 10.0.0.1

Why this answer

The primary IPv4 issues are a subnet mask mismatch on the point-to-point link and a missing default gateway on R2. On R1 G0/0, the mask is /24 instead of /30; while both routers can reach each other directly, the mismatched subnet mask causes routing inconsistencies because R1 advertises the link as a /24, potentially affecting routing decisions. Fixing the mask to /30 ensures both routers agree on the subnet.

R2 lacks a route to R1's loopback and the 192.168.1.0/24 network, so a default route via 10.0.0.1 resolves reachability. For IPv6, R1 G0/1 uses EUI-64, and R2 G0/1 must be on the same subnet (2001:db8:1::/64); R2's address was incorrectly set to 2001:db8:2::2/64, so changing it to 2001:db8:1::2/64 enables IPv6 ping.

Exam trap

Watch for subnet mask mismatches on point-to-point links; both ends must use the same mask. Also, ensure default routes point to the correct next-hop IP (the neighbor's interface IP). For IPv6, both interfaces must be on the same subnet to communicate directly.

Why the other options are wrong

The subnet mask on R1 G0/0 should be /30 to match R2, not /24.

The default gateway must be the neighbor's IP address, and IPv6 subnets must match for direct communication.

The requirement states EUI-64 on R1 G0/1, so static is not allowed.

Practice this question →

Multi-Selecthard

Which two statements accurately compare IPv4 private addresses and public addresses?

Select 2 answers

A.Private IPv4 addresses are not directly Internet-routable.

B.Public IPv4 addresses are intended to be globally unique and routable.

C.Private IPv4 addresses always require OSPF to function inside a LAN.

D.Public IPv4 addresses cannot exist on Internet-facing devices.

E.Private and public IPv4 addresses are both automatically translated by ARP.

AnswersA, B

Correct because RFC 1918 defines private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that are not globally routable; Internet routers are configured to discard packets with these source or destination addresses. This is enforced by ISPs and core routers to prevent conflicts and routing loops, since these addresses are reused by countless internal networks. To access the Internet, private addresses must be translated to a public address using NAT.

Why this answer

Private IPv4 addresses are intended for internal use and are not directly routable on the public Internet. In plain language, they are designed for use inside organizations, homes, and other local environments without consuming globally unique public space. Public addresses, by contrast, are intended to be unique and routable across the Internet. This is one of the main reasons NAT became so common in IPv4 environments.

CCNA questions often test this distinction because learners sometimes confuse “valid inside a LAN” with “routable everywhere.” Private addressing is extremely useful, but it does not eliminate the need for translation or public addressing when reaching the Internet. The two correct statements are the ones that preserve that basic separation between internal-use ranges and globally routable address space.

Exam trap

Be careful not to confuse the routability of private addresses with their validity within a LAN. Private addresses need NAT for Internet access.

Why the other options are wrong

Private IPv4 addresses do not require OSPF or any specific routing protocol to function inside a LAN; they can operate with static routes or any dynamic routing protocol. OSPF is just one option and is not mandatory.

Public IPv4 addresses are specifically used on Internet-facing devices to enable global reachability. Without public addresses, devices would not be directly accessible from the Internet.

ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses on a local network segment and does not perform any translation between private and public addresses. NAT (Network Address Translation) handles that translation.

Practice this question →

Multi-Selectmedium

Which TWO statements accurately describe the responsibilities of the OSI model's Transport layer?

Select 2 answers

A.It provides logical addressing and routing to determine the best path for data.

B.It segments data from the upper layers and manages end-to-end flow control.

C.It converts data into electrical signals for transmission over the physical medium.

D.It provides reliable or unreliable delivery of data between applications on different hosts.

E.It encapsulates data into frames and adds source and destination MAC addresses.

AnswersB, D

The Transport layer is responsible for segmenting data received from upper-layer protocols into smaller, manageable units called segments. TCP, for example, implements end-to-end flow control using a sliding window, which prevents a fast sender from overwhelming a slower receiver by adjusting the amount of data transmitted before requiring an acknowledgment. This explicit segmentation and flow-control management is separate from the delivery-reliability service, though both are Transport-layer duties.

Why this answer

The Transport layer (Layer 4) segments data from upper layers and manages end-to-end flow control using mechanisms like TCP's sliding window to prevent overwhelming a slow receiver. Option D is correct because the Transport layer provides either reliable delivery (TCP) or unreliable delivery (UDP) between applications on different hosts, ensuring data reaches the appropriate application via port numbers. Option A is incorrect because logical addressing and routing are functions of the Network layer (Layer 3).

Option C is incorrect because converting data into electrical signals is the responsibility of the Physical layer (Layer 1). Option E is incorrect because encapsulating data into frames with MAC addresses is a function of the Data Link layer (Layer 2).

Exam trap

Cisco often tests the distinction between Transport layer flow control (end-to-end) and Network layer congestion control (path-based), leading candidates to confuse Layer 4 segmentation with Layer 3 routing functions.

Why the other options are wrong

Logical addressing and routing are Network layer (Layer 3) functions, not Transport layer responsibilities.

Converting data into electrical signals is the Physical layer (Layer 1) function, not Transport layer.

Encapsulation into frames with MAC addresses is a Data Link layer (Layer 2) function, not Transport layer.

Practice this question →

MCQmedium

A network engineer is troubleshooting a connectivity issue between two hosts on different subnets. The sending host has constructed a packet with a destination IP address of 192.168.2.10. As the packet travels down the OSI model layers on the sending host, which Protocol Data Unit (PDU) name is assigned to the data at the Transport layer after TCP segments are created, and at which layer does the IP address get encapsulated?

A.PDU is a frame; IP address is added at the Data Link layer.

B.PDU is a segment; IP address is added at the Network layer.

C.PDU is a packet; IP address is added at the Transport layer.

D.PDU is a datagram; IP address is added at the Transport layer.

AnswerB

At the Transport layer, TCP encapsulates the application data into a segment, adding source and destination port numbers. This segment is then passed down to the Network layer, where the IP header—containing source and destination IP addresses—is added to create a packet. This is the correct sequence of encapsulation for TCP/IP communication.

Why this answer

At the Transport layer, TCP divides data into segments, so the PDU is called a segment, making B correct. The destination IP address (192.168.2.10) is added at the Network layer, where the IP header encapsulates the segment into a packet. Option A is wrong because a frame is a Data Link layer PDU, and IP addresses are not added at that layer.

Option C is wrong because the PDU at the Transport layer is a segment, not a packet, and IP addresses are added at the Network layer, not the Transport layer. Option D is wrong because 'datagram' typically refers to UDP’s Transport layer PDU (not TCP), and IP addresses are not added at the Transport layer.

Exam trap

Cisco often tests the precise PDU naming per layer (segment for TCP at Transport, packet for IP at Network) and the layer where IP addresses are added, tricking candidates who confuse 'packet' with 'segment' or think IP addresses are added at the Transport layer.

Why the other options are wrong

The PDU at the Transport layer is a segment, not a frame. Frames are the PDU at the Data Link layer (Layer 2). Additionally, IP addresses are added at the Network layer (Layer 3), not the Data Link layer.

A packet is the PDU at the Network layer (Layer 3), not the Transport layer. The IP address is added at the Network layer, not the Transport layer. The Transport layer PDU is a segment (for TCP) or a datagram (for UDP).

A datagram is the PDU for UDP at the Transport layer, but the question specifies TCP segments. Even if it were UDP, the IP address is still added at the Network layer, not the Transport layer.

Practice this question →

PBQhard

You are connected to R1. The network administrator has partially configured IPv4 and IPv6 on the interfaces. However, PC1 (connected to R1's G0/1) cannot reach PC2 (connected to R2's G0/1). Configure R1 and R2 so that PC1 can ping PC2. Fix any addressing errors. Use IPv4 subnet 192.0.2.0/30 for the link between R1 and R2, and 198.51.100.0/24 for the PC LANs. For IPv6, use 2001:db8:1::/64 on R1's G0/1 and 2001:db8:2::/64 on R2's G0/1, with R1's G0/1 using EUI-64 and R2's G0/1 using a static address 2001:db8:2::1/64.

Hints

•Check the subnet mask on the link between R1 and R2.
•IPv6 EUI-64 requires the interface to be up and unicast-routing enabled.
•Ensure both routers have routes to each other's LANs.

A.On R1, change the subnet mask on G0/0 from /24 to /30. On R1 G0/1, issue 'ipv6 address 2001:db8:1::/64 eui-64' and 'no shutdown'. Enable 'ipv6 unicast-routing' globally on both routers.

B.On R1, change the subnet mask on G0/0 from /24 to /30. On R1 G0/1, issue 'ipv6 address 2001:db8:1::/64 eui-64' and 'no shutdown'. No need to enable IPv6 unicast-routing because it is on by default.

C.On R1, change the subnet mask on G0/0 from /24 to /30. On R1 G0/1, issue 'ipv6 address 2001:db8:1::/64' (without eui-64) and 'no shutdown'. Enable 'ipv6 unicast-routing' globally on both routers.

D.On R1, change the subnet mask on G0/0 from /24 to /30. On R1 G0/1, issue 'ipv6 address 2001:db8:1::/64 eui-64' and 'no shutdown'. Enable 'ipv6 unicast-routing' globally on both routers. Also, change the default gateway on PC1 to 2001:db8:1::1.

AnswerA

solution

! R1
interface GigabitEthernet0/0
ip address 192.0.2.1 255.255.255.252
exit
interface GigabitEthernet0/1
ipv6 address 2001:db8:1::/64 eui-64
no shutdown
exit
ipv6 unicast-routing

! R2

Why this answer

The issue is a subnet mask mismatch on the link between R1 and R2: R1 uses /24 (255.255.255.0) while R2 uses /30 (255.255.255.252). This prevents R1 from having a route to R2's LAN. Fix R1's G0/0 mask to /30.

Additionally, R1's G0/1 IPv6 EUI-64 command is missing the interface identifier; the correct command is 'ipv6 address 2001:db8:1::/64 eui-64' but the interface must be enabled with 'no shutdown'. Also ensure IPv6 unicast-routing is enabled. The PCs have correct gateways.

Exam trap

Watch for subnet mask mismatches on point-to-point links; they break routing. Also, remember that IPv6 unicast-routing is disabled by default and must be enabled. EUI-64 requires the 'eui-64' keyword and generates an address based on MAC, not a static ::1.

Why the other options are wrong

The specific factual error is that IPv6 unicast-routing is disabled by default on Cisco routers.

The specific factual error is that the command without 'eui-64' assigns a static address, not an EUI-64 address.

The specific factual error is assuming the EUI-64 address ends with ::1, which is not guaranteed.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to isolate and resolve interface CRC errors, duplex mismatches, and flapping on a Cisco IOS-XE switch.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Start with checking statistics to identify issues, then verify duplex and cable, replace hardware if needed, and finally confirm resolution.

Exam trap

Candidates often jump to hardware replacement or configuration changes without first gathering data. Always start with 'show interface' statistics to pinpoint the issue before taking corrective action.

Practice this question →

MCQhard

A network technician is troubleshooting a link between two Cisco switches, SW1 and SW2, connected via a single-mode fiber optic cable. The interface on SW1 is up/up, but the interface on SW2 remains down/down. The technician has verified that the fiber cable is not damaged and that the SFP modules are correctly seated. Which configuration change should the technician make to resolve the issue?

A.Configure the interface on SW2 to use the same speed and duplex settings as SW1.

B.Replace the 1000BaseSX SFP on SW2 with a 1000BaseLX SFP.

C.Enable MDIX on both interfaces to allow automatic crossover detection.

D.Change the VLAN assignment on SW2's interface to match that of SW1.

AnswerB

SW1's 1000BaseLX SFP operates at 1300 nm on single-mode fiber, while SW2's 1000BaseSX SFP operates at 850 nm on multimode fiber; the wavelength difference means the electrical-to-optical conversion at the receiver cannot interpret the incoming light signal. With a down/down status, the root cause is a media-type mismatch, so replacing the SX module with an LX SFP on SW2 ensures both ends use the same 1300 nm wavelength and fiber mode. This allows the physical layer to establish a signal and bring the interface up.

Why this answer

The issue is that SW1 is up/up but SW2 is down/down, indicating a unidirectional link. Since the fiber cable and SFP seating are verified, the most likely cause is an SFP wavelength mismatch. SW1 likely has a 1000BaseLX SFP (long-wavelength, single-mode), while SW2 has a 1000BaseSX SFP (short-wavelength, multimode).

Single-mode fiber requires LX optics; SX optics are designed for multimode fiber and will not produce a signal that can be received correctly over single-mode fiber, causing the remote interface to remain down. Replacing the 1000BaseSX SFP on SW2 with a 1000BaseLX SFP resolves the wavelength incompatibility.

Exam trap

Cisco often tests the misconception that fiber link issues are always due to physical damage or seating, when in fact the most common exam trap is an SFP type mismatch (SX vs. LX) on single-mode fiber, causing a unidirectional link.

Why the other options are wrong

On fiber optic links, speed and duplex are typically fixed (e.g., 1000 Mbps full duplex) and do not require manual configuration; auto-negotiation is standard for Gigabit Ethernet over fiber. Since the interface on SW1 is up/up, the settings are already compatible, so this change would not resolve the down/down state on SW2.

MDIX (Medium Dependent Interface Crossover) is a feature for copper Ethernet cables to automatically correct for straight-through vs. crossover cable issues. Fiber optic connections do not use MDIX because they use separate transmit and receive fibers, so enabling MDIX has no effect on fiber links.

A VLAN mismatch would cause the interface to be up/up but not forward traffic (Layer 2 issue), not the down/down state observed. The down/down state indicates a Layer 1 problem, such as a physical or optical incompatibility.

Practice this question →

MCQhard

A subnet must support at least 62 usable hosts. Which prefix will create the smallest subnet that meets the requirement?

A./27

B./26

C./25

D./24

AnswerB

This is correct because a /26 provides 64 total addresses and 62 usable hosts.

Why this answer

To support at least 62 usable hosts, the subnet needs 64 total addresses, because two of those will be reserved for the network and broadcast addresses. In plain language, the target is not 62 total addresses; it is 62 usable ones after the two reserved values are taken away. A /26 provides exactly 64 total addresses and therefore 62 usable host addresses.

This is a classic minimum-prefix question because it checks whether you can convert a host requirement into the correct power-of-two subnet size without over-allocating unnecessarily. A /27 would be too small, while /25 would work but would waste more addresses than needed. The smallest valid prefix is /26.

Exam trap

Ensure you calculate usable hosts, not total addresses. Remember that network and broadcast addresses are not usable.

Why the other options are wrong

A /27 prefix provides only 32 total addresses (2^(32-27)=32), with 30 usable hosts after subtracting network and broadcast addresses. This is insufficient for the requirement of at least 62 usable hosts.

A /25 prefix provides 128 total addresses and 126 usable hosts, which is more than required. While it meets the requirement, it is not the smallest prefix, leading to wasted IP addresses in a subnet.

A /24 prefix provides 256 total addresses and 254 usable hosts, far exceeding the requirement of 62 usable hosts. This is not the smallest prefix and results in significant waste of IP address space.

Practice this question →

Matchingmedium

Match each IPv6 concept to its most accurate description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

IPv6 addressing used for wider routed communication

IPv6 addressing used only on the local segment

Host self-configuration using router advertisements

OSPF version used for IPv6 routing operation

Why these pairings

These pairings accurately define key IPv6 concepts.

Exam trap

Be careful not to confuse the scope of IPv6 address types. Link-local addresses are not routable, unique local addresses are private, and anycast is one-to-nearest, not one-to-many. Remember that 'local' in link-local means the link, not the site.

Practice this question →

Multi-Selectmedium

Which TWO statements accurately describe the encapsulation process and PDU naming across the OSI and TCP/IP models?

Select 2 answers

A.At the Transport layer, the TCP/IP model uses segments, while the OSI model uses packets.

B.In the OSI model, the Network layer encapsulates data into packets, while in the TCP/IP model the Internet layer performs the same function.

C.The term 'frame' is used at the Data Link layer in both the OSI and TCP/IP models, and it contains the Layer 2 header and trailer.

D.Encapsulation adds headers and trailers at each layer, so the PDU size decreases as data moves down the stack.

E.The OSI model's Session layer is responsible for end-to-end flow control using TCP segments, while the TCP/IP model combines this into the Application layer.

AnswersB, C

This is correct. The OSI Network layer (Layer 3) and the TCP/IP Internet layer are conceptually equivalent; both encapsulate the Transport layer PDU (segment or datagram) into an IP packet by adding a Layer 3 header. This packet is then passed down to the Data Link layer for framing. Thus, the function is identical in both models.

Why this answer

The OSI Network layer and the TCP/IP Internet layer both encapsulate transport layer segments or datagrams into packets by adding a Layer 3 header (e.g., IP header). This is the fundamental encapsulation step where logical addressing is applied, and the resulting PDU is called a packet in both models. The function is identical despite the different layer names.

Exam trap

Cisco often tests the precise PDU naming per layer (segment, packet, frame) and the fact that encapsulation increases PDU size, not decreases it, to catch candidates who confuse the direction of encapsulation or mix up OSI and TCP/IP layer terminology.

Why the other options are wrong

Misattributes the 'packet' PDU to the Transport layer – packets are created at the Network layer (Layer 3).

Reverses encapsulation logic: each layer adds its own overhead, increasing the size.

Incorrectly assigns flow control to the Session layer and misrepresents its placement in the TCP/IP model.

Practice this question →

PBQmedium

You are connected to the console of SW1. The network administrator reports that SW1 cannot discover neighbouring devices using CDP. SW1 is connected to R1 via GigabitEthernet0/1. CDP is globally enabled, but still no neighbours are shown.

Network Topology

Hints

•CDP is enabled globally but may be disabled per interface.
•Check the CDP status on the specific interface.
•Enable CDP on the interface with the 'cdp enable' command.

A.Enable CDP on interface GigabitEthernet0/1 with the command 'cdp enable'.

B.Enable CDP globally with the command 'cdp run'.

C.Use the command 'lldp run' to enable LLDP as an alternative.

D.Check the physical cable and interface status on GigabitEthernet0/1.

AnswerA

solution

! SW1
interface GigabitEthernet0/1
cdp enable

Why this answer

CDP was globally enabled but the interface GigabitEthernet0/1 had CDP disabled by default (or was explicitly disabled). Enabling CDP on the interface allowed neighbour discovery.

Exam trap

The trap is that candidates often think CDP is either globally enabled or disabled, forgetting that CDP must be enabled on each interface individually. Always check interface-level CDP configuration when global CDP is enabled but no neighbors are discovered.

Why the other options are wrong

The specific factual error is that 'cdp run' enables CDP globally, but global CDP is already enabled.

The specific factual error is that LLDP is a different protocol and does not affect CDP operation.

The specific factual error is that physical issues would likely cause the interface to be down, but the question does not indicate any physical problem.

Multi-Selectmedium

Which two statements accurately describe ARP in an IPv4 Ethernet network?

Select 2 answers

A.ARP resolves a known IPv4 address to a MAC address on the local segment.

B.ARP is used to choose the best Layer 3 path across multiple routers.

C.ARP requests are typically sent as broadcasts on the local LAN.

D.ARP can normally resolve the MAC address of a host located across a routed network.

E.ARP replaces the need for a default gateway.

AnswersA, C

ARP operates at the boundary of Layer 2 and Layer 3 on a local Ethernet segment, mapping a known IPv4 address to its corresponding MAC address. This mapping is essential because Ethernet frames require a destination MAC for delivery, while upper-layer applications only provide IP addresses. The ARP cache stores these resolved mappings to avoid repeating the request for every traffic flow.

Why this answer

ARP is the mechanism used to map a known IPv4 address to a Layer 2 MAC address on the local network segment. In plain language, if a device knows the IP address it wants to reach on the same LAN, ARP helps it discover the correct Ethernet destination MAC address to use in the frame. That is why ARP is so important for local delivery in IPv4 Ethernet environments. Without it, devices would know where they want to send traffic logically, but not how to address the actual frame on the local link.

ARP does not cross routers in the usual way, and it is not a routing protocol. It does not determine best paths to remote networks. It simply helps with local resolution of IPv4-to-MAC information. This distinction matters a lot on CCNA questions because many wrong answers try to blur the line between local neighbor resolution and routing behavior.

Exam trap

Do not confuse ARP with routing protocols or assume it functions across routers. Remember, ARP is strictly for local address resolution.

Why the other options are wrong

ARP operates at Layer 2 and is only concerned with resolving IP addresses to MAC addresses on the local link. Path selection between routers is performed by routing protocols (e.g., OSPF, EIGRP) and the routing table, which operate at Layer 3.

ARP requests are broadcast only within the local subnet and are not forwarded by routers. To reach a host on a different subnet, the source host must send the packet to its default gateway, which then uses its own ARP process to resolve the next-hop MAC.

ARP does not replace the default gateway; it only resolves the MAC address of the gateway or other local hosts. The default gateway is still required for routing traffic to other subnets, as ARP cannot provide Layer 3 forwarding.

Practice this question →

Multi-Selectmedium

Which three of the following are functions of the Dynamic Host Configuration Protocol (DHCP) in a network? (Choose three.)

Select 3 answers

.Assigning IP addresses to hosts automatically from a defined pool.

.Providing the default gateway and DNS server information to clients.

.Leasing IP addresses for a configurable period of time.

.Resolving domain names to IP addresses for client devices.

.Authenticating users before granting network access.

.Translating private IP addresses to public IP addresses for internet access.

Why this answer

DHCP automates IP address assignment from a defined pool, eliminating manual configuration. It also provides essential network parameters like the default gateway and DNS server via DHCP options (e.g., Option 3 for router, Option 6 for DNS). Additionally, DHCP leases IP addresses for a configurable period, after which the client must renew the lease to continue using the address.

Exam trap

Cisco often tests the distinction between DHCP providing DNS server information (correct) and DHCP performing DNS resolution (incorrect), as candidates confuse the roles of DHCP and DNS.

Practice this question →

MCQhard

A technician is troubleshooting a dual-stack network where an IPv6-only host cannot reach an IPv4 resource. The technician issues the show ipv6 interface brief command on the local router and notices the interface facing the host has a link-local address but no global unicast address. The technician then checks the running configuration and finds that the command ipv6 unicast-routing is missing. What is the most likely cause?

A.An IPv6 access list on the router is blocking Router Advertisement messages.

B.IPv6 unicast routing has not been enabled on the router.

C.The IPv4 resource is not configured for NAT64 translation.

D.The host has an incorrect default gateway for IPv6.

AnswerB

The ipv6 unicast-routing command is required to enable IPv6 forwarding on Cisco routers. Without it, the router does not participate in IPv6 routing, does not generate Router Advertisements, and interfaces will not obtain global unicast addresses through SLAAC or DHCPv6 relay. The show ipv6 interface output displaying only a link-local address, combined with the absence of ipv6 unicast-routing in the configuration, confirms this root cause.

Why this answer

The missing `ipv6 unicast-routing` command means the router is not acting as an IPv6 router, so it does not send Router Advertisement (RA) messages. Without RAs, the host cannot autoconfigure a global unicast address or learn a default gateway, breaking IPv6 connectivity to any IPv4 resource even if NAT64 is present.

Exam trap

Cisco often tests the misconception that configuring an IPv6 address on an interface is sufficient for IPv6 routing, when in fact the global `ipv6 unicast-routing` command is required to enable the router to forward IPv6 packets and send Router Advertisements.

Why the other options are wrong

This option focuses on a filtering issue, not the disabled routing engine, and would not cause the router’s own interface to lack a global unicast address.

NAT64 configuration would affect translation, but the root cause visible in the output is the lack of IPv6 routing capability on the router.

This shifts the blame to the host, but the router-side evidence (missing command and missing global unicast) clearly indicates a router configuration problem.

Practice this question →

Multi-Selectmedium

Which command or tool would a network engineer use to verify if a client has a duplicate IP address conflict on the local subnet?

Select 2 answers

A.ipconfig /all

B.arp -a

C.nslookup

D.ping

E.tracert

AnswersB, D

arp -a displays the system's ARP cache, which maps IPv4 addresses to MAC addresses for hosts reached on the local subnet. When two devices are using the same IP, the cache may show two different MAC addresses for that same IP, or the mapping may flip back and forth between the two entries as traffic is sent. Examining the ARP table for inconsistent or changing MAC-to-IP pairings is a classic method for detecting an IP address conflict.

Why this answer

The two tools to verify a duplicate IP conflict are arp -a and ping. The arp -a command displays the ARP cache; if a duplicate IP exists, the ARP table may show multiple MAC addresses for the same IP or rapid changes. Ping can be used to send traffic to the local IP address; if a reply is received from a different MAC address than expected, it indicates a conflict.

Together, these commands help network engineers confirm IP address duplication. Other commands like ipconfig /all, nslookup, and tracert do not directly reveal such conflicts.

Exam trap

A common misconception is that ipconfig /all can detect duplicate IPs, but it only displays local configuration. In reality, arp -a and ping are the key tools to identify IP conflicts at the network layer.

Why the other options are wrong

`ipconfig /all` shows only the local IP configuration, not whether the same IP is assigned to another host.

`nslookup` resolves domain names to IP addresses and is unrelated to local IP conflicts.

`tracert` traces the path to a remote host, irrelevant for detecting local subnet duplicate IPs.

Practice this question →

MCQeasy

Which medium is the most common choice for a 10G uplink between wiring closets on different floors of the same building?

A.Rollover cable

B.Fiber optic cable

C.Coaxial cable

D.Console cable

AnswerB

Fiber-optic cable is the standard medium for 10G uplinks because it supports both 10GBASE-SR (multimode, 850 nm VCSELs, up to 300 m on OM3/OM4) and 10GBASE-LR (single-mode, 1310 nm, up to 10 km), providing reach and bandwidth far beyond copper twisted pair. It is immune to electromagnetic interference, has extremely low signal attenuation, and offers the full-duplex symmetric bandwidth required for switch uplinks. Enterprise switches therefore ship with SFP+ slots where fiber transceivers are the default choice for interconnecting access-layer switches to distribution or core switches.

Why this answer

Fiber is commonly used for building uplinks because it supports higher bandwidth and longer distances than typical copper for this use case.

Exam trap

Don't confuse the capabilities of multimode fiber with single-mode fiber for long-distance, high-speed connections.

Why the other options are wrong

A rollover cable is a specialized Cisco console cable used for out-of-band management access to a device's console port, not for network data traffic. It cannot carry 10G Ethernet signals and is physically incompatible with Ethernet interfaces.

Coaxial cable (e.g., RG-6) is primarily used for cable TV, broadband internet (DOCSIS), or legacy Ethernet (10BASE2/10BASE5), but it does not support 10G Ethernet speeds over the distances required between floors in a modern enterprise network. Fiber or twisted-pair copper (Cat6a/Cat7) are the standard 10G media.

A console cable (typically a rollover or USB-to-serial cable) is used for initial device configuration and management access, not for carrying network traffic. It cannot support 10G data rates and is not designed for switch-to-switch uplinks.

Practice this question →

MCQhard

A switch unexpectedly blocks a link toward the distribution layer. Gi1/0/24 shows a path cost of 4 while Gi1/0/23 shows a path cost of 19. Why did interface Gi1/0/24 become the root port instead of Gi1/0/23?

A.Gi1/0/24 has a lower port number, so STP always prefers it first.

B.STP prefers interfaces with the highest path cost to reduce loops.

C.Gi1/0/23 is blocked because alternate ports are always chosen over root ports.

D.has a lower root path cost to the root bridge

AnswerD

This is correct because STP's root port selection is primarily based on the lowest root path cost to reach the root bridge. Gi1/0/24 has a cumulative cost of 4, whereas Gi1/0/23 has a cost of 19, so Gi1/0/24 is chosen as the root port and placed in forwarding state. Consequently, Gi1/0/23 becomes the alternate port with the higher cost and is put into blocking state to prevent Layer 2 loops.

Why this answer

Spanning Tree chooses a root port by looking for the best path toward the root bridge. In this case, Gi1/0/24 shows a cost of 4, while Gi1/0/23 shows a cost of 19. Lower cost is better, so Gi1/0/24 is selected as the root port and moves into forwarding.

Gi1/0/23 becomes an alternate port and is placed into a blocking state to prevent a loop. STP compares root path cost first; only if the cost is tied does it move on to tie-breakers like sender bridge ID and port ID. The lower cost on Gi1/0/24 explains why that port won the root-port election.

Exam trap

Remember that STP prioritizes root path cost over other factors like port numbers or bridge IDs unless there's a tie.

Why the other options are wrong

STP does not use port number as the primary criterion; it is only a tie-breaker when path cost, bridge ID, and sender bridge ID are all equal. Here, the path costs differ, so port number is irrelevant.

STP is designed to select the path with the lowest total cost to the root bridge, not the highest. Choosing a higher-cost path would increase latency and waste bandwidth.

The root port is the forwarding port toward the root bridge, while the alternate port is a blocked backup. The alternate port is not chosen over the root port; it only becomes active if the root port fails.

Practice this question →

MCQmedium

A network administrator is configuring a new Windows workstation on a small office network that uses IPv4 addressing. The workstation must be able to communicate with devices on other subnets and resolve hostnames via a company DNS server at 10.10.10.5. The administrator has already set the IP address to 10.10.10.10 and the subnet mask to 255.255.255.0. Which additional parameter must be configured to meet both requirements?

A.Configure a default gateway of 10.10.10.1 and a DNS server of 10.10.10.5.

B.Configure only a DNS server of 10.10.10.5.

C.Change the subnet mask to 255.255.0.0 to allow communication across subnets.

D.Configure a default gateway of 10.10.20.1 and a DNS server of 10.10.10.5.

AnswerA

This is the correct configuration because both entries are necessary and valid. The default gateway 10.10.10.1 lies on the same subnet as the workstation's IP address, so the host can resolve the gateway's MAC address via ARP and forward all out-of-subnet traffic to it. The router then routes packets between the 10.10.10.0/24 and 10.10.20.0/24 networks, enabling communication with devices on the other subnet. The DNS server 10.10.10.5 is also on the local subnet, allowing name resolution to work without requiring routing. Together, they provide both name resolution and the necessary Layer 3 path.

Why this answer

To communicate with devices on other subnets, the workstation needs a default gateway (router) to forward traffic beyond its local subnet. The IP address 10.10.10.10 with subnet mask 255.255.255.0 places it in the 10.10.10.0/24 network, so a default gateway (e.g., 10.10.10.1) is required for inter-subnet routing. Additionally, to resolve hostnames, the DNS server address must be explicitly configured; the company DNS server is at 10.10.10.5.

Option A correctly provides both parameters.

Exam trap

Cisco often tests the requirement that a default gateway must be on the same subnet as the host; the trap here is that candidates may think a DNS server alone suffices for inter-subnet communication, or they may incorrectly assume changing the subnet mask can replace a router, or they may choose a gateway on a different subnet without realizing it is unreachable.

Why the other options are wrong

Without a default gateway, the workstation cannot send packets to destinations outside its own subnet (10.10.10.0/24). The DNS server alone only provides name resolution, not routing to other subnets.

Changing the subnet mask to 255.255.0.0 would expand the broadcast domain and could cause routing problems, but it does not provide a path to other subnets. The workstation still needs a default gateway to communicate with devices outside its local network.

The default gateway 10.10.20.1 is not on the same subnet as the workstation (10.10.10.0/24). For a host to reach its default gateway, the gateway must be directly reachable on the local subnet. Since 10.10.20.1 is on a different subnet, the workstation cannot send traffic to it.

Practice this question →