CCNA Network Infrastructure and Connectivity Questions

The subnet mask on R1 G0/0 should be /30 to match R2, not /24.

The default gateway must be the neighbor's IP address, and IPv6 subnets must match for direct communication.

The requirement states EUI-64 on R1 G0/1, so static is not allowed.

The specific factual error: 'enable password' does not encrypt the password; 'login' without 'local' allows any password to work if set, but does not use local user database.

The specific factual error: 'login local' requires a local username database, but no username is configured; the VTY password is unnecessary and misleading.

The specific factual error: The question does not require creating a local username; adding one is extraneous and could be considered incorrect in a PBQ where only the specified steps are needed.

The specific factual error: Duplex must match the switch (full), and 1000BASE-SX cannot reach 5 km.

The specific factual error: Speed must match the switch port's configured speed (100 Mbps), not auto-negotiate to 1000 Mbps.

The specific factual error: Auto-negotiation cannot match a manually configured port; both sides must be manually set or both use auto-negotiation.

The specific factual error is that the security mode does not affect SSID visibility; the problem is the broadcast setting.

The specific factual error is that interface mapping controls VLAN assignment for traffic, not SSID broadcast.

The specific factual error is that radio band selection does not affect SSID broadcast; the hidden SSID prevents discovery on any band.

Misconception that speed mismatch produces specific error counters; in reality, incompatible speeds cause link failure, not runts and CRC errors.

Misconception that CRC errors alone point to a bad cable; duplex mismatch is one of the most common causes of runts and CRC errors on forced-full interfaces.

Misconception that a VLAN mismatch can trigger interface errors; these errors are purely physical/data-link layer phenomena unrelated to VLAN settings.

Private IPv4 addresses do not require OSPF or any specific routing protocol to function inside a LAN; they can operate with static routes or any dynamic routing protocol. OSPF is just one option and is not mandatory.

Public IPv4 addresses are specifically used on Internet-facing devices to enable global reachability. Without public addresses, devices would not be directly accessible from the Internet.

ARP (Address Resolution Protocol) resolves IP addresses to MAC addresses on a local network segment and does not perform any translation between private and public addresses. NAT (Network Address Translation) handles that translation.

Invalid syntax: the eui-64 keyword cannot be used with a full 128-bit address; it requires only a prefix.

Missing the eui-64 keyword, so the interface would be configured with a static address rather than deriving the interface ID from the MAC.

Invalid syntax: the eui-64 keyword does not accept an explicit MAC address as an argument.

This statement incorrectly identifies the Transport layer PDU; it is actually a segment or datagram, while a frame is at Layer 2.

Bits are created at the Physical layer, not the Data Link layer; the Data Link layer creates frames.

This describes decapsulation, not encapsulation. Encapsulation occurs when moving down the OSI model stack.

Logical addressing and routing are Network layer (Layer 3) functions, not Transport layer responsibilities.

Converting data into electrical signals is the Physical layer (Layer 1) function, not Transport layer.

Encapsulation into frames with MAC addresses is a Data Link layer (Layer 2) function, not Transport layer.

The PDU at the Transport layer is a segment, not a frame. Frames are the PDU at the Data Link layer (Layer 2). Additionally, IP addresses are added at the Network layer (Layer 3), not the Data Link layer.

A packet is the PDU at the Network layer (Layer 3), not the Transport layer. The IP address is added at the Network layer, not the Transport layer. The Transport layer PDU is a segment (for TCP) or a datagram (for UDP).

A datagram is the PDU for UDP at the Transport layer, but the question specifies TCP segments. Even if it were UDP, the IP address is still added at the Network layer, not the Transport layer.

The statement incorrectly mandates Cat6a cabling, whereas Cat5e and Cat6 also support the full 100-meter distance for 1000BASE-T.

This mixes up part number naming conventions; GLC-T and SFP-GE-T always indicate copper transceivers, not fiber.

TDR relies on electrical signals and impedance changes; it cannot function on fiber optics.

The specific factual error is that IPv6 unicast-routing is disabled by default on Cisco routers.

The specific factual error is that the command without 'eui-64' assigns a static address, not an EUI-64 address.

The specific factual error is assuming the EUI-64 address ends with ::1, which is not guaranteed.

On fiber optic links, speed and duplex are typically fixed (e.g., 1000 Mbps full duplex) and do not require manual configuration; auto-negotiation is standard for Gigabit Ethernet over fiber. Since the interface on SW1 is up/up, the settings are already compatible, so this change would not resolve the down/down state on SW2.

MDIX (Medium Dependent Interface Crossover) is a feature for copper Ethernet cables to automatically correct for straight-through vs. crossover cable issues. Fiber optic connections do not use MDIX because they use separate transmit and receive fibers, so enabling MDIX has no effect on fiber links.

A VLAN mismatch would cause the interface to be up/up but not forward traffic (Layer 2 issue), not the down/down state observed. The down/down state indicates a Layer 1 problem, such as a physical or optical incompatibility.

A /27 prefix provides only 32 total addresses (2^(32-27)=32), with 30 usable hosts after subtracting network and broadcast addresses. This is insufficient for the requirement of at least 62 usable hosts.

A /25 prefix provides 128 total addresses and 126 usable hosts, which is more than required. While it meets the requirement, it is not the smallest prefix, leading to wasted IP addresses in a subnet.

A /24 prefix provides 256 total addresses and 254 usable hosts, far exceeding the requirement of 62 usable hosts. This is not the smallest prefix and results in significant waste of IP address space.

Misattributes the 'packet' PDU to the Transport layer – packets are created at the Network layer (Layer 3).

Reverses encapsulation logic: each layer adds its own overhead, increasing the size.

Incorrectly assigns flow control to the Session layer and misrepresents its placement in the TCP/IP model.

The specific factual error is that 'cdp run' enables CDP globally, but global CDP is already enabled.

The specific factual error is that LLDP is a different protocol and does not affect CDP operation.

The specific factual error is that physical issues would likely cause the interface to be down, but the question does not indicate any physical problem.

ARP operates at Layer 2 and is only concerned with resolving IP addresses to MAC addresses on the local link. Path selection between routers is performed by routing protocols (e.g., OSPF, EIGRP) and the routing table, which operate at Layer 3.

ARP requests are broadcast only within the local subnet and are not forwarded by routers. To reach a host on a different subnet, the source host must send the packet to its default gateway, which then uses its own ARP process to resolve the next-hop MAC.

ARP does not replace the default gateway; it only resolves the MAC address of the gateway or other local hosts. The default gateway is still required for routing traffic to other subnets, as ARP cannot provide Layer 3 forwarding.

The U/L bit was not flipped; the interface ID starts with 0011 instead of 0211.

The FFFE insertion is missing; the interface ID is just the MAC address written in IPv6 format.

FFFE is missing; only the U/L bit flip was applied.

Missing the 'login local' command on VTY lines, so local authentication will not work.

Lacks an IP domain name, which is necessary to generate RSA keys for SSH.

Configures VTY lines for Telnet ('transport input telnet'), not SSH, failing the remote management requirement.

This option focuses on a filtering issue, not the disabled routing engine, and would not cause the router’s own interface to lack a global unicast address.

NAT64 configuration would affect translation, but the root cause visible in the output is the lack of IPv6 routing capability on the router.

This shifts the blame to the host, but the router-side evidence (missing command and missing global unicast) clearly indicates a router configuration problem.

`ipconfig /all` shows only the local IP configuration, not whether the same IP is assigned to another host.

`nslookup` resolves domain names to IP addresses and is unrelated to local IP conflicts.

`ping` tests connectivity but cannot identify duplicate IPs, as a reply does not guarantee the IP is unique.

`tracert` traces the path to a remote host, irrelevant for detecting local subnet duplicate IPs.

A rollover cable is a specialized Cisco console cable used for out-of-band management access to a device's console port, not for network data traffic. It cannot carry 10G Ethernet signals and is physically incompatible with Ethernet interfaces.

Coaxial cable (e.g., RG-6) is primarily used for cable TV, broadband internet (DOCSIS), or legacy Ethernet (10BASE2/10BASE5), but it does not support 10G Ethernet speeds over the distances required between floors in a modern enterprise network. Fiber or twisted-pair copper (Cat6a/Cat7) are the standard 10G media.

A console cable (typically a rollover or USB-to-serial cable) is used for initial device configuration and management access, not for carrying network traffic. It cannot support 10G data rates and is not designed for switch-to-switch uplinks.

STP does not use port number as the primary criterion; it is only a tie-breaker when path cost, bridge ID, and sender bridge ID are all equal. Here, the path costs differ, so port number is irrelevant.

STP is designed to select the path with the lowest total cost to the root bridge, not the highest. Choosing a higher-cost path would increase latency and waste bandwidth.

The root port is the forwarding port toward the root bridge, while the alternate port is a blocked backup. The alternate port is not chosen over the root port; it only becomes active if the root port fails.

Without a default gateway, the workstation cannot send packets to destinations outside its own subnet (10.10.10.0/24). The DNS server alone only provides name resolution, not routing to other subnets.

Changing the subnet mask to 255.255.0.0 would expand the broadcast domain and could cause routing problems, but it does not provide a path to other subnets. The workstation still needs a default gateway to communicate with devices outside its local network.

The default gateway 10.10.20.1 is not on the same subnet as the workstation (10.10.10.0/24). For a host to reach its default gateway, the gateway must be directly reachable on the local subnet. Since 10.10.20.1 is on a different subnet, the workstation cannot send traffic to it.

The server's acknowledgment is already included in the SYN-ACK segment; sending a separate ACK would be an extra step not defined in the TCP specification.

Layer 1 (Physical layer) deals with the physical transmission of bits over media, such as cables or radio frequencies. Routers do not make forwarding decisions at this layer; they only handle electrical or optical signals.

Layer 2 (Data Link layer) uses MAC addresses for switching within the same network segment. Routers, however, forward packets based on Layer 3 logical addresses, not MAC addresses, which are only used for next-hop delivery.

Layer 4 (Transport layer) handles end-to-end communication, segmentation, and flow control using protocols like TCP and UDP. Routers do not use Layer 4 information for forwarding decisions; they only examine Layer 3 headers.

A /24 prefix provides 256 total addresses (2^(32-24)=256), with 254 usable host addresses after subtracting the network and broadcast addresses. This does not match the /22 prefix in the question.

A /23 prefix provides 512 total addresses (2^(32-23)=512), with 510 usable host addresses. This is half the total addresses of a /22, so it is incorrect for the given prefix.

A /21 prefix provides 2048 total addresses (2^(32-21)=2048), with 2046 usable host addresses. This is double the total addresses of a /22, so it is incorrect for the given prefix.

Confuses speed mismatch (which prevents link establishment) with duplex mismatch (which allows the link to come up but causes errors and late collisions).

Assumes all interface errors are cable-related and overlooks the characteristic late-collision signature of duplex mismatch.

Misinterprets high utilization as a source of physical-layer errors and ignores the diagnostic value of asymmetric late collisions.

Link-local addresses have a scope of link-local (fe80::/10) and are not forwarded by routers, making them non-routable across the Internet. They are intended only for communication on a single network segment.

Link-local addresses are automatically generated on all IPv6 interfaces regardless of DHCPv6. They are a mandatory part of IPv6 operation, not a fallback mechanism.

For off-link communication, IPv6 hosts still require a default gateway (usually a router's link-local address) to forward packets beyond the local segment. Link-local addresses do not eliminate the need for routing logic.

The Version field (4 bits) indicates the IP version (e.g., IPv4 or IPv6) and has no role in loop prevention. It is used by routers to interpret the packet header correctly.

The Header Checksum field detects errors in the IPv4 header only; it does not limit packet forwarding or prevent loops. If corrupted, the packet is discarded, but this does not stop looping.

The Protocol field identifies the next-level protocol (e.g., TCP, UDP, ICMP) carried in the payload. It has no impact on packet forwarding or loop prevention.

Both the network address and broadcast address are reserved addresses within a subnet and cannot be assigned to hosts. The network address identifies the subnet itself, and the broadcast address is used for one-to-all communication. Assigning them to hosts would cause conflicts.

The default gateway is typically the IP address of a router interface on the subnet, which is a normal host address within the usable range. The broadcast address is the last address in the subnet and is reserved for broadcasting; it cannot be used as a gateway.

Network and broadcast addresses are fundamental to IPv4 subnetting and are defined in IPv4 standards. IPv6 does not use broadcast addresses; instead, it uses multicast and anycast. Therefore, stating these concepts exist only in IPv6 is factually incorrect.

Although `ifconfig` can still display IP settings, it is a deprecated legacy command and the question expects the modern `ip addr` from the iproute2 suite.

`tracert` is the Windows traceroute utility; the Linux command is `traceroute`.

`nslookup` is a DNS troubleshooting tool and cannot verify interface IP configuration or test basic reachability like `ping`.

'ipv6 enable' is an interface command, not a global command to enable IPv6 routing.

'ip routing ipv6' is not a valid Cisco IOS command.

'ipv6 route enable' is not a valid Cisco IOS command.

The MAC address of the remote web server is not used because the remote host is on a different subnet and cannot be reached directly at Layer 2.

The DNS server is used for domain name resolution, not for forwarding data frames to remote subnets.

The broadcast MAC address would send the frame to all devices on the local subnet, which is incorrect for unicast traffic to a remote destination.

Routing protocol misconfiguration is a Layer 3 issue that does not manifest in the 'show interfaces' output, which focuses on Layer 1 and Layer 2 interface statistics. To diagnose routing issues, you would use commands like 'show ip route' or 'show ip protocols'.

A VLAN mismatch is a Layer 2 issue that does not appear in the 'show interfaces' output; it is diagnosed using 'show vlan' or 'show interfaces trunk'. The 'show interfaces' command shows physical and data link layer statistics, not VLAN membership.

STP topology changes are not directly visible in 'show interfaces'; they are monitored using 'show spanning-tree' or 'debug spanning-tree events'. The 'show interfaces' command does not provide information about spanning-tree state changes.

Using 'password' instead of 'secret' stores the password in plaintext; allowing Telnet alongside SSH does not restrict to SSH only.

'transport input all' permits Telnet and other protocols, which is not restrictive enough.

Using 'password' and 'login' on vty lines enables password-only authentication, not local user authentication.

Troubleshooting at Layer 3 (IP) before verifying Layer 2 (VLAN) connectivity skips a fundamental step in the OSI model.

Confuses a Layer 1 problem with a Layer 2/3 problem. The client’s association proves the RF link is functional.

This investigates a condition that has already been ruled out (authentication succeeded) and does not address the IP assignment failure.

The interface is not administratively down; 'no shutdown' would have no effect on a loop condition.

The problem is a loopback test, not a speed/duplex mismatch. Changing speed may cause additional problems.

Keepalives are used to detect link failures; disabling them would not resolve a loopback test and could mask real issues.

/25 provides 126 usable hosts per subnet, which is more than enough for 50 hosts, but it only creates two subnets from a /24 network. Since four subnets are required, /25 is insufficient for subnet count.

/27 creates eight subnets from a /24, which is enough subnets, but each subnet only supports 30 usable hosts. This is less than the required 50 hosts, so /27 is not suitable.

/28 creates sixteen subnets but only supports 14 usable hosts per subnet, which is far below the 50-host requirement. Therefore, /28 is not a valid option.

Runts are frames smaller than 64 bytes, not larger than the maximum size.

Giants are frames larger than the maximum allowed size (typically 1518 bytes), not smaller than 64 bytes.

Flaps indicate an interface repeatedly transitioning between up and down states, not necessarily a physical disconnection.

Changing VLANs or using subinterfaces does not solve the problem because the router's physical interface must be up and have an IP address to serve the VLAN.

Enabling DHCP snooping or trust settings on the switch cannot fix a router interface that is administratively down and unassigned.

Assigning a static IP to the PC circumvents but does not resolve the root issue of the router's interface being down, and the scenario requires DHCP.

A router does not drop the packet without notification when the DF bit is not set; instead, it fragments the packet. Dropping without notification only occurs when the DF bit is set and the packet exceeds the MTU, in which case the router sends an ICMP Fragmentation Needed message.

Routers operate at Layer 3 (IP) and do not modify the transport layer protocol (e.g., UDP or TCP) to handle MTU issues. Converting a packet to UDP would change the protocol and is not a function of IP fragmentation or any standard routing behavior.

Switches operate at Layer 2 and do not perform IP fragmentation. Fragmentation is a Layer 3 function handled by routers or the source host. The router must fragment the packet before forwarding it to the switch.

A /30 subnet always has a block size of 4 addresses, starting at multiples of 4. The block starting at .18 would be 192.168.70.16–.19, not .18–.21. The range .18–.21 crosses a subnet boundary and includes addresses from two different subnets.

The block 192.168.70.12–.15 is a different /30 subnet (network .12, broadcast .15). The host .18 belongs to the subnet .16–.19, not .12–.15.

The block 192.168.70.20–.23 is the next /30 subnet (network .20, broadcast .23). The host .18 is not in this range; it is in the .16–.19 subnet.

10.55.8.119 is the broadcast address for the subnet 10.55.8.112/29, not the network address. The broadcast address is the last address in the block (112+8-1=119) and is used to send traffic to all hosts in the subnet.

10.55.8.120 is the network address of the next /29 subnet (120-127), not the current one. The current subnet ends at 119, so 120 belongs to a different subnet.

10.55.8.116 is a valid host address within the subnet 10.55.8.112/29 (usable range: 113-118). It is not the network address, which must be the first address (112).

The VLAN number is not a factor in the STP root bridge election. The election is based solely on bridge ID, which consists of bridge priority and MAC address.

The number of trunk ports does not affect the root bridge election. STP uses bridge ID (priority and MAC address) to determine the root bridge, not port count or type.

The root bridge is elected based on the lowest bridge ID, not the highest. A higher bridge priority (numerically larger) makes a switch less likely to become root.

Incorrect because ARP does not discover routing protocol identifiers like OSPF router IDs; these are unrelated to Layer 2 address resolution.

Incorrect because ARP does not replace DNS; DNS resolves hostnames to IP addresses, whereas ARP resolves IP addresses to MAC addresses.

The specific factual error is that a default route is already in place and working; adding another does not solve the NAT problem.

The specific factual error is that a host's default gateway must be on the same subnet; 203.0.113.1 is not reachable directly from PC1.

The specific factual error is that OSPF does not solve the private-to-public address translation problem; it only exchanges routes between routers.

The PC's APIPA address cannot reach the 192.168.10.1 gateway because it is not in the same subnet, so configuring a default gateway alone does not restore connectivity.

Changing the VLAN to VLAN 1 would isolate PC-A from the correct subnet (VLAN 10), breaking connectivity instead of fixing it.

The 'ip helper-address' command is used on interfaces that need to forward DHCP broadcasts to a remote DHCP server; here R1 itself is the DHCP server and is directly attached, so the command is not needed.

Uses 1000BASE-SX, which cannot support the required 2 km distance.

Retains 'negotiation auto', which is not supported on fiber SFPs and prevents the link from establishing.

Configures 'speed 100', a value incompatible with a 1000BASE-LX SFP, causing a link failure.

192.168.90.47 is the broadcast address for the subnet 192.168.90.32/28. Broadcast addresses cannot be assigned to hosts; they are used to send traffic to all hosts in the subnet.

192.168.90.33 is the first usable host in the subnet (network address .32 + 1). The question asks for the last usable host, not the first.

192.168.90.48 is the network address of the next subnet (192.168.90.48/28). It is not part of the current subnet and cannot be used as a host address in the subnet containing .33.

DNS misconfiguration would not prevent direct IP connectivity to the gateway.

With the port down, the PC would not assign any IP address; APIPA assignment requires an active link.

Physical disconnection prevents link establishment, so no IP address is assigned.

The subnet 10.0.0.0/25 covers addresses 10.0.0.0 through 10.0.0.127. Since 10.0.0.130 is outside this range, it cannot belong to this subnet. The host's address must be within the subnet's range.

The /25 prefix length has a subnet size of 128, so valid network addresses are multiples of 128 (0, 128, 256, etc.). 10.0.0.64 is not a multiple of 128, so it is not a valid /25 network address.

The /25 prefix length creates subnets with a block size of 128, starting at 0, 128, 256, etc. 10.0.0.192/25 would be a valid subnet if the network started at 192, but 192 is not a valid /25 boundary because 192 is not a multiple of 128.

The specific factual error is that 'cdp enable' is used on interfaces, not globally. The global command to enable CDP is 'cdp run'.

The specific factual error is that 'no cdp disable' is not a valid Cisco IOS command. The proper command is 'cdp enable'.

The specific factual errors are: the global command should be 'cdp run', and the interface command should be 'cdp enable'.

ARP is specifically designed for IPv4 networks to map IPv4 addresses to MAC addresses. IPv6 uses Neighbor Discovery Protocol (NDP) with ICMPv6 messages to perform address resolution, not ARP.

ARP operates only within a single broadcast domain (subnet) and is not forwarded by routers. Routers separate broadcast domains and do not forward ARP requests or replies across subnets by default.

Candidates may equate a physical link symptom with a faulty cable, but the port’s active status indicates a good L1 connection. This action skips necessary logical checks.

This is a common ‘quick fix’ mindset, but in a structured troubleshooting process, clearing the cache hides information without solving the root cause.

Candidates might confuse local ARP failure with reachability issues to a remote subnet, but the gateway is the router itself. Routing is irrelevant until the destination is off-segment.

Global unicast addresses are routable beyond the local link and are not automatically created for local link communication only.

Unique local addresses are similar to private IPv4 addresses and are routable within an organization, not limited to the local link.

Multicast addresses are used for group communication and are not assigned as interface addresses for unicast communication.

The 'show ipv6 interface' output shows 'up, line protocol is up', indicating the interface is not administratively down. An administratively down interface would show 'administratively down' in the output.

The link-local address (FE80::21A:2BFF:FE3C:4D5E) is correctly formed using EUI-64, which requires a valid MAC address. The presence of 'FF:FE' in the middle indicates EUI-64 is functioning properly, so the MAC address is valid.

The output shows 'ND router advertisements are sent every 200 seconds', confirming that Router Advertisements are enabled. The problem is about the router's own IPv6 address, not host autoconfiguration.

Gi1/0/6 is an access port in VLAN 1 (the default VLAN), not VLAN 20. The question specifically asks for an interface operating as an access port in VLAN 20, so this option is incorrect.

Gi1/0/24 is configured as a trunk port, which carries traffic for multiple VLANs and is not an access port. Access ports belong to a single VLAN, so this option is incorrect.

Gi1/0/5 is clearly an access port in VLAN 20, so there is an interface that matches the description. Therefore, 'None of the interfaces' is incorrect.