CCNA Network Infrastructure and Connectivity Questions — Page 2 of 4

MCQeasy

At which OSI layer do routers make forwarding decisions based on logical addressing?

A.Layer 1

B.Layer 2

C.Layer 3

D.Layer 4

AnswerC

Routers make forwarding decisions at OSI Layer 3, the network layer, by inspecting the destination IPv4 or IPv6 address in the packet header. They consult their routing table and apply the longest-prefix-match rule to select the next hop toward the destination network. This logical addressing allows routing across different broadcast domains.

Why this answer

Routers operate at the network layer when making forwarding decisions based on logical Layer 3 addresses such as IPv4 or IPv6 destination addresses.

Exam trap

Don't confuse the roles of routers and switches. Remember that routers use logical addressing (IP addresses) at Layer 3, while switches use physical addressing (MAC addresses) at Layer 2.

Why the other options are wrong

Layer 1 (Physical layer) deals with the physical transmission of bits over media, such as cables or radio frequencies. Routers do not make forwarding decisions at this layer; they only handle electrical or optical signals.

Layer 2 (Data Link layer) uses MAC addresses for switching within the same network segment. Routers, however, forward packets based on Layer 3 logical addresses, not MAC addresses, which are only used for next-hop delivery.

Layer 4 (Transport layer) handles end-to-end communication, segmentation, and flow control using protocols like TCP and UDP. Routers do not use Layer 4 information for forwarding decisions; they only examine Layer 3 headers.

Practice this question →

MCQhard

A subnet uses the prefix /22. How many usable host addresses are available?

A.254

B.510

C.1022

D.2046

AnswerC

A /22 prefix designates 22 network bits, leaving 10 bits for the host portion of the IPv4 address. This configuration provides 2^10, or 1024, total addresses within the subnet. However, two addresses are always reserved: one for the network address and one for the broadcast address. Subtracting these two reserved addresses from the total yields 1022 usable host addresses, directly satisfying the /22 prefix constraint specified in the question stem.

Why this answer

A /22 leaves 10 host bits available. In plain language, that means each subnet contains 2^10, or 1024, total addresses. Two of those are reserved for the network and broadcast addresses in normal IPv4 subnetting, leaving 1022 usable host addresses.

This is a common subnet-capacity calculation. The safest method is to calculate the total address count from the number of host bits and then subtract the two reserved addresses. That leads directly to the correct usable-host value.

Exam trap

Remember to subtract the network and broadcast addresses from the total number of addresses to find the usable host count.

Why the other options are wrong

A /24 prefix provides 256 total addresses (2^(32-24)=256), with 254 usable host addresses after subtracting the network and broadcast addresses. This does not match the /22 prefix in the question.

A /23 prefix provides 512 total addresses (2^(32-23)=512), with 510 usable host addresses. This is half the total addresses of a /22, so it is incorrect for the given prefix.

A /21 prefix provides 2048 total addresses (2^(32-21)=2048), with 2046 usable host addresses. This is double the total addresses of a /22, so it is incorrect for the given prefix.

Practice this question →

MCQhard

A network administrator is troubleshooting slow file transfers between two servers in different access-layer switches. The administrator runs the 'show interface' command on the uplink connecting the two switches and notices a high number of CRC errors on both ends, but a high number of late collisions on only one interface; the other interface reports no late collisions.

A.Duplex mismatch: the interface with late collisions is half-duplex while the other end is full-duplex. Configure both ends to auto-negotiate speed and duplex.

B.Speed mismatch: one interface is set to 100 Mbps, the other to 1 Gbps. This causes frequent link flaps, resulting in CRC errors. Use the 'speed' command to match the rates.

C.Faulty Ethernet cable causing signal degradation, which leads to CRC errors. The late collisions are a result of the switch misdetecting collisions due to the degraded signal. Replace the cable.

D.A broadcast storm caused by a loop is flooding the uplink with frames, leading to CRC errors and late collisions as the switch discards excess traffic. Enable Spanning Tree Protocol to block the redundant path.

AnswerA

Late collisions only occur on half-duplex Ethernet when multiple stations attempt to transmit simultaneously. When one end is full-duplex, the half-duplex end perceives any overlapping transmission as a collision, producing late collisions and CRC errors. Auto-negotiation correctly sets both ends to full-duplex when supported, fixing the problem.

Why this answer

A is correct because a duplex mismatch causes one interface to operate in half-duplex (detecting late collisions due to CSMA/CD) while the other operates in full-duplex (no collisions). The half-duplex interface waits for the carrier sense before transmitting, but the full-duplex interface transmits immediately, causing the half-duplex side to detect collisions after the transmission window (late collisions). CRC errors occur on both ends because frames are corrupted when collisions happen.

Configuring both ends to auto-negotiate ensures matching duplex and speed, resolving the issue.

Exam trap

Cisco often tests the distinction between CRC errors (which can have multiple causes like cable faults or duplex mismatch) and late collisions (which are a definitive indicator of a duplex mismatch), leading candidates to incorrectly attribute CRC errors alone to a cable issue.

Why the other options are wrong

Confuses speed mismatch (which prevents link establishment) with duplex mismatch (which allows the link to come up but causes errors and late collisions).

Assumes all interface errors are cable-related and overlooks the characteristic late-collision signature of duplex mismatch.

Misinterprets high utilization as a source of physical-layer errors and ignores the diagnostic value of asymmetric late collisions.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to describe the data encapsulation process as it flows down the OSI model from the source host.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Encapsulation proceeds from the top OSI layers to the bottom. First, the application generates data (Step 1). The Transport layer then adds a header (TCP or UDP) to create a segment (Step 2) because this is the first step in preparing data for reliable delivery.

The Network layer adds an IP header to form a packet (Step 3), which provides logical addressing and routing information. The Data Link layer adds a frame header and trailer to create a frame (Step 4), enabling physical addressing (MAC) and error detection. Finally, the Physical layer converts the frame to bits for transmission (Step 5), as it is the layer that ultimately puts signals on the wire.

Practice this question →

Multi-Selectmedium

Which two statements accurately describe IPv6 link-local addresses?

Select 2 answers

A.They are used for communication on the local segment only.

B.They are globally routable across the Internet.

C.They are commonly involved in local IPv6 neighbor interactions.

D.They exist only when DHCPv6 fails.

E.They replace the need for any default gateway logic.

AnswersA, C

Link-local addresses, identified by the FE80::/10 prefix, are automatically configured on every IPv6 interface and are valid only within the local network segment. A router will never forward a packet with a link-local source or destination address, so traffic using these addresses stays entirely on the local link, making this statement accurate for local-only communication.

Why this answer

IPv6 link-local addresses are designed for communication on the local segment only. In plain language, they allow devices to talk to nearby neighbors without needing globally routable addresses. They play an important role in IPv6 functions such as Neighbor Discovery and are commonly used when hosts communicate with the default gateway on the same link. These addresses are normal and expected in IPv6 environments.

They are not globally Internet-routable, and they are not just emergency fallbacks for DHCPv6 failure. The two correct answers are the ones that preserve their local-link purpose and their importance in standard IPv6 behavior rather than treating them as optional or globally reachable.

Exam trap

Remember that link-local addresses are not routable and are not a fallback for DHCPv6. They are essential for local communications.

Why the other options are wrong

Link-local addresses have a scope of link-local (fe80::/10) and are not forwarded by routers, making them non-routable across the Internet. They are intended only for communication on a single network segment.

Link-local addresses are automatically generated on all IPv6 interfaces regardless of DHCPv6. They are a mandatory part of IPv6 operation, not a fallback mechanism.

For off-link communication, IPv6 hosts still require a default gateway (usually a router's link-local address) to forward packets beyond the local segment. Link-local addresses do not eliminate the need for routing logic.

Practice this question →

MCQeasy

Which field in an IPv4 packet is primarily used to prevent packets from looping forever in the network?

A.Version

B.Header checksum

C.Time to Live

D.Protocol

AnswerC

Time to Live (TTL) is the loop-prevention field in an IPv4 header. Each router decrements TTL by at least 1, and when it reaches 0, the router discards the packet and typically sends an ICMP Time Exceeded message back to the source. This guarantees that no packet can traverse a routing loop forever, bounding the network diameter.

Why this answer

Each router decrements the TTL field by one. When TTL reaches zero, the packet is discarded. That mechanism prevents indefinite looping.

Exam trap

Remember that TTL is about lifespan and loop prevention, not error checking or addressing.

Why the other options are wrong

The Version field (4 bits) indicates the IP version (e.g., IPv4 or IPv6) and has no role in loop prevention. It is used by routers to interpret the packet header correctly.

The Header Checksum field detects errors in the IPv4 header only; it does not limit packet forwarding or prevent loops. If corrupted, the packet is discarded, but this does not stop looping.

The Protocol field identifies the next-level protocol (e.g., TCP, UDP, ICMP) carried in the payload. It has no impact on packet forwarding or loop prevention.

Practice this question →

Multi-Selectmedium

Which two statements accurately describe the relationship between a network address and a broadcast address in IPv4 subnetting?

Select 2 answers

A.The network address is the first address in the subnet block.

B.The broadcast address is the last address in the subnet block.

C.Both addresses are normal host addresses that can be assigned to users.

D.The broadcast address always becomes the default gateway.

E.These concepts exist only in IPv6 and not IPv4.

AnswersA, B

In IPv4, the network address is the first (lowest) address within a subnet block, obtained by setting all host bits to 0. This address uniquely identifies the subnet and is used by routers in their routing tables; it cannot be assigned to any host interface. It is the starting boundary from which the usable host range begins.

Why this answer

The network address identifies the beginning of the subnet block, and the broadcast address identifies the final address in that block. In practical terms, both are reserved and are not assigned to ordinary hosts. The usable host range falls between them.

This is a very basic subnetting truth, but it is foundational for every other addressing calculation.

Exam trap

Be cautious not to confuse the roles of network and broadcast addresses with usable host addresses.

Why the other options are wrong

Both the network address and broadcast address are reserved addresses within a subnet and cannot be assigned to hosts. The network address identifies the subnet itself, and the broadcast address is used for one-to-all communication. Assigning them to hosts would cause conflicts.

The default gateway is typically the IP address of a router interface on the subnet, which is a normal host address within the usable range. The broadcast address is the last address in the subnet and is reserved for broadcasting; it cannot be used as a gateway.

Network and broadcast addresses are fundamental to IPv4 subnetting and are defined in IPv4 standards. IPv6 does not use broadcast addresses; instead, it uses multicast and anycast. Therefore, stating these concepts exist only in IPv6 is factually incorrect.

Practice this question →

Multi-Selectmedium

Which TWO commands can a network technician use on a modern Linux host to verify the IP address configuration and test reachability to a remote server?

Select 2 answers

A.ip addr

B.ifconfig

C.tracert

D.ping

E.nslookup

AnswersA, D

ip addr, part of the iproute2 suite, is the modern replacement for ifconfig, displaying all interfaces, their IPv4/IPv6 addresses, MAC addresses, and administrative state. It only inspects local interface configuration; it does not generate any network traffic toward a remote host, so it cannot verify end-to-end reachability.

Why this answer

The `ip addr` command (option A) is the modern Linux utility for displaying IP address configuration, replacing the deprecated `ifconfig`. The `ping` command (option D) uses ICMP Echo Request/Reply messages to test Layer 3 reachability to a remote server. `ifconfig` (option B) is deprecated and not expected for current certification exams; `tracert` (option C) is a Windows command; `nslookup` (option E) performs DNS lookups but does not verify IP configuration or connectivity.

Exam trap

Cisco often tests the distinction between Windows and Linux commands, so the trap here is that candidates may mistakenly select `tracert` (a Windows command) instead of recognizing that the Linux equivalent is `traceroute`, or they may choose `ifconfig` without knowing it is deprecated in favor of `ip addr`.

Why the other options are wrong

Although `ifconfig` can still display IP settings, it is a deprecated legacy command and the question expects the modern `ip addr` from the iproute2 suite.

`tracert` is the Windows traceroute utility; the Linux command is `traceroute`.

`nslookup` is a DNS troubleshooting tool and cannot verify interface IP configuration or test basic reachability like `ping`.

Practice this question →

MCQmedium

Which command enables IPv6 routing on a Cisco router?

A.ipv6 unicast-routing

B.ipv6 enable

C.ip routing ipv6

D.ipv6 route enable

AnswerA

The global configuration command 'ipv6 unicast-routing' is the correct and required command to enable IPv6 routing on a Cisco router. It enables IPv6 packet forwarding on all interfaces and allows the router to route IPv6 traffic between networks. Without this command, the router will not forward IPv6 packets but will still process traffic explicitly addressed to itself.

Why this answer

The global configuration command 'ipv6 unicast-routing' enables IPv6 forwarding on a Cisco router. 'ipv6 enable' is an interface-level command used to enable IPv6 on a specific interface, not globally. 'ip routing ipv6' and 'ipv6 route enable' are syntactically invalid commands that do not exist in Cisco IOS.

Exam trap

Be careful not to confuse interface-specific commands with global routing commands. Remember that enabling IPv6 globally requires a specific command.

Why the other options are wrong

'ipv6 enable' is an interface command, not a global command to enable IPv6 routing.

'ip routing ipv6' is not a valid Cisco IOS command.

'ipv6 route enable' is not a valid Cisco IOS command.

Practice this question →

MCQeasy

A host sends traffic to a web server on another subnet. Which address is used as the destination MAC address in the first Ethernet frame sent by the host?

A.The MAC address of the remote web server

B.The MAC address of the local default gateway

C.The MAC address of the DNS server

D.The broadcast MAC address

AnswerB

The host's routing table indicates that the destination IP is not on the local subnet, so the packet must be sent to the default gateway. The destination MAC in the Ethernet frame is therefore the gateway's interface MAC, resolved via ARP, while the destination IP address remains that of the web server. The gateway then strips the frame and forwards the packet toward the remote subnet, changing the frame headers at each hop while preserving the IP addresses.

Why this answer

When a host wants to communicate with a device on a different subnet, it cannot reach that device directly. The host must send the frame to its default gateway, which is the router that connects to other subnets. Therefore, the destination MAC address in the first Ethernet frame is the MAC address of the local default gateway, not the remote web server (A).

The DNS server (C) is used for name resolution, not for forwarding traffic. The broadcast MAC address (D) would send the frame to all devices on the local subnet, which is not appropriate for unicast communication to a remote destination.

Exam trap

Remember that the destination MAC address for remote communication is the default gateway's, not the remote host's.

Why the other options are wrong

The MAC address of the remote web server is not used because the remote host is on a different subnet and cannot be reached directly at Layer 2.

The DNS server is used for domain name resolution, not for forwarding data frames to remote subnets.

The broadcast MAC address would send the frame to all devices on the local subnet, which is incorrect for unicast traffic to a remote destination.

Practice this question →

Multi-Selectmedium

Which TWO interface issues can be identified by analyzing the output of the 'show interfaces' command?

Select 2 answers

A.Duplex mismatch

B.Routing protocol misconfiguration

C.Speed mismatch

D.VLAN mismatch

E.STP topology change

AnswersA, C

A duplex mismatch occurs when one device is manually set to full duplex and the other is auto-negotiating or set to half duplex, often on a point-to-point link. The full-duplex side does not defer and sends anytime, while the half-duplex side only transmits when it senses the wire free, leading to collisions and late collisions on the half-duplex side; 'show interfaces' will display late collisions, runts, CRC errors, or excessive input errors on one or both sides. This is a classic Layer 1/physical problem that shows up clearly in interface counters.

Why this answer

The 'show interfaces' command displays interface statistics and operational status, including duplex and speed settings. A duplex mismatch occurs when one end of a link is set to full-duplex and the other to half-duplex, leading to collisions and CRC errors visible in the output. Speed mismatch is also detectable because the interface will show the negotiated speed or errors like 'input errors' if the speeds do not match.

Exam trap

Cisco often tests that 'show interfaces' reveals physical-layer issues like duplex and speed mismatches, but candidates mistakenly think it also shows Layer 2 or Layer 3 problems such as VLAN or routing misconfigurations.

Why the other options are wrong

Routing protocol misconfiguration is a Layer 3 issue that does not manifest in the 'show interfaces' output, which focuses on Layer 1 and Layer 2 interface statistics. To diagnose routing issues, you would use commands like 'show ip route' or 'show ip protocols'.

A VLAN mismatch is a Layer 2 issue that does not appear in the 'show interfaces' output; it is diagnosed using 'show vlan' or 'show interfaces trunk'. The 'show interfaces' command shows physical and data link layer statistics, not VLAN membership.

STP topology changes are not directly visible in 'show interfaces'; they are monitored using 'show spanning-tree' or 'debug spanning-tree events'. The 'show interfaces' command does not provide information about spanning-tree state changes.

Practice this question →

PBQhard

You are connected via the console to R1, a new Cisco ISR 4321 router. The network team requires that all routers be reachable via SSH for management. R1's management interface is GigabitEthernet0/0 with IP 192.168.1.1/24. You need to configure SSH on R1, including a hostname, domain name, RSA key pair of 1024 bits, local user 'admin' with secret 'cisco123', and enable SSH version 2. Additionally, configure the vty lines to accept only SSH connections and use local authentication.

Network Topology

Hints

•You need to set hostname and domain name before generating RSA keys.
•Use 'crypto key generate rsa modulus 1024' to create the key pair.
•Configure vty lines to only allow SSH and use local authentication.

A.R1(config)# hostname R1 R1(config)# ip domain-name example.com R1(config)# crypto key generate rsa modulus 1024 R1(config)# username admin secret cisco123 R1(config)# ip ssh version 2 R1(config)# line vty 0 4 R1(config-line)# transport input ssh R1(config-line)# login local

B.R1(config)# hostname R1 R1(config)# ip domain-name example.com R1(config)# crypto key generate rsa general-keys modulus 1024 R1(config)# username admin password cisco123 R1(config)# ip ssh version 2 R1(config)# line vty 0 4 R1(config-line)# transport input ssh telnet R1(config-line)# login local

C.R1(config)# hostname R1 R1(config)# ip domain-name example.com R1(config)# crypto key generate rsa modulus 1024 R1(config)# username admin secret cisco123 R1(config)# ip ssh version 2 R1(config)# line vty 0 4 R1(config-line)# transport input all R1(config-line)# login local

D.R1(config)# hostname R1 R1(config)# ip domain-name example.com R1(config)# crypto key generate rsa modulus 1024 R1(config)# username admin secret cisco123 R1(config)# ip ssh version 2 R1(config)# line vty 0 4 R1(config-line)# transport input ssh R1(config-line)# password cisco123 R1(config-line)# login

AnswerA

solution

! R1
hostname R1
ip domain-name example.com
crypto key generate rsa modulus 1024
username admin secret cisco123
line vty 0 4
transport input ssh
login local

Why this answer

SSH configuration requires a hostname, domain name, RSA key pair, local username, and vty line settings. The command sequence ensures SSH version 2 is used and only SSH connections are accepted on the vty lines.

Exam trap

Watch for subtle differences: 'username secret' vs 'username password', 'transport input ssh' vs 'transport input all' or 'transport input ssh telnet', and 'login local' vs 'login'. Also ensure the hostname and domain name are set before generating RSA keys.

Why the other options are wrong

Using 'password' instead of 'secret' stores the password in plaintext; allowing Telnet alongside SSH does not restrict to SSH only.

'transport input all' permits Telnet and other protocols, which is not restrictive enough.

Using 'password' and 'login' on vty lines enables password-only authentication, not local user authentication.

Matchingeasy

Match the data format to its most accurate characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Lightweight format commonly used by REST APIs

Markup-style format that uses opening and closing tags

Human-friendly format that relies heavily on indentation

Simple tabular format with comma-separated values

Why these pairings

JSON is lightweight and key-value based, XML uses tags and attributes, YAML relies on indentation, CSV is for tabular data, Protobuf is a binary schema-driven format, and HTML is for web page structure.

Exam trap

Avoid confusing the characteristics of different data formats. Remember that JSON uses key-value pairs, XML uses tags, YAML uses indentation, CSV is tabular, Protobuf is binary, and HTML is for web structure.

Practice this question →

MCQhard

A wireless client associates to an AP and successfully authenticates to the correct SSID, but it does not obtain an IP address. The WLC is running in local mode. What should the technician do next?

A.Check the DHCP server to ensure it has available leases.

B.Verify the AP’s operating channel for interference.

C.Verify the VLAN mapping on the WLC for the client’s WLAN.

D.Verify the WPA3 PSK on the client.

AnswerC

In local mode, the WLC bridges client traffic to a specified VLAN. An incorrect or missing VLAN ID prevents the DHCP discovery from reaching the DHCP server. This step directly confirms whether the client’s traffic is placed on the correct subnet.

Why this answer

When a wireless client authenticates to the SSID but fails to obtain an IP address, the most likely cause is a VLAN mapping mismatch on the WLC. In local mode, the WLC maps the WLAN to a specific VLAN (via the interface or VLAN tag), and if that VLAN does not have a DHCP relay or is not trunked to the correct switch, the client's DHCP requests will never reach the DHCP server. This is a common Layer 2 connectivity issue that prevents IP address assignment even though authentication succeeds.

Exam trap

Cisco often tests the misconception that DHCP issues are always server-side (Option A), when in reality the WLC's VLAN-to-interface mapping is a critical Layer 2 configuration that must be verified first in a wireless context.

Why the other options are wrong

Troubleshooting at Layer 3 (IP) before verifying Layer 2 (VLAN) connectivity skips a fundamental step in the OSI model.

Confuses a Layer 1 problem with a Layer 2/3 problem. The client’s association proves the RF link is functional.

This investigates a condition that has already been ruled out (authentication succeeded) and does not address the IP assignment failure.

Practice this question →

MCQhard

A branch office needs four subnets from the 192.168.50.0/24 network, with each subnet supporting up to 50 hosts. Which prefix length should be used for each subnet?

A./25

B./26

C./27

D./28

AnswerB

A /26 prefix borrows 2 host bits from the /24, yielding 4 equal-sized subnets (2^2 = 4), each with 62 usable addresses (2^6 - 2 = 62). This exactly meets the branch office requirement for four subnets while providing sufficient host capacity for typical devices. The subnet mask 255.255.255.192 is the correct choice.

Why this answer

Each subnet must support at least 50 hosts, so /26 is the smallest suitable prefix because it provides 62 usable addresses. A /24 can be split into exactly four /26 subnets.

Exam trap

A frequent exam trap is selecting a subnet mask that provides enough hosts but not enough subnets, or vice versa. For instance, choosing /25 seems tempting because it supports 126 hosts, which exceeds the 50-host requirement. However, /25 only creates two subnets from a /24, which fails the requirement for four subnets.

Another trap is picking /27, which creates enough subnets but only supports 30 hosts, insufficient for 50 hosts per subnet. Candidates must carefully balance subnet count and host capacity to avoid these pitfalls.

Why the other options are wrong

/25 provides 126 usable hosts per subnet, which is more than enough for 50 hosts, but it only creates two subnets from a /24 network. Since four subnets are required, /25 is insufficient for subnet count.

/27 creates eight subnets from a /24, which is enough subnets, but each subnet only supports 30 usable hosts. This is less than the required 50 hosts, so /27 is not suitable.

/28 creates sixteen subnets but only supports 14 usable hosts per subnet, which is far below the 50-host requirement. Therefore, /28 is not a valid option.

Practice this question →

Multi-Selectmedium

Which TWO of the following are valid interpretations of errors seen in the output of the 'show interface' command?

Select 2 answers

A.CRC errors indicate that frames were received with an invalid checksum, often due to cabling issues.

B.Runts are frames that are larger than the maximum allowed size.

C.Giants are frames that are smaller than 64 bytes.

D.Input errors include runts, giants, CRC errors, and frame errors.

E.Flaps indicate that the interface is physically disconnected.

AnswersA, D

A CRC error means the Ethernet frame's frame check sequence (FCS) computed at the receiver does not match the value transmitted, indicating corruption during transit. This is commonly caused by faulty cabling, bad connectors, electromagnetic interference, or a marginal transceiver, rather than by a software issue. CRC errors may also be accompanied by alignment errors if the corruption shifts bit boundaries, pointing further to a physical-layer problem.

Why this answer

CRC errors (option A) indicate frames with an invalid checksum, often due to cabling issues, which is correct. Option D is also correct: 'Input errors' is a cumulative counter that includes runts, giants, CRC errors, and frame errors. Option B is wrong because runts are frames smaller than 64 bytes, not larger.

Option C is wrong because giants are frames larger than the maximum allowed size (typically 1518 bytes), not smaller than 64 bytes. Option E is wrong because 'flaps' refer to an interface going up and down repeatedly, not necessarily physically disconnected; it could be due to duplex mismatch or other reasons.

Exam trap

Cisco often tests the exact byte thresholds for runts (less than 64 bytes) and giants (greater than 1518 bytes), and candidates frequently reverse these values or confuse them with other error types.

Why the other options are wrong

Runts are frames smaller than 64 bytes, not larger than the maximum size.

Giants are frames larger than the maximum allowed size (typically 1518 bytes), not smaller than 64 bytes.

Flaps indicate an interface repeatedly transitioning between up and down states, not necessarily a physical disconnection.

Practice this question →

Matchingmedium

Match each basic IPv4 concept to its most accurate role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Defines network versus host portions of the address

Next hop used for off-subnet traffic

Address used to reach all hosts in the local broadcast domain

Address identifying an individual device in the subnet

Why these pairings

An IP address uniquely identifies a device on an IP network. A subnet mask separates the network and host portions of an IP address, enabling devices to determine if a destination is local or remote. A default gateway is the router IP that forwards traffic to other networks when the destination is not on the local subnet.

A DNS server translates domain names into IP addresses, allowing devices to reach websites by name.

Exam trap

Do not confuse the subnet mask's role with that of the default gateway. The subnet mask helps identify the network, while the default gateway enables communication outside the local subnet.

Practice this question →

Matchingmedium

Match each IPv6 address type or concept to its most accurate description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

IPv6 address type used for wider routed communication

IPv6 address type used only on the local segment

Address used by a device to refer to itself

Method for deriving an interface identifier from a MAC address

Why these pairings

Each IPv6 address type has a distinct purpose: Global Unicast for public routing, Link-Local for local segment, Unique Local for private site, Multicast for group communication, Anycast for nearest device, and SLAAC for stateless address assignment.

Exam trap

The most common trap is confusing the scope of Link-Local and Unique Local addresses. Remember: Link-Local is only for the local link, while Unique Local is for private site-wide use but not internet-routable. Also, don't confuse multicast with unicast.

Practice this question →

PBQhard

You are troubleshooting a PC connected to switch SW1. The PC cannot access the internet. SW1 is connected to router R1 via port G0/1. R1 provides default gateway and DHCP services. Analyze the provided show output and fix the connectivity issue so that the PC can ping 8.8.8.8. === Show output from R1 === <pre> R1# show ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 unassigned YES manual administratively down down GigabitEthernet0/1 10.0.0.1 YES NVRAM up up </pre> === Show output from PC === <pre> C:\> ipconfig Ethernet adapter Ethernet0: Connection-specific DNS Suffix . : IPv4 Address. . . . . . . . . . : 169.254.123.45 Subnet Mask . . . . . . . . . . : 255.255.0.0 Default Gateway . . . . . . . . : </pre> === Show output from SW1 === <pre> SW1# show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi0/1, Gi0/2, Gi0/3 </pre>

Network Topology

Hints

•Check if R1's interface connected to SW1 has an IP address.
•The DHCP pool expects the default gateway to be on the same subnet as the clients.
•APIPA address means the PC did not receive a DHCP offer.

A.Configure R1's interface G0/0 with IP address 192.168.1.1/24 and ensure the interface is not administratively down.

B.Change the VLAN on SW1's port G0/2 to VLAN 10 and configure R1's subinterface G0/0.10 with IP 192.168.1.1/24.

C.Enable DHCP snooping on SW1 and configure the port G0/2 as a trusted port.

D.Configure a static IP address of 192.168.1.10/24 on the PC with default gateway 192.168.1.1.

AnswerA

solution

! R1
interface gigabitethernet0/0
ip address 192.168.1.1 255.255.255.0
no shutdown

Why this answer

The PC's APIPA address (169.254.x.x) indicates DHCP failure. The router's DHCP pool is correctly configured and has a lease, but the show output reveals that R1's interface G0/0 is administratively down and has no IP address. Without a working IP on G0/0, the router cannot serve DHCP or route traffic for VLAN 1, even though both the PC and the router are in the same VLAN.

Option A fixes the root cause by assigning the correct subnet IP and bringing the interface up. Option B is incorrect because moving the PC to a different VLAN or creating subinterfaces does nothing to enable the router's physical interface where DHCP and routing must run. Option C is wrong because DHCP snooping or trust configurations are irrelevant when the router's own interface is down/unaddressed.

Option D is a workaround that only masks the problem; the scenario requires a working DHCP service, and a static IP would not restore the intended design.

Exam trap

This question tests your ability to identify that a router interface must have an IP address in the client subnet for DHCP to work, even if the DHCP pool is correctly configured. Many candidates focus on VLANs or DHCP server settings but overlook the basic requirement of an IP address on the router interface.

Why the other options are wrong

Changing VLANs or using subinterfaces does not solve the problem because the router's physical interface must be up and have an IP address to serve the VLAN.

Enabling DHCP snooping or trust settings on the switch cannot fix a router interface that is administratively down and unassigned.

Assigning a static IP to the PC circumvents but does not resolve the root issue of the router's interface being down, and the scenario requires DHCP.

Practice this question →

Multi-Selectmedium

Which three options correctly describe how a router processes a packet destined for a remote network? (Choose three.)

Select 3 answers

.It decrements the Time-to-Live (TTL) field in the IP header.

.It performs a lookup in the routing table for the destination IP address.

.It rewrites the source and destination MAC addresses for the next hop.

.It replaces the source IP address with its own outgoing interface IP.

.It sends an ARP request for every destination IP address in the packet.

.It encapsulates the entire packet in a new Layer 2 frame with the original MAC addresses.

Why this answer

When a router forwards a packet to a remote network, it first decrements the Time-to-Live (TTL) field in the IP header to prevent infinite loops. It then performs a routing table lookup for the destination IP address to determine the next-hop interface and IP. Finally, it rewrites the source and destination MAC addresses for the next hop, because MAC addresses are only relevant on the local link and must be updated at each Layer 3 hop.

Exam trap

Cisco often tests the distinction between Layer 2 (MAC) and Layer 3 (IP) header changes, so the trap here is that candidates mistakenly think the source IP address is rewritten at each hop, confusing routing with NAT or PAT.

Practice this question →

Matchingeasy

Match each common network device or concept to its primary role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Forwards traffic between networks

Forwards local traffic inside a LAN

Applies permit/deny policy to traffic

Provides wireless connectivity

Why these pairings

Router routes between networks; switch forwards within LAN; hub repeats signals; firewall filters traffic; AP provides Wi-Fi; modem converts digital to analog for WAN.

Exam trap

Be careful not to confuse the functions of routers and switches, as both forward traffic but at different layers. Also, remember that a home 'router' often includes a switch, AP, and modem, but the primary role of a router is routing between networks.

Practice this question →

MCQhard

A host sends an IPv4 packet larger than the outgoing interface MTU, and the DF bit is not set. What will a router normally do?

A.Drop the packet without notification

B.Fragment the packet before forwarding

C.Convert the packet into UDP

D.Forward it unchanged and let the switch fragment it

AnswerB

When the outgoing interface has a smaller MTU than the incoming packet and the IP header's Do Not Fragment (DF) bit is 0, the router correctly fragments the packet into smaller Layer 3 pieces that each fit the outgoing MTU. Each fragment gets its own IP header with the same identification field, a fragment offset, and the More Fragments flag set as needed, allowing the destination host to reassemble the original packet. This is the standard expected IPv4 behavior for an intermediate router.

Why this answer

If fragmentation is allowed, an IPv4 router can fragment a packet to fit the outgoing interface MTU. If DF were set, the router would instead drop the packet and typically send an ICMP message back to the source.

Exam trap

Be careful not to confuse the behavior when the DF bit is set with when it is not set. Remember, fragmentation is allowed when DF is not set.

Why the other options are wrong

A router does not drop the packet without notification when the DF bit is not set; instead, it fragments the packet. Dropping without notification only occurs when the DF bit is set and the packet exceeds the MTU, in which case the router sends an ICMP Fragmentation Needed message.

Routers operate at Layer 3 (IP) and do not modify the transport layer protocol (e.g., UDP or TCP) to handle MTU issues. Converting a packet to UDP would change the protocol and is not a function of IP fragmentation or any standard routing behavior.

Switches operate at Layer 2 and do not perform IP fragmentation. Fragmentation is a Layer 3 function handled by routers or the source host. The router must fragment the packet before forwarding it to the switch.

Practice this question →

MCQhard

A host is configured with IP address 192.168.70.18/30. Which addresses belong to the same subnet block?

A.192.168.70.16 through 192.168.70.19

B.192.168.70.18 through 192.168.70.21

C.192.168.70.12 through 192.168.70.15

D.192.168.70.20 through 192.168.70.23

AnswerA

A /30 prefix (255.255.255.252) defines a block of exactly 4 addresses aligned to multiples of 4. The IP 192.168.70.18 falls within the block 192.168.70.16/30, where .16 is the network address, .17 and .18 are usable host addresses, and .19 is the broadcast address. Therefore the entire subnet range is 192.168.70.16 through 192.168.70.19.

Why this answer

A /30 subnet has a block size of 4. In practical terms, the relevant blocks in the last octet are 0–3, 4–7, 8–11, 12–15, 16–19, and so on. Because 18 falls inside the 16–19 block, the subnet includes network address .16, usable hosts .17 and .18, and broadcast .19.

This question checks whether you can identify the correct /30 block and understand all addresses that fall inside it.

Exam trap

Be careful not to confuse adjacent subnet blocks or miscalculate the block size of a /30 subnet.

Why the other options are wrong

A /30 subnet always has a block size of 4 addresses, starting at multiples of 4. The block starting at .18 would be 192.168.70.16–.19, not .18–.21. The range .18–.21 crosses a subnet boundary and includes addresses from two different subnets.

The block 192.168.70.12–.15 is a different /30 subnet (network .12, broadcast .15). The host .18 belongs to the subnet .16–.19, not .12–.15.

The block 192.168.70.20–.23 is the next /30 subnet (network .20, broadcast .23). The host .18 is not in this range; it is in the .16–.19 subnet.

Practice this question →

MCQhard

A host address is 10.55.8.117/29. Which address is the network address of the subnet?

A.10.55.8.112

B.10.55.8.119

C.10.55.8.120

D.10.55.8.116

AnswerA

10.55.8.112 is the network address because the /29 prefix length equates to a 255.255.248 subnet mask, creating subnets with 8 addresses each. The host address 10.55.8.117 falls within the range 112 through 119, so the network address is the first address in that block, 10.55.8.112, with 10.55.8.119 as the broadcast address.

Why this answer

A /29 subnet has a block size of 8. In practical terms, the relevant last-octet blocks are 112-119 for this host. That means the network address is 10.55.8.112. Once you identify the correct block, the first address in the block is the network address.

This is a useful addressing-boundary question because it checks careful block calculation, not memorized guesses.

Exam trap

Be careful not to confuse the network address with the first usable host or the broadcast address.

Why the other options are wrong

10.55.8.119 is the broadcast address for the subnet 10.55.8.112/29, not the network address. The broadcast address is the last address in the block (112+8-1=119) and is used to send traffic to all hosts in the subnet.

10.55.8.120 is the network address of the next /29 subnet (120-127), not the current one. The current subnet ends at 119, so 120 belongs to a different subnet.

10.55.8.116 is a valid host address within the subnet 10.55.8.112/29 (usable range: 113-118). It is not the network address, which must be the first address (112).

Practice this question →

100

MCQhard

In a network running STP, SW2 became the root bridge for VLAN 10. Both SW1 and SW2 have the same bridge priority. Why did SW2 become the root?

A.Because SW2 has the lower bridge ID due to the lower MAC address.

B.Because SW2 has the higher VLAN number configured.

C.Because SW2 has more trunk ports than SW1.

D.Because SW2 has the highest bridge priority.

AnswerA

In STP, each switch's bridge ID is composed of a configurable priority (default 32768) and its MAC address, concatenated to form a unique identifier. When SW1 and SW2 have equal bridge priority, the election breaks the tie by comparing the MAC portion, and the numerically lower MAC address wins. Since SW2's MAC is lower, its bridge ID is lower, making it the root bridge for the VLAN.

Why this answer

SW2 became the root bridge because its bridge ID is lower. In practical terms, spanning tree elects the root bridge by comparing bridge IDs, which are based on priority plus MAC address. The device with the lowest bridge ID wins. In the exhibit, both switches use the same priority, so the tie is broken by the lower MAC address.

This is a classic STP interpretation question. Many learners focus only on priority, but if priorities match, the MAC address becomes decisive.

Exam trap

Remember, in STP, lower values are preferred. If priorities match, the MAC address decides the root bridge.

Why the other options are wrong

The VLAN number is not a factor in the STP root bridge election. The election is based solely on bridge ID, which consists of bridge priority and MAC address.

The number of trunk ports does not affect the root bridge election. STP uses bridge ID (priority and MAC address) to determine the root bridge, not port count or type.

The root bridge is elected based on the lowest bridge ID, not the highest. A higher bridge priority (numerically larger) makes a switch less likely to become root.

Practice this question →

101

Multi-Selecteasy

A support engineer is explaining why a host uses ARP before sending a frame on an Ethernet LAN. Which two statements are correct?

Select 2 answers

A.ARP resolves an IPv4 address to a MAC address

B.A host may ARP for its default gateway when sending to a remote network

C.ARP is used to discover the remote router's OSPF router ID

D.ARP replaces DNS for hostname resolution

AnswersA, B

ARP's core function is to dynamically discover the hardware (MAC) address associated with a given IPv4 address when a host must deliver a frame on the same Layer 2 segment. The host broadcasts an ARP request containing the target IPv4 address; the node that owns that address replies with its MAC address, which is then stored in the ARP cache. Without this mapping, the host cannot construct the Ethernet frame header with the correct destination MAC, making ARP a prerequisite for IPv4 communication over most LAN technologies.

Why this answer

On Ethernet, the sender needs a destination MAC address. For remote destinations, that usually means ARPing for the default gateway's MAC.

Exam trap

A frequent exam trap is selecting options that confuse ARP with DNS or routing protocol functions. For example, some may incorrectly believe ARP resolves hostnames like DNS or discovers OSPF router IDs. These misunderstandings arise because ARP and DNS both involve address resolution, but ARP only maps IPv4 addresses to MAC addresses on the local LAN, while DNS maps hostnames to IP addresses.

Similarly, ARP does not interact with routing protocols like OSPF. Misinterpreting ARP’s role leads to incorrect answers and can cost points on the CCNA exam.

Why the other options are wrong

Incorrect because ARP does not discover routing protocol identifiers like OSPF router IDs; these are unrelated to Layer 2 address resolution.

Incorrect because ARP does not replace DNS; DNS resolves hostnames to IP addresses, whereas ARP resolves IP addresses to MAC addresses.

Practice this question →

102

Multi-Selectmedium

Which three of the following are characteristics of Layer 2 Ethernet switches that improve network performance? (Choose three.)

Select 3 answers

.They create separate collision domains per port.

.They forward frames based on the destination MAC address.

.They reduce the number of broadcast domains.

.They can perform cut-through switching to reduce latency.

.They use IP addresses to make forwarding decisions.

.They automatically block all unknown unicast frames.

Why this answer

Layer 2 Ethernet switches improve network performance by creating separate collision domains per port, eliminating collisions between devices on different ports. They forward frames based on the destination MAC address, enabling efficient hardware-based switching. Cut-through switching reduces latency by starting to forward as soon as the destination MAC address is read.

The other options are incorrect: switches do not reduce broadcast domains (broadcasts are forwarded to all ports in the same VLAN unless a router or VLAN segmentation is used); switches operate at Layer 2 using MAC addresses, not IP addresses; and unknown unicast frames are flooded out all ports except the incoming port, not automatically blocked, to ensure connectivity if the destination is unknown.

Exam trap

Cisco often tests the distinction between collision domains and broadcast domains, where candidates mistakenly think switches reduce broadcast domains, but switches only segment collision domains while broadcast domains are controlled by VLANs or routers.

Practice this question →

103

PBQhard

You are connected to R1 via console. PC1 is connected to R1's GigabitEthernet0/1 interface and is configured with a static IP address. PC1 cannot reach the internet (203.0.113.1). Identify and resolve the connectivity issue. Configure R1 to restore full connectivity for PC1.

Network Topology

Hints

•The problem is not with IP addressing or routing; R1 can reach the internet.
•PC1 uses a private IP address (RFC 1918), which must be translated before leaving R1.
•Check if NAT is configured on R1.

A.Configure NAT overload on R1: define ACL 1 to permit 192.168.1.0 0.0.0.255, set GigabitEthernet0/0 as outside and GigabitEthernet0/1 as inside, and apply ip nat inside source list 1 interface GigabitEthernet0/0 overload.

B.Configure a static route on R1: ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 203.0.113.1.

C.Change PC1's default gateway to 203.0.113.1.

D.Enable IP routing on R1 and configure OSPF.

AnswerA

solution

! R1
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
interface GigabitEthernet0/1
ip nat inside
interface GigabitEthernet0/0
ip nat outside

Why this answer

PC1 has a default gateway of 192.168.1.1, which is correct, but R1 is not performing NAT. R1 can reach the internet (203.0.113.1) but PC1 cannot because R1 drops packets from PC1 destined to the internet without source NAT. The fix is to configure NAT overload (PAT) on R1: define an ACL to match PC1's subnet, configure the inside and outside interfaces, and enable NAT on the outside interface.

This will translate PC1's private IP to R1's public IP.

Exam trap

The trap is that candidates may focus on routing (default route, routing protocols) or IP addressing (default gateway) when the real issue is NAT. Always verify if private IPs are being translated when hosts cannot reach the internet, even if the router itself has connectivity.

Why the other options are wrong

The specific factual error is that a default route is already in place and working; adding another does not solve the NAT problem.

The specific factual error is that a host's default gateway must be on the same subnet; 203.0.113.1 is not reachable directly from PC1.

The specific factual error is that OSPF does not solve the private-to-public address translation problem; it only exchanges routes between routers.

Practice this question →

104

PBQhard

You are troubleshooting a PC (PC-A) connected to switch SW1, which is connected to router R1. PC-A has an APIPA address (169.254.23.45) and cannot reach the internet (203.0.113.1). You confirm that R1 has a correctly configured DHCP pool for the 192.168.10.0/24 subnet, but the DHCP service is not enabled. The network uses VLAN 10 with subnet 192.168.10.0/24. Verify and correct the configuration on PC-A, SW1, and R1 to restore full connectivity.

Network Topology

Hints

•Check if the DHCP server process is running on R1.
•APIPA addresses (169.254.x.x) indicate DHCP failure.
•The DHCP pool is configured but not yet active.

A.Enable the DHCP service on R1 with the 'service dhcp' command.

B.Configure a default gateway on PC-A with the IP address 192.168.10.1.

C.Change the VLAN on SW1's interface connected to PC-A from VLAN 10 to VLAN 1.

D.Add the 'ip helper-address' command on R1's interface connected to SW1.

AnswerA

solution

! R1
service dhcp

! SW1


! PC-A

Why this answer

The APIPA address (169.254.x.x) indicates that PC-A failed to obtain a DHCP lease. The correct solution is to enable the DHCP service on R1 with 'service dhcp', which is not running despite the configured pool. Option B is incorrect because setting a default gateway on PC-A with a static IP would still require a valid address in the subnet; the APIPA address cannot communicate with 192.168.10.1.

Option C is wrong because the PC-A interface on SW1 is correctly assigned to VLAN 10. Option D is unnecessary since R1 is directly connected to the same subnet, so 'ip helper-address' is only used to forward DHCP broadcasts across router boundaries.

Exam trap

Do not assume that configuring a DHCP pool is sufficient; the DHCP service must be explicitly enabled with 'service dhcp'. Also, remember that APIPA addresses indicate DHCP failure, not just a missing gateway.

Why the other options are wrong

The PC's APIPA address cannot reach the 192.168.10.1 gateway because it is not in the same subnet, so configuring a default gateway alone does not restore connectivity.

Changing the VLAN to VLAN 1 would isolate PC-A from the correct subnet (VLAN 10), breaking connectivity instead of fixing it.

The 'ip helper-address' command is used on interfaces that need to forward DHCP broadcasts to a remote DHCP server; here R1 itself is the DHCP server and is directly attached, so the command is not needed.

Practice this question →

105

PBQhard

You are connected to R1 via the console. R1 and R2 are connected via a fiber link using SFPs. The link is not coming up. Configure the correct SFP type on R1's interface GigabitEthernet0/0 to support the required 2 km distance, and fix any auto-negotiation or speed/duplex misconfiguration so that the link becomes operational.

Network Topology

Hints

•Check the transceiver details to see the current SFP's distance capability.
•The link requires 2 km; the current SFP only supports 550 m.
•Auto-negotiation is not used on fiber links; disable it with 'no negotiation auto'.

A.Replace SFP with 1000BASE-LX, configure 'no negotiation auto' on GigabitEthernet0/0, and remove 'speed 1000' and 'duplex full'.

B.Replace SFP with 1000BASE-SX, configure 'negotiation auto' on GigabitEthernet0/0, and keep 'speed 1000' and 'duplex full'.

C.Replace SFP with 1000BASE-LX, configure 'negotiation auto' on GigabitEthernet0/0, and keep 'speed 1000' and 'duplex full'.

D.Replace SFP with 1000BASE-LX, configure 'no negotiation auto' on GigabitEthernet0/0, and configure 'speed 100' and 'duplex full'.

AnswerA

solution

! R1
interface gigabitEthernet 0/0
no speed 1000
no duplex full
no negotiation auto
end

Why this answer

For a 2 km fiber link, a 1000BASE-LX SFP is required (supports up to 10 km). Fiber SFPs like 1000BASE-LX typically do not support auto-negotiation; speed and duplex are fixed. Therefore, the interface should have 'no negotiation auto' configured and no explicit speed/duplex commands.

Option A implements these changes. Option B uses 1000BASE-SX, which is suitable only for up to 550 m. Option C leaves auto-negotiation enabled, which is unsupported.

Option D sets speed to 100, which is incompatible with a GigabitEthernet interface.

Exam trap

Do not assume auto-negotiation is always required; fiber SFPs use fixed parameters. Also, remember that 1000BASE-SX is for short distances (up to 550 m), while 1000BASE-LX supports longer distances (up to 10 km).

Why the other options are wrong

Uses 1000BASE-SX, which cannot support the required 2 km distance.

Retains 'negotiation auto', which is not supported on fiber SFPs and prevents the link from establishing.

Configures 'speed 100', a value incompatible with a 1000BASE-LX SFP, causing a link failure.

Practice this question →

106

MCQhard

A host address is 192.168.90.33/28. Which address is the last usable host in the subnet?

A.192.168.90.46

B.192.168.90.47

C.192.168.90.33

D.192.168.90.48

AnswerA

192.168.90.46 is the last usable host address in the /28 subnet that contains .33. A /28 prefix has a block size of 16, so the subnet boundaries are 192.168.90.32 and 192.168.90.47. The address .46 has all host bits set to 1 except the last one, making it the highest address that can be assigned to a device. The next address, .47, is the directed broadcast for this subnet.

Why this answer

The /28 subnet mask (255.255.255.240) gives a block size of 16 addresses. The network address for 192.168.90.33 is 192.168.90.32, so the broadcast address is 192.168.90.47. The last usable host is the broadcast address minus one, which is 192.168.90.46.

Exam trap

Cisco often tests the distinction between the broadcast address and the last usable host, tricking candidates who forget to subtract one from the broadcast address.

Why the other options are wrong

192.168.90.47 is the broadcast address for the subnet 192.168.90.32/28. Broadcast addresses cannot be assigned to hosts; they are used to send traffic to all hosts in the subnet.

192.168.90.33 is the first usable host in the subnet (network address .32 + 1). The question asks for the last usable host, not the first.

192.168.90.48 is the network address of the next subnet (192.168.90.48/28). It is not part of the current subnet and cannot be used as a host address in the subnet containing .33.

Practice this question →

107

MCQhard

A host with address 10.0.0.130/25 needs to identify its subnet. Which subnet is correct?

A.10.0.0.0/25

B.10.0.0.64/25

C.10.0.0.128/25

D.10.0.0.192/25

AnswerC

The /25 prefix length creates subnets with a block size of 128 addresses. The host address 10.0.0.130 has a last octet binary of 10000010, which lies within the 128-255 range, so it belongs to the subnet that starts at 10.0.0.128. The network address is therefore 10.0.0.128, with usable host addresses 10.0.0.129 through 10.0.0.254 and a broadcast address of 10.0.0.255.

Why this answer

A /25 uses blocks of 128 addresses. In plain language, that means the fourth-octet ranges are 0–127 and 128–255. Since the host address ends in 130, it belongs to the upper block, which means the subnet is 10.0.0.128/25.

This kind of question is a staple of subnetting because it tests whether you can identify the correct subnet boundary from the prefix and host address. Once you recognize the /25 split, the answer becomes straightforward.

Exam trap

Be careful not to confuse the subnet mask with the number of addresses it covers. Always calculate the address range based on the subnet mask.

Why the other options are wrong

The subnet 10.0.0.0/25 covers addresses 10.0.0.0 through 10.0.0.127. Since 10.0.0.130 is outside this range, it cannot belong to this subnet. The host's address must be within the subnet's range.

The /25 prefix length has a subnet size of 128, so valid network addresses are multiples of 128 (0, 128, 256, etc.). 10.0.0.64 is not a multiple of 128, so it is not a valid /25 network address.

The /25 prefix length creates subnets with a block size of 128, starting at 0, 128, 256, etc. 10.0.0.192/25 would be a valid subnet if the network started at 192, but 192 is not a valid /25 boundary because 192 is not a multiple of 128.

Practice this question →

108

PBQmedium

You are connected to the console of R1. The network administrator reports that R1 cannot discover neighboring devices via CDP. R1 is connected to SW1 via GigabitEthernet0/0. You suspect CDP is disabled globally or on the interface. Your task is to enable CDP and verify neighbor discovery.

Network Topology

Hints

•CDP can be disabled globally or per interface.
•Use the 'show cdp' command to check global status.
•After enabling, wait a few seconds for neighbor discovery.

A.Enter global configuration mode, issue 'cdp run', then enter interface configuration mode for GigabitEthernet0/0 and issue 'cdp enable'.

B.Enter global configuration mode, issue 'cdp enable', then enter interface configuration mode for GigabitEthernet0/0 and issue 'cdp run'.

C.Enter global configuration mode, issue 'cdp run', then enter interface configuration mode for GigabitEthernet0/0 and issue 'no cdp disable'.

D.Enter global configuration mode, issue 'cdp enable', then enter interface configuration mode for GigabitEthernet0/0 and issue 'no cdp disable'.

AnswerA

solution

! R1
cdp run
interface GigabitEthernet0/0
cdp enable

Why this answer

CDP was disabled globally and on the interface. Enabling CDP globally and then on the interface allows R1 to discover directly connected Cisco devices.

Exam trap

Remember that CDP requires two separate commands: 'cdp run' globally and 'cdp enable' on each interface. Do not confuse the global and interface commands, and do not invent commands like 'no cdp disable'.

Why the other options are wrong

The specific factual error is that 'cdp enable' is used on interfaces, not globally. The global command to enable CDP is 'cdp run'.

The specific factual error is that 'no cdp disable' is not a valid Cisco IOS command. The proper command is 'cdp enable'.

The specific factual errors are: the global command should be 'cdp run', and the interface command should be 'cdp enable'.

109

Multi-Selectmedium

Which two statements about ARP on an IPv4 Ethernet network are correct? (Choose two.)

Select 2 answers

A.An ARP request is sent as a Layer 2 broadcast.

B.An ARP reply is normally sent as a unicast frame.

C.ARP is used to map IPv6 addresses to MAC addresses.

D.ARP is forwarded by routers across subnets by default.

AnswersA, B

An ARP request is a broadcast at Layer 2 because the sender knows the target IPv4 address but not the target MAC address. To reach all devices on the local Ethernet segment, the frame's destination MAC is set to FF:FF:FF:FF:FF:FF, causing switches to flood it out all ports and every host in the VLAN to process it. Only the device configured with the target IPv4 address responds.

Why this answer

ARP resolves an IPv4 address to a MAC address on the local segment. ARP requests are broadcast; ARP replies are typically unicast.

Exam trap

Be careful not to confuse ARP requests with replies, and remember that ARP operates only within a local segment.

Why the other options are wrong

ARP is specifically designed for IPv4 networks to map IPv4 addresses to MAC addresses. IPv6 uses Neighbor Discovery Protocol (NDP) with ICMPv6 messages to perform address resolution, not ARP.

ARP operates only within a single broadcast domain (subnet) and is not forwarded by routers. Routers separate broadcast domains and do not forward ARP requests or replies across subnets by default.

Practice this question →

110

MCQhard

A host cannot communicate with its default gateway. The technician uses the show arp command on the host and sees that the ARP entry for the gateway IP is incomplete. The technician has already verified that the Ethernet cable is securely connected and the switch port is active. What should the technician do next?

A.Check the switch port’s VLAN configuration and ensure the host and router interface are in the same VLAN.

B.Replace the Ethernet cable between the host and the switch.

C.Clear the ARP cache on the host and attempt to ping the gateway again.

D.Check the router’s routing table for a route to the host’s subnet.

AnswerA

If the host and gateway are in different VLANs, the ARP request broadcast never reaches the gateway, so the entry stays incomplete. This step directly addresses the most probable Layer 2 fault after excluding physical issues.

Why this answer

An incomplete ARP entry for the default gateway indicates that the host sent an ARP request but never received a reply. Since the physical layer (cable and switch port) is verified as operational, the most likely cause is a Layer 2 mismatch: the host and the router interface are in different VLANs, preventing the ARP reply from reaching the host. Checking the switch port's VLAN configuration ensures both devices are in the same broadcast domain, which is required for ARP to function.

Exam trap

Cisco often tests the distinction between Layer 2 connectivity (ARP, VLANs) and Layer 3 connectivity (routing), leading candidates to incorrectly focus on routing tables or ARP cache clearing when the real issue is a VLAN mismatch.

Why the other options are wrong

Candidates may equate a physical link symptom with a faulty cable, but the port’s active status indicates a good L1 connection. This action skips necessary logical checks.

This is a common ‘quick fix’ mindset, but in a structured troubleshooting process, clearing the cache hides information without solving the root cause.

Candidates might confuse local ARP failure with reachability issues to a remote subnet, but the gateway is the router itself. Routing is irrelevant until the destination is off-segment.

Practice this question →

111

MCQmedium

Which IPv6 address type is automatically created on an interface and used for communication on the local link only?

A.Global unicast

B.Link-local

C.Unique local

D.Multicast

AnswerB

Link-local addresses (fe80::/10) are automatically generated on all IPv6-enabled interfaces and remain confined to a single link; they are not routed by routers. This automatic creation happens immediately when IPv6 is enabled on the interface, and the address is typically derived from the interface's MAC address using EUI-64 or generated randomly with privacy extensions. This is the address type the question refers to.

Why this answer

Every IPv6-enabled interface generates a link-local address, typically in the FE80::/10 range. It is used for neighbor discovery, local communication, and next-hop resolution on the same link.

Exam trap

A common exam trap is confusing link-local addresses with unique local or global unicast addresses. Link-local addresses are automatically generated and only valid on the local link, whereas unique local addresses resemble private IPv4 addresses but are routable within an organization. Multicast addresses are not assigned to interfaces for unicast communication, so selecting multicast is incorrect.

Understanding the scope and automatic generation of link-local addresses is critical.

Why the other options are wrong

Global unicast addresses are routable beyond the local link and are not automatically created for local link communication only.

Unique local addresses are similar to private IPv4 addresses and are routable within an organization, not limited to the local link.

Multicast addresses are used for group communication and are not assigned as interface addresses for unicast communication.

Practice this question →

112

MCQhard

A network administrator is troubleshooting an IPv6 connectivity issue on a newly deployed router. The router's G0/0/0 interface is configured with an IPv6 address using EUI-64, but hosts on that subnet cannot reach the router's link-local address. The administrator runs 'show ipv6 interface g0/0/0' and sees that the interface is up/up but the IPv6 address is not in the expected format. What is the most likely cause of the problem?

A.The interface is administratively down.

B.The IPv6 address was not configured correctly; the 'ipv6 address' command was likely omitted or misconfigured.

C.The MAC address of the interface is invalid, preventing EUI-64 from generating a proper address.

D.The router is not sending Router Advertisements, so hosts cannot autoconfigure.

AnswerB

If the 'ipv6 address' command was omitted, IPv6 is not enabled, and no link-local address exists. If it was misconfigured (e.g., missing the `eui-64` keyword), the router would still have a link-local address, so the symptom of hosts unable to reach the link-local address would not occur. Therefore, omission is the most likely cause given the symptom.

Why this answer

The router's G0/0/0 interface is up/up, but the IPv6 address is not in the expected EUI-64 format. This indicates that the 'ipv6 address' command was likely omitted entirely, because if it were simply misconfigured (e.g., without the `eui-64` keyword), the router would still automatically generate a link-local address, and hosts would be able to reach it. Since hosts cannot reach the link-local address, IPv6 is not enabled on the interface at all.

The correct configuration requires the `ipv6 address` command with the appropriate prefix and the `eui-64` keyword.

Exam trap

Cisco often tests the distinction between interface status (up/up) and configuration correctness, leading candidates to assume that a working interface means the IPv6 address is properly configured, when in fact the address may be missing or misconfigured.

Why the other options are wrong

The 'show ipv6 interface' output shows 'up, line protocol is up', indicating the interface is not administratively down. An administratively down interface would show 'administratively down' in the output.

The link-local address (FE80::21A:2BFF:FE3C:4D5E) is correctly formed using EUI-64, which requires a valid MAC address. The presence of 'FF:FE' in the middle indicates EUI-64 is functioning properly, so the MAC address is valid.

The output shows 'ND router advertisements are sent every 200 seconds', confirming that Router Advertisements are enabled. The problem is about the router's own IPv6 address, not host autoconfiguration.

Practice this question →

113

MCQmedium

A switch displays the following output: Interface Status VLAN Gi1/0/5 connected 20 Gi1/0/6 notconnect 1 Gi1/0/24 trunk trunk Which interface is operating as an access port in VLAN 20?

A.Gi1/0/5

B.Gi1/0/6

C.Gi1/0/24

D.None of the interfaces

AnswerA

The output for Gi1/0/5 shows an interface that is up/connected and explicitly assigned to VLAN 20 as an access port, which exactly matches the requirement stated in the question. The status column indicates the link is active, and the VLAN column confirms membership in VLAN 20, leaving no doubt that this is the correct interface.

Why this answer

The output explicitly shows Gi1/0/5 in VLAN 20 and not operating as a trunk.

Exam trap

Be careful not to confuse trunk ports with access ports or assume interfaces not shown in the output are relevant.

Why the other options are wrong

Gi1/0/6 is an access port in VLAN 1 (the default VLAN), not VLAN 20. The question specifically asks for an interface operating as an access port in VLAN 20, so this option is incorrect.

Gi1/0/24 is configured as a trunk port, which carries traffic for multiple VLANs and is not an access port. Access ports belong to a single VLAN, so this option is incorrect.

Gi1/0/5 is clearly an access port in VLAN 20, so there is an interface that matches the description. Therefore, 'None of the interfaces' is incorrect.

Practice this question →

114

MCQhard

A network engineer notices that users on VLAN 100 are experiencing intermittent connectivity to the server farm. The switch connecting these users shows no errors on the uplink interface, but the server farm switch reports a high number of input errors on its connected interface. The engineer runs 'show controllers' on the server farm switch. What is the most likely cause of the issue?

A.The interface is configured with the wrong duplex setting.

B.The SFP module is faulty or incompatible with the cable type.

C.The cable is too long, causing attenuation.

D.Auto-negotiation is disabled, causing a speed mismatch.

AnswerB

The 'show controllers' output shows the media type as 1000BaseSX SFP with auto-negotiation off, but the interface is reporting no errors. However, the other switch sees input errors. This points to a hardware issue with the SFP, such as a faulty module or a mismatch between the SFP and the fiber cable (e.g., using a single-mode SFP with multi-mode fiber).

Why this answer

The 'show controllers' command on the server farm switch reveals physical-layer issues such as framing errors, CRC errors, or alignment errors, which are often caused by faulty or incompatible SFP modules. Since the uplink interface on the user switch shows no errors, the problem is isolated to the server farm switch's interface, and a faulty SFP can introduce signal degradation or electrical issues without necessarily causing complete link failure. Option B is correct because SFP incompatibility or defects commonly produce input errors at the physical layer, even when the link appears up.

Exam trap

Cisco often tests the distinction between 'show interfaces' (which shows input errors but not the specific physical-layer cause) and 'show controllers' (which reveals the exact physical-layer errors), leading candidates to mistakenly choose duplex mismatch or cable length issues without recognizing that the command output points to SFP or transceiver problems.

Why the other options are wrong

The 'show controllers' output confirms Full-duplex on both ends, so a duplex mismatch is not the cause. Duplex mismatch would typically cause collisions or CRC errors, which are not indicated here.

While excessive cable length can cause attenuation and errors, the 'show controllers' output does not show specific error counters like symbol errors or FCS errors that would indicate attenuation. The link is up and no errors are reported on this switch, making cable length an unlikely cause.

Speed is set to 1000 Mbps on both ends, and auto-negotiation is off, which is normal for fiber connections. A speed mismatch would prevent the link from coming up or cause constant errors, but the link is up and no errors are reported on this switch.

Practice this question →

115

Drag & Dropmedium

Drag and drop the following troubleshooting steps into the correct order to diagnose a client connectivity issue using the OSI bottom-up method.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The OSI bottom-up method starts at physical layer and moves up. This ensures that lower-layer issues are resolved before higher-layer troubleshooting, preventing wasted effort on symptoms caused by underlying problems.

Exam trap

The exam trap is that candidates may confuse bottom-up with top-down troubleshooting or think that checking the network layer first is more efficient. Remember: bottom-up always starts at the physical layer and proceeds sequentially upward.

Practice this question →

116

Drag & Dropmedium

Drag and drop the following steps into the correct order to replace a faulty fiber optic SFP module and verify the interface on a Cisco IOS-XE switch. Assume the fiber cable is already disconnected from the SFP module.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order for replacing a faulty SFP module is: first remove the old module, then insert the new one, then connect the fiber cable, and finally verify the interface status and check for errors. Option A follows this sequence exactly. Options B, C, and D each have steps out of order: B connects the cable before removing the old module; C connects the cable before inserting the new module; D verifies the interface before connecting the cable, which would result in the interface being down during verification.

Exam trap

The trap is that candidates may think the cable can be connected at any point, but the correct order requires the module to be inserted before the cable, and the cable must be connected before verification. Also, some may skip the error-checking step, but it is essential for complete verification.

Practice this question →

117

PBQhard

You are connected to R1 via the console. R1 and R2 are directly connected via their GigabitEthernet0/0 interfaces. The link between them is down. Your task is to diagnose and fix the issue: R1's interface is configured for 100 Mbps full-duplex, but R2 is using auto-negotiation. Additionally, the link requires a Gigabit Ethernet connection over a distance of 5 km. Configure R1's interface to match R2's settings (auto-negotiation) and then select and install the correct SFP module to support the 5 km distance requirement.

Network Topology

Hints

•Check the current speed and duplex settings on R1's interface.
•Auto-negotiation requires both sides to be set to 'auto' to succeed.
•For distances up to 5 km, use a 1000BASE-LX SFP (single-mode fiber).

A.Configure R1 with 'no speed', 'no duplex', and 'negotiation auto' on GigabitEthernet0/0, then replace the SFP module with a 1000BASE-LX SFP.

B.Configure R1 with 'speed 1000' and 'duplex full' on GigabitEthernet0/0, then replace the SFP module with a 1000BASE-SX SFP.

C.Configure R1 with 'no speed', 'no duplex', and 'negotiation auto' on GigabitEthernet0/0, then replace the SFP module with a 1000BASE-SX SFP.

D.Configure R1 with 'speed 100' and 'duplex full' on GigabitEthernet0/0, then replace the SFP module with a 1000BASE-LX SFP.

AnswerA

solution

! R1
configure terminal
interface gigabitethernet 0/0
no speed 100
no duplex full
negotiation auto
end

Why this answer

The link is down because R1 is forcing speed 100 and full-duplex while R2 is using auto-negotiation. When one side is hard-coded and the other is set to auto, auto-negotiation fails and the link does not come up. The fix is to enable auto-negotiation on R1 by removing the manual speed and duplex settings with the 'no speed' and 'no duplex' commands, and then using 'negotiation auto'.

For the 5 km distance, a standard 1000BASE-SX SFP (550 m) is insufficient; a 1000BASE-LX SFP (up to 10 km) is required. The candidate must also replace the SFP module with a compatible LX SFP.

Exam trap

Students often forget that auto-negotiation must be enabled on both sides for Gigabit Ethernet; hard-coding one side breaks the link. Also, they may confuse SFP types: SX for short range, LX for long range. Always verify distance requirements when selecting fiber optics.

Why the other options are wrong

The specific factual error is that hard-coding speed and duplex on one side while the other uses auto-negotiation prevents the link from coming up, and 1000BASE-SX cannot reach 5 km.

The specific factual error is that 1000BASE-SX is designed for short-range multimode fiber, not long distances.

The specific factual error is that GigabitEthernet interfaces can operate at 100 Mbps, but the SFP module requires 1000 Mbps; additionally, the speed/duplex mismatch prevents the link from coming up.

Practice this question →

118

PBQhard

You are connected to WLC-1 via the management interface (192.168.1.100/24). The wireless network 'CustomerNet' uses WPA3-Personal, but clients are failing to associate. The SSID is hidden and the correct VLAN is 30. Configure the WLAN and SSID parameters to allow successful client associations and verify the configuration.

Network Topology

Hints

•Remember to create the interface before assigning it to the WLAN.
•WPA3-Personal uses a pre-shared key (PSK) but the command is 'security wpa3'.
•The SSID broadcast must be enabled ('broadcast-ssid enable') for clients to discover it.

A.Create a new interface 'vlan30' with VLAN 30, then create a new WLAN with SSID 'CustomerNet', set security to WPA3-Personal, enable SSID broadcast, and assign the 'vlan30' interface.

B.Modify the existing GuestNet WLAN: change security to WPA3-Personal, enable SSID broadcast, and change the interface to 'guest' (VLAN 20).

C.Create a new WLAN with SSID 'CustomerNet', set security to WPA2-PSK, enable SSID broadcast, and assign the 'guest' interface (VLAN 20).

D.Modify the GuestNet WLAN: change security to WPA3-Personal, keep SSID broadcast disabled, and change the interface to a new interface mapped to VLAN 30.

AnswerA

solution

! WLC-1
config terminal
interface customer
vlan 30
ip address 192.168.30.1 255.255.255.0
exit
wlan 3
ssid CustomerNet
broadcast-ssid enable
security wpa3
security wpa akm psk set-key ascii 0 CiscoSecure123
interface customer
no shutdown
end

Why this answer

The GuestNet WLAN (ID 2) currently uses WPA2 with PSK, but clients expect WPA3-Personal. Additionally, the SSID is hidden (broadcast disabled) and the interface is set to guest (VLAN 20) instead of the required VLAN 30. To fix, create a new WLAN (or modify WLAN 2) to use WPA3-Personal, enable SSID broadcast, and assign it to a new interface mapped to VLAN 30.

Configure the interface first, then apply to the WLAN.

Exam trap

A common trap is to assume that modifying the existing WLAN is sufficient, but you must also ensure the correct VLAN interface exists and is assigned. Additionally, candidates often forget that a hidden SSID must be broadcast for clients to discover it, especially when clients are failing to associate.

Why the other options are wrong

The specific factual error is that the interface remains set to 'guest' (VLAN 20) instead of being changed to VLAN 30 as required.

The specific factual errors are using WPA2-PSK (clients expect WPA3-Personal) and assigning the wrong VLAN (20 instead of 30).

The specific factual error is that the SSID broadcast remains disabled, which means clients cannot see the SSID and will not attempt to associate.

Practice this question →

119

PBQhard

You are managing a Cisco WLC (WLC-1) with IP 10.10.10.10. A wireless client reports it can see the SSID 'CorpNet' but fails to associate. The SSID is configured for WPA3, but the client only supports WPA2. Additionally, the WLAN is mapped to VLAN 100, but the AP is on VLAN 10, causing a mismatch. Your task: reconfigure the WLAN to use WPA2-PSK with AES encryption, correct the VLAN assignment to 10, and ensure the SSID is hidden. Also, verify that management access via the WLC web UI is restricted to the 192.168.1.0/24 subnet.

Network Topology

Hints

•The client cannot join because WPA3 is required but the client only supports WPA2.
•The WLAN is on VLAN 100, but the AP is on VLAN 10 — this mismatch prevents client traffic from being properly bridged.
•Management access is open to all; restrict it to the subnet that contains your admin workstation.

A.Change security to WPA2-PSK with AES, disable PMF, map WLAN to management interface (VLAN 10), disable SSID broadcast, restrict HTTP/HTTPS access to 192.168.1.0/24.

B.Change security to WPA2-PSK with TKIP, enable PMF, map WLAN to VLAN 100, enable SSID broadcast, restrict HTTP access to 192.168.1.0/24.

C.Change security to WPA3-PSK with AES, disable PMF, map WLAN to VLAN 10, disable SSID broadcast, restrict HTTP/HTTPS access to 10.10.10.0/24.

D.Change security to WPA2-PSK with AES, enable PMF, map WLAN to VLAN 10, enable SSID broadcast, restrict HTTP/HTTPS access to 192.168.1.0/24.

AnswerA

solution

! WLC-1
config wlan 1
no security wpa3
security wpa2
security wpa2 akm psk
security wpa2 encryption aes
no security wpa3 pmf
interface VLAN10
no broadcast-ssid
end
config management
management http subnet 192.168.1.0 255.255.255.0
management https subnet 192.168.1.0 255.255.255.0
end

Why this answer

The client cannot associate because the WLAN requires WPA3 (PMF required) but the client only supports WPA2. Also, the WLAN is mapped to VLAN 100, but the AP is on VLAN 10, causing a VLAN mismatch that prevents client traffic from reaching the correct subnet. The SSID is broadcast (visible), and management access is open to all subnets.

To fix: change the WLAN security to WPA2-PSK with AES, disable PMF, map the WLAN to the management interface (VLAN 10), disable SSID broadcast, and restrict HTTP/HTTPS access to subnet 192.168.1.0/24.

Exam trap

The exam trap is that candidates may overlook the VLAN mismatch or the requirement to disable PMF when switching from WPA3 to WPA2. Also, they might forget to restrict both HTTP and HTTPS, or confuse the management subnet with the WLC IP address. Always verify client capabilities and VLAN assignments.

Why the other options are wrong

The specific factual error: TKIP is deprecated and not used with WPA2-PSK; PMF must be disabled for WPA2-only clients; VLAN 100 is incorrect; SSID broadcast should be disabled; HTTPS access must also be restricted.

The specific factual error: WPA3-PSK requires PMF and is incompatible with WPA2-only clients; the allowed subnet for management is 192.168.1.0/24, not 10.10.10.0/24.

The specific factual error: PMF is not supported by all WPA2 clients and can cause association issues; SSID broadcast should be disabled to hide the SSID.

Practice this question →

120

PBQhard

You are connected to R1. The link between R1's GigabitEthernet0/0 and R2's GigabitEthernet0/0 should operate at 1 Gbps full duplex, but the interface is showing errors and only negotiating at 100 Mbps half duplex. Diagnose and fix the fault, then verify the link is stable at the correct speed and duplex.

Network Topology

Hints

•The interface is manually forced to 100 Mbps half duplex; check the duplex and speed configuration.
•Auto-negotiation requires both 'duplex' and 'speed' to be in default (no explicit command).
•CRC errors indicate a duplex mismatch; R2 is likely set to auto-negotiate.

A.Remove the manual speed and duplex settings on R1's GigabitEthernet0/0 with 'no speed' and 'no duplex' to allow auto-negotiation.

B.Change the duplex setting to 'full' and speed to '1000' on R1's GigabitEthernet0/0.

C.Replace the cable between R1 and R2 with a crossover cable.

D.Configure R2's GigabitEthernet0/0 with 'speed 100' and 'duplex half' to match R1's settings.

AnswerA

solution

! R1
enable
configure terminal
interface gigabitEthernet 0/0
no duplex
no speed
end
copy running-config startup-config

Why this answer

The interface was manually configured with 'duplex half' and 'speed 100', which forced the link to 100 Mbps half duplex, causing CRC errors due to duplex mismatch. The correct fix is to remove these manual settings and allow auto-negotiation, or explicitly set both sides to 'speed 1000' and 'duplex full'. Since the remote side (R2) is set to auto (default), the simplest correction is to use 'no duplex' and 'no speed' on R1 to re-enable auto-negotiation.

After the commands are applied, the interface should show 'Full-duplex, 1000Mb/s' and CRC errors should stop incrementing.

Exam trap

The exam trap is that candidates may think manually setting the correct speed and duplex is always the best approach, but they must consider the remote device's configuration. Auto-negotiation is the default and preferred method for Gigabit Ethernet; manual settings should be used consistently on both ends.

Why the other options are wrong

The specific factual error is that manually setting speed and duplex on one side while the other side is set to auto can lead to a mismatch; auto-negotiation is required for proper link establishment.

The specific factual error is that Auto-MDIX eliminates the need for crossover cables on modern interfaces; cable type is not the cause of the problem.

The specific factual error is that matching the incorrect settings does not achieve the desired speed and duplex; it only prevents errors at a lower performance level.

Practice this question →

121

MCQhard

An engineer is deploying a new Cisco Catalyst 9300 switch in a campus wiring closet. The uplink to the distribution switch uses a 1000BASE-LX SFP module. After connecting the fiber, the interface shows 'up/up' but the engineer notices that the 'input errors' counter is incrementing rapidly, with many CRC errors, runts, and giants being reported. What is the most likely cause of these input errors?

A.Replace the SFP with a 1000BASE-SX module.

B.Check the fiber distance and ensure it is within the 5 km limit for 1000BASE-LX; if over, use a single-mode fiber extender.

C.Configure the interface with 'speed 100' and 'duplex full' to match the SFP capabilities.

D.Replace the fiber patch cable with a CAT6a copper cable and use a 1000BASE-T SFP.

AnswerB

1000BASE-LX SFP modules are rated for a maximum distance of 5km over single-mode fiber using 1310nm light. If the actual fiber distance exceeds this, the received optical signal power falls below the receiver sensitivity, producing bit errors and CRC errors on the interface. The correct action is to verify the link distance and either use a fiber extender/repeater or upgrade to a longer-reach optic such as 1000BASE-ZX (up to 70km) to regain a positive link budget.

Why this answer

The 1000BASE-LX standard uses long-wavelength laser optics (1300 nm) over single-mode fiber with a maximum distance of 5 km. Exceeding this limit causes signal attenuation and dispersion, generating bit errors that corrupt the frame check sequence (FCS). Cisco IOS counts these as CRC errors.

Runts (frames shorter than 64 bytes) and giants (frames longer than 1518 bytes) also appear because the damaged frames are misinterpreted. Option B correctly identifies the distance limit as the root cause and recommends verifying it or using a fiber extender. Options A and D propose incorrect media, and option C would break the link since 1000BASE-LX operates at fixed 1000/full speed.

Exam trap

Learners often misdiagnose runts and giants as a duplex mismatch, but when CRC errors are present alongside them, the issue is a physical-layer impairment—such as excessive fiber distance—rather than a configuration error.

Why the other options are wrong

1000BASE-SX uses multimode fiber with a maximum 550 m distance, which is far shorter than 1000BASE-LX and would not resolve a distance issue.

The SFP is fixed at 1000 Mbps full-duplex; manually setting 'speed 100' and 'duplex full' would cause a speed mismatch and prevent the link from coming up.

Copper cabling (CAT6a) and a 1000BASE-T SFP are limited to 100 m and cannot solve a fiber distance problem.

Practice this question →

122

MCQmedium

A network technician is troubleshooting a connectivity issue between two hosts on different subnets. During the analysis, the technician captures packets and observes that the data link layer frames are being stripped and rebuilt at each router hop. Which layer of the OSI model is responsible for encapsulating the original data into segments before transmission from the source host?

A.Network layer

B.Transport layer

C.Data Link layer

D.Application layer

AnswerB

The Transport layer is the exact location where upper-layer application data is broken into smaller units and a transport header is appended, producing TCP segments or UDP datagrams. It manages end-to-end communications, including flow control and reliability, using port numbers and, in TCP, sequence and acknowledgment numbers. This segmentation function is the defining responsibility of Layer 4.

Why this answer

The Transport layer (Layer 4) is responsible for encapsulating the original data into segments. Protocols such as TCP (RFC 793) or UDP (RFC 768) add a header containing source and destination port numbers, sequence numbers, and other control information to form a segment. This segmentation occurs at the source host before the data is passed down to the Network layer for routing.

Exam trap

Cisco often tests the distinction between encapsulation layers by describing a Layer 2 behavior (frame stripping/rebuilding) in the scenario to mislead candidates into selecting the Data Link layer, when the question specifically asks about the layer that creates segments at the source host.

Why the other options are wrong

The Network layer (Layer 3) encapsulates segments into packets and adds logical addressing (IP addresses) for routing across networks, but it does not perform the initial segmentation of data into segments.

The Data Link layer (Layer 2) encapsulates packets into frames and adds physical addressing (MAC addresses) for delivery on a local network segment, but it does not perform segmentation of data into segments.

The Application layer (Layer 7) provides the interface for applications to generate data, but it does not perform segmentation or encapsulation into segments. Segmentation occurs at the Transport layer.

Practice this question →

123

PBQhard

You are connected via the console to SW1, a Cisco Catalyst 2960 switch. The network administrator reports that users in VLAN 10 (Sales) cannot ping the default gateway 192.168.10.1, which is on R1's GigabitEthernet0/1 interface. SW1's interface GigabitEthernet0/1 connects to R1 and is configured as an access port in VLAN 10. R1's interface GigabitEthernet0/1 is configured with IP 192.168.10.1/24 and no shutdown. However, the link between them is up but the line protocol is down on both sides.

Network Topology

Hints

•Check the interface status on both sides for speed/duplex mismatch.
•Use 'show interfaces' to see if there are CRC errors or runts.
•Manually set speed and duplex to the same values on both ends.

A.Configure the switchport to use the same speed and duplex settings as the router interface.

B.Change the switchport mode to trunk to allow VLAN 10 traffic to pass to the router.

C.Assign the IP address 192.168.10.1 to the switch's VLAN 10 interface.

D.Enable CDP on both devices to verify neighbor information.

AnswerA

solution

! R1
interface GigabitEthernet0/1
duplex full
speed 100

! SW1
interface GigabitEthernet0/1
duplex full
speed 100

Why this answer

The line protocol down indicates a Layer 1 or Layer 2 issue. The switch was likely set to auto-negotiate while the router defaulted to auto, but mismatch can occur. Setting both sides to 100 Mbps full duplex resolves the issue.

Exam trap

Do not confuse 'line protocol down' with IP addressing or VLAN issues. The line protocol down is a Layer 1/2 problem, often caused by speed/duplex mismatch. Always check physical and data link layer first.

Why the other options are wrong

The problem is Layer 1/2, not VLAN tagging. A trunk is used when multiple VLANs need to traverse the link, but the line protocol down indicates a physical or data link issue.

The switch's SVI (VLAN interface) is used for management, not for routing user traffic. The problem is at Layer 1/2, not Layer 3.

CDP requires the line protocol to be up to exchange information. Enabling CDP does not resolve speed/duplex mismatches.

124

MCQeasy

Which OSI layer is responsible for end-to-end segmentation, port numbers, and reliability functions such as acknowledgments?

A.Network

B.Data Link

C.Transport

D.Session

AnswerC

At the transport layer, protocols such as TCP and UDP perform end-to-end segmentation, breaking application data into segments that can be reassembled at the destination. The transport header carries source and destination port numbers, which identify the specific application processes at each end of the communication session. TCP also adds reliability mechanisms like sequencing and acknowledgments, making it the definitive layer for this function.

Why this answer

The Transport layer (Layer 4) is responsible for end-to-end segmentation, port numbers for identifying applications, and reliability functions like acknowledgments and retransmission. The Network layer (Layer 3) handles logical addressing and routing between networks. The Data Link layer (Layer 2) manages local frame delivery and error detection.

The Session layer (Layer 5) controls dialog management and synchronization, not segmentation or ports.

Exam trap

Don't confuse the Transport Layer's end-to-end functions with the Network Layer's routing or the Data Link Layer's local communication roles.

Why the other options are wrong

The Network layer provides logical addressing and routing, not end-to-end segmentation or port numbers.

The Data Link layer handles local frame delivery and error detection, not end-to-end reliability or port numbers.

The Session layer manages dialog control and synchronization, not segmentation, port numbers, or reliability acknowledgments.

Practice this question →

125

PBQhard

You are connected to R1. The network has R1, R2, and a multilayer switch MLS1. Configure IPv4 and IPv6 addressing on R1's interfaces so that R1 can ping both R2 (198.51.100.2) and MLS1 (203.0.113.2) via IPv4. Additionally, configure IPv6 on G0/1 using EUI-64 with prefix 2001:db8:1::/64 and verify that R1 can ping the IPv6 address of MLS1 (2001:db8:1::2). The current configuration has incorrect subnet masks and missing IPv6 settings, causing reachability failures.

Hints

•The subnet mask on both interfaces is too large; it should be /30.
•IPv6 is not enabled on G0/1 yet; use the 'ipv6 address' command with EUI-64.
•After changing the mask, the ping should work because the devices will be on the same subnet.

A.Change the subnet mask on G0/0 to 255.255.255.252, change G0/1 to 255.255.255.252, then configure IPv6 on G0/1 with the EUI-64 address using the prefix 2001:db8:1::/64.

B.Change the subnet mask on G0/0 to 255.255.255.0, change G0/1 to 255.255.255.0, then configure IPv6 on G0/1 with the EUI-64 address using the prefix 2001:db8:1::/64.

C.Change the subnet mask on G0/0 to 255.255.255.252, change G0/1 to 255.255.255.252, then configure IPv6 on G0/1 with the static address 2001:db8:1::1/64.

D.Change the subnet mask on G0/0 to 255.255.255.252, change G0/1 to 255.255.255.252, then configure IPv6 on G0/1 with the EUI-64 address using the prefix 2001:db8:1::/32.

AnswerA

solution

! R1
interface GigabitEthernet0/0
ip address 198.51.100.1 255.255.255.252
exit
interface GigabitEthernet0/1
ip address 203.0.113.1 255.255.255.252
ipv6 address 2001:db8:1::/64 eui-64
exit

Why this answer

The interfaces on R1 were configured with subnet masks that were not /30, which is required for these point-to-point links. With an incorrect mask, R1 does not consider the neighboring IPs (198.51.100.2 and 203.0.113.2) as directly connected, preventing ARP resolution and IPv4 reachability. Additionally, IPv6 was missing on G0/1.

To fix, change the subnet mask on G0/0 to 255.255.255.252, change G0/1 to 255.255.255.252, then configure IPv6 on G0/1 with the EUI-64 address using the prefix 2001:db8:1::/64. After these changes, pings succeed.

Exam trap

This question tests your understanding of subnet masks and their impact on Layer 3 reachability. A common trap is to focus only on IPv6 and forget that incorrect IPv4 subnet masks can prevent ARP resolution, even if IPv6 is configured correctly. Also, pay close attention to the exact requirements: EUI-64 and the correct prefix length.

Why the other options are wrong

The specific factual error is that /24 masks are too large for point-to-point links and do not match the expected subnets for R2 and MLS1.

The specific factual error is that the IPv6 address should be configured with the EUI-64 keyword, not a static address.

The specific factual error is that the prefix length must be /64 as specified in the question; a /32 prefix is incorrect for this scenario.

Practice this question →

126

MCQmedium

A switch port and a host NIC have a duplex mismatch. Which symptom is most likely?

A.Increased late collisions and poor performance

B.Incorrect VLAN tagging on trunks

C.OSPF area mismatch errors

D.A change in the subnet mask on the host

AnswerA

A duplex mismatch occurs when one side of an Ethernet link runs full-duplex while the other runs half-duplex. The half-duplex side fails to sense the full-duplex side's transmission, so both transmit simultaneously, producing late collisions after the 64-byte collision window. These late collisions corrupt frames, forcing retransmissions that degrade throughput, increase latency, and cause poor performance.

Why this answer

A duplex mismatch often causes collisions, frame errors, and degraded throughput, especially on the half-duplex side. It is a classic physical/link layer performance problem.

Exam trap

Don't confuse duplex mismatch symptoms with total connectivity loss or latency-only issues; focus on error and collision symptoms.

Why the other options are wrong

VLAN tagging on trunks is a Layer 2 function that deals with VLAN identification using 802.1Q tags. Duplex mismatch is a physical-layer issue affecting how data is sent and received (simultaneous vs. one direction at a time) and has no impact on VLAN tagging.

OSPF area mismatch errors are Layer 3 routing protocol issues that prevent OSPF neighbors from forming. Duplex mismatch is a Layer 1/2 problem that affects frame delivery and collision detection, not routing protocol adjacency.

A change in subnet mask is a Layer 3 IP configuration change that affects network/host identification. Duplex mismatch is a physical-layer issue and does not alter IP addressing or subnet masks.

Practice this question →

127

Multi-Selectmedium

Which TWO interface errors are most likely caused by a mismatch in duplex settings between two connected switches?

Select 2 answers

A.Runts

B.Giants

C.CRC errors

D.Input errors

E.Output errors

F.Flaps

AnswersA, C

Runts are Ethernet frames smaller than the minimum 64-byte size, and they are a classic symptom of duplex mismatch. When one end operates at half duplex and the other at full duplex, the half-duplex end may sense a collision (or late collision) and abort its transmission prematurely, leaving a truncated frame that the full-duplex receiver counts as a runt. Thus, a high rate of runts on an interface strongly suggests that the peer is running at a different duplex setting than the local switch port.

Why this answer

A duplex mismatch occurs when one switch operates at full duplex while the other operates at half duplex. On the half-duplex side, frames arriving while the interface is transmitting are considered collisions, causing the frame to be truncated into fragments (runts). On the full-duplex side, the switch does not detect collisions but may receive incomplete frames, which are counted as runts if they are less than 64 bytes.

CRC errors also spike because the truncated or corrupted frames fail the Frame Check Sequence (FCS) validation.

Exam trap

Cisco often tests the distinction between runts and giants, where candidates mistakenly think giants are caused by duplex mismatch, but giants are actually linked to jumbo frames or faulty hardware, not duplex negotiation issues.

Why the other options are wrong

Giants are frames exceeding the maximum size (typically 1518 bytes) and are caused by MTU misconfiguration, faulty NICs, or software errors, not by duplex mismatch. Duplex mismatch does not affect frame size; it causes collisions and CRC errors.

Input errors is a broad counter that includes runts, CRC errors, frame errors, and others. While duplex mismatch can contribute to some input errors, it is not a specific error type. The question asks for 'interface errors' most likely caused by duplex mismatch, and input errors is too generic.

Output errors include collisions, late collisions, and underruns. While collisions can occur due to duplex mismatch, output errors are not exclusively caused by duplex mismatch; they can result from other issues like cable faults or interface congestion. The question asks for errors 'most likely' caused by duplex mismatch, and runts and CRC errors are more directly linked.

Flaps refer to an interface repeatedly going up and down, typically due to physical layer issues like loose cables, faulty transceivers, or power fluctuations. Duplex mismatch does not cause interface flaps; it causes errors on the link but the interface remains up.

Practice this question →

128

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure a Cisco switch with an IPv4 management address 192.168.1.10/24, an IPv6 address 2001:db8:1::1/64, and a default gateway 192.168.1.1.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

6Step 6

7Step 7

Why this order

Correct order:

Enter global configuration mode – all subsequent configuration commands require this mode.

Enter interface configuration mode for VLAN 1 – the management SVI must be selected to apply IP settings.

Assign the IPv4 address 192.168.1.10 255.255.255.0 – sets the switch's management IPv4 address and subnet mask.

Enable the interface with the no shutdown command – activates the SVI so it can send and receive traffic.

Assign the IPv6 address 2001:db8:1::1/64 – enables IPv6 processing and statically configures a global unicast address.

Exit interface configuration mode to return to global configuration mode – required because the default gateway command is a global configuration command, not an interface subcommand.

Set the default gateway to 192.168.1.1 using the ip default-gateway command – provides the next-hop router for IPv4 traffic leaving the local subnet.

Practice this question →

129

MCQhard

A user on VLAN 10 reports that they cannot ping the default gateway at 192.168.10.1 from their PC with IP 192.168.10.50/24. The switch interface connecting to the PC is up/up, and the PC shows a valid IP configuration. What is the most likely cause of this connectivity failure?

A.Change the switchport mode to trunk to allow VLAN 10 traffic.

B.Configure an SVI for VLAN 10 with an IP address in the 192.168.10.0/24 subnet.

C.Change the PC's IP address to a different subnet, such as 192.168.20.0/24.

D.Recreate VLAN 10 and reassign the port to it.

AnswerB

The switch must provide a Layer 3 interface in VLAN 10 to serve as the default gateway for PCs in the 192.168.10.0/24 subnet. An SVI (interface vlan 10) with an IP address from that subnet creates a routable interface on the multilayer switch. This allows hosts in VLAN 10 to send traffic to other subnets, as their default gateway points to that SVI. Without this SVI, the PC has no gateway to route its traffic beyond its local segment.

Why this answer

The PC and default gateway are on the same subnet (192.168.10.0/24), but the switch lacks a Layer 3 interface for VLAN 10. Without an SVI (Switch Virtual Interface) configured with an IP address in that subnet, the switch cannot route traffic to the gateway or respond to ARP requests from the PC, breaking connectivity even though the access port is up/up.

Exam trap

Cisco often tests the misconception that a VLAN alone provides Layer 3 connectivity, when in fact an SVI or a separate router-on-a-stick configuration is required for inter-VLAN routing and default gateway functionality.

Why the other options are wrong

A trunk port is used to carry multiple VLANs between switches, not to connect an end device like a PC. Configuring the switchport as trunk would break connectivity because the PC expects an access port.

Changing the PC's IP subnet would not resolve the issue because the PC would still need a default gateway on its new subnet. The root cause is the missing SVI on the switch, not the PC's IP address.

Recreating VLAN 10 and reassigning the port does not address the missing SVI. The VLAN already exists and the port is correctly assigned; the issue is at Layer 3, not Layer 2.

Practice this question →

130

MCQhard

A host is configured with IP address 192.168.50.94/27. Which subnet contains that host?

A.192.168.50.32/27

B.192.168.50.64/27

C.192.168.50.96/27

D.192.168.50.0/27

AnswerB

A /27 prefix length defines a subnet mask of 255.255.255.224, creating a block of 32 addresses. The host address 192.168.50.94 falls within the range 192.168.50.64–192.168.50.95, where 192.168.50.64 is the network address and 192.168.50.95 is the broadcast address. This satisfies the constraint that the host’s IP must lie between the subnet’s network and broadcast addresses.

Why this answer

A /27 subnet has a block size of 32. In simple terms, the fourth-octet ranges are 0–31, 32–63, 64–95, 96–127, and so on. Because 94 falls inside the 64–95 range, the network address for the host’s subnet is 192.168.50.64/27.

This kind of question tests whether you can move from prefix length to block size and then place the host inside the correct interval. The most common mistake is choosing a nearby boundary like 96 or 32 without calculating the actual block that contains the address.

Exam trap

Always calculate the subnet range using the block size derived from the prefix length to avoid choosing incorrect boundaries.

Why the other options are wrong

The subnet 192.168.50.32/27 covers addresses 192.168.50.32 to 192.168.50.63. The host address 192.168.50.94 is outside this range, so it does not belong to this subnet.

The subnet 192.168.50.96/27 covers addresses 192.168.50.96 to 192.168.50.127. The host address 192.168.50.94 is below this range, so it does not belong to this subnet.

The subnet 192.168.50.0/27 covers addresses 192.168.50.0 to 192.168.50.31. The host address 192.168.50.94 is far above this range, so it does not belong to this subnet.

Practice this question →

131

Multi-Selectmedium

Which TWO statements accurately describe characteristics of copper and fiber optic cabling used in modern Ethernet networks?

Select 2 answers

A.Copper UTP cables can reliably transmit data up to 500 meters without a repeater.

B.Fiber optic cables are immune to electromagnetic interference (EMI).

C.Multi-mode fiber typically uses laser-based transmitters for short-range communication.

D.Single-mode fiber is designed for long-distance transmission with a narrow core.

E.Fiber optic cabling is generally less expensive per meter than copper cabling.

AnswersB, D

Fiber optic cables transmit data as pulses of light through a glass or plastic core, so they are completely unaffected by electromagnetic interference, radio-frequency interference, or electrical crosstalk from nearby power cables and machinery. This immunity makes single-mode and multi-mode fiber the preferred medium in industrial environments, data centers, and other settings where electrical noise would corrupt copper signals.

Why this answer

Fiber optic cables transmit data as light pulses through glass or plastic cores, which are completely unaffected by electromagnetic interference (EMI), unlike copper cables that rely on electrical signals and are susceptible to EMI. Option D is correct because single-mode fiber uses a narrow core (typically 9 microns) and laser transmitters to support long-distance transmission (up to tens of kilometers) with low signal loss. Option A is wrong because copper UTP cables are limited to 100 meters without a repeater, not 500 meters.

Option C is wrong because multi-mode fiber typically uses LED or VCSEL transmitters for short-range communication, while laser-based transmitters are used with single-mode fiber. Option E is wrong because fiber optic cabling is generally more expensive per meter than copper cabling, though installation and equipment costs may differ.

Exam trap

Cisco often tests the distinction between multi-mode and single-mode fiber transmitters, where candidates mistakenly associate laser-based transmitters with multi-mode fiber instead of correctly identifying them with single-mode fiber's long-distance, narrow-core design.

Why the other options are wrong

Copper UTP cables have a maximum segment length of 100 meters for Ethernet, not 500 meters without a repeater.

Multi-mode fiber typically uses LED or VCSEL transmitters, not laser-based transmitters; lasers are used with single-mode fiber for long distances.

Fiber optic cabling is generally more expensive per meter than copper cabling, not less expensive.

Practice this question →

132

Drag & Dropmedium

Which of the following shows the correct order of steps to troubleshoot a suspected duplex mismatch and CRC errors on a Cisco IOS-XE interface?

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The proper troubleshooting flow requires moving through the correct configuration hierarchy: from privileged EXEC mode you first enter global configuration mode. Then you specify the affected interface to enter interface configuration mode, where the duplex and speed settings are applied. After making the changes, you exit all configuration modes back to privileged EXEC and use show commands to verify the interface status.

Option A follows this exact sequence. Option B is wrong because it tries to enter interface configuration without global config. Option C mistakenly attempts to set duplex/speed globally, which is not allowed.

Option D not only omits global config but also exits to the wrong mode, leaving you in global configuration instead of privileged EXEC for verification.

Exam trap

A common trap is to forget that you must enter global configuration mode before interface configuration mode. Another trap is to think that duplex and speed can be set globally, but they are interface-specific. Always remember the correct hierarchy: privileged EXEC -> global config -> interface config.

Practice this question →

133

MCQhard

An IPv6 host successfully reaches neighbors on its local segment, but it cannot reach remote IPv6 destinations. The host has a global unicast address and a correct prefix length. Which missing item is the strongest suspect?

A.A usable default router or next-hop route for off-link IPv6 traffic

B.A NAT rule translating IPv6 to IPv4

C.A VLAN trunk on the host NIC

D.A second global unicast address on the same interface

AnswerA

IPv6 hosts on a local segment can communicate with neighbors using Neighbor Discovery (ND) and link-local addresses, but any traffic destined beyond that segment must be forwarded by a router. Without a default router learned via ICMPv6 Router Advertisement or a manually configured static route, the host has no way to choose a next hop for off-link destinations. Thus the host would successfully reach on-link neighbors yet fail to reach anything outside the local segment.

Why this answer

The strongest suspect is the absence of a usable default router learned through IPv6 router advertisements or equivalent configuration. While local connectivity works because the host can communicate on its own link, remote IPv6 destinations require a next hop off the local segment. Option B is wrong because IPv6-to-IPv4 NAT is unnecessary for native IPv6 communication and would not be the primary cause of off-link failure.

Option C is wrong because a VLAN trunk on the host NIC is for carrying multiple VLANs, not for enabling off-link routing. Option D is wrong because a second global unicast address does not provide a default route; it only adds another local address.

Exam trap

Don't confuse local connectivity success with overall network configuration correctness. Always check for a default route when remote communication fails.

Why the other options are wrong

NAT rules are not required for native IPv6 communication and would not be the first suspect when a host cannot reach remote IPv6 destinations.

A VLAN trunk on the host NIC relates to Layer 2 segmentation, not to providing a default route for off-link IPv6 traffic.

A second global unicast address on the same interface does not supply the missing default route needed to reach off-link destinations.

Practice this question →

134

PBQhard

You are connected to the Cisco WLC (WLC-1) via its management IP 192.168.1.10. The wireless network 'CorpNet' is configured but clients cannot associate. Troubleshoot and resolve the issue: clients report 'Association failed' and the SSID is not visible in site surveys. Ensure that after your fix, the SSID is broadcast, WPA3 is used, and the WLAN is mapped to VLAN 20. Also, verify the WLC management interface is accessible over HTTPS.

Network Topology

Hints

•Check if the WLAN is enabled and broadcasting the SSID.
•Verify that the WLAN is mapped to a user VLAN, not the management interface.
•Ensure HTTPS is enabled for web management access.

A.Enable the WLAN, set Broadcast SSID to Enabled, create a dynamic interface for VLAN 20 and map the WLAN to it, and enable the HTTPS server.

B.Enable the WLAN, set Broadcast SSID to Enabled, change the interface to the management interface, and enable the HTTPS server.

C.Enable the WLAN, keep Broadcast SSID Disabled for security, create a dynamic interface for VLAN 20 and map the WLAN to it, and enable the HTTPS server.

D.Enable the WLAN, set Broadcast SSID to Enabled, create a dynamic interface for VLAN 20 and map the WLAN to it, but leave HTTPS disabled for security.

AnswerA

solution

! WLC-1
config wlan 1 enable
config wlan 1 broadcast-ssid enable
config wlan 1 interface vlan20
config interface create vlan20 20
config interface address vlan20 192.168.20.1 255.255.255.0
config wlan 1 interface vlan20
ip http secure-server

Why this answer

The WLAN was disabled, the SSID was hidden (Broadcast SSID Disabled), and it was incorrectly mapped to the management interface instead of a user VLAN. Additionally, HTTPS access was disabled. The solution: enable the WLAN, enable SSID broadcast, change the interface to a VLAN 20 interface (e.g., create a dynamic interface 'vlan20' with VLAN 20), and enable the HTTPS server for management access.

Note: On an AireOS WLC, the correct commands use `config wlan enable <wlan_id>`, `config wlan broadcast-ssid enable <wlan_id>`, and `config network secureweb enable` for HTTPS.

Exam trap

This question tests your ability to identify multiple misconfigurations simultaneously. Common traps: confusing management interface with user VLANs, thinking hidden SSID is acceptable when broadcast is required, and overlooking the HTTPS requirement. Also, ensure you use AireOS-specific commands, not IOS commands like `ip http secure-server`.

Always verify all requirements in the question.

Why the other options are wrong

The specific factual error: The management interface is for WLC management traffic, not client data. Client traffic should be on a separate user VLAN.

The specific factual error: Broadcast SSID must be enabled for the SSID to be visible. Disabling it hides the SSID, which contradicts the requirement to make it visible.

The specific factual error: HTTPS must be enabled for management access. Disabling it would block HTTPS connections to the WLC.

Practice this question →

135

Multi-Selectmedium

Which TWO statements correctly describe the configuration and verification of IPv4 and IPv6 parameters for host connectivity, including default gateway, DNS, and subnet masks?

Select 2 answers

A.The subnet mask determines the DNS server address used by the host.

B.The default gateway must be on the same subnet as the host's IP address.

C.IPv6 hosts can only obtain their IP address via DHCPv6.

D.The command 'ipconfig /all' displays both IPv4 and IPv6 configuration details.

E.A host can reach any remote network if its default gateway is configured with any IP address.

AnswersB, D

For a host to deliver a frame to the default gateway, the gateway's IP must be in the same network/subnet as the host's interface, because the host uses ARP (or NDP for IPv6) to resolve the gateway's MAC address on the local link. If the gateway were on a different subnet, the host would not be able to reach it without another router on the local segment.

Why this answer

A host's default gateway must be on the same subnet to be reachable at Layer 2; otherwise, a circular dependency occurs. Option D is correct because the 'ipconfig /all' command displays both IPv4 and IPv6 configuration details, including IP address, subnet mask, default gateway, and DNS servers. Option A is wrong because the subnet mask determines the network and host portions of an IP address, not the DNS server address.

Option C is wrong because IPv6 hosts can obtain their IP address via SLAAC, DHCPv6, or static configuration; the phrase 'can only' makes it incorrect. Option E is wrong because the default gateway must be reachable (on the same subnet) and configured with an IP address that belongs to a router interface on that subnet, not just any IP address.

Exam trap

Cisco often tests the misconception that IPv6 hosts require DHCPv6 for address assignment, when in fact SLAAC is a common and valid method, and the question's wording 'can only' is the trap that eliminates Option C.

Why the other options are wrong

The subnet mask is used to determine the network portion of an IP address and the host portion, not the DNS server address. DNS server addresses are configured separately, either manually or via DHCP.

IPv6 hosts can obtain their IP address via Stateless Address Autoconfiguration (SLAAC), which does not require DHCPv6. DHCPv6 is optional and used for stateful configuration or to provide additional parameters.

The default gateway must be on the same subnet as the host's IP address; otherwise, the host cannot send Ethernet frames to it because the gateway's MAC address would not be reachable via ARP. An arbitrary IP address would not work.

Practice this question →

136

Multi-Selectmedium

Which TWO statements correctly describe the configuration and verification of IPv4 and IPv6 parameters for host connectivity?

Select 2 answers

A.On a Windows host, the default gateway IPv4 address must be on the same subnet as the host's IPv4 address.

B.The IPv6 default gateway can be any global unicast address on the internet.

C.The subnet mask is used to define the host portion of an IPv4 address.

D.A DNS server address can be statically configured on a host or obtained dynamically via DHCP.

E.Configuring a DNS server is mandatory for a host to communicate with any other device on the same subnet.

AnswersA, D

On a Windows host, and on any IPv4 host, the default gateway address must reside on the same subnet as the host's own IPv4 address because the host must deliver Ethernet frames directly to the gateway using its MAC address, obtained via ARP. If the gateway were on a different subnet, the host would need to use another router to reach it, which contradicts the purpose of the default gateway as the immediate next hop. The host validates this by applying its own subnet mask to the gateway address and will reject it if it ends up in a different network.

Why this answer

For a host to reach outside its subnet, the default gateway's IP must be in the same subnet; otherwise the host cannot ARP for the gateway's MAC and traffic will fail. Option D is correct because DNS server addresses can be set manually or assigned via DHCP. Option B is wrong because IPv6 gateways must be on the same local link, not any global unicast address on the internet.

Option C is wrong because the subnet mask defines the network/subnet portion of an IPv4 address, not the host portion. Option E is wrong because DNS is used for name resolution; local IP communication on the same subnet works without DNS.

Exam trap

Cisco often tests the misconception that a default gateway can be any routable address, but the trap here is that both IPv4 and IPv6 default gateways must be on the same local subnet as the host for Layer 2 reachability.

Why the other options are wrong

An IPv6 default gateway must be on the same local link, not just any globally routable address.

The subnet mask identifies the network bits, not the host bits; the host portion is the inverse of the mask.

DNS resolves names to IPs; hosts on the same subnet can communicate with IP addressing alone, making DNS optional.

Practice this question →

137

MCQhard

A host address is 172.16.8.70/26. What is the network address of its subnet?

A.172.16.8.0

B.172.16.8.64

C.172.16.8.70

D.172.16.8.128

AnswerB

For a /26 prefix, the subnet mask is 255.255.255.192, which creates block sizes of 64 addresses in the fourth octet. The host address .70 lies in the range 64–127, so the network address is found by zeroing the host bits: 70 AND 192 = 64. Thus, 172.16.8.64 is the correct network address for this host.

Why this answer

A /26 uses blocks of 64 addresses. In plain language, the fourth-octet subnet ranges are 0–63, 64–127, 128–191, and 192–255. Since the host address ends in 70, it belongs to the 64–127 block. That means the network address of the subnet is 172.16.8.64.

This is a standard subnetting calculation. The key is to identify the correct block based on the prefix and then choose the first address in that block as the network address.

Exam trap

A frequent exam trap is mistaking the host IP address for the network address or selecting the wrong subnet block based on the subnet mask. Candidates often pick 172.16.8.0 because it looks like a common network address or 172.16.8.128 assuming it’s the next block, but these do not contain the host 172.16.8.70 under a /26 mask. The trap arises from not calculating subnet ranges correctly or misunderstanding how subnet masks segment the address space into fixed blocks.

This mistake leads to incorrect subnet identification and can cause routing or addressing errors in real networks.

Why the other options are wrong

172.16.8.0 is incorrect because the /26 subnet blocks cover 0–63, 64–127, etc., and the host address 70 does not fall within the 0–63 range. Selecting this ignores the actual subnet boundaries defined by the mask.

172.16.8.70 is incorrect because this is the host address itself, not the network address. The network address must be the first address in the subnet block, not a host address within it.

172.16.8.128 is incorrect because this subnet block starts at 128, which is above the host address 70. The host does not belong to this subnet, so this cannot be the network address.

Practice this question →

138

Matchingmedium

Drag and drop the cable types and transceivers on the left to their corresponding distance limits or interface diagnostics on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

100 meters maximum segment length

550 meters maximum segment length

5 km maximum segment length

300 meters over multimode fiber

Displays interface errors, speed, and duplex

Why these pairings

Each cable type or transceiver has a specified maximum distance based on IEEE standards and fiber-optic characteristics. Cat5e UTP supporting 1000BASE-T is limited to 100 meters due to signal attenuation and the 1000BASE-T standard. Multimode fiber OM3 with 1000BASE-SX (short wavelength) reaches up to 550 meters because of modal dispersion and the SX transceiver's power budget.

Singlemode fiber with 1000BASE-LX (long wavelength) can transmit up to 5 kilometers due to lower attenuation and reduced dispersion in single-mode fiber. The SFP-10G-SR (short-reach 10 Gigabit) transceiver over OM3 multimode fiber has a maximum distance of 300 meters per the 10GBASE-SR standard. The 'show interfaces' command displays critical interface diagnostics such as input/output errors, speed, duplex settings, and CRC errors, which are essential for troubleshooting link issues.

Exam trap

Be careful not to confuse the distance limits of multimode vs. single-mode fiber. Remember: SX = short reach (hundreds of meters), LX = long reach (kilometers), ER = extended reach (tens of kilometers). Copper is always 100m.

Practice this question →

139

MCQmedium

Which rule does a router apply first when selecting a route for a destination packet?

A.Lowest metric across all protocols

B.Oldest route in the routing table

C.Longest prefix match

D.Default route if one exists

AnswerC

A router's IP forwarding logic first identifies all routes whose prefix matches the destination address's network portion. It then selects the route with the longest subnet mask because that prefix is the most specific representation of the destination, even if that route has a higher metric. This rule is non-negotiable and precedes any metric or administrative-distance comparison.

Why this answer

Routers first look for the most specific matching prefix. Administrative distance and metrics matter when competing routes exist for the same destination prefix length.

Exam trap

Remember, prefix length is the primary factor in route selection, not administrative distance or metrics.

Why the other options are wrong

The router first uses the longest prefix match to select a route; metrics are only compared among routes from the same routing protocol or when administrative distance is equal. Comparing metrics across different protocols is not the first step.

Route age is not a primary selection criterion; routers use longest prefix match first, then administrative distance, then metric. Older routes are not preferred over newer ones in the selection process.

A default route is only used when no other route matches the destination; the router first checks for more specific matches using the longest prefix match. The default route is the least preferred.

Practice this question →

140

Multi-Selectmedium

Which single OSI model layer is responsible for both end‑to‑end reliable data delivery and segmenting data into smaller units?

Select 1 answer

A.Transport layer (Layer 4)

B.Data Link layer (Layer 2)

C.Network layer (Layer 3)

D.Session layer (Layer 5)

E.Transport layer (Layer 4) and Network layer (Layer 3)

AnswersA

The Transport layer (Layer 4) is correct: it accepts data from the Session layer, divides it into segments, and is responsible for end-to-end delivery. TCP, a Transport layer protocol, provides reliable delivery via sequence numbers, acknowledgments, timeouts, and retransmissions, while UDP is a simpler, unreliable transport alternative. This layer is uniquely positioned to ensure that the entire message arrives intact and in order across the network.

Why this answer

The Transport layer (Layer 4) is the only OSI layer responsible for both end‑to‑end reliable data delivery (via protocols like TCP) and segmenting data into smaller units (segments). The Network layer (Layer 3) handles routing and packetizing but does not provide reliability. Therefore, only the Transport layer fulfills both requirements.

Exam trap

Candidates may think the Network layer also performs both functions because it segments data into packets and provides end‑to‑end delivery, but reliability is strictly a Transport layer function. The question asks for a single layer, so combining Transport and Network is incorrect.

Why the other options are wrong

The Data Link layer handles framing and error detection on a single link, not end‑to‑end reliability or segmentation across the entire network.

The Network layer provides routing and logical addressing but does not guarantee delivery or perform segmentation of data from applications.

The Session layer manages dialog control between applications, not data segmentation or reliable transport mechanisms.

Practice this question →

141

MCQmedium

Exhibit: A laptop has IP address 10.20.30.44/27. Which address is its directed broadcast for that subnet?

A.10.20.30.31

B.10.20.30.32

C.10.20.30.63

D.10.20.30.64

AnswerC

With a /27 prefix, the subnet block size is 32 addresses. The host address 10.20.30.44 falls inside 10.20.30.32/27, whose range extends from .32 through .63. The directed broadcast address is the final address in that range, 10.20.30.63, with all five host bits set to 1. It is valid only as a broadcast target and cannot be assigned to an interface.

Why this answer

A /27 gives a block size of 32 addresses. The host 10.20.30.44 falls in the 10.20.30.32 to 10.20.30.63 subnet, so the broadcast address is 10.20.30.63.

Exam trap

Avoid confusing the network address or a host address with the broadcast address. Remember, the broadcast address is the last address in the subnet.

Why the other options are wrong

10.20.30.31 is the broadcast address of the previous /27 subnet (10.20.30.0/27), not the subnet containing 10.20.30.44. The host 10.20.30.44 belongs to the 10.20.30.32/27 subnet, so its broadcast is 10.20.30.63.

10.20.30.32 is the network address (subnet ID) of the subnet 10.20.30.32/27, not the broadcast address. The network address is the first address in the subnet and is used to identify the subnet itself.

10.20.30.64 is the network address of the next /27 subnet (10.20.30.64/27), not the broadcast of the current subnet. The broadcast address for 10.20.30.32/27 is 10.20.30.63.

Practice this question →

142

PBQhard

You are connected to the console of R1. The network uses IPv6 with EUI-64. R1's GigabitEthernet0/0 interface has MAC address 001e.4a7b.9c0d. You need to configure an IPv6 address on this interface using EUI-64, with the subnet 2001:db8:abcd:1::/64.

Hints

•Enable IPv6 globally first if not already done.
•Use the 'ipv6 address' command with the 'eui-64' keyword.
•The interface must have IPv6 enabled to use EUI-64.

A.ipv6 address 2001:db8:abcd:1::/64 eui-64

B.ipv6 address 2001:db8:abcd:1::/64

C.ipv6 address 2001:db8:abcd:1::/64 link-local

D.ipv6 enable

AnswerA

solution

! R1
interface GigabitEthernet0/0
ipv6 address 2001:db8:abcd:1::/64 eui-64
ipv6 enable

Why this answer

The 'ipv6 address 2001:db8:abcd:1::/64 eui-64' command configures the IPv6 address using EUI-64, which generates the interface ID from the MAC address. This command alone enables IPv6 on the interface and assigns the global address; the 'ipv6 enable' command is not strictly necessary and is only required if a link-local address is needed without a global address. Option B would configure a static interface ID, not EUI-64.

Option C incorrectly uses the 'link-local' keyword, which is not valid in this context. Option D only enables IPv6 for link-local addressing without assigning a global unicast address.

Exam trap

Remember that EUI-64 requires the 'eui-64' keyword after the prefix. Without it, the address is static. Also, 'ipv6 enable' only creates a link-local address, not a global one.

Why the other options are wrong

The command lacks the 'eui-64' keyword, so it does not generate the interface ID from the MAC address.

The 'link-local' keyword is used for link-local addresses (fe80::/10), not for global prefixes.

The command does not assign the specified subnet prefix; it only activates IPv6 processing.

143

MCQhard

A host address is 192.168.14.222/28. Which address is the broadcast address of its subnet?

A.192.168.14.207

B.192.168.14.223

C.192.168.14.208

D.192.168.14.224

AnswerB

With /28, the host portion occupies only the last 4 bits, so the usable range for the subnet containing .222 is 192.168.14.208 through 192.168.14.223. Setting all host bits to 1 yields the broadcast address 192.168.14.223, which is the directed broadcast for the /28 subnet that includes .222. This makes .223 the correct answer.

Why this answer

A /28 subnet has a block size of 16. In practical terms, the fourth-octet blocks are 0-15, 16-31, and so on. Because 222 falls within the 208-223 block, the broadcast address is the last address in that block: 192.168.14.223.

This is a subnet-boundary question that depends on identifying the correct /28 block before choosing the broadcast address.

Exam trap

Be careful not to confuse the broadcast address with the network address of the next subnet or a host address within the subnet.

Why the other options are wrong

192.168.14.207 is the broadcast address of the previous /28 subnet (192.168.14.192/28), not the subnet containing 192.168.14.222.

192.168.14.208 is the network address (subnet ID) of the /28 subnet containing .222, not the broadcast address.

192.168.14.224 is the network address of the next /28 subnet (192.168.14.224/28), not the broadcast of the current subnet.

Practice this question →

144

MCQmedium

A network administrator is troubleshooting a Windows 10 workstation that cannot access the internet. The workstation receives an IPv4 address starting with 169.254.x.x. The network uses DHCP, and other workstations on the same subnet are working correctly. What is the most likely cause of this issue?

A.The workstation's DNS server settings are incorrect.

B.The workstation's network cable is unplugged or faulty, preventing DHCP communication.

C.The DHCP server has exhausted its address pool.

D.The workstation's default gateway is misconfigured.

AnswerB

A physical connectivity issue (e.g., unplugged or faulty cable) prevents the workstation from reaching the DHCP server, causing it to fall back to APIPA. This is the most common cause when only one workstation is affected.

Why this answer

The 169.254.x.x address is an Automatic Private IP Addressing (APIPA) address assigned by Windows when DHCP fails. Since other workstations on the same subnet work correctly, the DHCP server and network are functional, isolating the issue to the specific workstation. A faulty or unplugged network cable would prevent the workstation from sending DHCP Discover messages, causing it to fall back to APIPA.

Exam trap

Cisco often tests the distinction between DHCP failure symptoms (APIPA) and other connectivity issues, trapping candidates who confuse DNS or gateway misconfigurations with the inability to obtain an IP lease.

Why the other options are wrong

Incorrect DNS settings prevent name resolution but do not affect IP address assignment. The workstation would still receive a valid IP from DHCP, not an APIPA address.

If the DHCP pool were exhausted, all workstations would fail to obtain addresses and use APIPA. The scenario states other workstations are working correctly, so pool exhaustion is not the cause.

A misconfigured default gateway would prevent internet access but the workstation would still receive a valid IP from DHCP. APIPA addresses are only assigned when DHCP fails entirely.

Practice this question →

145

Multi-Selectmedium

Which two statements accurately describe subnet masks in IPv4?

Select 2 answers

A.It identifies the network-versus-host split in an IPv4 address.

B.It helps a host determine whether a destination is local or remote.

C.It resolves hostnames into IP addresses.

D.It encrypts packets before they leave the host.

E.It replaces the need for a default gateway.

AnswersA, B

A subnet mask is a 32-bit value that uses contiguous 1s to mark the network portion of an IPv4 address and contiguous 0s to mark the host portion. By ANDing an IP address with its mask, you derive the network address, which reveals the exact boundary between the bits that identify the network and the bits assigned to hosts. This boundary is the mask's defining purpose, so saying it identifies the network-versus-host split is accurate.

Why this answer

A subnet mask tells the host which part of the IPv4 address refers to the network and which part refers to the host. In plain language, it helps the device determine whether a destination is local or remote. That decision is essential because it affects whether the host uses ARP directly or forwards traffic to the default gateway.

The wrong answers usually attribute unrelated behaviors to the subnet mask, such as encryption or hostname resolution. The two correct answers are the ones that preserve its role in defining local scope and address structure.

Exam trap

Avoid confusing subnet mask functions with encryption or DNS, as these are unrelated to IP address segmentation.

Why the other options are wrong

Subnet masks are used solely for IP addressing and routing purposes, not for name resolution. Hostname-to-IP-address resolution is performed by the Domain Name System (DNS), which is a completely different protocol and service.

Subnet masks do not provide any encryption or security functionality. Encryption of packets is performed by protocols such as IPsec, TLS, or other cryptographic mechanisms, which operate independently of subnet masking.

A default gateway is still required for any traffic destined to a different subnet. The subnet mask only defines the local network boundary; it does not provide routing to other networks. Without a default gateway, a host cannot send packets off its subnet.

Practice this question →

146

MCQhard

A host address is 192.168.50.158/27. Which address is the network address of its subnet?

A.192.168.50.128

B.192.168.50.159

C.192.168.50.160

D.192.168.50.96

AnswerA

With a /27 prefix, the subnet block size is 32 addresses. The host .158 falls within the range .128–.159, and the network address is always the first address of that block, so it is 192.168.50.128. This is the lowest address that identifies this subnet.

Why this answer

A /27 subnet has a block size of 32. In practical terms, the relevant ranges in the last octet are 0-31, 32-63, 64-95, 96-127, 128-159, and so on. Because 158 falls in the 128-159 block, the network address is 192.168.50.128.

This is a block-identification question. Once you identify the correct /27 block, the network address is the first address in that range.

Exam trap

Ensure you calculate the correct block range for the subnet mask given, not just any multiple of the block size.

Why the other options are wrong

192.168.50.159 is the broadcast address for the 192.168.50.128/27 subnet, not the network address. The broadcast address is used to send packets to all hosts in the subnet and cannot be assigned to a host.

192.168.50.160 is the network address of the next /27 subnet (160-191), not the subnet containing 158. The /27 mask creates subnets with a block size of 32, so the subnet boundaries are multiples of 32.

192.168.50.96 is the network address of the 96-127 /27 subnet, which is an earlier subnet. The address 158 falls in the 128-159 range, not the 96-127 range.

Practice this question →

147

PBQmedium

You are connected to the console of R1. The network uses IPv6 with EUI-64. R1's GigabitEthernet0/0 interface has MAC address 0011.2233.4455. You must configure the interface to generate an IPv6 link-local address using the 'ipv6 enable' command, and also assign a global unicast address 2001:db8:1::/64 using EUI-64. The interface is currently administratively down.

Network Topology

Hints

•EUI-64 derives the interface ID from the MAC address.
•The 'ipv6 enable' command generates a link-local address.
•The interface must be administratively brought up.

A.R1(config-if)# ipv6 enable R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64 R1(config-if)# no shutdown

B.R1(config-if)# ipv6 address fe80::/10 eui-64 R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64 R1(config-if)# no shutdown

C.R1(config-if)# ipv6 address 2001:db8:1::/64 eui-64 R1(config-if)# no shutdown

D.R1(config-if)# ipv6 enable R1(config-if)# ipv6 address 2001:db8:1::1/64 R1(config-if)# no shutdown

AnswerA

solution

! R1
interface GigabitEthernet0/0
ipv6 enable
ipv6 address 2001:db8:1::/64 eui-64
no shutdown

Why this answer

The ipv6 enable command explicitly creates a link-local address as required by the scenario. The global unicast address with the eui-64 keyword automatically derives the interface ID from the MAC address. Option B is incorrect because it tries to manually configure a link-local address with eui-64, which is unnecessary and invalid.

Option C omits the ipv6 enable command, failing the explicit requirement. Option D assigns a static host portion instead of using eui-64.

Exam trap

When the question specifically mandates the ipv6 enable command for link-local generation, do not omit it; simply configuring a global unicast address will also create a link-local address, but it does not meet the stated objective.

Why the other options are wrong

Manually configuring a link-local address with the eui-64 keyword is invalid; link-local addresses are automatically generated.

This option does not include the required ipv6 enable command, so it does not satisfy the explicit scenario requirement.

Uses a static host address (::1/64) instead of the eui-64 keyword, so the interface ID will not be generated from the MAC address.

148

MCQhard

Refer to the exhibit. A network engineer is troubleshooting a connectivity issue on R1. The serial link to R2 on interface Serial0/1 is using HDLC encapsulation, and the physical cable has been verified as good. The engineer has confirmed that the encapsulation type matches on both routers and that the clock rate is correctly configured on the DCE end. Based on the output, what is the most likely cause of the line protocol down state on Serial0/1?

A.The encapsulation type is mismatched between R1 and R2.

B.The clock rate has not been configured on the DCE end of the serial link.

C.The IP address configured on Serial0/1 conflicts with another interface.

D.The keepalive packets are not being received, causing the protocol to stay down.

AnswerD

In HDLC serial links, routers exchange keepalive messages every 10 seconds by default, and the line protocol is declared down when successive keepalives are not received from the far end. Even though the physical layer is up (represented by the 'up' in 'Serial0/1 is up'), the protocol remains down because the local router has lost contact with the remote router at the data link layer. With encapsulation and clocking verified as correct, the most consistent cause is that keepalive packets are not being received, preventing the line protocol from transitioning to 'up'.

Why this answer

The output shows that the line protocol is down while the physical layer (Serial0/1 is up). With HDLC encapsulation and clock rate confirmed correct, the most likely cause is that keepalive packets are not being exchanged between R1 and R2. HDLC uses keepalives to maintain the data link layer; if they are not received (e.g., due to a misconfiguration like 'no keepalive' on one side or a faulty cable), the protocol state will remain down even though the physical layer is operational.

Exam trap

Cisco often tests the distinction between physical layer (line is up) and data link layer (protocol is down), leading candidates to incorrectly blame encapsulation or clock rate when the real issue is keepalive failure.

Why the other options are wrong

Candidates might fixate on the up/down status and assume encapsulation mismatch without considering the explicitly stated troubleshooting steps.

Students often associate up/down with missing clock rate, but the question precludes this by confirming correct configuration.

Some learners confuse Layer 3 problems (IP issues) with the line protocol status that reflects Layer 2 health.

Practice this question →

149

MCQhard

A network technician is troubleshooting connectivity between two directly connected Cisco switches. Hosts on VLAN 10 connected to SwitchA cannot ping the default gateway on SwitchB. The interface on SwitchB shows up/up, but the interface on SwitchA shows up/down. The technician examines the interface configuration and status on SwitchA. What is the most likely cause of this issue?

A.Replace the Ethernet cable because it is faulty.

B.Configure both interfaces with the same duplex and speed settings, either both auto or both manually set to full-duplex and 1000 Mbps.

C.Issue the 'shutdown' and 'no shutdown' commands on the interface to recover from err-disabled state.

D.Check the VLAN configuration on SwitchA because the interface is administratively down.

AnswerB

The line protocol being down with up/up on the remote suggests a duplex mismatch, which can occur when one side is manually set and the other is auto-negotiating. Setting both sides consistently resolves the issue.

Why this answer

The interface on SwitchA shows up/down, meaning Layer 1 is active but the line protocol is down. This is commonly caused by a speed mismatch between the two ends. A duplex mismatch, in contrast, typically results in both interfaces showing up/up with CRC errors.

Therefore, the most likely cause is that the speed settings differ—for example, one interface is set to auto-negotiate while the other is hard-coded to a specific speed. Configuring both interfaces with identical speed and duplex settings, either both auto or both manually configured, resolves the issue.

Exam trap

The trap is that up/down is often misinterpreted as a faulty cable or an err-disabled state, but it actually points to a speed mismatch or auto-negotiation failure, not a duplex mismatch.

Why the other options are wrong

The interface status shows 'up, line protocol is down', which indicates a Layer 2 issue, not a physical cable fault. Additionally, no CRC, runts, giants, or collisions are reported, so the cable is likely not faulty.

The interface status is 'up, line protocol is down', not 'err-disabled'. The err-disabled state would show 'err-disabled' in the interface status, and a shutdown/no shutdown would be appropriate only for err-disabled recovery.

The interface status is 'up', not 'administratively down'. An administratively down interface would show 'administratively down, line protocol is down'. VLAN configuration issues typically cause the interface to be up/up but unable to forward traffic, not up/down.

Practice this question →

150

PBQmedium

You are connected to the console of R1. The network administrator reports that hosts on VLAN 10 cannot ping the default gateway (192.168.10.1). R1's GigabitEthernet0/1 is connected to a switch with trunk port allowing VLAN 10 and 20. The interface configuration on R1 appears correct, but the VLAN 10 interface is not operational.

Network Topology

Hints

•Check the status of the subinterface.
•Verify that the physical interface is not administratively down.
•Confirm that the encapsulation command is correct.

A.The physical interface GigabitEthernet0/1 was administratively down.

B.The VLAN 10 subinterface was configured with the wrong encapsulation dot1q VLAN ID.

C.The switch port connected to R1 was not configured as a trunk.

D.The VLAN 10 subinterface was missing the 'no shutdown' command.

AnswerA

solution

! R1
interface GigabitEthernet0/1
no shutdown
interface GigabitEthernet0/1.10
encapsulation dot1Q 10
ip address 192.168.10.1 255.255.255.0

Why this answer

The GigabitEthernet0/1 interface was administratively down (missing 'no shutdown' in the initial config). Although the subinterface had 'no shutdown', the physical interface must also be up. Bringing up the physical interface resolved the issue.

Exam trap

Do not assume that subinterfaces can be independently brought up; always check the physical interface state first. A common trap is to focus on subinterface configuration while ignoring the parent interface.

Why the other options are wrong

The specific factual error is that the subinterface would still show as up/up (though traffic would not be forwarded) if the encapsulation were wrong; the problem is the physical interface being down.

The specific factual error is that the switch trunk configuration is given as correct; the problem is on the router side, not the switch.

The specific factual error is that subinterfaces do not have an independent administrative state; they rely on the physical interface being up.