CCNA Network Infrastructure and Connectivity Questions — Page 2 of 5

Multi-Selectmedium

Which command or tool would a network engineer use to verify if a client has a duplicate IP address conflict on the local subnet?

Select 2 answers

A.ipconfig /all

B.arp -a

C.nslookup

D.ping

E.tracert

AnswersB, D

arp -a displays the system's ARP cache, which maps IPv4 addresses to MAC addresses for hosts reached on the local subnet. When two devices are using the same IP, the cache may show two different MAC addresses for that same IP, or the mapping may flip back and forth between the two entries as traffic is sent. Examining the ARP table for inconsistent or changing MAC-to-IP pairings is a classic method for detecting an IP address conflict.

Why this answer

The two tools to verify a duplicate IP conflict are arp -a and ping. The arp -a command displays the ARP cache; if a duplicate IP exists, the ARP table may show multiple MAC addresses for the same IP or rapid changes. Ping can be used to send traffic to the local IP address; if a reply is received from a different MAC address than expected, it indicates a conflict.

Together, these commands help network engineers confirm IP address duplication. Other commands like ipconfig /all, nslookup, and tracert do not directly reveal such conflicts.

Exam trap

A common misconception is that ipconfig /all can detect duplicate IPs, but it only displays local configuration. In reality, arp -a and ping are the key tools to identify IP conflicts at the network layer.

Why the other options are wrong

`ipconfig /all` shows only the local IP configuration, not whether the same IP is assigned to another host.

`nslookup` resolves domain names to IP addresses and is unrelated to local IP conflicts.

`tracert` traces the path to a remote host, irrelevant for detecting local subnet duplicate IPs.

Practice this question →

MCQeasy

Which medium is the most common choice for a 10G uplink between wiring closets on different floors of the same building?

A.Rollover cable

B.Fiber optic cable

C.Coaxial cable

D.Console cable

AnswerB

Fiber-optic cable is the standard medium for 10G uplinks because it supports both 10GBASE-SR (multimode, 850 nm VCSELs, up to 300 m on OM3/OM4) and 10GBASE-LR (single-mode, 1310 nm, up to 10 km), providing reach and bandwidth far beyond copper twisted pair. It is immune to electromagnetic interference, has extremely low signal attenuation, and offers the full-duplex symmetric bandwidth required for switch uplinks. Enterprise switches therefore ship with SFP+ slots where fiber transceivers are the default choice for interconnecting access-layer switches to distribution or core switches.

Why this answer

Fiber is commonly used for building uplinks because it supports higher bandwidth and longer distances than typical copper for this use case.

Exam trap

Don't confuse the capabilities of multimode fiber with single-mode fiber for long-distance, high-speed connections.

Why the other options are wrong

A rollover cable is a specialized Cisco console cable used for out-of-band management access to a device's console port, not for network data traffic. It cannot carry 10G Ethernet signals and is physically incompatible with Ethernet interfaces.

Coaxial cable (e.g., RG-6) is primarily used for cable TV, broadband internet (DOCSIS), or legacy Ethernet (10BASE2/10BASE5), but it does not support 10G Ethernet speeds over the distances required between floors in a modern enterprise network. Fiber or twisted-pair copper (Cat6a/Cat7) are the standard 10G media.

A console cable (typically a rollover or USB-to-serial cable) is used for initial device configuration and management access, not for carrying network traffic. It cannot support 10G data rates and is not designed for switch-to-switch uplinks.

Practice this question →

MCQhard

A switch unexpectedly blocks a link toward the distribution layer. Gi1/0/24 shows a path cost of 4 while Gi1/0/23 shows a path cost of 19. Why did interface Gi1/0/24 become the root port instead of Gi1/0/23?

A.Gi1/0/24 has a lower port number, so STP always prefers it first.

B.STP prefers interfaces with the highest path cost to reduce loops.

C.Gi1/0/23 is blocked because alternate ports are always chosen over root ports.

D.has a lower root path cost to the root bridge

AnswerD

This is correct because STP's root port selection is primarily based on the lowest root path cost to reach the root bridge. Gi1/0/24 has a cumulative cost of 4, whereas Gi1/0/23 has a cost of 19, so Gi1/0/24 is chosen as the root port and placed in forwarding state. Consequently, Gi1/0/23 becomes the alternate port with the higher cost and is put into blocking state to prevent Layer 2 loops.

Why this answer

Spanning Tree chooses a root port by looking for the best path toward the root bridge. In this case, Gi1/0/24 shows a cost of 4, while Gi1/0/23 shows a cost of 19. Lower cost is better, so Gi1/0/24 is selected as the root port and moves into forwarding.

Gi1/0/23 becomes an alternate port and is placed into a blocking state to prevent a loop. STP compares root path cost first; only if the cost is tied does it move on to tie-breakers like sender bridge ID and port ID. The lower cost on Gi1/0/24 explains why that port won the root-port election.

Exam trap

Remember that STP prioritizes root path cost over other factors like port numbers or bridge IDs unless there's a tie.

Why the other options are wrong

STP does not use port number as the primary criterion; it is only a tie-breaker when path cost, bridge ID, and sender bridge ID are all equal. Here, the path costs differ, so port number is irrelevant.

STP is designed to select the path with the lowest total cost to the root bridge, not the highest. Choosing a higher-cost path would increase latency and waste bandwidth.

The root port is the forwarding port toward the root bridge, while the alternate port is a blocked backup. The alternate port is not chosen over the root port; it only becomes active if the root port fails.

Practice this question →

MCQmedium

A network administrator is configuring a new Windows workstation on a small office network that uses IPv4 addressing. The workstation must be able to communicate with devices on other subnets and resolve hostnames via a company DNS server at 10.10.10.5. The administrator has already set the IP address to 10.10.10.10 and the subnet mask to 255.255.255.0. Which additional parameter must be configured to meet both requirements?

A.Configure a default gateway of 10.10.10.1 and a DNS server of 10.10.10.5.

B.Configure only a DNS server of 10.10.10.5.

C.Change the subnet mask to 255.255.0.0 to allow communication across subnets.

D.Configure a default gateway of 10.10.20.1 and a DNS server of 10.10.10.5.

AnswerA

This is the correct configuration because both entries are necessary and valid. The default gateway 10.10.10.1 lies on the same subnet as the workstation's IP address, so the host can resolve the gateway's MAC address via ARP and forward all out-of-subnet traffic to it. The router then routes packets between the 10.10.10.0/24 and 10.10.20.0/24 networks, enabling communication with devices on the other subnet. The DNS server 10.10.10.5 is also on the local subnet, allowing name resolution to work without requiring routing. Together, they provide both name resolution and the necessary Layer 3 path.

Why this answer

To communicate with devices on other subnets, the workstation needs a default gateway (router) to forward traffic beyond its local subnet. The IP address 10.10.10.10 with subnet mask 255.255.255.0 places it in the 10.10.10.0/24 network, so a default gateway (e.g., 10.10.10.1) is required for inter-subnet routing. Additionally, to resolve hostnames, the DNS server address must be explicitly configured; the company DNS server is at 10.10.10.5.

Option A correctly provides both parameters.

Exam trap

Cisco often tests the requirement that a default gateway must be on the same subnet as the host; the trap here is that candidates may think a DNS server alone suffices for inter-subnet communication, or they may incorrectly assume changing the subnet mask can replace a router, or they may choose a gateway on a different subnet without realizing it is unreachable.

Why the other options are wrong

Without a default gateway, the workstation cannot send packets to destinations outside its own subnet (10.10.10.0/24). The DNS server alone only provides name resolution, not routing to other subnets.

Changing the subnet mask to 255.255.0.0 would expand the broadcast domain and could cause routing problems, but it does not provide a path to other subnets. The workstation still needs a default gateway to communicate with devices outside its local network.

The default gateway 10.10.20.1 is not on the same subnet as the workstation (10.10.10.0/24). For a host to reach its default gateway, the gateway must be directly reachable on the local subnet. Since 10.10.20.1 is on a different subnet, the workstation cannot send traffic to it.

Practice this question →

MCQeasy

At which OSI layer do routers make forwarding decisions based on logical addressing?

A.Layer 1

B.Layer 2

C.Layer 3

D.Layer 4

AnswerC

Routers make forwarding decisions at OSI Layer 3, the network layer, by inspecting the destination IPv4 or IPv6 address in the packet header. They consult their routing table and apply the longest-prefix-match rule to select the next hop toward the destination network. This logical addressing allows routing across different broadcast domains.

Why this answer

Routers operate at the network layer when making forwarding decisions based on logical Layer 3 addresses such as IPv4 or IPv6 destination addresses.

Exam trap

Don't confuse the roles of routers and switches. Remember that routers use logical addressing (IP addresses) at Layer 3, while switches use physical addressing (MAC addresses) at Layer 2.

Why the other options are wrong

Layer 1 (Physical layer) deals with the physical transmission of bits over media, such as cables or radio frequencies. Routers do not make forwarding decisions at this layer; they only handle electrical or optical signals.

Layer 2 (Data Link layer) uses MAC addresses for switching within the same network segment. Routers, however, forward packets based on Layer 3 logical addresses, not MAC addresses, which are only used for next-hop delivery.

Layer 4 (Transport layer) handles end-to-end communication, segmentation, and flow control using protocols like TCP and UDP. Routers do not use Layer 4 information for forwarding decisions; they only examine Layer 3 headers.

Practice this question →

Drag & Dropmedium

Drag and drop the following troubleshooting steps into the correct order to isolate CRC errors, duplex mismatches, and flapping on a Cisco IOS-XE interface.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct troubleshooting order is: first, use show commands to gather interface statistics and identify CRC errors, duplex mismatches, and flapping (Step A). Next, apply configuration changes to resolve the identified issues (Step C). Then, clear interface counters to reset the statistics (Step B).

Finally, verify the fix by monitoring interface statistics after clearing counters (Step D). This order ensures that after applying changes, you clear the old error data so that verification shows only new errors, confirming the fix. Clearing counters before verification provides a clean baseline.

Exam trap

Do not skip clearing counters before verification. After applying changes, you must clear the counters to remove old error data, then verify that new errors do not appear. The correct order is gather, apply, clear, verify.

Practice this question →

MCQhard

A subnet uses the prefix /22. How many usable host addresses are available?

A.254

B.510

C.1022

D.2046

AnswerC

A /22 prefix designates 22 network bits, leaving 10 bits for the host portion of the IPv4 address. This configuration provides 2^10, or 1024, total addresses within the subnet. However, two addresses are always reserved: one for the network address and one for the broadcast address. Subtracting these two reserved addresses from the total yields 1022 usable host addresses, directly satisfying the /22 prefix constraint specified in the question stem.

Why this answer

A /22 leaves 10 host bits available. In plain language, that means each subnet contains 2^10, or 1024, total addresses. Two of those are reserved for the network and broadcast addresses in normal IPv4 subnetting, leaving 1022 usable host addresses.

This is a common subnet-capacity calculation. The safest method is to calculate the total address count from the number of host bits and then subtract the two reserved addresses. That leads directly to the correct usable-host value.

Exam trap

Remember to subtract the network and broadcast addresses from the total number of addresses to find the usable host count.

Why the other options are wrong

A /24 prefix provides 256 total addresses (2^(32-24)=256), with 254 usable host addresses after subtracting the network and broadcast addresses. This does not match the /22 prefix in the question.

A /23 prefix provides 512 total addresses (2^(32-23)=512), with 510 usable host addresses. This is half the total addresses of a /22, so it is incorrect for the given prefix.

A /21 prefix provides 2048 total addresses (2^(32-21)=2048), with 2046 usable host addresses. This is double the total addresses of a /22, so it is incorrect for the given prefix.

Practice this question →

MCQhard

A network administrator is troubleshooting slow file transfers between two servers in different access-layer switches. The administrator runs the 'show interface' command on the uplink connecting the two switches and notices a high number of CRC errors on both ends, but a high number of late collisions on only one interface; the other interface reports no late collisions.

A.Duplex mismatch: the interface with late collisions is half-duplex while the other end is full-duplex. Configure both ends to auto-negotiate speed and duplex.

B.Speed mismatch: one interface is set to 100 Mbps, the other to 1 Gbps. This causes frequent link flaps, resulting in CRC errors. Use the 'speed' command to match the rates.

C.Faulty Ethernet cable causing signal degradation, which leads to CRC errors. The late collisions are a result of the switch misdetecting collisions due to the degraded signal. Replace the cable.

D.A broadcast storm caused by a loop is flooding the uplink with frames, leading to CRC errors and late collisions as the switch discards excess traffic. Enable Spanning Tree Protocol to block the redundant path.

AnswerA

Late collisions only occur on half-duplex Ethernet when multiple stations attempt to transmit simultaneously. When one end is full-duplex, the half-duplex end perceives any overlapping transmission as a collision, producing late collisions and CRC errors. Auto-negotiation correctly sets both ends to full-duplex when supported, fixing the problem.

Why this answer

A is correct because a duplex mismatch causes one interface to operate in half-duplex (detecting late collisions due to CSMA/CD) while the other operates in full-duplex (no collisions). The half-duplex interface waits for the carrier sense before transmitting, but the full-duplex interface transmits immediately, causing the half-duplex side to detect collisions after the transmission window (late collisions). CRC errors occur on both ends because frames are corrupted when collisions happen.

Configuring both ends to auto-negotiate ensures matching duplex and speed, resolving the issue.

Exam trap

Cisco often tests the distinction between CRC errors (which can have multiple causes like cable faults or duplex mismatch) and late collisions (which are a definitive indicator of a duplex mismatch), leading candidates to incorrectly attribute CRC errors alone to a cable issue.

Why the other options are wrong

Confuses speed mismatch (which prevents link establishment) with duplex mismatch (which allows the link to come up but causes errors and late collisions).

Assumes all interface errors are cable-related and overlooks the characteristic late-collision signature of duplex mismatch.

Misinterprets high utilization as a source of physical-layer errors and ignores the diagnostic value of asymmetric late collisions.

Practice this question →

Drag & Dropmedium

Drag and drop the following steps into the correct order to describe the data encapsulation process as it flows down the OSI model from the source host.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Encapsulation proceeds from the top OSI layers to the bottom. First, the application generates data (Step 1). The Transport layer then adds a header (TCP or UDP) to create a segment (Step 2) because this is the first step in preparing data for reliable delivery.

The Network layer adds an IP header to form a packet (Step 3), which provides logical addressing and routing information. The Data Link layer adds a frame header and trailer to create a frame (Step 4), enabling physical addressing (MAC) and error detection. Finally, the Physical layer converts the frame to bits for transmission (Step 5), as it is the layer that ultimately puts signals on the wire.

Practice this question →

Multi-Selectmedium

Which two statements accurately describe IPv6 link-local addresses?

Select 2 answers

A.They are used for communication on the local segment only.

B.They are globally routable across the Internet.

C.They are commonly involved in local IPv6 neighbor interactions.

D.They exist only when DHCPv6 fails.

E.They replace the need for any default gateway logic.

AnswersA, C

Link-local addresses, identified by the FE80::/10 prefix, are automatically configured on every IPv6 interface and are valid only within the local network segment. A router will never forward a packet with a link-local source or destination address, so traffic using these addresses stays entirely on the local link, making this statement accurate for local-only communication.

Why this answer

IPv6 link-local addresses are designed for communication on the local segment only. In plain language, they allow devices to talk to nearby neighbors without needing globally routable addresses. They play an important role in IPv6 functions such as Neighbor Discovery and are commonly used when hosts communicate with the default gateway on the same link. These addresses are normal and expected in IPv6 environments.

They are not globally Internet-routable, and they are not just emergency fallbacks for DHCPv6 failure. The two correct answers are the ones that preserve their local-link purpose and their importance in standard IPv6 behavior rather than treating them as optional or globally reachable.

Exam trap

Remember that link-local addresses are not routable and are not a fallback for DHCPv6. They are essential for local communications.

Why the other options are wrong

Link-local addresses have a scope of link-local (fe80::/10) and are not forwarded by routers, making them non-routable across the Internet. They are intended only for communication on a single network segment.

Link-local addresses are automatically generated on all IPv6 interfaces regardless of DHCPv6. They are a mandatory part of IPv6 operation, not a fallback mechanism.

For off-link communication, IPv6 hosts still require a default gateway (usually a router's link-local address) to forward packets beyond the local segment. Link-local addresses do not eliminate the need for routing logic.

Practice this question →

MCQeasy

Which field in an IPv4 packet is primarily used to prevent packets from looping forever in the network?

A.Version

B.Header checksum

C.Time to Live

D.Protocol

AnswerC

Time to Live (TTL) is the loop-prevention field in an IPv4 header. Each router decrements TTL by at least 1, and when it reaches 0, the router discards the packet and typically sends an ICMP Time Exceeded message back to the source. This guarantees that no packet can traverse a routing loop forever, bounding the network diameter.

Why this answer

Each router decrements the TTL field by one. When TTL reaches zero, the packet is discarded. That mechanism prevents indefinite looping.

Exam trap

Remember that TTL is about lifespan and loop prevention, not error checking or addressing.

Why the other options are wrong

The Version field (4 bits) indicates the IP version (e.g., IPv4 or IPv6) and has no role in loop prevention. It is used by routers to interpret the packet header correctly.

The Header Checksum field detects errors in the IPv4 header only; it does not limit packet forwarding or prevent loops. If corrupted, the packet is discarded, but this does not stop looping.

The Protocol field identifies the next-level protocol (e.g., TCP, UDP, ICMP) carried in the payload. It has no impact on packet forwarding or loop prevention.

Practice this question →

Multi-Selectmedium

Which two statements accurately describe the relationship between a network address and a broadcast address in IPv4 subnetting?

Select 2 answers

A.The network address is the first address in the subnet block.

B.The broadcast address is the last address in the subnet block.

C.Both addresses are normal host addresses that can be assigned to users.

D.The broadcast address always becomes the default gateway.

E.These concepts exist only in IPv6 and not IPv4.

AnswersA, B

In IPv4, the network address is the first (lowest) address within a subnet block, obtained by setting all host bits to 0. This address uniquely identifies the subnet and is used by routers in their routing tables; it cannot be assigned to any host interface. It is the starting boundary from which the usable host range begins.

Why this answer

The network address identifies the beginning of the subnet block, and the broadcast address identifies the final address in that block. In practical terms, both are reserved and are not assigned to ordinary hosts. The usable host range falls between them.

This is a very basic subnetting truth, but it is foundational for every other addressing calculation.

Exam trap

Be cautious not to confuse the roles of network and broadcast addresses with usable host addresses.

Why the other options are wrong

Both the network address and broadcast address are reserved addresses within a subnet and cannot be assigned to hosts. The network address identifies the subnet itself, and the broadcast address is used for one-to-all communication. Assigning them to hosts would cause conflicts.

The default gateway is typically the IP address of a router interface on the subnet, which is a normal host address within the usable range. The broadcast address is the last address in the subnet and is reserved for broadcasting; it cannot be used as a gateway.

Network and broadcast addresses are fundamental to IPv4 subnetting and are defined in IPv4 standards. IPv6 does not use broadcast addresses; instead, it uses multicast and anycast. Therefore, stating these concepts exist only in IPv6 is factually incorrect.

Practice this question →

Multi-Selectmedium

Which TWO commands can a network technician use on a modern Linux host to verify the IP address configuration and test reachability to a remote server?

Select 2 answers

A.ip addr

B.ifconfig

C.tracert

D.ping

E.nslookup

AnswersA, D

ip addr, part of the iproute2 suite, is the modern replacement for ifconfig, displaying all interfaces, their IPv4/IPv6 addresses, MAC addresses, and administrative state. It only inspects local interface configuration; it does not generate any network traffic toward a remote host, so it cannot verify end-to-end reachability.

Why this answer

The `ip addr` command (option A) is the modern Linux utility for displaying IP address configuration, replacing the deprecated `ifconfig`. The `ping` command (option D) uses ICMP Echo Request/Reply messages to test Layer 3 reachability to a remote server. `ifconfig` (option B) is deprecated and not expected for current certification exams; `tracert` (option C) is a Windows command; `nslookup` (option E) performs DNS lookups but does not verify IP configuration or connectivity.

Exam trap

Cisco often tests the distinction between Windows and Linux commands, so the trap here is that candidates may mistakenly select `tracert` (a Windows command) instead of recognizing that the Linux equivalent is `traceroute`, or they may choose `ifconfig` without knowing it is deprecated in favor of `ip addr`.

Why the other options are wrong

Although `ifconfig` can still display IP settings, it is a deprecated legacy command and the question expects the modern `ip addr` from the iproute2 suite.

`tracert` is the Windows traceroute utility; the Linux command is `traceroute`.

`nslookup` is a DNS troubleshooting tool and cannot verify interface IP configuration or test basic reachability like `ping`.

Practice this question →

MCQmedium

Which command enables IPv6 routing on a Cisco router?

A.ipv6 unicast-routing

B.ipv6 enable

C.ip routing ipv6

D.ipv6 route enable

AnswerA

The global configuration command 'ipv6 unicast-routing' is the correct and required command to enable IPv6 routing on a Cisco router. It enables IPv6 packet forwarding on all interfaces and allows the router to route IPv6 traffic between networks. Without this command, the router will not forward IPv6 packets but will still process traffic explicitly addressed to itself.

Why this answer

The global configuration command 'ipv6 unicast-routing' enables IPv6 forwarding on a Cisco router. 'ipv6 enable' is an interface-level command used to enable IPv6 on a specific interface, not globally. 'ip routing ipv6' and 'ipv6 route enable' are syntactically invalid commands that do not exist in Cisco IOS.

Exam trap

Be careful not to confuse interface-specific commands with global routing commands. Remember that enabling IPv6 globally requires a specific command.

Why the other options are wrong

'ipv6 enable' is an interface command, not a global command to enable IPv6 routing.

'ip routing ipv6' is not a valid Cisco IOS command.

'ipv6 route enable' is not a valid Cisco IOS command.

Practice this question →

MCQeasy

A host sends traffic to a web server on another subnet. Which address is used as the destination MAC address in the first Ethernet frame sent by the host?

A.The MAC address of the remote web server

B.The MAC address of the local default gateway

C.The MAC address of the DNS server

D.The broadcast MAC address

AnswerB

The host's routing table indicates that the destination IP is not on the local subnet, so the packet must be sent to the default gateway. The destination MAC in the Ethernet frame is therefore the gateway's interface MAC, resolved via ARP, while the destination IP address remains that of the web server. The gateway then strips the frame and forwards the packet toward the remote subnet, changing the frame headers at each hop while preserving the IP addresses.

Why this answer

When a host wants to communicate with a device on a different subnet, it cannot reach that device directly. The host must send the frame to its default gateway, which is the router that connects to other subnets. Therefore, the destination MAC address in the first Ethernet frame is the MAC address of the local default gateway, not the remote web server (A).

The DNS server (C) is used for name resolution, not for forwarding traffic. The broadcast MAC address (D) would send the frame to all devices on the local subnet, which is not appropriate for unicast communication to a remote destination.

Exam trap

Remember that the destination MAC address for remote communication is the default gateway's, not the remote host's.

Why the other options are wrong

The MAC address of the remote web server is not used because the remote host is on a different subnet and cannot be reached directly at Layer 2.

The DNS server is used for domain name resolution, not for forwarding data frames to remote subnets.

The broadcast MAC address would send the frame to all devices on the local subnet, which is incorrect for unicast traffic to a remote destination.

Practice this question →

Multi-Selectmedium

Which TWO interface issues can be identified by analyzing the output of the 'show interfaces' command?

Select 2 answers

A.Duplex mismatch

B.Routing protocol misconfiguration

C.Speed mismatch

D.VLAN mismatch

E.STP topology change

AnswersA, C

A duplex mismatch occurs when one device is manually set to full duplex and the other is auto-negotiating or set to half duplex, often on a point-to-point link. The full-duplex side does not defer and sends anytime, while the half-duplex side only transmits when it senses the wire free, leading to collisions and late collisions on the half-duplex side; 'show interfaces' will display late collisions, runts, CRC errors, or excessive input errors on one or both sides. This is a classic Layer 1/physical problem that shows up clearly in interface counters.

Why this answer

The 'show interfaces' command displays interface statistics and operational status, including duplex and speed settings. A duplex mismatch occurs when one end of a link is set to full-duplex and the other to half-duplex, leading to collisions and CRC errors visible in the output. Speed mismatch is also detectable because the interface will show the negotiated speed or errors like 'input errors' if the speeds do not match.

Exam trap

Cisco often tests that 'show interfaces' reveals physical-layer issues like duplex and speed mismatches, but candidates mistakenly think it also shows Layer 2 or Layer 3 problems such as VLAN or routing misconfigurations.

Why the other options are wrong

Routing protocol misconfiguration is a Layer 3 issue that does not manifest in the 'show interfaces' output, which focuses on Layer 1 and Layer 2 interface statistics. To diagnose routing issues, you would use commands like 'show ip route' or 'show ip protocols'.

A VLAN mismatch is a Layer 2 issue that does not appear in the 'show interfaces' output; it is diagnosed using 'show vlan' or 'show interfaces trunk'. The 'show interfaces' command shows physical and data link layer statistics, not VLAN membership.

STP topology changes are not directly visible in 'show interfaces'; they are monitored using 'show spanning-tree' or 'debug spanning-tree events'. The 'show interfaces' command does not provide information about spanning-tree state changes.

Practice this question →

PBQhard

You are connected via the console to R1, a new Cisco ISR 4321 router. The network team requires that all routers be reachable via SSH for management. R1's management interface is GigabitEthernet0/0 with IP 192.168.1.1/24. You need to configure SSH on R1, including a hostname, domain name, RSA key pair of 1024 bits, local user 'admin' with secret 'cisco123', and enable SSH version 2. Additionally, configure the vty lines to accept only SSH connections and use local authentication.

Network Topology

Hints

•You need to set hostname and domain name before generating RSA keys.
•Use 'crypto key generate rsa modulus 1024' to create the key pair.
•Configure vty lines to only allow SSH and use local authentication.

A.R1(config)# hostname R1 R1(config)# ip domain-name example.com R1(config)# crypto key generate rsa modulus 1024 R1(config)# username admin secret cisco123 R1(config)# ip ssh version 2 R1(config)# line vty 0 4 R1(config-line)# transport input ssh R1(config-line)# login local

B.R1(config)# hostname R1 R1(config)# ip domain-name example.com R1(config)# crypto key generate rsa general-keys modulus 1024 R1(config)# username admin password cisco123 R1(config)# ip ssh version 2 R1(config)# line vty 0 4 R1(config-line)# transport input ssh telnet R1(config-line)# login local

C.R1(config)# hostname R1 R1(config)# ip domain-name example.com R1(config)# crypto key generate rsa modulus 1024 R1(config)# username admin secret cisco123 R1(config)# ip ssh version 2 R1(config)# line vty 0 4 R1(config-line)# transport input all R1(config-line)# login local

D.R1(config)# hostname R1 R1(config)# ip domain-name example.com R1(config)# crypto key generate rsa modulus 1024 R1(config)# username admin secret cisco123 R1(config)# ip ssh version 2 R1(config)# line vty 0 4 R1(config-line)# transport input ssh R1(config-line)# password cisco123 R1(config-line)# login

AnswerA

solution

! R1
hostname R1
ip domain-name example.com
crypto key generate rsa modulus 1024
username admin secret cisco123
line vty 0 4
transport input ssh
login local

Why this answer

SSH configuration requires a hostname, domain name, RSA key pair, local username, and vty line settings. The command sequence ensures SSH version 2 is used and only SSH connections are accepted on the vty lines.

Exam trap

Watch for subtle differences: 'username secret' vs 'username password', 'transport input ssh' vs 'transport input all' or 'transport input ssh telnet', and 'login local' vs 'login'. Also ensure the hostname and domain name are set before generating RSA keys.

Why the other options are wrong

Using 'password' instead of 'secret' stores the password in plaintext; allowing Telnet alongside SSH does not restrict to SSH only.

'transport input all' permits Telnet and other protocols, which is not restrictive enough.

Using 'password' and 'login' on vty lines enables password-only authentication, not local user authentication.

Matchingeasy

Match the data format to its most accurate characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Lightweight format commonly used by REST APIs

Markup-style format that uses opening and closing tags

Human-friendly format that relies heavily on indentation

Simple tabular format with comma-separated values

Why these pairings

JSON is lightweight and key-value based, XML uses tags and attributes, YAML relies on indentation, CSV is for tabular data, Protobuf is a binary schema-driven format, and HTML is for web page structure.

Exam trap

Avoid confusing the characteristics of different data formats. Remember that JSON uses key-value pairs, XML uses tags, YAML uses indentation, CSV is tabular, Protobuf is binary, and HTML is for web structure.

Practice this question →

MCQhard

A wireless client associates to an AP and successfully authenticates to the correct SSID, but it does not obtain an IP address. The WLC is running in local mode. What should the technician do next?

A.Check the DHCP server to ensure it has available leases.

B.Verify the AP’s operating channel for interference.

C.Verify the VLAN mapping on the WLC for the client’s WLAN.

D.Verify the WPA3 PSK on the client.

AnswerC

In local mode, the WLC bridges client traffic to a specified VLAN. An incorrect or missing VLAN ID prevents the DHCP discovery from reaching the DHCP server. This step directly confirms whether the client’s traffic is placed on the correct subnet.

Why this answer

When a wireless client authenticates to the SSID but fails to obtain an IP address, the most likely cause is a VLAN mapping mismatch on the WLC. In local mode, the WLC maps the WLAN to a specific VLAN (via the interface or VLAN tag), and if that VLAN does not have a DHCP relay or is not trunked to the correct switch, the client's DHCP requests will never reach the DHCP server. This is a common Layer 2 connectivity issue that prevents IP address assignment even though authentication succeeds.

Exam trap

Cisco often tests the misconception that DHCP issues are always server-side (Option A), when in reality the WLC's VLAN-to-interface mapping is a critical Layer 2 configuration that must be verified first in a wireless context.

Why the other options are wrong

Troubleshooting at Layer 3 (IP) before verifying Layer 2 (VLAN) connectivity skips a fundamental step in the OSI model.

Confuses a Layer 1 problem with a Layer 2/3 problem. The client’s association proves the RF link is functional.

This investigates a condition that has already been ruled out (authentication succeeded) and does not address the IP assignment failure.

Practice this question →

MCQhard

A branch office needs four subnets from the 192.168.50.0/24 network, with each subnet supporting up to 50 hosts. Which prefix length should be used for each subnet?

A./25

B./26

C./27

D./28

AnswerB

A /26 prefix borrows 2 host bits from the /24, yielding 4 equal-sized subnets (2^2 = 4), each with 62 usable addresses (2^6 - 2 = 62). This exactly meets the branch office requirement for four subnets while providing sufficient host capacity for typical devices. The subnet mask 255.255.255.192 is the correct choice.

Why this answer

Each subnet must support at least 50 hosts, so /26 is the smallest suitable prefix because it provides 62 usable addresses. A /24 can be split into exactly four /26 subnets.

Exam trap

A frequent exam trap is selecting a subnet mask that provides enough hosts but not enough subnets, or vice versa. For instance, choosing /25 seems tempting because it supports 126 hosts, which exceeds the 50-host requirement. However, /25 only creates two subnets from a /24, which fails the requirement for four subnets.

Another trap is picking /27, which creates enough subnets but only supports 30 hosts, insufficient for 50 hosts per subnet. Candidates must carefully balance subnet count and host capacity to avoid these pitfalls.

Why the other options are wrong

/25 provides 126 usable hosts per subnet, which is more than enough for 50 hosts, but it only creates two subnets from a /24 network. Since four subnets are required, /25 is insufficient for subnet count.

/27 creates eight subnets from a /24, which is enough subnets, but each subnet only supports 30 usable hosts. This is less than the required 50 hosts, so /27 is not suitable.

/28 creates sixteen subnets but only supports 14 usable hosts per subnet, which is far below the 50-host requirement. Therefore, /28 is not a valid option.

Practice this question →

Multi-Selectmedium

Which TWO of the following are valid interpretations of errors seen in the output of the 'show interface' command?

Select 2 answers

A.CRC errors indicate that frames were received with an invalid checksum, often due to cabling issues.

B.Runts are frames that are larger than the maximum allowed size.

C.Giants are frames that are smaller than 64 bytes.

D.Input errors include runts, giants, CRC errors, and frame errors.

E.Flaps indicate that the interface is physically disconnected.

AnswersA, D

A CRC error means the Ethernet frame's frame check sequence (FCS) computed at the receiver does not match the value transmitted, indicating corruption during transit. This is commonly caused by faulty cabling, bad connectors, electromagnetic interference, or a marginal transceiver, rather than by a software issue. CRC errors may also be accompanied by alignment errors if the corruption shifts bit boundaries, pointing further to a physical-layer problem.

Why this answer

CRC errors (option A) indicate frames with an invalid checksum, often due to cabling issues, which is correct. Option D is also correct: 'Input errors' is a cumulative counter that includes runts, giants, CRC errors, and frame errors. Option B is wrong because runts are frames smaller than 64 bytes, not larger.

Option C is wrong because giants are frames larger than the maximum allowed size (typically 1518 bytes), not smaller than 64 bytes. Option E is wrong because 'flaps' refer to an interface going up and down repeatedly, not necessarily physically disconnected; it could be due to duplex mismatch or other reasons.

Exam trap

Cisco often tests the exact byte thresholds for runts (less than 64 bytes) and giants (greater than 1518 bytes), and candidates frequently reverse these values or confuse them with other error types.

Why the other options are wrong

Runts are frames smaller than 64 bytes, not larger than the maximum size.

Giants are frames larger than the maximum allowed size (typically 1518 bytes), not smaller than 64 bytes.

Flaps indicate an interface repeatedly transitioning between up and down states, not necessarily a physical disconnection.

Practice this question →

Matchingmedium

Match each basic IPv4 concept to its most accurate role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Defines network versus host portions of the address

Next hop used for off-subnet traffic

Address used to reach all hosts in the local broadcast domain

Address identifying an individual device in the subnet

Why these pairings

An IP address uniquely identifies a device on an IP network. A subnet mask separates the network and host portions of an IP address, enabling devices to determine if a destination is local or remote. A default gateway is the router IP that forwards traffic to other networks when the destination is not on the local subnet.

A DNS server translates domain names into IP addresses, allowing devices to reach websites by name.

Exam trap

Do not confuse the subnet mask's role with that of the default gateway. The subnet mask helps identify the network, while the default gateway enables communication outside the local subnet.

Practice this question →

Matchingmedium

Match each IPv6 address type or concept to its most accurate description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

IPv6 address type used for wider routed communication

IPv6 address type used only on the local segment

Address used by a device to refer to itself

Method for deriving an interface identifier from a MAC address

Why these pairings

Each IPv6 address type has a distinct purpose: Global Unicast for public routing, Link-Local for local segment, Unique Local for private site, Multicast for group communication, Anycast for nearest device, and SLAAC for stateless address assignment.

Exam trap

The most common trap is confusing the scope of Link-Local and Unique Local addresses. Remember: Link-Local is only for the local link, while Unique Local is for private site-wide use but not internet-routable. Also, don't confuse multicast with unicast.

Practice this question →

PBQhard

You are troubleshooting a PC connected to switch SW1. The PC cannot access the internet. SW1 is connected to router R1 via port G0/1. R1 provides default gateway and DHCP services. Analyze the provided show output and fix the connectivity issue so that the PC can ping 8.8.8.8. === Show output from R1 === <pre> R1# show ip interface brief Interface IP-Address OK? Method Status Protocol GigabitEthernet0/0 unassigned YES manual administratively down down GigabitEthernet0/1 10.0.0.1 YES NVRAM up up </pre> === Show output from PC === <pre> C:\> ipconfig Ethernet adapter Ethernet0: Connection-specific DNS Suffix . : IPv4 Address. . . . . . . . . . : 169.254.123.45 Subnet Mask . . . . . . . . . . : 255.255.0.0 Default Gateway . . . . . . . . : </pre> === Show output from SW1 === <pre> SW1# show vlan brief VLAN Name Status Ports ---- -------------------------------- --------- ------------------------------- 1 default active Gi0/1, Gi0/2, Gi0/3 </pre>

Network Topology

Hints

•Check if R1's interface connected to SW1 has an IP address.
•The DHCP pool expects the default gateway to be on the same subnet as the clients.
•APIPA address means the PC did not receive a DHCP offer.

A.Configure R1's interface G0/0 with IP address 192.168.1.1/24 and ensure the interface is not administratively down.

B.Change the VLAN on SW1's port G0/2 to VLAN 10 and configure R1's subinterface G0/0.10 with IP 192.168.1.1/24.

C.Enable DHCP snooping on SW1 and configure the port G0/2 as a trusted port.

D.Configure a static IP address of 192.168.1.10/24 on the PC with default gateway 192.168.1.1.

AnswerA

solution

! R1
interface gigabitethernet0/0
ip address 192.168.1.1 255.255.255.0
no shutdown

Why this answer

The PC's APIPA address (169.254.x.x) indicates DHCP failure. The router's DHCP pool is correctly configured and has a lease, but the show output reveals that R1's interface G0/0 is administratively down and has no IP address. Without a working IP on G0/0, the router cannot serve DHCP or route traffic for VLAN 1, even though both the PC and the router are in the same VLAN.

Option A fixes the root cause by assigning the correct subnet IP and bringing the interface up. Option B is incorrect because moving the PC to a different VLAN or creating subinterfaces does nothing to enable the router's physical interface where DHCP and routing must run. Option C is wrong because DHCP snooping or trust configurations are irrelevant when the router's own interface is down/unaddressed.

Option D is a workaround that only masks the problem; the scenario requires a working DHCP service, and a static IP would not restore the intended design.

Exam trap

This question tests your ability to identify that a router interface must have an IP address in the client subnet for DHCP to work, even if the DHCP pool is correctly configured. Many candidates focus on VLANs or DHCP server settings but overlook the basic requirement of an IP address on the router interface.

Why the other options are wrong

Changing VLANs or using subinterfaces does not solve the problem because the router's physical interface must be up and have an IP address to serve the VLAN.

Enabling DHCP snooping or trust settings on the switch cannot fix a router interface that is administratively down and unassigned.

Assigning a static IP to the PC circumvents but does not resolve the root issue of the router's interface being down, and the scenario requires DHCP.

Practice this question →

100

Multi-Selectmedium

Which three options correctly describe how a router processes a packet destined for a remote network? (Choose three.)

Select 3 answers

.It decrements the Time-to-Live (TTL) field in the IP header.

.It performs a lookup in the routing table for the destination IP address.

.It rewrites the source and destination MAC addresses for the next hop.

.It replaces the source IP address with its own outgoing interface IP.

.It sends an ARP request for every destination IP address in the packet.

.It encapsulates the entire packet in a new Layer 2 frame with the original MAC addresses.

Why this answer

When a router forwards a packet to a remote network, it first decrements the Time-to-Live (TTL) field in the IP header to prevent infinite loops. It then performs a routing table lookup for the destination IP address to determine the next-hop interface and IP. Finally, it rewrites the source and destination MAC addresses for the next hop, because MAC addresses are only relevant on the local link and must be updated at each Layer 3 hop.

Exam trap

Cisco often tests the distinction between Layer 2 (MAC) and Layer 3 (IP) header changes, so the trap here is that candidates mistakenly think the source IP address is rewritten at each hop, confusing routing with NAT or PAT.

Practice this question →

101

Matchingeasy

Match each common network device or concept to its primary role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Forwards traffic between networks

Forwards local traffic inside a LAN

Applies permit/deny policy to traffic

Provides wireless connectivity

Why these pairings

Router routes between networks; switch forwards within LAN; hub repeats signals; firewall filters traffic; AP provides Wi-Fi; modem converts digital to analog for WAN.

Exam trap

Be careful not to confuse the functions of routers and switches, as both forward traffic but at different layers. Also, remember that a home 'router' often includes a switch, AP, and modem, but the primary role of a router is routing between networks.

Practice this question →

102

MCQhard

A host sends an IPv4 packet larger than the outgoing interface MTU, and the DF bit is not set. What will a router normally do?

A.Drop the packet without notification

B.Fragment the packet before forwarding

C.Convert the packet into UDP

D.Forward it unchanged and let the switch fragment it

AnswerB

When the outgoing interface has a smaller MTU than the incoming packet and the IP header's Do Not Fragment (DF) bit is 0, the router correctly fragments the packet into smaller Layer 3 pieces that each fit the outgoing MTU. Each fragment gets its own IP header with the same identification field, a fragment offset, and the More Fragments flag set as needed, allowing the destination host to reassemble the original packet. This is the standard expected IPv4 behavior for an intermediate router.

Why this answer

If fragmentation is allowed, an IPv4 router can fragment a packet to fit the outgoing interface MTU. If DF were set, the router would instead drop the packet and typically send an ICMP message back to the source.

Exam trap

Be careful not to confuse the behavior when the DF bit is set with when it is not set. Remember, fragmentation is allowed when DF is not set.

Why the other options are wrong

A router does not drop the packet without notification when the DF bit is not set; instead, it fragments the packet. Dropping without notification only occurs when the DF bit is set and the packet exceeds the MTU, in which case the router sends an ICMP Fragmentation Needed message.

Routers operate at Layer 3 (IP) and do not modify the transport layer protocol (e.g., UDP or TCP) to handle MTU issues. Converting a packet to UDP would change the protocol and is not a function of IP fragmentation or any standard routing behavior.

Switches operate at Layer 2 and do not perform IP fragmentation. Fragmentation is a Layer 3 function handled by routers or the source host. The router must fragment the packet before forwarding it to the switch.

Practice this question →

103

MCQhard

A host is configured with IP address 192.168.70.18/30. Which addresses belong to the same subnet block?

A.192.168.70.16 through 192.168.70.19

B.192.168.70.18 through 192.168.70.21

C.192.168.70.12 through 192.168.70.15

D.192.168.70.20 through 192.168.70.23

AnswerA

A /30 prefix (255.255.255.252) defines a block of exactly 4 addresses aligned to multiples of 4. The IP 192.168.70.18 falls within the block 192.168.70.16/30, where .16 is the network address, .17 and .18 are usable host addresses, and .19 is the broadcast address. Therefore the entire subnet range is 192.168.70.16 through 192.168.70.19.

Why this answer

A /30 subnet has a block size of 4. In practical terms, the relevant blocks in the last octet are 0–3, 4–7, 8–11, 12–15, 16–19, and so on. Because 18 falls inside the 16–19 block, the subnet includes network address .16, usable hosts .17 and .18, and broadcast .19.

This question checks whether you can identify the correct /30 block and understand all addresses that fall inside it.

Exam trap

Be careful not to confuse adjacent subnet blocks or miscalculate the block size of a /30 subnet.

Why the other options are wrong

A /30 subnet always has a block size of 4 addresses, starting at multiples of 4. The block starting at .18 would be 192.168.70.16–.19, not .18–.21. The range .18–.21 crosses a subnet boundary and includes addresses from two different subnets.

The block 192.168.70.12–.15 is a different /30 subnet (network .12, broadcast .15). The host .18 belongs to the subnet .16–.19, not .12–.15.

The block 192.168.70.20–.23 is the next /30 subnet (network .20, broadcast .23). The host .18 is not in this range; it is in the .16–.19 subnet.

Practice this question →

104

MCQhard

A host address is 10.55.8.117/29. Which address is the network address of the subnet?

A.10.55.8.112

B.10.55.8.119

C.10.55.8.120

D.10.55.8.116

AnswerA

10.55.8.112 is the network address because the /29 prefix length equates to a 255.255.248 subnet mask, creating subnets with 8 addresses each. The host address 10.55.8.117 falls within the range 112 through 119, so the network address is the first address in that block, 10.55.8.112, with 10.55.8.119 as the broadcast address.

Why this answer

A /29 subnet has a block size of 8. In practical terms, the relevant last-octet blocks are 112-119 for this host. That means the network address is 10.55.8.112. Once you identify the correct block, the first address in the block is the network address.

This is a useful addressing-boundary question because it checks careful block calculation, not memorized guesses.

Exam trap

Be careful not to confuse the network address with the first usable host or the broadcast address.

Why the other options are wrong

10.55.8.119 is the broadcast address for the subnet 10.55.8.112/29, not the network address. The broadcast address is the last address in the block (112+8-1=119) and is used to send traffic to all hosts in the subnet.

10.55.8.120 is the network address of the next /29 subnet (120-127), not the current one. The current subnet ends at 119, so 120 belongs to a different subnet.

10.55.8.116 is a valid host address within the subnet 10.55.8.112/29 (usable range: 113-118). It is not the network address, which must be the first address (112).

Practice this question →

105

MCQhard

In a network running STP, SW2 became the root bridge for VLAN 10. Both SW1 and SW2 have the same bridge priority. Why did SW2 become the root?

A.Because SW2 has the lower bridge ID due to the lower MAC address.

B.Because SW2 has the higher VLAN number configured.

C.Because SW2 has more trunk ports than SW1.

D.Because SW2 has the highest bridge priority.

AnswerA

In STP, each switch's bridge ID is composed of a configurable priority (default 32768) and its MAC address, concatenated to form a unique identifier. When SW1 and SW2 have equal bridge priority, the election breaks the tie by comparing the MAC portion, and the numerically lower MAC address wins. Since SW2's MAC is lower, its bridge ID is lower, making it the root bridge for the VLAN.

Why this answer

SW2 became the root bridge because its bridge ID is lower. In practical terms, spanning tree elects the root bridge by comparing bridge IDs, which are based on priority plus MAC address. The device with the lowest bridge ID wins. In the exhibit, both switches use the same priority, so the tie is broken by the lower MAC address.

This is a classic STP interpretation question. Many learners focus only on priority, but if priorities match, the MAC address becomes decisive.

Exam trap

Remember, in STP, lower values are preferred. If priorities match, the MAC address decides the root bridge.

Why the other options are wrong

The VLAN number is not a factor in the STP root bridge election. The election is based solely on bridge ID, which consists of bridge priority and MAC address.

The number of trunk ports does not affect the root bridge election. STP uses bridge ID (priority and MAC address) to determine the root bridge, not port count or type.

The root bridge is elected based on the lowest bridge ID, not the highest. A higher bridge priority (numerically larger) makes a switch less likely to become root.

Practice this question →

106

Multi-Selecteasy

A support engineer is explaining why a host uses ARP before sending a frame on an Ethernet LAN. Which two statements are correct?

Select 2 answers

A.ARP resolves an IPv4 address to a MAC address

B.A host may ARP for its default gateway when sending to a remote network

C.ARP is used to discover the remote router's OSPF router ID

D.ARP replaces DNS for hostname resolution

AnswersA, B

ARP's core function is to dynamically discover the hardware (MAC) address associated with a given IPv4 address when a host must deliver a frame on the same Layer 2 segment. The host broadcasts an ARP request containing the target IPv4 address; the node that owns that address replies with its MAC address, which is then stored in the ARP cache. Without this mapping, the host cannot construct the Ethernet frame header with the correct destination MAC, making ARP a prerequisite for IPv4 communication over most LAN technologies.

Why this answer

On Ethernet, the sender needs a destination MAC address. For remote destinations, that usually means ARPing for the default gateway's MAC.

Exam trap

A frequent exam trap is selecting options that confuse ARP with DNS or routing protocol functions. For example, some may incorrectly believe ARP resolves hostnames like DNS or discovers OSPF router IDs. These misunderstandings arise because ARP and DNS both involve address resolution, but ARP only maps IPv4 addresses to MAC addresses on the local LAN, while DNS maps hostnames to IP addresses.

Similarly, ARP does not interact with routing protocols like OSPF. Misinterpreting ARP’s role leads to incorrect answers and can cost points on the CCNA exam.

Why the other options are wrong

Incorrect because ARP does not discover routing protocol identifiers like OSPF router IDs; these are unrelated to Layer 2 address resolution.

Incorrect because ARP does not replace DNS; DNS resolves hostnames to IP addresses, whereas ARP resolves IP addresses to MAC addresses.

Practice this question →

107

Multi-Selectmedium

Which three of the following are characteristics of Layer 2 Ethernet switches that improve network performance? (Choose three.)

Select 3 answers

.They create separate collision domains per port.

.They forward frames based on the destination MAC address.

.They reduce the number of broadcast domains.

.They can perform cut-through switching to reduce latency.

.They use IP addresses to make forwarding decisions.

.They automatically block all unknown unicast frames.

Why this answer

Layer 2 Ethernet switches improve network performance by creating separate collision domains per port, eliminating collisions between devices on different ports. They forward frames based on the destination MAC address, enabling efficient hardware-based switching. Cut-through switching reduces latency by starting to forward as soon as the destination MAC address is read.

The other options are incorrect: switches do not reduce broadcast domains (broadcasts are forwarded to all ports in the same VLAN unless a router or VLAN segmentation is used); switches operate at Layer 2 using MAC addresses, not IP addresses; and unknown unicast frames are flooded out all ports except the incoming port, not automatically blocked, to ensure connectivity if the destination is unknown.

Exam trap

Cisco often tests the distinction between collision domains and broadcast domains, where candidates mistakenly think switches reduce broadcast domains, but switches only segment collision domains while broadcast domains are controlled by VLANs or routers.

Practice this question →

108

PBQhard

You are connected to R1 via console. PC1 is connected to R1's GigabitEthernet0/1 interface and is configured with a static IP address. PC1 cannot reach the internet (203.0.113.1). Identify and resolve the connectivity issue. Configure R1 to restore full connectivity for PC1.

Network Topology

Hints

•The problem is not with IP addressing or routing; R1 can reach the internet.
•PC1 uses a private IP address (RFC 1918), which must be translated before leaving R1.
•Check if NAT is configured on R1.

A.Configure NAT overload on R1: define ACL 1 to permit 192.168.1.0 0.0.0.255, set GigabitEthernet0/0 as outside and GigabitEthernet0/1 as inside, and apply ip nat inside source list 1 interface GigabitEthernet0/0 overload.

B.Configure a static route on R1: ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 203.0.113.1.

C.Change PC1's default gateway to 203.0.113.1.

D.Enable IP routing on R1 and configure OSPF.

AnswerA

solution

! R1
access-list 1 permit 192.168.1.0 0.0.0.255
ip nat inside source list 1 interface GigabitEthernet0/0 overload
interface GigabitEthernet0/1
ip nat inside
interface GigabitEthernet0/0
ip nat outside

Why this answer

PC1 has a default gateway of 192.168.1.1, which is correct, but R1 is not performing NAT. R1 can reach the internet (203.0.113.1) but PC1 cannot because R1 drops packets from PC1 destined to the internet without source NAT. The fix is to configure NAT overload (PAT) on R1: define an ACL to match PC1's subnet, configure the inside and outside interfaces, and enable NAT on the outside interface.

This will translate PC1's private IP to R1's public IP.

Exam trap

The trap is that candidates may focus on routing (default route, routing protocols) or IP addressing (default gateway) when the real issue is NAT. Always verify if private IPs are being translated when hosts cannot reach the internet, even if the router itself has connectivity.

Why the other options are wrong

The specific factual error is that a default route is already in place and working; adding another does not solve the NAT problem.

The specific factual error is that a host's default gateway must be on the same subnet; 203.0.113.1 is not reachable directly from PC1.

The specific factual error is that OSPF does not solve the private-to-public address translation problem; it only exchanges routes between routers.

Practice this question →

109

PBQhard

You are troubleshooting a PC (PC-A) connected to switch SW1, which is connected to router R1. PC-A has an APIPA address (169.254.23.45) and cannot reach the internet (203.0.113.1). You confirm that R1 has a correctly configured DHCP pool for the 192.168.10.0/24 subnet, but the DHCP service is not enabled. The network uses VLAN 10 with subnet 192.168.10.0/24. Verify and correct the configuration on PC-A, SW1, and R1 to restore full connectivity.

Network Topology

Hints

•Check if the DHCP server process is running on R1.
•APIPA addresses (169.254.x.x) indicate DHCP failure.
•The DHCP pool is configured but not yet active.

A.Enable the DHCP service on R1 with the 'service dhcp' command.

B.Configure a default gateway on PC-A with the IP address 192.168.10.1.

C.Change the VLAN on SW1's interface connected to PC-A from VLAN 10 to VLAN 1.

D.Add the 'ip helper-address' command on R1's interface connected to SW1.

AnswerA

solution

! R1
service dhcp

! SW1


! PC-A

Why this answer

The APIPA address (169.254.x.x) indicates that PC-A failed to obtain a DHCP lease. The correct solution is to enable the DHCP service on R1 with 'service dhcp', which is not running despite the configured pool. Option B is incorrect because setting a default gateway on PC-A with a static IP would still require a valid address in the subnet; the APIPA address cannot communicate with 192.168.10.1.

Option C is wrong because the PC-A interface on SW1 is correctly assigned to VLAN 10. Option D is unnecessary since R1 is directly connected to the same subnet, so 'ip helper-address' is only used to forward DHCP broadcasts across router boundaries.

Exam trap

Do not assume that configuring a DHCP pool is sufficient; the DHCP service must be explicitly enabled with 'service dhcp'. Also, remember that APIPA addresses indicate DHCP failure, not just a missing gateway.

Why the other options are wrong

The PC's APIPA address cannot reach the 192.168.10.1 gateway because it is not in the same subnet, so configuring a default gateway alone does not restore connectivity.

Changing the VLAN to VLAN 1 would isolate PC-A from the correct subnet (VLAN 10), breaking connectivity instead of fixing it.

The 'ip helper-address' command is used on interfaces that need to forward DHCP broadcasts to a remote DHCP server; here R1 itself is the DHCP server and is directly attached, so the command is not needed.

Practice this question →

110

PBQhard

You are connected to R1 via the console. R1 and R2 are connected via a fiber link using SFPs. The link is not coming up. Configure the correct SFP type on R1's interface GigabitEthernet0/0 to support the required 2 km distance, and fix any auto-negotiation or speed/duplex misconfiguration so that the link becomes operational.

Network Topology

Hints

•Check the transceiver details to see the current SFP's distance capability.
•The link requires 2 km; the current SFP only supports 550 m.
•Auto-negotiation is not used on fiber links; disable it with 'no negotiation auto'.

A.Replace SFP with 1000BASE-LX, configure 'no negotiation auto' on GigabitEthernet0/0, and remove 'speed 1000' and 'duplex full'.

B.Replace SFP with 1000BASE-SX, configure 'negotiation auto' on GigabitEthernet0/0, and keep 'speed 1000' and 'duplex full'.

C.Replace SFP with 1000BASE-LX, configure 'negotiation auto' on GigabitEthernet0/0, and keep 'speed 1000' and 'duplex full'.

D.Replace SFP with 1000BASE-LX, configure 'no negotiation auto' on GigabitEthernet0/0, and configure 'speed 100' and 'duplex full'.

AnswerA

solution

! R1
interface gigabitEthernet 0/0
no speed 1000
no duplex full
no negotiation auto
end

Why this answer

For a 2 km fiber link, a 1000BASE-LX SFP is required (supports up to 10 km). Fiber SFPs like 1000BASE-LX typically do not support auto-negotiation; speed and duplex are fixed. Therefore, the interface should have 'no negotiation auto' configured and no explicit speed/duplex commands.

Option A implements these changes. Option B uses 1000BASE-SX, which is suitable only for up to 550 m. Option C leaves auto-negotiation enabled, which is unsupported.

Option D sets speed to 100, which is incompatible with a GigabitEthernet interface.

Exam trap

Do not assume auto-negotiation is always required; fiber SFPs use fixed parameters. Also, remember that 1000BASE-SX is for short distances (up to 550 m), while 1000BASE-LX supports longer distances (up to 10 km).

Why the other options are wrong

Uses 1000BASE-SX, which cannot support the required 2 km distance.

Retains 'negotiation auto', which is not supported on fiber SFPs and prevents the link from establishing.

Configures 'speed 100', a value incompatible with a 1000BASE-LX SFP, causing a link failure.

Practice this question →

111

MCQhard

A host address is 192.168.90.33/28. Which address is the last usable host in the subnet?

A.192.168.90.46

B.192.168.90.47

C.192.168.90.33

D.192.168.90.48

AnswerA

192.168.90.46 is the last usable host address in the /28 subnet that contains .33. A /28 prefix has a block size of 16, so the subnet boundaries are 192.168.90.32 and 192.168.90.47. The address .46 has all host bits set to 1 except the last one, making it the highest address that can be assigned to a device. The next address, .47, is the directed broadcast for this subnet.

Why this answer

The /28 subnet mask (255.255.255.240) gives a block size of 16 addresses. The network address for 192.168.90.33 is 192.168.90.32, so the broadcast address is 192.168.90.47. The last usable host is the broadcast address minus one, which is 192.168.90.46.

Exam trap

Cisco often tests the distinction between the broadcast address and the last usable host, tricking candidates who forget to subtract one from the broadcast address.

Why the other options are wrong

192.168.90.47 is the broadcast address for the subnet 192.168.90.32/28. Broadcast addresses cannot be assigned to hosts; they are used to send traffic to all hosts in the subnet.

192.168.90.33 is the first usable host in the subnet (network address .32 + 1). The question asks for the last usable host, not the first.

192.168.90.48 is the network address of the next subnet (192.168.90.48/28). It is not part of the current subnet and cannot be used as a host address in the subnet containing .33.

Practice this question →

112

MCQhard

A network administrator is troubleshooting a connectivity issue between two routers, R1 and R2, connected via a serial link. R1 is configured with PPP encapsulation and CHAP authentication. R2 is configured with PPP encapsulation but no authentication. The link is down. Which statement explains the most likely cause?

A.The link is down because PPP encapsulation is not compatible with serial interfaces.

B.CHAP authentication failed because R2 did not send a challenge.

C.The link is down because CHAP requires the same hostname on both routers.

D.The link is down because R1 requires authentication but R2 is not configured to authenticate.

AnswerD

When one side of a PPP link is configured with authentication (CHAP) and the other side is not, the authentication will fail. R1 will send a CHAP challenge to R2, but R2 will not have the necessary credentials or configuration to respond. As a result, the link will not come up. This is the most likely cause of the connectivity issue. Both ends must agree on authentication parameters for the link to establish.

Why this answer

In PPP, if one side is configured with authentication (CHAP) and the other side is not, the authentication process will fail, and the link will not come up. R1 will send a challenge, but R2 cannot respond appropriately. Both ends must have compatible authentication configurations.

The most likely cause is the mismatch in authentication settings.

Exam trap

The trap here is assuming that CHAP requires identical hostnames or that PPP is incompatible with serial interfaces, rather than recognizing the authentication mismatch as the cause.

Practice this question →

113

MCQhard

A user reports they cannot access any network resources. A network administrator runs ipconfig on the user's Windows PC and sees an IPv4 address of 169.254.45.3/16. The administrator then pings the default gateway 10.0.0.1, which fails, and uses traceroute to 10.0.0.1, which shows only '1 * * * Request timed out.' What is the most likely cause of the problem?

A.The PC's DNS server address is incorrect.

B.The switch port is in an administratively down state.

C.The Ethernet cable is unplugged from the PC.

D.The DHCP server is unreachable.

AnswerD

The 169.254.x.x APIPA address indicates that the PC is configured for DHCP but did not receive a DHCP offer. Because the address is not in the same subnet as the default gateway, all connectivity beyond the local link fails.

Why this answer

The 169.254.45.3/16 address is an Automatic Private IP Addressing (APIPA) address, assigned by Windows when a DHCP discovery fails. The failed ping and traceroute to the default gateway confirm that the PC has no IP connectivity to the network. Since the PC has an APIPA address, it was unable to reach a DHCP server to obtain a valid IPv4 address; the most likely cause is that the DHCP server is unreachable.

The presence of an APIPA address also indicates the PC's NIC has a working physical and data-link connection, ruling out a disconnected cable or disabled switch port.

Exam trap

Cisco often tests the distinction between a link-local APIPA address and a 'Media disconnected' state; the trap here is that candidates may assume a physical issue (unplugged cable or disabled port) when the presence of an APIPA address actually proves the physical and data link layers are operational.

Why the other options are wrong

DNS misconfiguration would not prevent direct IP connectivity to the gateway.

With the port down, the PC would not assign any IP address; APIPA assignment requires an active link.

Physical disconnection prevents link establishment, so no IP address is assigned.

Practice this question →

114

MCQhard

A host with address 10.0.0.130/25 needs to identify its subnet. Which subnet is correct?

A.10.0.0.0/25

B.10.0.0.64/25

C.10.0.0.128/25

D.10.0.0.192/25

AnswerC

The /25 prefix length creates subnets with a block size of 128 addresses. The host address 10.0.0.130 has a last octet binary of 10000010, which lies within the 128-255 range, so it belongs to the subnet that starts at 10.0.0.128. The network address is therefore 10.0.0.128, with usable host addresses 10.0.0.129 through 10.0.0.254 and a broadcast address of 10.0.0.255.

Why this answer

A /25 uses blocks of 128 addresses. In plain language, that means the fourth-octet ranges are 0–127 and 128–255. Since the host address ends in 130, it belongs to the upper block, which means the subnet is 10.0.0.128/25.

This kind of question is a staple of subnetting because it tests whether you can identify the correct subnet boundary from the prefix and host address. Once you recognize the /25 split, the answer becomes straightforward.

Exam trap

Be careful not to confuse the subnet mask with the number of addresses it covers. Always calculate the address range based on the subnet mask.

Why the other options are wrong

The subnet 10.0.0.0/25 covers addresses 10.0.0.0 through 10.0.0.127. Since 10.0.0.130 is outside this range, it cannot belong to this subnet. The host's address must be within the subnet's range.

The /25 prefix length has a subnet size of 128, so valid network addresses are multiples of 128 (0, 128, 256, etc.). 10.0.0.64 is not a multiple of 128, so it is not a valid /25 network address.

The /25 prefix length creates subnets with a block size of 128, starting at 0, 128, 256, etc. 10.0.0.192/25 would be a valid subnet if the network started at 192, but 192 is not a valid /25 boundary because 192 is not a multiple of 128.

Practice this question →

115

PBQmedium

You are connected to the console of R1. The network administrator reports that R1 cannot discover neighboring devices via CDP. R1 is connected to SW1 via GigabitEthernet0/0. You suspect CDP is disabled globally or on the interface. Your task is to enable CDP and verify neighbor discovery.

Network Topology

Hints

•CDP can be disabled globally or per interface.
•Use the 'show cdp' command to check global status.
•After enabling, wait a few seconds for neighbor discovery.

A.Enter global configuration mode, issue 'cdp run', then enter interface configuration mode for GigabitEthernet0/0 and issue 'cdp enable'.

B.Enter global configuration mode, issue 'cdp enable', then enter interface configuration mode for GigabitEthernet0/0 and issue 'cdp run'.

C.Enter global configuration mode, issue 'cdp run', then enter interface configuration mode for GigabitEthernet0/0 and issue 'no cdp disable'.

D.Enter global configuration mode, issue 'cdp enable', then enter interface configuration mode for GigabitEthernet0/0 and issue 'no cdp disable'.

AnswerA

solution

! R1
cdp run
interface GigabitEthernet0/0
cdp enable

Why this answer

CDP was disabled globally and on the interface. Enabling CDP globally and then on the interface allows R1 to discover directly connected Cisco devices.

Exam trap

Remember that CDP requires two separate commands: 'cdp run' globally and 'cdp enable' on each interface. Do not confuse the global and interface commands, and do not invent commands like 'no cdp disable'.

Why the other options are wrong

The specific factual error is that 'cdp enable' is used on interfaces, not globally. The global command to enable CDP is 'cdp run'.

The specific factual error is that 'no cdp disable' is not a valid Cisco IOS command. The proper command is 'cdp enable'.

The specific factual errors are: the global command should be 'cdp run', and the interface command should be 'cdp enable'.

116

Multi-Selectmedium

Which two statements about ARP on an IPv4 Ethernet network are correct? (Choose two.)

Select 2 answers

A.An ARP request is sent as a Layer 2 broadcast.

B.An ARP reply is normally sent as a unicast frame.

C.ARP is used to map IPv6 addresses to MAC addresses.

D.ARP is forwarded by routers across subnets by default.

AnswersA, B

An ARP request is a broadcast at Layer 2 because the sender knows the target IPv4 address but not the target MAC address. To reach all devices on the local Ethernet segment, the frame's destination MAC is set to FF:FF:FF:FF:FF:FF, causing switches to flood it out all ports and every host in the VLAN to process it. Only the device configured with the target IPv4 address responds.

Why this answer

ARP resolves an IPv4 address to a MAC address on the local segment. ARP requests are broadcast; ARP replies are typically unicast.

Exam trap

Be careful not to confuse ARP requests with replies, and remember that ARP operates only within a local segment.

Why the other options are wrong

ARP is specifically designed for IPv4 networks to map IPv4 addresses to MAC addresses. IPv6 uses Neighbor Discovery Protocol (NDP) with ICMPv6 messages to perform address resolution, not ARP.

ARP operates only within a single broadcast domain (subnet) and is not forwarded by routers. Routers separate broadcast domains and do not forward ARP requests or replies across subnets by default.

Practice this question →

117

MCQeasy

A junior administrator is asked to configure a Cisco router interface with the IPv4 address 10.1.1.1 and a subnet mask of 255.255.255.0 so it can route traffic for the 10.1.1.0/24 network. Which command correctly assigns this address to the interface?

A.ipv4 address 10.1.1.1 255.255.255.0

B.ip address 10.1.1.1 mask 255.255.255.0

C.ip address 10.1.1.1 255.255.255.0

D.ip address 10.1.1.1/24

AnswerC

The ip address command on a Cisco router interface accepts the address followed by a dotted-decimal subnet mask, so ip address 10.1.1.1 255.255.255.0 correctly assigns the address and mask. This is the standard syntax used in interface configuration mode and produces the intended 10.1.1.0/24 network on that interface.

Why this answer

Cisco IOS interface configuration uses the ip address command with the address and a dotted-decimal subnet mask, so ip address 10.1.1.1 255.255.255.0 is correct. Slash notation, the ipv4 keyword, and an extra mask keyword are all invalid in this context. Getting the exact syntax right is essential because a rejected command leaves the interface unaddressed and unable to route for the 10.1.1.0/24 network.

Exam trap

The trap here is mixing CIDR slash notation or non-IOS keywords into a command that requires a dotted-decimal mask.

Practice this question →

118

MCQhard

A host cannot communicate with its default gateway. The technician uses the show arp command on the host and sees that the ARP entry for the gateway IP is incomplete. The technician has already verified that the Ethernet cable is securely connected and the switch port is active. What should the technician do next?

A.Check the switch port’s VLAN configuration and ensure the host and router interface are in the same VLAN.

B.Replace the Ethernet cable between the host and the switch.

C.Clear the ARP cache on the host and attempt to ping the gateway again.

D.Check the router’s routing table for a route to the host’s subnet.

AnswerA

If the host and gateway are in different VLANs, the ARP request broadcast never reaches the gateway, so the entry stays incomplete. This step directly addresses the most probable Layer 2 fault after excluding physical issues.

Why this answer

An incomplete ARP entry for the default gateway indicates that the host sent an ARP request but never received a reply. Since the physical layer (cable and switch port) is verified as operational, the most likely cause is a Layer 2 mismatch: the host and the router interface are in different VLANs, preventing the ARP reply from reaching the host. Checking the switch port's VLAN configuration ensures both devices are in the same broadcast domain, which is required for ARP to function.

Exam trap

Cisco often tests the distinction between Layer 2 connectivity (ARP, VLANs) and Layer 3 connectivity (routing), leading candidates to incorrectly focus on routing tables or ARP cache clearing when the real issue is a VLAN mismatch.

Why the other options are wrong

Candidates may equate a physical link symptom with a faulty cable, but the port’s active status indicates a good L1 connection. This action skips necessary logical checks.

This is a common ‘quick fix’ mindset, but in a structured troubleshooting process, clearing the cache hides information without solving the root cause.

Candidates might confuse local ARP failure with reachability issues to a remote subnet, but the gateway is the router itself. Routing is irrelevant until the destination is off-segment.

Practice this question →

119

MCQmedium

Which IPv6 address type is automatically created on an interface and used for communication on the local link only?

A.Global unicast

B.Link-local

C.Unique local

D.Multicast

AnswerB

Link-local addresses (fe80::/10) are automatically generated on all IPv6-enabled interfaces and remain confined to a single link; they are not routed by routers. This automatic creation happens immediately when IPv6 is enabled on the interface, and the address is typically derived from the interface's MAC address using EUI-64 or generated randomly with privacy extensions. This is the address type the question refers to.

Why this answer

Every IPv6-enabled interface generates a link-local address, typically in the FE80::/10 range. It is used for neighbor discovery, local communication, and next-hop resolution on the same link.

Exam trap

A common exam trap is confusing link-local addresses with unique local or global unicast addresses. Link-local addresses are automatically generated and only valid on the local link, whereas unique local addresses resemble private IPv4 addresses but are routable within an organization. Multicast addresses are not assigned to interfaces for unicast communication, so selecting multicast is incorrect.

Understanding the scope and automatic generation of link-local addresses is critical.

Why the other options are wrong

Global unicast addresses are routable beyond the local link and are not automatically created for local link communication only.

Unique local addresses are similar to private IPv4 addresses and are routable within an organization, not limited to the local link.

Multicast addresses are used for group communication and are not assigned as interface addresses for unicast communication.

Practice this question →

120

MCQhard

A network administrator is troubleshooting an IPv6 connectivity issue on a newly deployed router. The router's G0/0/0 interface is configured with an IPv6 address using EUI-64, but hosts on that subnet cannot reach the router's link-local address. The administrator runs 'show ipv6 interface g0/0/0' and sees that the interface is up/up but the IPv6 address is not in the expected format. What is the most likely cause of the problem?

A.The interface is administratively down.

B.The IPv6 address was not configured correctly; the 'ipv6 address' command was likely omitted or misconfigured.

C.The MAC address of the interface is invalid, preventing EUI-64 from generating a proper address.

D.The router is not sending Router Advertisements, so hosts cannot autoconfigure.

AnswerB

If the 'ipv6 address' command was omitted, IPv6 is not enabled, and no link-local address exists. If it was misconfigured (e.g., missing the `eui-64` keyword), the router would still have a link-local address, so the symptom of hosts unable to reach the link-local address would not occur. Therefore, omission is the most likely cause given the symptom.

Why this answer

The router's G0/0/0 interface is up/up, but the IPv6 address is not in the expected EUI-64 format. This indicates that the 'ipv6 address' command was likely omitted entirely, because if it were simply misconfigured (e.g., without the `eui-64` keyword), the router would still automatically generate a link-local address, and hosts would be able to reach it. Since hosts cannot reach the link-local address, IPv6 is not enabled on the interface at all.

The correct configuration requires the `ipv6 address` command with the appropriate prefix and the `eui-64` keyword.

Exam trap

Cisco often tests the distinction between interface status (up/up) and configuration correctness, leading candidates to assume that a working interface means the IPv6 address is properly configured, when in fact the address may be missing or misconfigured.

Why the other options are wrong

The 'show ipv6 interface' output shows 'up, line protocol is up', indicating the interface is not administratively down. An administratively down interface would show 'administratively down' in the output.

The link-local address (FE80::21A:2BFF:FE3C:4D5E) is correctly formed using EUI-64, which requires a valid MAC address. The presence of 'FF:FE' in the middle indicates EUI-64 is functioning properly, so the MAC address is valid.

The output shows 'ND router advertisements are sent every 200 seconds', confirming that Router Advertisements are enabled. The problem is about the router's own IPv6 address, not host autoconfiguration.

Practice this question →

121

MCQmedium

A switch displays the following output: Interface Status VLAN Gi1/0/5 connected 20 Gi1/0/6 notconnect 1 Gi1/0/24 trunk trunk Which interface is operating as an access port in VLAN 20?

A.Gi1/0/5

B.Gi1/0/6

C.Gi1/0/24

D.None of the interfaces

AnswerA

The output for Gi1/0/5 shows an interface that is up/connected and explicitly assigned to VLAN 20 as an access port, which exactly matches the requirement stated in the question. The status column indicates the link is active, and the VLAN column confirms membership in VLAN 20, leaving no doubt that this is the correct interface.

Why this answer

The output explicitly shows Gi1/0/5 in VLAN 20 and not operating as a trunk.

Exam trap

Be careful not to confuse trunk ports with access ports or assume interfaces not shown in the output are relevant.

Why the other options are wrong

Gi1/0/6 is an access port in VLAN 1 (the default VLAN), not VLAN 20. The question specifically asks for an interface operating as an access port in VLAN 20, so this option is incorrect.

Gi1/0/24 is configured as a trunk port, which carries traffic for multiple VLANs and is not an access port. Access ports belong to a single VLAN, so this option is incorrect.

Gi1/0/5 is clearly an access port in VLAN 20, so there is an interface that matches the description. Therefore, 'None of the interfaces' is incorrect.

Practice this question →

122

MCQhard

A network engineer notices that users on VLAN 100 are experiencing intermittent connectivity to the server farm. The switch connecting these users shows no errors on the uplink interface, but the server farm switch reports a high number of input errors on its connected interface. The engineer runs 'show controllers' on the server farm switch. What is the most likely cause of the issue?

A.The interface is configured with the wrong duplex setting.

B.The SFP module is faulty or incompatible with the cable type.

C.The cable is too long, causing attenuation.

D.Auto-negotiation is disabled, causing a speed mismatch.

AnswerB

The 'show controllers' output shows the media type as 1000BaseSX SFP with auto-negotiation off, but the interface is reporting no errors. However, the other switch sees input errors. This points to a hardware issue with the SFP, such as a faulty module or a mismatch between the SFP and the fiber cable (e.g., using a single-mode SFP with multi-mode fiber).

Why this answer

The 'show controllers' command on the server farm switch reveals physical-layer issues such as framing errors, CRC errors, or alignment errors, which are often caused by faulty or incompatible SFP modules. Since the uplink interface on the user switch shows no errors, the problem is isolated to the server farm switch's interface, and a faulty SFP can introduce signal degradation or electrical issues without necessarily causing complete link failure. Option B is correct because SFP incompatibility or defects commonly produce input errors at the physical layer, even when the link appears up.

Exam trap

Cisco often tests the distinction between 'show interfaces' (which shows input errors but not the specific physical-layer cause) and 'show controllers' (which reveals the exact physical-layer errors), leading candidates to mistakenly choose duplex mismatch or cable length issues without recognizing that the command output points to SFP or transceiver problems.

Why the other options are wrong

The 'show controllers' output confirms Full-duplex on both ends, so a duplex mismatch is not the cause. Duplex mismatch would typically cause collisions or CRC errors, which are not indicated here.

While excessive cable length can cause attenuation and errors, the 'show controllers' output does not show specific error counters like symbol errors or FCS errors that would indicate attenuation. The link is up and no errors are reported on this switch, making cable length an unlikely cause.

Speed is set to 1000 Mbps on both ends, and auto-negotiation is off, which is normal for fiber connections. A speed mismatch would prevent the link from coming up or cause constant errors, but the link is up and no errors are reported on this switch.

Practice this question →

123

Drag & Dropmedium

Drag and drop the following troubleshooting steps into the correct order to diagnose a client connectivity issue using the OSI bottom-up method.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The OSI bottom-up method starts at physical layer and moves up. This ensures that lower-layer issues are resolved before higher-layer troubleshooting, preventing wasted effort on symptoms caused by underlying problems.

Exam trap

The exam trap is that candidates may confuse bottom-up with top-down troubleshooting or think that checking the network layer first is more efficient. Remember: bottom-up always starts at the physical layer and proceeds sequentially upward.

Practice this question →

124

PBQhard

You are connected to R1 via the console. R1 and R2 are directly connected via their GigabitEthernet0/0 interfaces. The link between them is down. Your task is to diagnose and fix the issue: R1's interface is configured for 100 Mbps full-duplex, but R2 is using auto-negotiation. Additionally, the link requires a Gigabit Ethernet connection over a distance of 5 km. Configure R1's interface to match R2's settings (auto-negotiation) and then select and install the correct SFP module to support the 5 km distance requirement.

Network Topology

Hints

•Check the current speed and duplex settings on R1's interface.
•Auto-negotiation requires both sides to be set to 'auto' to succeed.
•For distances up to 5 km, use a 1000BASE-LX SFP (single-mode fiber).

A.Configure R1 with 'no speed', 'no duplex', and 'negotiation auto' on GigabitEthernet0/0, then replace the SFP module with a 1000BASE-LX SFP.

B.Configure R1 with 'speed 1000' and 'duplex full' on GigabitEthernet0/0, then replace the SFP module with a 1000BASE-SX SFP.

C.Configure R1 with 'no speed', 'no duplex', and 'negotiation auto' on GigabitEthernet0/0, then replace the SFP module with a 1000BASE-SX SFP.

D.Configure R1 with 'speed 100' and 'duplex full' on GigabitEthernet0/0, then replace the SFP module with a 1000BASE-LX SFP.

AnswerA

solution

! R1
configure terminal
interface gigabitethernet 0/0
no speed 100
no duplex full
negotiation auto
end

Why this answer

The link is down because R1 is forcing speed 100 and full-duplex while R2 is using auto-negotiation. When one side is hard-coded and the other is set to auto, auto-negotiation fails and the link does not come up. The fix is to enable auto-negotiation on R1 by removing the manual speed and duplex settings with the 'no speed' and 'no duplex' commands, and then using 'negotiation auto'.

For the 5 km distance, a standard 1000BASE-SX SFP (550 m) is insufficient; a 1000BASE-LX SFP (up to 10 km) is required. The candidate must also replace the SFP module with a compatible LX SFP.

Exam trap

Students often forget that auto-negotiation must be enabled on both sides for Gigabit Ethernet; hard-coding one side breaks the link. Also, they may confuse SFP types: SX for short range, LX for long range. Always verify distance requirements when selecting fiber optics.

Why the other options are wrong

The specific factual error is that hard-coding speed and duplex on one side while the other uses auto-negotiation prevents the link from coming up, and 1000BASE-SX cannot reach 5 km.

The specific factual error is that 1000BASE-SX is designed for short-range multimode fiber, not long distances.

The specific factual error is that GigabitEthernet interfaces can operate at 100 Mbps, but the SFP module requires 1000 Mbps; additionally, the speed/duplex mismatch prevents the link from coming up.

Practice this question →

125

PBQhard

You are connected to WLC-1 via the management interface (192.168.1.100/24). The wireless network 'CustomerNet' uses WPA3-Personal, but clients are failing to associate. The SSID is hidden and the correct VLAN is 30. Configure the WLAN and SSID parameters to allow successful client associations and verify the configuration.

Network Topology

Hints

•Remember to create the interface before assigning it to the WLAN.
•WPA3-Personal uses a pre-shared key (PSK) but the command is 'security wpa3'.
•The SSID broadcast must be enabled ('broadcast-ssid enable') for clients to discover it.

A.Create a new interface 'vlan30' with VLAN 30, then create a new WLAN with SSID 'CustomerNet', set security to WPA3-Personal, enable SSID broadcast, and assign the 'vlan30' interface.

B.Modify the existing GuestNet WLAN: change security to WPA3-Personal, enable SSID broadcast, and change the interface to 'guest' (VLAN 20).

C.Create a new WLAN with SSID 'CustomerNet', set security to WPA2-PSK, enable SSID broadcast, and assign the 'guest' interface (VLAN 20).

D.Modify the GuestNet WLAN: change security to WPA3-Personal, keep SSID broadcast disabled, and change the interface to a new interface mapped to VLAN 30.

AnswerA

solution

! WLC-1
config terminal
interface customer
vlan 30
ip address 192.168.30.1 255.255.255.0
exit
wlan 3
ssid CustomerNet
broadcast-ssid enable
security wpa3
security wpa akm psk set-key ascii 0 CiscoSecure123
interface customer
no shutdown
end

Why this answer

The GuestNet WLAN (ID 2) currently uses WPA2 with PSK, but clients expect WPA3-Personal. Additionally, the SSID is hidden (broadcast disabled) and the interface is set to guest (VLAN 20) instead of the required VLAN 30. To fix, create a new WLAN (or modify WLAN 2) to use WPA3-Personal, enable SSID broadcast, and assign it to a new interface mapped to VLAN 30.

Configure the interface first, then apply to the WLAN.

Exam trap

A common trap is to assume that modifying the existing WLAN is sufficient, but you must also ensure the correct VLAN interface exists and is assigned. Additionally, candidates often forget that a hidden SSID must be broadcast for clients to discover it, especially when clients are failing to associate.

Why the other options are wrong

The specific factual error is that the interface remains set to 'guest' (VLAN 20) instead of being changed to VLAN 30 as required.

The specific factual errors are using WPA2-PSK (clients expect WPA3-Personal) and assigning the wrong VLAN (20 instead of 30).

The specific factual error is that the SSID broadcast remains disabled, which means clients cannot see the SSID and will not attempt to associate.

Practice this question →

126

MCQhard

A network engineer notices that after issuing the no shutdown command on interface GigabitEthernet0/0 of a router, the interface remains down. The output of show interfaces GigabitEthernet0/0 displays 'GigabitEthernet0/0 is down, line protocol is down'. The physically connected switch port is also administratively down. What is the most likely cause?

A.The connected switch port is administratively down.

B.Mismatched encapsulation types on the router and switch.

C.Speed and duplex mismatch between the router and switch.

D.Incorrect native VLAN configuration on the trunk link.

AnswerA

An administratively down switch port is placed in the shutdown state, which disables all physical-layer signaling and removes carrier from the cable. The router consequently senses no layer 1 presence on its interface, so the line protocol cannot transition to up even if the router's own configuration is otherwise sound. This is the direct and definitive cause of the line protocol being down, as no handshake or frame exchange can occur.

Why this answer

The output 'GigabitEthernet0/0 is down, line protocol is down' indicates that both Layer 1 and Layer 2 are down. Since the directly connected switch port is administratively down, the router interface detects no carrier and remains down/down even after the local no shutdown command. Therefore, option A is the most likely cause.

Exam trap

Cisco does test the distinction between local and remote administrative shutdown, but the resulting state would be 'down/down', not 'up/down'. Students should understand that 'up/down' implies Layer 1 is functional, which cannot happen if the remote port is shut down.

Why the other options are wrong

Candidates often attribute line protocol down to encapsulation issues, missing the clear indication that the switch port is shut down.

Duplex mismatch is a common cause of interface issues, so candidates may assume it without considering the explicitly stated admin-down condition.

Candidates may recall VLAN mismatch as a cause for line protocol down on trunk links, forgetting that the scenario gives a clear admin-down state.

Practice this question →

127

PBQhard

You are managing a Cisco WLC (WLC-1) with IP 10.10.10.10. A wireless client reports it can see the SSID 'CorpNet' but fails to associate. The SSID is configured for WPA3, but the client only supports WPA2. Additionally, the WLAN is mapped to VLAN 100, but the AP is on VLAN 10, causing a mismatch. Your task: reconfigure the WLAN to use WPA2-PSK with AES encryption, correct the VLAN assignment to 10, and ensure the SSID is hidden. Also, verify that management access via the WLC web UI is restricted to the 192.168.1.0/24 subnet.

Network Topology

Hints

•The client cannot join because WPA3 is required but the client only supports WPA2.
•The WLAN is on VLAN 100, but the AP is on VLAN 10 — this mismatch prevents client traffic from being properly bridged.
•Management access is open to all; restrict it to the subnet that contains your admin workstation.

A.Change security to WPA2-PSK with AES, disable PMF, map WLAN to management interface (VLAN 10), disable SSID broadcast, restrict HTTP/HTTPS access to 192.168.1.0/24.

B.Change security to WPA2-PSK with TKIP, enable PMF, map WLAN to VLAN 100, enable SSID broadcast, restrict HTTP access to 192.168.1.0/24.

C.Change security to WPA3-PSK with AES, disable PMF, map WLAN to VLAN 10, disable SSID broadcast, restrict HTTP/HTTPS access to 10.10.10.0/24.

D.Change security to WPA2-PSK with AES, enable PMF, map WLAN to VLAN 10, enable SSID broadcast, restrict HTTP/HTTPS access to 192.168.1.0/24.

AnswerA

solution

! WLC-1
config wlan 1
no security wpa3
security wpa2
security wpa2 akm psk
security wpa2 encryption aes
no security wpa3 pmf
interface VLAN10
no broadcast-ssid
end
config management
management http subnet 192.168.1.0 255.255.255.0
management https subnet 192.168.1.0 255.255.255.0
end

Why this answer

The client cannot associate because the WLAN requires WPA3 (PMF required) but the client only supports WPA2. Also, the WLAN is mapped to VLAN 100, but the AP is on VLAN 10, causing a VLAN mismatch that prevents client traffic from reaching the correct subnet. The SSID is broadcast (visible), and management access is open to all subnets.

To fix: change the WLAN security to WPA2-PSK with AES, disable PMF, map the WLAN to the management interface (VLAN 10), disable SSID broadcast, and restrict HTTP/HTTPS access to subnet 192.168.1.0/24.

Exam trap

The exam trap is that candidates may overlook the VLAN mismatch or the requirement to disable PMF when switching from WPA3 to WPA2. Also, they might forget to restrict both HTTP and HTTPS, or confuse the management subnet with the WLC IP address. Always verify client capabilities and VLAN assignments.

Why the other options are wrong

The specific factual error: TKIP is deprecated and not used with WPA2-PSK; PMF must be disabled for WPA2-only clients; VLAN 100 is incorrect; SSID broadcast should be disabled; HTTPS access must also be restricted.

The specific factual error: WPA3-PSK requires PMF and is incompatible with WPA2-only clients; the allowed subnet for management is 192.168.1.0/24, not 10.10.10.0/24.

The specific factual error: PMF is not supported by all WPA2 clients and can cause association issues; SSID broadcast should be disabled to hide the SSID.

Practice this question →

128

PBQhard

You are connected to R1. The link between R1's GigabitEthernet0/0 and R2's GigabitEthernet0/0 should operate at 1 Gbps full duplex, but the interface is showing errors and only negotiating at 100 Mbps half duplex. Diagnose and fix the fault, then verify the link is stable at the correct speed and duplex.

Network Topology

Hints

•The interface is manually forced to 100 Mbps half duplex; check the duplex and speed configuration.
•Auto-negotiation requires both 'duplex' and 'speed' to be in default (no explicit command).
•CRC errors indicate a duplex mismatch; R2 is likely set to auto-negotiate.

A.Remove the manual speed and duplex settings on R1's GigabitEthernet0/0 with 'no speed' and 'no duplex' to allow auto-negotiation.

B.Change the duplex setting to 'full' and speed to '1000' on R1's GigabitEthernet0/0.

C.Replace the cable between R1 and R2 with a crossover cable.

D.Configure R2's GigabitEthernet0/0 with 'speed 100' and 'duplex half' to match R1's settings.

AnswerA

solution

! R1
enable
configure terminal
interface gigabitEthernet 0/0
no duplex
no speed
end
copy running-config startup-config

Why this answer

The interface was manually configured with 'duplex half' and 'speed 100', which forced the link to 100 Mbps half duplex, causing CRC errors due to duplex mismatch. The correct fix is to remove these manual settings and allow auto-negotiation, or explicitly set both sides to 'speed 1000' and 'duplex full'. Since the remote side (R2) is set to auto (default), the simplest correction is to use 'no duplex' and 'no speed' on R1 to re-enable auto-negotiation.

After the commands are applied, the interface should show 'Full-duplex, 1000Mb/s' and CRC errors should stop incrementing.

Exam trap

The exam trap is that candidates may think manually setting the correct speed and duplex is always the best approach, but they must consider the remote device's configuration. Auto-negotiation is the default and preferred method for Gigabit Ethernet; manual settings should be used consistently on both ends.

Why the other options are wrong

The specific factual error is that manually setting speed and duplex on one side while the other side is set to auto can lead to a mismatch; auto-negotiation is required for proper link establishment.

The specific factual error is that Auto-MDIX eliminates the need for crossover cables on modern interfaces; cable type is not the cause of the problem.

The specific factual error is that matching the incorrect settings does not achieve the desired speed and duplex; it only prevents errors at a lower performance level.

Practice this question →

129

Matchingmedium

Drag and drop the PDU names on the left to the correct OSI model layers on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Application Layer (Layer 7)

Transport Layer (Layer 4)

Network Layer (Layer 3)

Data Link Layer (Layer 2)

Physical Layer (Layer 1)

Why these pairings

In the OSI model, each layer processes a specific Protocol Data Unit (PDU). The Application layer (Layer 7) uses 'Message', the Transport layer (Layer 4) uses 'Segment', the Network layer (Layer 3) uses 'Packet', the Data Link layer (Layer 2) uses 'Frame', the Physical layer (Layer 1) uses 'Bit', and the Session layer (Layer 5) uses 'Data'. This pairing follows the correct OSI terminology as shown in Option A.

Exam trap

Be careful not to swap the PDU names for Transport (segment) and Network (packet). Also, remember that 'Message' is the Application layer PDU, not 'Data'.

Practice this question →

130

MCQhard

An engineer is deploying a new Cisco Catalyst 9300 switch in a campus wiring closet. The uplink to the distribution switch uses a 1000BASE-LX SFP module. After connecting the fiber, the interface shows 'up/up' but the engineer notices that the 'input errors' counter is incrementing rapidly, with many CRC errors, runts, and giants being reported. What is the most likely cause of these input errors?

A.Replace the SFP with a 1000BASE-SX module.

B.Check the fiber distance and ensure it is within the 5 km limit for 1000BASE-LX; if over, use a single-mode fiber extender.

C.Configure the interface with 'speed 100' and 'duplex full' to match the SFP capabilities.

D.Replace the fiber patch cable with a CAT6a copper cable and use a 1000BASE-T SFP.

AnswerB

1000BASE-LX SFP modules are rated for a maximum distance of 5km over single-mode fiber using 1310nm light. If the actual fiber distance exceeds this, the received optical signal power falls below the receiver sensitivity, producing bit errors and CRC errors on the interface. The correct action is to verify the link distance and either use a fiber extender/repeater or upgrade to a longer-reach optic such as 1000BASE-ZX (up to 70km) to regain a positive link budget.

Why this answer

The 1000BASE-LX standard uses long-wavelength laser optics (1300 nm) over single-mode fiber with a maximum distance of 5 km. Exceeding this limit causes signal attenuation and dispersion, generating bit errors that corrupt the frame check sequence (FCS). Cisco IOS counts these as CRC errors.

Runts (frames shorter than 64 bytes) and giants (frames longer than 1518 bytes) also appear because the damaged frames are misinterpreted. Option B correctly identifies the distance limit as the root cause and recommends verifying it or using a fiber extender. Options A and D propose incorrect media, and option C would break the link since 1000BASE-LX operates at fixed 1000/full speed.

Exam trap

Learners often misdiagnose runts and giants as a duplex mismatch, but when CRC errors are present alongside them, the issue is a physical-layer impairment—such as excessive fiber distance—rather than a configuration error.

Why the other options are wrong

1000BASE-SX uses multimode fiber with a maximum 550 m distance, which is far shorter than 1000BASE-LX and would not resolve a distance issue.

The SFP is fixed at 1000 Mbps full-duplex; manually setting 'speed 100' and 'duplex full' would cause a speed mismatch and prevent the link from coming up.

Copper cabling (CAT6a) and a 1000BASE-T SFP are limited to 100 m and cannot solve a fiber distance problem.

Practice this question →

131

MCQmedium

A network technician is troubleshooting a connectivity issue between two hosts on different subnets. During the analysis, the technician captures packets and observes that the data link layer frames are being stripped and rebuilt at each router hop. Which layer of the OSI model is responsible for encapsulating the original data into segments before transmission from the source host?

A.Network layer

B.Transport layer

C.Data Link layer

D.Application layer

AnswerB

The Transport layer is the exact location where upper-layer application data is broken into smaller units and a transport header is appended, producing TCP segments or UDP datagrams. It manages end-to-end communications, including flow control and reliability, using port numbers and, in TCP, sequence and acknowledgment numbers. This segmentation function is the defining responsibility of Layer 4.

Why this answer

The Transport layer (Layer 4) is responsible for encapsulating the original data into segments. Protocols such as TCP (RFC 793) or UDP (RFC 768) add a header containing source and destination port numbers, sequence numbers, and other control information to form a segment. This segmentation occurs at the source host before the data is passed down to the Network layer for routing.

Exam trap

Cisco often tests the distinction between encapsulation layers by describing a Layer 2 behavior (frame stripping/rebuilding) in the scenario to mislead candidates into selecting the Data Link layer, when the question specifically asks about the layer that creates segments at the source host.

Why the other options are wrong

The Network layer (Layer 3) encapsulates segments into packets and adds logical addressing (IP addresses) for routing across networks, but it does not perform the initial segmentation of data into segments.

The Data Link layer (Layer 2) encapsulates packets into frames and adds physical addressing (MAC addresses) for delivery on a local network segment, but it does not perform segmentation of data into segments.

The Application layer (Layer 7) provides the interface for applications to generate data, but it does not perform segmentation or encapsulation into segments. Segmentation occurs at the Transport layer.

Practice this question →

132

MCQeasy

Which OSI layer is responsible for end-to-end segmentation, port numbers, and reliability functions such as acknowledgments?

A.Network

B.Data Link

C.Transport

D.Session

AnswerC

At the transport layer, protocols such as TCP and UDP perform end-to-end segmentation, breaking application data into segments that can be reassembled at the destination. The transport header carries source and destination port numbers, which identify the specific application processes at each end of the communication session. TCP also adds reliability mechanisms like sequencing and acknowledgments, making it the definitive layer for this function.

Why this answer

The Transport layer (Layer 4) is responsible for end-to-end segmentation, port numbers for identifying applications, and reliability functions like acknowledgments and retransmission. The Network layer (Layer 3) handles logical addressing and routing between networks. The Data Link layer (Layer 2) manages local frame delivery and error detection.

The Session layer (Layer 5) controls dialog management and synchronization, not segmentation or ports.

Exam trap

Don't confuse the Transport Layer's end-to-end functions with the Network Layer's routing or the Data Link Layer's local communication roles.

Why the other options are wrong

The Network layer provides logical addressing and routing, not end-to-end segmentation or port numbers.

The Data Link layer handles local frame delivery and error detection, not end-to-end reliability or port numbers.

The Session layer manages dialog control and synchronization, not segmentation, port numbers, or reliability acknowledgments.

Practice this question →

133

MCQeasy

A network administrator is configuring a Cisco switch. The switch has a management VLAN 99 with IP address 10.10.99.5/24 and default gateway 10.10.99.1. The administrator wants to verify that the switch can reach a server at 10.10.99.100. Which command should be used on the switch to test reachability?

A.show ip route

B.show ip interface brief

C.traceroute 10.10.99.100

D.ping 10.10.99.100

AnswerD

The ping command on a Cisco switch sends ICMP echo requests to the specified IP address and reports replies, directly testing reachability. Since the switch has an IP address in the same subnet as the server, the ping will be sourced from VLAN 99 interface and should succeed if connectivity exists. This is the standard method to verify Layer 3 connectivity from a switch.

Why this answer

To verify reachability to a specific IP address from a Cisco switch, the ping command is the correct tool. It sends ICMP echo requests and waits for replies, providing immediate feedback on whether the destination is reachable. Other commands like show ip interface brief or show ip route only display configuration or routing information and do not test actual connectivity.

Exam trap

The trap here is confusing the display of routing or interface information with an active connectivity test.

Practice this question →

134

PBQhard

You are connected to R1. The network has R1, R2, and a multilayer switch MLS1. Configure IPv4 and IPv6 addressing on R1's interfaces so that R1 can ping both R2 (198.51.100.2) and MLS1 (203.0.113.2) via IPv4. Additionally, configure IPv6 on G0/1 using EUI-64 with prefix 2001:db8:1::/64 and verify that R1 can ping the IPv6 address of MLS1 (2001:db8:1::2). The current configuration has incorrect subnet masks and missing IPv6 settings, causing reachability failures.

Hints

•The subnet mask on both interfaces is too large; it should be /30.
•IPv6 is not enabled on G0/1 yet; use the 'ipv6 address' command with EUI-64.
•After changing the mask, the ping should work because the devices will be on the same subnet.

A.Change the subnet mask on G0/0 to 255.255.255.252, change G0/1 to 255.255.255.252, then configure IPv6 on G0/1 with the EUI-64 address using the prefix 2001:db8:1::/64.

B.Change the subnet mask on G0/0 to 255.255.255.0, change G0/1 to 255.255.255.0, then configure IPv6 on G0/1 with the EUI-64 address using the prefix 2001:db8:1::/64.

C.Change the subnet mask on G0/0 to 255.255.255.252, change G0/1 to 255.255.255.252, then configure IPv6 on G0/1 with the static address 2001:db8:1::1/64.

D.Change the subnet mask on G0/0 to 255.255.255.252, change G0/1 to 255.255.255.252, then configure IPv6 on G0/1 with the EUI-64 address using the prefix 2001:db8:1::/32.

AnswerA

solution

! R1
interface GigabitEthernet0/0
ip address 198.51.100.1 255.255.255.252
exit
interface GigabitEthernet0/1
ip address 203.0.113.1 255.255.255.252
ipv6 address 2001:db8:1::/64 eui-64
exit

Why this answer

The interfaces on R1 were configured with subnet masks that were not /30, which is required for these point-to-point links. With an incorrect mask, R1 does not consider the neighboring IPs (198.51.100.2 and 203.0.113.2) as directly connected, preventing ARP resolution and IPv4 reachability. Additionally, IPv6 was missing on G0/1.

To fix, change the subnet mask on G0/0 to 255.255.255.252, change G0/1 to 255.255.255.252, then configure IPv6 on G0/1 with the EUI-64 address using the prefix 2001:db8:1::/64. After these changes, pings succeed.

Exam trap

This question tests your understanding of subnet masks and their impact on Layer 3 reachability. A common trap is to focus only on IPv6 and forget that incorrect IPv4 subnet masks can prevent ARP resolution, even if IPv6 is configured correctly. Also, pay close attention to the exact requirements: EUI-64 and the correct prefix length.

Why the other options are wrong

The specific factual error is that /24 masks are too large for point-to-point links and do not match the expected subnets for R2 and MLS1.

The specific factual error is that the IPv6 address should be configured with the EUI-64 keyword, not a static address.

The specific factual error is that the prefix length must be /64 as specified in the question; a /32 prefix is incorrect for this scenario.

Practice this question →

135

MCQmedium

A switch port and a host NIC have a duplex mismatch. Which symptom is most likely?

A.Increased late collisions and poor performance

B.Incorrect VLAN tagging on trunks

C.OSPF area mismatch errors

D.A change in the subnet mask on the host

AnswerA

A duplex mismatch occurs when one side of an Ethernet link runs full-duplex while the other runs half-duplex. The half-duplex side fails to sense the full-duplex side's transmission, so both transmit simultaneously, producing late collisions after the 64-byte collision window. These late collisions corrupt frames, forcing retransmissions that degrade throughput, increase latency, and cause poor performance.

Why this answer

A duplex mismatch often causes collisions, frame errors, and degraded throughput, especially on the half-duplex side. It is a classic physical/link layer performance problem.

Exam trap

Don't confuse duplex mismatch symptoms with total connectivity loss or latency-only issues; focus on error and collision symptoms.

Why the other options are wrong

VLAN tagging on trunks is a Layer 2 function that deals with VLAN identification using 802.1Q tags. Duplex mismatch is a physical-layer issue affecting how data is sent and received (simultaneous vs. one direction at a time) and has no impact on VLAN tagging.

OSPF area mismatch errors are Layer 3 routing protocol issues that prevent OSPF neighbors from forming. Duplex mismatch is a Layer 1/2 problem that affects frame delivery and collision detection, not routing protocol adjacency.

A change in subnet mask is a Layer 3 IP configuration change that affects network/host identification. Duplex mismatch is a physical-layer issue and does not alter IP addressing or subnet masks.

Practice this question →

136

Multi-Selectmedium

Which TWO interface errors are most likely caused by a mismatch in duplex settings between two connected switches?

Select 2 answers

A.Runts

B.Giants

C.CRC errors

D.Input errors

E.Output errors

F.Flaps

AnswersA, C

Runts are Ethernet frames smaller than the minimum 64-byte size, and they are a classic symptom of duplex mismatch. When one end operates at half duplex and the other at full duplex, the half-duplex end may sense a collision (or late collision) and abort its transmission prematurely, leaving a truncated frame that the full-duplex receiver counts as a runt. Thus, a high rate of runts on an interface strongly suggests that the peer is running at a different duplex setting than the local switch port.

Why this answer

A duplex mismatch occurs when one switch operates at full duplex while the other operates at half duplex. On the half-duplex side, frames arriving while the interface is transmitting are considered collisions, causing the frame to be truncated into fragments (runts). On the full-duplex side, the switch does not detect collisions but may receive incomplete frames, which are counted as runts if they are less than 64 bytes.

CRC errors also spike because the truncated or corrupted frames fail the Frame Check Sequence (FCS) validation.

Exam trap

Cisco often tests the distinction between runts and giants, where candidates mistakenly think giants are caused by duplex mismatch, but giants are actually linked to jumbo frames or faulty hardware, not duplex negotiation issues.

Why the other options are wrong

Giants are frames exceeding the maximum size (typically 1518 bytes) and are caused by MTU misconfiguration, faulty NICs, or software errors, not by duplex mismatch. Duplex mismatch does not affect frame size; it causes collisions and CRC errors.

Input errors is a broad counter that includes runts, CRC errors, frame errors, and others. While duplex mismatch can contribute to some input errors, it is not a specific error type. The question asks for 'interface errors' most likely caused by duplex mismatch, and input errors is too generic.

Output errors include collisions, late collisions, and underruns. While collisions can occur due to duplex mismatch, output errors are not exclusively caused by duplex mismatch; they can result from other issues like cable faults or interface congestion. The question asks for errors 'most likely' caused by duplex mismatch, and runts and CRC errors are more directly linked.

Flaps refer to an interface repeatedly going up and down, typically due to physical layer issues like loose cables, faulty transceivers, or power fluctuations. Duplex mismatch does not cause interface flaps; it causes errors on the link but the interface remains up.

Practice this question →

137

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure a Cisco switch with an IPv4 management address 192.168.1.10/24, an IPv6 address 2001:db8:1::1/64, and a default gateway 192.168.1.1.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

6Step 6

7Step 7

Why this order

Correct order:

Enter global configuration mode – all subsequent configuration commands require this mode.

Enter interface configuration mode for VLAN 1 – the management SVI must be selected to apply IP settings.

Assign the IPv4 address 192.168.1.10 255.255.255.0 – sets the switch's management IPv4 address and subnet mask.

Enable the interface with the no shutdown command – activates the SVI so it can send and receive traffic.

Assign the IPv6 address 2001:db8:1::1/64 – enables IPv6 processing and statically configures a global unicast address.

Exit interface configuration mode to return to global configuration mode – required because the default gateway command is a global configuration command, not an interface subcommand.

Set the default gateway to 192.168.1.1 using the ip default-gateway command – provides the next-hop router for IPv4 traffic leaving the local subnet.

Practice this question →

138

MCQhard

A network engineer is configuring a Cisco router to provide DHCP services to a remote subnet. The router interface connected to that subnet is GigabitEthernet0/1 with IP address 192.168.20.1/24. The DHCP pool must exclude the first 10 addresses for static devices. Which configuration correctly sets up the DHCP pool?

A.ip dhcp pool LAN, network 192.168.20.0 255.255.255.0, default-router 192.168.20.1, exclude 192.168.20.1 192.168.20.10

B.ip dhcp pool LAN, network 192.168.20.0 255.255.255.0, default-router 192.168.20.1, ip dhcp excluded-address 192.168.20.1 192.168.20.10

C.ip dhcp excluded-address 192.168.20.1 192.168.20.10, then ip dhcp pool LAN, network 192.168.20.0 255.255.255.0, default-router 192.168.20.1

D.ip dhcp excluded-address 192.168.20.0 192.168.20.10, then ip dhcp pool LAN, network 192.168.20.0 255.255.255.0, default-router 192.168.20.1

AnswerC

The ip dhcp excluded-address command reserves the range 192.168.20.1 through 192.168.20.10 from being leased. The pool then defines the network 192.168.20.0/24 and the default gateway 192.168.20.1. This combination correctly provides DHCP service while protecting the first ten addresses for static assignment, matching the stated requirement.

Why this answer

DHCP exclusions are configured globally with ip dhcp excluded-address before defining the pool, and the pool itself specifies the network and default router. The correct sequence reserves 192.168.20.1 through 192.168.20.10, defines the 192.168.20.0/24 network, and sets the gateway. The other options misuse the exclude keyword, exclude the network address unnecessarily, or place a global command inside pool mode.

Exam trap

The trap here is placing the excluded-address command inside the DHCP pool, when it is actually a global configuration command.

Practice this question →

139

MCQhard

A user on VLAN 10 reports that they cannot ping the default gateway at 192.168.10.1 from their PC with IP 192.168.10.50/24. The switch interface connecting to the PC is up/up, and the PC shows a valid IP configuration. What is the most likely cause of this connectivity failure?

A.Change the switchport mode to trunk to allow VLAN 10 traffic.

B.Configure an SVI for VLAN 10 with an IP address in the 192.168.10.0/24 subnet.

C.Change the PC's IP address to a different subnet, such as 192.168.20.0/24.

D.Recreate VLAN 10 and reassign the port to it.

AnswerB

The switch must provide a Layer 3 interface in VLAN 10 to serve as the default gateway for PCs in the 192.168.10.0/24 subnet. An SVI (interface vlan 10) with an IP address from that subnet creates a routable interface on the multilayer switch. This allows hosts in VLAN 10 to send traffic to other subnets, as their default gateway points to that SVI. Without this SVI, the PC has no gateway to route its traffic beyond its local segment.

Why this answer

The PC and default gateway are on the same subnet (192.168.10.0/24), but the switch lacks a Layer 3 interface for VLAN 10. Without an SVI (Switch Virtual Interface) configured with an IP address in that subnet, the switch cannot route traffic to the gateway or respond to ARP requests from the PC, breaking connectivity even though the access port is up/up.

Exam trap

Cisco often tests the misconception that a VLAN alone provides Layer 3 connectivity, when in fact an SVI or a separate router-on-a-stick configuration is required for inter-VLAN routing and default gateway functionality.

Why the other options are wrong

A trunk port is used to carry multiple VLANs between switches, not to connect an end device like a PC. Configuring the switchport as trunk would break connectivity because the PC expects an access port.

Changing the PC's IP subnet would not resolve the issue because the PC would still need a default gateway on its new subnet. The root cause is the missing SVI on the switch, not the PC's IP address.

Recreating VLAN 10 and reassigning the port does not address the missing SVI. The VLAN already exists and the port is correctly assigned; the issue is at Layer 3, not Layer 2.

Practice this question →

140

MCQhard

A host is configured with IP address 192.168.50.94/27. Which subnet contains that host?

A.192.168.50.32/27

B.192.168.50.64/27

C.192.168.50.96/27

D.192.168.50.0/27

AnswerB

A /27 prefix length defines a subnet mask of 255.255.255.224, creating a block of 32 addresses. The host address 192.168.50.94 falls within the range 192.168.50.64–192.168.50.95, where 192.168.50.64 is the network address and 192.168.50.95 is the broadcast address. This satisfies the constraint that the host’s IP must lie between the subnet’s network and broadcast addresses.

Why this answer

A /27 subnet has a block size of 32. In simple terms, the fourth-octet ranges are 0–31, 32–63, 64–95, 96–127, and so on. Because 94 falls inside the 64–95 range, the network address for the host’s subnet is 192.168.50.64/27.

This kind of question tests whether you can move from prefix length to block size and then place the host inside the correct interval. The most common mistake is choosing a nearby boundary like 96 or 32 without calculating the actual block that contains the address.

Exam trap

Always calculate the subnet range using the block size derived from the prefix length to avoid choosing incorrect boundaries.

Why the other options are wrong

The subnet 192.168.50.32/27 covers addresses 192.168.50.32 to 192.168.50.63. The host address 192.168.50.94 is outside this range, so it does not belong to this subnet.

The subnet 192.168.50.96/27 covers addresses 192.168.50.96 to 192.168.50.127. The host address 192.168.50.94 is below this range, so it does not belong to this subnet.

The subnet 192.168.50.0/27 covers addresses 192.168.50.0 to 192.168.50.31. The host address 192.168.50.94 is far above this range, so it does not belong to this subnet.

Practice this question →

141

Multi-Selectmedium

Which TWO statements accurately describe characteristics of copper and fiber optic cabling used in modern Ethernet networks?

Select 2 answers

A.Copper UTP cables can reliably transmit data up to 500 meters without a repeater.

B.Fiber optic cables are immune to electromagnetic interference (EMI).

C.Multi-mode fiber typically uses laser-based transmitters for short-range communication.

D.Single-mode fiber is designed for long-distance transmission with a narrow core.

E.Fiber optic cabling is generally less expensive per meter than copper cabling.

AnswersB, D

Fiber optic cables transmit data as pulses of light through a glass or plastic core, so they are completely unaffected by electromagnetic interference, radio-frequency interference, or electrical crosstalk from nearby power cables and machinery. This immunity makes single-mode and multi-mode fiber the preferred medium in industrial environments, data centers, and other settings where electrical noise would corrupt copper signals.

Why this answer

Fiber optic cables transmit data as light pulses through glass or plastic cores, which are completely unaffected by electromagnetic interference (EMI), unlike copper cables that rely on electrical signals and are susceptible to EMI. Option D is correct because single-mode fiber uses a narrow core (typically 9 microns) and laser transmitters to support long-distance transmission (up to tens of kilometers) with low signal loss. Option A is wrong because copper UTP cables are limited to 100 meters without a repeater, not 500 meters.

Option C is wrong because multi-mode fiber typically uses LED or VCSEL transmitters for short-range communication, while laser-based transmitters are used with single-mode fiber. Option E is wrong because fiber optic cabling is generally more expensive per meter than copper cabling, though installation and equipment costs may differ.

Exam trap

Cisco often tests the distinction between multi-mode and single-mode fiber transmitters, where candidates mistakenly associate laser-based transmitters with multi-mode fiber instead of correctly identifying them with single-mode fiber's long-distance, narrow-core design.

Why the other options are wrong

Copper UTP cables have a maximum segment length of 100 meters for Ethernet, not 500 meters without a repeater.

Multi-mode fiber typically uses LED or VCSEL transmitters, not laser-based transmitters; lasers are used with single-mode fiber for long distances.

Fiber optic cabling is generally more expensive per meter than copper cabling, not less expensive.

Practice this question →

142

Drag & Dropmedium

Which of the following shows the correct order of steps to troubleshoot a suspected duplex mismatch and CRC errors on a Cisco IOS-XE interface?

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The proper troubleshooting flow requires moving through the correct configuration hierarchy: from privileged EXEC mode you first enter global configuration mode. Then you specify the affected interface to enter interface configuration mode, where the duplex and speed settings are applied. After making the changes, you exit all configuration modes back to privileged EXEC and use show commands to verify the interface status.

Option A follows this exact sequence. Option B is wrong because it tries to enter interface configuration without global config. Option C mistakenly attempts to set duplex/speed globally, which is not allowed.

Option D not only omits global config but also exits to the wrong mode, leaving you in global configuration instead of privileged EXEC for verification.

Exam trap

A common trap is to forget that you must enter global configuration mode before interface configuration mode. Another trap is to think that duplex and speed can be set globally, but they are interface-specific. Always remember the correct hierarchy: privileged EXEC -> global config -> interface config.

Practice this question →

143

MCQhard

An IPv6 host successfully reaches neighbors on its local segment, but it cannot reach remote IPv6 destinations. The host has a global unicast address and a correct prefix length. Which missing item is the strongest suspect?

A.A usable default router or next-hop route for off-link IPv6 traffic

B.A NAT rule translating IPv6 to IPv4

C.A VLAN trunk on the host NIC

D.A second global unicast address on the same interface

AnswerA

IPv6 hosts on a local segment can communicate with neighbors using Neighbor Discovery (ND) and link-local addresses, but any traffic destined beyond that segment must be forwarded by a router. Without a default router learned via ICMPv6 Router Advertisement or a manually configured static route, the host has no way to choose a next hop for off-link destinations. Thus the host would successfully reach on-link neighbors yet fail to reach anything outside the local segment.

Why this answer

The strongest suspect is the absence of a usable default router learned through IPv6 router advertisements or equivalent configuration. While local connectivity works because the host can communicate on its own link, remote IPv6 destinations require a next hop off the local segment. Option B is wrong because IPv6-to-IPv4 NAT is unnecessary for native IPv6 communication and would not be the primary cause of off-link failure.

Option C is wrong because a VLAN trunk on the host NIC is for carrying multiple VLANs, not for enabling off-link routing. Option D is wrong because a second global unicast address does not provide a default route; it only adds another local address.

Exam trap

Don't confuse local connectivity success with overall network configuration correctness. Always check for a default route when remote communication fails.

Why the other options are wrong

NAT rules are not required for native IPv6 communication and would not be the first suspect when a host cannot reach remote IPv6 destinations.

A VLAN trunk on the host NIC relates to Layer 2 segmentation, not to providing a default route for off-link IPv6 traffic.

A second global unicast address on the same interface does not supply the missing default route needed to reach off-link destinations.

Practice this question →

144

PBQhard

You are connected to the Cisco WLC (WLC-1) via its management IP 192.168.1.10. The wireless network 'CorpNet' is configured but clients cannot associate. Troubleshoot and resolve the issue: clients report 'Association failed' and the SSID is not visible in site surveys. Ensure that after your fix, the SSID is broadcast, WPA3 is used, and the WLAN is mapped to VLAN 20. Also, verify the WLC management interface is accessible over HTTPS.

Network Topology

Hints

•Check if the WLAN is enabled and broadcasting the SSID.
•Verify that the WLAN is mapped to a user VLAN, not the management interface.
•Ensure HTTPS is enabled for web management access.

A.Enable the WLAN, set Broadcast SSID to Enabled, create a dynamic interface for VLAN 20 and map the WLAN to it, and enable the HTTPS server.

B.Enable the WLAN, set Broadcast SSID to Enabled, change the interface to the management interface, and enable the HTTPS server.

C.Enable the WLAN, keep Broadcast SSID Disabled for security, create a dynamic interface for VLAN 20 and map the WLAN to it, and enable the HTTPS server.

D.Enable the WLAN, set Broadcast SSID to Enabled, create a dynamic interface for VLAN 20 and map the WLAN to it, but leave HTTPS disabled for security.

AnswerA

solution

! WLC-1
config wlan 1 enable
config wlan 1 broadcast-ssid enable
config wlan 1 interface vlan20
config interface create vlan20 20
config interface address vlan20 192.168.20.1 255.255.255.0
config wlan 1 interface vlan20
ip http secure-server

Why this answer

The WLAN was disabled, the SSID was hidden (Broadcast SSID Disabled), and it was incorrectly mapped to the management interface instead of a user VLAN. Additionally, HTTPS access was disabled. The solution: enable the WLAN, enable SSID broadcast, change the interface to a VLAN 20 interface (e.g., create a dynamic interface 'vlan20' with VLAN 20), and enable the HTTPS server for management access.

Note: On an AireOS WLC, the correct commands use `config wlan enable <wlan_id>`, `config wlan broadcast-ssid enable <wlan_id>`, and `config network secureweb enable` for HTTPS.

Exam trap

This question tests your ability to identify multiple misconfigurations simultaneously. Common traps: confusing management interface with user VLANs, thinking hidden SSID is acceptable when broadcast is required, and overlooking the HTTPS requirement. Also, ensure you use AireOS-specific commands, not IOS commands like `ip http secure-server`.

Always verify all requirements in the question.

Why the other options are wrong

The specific factual error: The management interface is for WLC management traffic, not client data. Client traffic should be on a separate user VLAN.

The specific factual error: Broadcast SSID must be enabled for the SSID to be visible. Disabling it hides the SSID, which contradicts the requirement to make it visible.

The specific factual error: HTTPS must be enabled for management access. Disabling it would block HTTPS connections to the WLC.

Practice this question →

145

Multi-Selectmedium

Which TWO statements correctly describe the configuration and verification of IPv4 and IPv6 parameters for host connectivity, including default gateway, DNS, and subnet masks?

Select 2 answers

A.The subnet mask determines the DNS server address used by the host.

B.The default gateway must be on the same subnet as the host's IP address.

C.IPv6 hosts can only obtain their IP address via DHCPv6.

D.The command 'ipconfig /all' displays both IPv4 and IPv6 configuration details.

E.A host can reach any remote network if its default gateway is configured with any IP address.

AnswersB, D

For a host to deliver a frame to the default gateway, the gateway's IP must be in the same network/subnet as the host's interface, because the host uses ARP (or NDP for IPv6) to resolve the gateway's MAC address on the local link. If the gateway were on a different subnet, the host would not be able to reach it without another router on the local segment.

Why this answer

A host's default gateway must be on the same subnet to be reachable at Layer 2; otherwise, a circular dependency occurs. Option D is correct because the 'ipconfig /all' command displays both IPv4 and IPv6 configuration details, including IP address, subnet mask, default gateway, and DNS servers. Option A is wrong because the subnet mask determines the network and host portions of an IP address, not the DNS server address.

Option C is wrong because IPv6 hosts can obtain their IP address via SLAAC, DHCPv6, or static configuration; the phrase 'can only' makes it incorrect. Option E is wrong because the default gateway must be reachable (on the same subnet) and configured with an IP address that belongs to a router interface on that subnet, not just any IP address.

Exam trap

Cisco often tests the misconception that IPv6 hosts require DHCPv6 for address assignment, when in fact SLAAC is a common and valid method, and the question's wording 'can only' is the trap that eliminates Option C.

Why the other options are wrong

The subnet mask is used to determine the network portion of an IP address and the host portion, not the DNS server address. DNS server addresses are configured separately, either manually or via DHCP.

IPv6 hosts can obtain their IP address via Stateless Address Autoconfiguration (SLAAC), which does not require DHCPv6. DHCPv6 is optional and used for stateful configuration or to provide additional parameters.

The default gateway must be on the same subnet as the host's IP address; otherwise, the host cannot send Ethernet frames to it because the gateway's MAC address would not be reachable via ARP. An arbitrary IP address would not work.

Practice this question →

146

Multi-Selectmedium

Which TWO statements correctly describe the configuration and verification of IPv4 and IPv6 parameters for host connectivity?

Select 2 answers

A.On a Windows host, the default gateway IPv4 address must be on the same subnet as the host's IPv4 address.

B.The IPv6 default gateway can be any global unicast address on the internet.

C.The subnet mask is used to define the host portion of an IPv4 address.

D.A DNS server address can be statically configured on a host or obtained dynamically via DHCP.

E.Configuring a DNS server is mandatory for a host to communicate with any other device on the same subnet.

AnswersA, D

On a Windows host, and on any IPv4 host, the default gateway address must reside on the same subnet as the host's own IPv4 address because the host must deliver Ethernet frames directly to the gateway using its MAC address, obtained via ARP. If the gateway were on a different subnet, the host would need to use another router to reach it, which contradicts the purpose of the default gateway as the immediate next hop. The host validates this by applying its own subnet mask to the gateway address and will reject it if it ends up in a different network.

Why this answer

For a host to reach outside its subnet, the default gateway's IP must be in the same subnet; otherwise the host cannot ARP for the gateway's MAC and traffic will fail. Option D is correct because DNS server addresses can be set manually or assigned via DHCP. Option B is wrong because IPv6 gateways must be on the same local link, not any global unicast address on the internet.

Option C is wrong because the subnet mask defines the network/subnet portion of an IPv4 address, not the host portion. Option E is wrong because DNS is used for name resolution; local IP communication on the same subnet works without DNS.

Exam trap

Cisco often tests the misconception that a default gateway can be any routable address, but the trap here is that both IPv4 and IPv6 default gateways must be on the same local subnet as the host for Layer 2 reachability.

Why the other options are wrong

An IPv6 default gateway must be on the same local link, not just any globally routable address.

The subnet mask identifies the network bits, not the host bits; the host portion is the inverse of the mask.

DNS resolves names to IPs; hosts on the same subnet can communicate with IP addressing alone, making DNS optional.

Practice this question →

147

MCQhard

A host address is 172.16.8.70/26. What is the network address of its subnet?

A.172.16.8.0

B.172.16.8.64

C.172.16.8.70

D.172.16.8.128

AnswerB

For a /26 prefix, the subnet mask is 255.255.255.192, which creates block sizes of 64 addresses in the fourth octet. The host address .70 lies in the range 64–127, so the network address is found by zeroing the host bits: 70 AND 192 = 64. Thus, 172.16.8.64 is the correct network address for this host.

Why this answer

A /26 uses blocks of 64 addresses. In plain language, the fourth-octet subnet ranges are 0–63, 64–127, 128–191, and 192–255. Since the host address ends in 70, it belongs to the 64–127 block. That means the network address of the subnet is 172.16.8.64.

This is a standard subnetting calculation. The key is to identify the correct block based on the prefix and then choose the first address in that block as the network address.

Exam trap

A frequent exam trap is mistaking the host IP address for the network address or selecting the wrong subnet block based on the subnet mask. Candidates often pick 172.16.8.0 because it looks like a common network address or 172.16.8.128 assuming it’s the next block, but these do not contain the host 172.16.8.70 under a /26 mask. The trap arises from not calculating subnet ranges correctly or misunderstanding how subnet masks segment the address space into fixed blocks.

This mistake leads to incorrect subnet identification and can cause routing or addressing errors in real networks.

Why the other options are wrong

172.16.8.0 is incorrect because the /26 subnet blocks cover 0–63, 64–127, etc., and the host address 70 does not fall within the 0–63 range. Selecting this ignores the actual subnet boundaries defined by the mask.

172.16.8.70 is incorrect because this is the host address itself, not the network address. The network address must be the first address in the subnet block, not a host address within it.

172.16.8.128 is incorrect because this subnet block starts at 128, which is above the host address 70. The host does not belong to this subnet, so this cannot be the network address.

Practice this question →

148

MCQmedium

Which rule does a router apply first when selecting a route for a destination packet?

A.Lowest metric across all protocols

B.Oldest route in the routing table

C.Longest prefix match

D.Default route if one exists

AnswerC

A router's IP forwarding logic first identifies all routes whose prefix matches the destination address's network portion. It then selects the route with the longest subnet mask because that prefix is the most specific representation of the destination, even if that route has a higher metric. This rule is non-negotiable and precedes any metric or administrative-distance comparison.

Why this answer

Routers first look for the most specific matching prefix. Administrative distance and metrics matter when competing routes exist for the same destination prefix length.

Exam trap

Remember, prefix length is the primary factor in route selection, not administrative distance or metrics.

Why the other options are wrong

The router first uses the longest prefix match to select a route; metrics are only compared among routes from the same routing protocol or when administrative distance is equal. Comparing metrics across different protocols is not the first step.

Route age is not a primary selection criterion; routers use longest prefix match first, then administrative distance, then metric. Older routes are not preferred over newer ones in the selection process.

A default route is only used when no other route matches the destination; the router first checks for more specific matches using the longest prefix match. The default route is the least preferred.

Practice this question →

149

Multi-Selectmedium

Which single OSI model layer is responsible for both end‑to‑end reliable data delivery and segmenting data into smaller units?

Select 1 answer

A.Transport layer (Layer 4)

B.Data Link layer (Layer 2)

C.Network layer (Layer 3)

D.Session layer (Layer 5)

E.Transport layer (Layer 4) and Network layer (Layer 3)

AnswersA

The Transport layer (Layer 4) is correct: it accepts data from the Session layer, divides it into segments, and is responsible for end-to-end delivery. TCP, a Transport layer protocol, provides reliable delivery via sequence numbers, acknowledgments, timeouts, and retransmissions, while UDP is a simpler, unreliable transport alternative. This layer is uniquely positioned to ensure that the entire message arrives intact and in order across the network.

Why this answer

The Transport layer (Layer 4) is the only OSI layer responsible for both end‑to‑end reliable data delivery (via protocols like TCP) and segmenting data into smaller units (segments). The Network layer (Layer 3) handles routing and packetizing but does not provide reliability. Therefore, only the Transport layer fulfills both requirements.

Exam trap

Candidates may think the Network layer also performs both functions because it segments data into packets and provides end‑to‑end delivery, but reliability is strictly a Transport layer function. The question asks for a single layer, so combining Transport and Network is incorrect.

Why the other options are wrong

The Data Link layer handles framing and error detection on a single link, not end‑to‑end reliability or segmentation across the entire network.

The Network layer provides routing and logical addressing but does not guarantee delivery or perform segmentation of data from applications.

The Session layer manages dialog control between applications, not data segmentation or reliable transport mechanisms.

Practice this question →

150

MCQmedium

Exhibit: A laptop has IP address 10.20.30.44/27. Which address is its directed broadcast for that subnet?

A.10.20.30.31

B.10.20.30.32

C.10.20.30.63

D.10.20.30.64

AnswerC

With a /27 prefix, the subnet block size is 32 addresses. The host address 10.20.30.44 falls inside 10.20.30.32/27, whose range extends from .32 through .63. The directed broadcast address is the final address in that range, 10.20.30.63, with all five host bits set to 1. It is valid only as a broadcast target and cannot be assigned to an interface.

Why this answer

A /27 gives a block size of 32 addresses. The host 10.20.30.44 falls in the 10.20.30.32 to 10.20.30.63 subnet, so the broadcast address is 10.20.30.63.

Exam trap

Avoid confusing the network address or a host address with the broadcast address. Remember, the broadcast address is the last address in the subnet.

Why the other options are wrong

10.20.30.31 is the broadcast address of the previous /27 subnet (10.20.30.0/27), not the subnet containing 10.20.30.44. The host 10.20.30.44 belongs to the 10.20.30.32/27 subnet, so its broadcast is 10.20.30.63.

10.20.30.32 is the network address (subnet ID) of the subnet 10.20.30.32/27, not the broadcast address. The network address is the first address in the subnet and is used to identify the subnet itself.

10.20.30.64 is the network address of the next /27 subnet (10.20.30.64/27), not the broadcast of the current subnet. The broadcast address for 10.20.30.32/27 is 10.20.30.63.

Practice this question →