CCNA Network Infrastructure and Connectivity Questions — Page 3 of 4

151

MCQhard

A host is configured as 192.168.50.130/25. Which address is the broadcast address for its subnet?

A.192.168.50.127

B.192.168.50.128

C.192.168.50.255

D.192.168.50.254

AnswerC

With a /25 prefix, the subnet mask is 255.255.255.128, which splits the 192.168.50.0/24 network into two 128-address blocks. The address 192.168.50.130 falls into the upper block, 192.168.50.128/25, which spans .128 through .255. The broadcast address is the last address in that block, .255, where all seven host bits are set to 1.

Why this answer

A /25 divides the /24 into two blocks: 0–127 and 128–255. In plain language, because the host ends in 130, it belongs to the upper half, which starts at 128 and ends at 255. The last address in that block is the broadcast address, so the broadcast is 192.168.50.255.

This is a classic subnetting pattern because it tests whether you can identify not just the subnet, but also the reserved last address in that subnet.

Exam trap

A frequent exam trap is mistaking the network address or a high usable host address for the broadcast address. Candidates often select 192.168.50.128, confusing it as the broadcast because it is the start of the upper subnet, or 192.168.50.254, assuming it is the broadcast since it is near the subnet's end. The trap lies in not recognizing that the broadcast address is always the highest address in the subnet, which in this case is 192.168.50.255.

Misidentifying these addresses leads to incorrect subnet calculations and can cause network communication failures in real scenarios.

Why the other options are wrong

192.168.50.127 is the broadcast address for the lower /25 subnet (192.168.50.0/25), not the subnet containing 192.168.50.130. Since the host IP is in the upper subnet, this option is incorrect.

192.168.50.128 is the network address of the upper /25 subnet (192.168.50.128/25), not the broadcast address. Network addresses cannot be assigned to hosts or used as broadcast addresses, so this option is incorrect.

192.168.50.254 is a valid usable host address within the upper /25 subnet. It is not the broadcast address, so this option is incorrect.

Practice this question →

152

PBQmedium

You are connected to the console of R1. The output of 'show interfaces serial0/0/0' displays that the interface is administratively down (status: administratively down, line protocol is down). The network administrator reports that the serial link between R1 and R2 was recently configured but is not working. You need to troubleshoot and restore connectivity. The serial interface on R1 is Serial0/0/0, and the link is a point-to-point HDLC connection.

Network Topology

Hints

•Check the interface status with show interfaces.
•Look for 'administratively down' in the output.
•Use the no shutdown command to enable the interface.

A.Enter interface configuration mode for Serial0/0/0 and issue the 'no shutdown' command.

B.Enter global configuration mode and issue the 'clock rate 64000' command.

C.Enter interface configuration mode for Serial0/0/0 and issue the 'encapsulation ppp' command.

D.Enter privileged EXEC mode and issue the 'clear interface serial0/0/0' command.

AnswerA

solution

! R1
interface Serial0/0/0
no shutdown

Why this answer

The interface status 'administratively down' indicates the interface has been manually shut down with the 'shutdown' command. Issuing 'no shutdown' in interface configuration mode re-enables it, bringing the line protocol up and restoring connectivity. Option B is incorrect because clock rate configuration is necessary only if R1 is the DCE and clocking is missing; the issue here is the administrative state, not clocking.

Option C is incorrect because changing the encapsulation to PPP would not resolve an administratively down state and could create a mismatch. Option D is wrong because 'clear interface' only resets counters and does not change the interface's administrative status.

Exam trap

The trap is that candidates may overlook the 'administratively down' status and instead focus on clocking or encapsulation issues. Always check the interface status first; if it says 'administratively down', the fix is 'no shutdown'.

Why the other options are wrong

The specific factual error: The 'clock rate' command configures the clocking rate on a DCE serial interface, not the administrative state.

The specific factual error: The encapsulation command changes the Layer 2 protocol but does not affect the administrative state of the interface.

The specific factual error: The 'clear interface' command does not enable an administratively down interface; it only resets statistics.

153

MCQhard

Refer to the exhibit. A network engineer is troubleshooting a connectivity issue between two routers connected via a serial link. The engineer runs the show interfaces Serial0/0/0 command on R1. Based on the output, what is the most likely cause of the problem?

A.The interface is configured with the wrong encapsulation type.

B.The interface is administratively shut down.

C.The serial cable is disconnected or has a physical fault.

D.The DCE end of the serial link is missing a clock rate configuration.

AnswerD

The output explicitly states 'DCE, no clock rate set'. On a serial WAN link, the data communications equipment (DCE) must supply the clock signal. Without the clock rate command, the line protocol cannot come up, regardless of all other settings being correct.

Why this answer

The output shows that the interface is up (line protocol is down), and the serial cable is physically connected. The absence of a clock rate on the DCE end of a serial link causes the line protocol to remain down because the receiving router cannot synchronize bit timing. Option D is correct because the DCE device must provide a clock signal for the serial link to establish Layer 2 connectivity.

Exam trap

Cisco often tests the distinction between 'interface is up, line protocol is down' (Layer 1 up, Layer 2 down) and 'interface is down, line protocol is down' (Layer 1 fault), tricking candidates into thinking a physical cable issue is the cause when the real problem is a missing clock rate on the DCE.

Why the other options are wrong

Many candidates assume that a Layer 2 protocol down on a serial link is always caused by an encapsulation mismatch, overlooking the explicit clocking issue displayed in the output.

Novice engineers might misinterpret 'line protocol is down' as an indication that the interface is disabled, without reading the full status line.

The trap: candidates see 'line protocol is down' and immediately think of a physical problem, missing the clear distinction that the interface itself is 'up'.

Practice this question →

154

Drag & Dropmedium

Drag and drop the following steps into the correct order to enable a third-party SFP transceiver and verify its diagnostics on a Cisco switch.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Cisco switches by default only support Cisco-branded SFP transceivers. To use a third-party transceiver, the command `service unsupported-transceiver` must be enabled in global configuration mode. After configuring the interface, the `show interfaces transceiver` command displays diagnostic information including temperature, voltage, and optical power, which helps verify proper operation.

Practice this question →

155

MCQhard

A host address is 192.168.88.66/27. Which address is the network address of the subnet?

A.192.168.88.32

B.192.168.88.64

C.192.168.88.95

D.192.168.88.96

AnswerB

The /27 mask creates 32-address subnets, and the range from .64 to .95 is one such subnet. Host .66 is within this range, so the network address is the first address of the block, 192.168.88.64. All hosts in this subnet share the same network bits, and .64 is the all-zero host portion for that range.

Why this answer

A /27 subnet has a block size of 32. In practical terms, the fourth-octet ranges are 0-31, 32-63, 64-95, and so on. Because 66 falls within the 64-95 block, the network address is 192.168.88.64.

This is a classic subnet-boundary calculation. The key step is identifying the correct block first.

Exam trap

Avoid assuming the host address is in the first or last subnet without calculating the correct range.

Why the other options are wrong

192.168.88.32 is the network address of the previous /27 subnet (32-63). Since the host address 192.168.88.66 falls in the 64-95 range, the correct network address is 192.168.88.64, not 192.168.88.32.

192.168.88.95 is the broadcast address for the /27 subnet that starts at 192.168.88.64. The broadcast address is the last address in the subnet, used to send packets to all hosts in that subnet, not the network address.

192.168.88.96 is the network address of the next /27 subnet (96-127). The host 192.168.88.66 is not in that range; it belongs to the subnet starting at 192.168.88.64.

Practice this question →

156

Drag & Dropmedium

Drag and drop the following steps into the correct order to troubleshoot a suspected duplex mismatch and CRC errors on a Cisco switch interface.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct troubleshooting sequence starts with entering privileged EXEC mode (step A) because 'show' and 'configure' commands require it. Next, use the 'show interfaces' command (step B) to check for CRC errors and duplex mismatch on the interface. Then, enter global configuration mode (step D) to access interface configuration.

Finally, configure the interface with the 'duplex full' command (step C) to fix the mismatch. Placing step C before step D would be invalid because you must be in global configuration mode before you can configure an interface.

Exam trap

The exam trap is that candidates often skip the initial step of entering privileged EXEC mode, thinking they can directly check errors or configure. Remember that 'show' and 'configure' commands require the appropriate mode.

Practice this question →

157

MCQmedium

Why does traceroute reveal each router hop along a path?

A.Each router appends its hostname to the packet payload

B.Each router sends an ARP response back to the source

C.Each router decrements TTL or hop limit, and expired packets trigger ICMP messages

D.Each switch on the path sends a syslog message to the source host

AnswerC

Traceroute sends packets with an incrementing IP time-to-live (TTL or IPv6 hop limit), starting at 1. Each router along the path decrements this value; when it reaches 0, the router discards the packet and sends an ICMP Time Exceeded message back to the source. That ICMP message carries the router's IP address in its source field, which reveals each hop in sequence as the TTL is increased.

Why this answer

Traceroute sends packets with increasing TTL or hop-limit values. When the value expires, the router that drops the packet returns an ICMP message, identifying that hop.

Exam trap

Don't confuse traceroute's use of TTL and ICMP Time Exceeded messages with ping's use of ICMP Echo Requests.

Why the other options are wrong

Routers do not modify packet payloads to add hostnames during normal forwarding. Traceroute relies on ICMP Time Exceeded messages generated by routers when TTL expires, not on payload modifications. Adding hostnames would violate IP packet integrity and is not a standard function.

ARP (Address Resolution Protocol) operates only within a local network segment to map IP addresses to MAC addresses. It is not used for path discovery across multiple routed hops. Traceroute uses TTL expiry to trigger ICMP responses, not ARP replies.

Switches operate at Layer 2 and do not decrement TTL or generate ICMP Time Exceeded messages for traceroute. Syslog is a logging protocol used for network device event reporting, not for hop-by-hop path discovery. Traceroute relies on ICMP or UDP/TCP probes, not syslog messages.

Practice this question →

158

Drag & Dropmedium

Drag and drop the following steps into the correct order to troubleshoot a client PC that cannot connect to a remote web server.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

6Step 6

Why this order

The correct order follows Cisco's bottom-up troubleshooting methodology: first verify local IP configuration with ipconfig, then confirm the local TCP/IP stack with a loopback ping, then verify the NIC and IP binding by pinging the assigned address. Next, test connectivity to the default gateway to ensure the local subnet and router are reachable. After that, attempt to reach the remote server's IP address with ping.

If that fails, use traceroute to identify where along the path the packets are lost. This sequence efficiently isolates the fault domain from the local device to the internetwork.

Practice this question →

159

Matchingmedium

Match the security feature to its main purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Filters traffic based on defined permit and deny rules

Helps block rogue DHCP servers and build trusted binding information

Validates ARP traffic against trusted information to reduce ARP spoofing

Limits and controls MAC addresses learned on a switch port

Why these pairings

ACLs are correct because they use permit and deny statements to filter traffic based on source/destination IP, protocol, or port. DHCP Snooping is correct because it identifies trusted ports and builds a DHCP binding table to block rogue DHCP servers and prevent spoofed DHCP messages. DAI is correct because it leverages the DHCP Snooping binding table to validate ARP packets, dropping those that do not match trusted bindings and thus preventing ARP spoofing attacks.

Port Security is correct because it restricts the number and specific MAC addresses learned on a switch port, mitigating MAC flooding and unauthorized device access.

Exam trap

Avoid confusing the general term 'security' with specific functions. Firewalls filter traffic; they do not encrypt, detect endpoint malware, or provide centralized log analysis. Each security tool has a defined purpose.

Practice this question →

160

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure a Windows 10 host with a static IPv4 address, subnet mask, and default gateway.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

6Step 6

Why this order

The correct order begins with opening Network and Sharing Center to access network settings. Then, you must click 'Change adapter settings' to see the list of network connections. Right-clicking the appropriate adapter and selecting Properties opens its configuration.

Selecting IPv4 and clicking Properties allows you to set the IP parameters. Choosing 'Use the following IP address' enables the fields for static input. Finally, entering the IP address, subnet mask, and default gateway followed by OK/Close applies the configuration.

This sequence follows the logical navigation of the Windows GUI to reach the static IP assignment interface.

Practice this question →

161

PBQhard

You are connected to R1. The network administrator reports that hosts on VLAN 10 cannot communicate with the server attached to R2's GigabitEthernet0/1 interface. Troubleshoot and resolve the issue. Identify the root cause and apply the necessary fix on R1.

Network Topology

Hints

•The high input error count on G0/0 suggests a Layer 1 issue, possibly duplex mismatch.
•Compare the configured duplex on R1's G0/0 with the typical auto-negotiation settings on a switch.
•Reverting to auto-negotiation on both speed and duplex is often the solution for such mismatches.

A.Configure 'no duplex' and 'no speed' under interface GigabitEthernet0/0 to enable auto-negotiation.

B.Change the duplex setting on GigabitEthernet0/0 to half-duplex using 'duplex half'.

C.Apply 'speed 100' and 'duplex full' on GigabitEthernet0/0 to match a common switch configuration.

D.Clear the interface counters on GigabitEthernet0/0 with 'clear counters gigabitethernet0/0' without changing any configuration.

AnswerA

solution

! R1
configure terminal
interface GigabitEthernet0/0
no duplex
no speed
end
clear counters GigabitEthernet0/0

Why this answer

The issue is a duplex mismatch on GigabitEthernet0/0. R1 is configured with 'duplex full' and 'speed 1000', but the connected switch port is likely set to auto-negotiate or is set to half-duplex. This causes high input errors (1500) and degraded performance.

The fix is to set R1's G0/0 to auto-negotiate both speed and duplex, matching the switch's configuration. Enter interface configuration mode for G0/0, issue 'no duplex' and 'no speed' to revert to auto, then clear the interface counters with 'clear counters gigabitethernet0/0'.

Exam trap

The exam trap is that candidates often focus on speed mismatches or clearing counters, but the real issue is duplex mismatch. Remember that on GigabitEthernet interfaces, auto-negotiation is the default and recommended setting; static duplex/speed settings can cause mismatches and errors.

Why the other options are wrong

The specific factual error is that manually setting half-duplex does not resolve a mismatch; it may create a new mismatch or degrade performance further.

The specific factual error is that GigabitEthernet interfaces usually operate at 1000 Mbps; setting speed to 100 may cause the interface to not come up or to underperform.

The specific factual error is that clearing counters is a diagnostic step, not a fix. The root cause (duplex mismatch) remains unaddressed.

Practice this question →

162

Multi-Selectmedium

Which three of the following are characteristics of wireless LAN (WLAN) operation in the 2.4 GHz and 5 GHz bands? (Choose three.)

Select 3 answers

.The 5 GHz band offers more non-overlapping channels than the 2.4 GHz band.

.The 2.4 GHz band generally provides longer range than 5 GHz for the same transmit power.

.Both bands can be used simultaneously by dual-band access points.

.The 2.4 GHz band supports higher data rates than the 5 GHz band.

.The 5 GHz band experiences more interference from Bluetooth devices.

.Both bands require a license for operation in enterprise environments.

Why this answer

The 5 GHz band offers more non-overlapping channels (up to 23 or 25, depending on regulatory domain) compared to the 2.4 GHz band, which has only three non-overlapping channels (1, 6, 11). The 2.4 GHz band generally provides longer range due to better propagation characteristics and lower attenuation through obstacles. Dual-band access points can operate simultaneously on both bands, allowing clients to connect on either frequency.

Exam trap

Cisco often tests the misconception that the 2.4 GHz band has more channels or that 5 GHz always provides longer range, but the correct understanding is that 5 GHz has more non-overlapping channels and 2.4 GHz offers better range due to lower frequency propagation.

Practice this question →

163

Multi-Selectmedium

Which TWO statements accurately describe the characteristics and deployment considerations for fiber optic cabling in a modern enterprise network?

Select 2 answers

A.Single-mode fiber (SMF) typically uses a larger core diameter than multimode fiber (MMF).

B.Multimode fiber (MMF) is generally preferred for longer-distance links, such as between buildings on a campus network.

C.A 1000BASE-LX SFP transceiver operating over single-mode fiber can support distances up to 10 km.

D.When using a 10GBASE-SR SFP+ transceiver over OM3 multimode fiber, the maximum supported distance is 300 meters.

E.Fiber optic cabling is immune to electromagnetic interference (EMI), making it ideal for environments with high electrical noise.

AnswersD, E

Under IEEE 802.3ae, a 10GBASE-SR SFP+ transceiver operating over OM3 multimode fiber supports a maximum link length of 300 meters. OM3 is a laser-optimized 50/125 µm fiber with an effective modal bandwidth of 2000 MHz·km at 850 nm, which is the wavelength used by the short-range VCSEL optic in 10GBASE-SR. This 300-meter limit specifically applies to OM3; OM4 raises the distance to 400 meters, while OM2 supports only about 82 meters at 10 Gbps.

Why this answer

The correct statements are that 10GBASE-SR over OM3 multimode fiber supports up to 300 meters and that fiber optic cabling is immune to electromagnetic interference (EMI), making it ideal for electrically noisy environments. Single-mode fiber actually has a smaller core diameter than multimode, making option A incorrect. Multimode fiber is designed for shorter links, so option B is wrong.

Standard 1000BASE-LX SFP transceivers over single-mode fiber are limited to 5 km, not 10 km, so option C is inaccurate.

Exam trap

Cisco often tests the misconception that single-mode fiber has a larger core diameter than multimode fiber, when in fact the opposite is true, and that multimode fiber is suitable for long-haul links, whereas it is actually limited to shorter distances due to modal dispersion.

Why the other options are wrong

Single-mode fiber has a smaller core diameter (typically 9 microns) than multimode (50 or 62.5 microns), so this reverses the relationship.

Multimode fiber’s larger core introduces modal dispersion, limiting it to shorter distances; long-distance links use single-mode fiber.

IEEE 1000BASE-LX specifies a maximum distance of 5 km over single-mode fiber; 10 km is beyond the standard CCNA curriculum.

Practice this question →

164

MCQhard

A host address is 192.168.1.14/29. Which address is the broadcast address for that host’s subnet?

A.192.168.1.7

B.192.168.1.14

C.192.168.1.15

D.192.168.1.16

AnswerC

A /29 prefix (255.255.255.248) creates subnets with 8 addresses each. The host 192.168.1.14 falls in the subnet from 192.168.1.8 to 192.168.1.15, where the first address is the network ID and the last is the directed broadcast. Therefore, 192.168.1.15 is the broadcast address for this subnet, and .14 is the last usable host address.

Why this answer

A /29 uses blocks of 8 addresses. In plain language, the subnets in the last octet move in increments of 8: 0–7, 8–15, 16–23, and so on. Since the host address ends in 14, it belongs to the 8–15 block. In that block, the last address is the broadcast address, so the broadcast is 192.168.1.15.

This is a classic subnetting pattern because it requires you to place the host inside the correct block and then identify the last address in that block rather than guessing based on the host value itself.

Exam trap

Be careful not to confuse the network address or the next subnet's network address with the broadcast address.

Why the other options are wrong

192.168.1.7 is the broadcast address for the /29 block 0–7, which does not contain host .14. The host .14 is in the block 8–15, so its broadcast is .15.

192.168.1.14 is the host address itself, not the broadcast address. The broadcast address is always the last address in the subnet, which is .15 for the block 8–15.

192.168.1.16 is the network address of the next /29 block (16–23), not the broadcast address for the block containing .14. The broadcast address must be the last address in the same block as the host.

Practice this question →

165

PBQhard

You are troubleshooting a wireless client association failure on a Cisco WLC. The client is unable to connect to the corporate SSID 'CorpNet' and reports an authentication error. Review the WLC configuration and fix the issue so that the client can associate and obtain an IP address from VLAN 100. The WLC management IP is 192.168.1.10/24.

Hints

•Check the security settings — the client may not support WPA3.
•Verify if the SSID is hidden — the client cannot scan for it.
•Ensure the VLAN assigned to the WLAN matches the client's subnet.

A.Change the WLAN security to WPA2, enable SSID broadcast, and configure the WLAN interface to use VLAN 100 with a DHCP scope on that VLAN.

B.Change the WLAN security to WPA3 only, enable SSID broadcast, and change the management interface IP to 192.168.100.10/24.

C.Keep WPA3, disable SSID broadcast for security, and configure the WLAN interface to use VLAN 100 with a DHCP scope on VLAN 1.

D.Change the WLAN security to WPA2, keep SSID broadcast disabled, and configure the WLAN interface to use VLAN 1.

AnswerA

solution

! WLC
configure terminal
wlan CorpNet 1 CorpNet
security wpa2
security wpa akm psk
security wpa psk ascii 7 1234567890abcdef
no security wpa3-sae
broadcast-ssid enable
interface wlan 1
vlan 100
end

Why this answer

The client authentication and DHCP issues are caused by: (1) WPA3 being configured while the client only supports WPA2, (2) SSID broadcast disabled, preventing client discovery, and (3) the WLAN's client VLAN (100) lacking a DHCP server or scope. The management interface VLAN (1) does not interfere with client DHCP. To resolve, change security to WPA2, enable SSID broadcast, and ensure the WLAN is associated with the correct VLAN (100) and a DHCP scope exists on that VLAN.

Exam trap

Be careful not to confuse the management interface VLAN with the client data VLAN. Also, remember that SSID broadcast must be enabled for clients to discover the network, and security settings must match client capabilities. Always verify DHCP scope placement matches the client VLAN.

Why the other options are wrong

The specific factual error is that WPA3-only security may not be supported by the client, and changing the management interface IP does not resolve the client VLAN assignment issue.

The specific factual errors are: WPA3 may not be compatible, disabling SSID broadcast hides the network, and DHCP scope must be on the same VLAN as the client (VLAN 100).

The specific factual errors are: SSID broadcast must be enabled for client discovery, and the WLAN interface must be mapped to VLAN 100, not VLAN 1.

Practice this question →

166

MCQhard

A network engineer is troubleshooting an issue where a Windows 10 workstation (Host-A) cannot reach the internet, but can ping the local default gateway. The engineer runs 'ipconfig /all' on Host-A and reviews the output. What is the most likely cause of the problem?

A.The subnet mask is incorrect.

B.The default gateway is missing or incorrect.

C.The DNS server is configured as a public DNS server that may be unreachable due to network policy or firewall.

D.The host has obtained an APIPA address (169.254.x.x).

AnswerC

The DNS server is 8.8.8.8, which is a public Google DNS server outside the local network domain. In many enterprise or restrictive network environments, outbound UDP/TCP port 53 to public DNS servers is blocked by firewall policy or requires an internal DNS forwarder. Without reachable DNS, the host cannot resolve domain names, causing connectivity failures even though IP addressing, subnet mask, and default gateway are all correct; this makes DNS misconfiguration the most plausible cause.

Why this answer

Host-A can ping the default gateway, which confirms that Layer 3 connectivity to the local network is working and that the subnet mask and default gateway are correctly configured. The inability to reach the internet despite this connectivity points to a name resolution failure, likely caused by an incorrect or unreachable DNS server. A public DNS server (e.g., 8.8.8.8) may be blocked by corporate firewall policy, preventing Host-A from resolving internet domain names.

Exam trap

The trap here is that candidates assume a successful ping to the gateway means all Layer 3 connectivity is fine, overlooking that DNS is a separate service that can fail even when IP connectivity is intact.

Why the other options are wrong

The subnet mask 255.255.255.0 is correct for a /24 network, so it is not the cause of the problem.

The default gateway is correctly set to 192.168.1.1, and the host can ping it, so the gateway is not missing or incorrect.

The IPv4 address is 192.168.1.100, which is a valid private address, not an APIPA address (169.254.x.x). APIPA addresses are used when DHCP fails, but here the host has a proper address.

Practice this question →

167

PBQhard

You are connected to R1. The link between R1 and R2 is experiencing intermittent connectivity and poor performance. Review the provided show interface output to identify the root cause(s) of the issue, then apply the necessary configuration changes to resolve the problem and restore full connectivity. Output from R1: ``` GigabitEthernet0/0 is up, line protocol is up (connected) Hardware is Gigabit Ethernet, address is aaaa.bbbb.cccc (bia aaaa.bbbb.cccc) Internet address is 192.168.1.1/30 MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Half-duplex, 100Mb/s, link type is auto, media type is RJ45 output flow-control is unsupported, input flow-control is unsupported ARP type: ARPA, ARP Timeout 04:00:00 Last input 00:00:01, output 00:00:01, output hang never Last clearing of "show interface" counters 00:01:23 Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 150 packets input, 1500 bytes, 0 no buffer Received 0 broadcasts (0 multicasts) 0 runts, 0 giants, 0 throttles 150 input errors, 150 CRC, 0 frame, 0 overrun, 0 ignored 0 watchdog, 0 multicast, 0 pause input 0 input packets with dribble condition detected 200 packets output, 2000 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 babbles, 0 late collision, 0 deferred 0 lost carrier, 0 no carrier 0 output buffer failures, 0 output buffers swapped out ```

Hints

•CRC errors often indicate a duplex mismatch between the two connected devices.
•Check the current duplex setting on R1's interface—it is set to auto, but the high error count suggests the other end is not negotiating correctly.
•To fix, manually set both speed and duplex on the interface to match the expected settings of the neighbor.

A.Configure the interface with 'speed 1000' and 'duplex full' to match R2's settings, then clear counters.

B.Replace the faulty cable between R1 and R2 to eliminate CRC errors caused by physical layer issues.

C.Disable autonegotiation on the interface with 'no negotiation auto' to force the link to use the configured speed and duplex.

D.Increase the interface MTU to reduce fragmentation and improve performance on the link.

AnswerA

solution

! R1
interface GigabitEthernet0/0
speed 1000
duplex full

Why this answer

The show interface output reveals that R1's GigabitEthernet0/0 is operating at half-duplex, 100 Mb/s, yet it is accumulating a high number of CRC errors (150 in 1 minute 23 seconds). This indicates a speed/duplex mismatch with R2, which is likely set to full-duplex at 1000 Mb/s. To resolve, you must manually configure R1 to match R2's proper settings by issuing the 'speed 1000' and 'duplex full' commands, then clearing the counters to start fresh monitoring.

The other options are incorrect because they do not address the mismatch: replacing the cable would not fix a configuration issue; disabling autonegotiation alone may not fix the mismatch if the hard-coded values are still wrong; and increasing the MTU does not affect CRC errors caused by duplex mismatch.

Exam trap

CRC errors on a link are often misinterpreted as faulty cabling, but the presence of CRC errors on an interface that is up/up but operating at a mismatched speed or duplex strongly indicates a configuration mismatch between the two ends.

Why the other options are wrong

Replacing the cable does not solve a duplex/speed mismatch because the errors are caused by configuration, not physical layer damage.

Disabling autonegotiation alone does not guarantee the interface will use the correct speed and duplex; it still requires manual configuration of the correct values.

Increasing the MTU addresses fragmentation issues, not CRC errors resulting from duplex or speed mismatches.

Practice this question →

168

PBQhard

You are troubleshooting connectivity between R1 and R2. The link is down, and you need to identify and fix the issue. Examine the provided 'show interfaces' output and running configuration, then apply the necessary commands to restore connectivity.

Network Topology

Hints

•Check the running configuration for the 'shutdown' command.
•The interface status shows 'administratively down' if it is shutdown.
•Use the 'no shutdown' command under the interface configuration mode.

A.Enter interface configuration mode for the down interface and issue the 'no shutdown' command.

B.Enter global configuration mode and issue the 'interface reset' command to reset the interface counters.

C.Enter interface configuration mode and issue the 'speed' command to set the interface speed to match the connected device.

D.Enter interface configuration mode and issue the 'no keepalive' command to disable keepalives.

AnswerA

solution

! R1
interface gigabitEthernet 0/0
no shutdown

Why this answer

The interface is administratively down because the 'shutdown' command is present. The line protocol is down because the interface is disabled. To fix this, you must issue the 'no shutdown' command on the interface.

After that, the interface will come up, and the line protocol will become up if the other side is properly configured.

Exam trap

The trap is that candidates may focus on physical layer issues (speed/duplex) or protocol issues (keepalives) instead of recognizing the clear 'administratively down' indication. Always check the interface status first: if it says 'administratively down', the solution is 'no shutdown'.

Why the other options are wrong

The specific factual error: 'interface reset' is not a real command; the correct command to reset counters is 'clear counters'.

The specific factual error: speed mismatch causes line protocol issues but not administrative down state.

The specific factual error: 'no keepalive' affects line protocol detection but does not change administrative state.

Practice this question →

169

MCQmedium

A network technician is troubleshooting a connectivity issue where a host cannot communicate with a remote server. The technician notices that frames are being dropped at an intermediate switch. At which OSI model layer does the switch primarily operate, and what is the Protocol Data Unit (PDU) used at that layer?

A.Layer 1; bits

B.Layer 2; frames

C.Layer 3; packets

D.Layer 4; segments

AnswerB

Switches are Layer 2 devices that forward frames. When a frame arrives, the switch parses its Data Link header, reads the destination MAC address, and looks up that address in its MAC address table to determine the egress port. It then forwards the entire frame out the appropriate interface (or floods it if the address is unknown), making 'Layer 2; frames' the correct answer.

Why this answer

Switches primarily operate at Layer 2 (Data Link layer) of the OSI model, where they make forwarding decisions based on MAC addresses. The Protocol Data Unit (PDU) at this layer is the frame, which includes the MAC header, payload, and trailer. When frames are dropped at an intermediate switch, it indicates a Layer 2 issue such as a MAC address table problem, VLAN mismatch, or duplex mismatch.

Exam trap

Cisco often tests the distinction that a standard switch operates at Layer 2, but candidates may incorrectly choose Layer 3 because they associate switches with VLANs or IP routing, forgetting that basic switching is a Layer 2 function.

Why the other options are wrong

Switches do not operate at Layer 1; hubs and repeaters do.

While some multilayer switches can route, the basic switch in this scenario operates at Layer 2.

Segments are used by transport layer protocols, not by switches.

Practice this question →

170

MCQhard

A subnet must support 30 usable IPv4 host addresses. Which prefix is the smallest that meets the requirement?

A./28

B./27

C./26

D./25

AnswerB

A /27 prefix has a subnet mask of 255.255.255.224, which creates 32 total addresses. After reserving the network address and broadcast address, exactly 30 usable host addresses remain, making it the smallest prefix that satisfies the requirement of 30 usable IPv4 hosts. Thus, /27 is the correct choice because it provides the precise number of needed addresses without wasting space.

Why this answer

A /27 is the smallest valid prefix. In plain language, a /27 provides 32 total addresses, and after subtracting the network and broadcast addresses, 30 usable host addresses remain. A /28 would be too small because it provides only 14 usable hosts.

This is a classic minimum-prefix question because it checks whether you can work backward from a host requirement and choose the smallest subnet that fits without over-allocating more space than necessary.

Exam trap

A frequent exam trap is choosing a /28 prefix because it appears to be the closest to supporting 30 hosts. However, a /28 subnet only provides 16 total addresses, of which 14 are usable for hosts after excluding the network and broadcast addresses. This mistake arises from confusing total addresses with usable hosts or failing to subtract the reserved addresses.

Selecting a /28 leads to insufficient host capacity, causing network issues or exam failure. Always remember that usable hosts equal total addresses minus two, which is critical when calculating subnet sizes for CCNA questions.

Why the other options are wrong

Option A (/28) is incorrect because a /28 subnet provides only 16 total addresses, which results in 14 usable host addresses after subtracting the network and broadcast addresses. This is insufficient to support 30 hosts.

Option C (/26) is incorrect because although it supports 62 usable hosts, it is larger than necessary for 30 hosts, leading to inefficient IP address allocation.

Option D (/25) is incorrect because it provides 126 usable host addresses, which is far more than required, resulting in significant address space waste.

Practice this question →

171

Drag & Dropmedium

Drag and drop the following steps into the correct order to install a new fiber optic link between two switches, including SFP insertion and basic troubleshooting.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct installation order follows best practice: insert the SFP and connect the cable on one switch before moving to the other. This minimizes the time the SFP module is exposed and prevents potential damage. Option A is the only correct sequence.

Option B exposes both SFPs before cabling, increasing risk of contamination. Option C attempts to connect cables before inserting SFPs, which is impractical and can cause damage. Option D verifies link on Switch A before the other end is connected, which will show a down state and is not a valid step sequence.

Exam trap

The exam trap is that candidates may think it is acceptable to insert both SFPs first or to verify the link on one switch before the other end is connected. Remember that fiber optic installation requires careful handling: insert SFP, then cable, and only verify after both ends are complete.

Practice this question →

172

Drag & Dropmedium

Drag and drop the following steps into the correct order to troubleshoot and resolve excessive interface errors caused by a duplex mismatch on a Cisco switch interface.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

The correct order starts with identifying symptoms using show interfaces to see error counters like CRC and late collisions. Next, check the local interface speed and duplex with show interfaces status. Then discover the neighbor's speed and duplex, for instance via show cdp neighbors detail, to confirm a mismatch.

After identifying the mismatch, configure the interface with the correct settings (e.g., speed and duplex commands). Finally, verify the resolution by running show interfaces again to ensure errors are no longer incrementing.

Practice this question →

173

PBQhard

You are connected to R1 via console. R1 is directly connected to R2 over a 1000BASE-T link that is failing to come up. Configure interface GigabitEthernet0/0 on R1 with the correct speed and duplex settings to match R2's configuration, and then verify the link is operational. Additionally, determine the appropriate SFP type for a new 40 km fiber link between R1 and R2.

Network Topology

Hints

•Check R2's running config to see if speed and duplex are manually set.
•Auto-negotiation failure can occur when one side is set to auto and the other to fixed settings.
•For distances over 10 km on fiber, you typically need a 1000BASE-ZX SFP.

A.Configure interface GigabitEthernet0/0 with 'speed 1000' and 'duplex full'. For the new fiber link, use a 1000BASE-ZX SFP.

B.Configure interface GigabitEthernet0/0 with 'speed auto' and 'duplex auto'. For the new fiber link, use a 1000BASE-SX SFP.

C.Configure interface GigabitEthernet0/0 with 'speed 1000' and 'duplex half'. For the new fiber link, use a 1000BASE-LX SFP.

D.Configure interface GigabitEthernet0/0 with 'speed 100' and 'duplex full'. For the new fiber link, use a 1000BASE-EX SFP.

AnswerA

solution

! R1
interface GigabitEthernet0/0
speed 1000
duplex full

Why this answer

The link is down because R1 is set to auto-negotiate speed and duplex while R2 is hardcoded to 1000 Mbps full duplex. This mismatch causes the link to fail. To fix, configure R1's GigabitEthernet0/0 with 'speed 1000' and 'duplex full'.

For the new 40 km fiber link, a 1000BASE-ZX SFP is required as it supports distances up to 70 km. (1000BASE-LX supports only up to 10 km and is insufficient for 40 km.) Verify with 'show interfaces GigabitEthernet0/0' to see the link state change to up/up.

Exam trap

Do not assume auto-negotiation always works; when one side is hardcoded, the other must match. Also, know the distance limitations of SFP types: SX (short), LX (long, 10 km), ZX (extended, 70 km).

Why the other options are wrong

Auto-negotiation cannot match a hardcoded speed/duplex; 1000BASE-SX is for short distances (up to 550 m).

Gigabit Ethernet does not support half duplex; 1000BASE-LX maximum distance is 10 km.

Speed mismatch (100 vs 1000) will cause link failure; 1000BASE-EX is not an IEEE standard (ZX is used for extended reach).

Practice this question →

174

PBQhard

You are managing a Cisco WLC (192.168.1.10) via its web UI. The wireless network 'CorpSecure' has been configured but clients cannot associate. Some report 'wrong password' errors; others see the SSID but fail to connect. Additionally, management access to the WLC web UI is intermittent. Identify and resolve the issues so that wireless clients can successfully associate with 'CorpSecure' using WPA3-Personal and the WLC web UI is reliably accessible from the management VLAN (VLAN 10).

Hints

•Check the security settings on the WLAN; clients expecting WPA3 will fail with WPA2 configured.
•An SSID that is hidden (Broadcast disabled) may not appear in client scans unless manually entered.
•Management access issues might be unrelated to the WLAN config; verify the management interface IP and default gateway are correct.

A.Configure the SSID with WPA3-Personal; verify management interface is on VLAN 10 with correct gateway.

B.Change the SSID security to WPA2-PSK and disable SSID broadcast; reset the WLC to factory defaults.

C.Update the WLC firmware to the latest version and change the management VLAN to VLAN 1.

D.Reconfigure the SSID with WPA3-Enterprise and enable SSID broadcast; set the management interface to use DHCP.

AnswerA

solution

! WLC
Navigate to WLANs > Edit CorpSecure > Security > Layer 2 > Select WPA3-Personal (AES) > Apply
Navigate to WLANs > Edit CorpSecure > SSID > Enable Broadcast SSID > Apply

Why this answer

The primary issue is a security mismatch: the SSID is set to WPA2-PSK while clients expect WPA3, causing 'wrong password' errors. Since clients can see the SSID, broadcast is already enabled; the secondary connection failures may be due to incompatible devices, but the correct fix is to change the security to WPA3-Personal (AES). Additionally, verify that the management interface is on VLAN 10 with the correct gateway to ensure reliable WLC web UI access.

Exam trap

Candidates might mistakenly conclude the SSID broadcast is disabled and enable it unnecessarily, overlooking that the visible SSID indicates broadcast is already on, or they might ignore the management VLAN configuration.

Why the other options are wrong

The specific factual error: WPA2-PSK is not compatible with clients expecting WPA3-Personal, and hiding the SSID prevents clients from seeing it.

The specific factual error: VLAN 1 is the default and often discouraged for management; the issue is not firmware-related but configuration-based.

The specific factual error: WPA3-Enterprise is not appropriate without a RADIUS server, and DHCP for management can lead to unreliable access.

Practice this question →

175

PBQhard

You are connected to WLC-1 via SSH. A new SSID 'CorpSecure' must be configured for 5 GHz clients using WPA3-Personal. However, after creation, clients can see the SSID but fail to associate. Review the WLC configuration and fix the issue so that clients can successfully associate and obtain an IP address from VLAN 100 (subnet 10.0.100.0/24).

Network Topology

Hints

•Check the current security settings on the WLAN; they are using WPA2, not WPA3.
•The radio policy is not set — clients may try to connect on 2.4 GHz, but the SSID should be 5 GHz only.
•Ensure the WLAN is enabled after changes.

A.Change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, set the radio policy to 5 GHz, and ensure the WLAN is mapped to the dynamic interface for VLAN 100.

B.Change the WLAN security to WPA2-Personal, enable TKIP encryption, and set the radio policy to 5 GHz.

C.Change the WLAN security to WPA3-Personal, enable AES-CCMP, but leave the radio policy as 'All' (both 2.4 GHz and 5 GHz).

D.Change the WLAN security to WPA3-Personal, enable AES-CCMP, set the radio policy to 5 GHz, but do not enable the WLAN after changes.

AnswerA

solution

! WLC-1
config wlan security wpa3 1 enable
config wlan security wpa3 psk 1 set ascii CorpSecurePass123
config wlan radio-policy 1 5ghz
config wlan enable 1
config wlan security wpa3 ciphers 1 aes-ccmp

Why this answer

The SSID was configured with WPA2 instead of WPA3. The WLC also had no radio policy set for 5 GHz only. To fix, change the WLAN security to WPA3-Personal, enable AES-CCMP for WPA3, and set the radio policy to 5 GHz.

Additionally, ensure the WLAN is mapped to the appropriate dynamic interface for VLAN 100, not the management interface, and that client VLAN 100 is reachable. The commands to modify the WLAN are: config wlan security wpa3 1 enable, config wlan security wpa3 psk ascii CorpSecurePass123 1, config wlan radio policy 802.11a-only 1, and config wlan enable 1.

Exam trap

Students often forget to change the radio policy from 'All' to a specific band, or they confuse WPA2 with WPA3. Also, they may overlook enabling the WLAN after configuration. Ensure you understand the specific requirements for WPA3 and the need to match the radio policy to the client band.

Why the other options are wrong

The specific factual error is that WPA2-Personal with TKIP does not meet the WPA3-Personal requirement; WPA3 mandates AES-CCMP.

The specific factual error is that the radio policy must be set to 5 GHz only, not 'All', to restrict access to 5 GHz clients.

The specific factual error is that the WLAN remains disabled, so clients cannot associate even if other settings are correct.

Practice this question →

176

MCQhard

A network administrator is troubleshooting connectivity issues between two switches. Hosts connected to Switch A cannot ping hosts on Switch B. The link between the switches shows as up/up on both ends, but interface error counters (CRC, runts) are increasing rapidly. What should the administrator do to resolve the issue?

A.Replace the faulty cable between the two switches.

B.Change the duplex setting on SwitchA's interface to auto-negotiation.

C.Replace the SFP module on SwitchA's GigabitEthernet0/1 port.

D.Enable the interface with 'no shutdown' command.

AnswerB

The correct fix is to change the duplex setting on SwitchA's interface to auto-negotiation. The interface is manually hard-coded to full-duplex, while the remote switch is likely auto-negotiating and has fallen back to half-duplex due to the negotiation failure. This duplex mismatch causes late collisions and poor performance. On 1000BASE-T, auto-negotiation is mandatory, so both ends must either auto-negotiate or be manually set to identical duplex and speed settings; changing SwitchA to auto allows both sides to agree on full-duplex.

Why this answer

The increasing CRC and runts errors on an up/up link indicate a duplex mismatch, where one side is using full duplex and the other half duplex. Assuming SwitchB is using auto-negotiation (the default on Cisco switches), changing SwitchA's interface to auto-negotiation will allow both ends to negotiate the correct duplex setting, resolving the mismatch and stopping the errors.

Exam trap

Cisco often tests the misconception that a link showing 'up/up' means the physical layer is perfect, when in reality duplex mismatch causes high error rates while keeping the interface up, leading candidates to incorrectly suspect cable or hardware faults.

Why the other options are wrong

Cable issues would manifest as input errors or interface flapping, but the counters show zero errors.

No errors are reported, so the SFP is functioning correctly.

The 'show interface' output clearly shows the interface is up, so no shutdown is not needed.

Practice this question →

177

Multi-Selectmedium

Which TWO statements correctly describe the encapsulation process at the OSI model Transport layer?

Select 2 answers

A.It adds source and destination IP addresses to the data.

B.It breaks data into smaller units called segments (for TCP) or datagrams (for UDP).

C.It adds a header that includes source and destination MAC addresses.

D.It adds a header that includes source and destination port numbers.

E.It converts data into bits for transmission over the physical medium.

AnswersB, D

The Transport layer accepts data from upper layers and divides it into appropriately sized units for transmission. For TCP, these units are called segments, and for UDP, they are datagrams. This segmentation enables efficient network usage, and TCP further assigns sequence numbers to these units so the receiving host can reorder them correctly and request retransmission of missing data. This is a fundamental Transport layer role, ensuring that upper-layer data is properly prepared for network delivery.

Why this answer

At the Transport layer (Layer 4), TCP segments data into segments and UDP segments data into datagrams. This segmentation allows efficient transmission and reassembly at the destination. The Transport layer header includes source and destination port numbers to identify the communicating applications, not IP or MAC addresses.

Exam trap

Cisco often tests the distinction between OSI model layers, and the trap here is confusing the Transport layer's port numbers and segmentation with the Network layer's IP addressing or the Data Link layer's MAC addressing.

Why the other options are wrong

The Transport layer uses port numbers, not IP addresses. IP addresses are added during Network layer encapsulation.

MAC addresses are used for local delivery on a network segment and are part of Layer 2 encapsulation.

The Physical layer handles the actual transmission of raw bits over the network medium.

Practice this question →

178

MCQmedium

Which IPv6 protocol function replaces ARP?

A.DHCPv6

B.Neighbor Discovery

C.EUI-64

D.SLAAC

AnswerB

Neighbor Discovery (ND) replaces ARP by using ICMPv6 Neighbor Solicitation and Neighbor Advertisement messages to dynamically resolve IPv6 addresses to link-layer MAC addresses. It also handles router discovery, prefix discovery, and duplicate address detection, making it the core protocol for link-local interactions in IPv6. ND tracks neighbor reachability state in the neighbor cache, just as ARP did in IPv4.

Why this answer

IPv6 uses Neighbor Discovery Protocol to resolve Layer 3-to-Layer 2 information and perform related local-link functions such as router discovery and address resolution.

Exam trap

Be careful not to confuse protocols that manage IP addresses or routing with those that resolve addresses.

Why the other options are wrong

DHCPv6 is not a protocol that replaces ARP; instead, it is used for assigning IP addresses and configuration information to IPv6 devices. ARP is replaced by the Neighbor Discovery Protocol in IPv6, which performs similar functions for address resolution.

EUI-64 is not a protocol but a method for generating IPv6 interface identifiers. It does not perform the function of resolving link-layer addresses like ARP does in IPv4.

SLAAC (Stateless Address Autoconfiguration) is a method for automatically configuring IPv6 addresses but does not perform the function of resolving link-layer addresses like ARP does in IPv4. Therefore, it cannot replace ARP in IPv6.

Practice this question →

179

MCQhard

A host uses the subnet mask 255.255.254.0. Which prefix length does this represent?

A./22

B./23

C./24

D./25

AnswerB

A prefix length of /23 means 23 bits are set to 1 in the subnet mask, which in binary is 11111111.11111111.11111110.00000000. This converts directly to decimal 255.255.254.0, where the third octet has seven network bits and one host bit. Since the fourth octet contributes eight more host bits, the total host address space is 2^9 = 512 addresses, verifying that /23 is the correct representation.

Why this answer

The mask 255.255.254.0 represents /23. In plain language, the first two octets are fully network bits, the third octet contributes 7 more network bits because 254 in binary is 11111110, and the last octet contributes none. That totals 23 network bits.

This is a common prefix-conversion question because candidates often memorize the usual masks but hesitate when a non-/24 boundary appears. Recognizing that 255.255.254.0 equals /23 is important for subnetting and local-scope calculations.

Exam trap

Be cautious of common subnet masks like /24 and ensure you count the bits correctly, especially in non-standard masks.

Why the other options are wrong

Option A is incorrect because the subnet mask 255.255.254.0 corresponds to a prefix length of /23, not /22. A /22 prefix would indicate a subnet mask of 255.255.252.0.

The subnet mask 255.255.254.0 corresponds to a prefix length of /23, not /24. A /24 prefix length would indicate a subnet mask of 255.255.255.0, which allows for fewer hosts per subnet.

Option D is incorrect because a subnet mask of 255.255.254.0 corresponds to a prefix length of /23, not /25. A /25 subnet mask would allow for only 128 IP addresses, which is not applicable here.

Practice this question →

180

MCQhard

A network engineer is troubleshooting connectivity issues for hosts in VLAN 10. Hosts in VLAN 10 are unable to ping the default gateway at 192.168.10.1. The engineer checks the switch configuration and notices that the SVI for VLAN 10 is configured with an IP address, but the interface is in a down/down state. What is the most likely cause of this issue?

A.The interface is administratively shut down.

B.VLAN 10 does not exist in the VLAN database.

C.The IP address is not in the correct subnet for VLAN 10.

D.The switch does not have a default gateway configured.

AnswerB

The SVI for VLAN 10 is down/down because the VLAN is not created. Once VLAN 10 is created with the 'vlan 10' command in global configuration mode, the SVI will come up if there is at least one active port in that VLAN.

Why this answer

An SVI (Switch Virtual Interface) will remain in a down/down state if the corresponding VLAN does not exist in the switch's VLAN database. Even if the SVI is configured with an IP address, the interface cannot come up because there is no Layer 2 VLAN to associate with it. This is a common cause of SVI down/down issues when the VLAN has not been created or has been deleted.

Exam trap

Cisco often tests the distinction between an SVI being down due to a missing VLAN versus an administratively shutdown interface, leading candidates to mistakenly choose the administrative shutdown option when the interface status shows 'down/down' instead of 'administratively down'.

Why the other options are wrong

The running-config shows 'no shutdown', so this is not the cause.

The IP address and subnet mask are correctly configured for the VLAN.

The SVI status is not affected by the presence or absence of a default gateway.

Practice this question →

181

Drag & Dropmedium

Drag and drop the following steps into the correct order to troubleshoot a suspected duplex mismatch and CRC errors on a Cisco switch interface using CLI commands.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

Start by examining current interface stats, then fix the mismatch, and finally clear and recheck counters.

Exam trap

The trap is that candidates often clear counters before fixing the issue, thinking they need a clean baseline. However, you must first see the errors to confirm the problem. Also, some may try to fix before inspecting, which is not systematic troubleshooting.

Practice this question →

182

Drag & Dropmedium

Which of the following correctly describes the sequence of the TCP three-way handshake between a client and a server?

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The TCP three-way handshake establishes a reliable connection in three steps: the client sends a SYN, the server replies with SYN-ACK, and the client acknowledges with an ACK. Option A correctly depicts this. Option B omits the server's SYN, leaving synchronization incomplete.

Option C reverses the roles by having the server initiate, which never occurs in a standard handshake. Option D begins with a SYN-ACK, which is not a valid initial packet; the handshake must start with a SYN.

Exam trap

Do not confuse the roles: the client always initiates with a SYN, the server responds with SYN-ACK, and the client finishes with an ACK. Watch out for options that reverse the order or swap the flags.

Practice this question →

183

MCQhard

A host is configured as 10.20.30.95/27. Which address is the network address of its subnet?

A.10.20.30.32

B.10.20.30.64

C.10.20.30.95

D.10.20.30.96

AnswerB

The /27 prefix length means the subnet mask is 255.255.255.224, giving a block size of 32 addresses. The host address 10.20.30.95 falls within the range 10.20.30.64 through 10.20.30.95, making .64 the first address of that subnet. Since the network address is always the first address in the block, 10.20.30.64 is indeed the network for this host.

Why this answer

A /27 uses blocks of 32 addresses. In plain language, the ranges in the last octet are 0–31, 32–63, 64–95, 96–127, and so on. Since the host address ends in 95, it belongs to the 64–95 block. The first address in that block is the network address, which is 10.20.30.64.

This is a classic subnet-boundary question because it tests whether you can identify the containing block and then choose the first address in that block as the network address.

Exam trap

A frequent exam trap is mistaking the host IP address for the network address or incorrectly identifying the subnet block boundaries. Candidates often select the host IP itself or the next block's starting address as the network address. For example, choosing 10.20.30.95 or 10.20.30.96 instead of 10.20.30.64.

This happens because the subnet mask’s block size (32 addresses for /27) is overlooked, leading to confusion about which block the host belongs to. Misunderstanding this can cause incorrect subnetting and routing errors in real networks.

Why the other options are wrong

10.20.30.32 is incorrect because the host IP 10.20.30.95 does not fall within the 32–63 subnet block. This address belongs to a different subnet block and cannot be the network address for the given host.

10.20.30.95 is incorrect because it is the host IP address itself, not the network address. The network address must be the first address in the subnet block, not a host address.

10.20.30.96 is incorrect because it is the first address of the next subnet block (96–127). The host IP 10.20.30.95 belongs to the previous block, so 10.20.30.96 cannot be its network address.

Practice this question →

184

MCQhard

A network engineer is troubleshooting intermittent connectivity on an access switch port connected to a server. The output of 'show interfaces gigabitEthernet 1/0/24' shows an increasing number of runts and giants, but no CRC errors. The 'show interfaces status' command indicates the port is in 'err-disabled' state every few hours and must be manually re-enabled. What is the most likely cause of this issue?

A.Duplex mismatch between the switch port and the server NIC

B.Faulty cable or connector causing physical layer errors

C.Incorrect VLAN configuration on the switch port

D.Speed mismatch between the switch port and the server NIC

AnswerB

Runts and giants without CRC errors often indicate physical layer issues like a bad cable, connector, or excessive noise. The cable length at maximum (100 meters) and MDIX off suggest potential signal degradation, leading to intermittent flapping and err-disabled state.

Why this answer

Runts and giants without CRC errors indicate a physical-layer issue that corrupts the frame preamble or interframe gap but not the actual data payload. A faulty cable or connector can cause signal degradation leading to these framing errors. The intermittent err-disabled state is typically triggered by link-flap (repeated link up/down events) caused by the unstable physical connection, not directly by alignment or frame-check error counters.

Exam trap

Cisco often tests the distinction between CRC errors (data corruption) and runts/giants (framing errors) to mislead candidates into thinking duplex mismatch is the cause, but duplex mismatch produces CRC errors and collisions, not runts/giants without CRC errors.

Why the other options are wrong

Duplex mismatch would cause CRC errors and late collisions, which are not present in the exhibit.

VLAN mismatch does not cause runts or giants; it causes Layer 2 issues like no connectivity.

Speed mismatch would prevent the link from coming up or cause CRC errors, but the link is up at 1000 Mb/s.

Practice this question →

185

MCQhard

A network engineer is troubleshooting a link between two Cisco Catalyst 9300 switches that are connected via a 10GBASE-SR SFP+ module on each end over OM3 multimode fiber. The link is up, but the interface counters show a high number of CRC errors and runts. The engineer runs 'show interfaces Gi1/0/1' and 'show interfaces Gi1/0/1 transceiver details'. What is the most likely cause of the errors?

A.The SFP+ module is faulty and needs replacement.

B.The fiber patch cables are too long, exceeding the 300-meter distance limit for 10GBASE-SR over OM3 fiber.

C.The interface speed is mismatched; the switch interface shows 1000Mb/s but the SFP+ is 10GBASE-SR.

D.The receive optical power is too low, indicating a fiber or connector issue.

AnswerD

The receive power of -15.1 dBm is below the typical receive sensitivity for 10GBASE-SR (about -12.6 dBm). This causes bit errors that appear as CRC errors and runts. The transmit power is normal, so the issue is on the receive side, likely dirty connectors or a damaged fiber.

Why this answer

The high CRC errors and runts on a 10GBASE-SR link over OM3 fiber, combined with the 'show interfaces transceiver details' command, point to a physical-layer issue. Low receive optical power (below the receiver sensitivity threshold) causes bit errors that manifest as CRC errors and runts, even though the link is up. This is the most common cause when the fiber and transceivers are otherwise compatible.

Exam trap

Cisco often tests the misconception that CRC errors always indicate a faulty transceiver or cable length issue, when in reality low optical power from dirty or damaged connectors is a more common and subtle cause on fiber links.

Why the other options are wrong

The transceiver diagnostics show no fault flags, and the module is reporting nominal bit rate and other values within range.

The distance itself is within spec; the issue is the receive power being too low, not the distance exceeding the limit.

This is a configuration mismatch, but it does not directly cause CRC errors. The CRC errors are due to low receive power.

Practice this question →

186

PBQhard

You are connected to R1 via console. The network consists of R1, R2, and a multilayer switch MLS1. R1's GigabitEthernet0/0 connects to MLS1's GigabitEthernet1/0/1 (VLAN 10), and MLS1's GigabitEthernet1/0/2 connects to R2's GigabitEthernet0/0. The goal is to enable IPv6 communication between R1 and R2 across the layer-3 switch. Currently, R1 and R2 cannot ping each other's IPv6 addresses. Configure R1's G0/0 with the IPv6 prefix 2001:db8:1:10::/64 using EUI-64, and R2's G0/0 with static IPv6 address 2001:db8:1:10::2/64. Also ensure MLS1 has IPv6 routing enabled and an IPv6 address on VLAN 10 (2001:db8:1:10::3/64). Troubleshoot and fix any layer-2 or layer-3 issues preventing connectivity.

Network Topology

Hints

•R1's G0/0 has no IPv6 address configured.
•The correct command uses the 'eui-64' keyword to generate the interface ID from the MAC.
•After configuration, R1 should be able to ping the other IPv6 addresses.

A.Configure 'ipv6 address 2001:db8:1:10::/64 eui-64' on R1's G0/0 interface.

B.Enable IPv6 routing on R1 with 'ipv6 unicast-routing'.

C.Configure 'ipv6 address 2001:db8:1:10::1/64' on R1's G0/0 interface (without EUI-64).

D.Change the VLAN on MLS1's G1/0/1 to match R1's VLAN.

AnswerA

solution

! R1
interface GigabitEthernet0/0
ipv6 address 2001:db8:1:10::1/64 eui-64
end

Why this answer

R1 has no IPv6 address configured on G0/0. The required prefix is 2001:db8:1:10::/64 using EUI-64, which generates the interface ID from the MAC address. The command 'ipv6 address 2001:db8:1:10::/64 eui-64' must be entered in interface configuration mode.

Additionally, MLS1 has IPv6 routing enabled (as seen by the connected route), but R1's interface is missing the IPv6 address. After configuration, R1 will be able to ping R2 and MLS1. No other changes are needed because R2 and MLS1 are correctly configured.

Exam trap

Do not confuse global IPv6 routing enablement with interface address configuration. The presence of a connected route indicates routing is enabled; the missing piece is the interface address. Also, pay attention to specific requirements like EUI-64.

Why the other options are wrong

IPv6 unicast-routing is already enabled; the problem is at the interface level.

The requirement specifies EUI-64; omitting it results in a static address that does not match the intended configuration.

The VLAN configuration is correct; no change is needed.

Practice this question →

187

PBQhard

You are connected to the console of R1. The network administrator reports that hosts in VLAN 10 cannot reach the server at 192.168.1.100. R1 is the default gateway for VLAN 10 via subinterface G0/0.10. The link between R1 and the switch SW1 appears to be up, but pings fail. Your task is to identify and resolve the issue.

Network Topology

Hints

•Check the interface status and error counters on the link.
•Auto-negotiation might have failed; try manually setting speed and duplex.
•The trunk link must be operational for inter-VLAN routing.

A.Check the interface status on R1's G0/0.10 subinterface; it may be administratively down.

B.Verify that the VLAN 10 SVI on SW1 has an IP address in the correct subnet.

C.Check the duplex and speed settings on the physical interface G0/0 of R1 and the corresponding switchport on SW1; they may be mismatched.

D.Ensure that the native VLAN on the trunk between R1 and SW1 is VLAN 1.

AnswerC

solution

! R1
interface GigabitEthernet0/0
duplex full
speed 100
no shutdown

! SW1
interface GigabitEthernet0/1
duplex full
speed 100
no shutdown

Why this answer

The link between R1 and SW1 had mismatched duplex/speed settings because auto-negotiation failed, causing excessive CRC errors and packet loss. Manually setting both sides to 100/full resolves the issue.

Exam trap

Do not assume that a link showing 'up/up' means error-free communication. Always check for CRC errors and duplex mismatches when pings fail despite the interface being up. Subinterfaces depend on the physical interface; troubleshoot the physical layer first.

Why the other options are wrong

The specific factual error is that subinterfaces do not have an independent line protocol state; they depend on the physical interface. The problem is likely a physical layer issue like duplex mismatch.

The specific factual error is that the SVI is not involved in this scenario; the router's subinterface handles routing for VLAN 10. The link between R1 and SW1 is the bottleneck.

The specific factual error is that native VLAN mismatch causes different symptoms (e.g., CDP/STP issues) and does not cause line protocol down or CRC errors.

188

MCQmedium

A network engineer must summarize the following routes before advertising them upstream: 172.16.32.0/24 172.16.33.0/24 172.16.34.0/24 172.16.35.0/24 Which summary route should be used?

A.172.16.32.0/22

B.172.16.32.0/23

C.172.16.32.0/21

D.172.16.34.0/22

AnswerA

A /22 prefix has a block size of 4 in the third octet, so 172.16.32.0/22 spans 172.16.32.0 through 172.16.35.255, exactly covering the four /24 routes 172.16.32.0/24, 172.16.33.0/24, 172.16.34.0/24, and 172.16.35.0/24. The network address 172.16.32.0 is aligned to a multiple-of-four boundary (32 % 4 = 0), making it a valid summary. It is the smallest CIDR block that cleanly encapsulates all four contiguous subnets with no additional address space.

Why this answer

The correct summary is 172.16.32.0/22 because a /22 covers exactly four consecutive /24 networks when the starting boundary is aligned correctly. This is the part many people miss: summarization is not only about how many networks fit into a block, but also where that block starts. Here the four /24 networks begin neatly at 172.16.32.0 and continue through 172.16.35.255, which is the exact range a /22 covers.

A /23 would be too small, while a /21 would be unnecessarily broad and could advertise addresses you do not intend to include. The /22 beginning at 172.16.34.0 is not on a valid /22 boundary, so that option is misaligned.

Exam trap

Ensure the summary route starts on the correct boundary and covers exactly the intended range without including extra networks.

Why the other options are wrong

Option B, 172.16.32.0/23, is incorrect because it only summarizes two of the four provided routes (172.16.32.0/24 and 172.16.33.0/24), failing to include the other two routes (172.16.34.0/24 and 172.16.35.0/24).

Option C (172.16.32.0/21) includes a broader range of addresses than necessary, covering 172.16.32.0 to 172.16.39.255, which exceeds the specified routes and could lead to incorrect routing information being advertised.

Option D is incorrect because the summary route 172.16.34.0/22 would only cover the addresses from 172.16.34.0 to 172.16.35.255, missing the routes 172.16.32.0/24 and 172.16.33.0/24.

Practice this question →

189

Multi-Selectmedium

Which TWO statements correctly describe IPv4 and IPv6 host configuration?

Select 2 answers

A.APIPA assigns an IPv4 address in the 169.254.0.0/16 range when a DHCP server is unavailable.

B.IPv6 link-local addresses are always assigned using EUI-64 and start with FE80::/10.

C.EUI-64 is used to generate the network prefix of an IPv6 address from the interface's MAC address.

D.A host can have only one default gateway configured at a time for both IPv4 and IPv6.

E.The ipconfig command on Windows can display both IPv4 and IPv6 addresses, subnet masks, default gateways, and DNS servers.

AnswersA, E

APIPA is a fallback mechanism in IPv4 used by Windows hosts when a DHCP server cannot be reached after a timeout. It automatically configures an interface address from the 169.254.0.0/16 range with a /16 subnet mask, enabling local communication on that subnet only. Because APIPA addresses are not routable, no default gateway is assigned, so internet access is unavailable until DHCP succeeds.

Why this answer

APIPA (Automatic Private IP Addressing) automatically assigns an IPv4 address from the 169.254.0.0/16 range when a DHCP server is unavailable, enabling local subnet communication without manual configuration. Option E is correct because the ipconfig command on Windows displays both IPv4 and IPv6 addresses, subnet masks, default gateways, and DNS servers. Option B is incorrect because while IPv6 link-local addresses start with FE80::/10, they are not always assigned using EUI-64; they can also be randomly generated (privacy extensions) or manually configured.

Option C is incorrect because EUI-64 generates the interface identifier (host portion) of an IPv6 address from the MAC address, not the network prefix — the prefix is provided via SLAAC, DHCPv6, or manual configuration. Option D is incorrect because a host can have multiple default gateways configured for redundancy, though only one is active at a time per routing table; additionally, IPv4 and IPv6 default gateways are independent and can coexist.

Exam trap

Cisco often tests the misconception that EUI-64 generates the network prefix of an IPv6 address, when in fact it generates only the interface identifier (host portion), while the network prefix is assigned via SLAAC, DHCPv6, or manual configuration.

Why the other options are wrong

The statement incorrectly claims that link-local addresses are always assigned using EUI-64.

The statement confuses the role of EUI-64; it creates the interface ID, not the network prefix.

The statement is too restrictive; multiple default gateways can be configured, especially in multi-homed hosts.

Practice this question →

190

MCQmedium

A network administrator is troubleshooting a connectivity issue between two hosts on different subnets. The administrator captures packets on the source host and notices that the frames contain the correct source and destination MAC addresses but the encapsulated packets have incorrect source and destination IP addresses. According to the OSI model, which layer is most likely responsible for this issue?

A.Physical Layer (Layer 1)

B.Data Link Layer (Layer 2)

C.Network Layer (Layer 3)

D.Transport Layer (Layer 4)

AnswerC

The Network Layer is responsible for logical addressing, routing, and forwarding packets based on IP addresses. When an IP address is incorrect, the host cannot participate in proper network communication, and routers cannot make accurate forwarding decisions. Because the problem directly involves IP addresses, the Network Layer is the most likely layer where the fault exists.

Why this answer

The Network Layer (Layer 3) is responsible for logical addressing (IP addresses) and routing packets between different subnets. Since the captured frames have correct MAC addresses (Layer 2) but incorrect source and destination IP addresses, the issue lies in how the IP headers are being constructed or assigned, which is a Layer 3 function. This could be caused by misconfigured IP addresses, subnet masks, or default gateways on the source host.

Exam trap

Cisco often tests the distinction between MAC addresses (Layer 2) and IP addresses (Layer 3) in troubleshooting scenarios, and the trap here is that candidates might incorrectly blame the Data Link Layer because they see 'frames' and 'MAC addresses' in the question, without recognizing that the IP address error points to the Network Layer.

Why the other options are wrong

The issue is with the IP addresses, which are not handled at Layer 1.

The MAC addresses are correct, so the Data Link Layer is functioning properly.

IP addresses are not part of the Transport Layer header; they belong to the Network Layer.

Practice this question →

191

MCQhard

A router interface is configured with 192.0.2.97/28. What is the network address of the subnet?

A.192.0.2.80

B.192.0.2.96

C.192.0.2.111

D.192.0.2.112

AnswerB

Correct. It is the first address in the 192.0.2.96/28 subnet.

Why this answer

A /28 uses blocks of 16 addresses. The block containing .97 runs from .96 through .111, so .96 is the network address.

Exam trap

Be careful not to confuse the given IP address or the broadcast address with the network address.

Why the other options are wrong

Option A (192.0.2.80) is incorrect because the subnet mask /28 indicates a block size of 16, making the valid network addresses range from 192.0.2.96 to 192.0.2.111. The network address for this subnet is 192.0.2.96.

The address 192.0.2.111 is not a valid network address for the subnet defined by 192.0.2.97/28, as it falls outside the range of usable addresses for that subnet, which spans from 192.0.2.96 to 192.0.2.111.

Option D, 192.0.2.112, is wrong because it does not represent the network address for the subnet defined by the IP address 192.0.2.97/28. The correct network address is 192.0.2.96, which is the first address in the subnet range.

Practice this question →

192

MCQhard

A host uses the subnet mask 255.255.255.240. How many usable host addresses exist in each subnet?

A.12

B.14

C.16

D.30

AnswerB

A subnet mask of 255.255.255.240 is a /28 prefix, meaning 4 bits are available for host addresses. This yields 2^4 = 16 total IP addresses within the subnet. To determine usable host addresses, subtract the network address and the broadcast address, leaving 16 - 2 = 14 assignable addresses. So 14 is the correct number of usable hosts for a /28 network.

Why this answer

The mask 255.255.255.240 corresponds to /28. In practical terms, that leaves 4 host bits, which gives 16 total addresses in each subnet. After subtracting the network and broadcast addresses, 14 usable hosts remain.

This is a classic host-capacity calculation and a very common subnetting pattern on the exam.

Exam trap

A frequent exam trap is selecting the total number of addresses in the subnet (16) instead of the usable host addresses (14). Candidates often forget to subtract the network and broadcast addresses, which are reserved and cannot be assigned to hosts. Another common mistake is confusing the /28 subnet mask with /27, which offers 30 usable hosts, leading to incorrect answers like 30.

This confusion arises because both subnet masks are close in size but differ significantly in host capacity. Always remember that usable hosts equal total addresses minus two reserved addresses.

Why the other options are wrong

Option A states 12 usable hosts, which is incorrect because a /28 subnet provides 16 total addresses. Subtracting the network and broadcast addresses leaves 14 usable hosts, not 12. This option underestimates the host capacity.

Option C claims 16 usable hosts, which is incorrect because 16 represents the total number of addresses in the subnet, including network and broadcast addresses. Usable hosts must exclude these two reserved addresses.

Option D suggests 30 usable hosts, which corresponds to a /27 subnet mask (255.255.255.224), not /28. This overestimates the host count for the given subnet mask and is therefore incorrect.

Practice this question →

193

MCQhard

A network administrator notices that file transfers to a server are extremely slow, and on the switch interface connecting to the server, the output of 'show interfaces' indicates a high number of runts and CRC errors, but no collisions. Which of the following is the most likely cause?

A.The cable connecting the server to the switch is faulty.

B.The switch port is configured for full-duplex, but the server's NIC is set to half-duplex.

C.The switch port speed is set to 100 Mbps, but the server NIC is set to 10 Mbps.

D.The server's NIC driver is outdated, causing packet loss.

AnswerB

A duplex mismatch where the switch uses full-duplex and the server uses half-duplex results in the full-duplex side (switch) showing runts and CRC errors without collisions, while the half-duplex side sees collisions. This matches the 'show interfaces' output and explains the slow transfers due to excessive retransmissions.

Why this answer

The combination of runts (frames smaller than 64 bytes) and CRC errors with zero collisions is a classic symptom of a duplex mismatch. When one side operates at full-duplex and the other at half-duplex, the half-duplex side will detect collisions and invoke its backoff algorithm, causing the full-duplex side to receive truncated frames (runts) and frames with invalid FCS (CRC errors). The switch interface statistics show no collisions because the switch port is full-duplex and does not detect collisions, while the server's half-duplex NIC is causing the corruption.

Exam trap

Cisco often tests the distinction between symptoms of duplex mismatch versus cable faults, where candidates mistakenly attribute runts and CRC errors to a bad cable, ignoring the critical clue of zero collisions that points to a mismatch.

Why the other options are wrong

While a faulty cable could cause CRC errors, it would likely produce other error types and might not exhibit the specific pattern of only runts and CRC errors with no collisions. This pattern strongly points to a duplex mismatch.

A speed mismatch would generally cause the link to fail entirely; you wouldn't see interface errors because there would be no connectivity. The scenario describes connectivity with errors, so this is unlikely.

Outdated drivers may cause performance problems, but they do not produce the specific interface error counters on the switch. The recorded runts and CRC errors point to a physical or data-link layer issue, not a driver problem.

Practice this question →

194

Drag & Drophard

Drag and drop the following steps into the correct order to configure a new WLAN on a Cisco WLC using IOS-XE CLI, including WPA3-Personal security, and to complete a wireless client association with DHCP.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The configuration order follows the Cisco IOS-XE WLC CLI: first enter global config, create the WLAN profile, set security (WPA3-Personal/SAE), enable the WLAN, then the client associates and gets an IP via DHCP.

Exam trap

Be careful with the order of operations: you must create the WLAN profile first, then configure security, then enable the WLAN. Also, remember that DHCP IP assignment occurs after the client associates, not before.

Practice this question →

195

MCQmedium

A network technician is troubleshooting a connectivity issue between two hosts. Host A sends a web request to Host B. The technician captures packets on the link between the two hosts and sees the data as '01010101...'. At which layer of the OSI model is this data being transmitted, and what is the correct PDU name for this layer?

A.Data Link layer; frames

B.Physical layer; bits

C.Network layer; packets

D.Transport layer; segments

AnswerB

The Physical layer (Layer 1) is responsible for the transmission and reception of unstructured raw bit streams over a physical medium, such as copper wire, fiber, or radio waves. At this layer, the PDU is simply the bit, and there is no recognition of packets, frames, or segments—only signaling states that represent 0s and 1s. The captured data '01010101...' exactly matches this definition, making 'Physical layer; bits' the correct answer.

Why this answer

The data shown as '01010101...' represents raw binary bits being transmitted over the physical medium. At the Physical layer (Layer 1), data is encoded as electrical signals, light pulses, or radio waves, and the PDU is called bits. This matches the description of the captured data.

Exam trap

Cisco often tests the distinction between the Physical layer's raw bits and the Data Link layer's frames, expecting candidates to recognize that binary sequences without structure belong to Layer 1, not Layer 2.

Why the other options are wrong

The technician sees raw bits before framing, so this is not the Data Link layer.

The Network layer deals with logical addressing and routing, not the physical transmission of bits.

The Transport layer is above the Physical layer and does not deal with bit-level transmission.

Practice this question →

196

MCQhard

A host uses subnet mask 255.255.255.224. How many total addresses exist in each subnet block?

A.16

B.32

C.30

D.64

AnswerB

The subnet mask 255.255.255.224 has 27 network bits, denoted as /27. The total number of addresses in a subnet is calculated as 2^(32-27) = 2^5 = 32. This total includes both the network address and the broadcast address, so the full address block size is 32 addresses.

Why this answer

The subnet mask 255.255.255.224 (/27) has 5 host bits, so each subnet has 2^5 = 32 total addresses. Option A (16) results from confusing /27 with /28 (4 host bits = 16). Option D (64) results from confusing /27 with /26 (6 host bits = 64).

Option C (30) is the number of usable host addresses (32 - 2 = 30), not the total addresses asked for in the question.

Exam trap

Be careful to distinguish between total addresses and usable addresses. Many candidates automatically think of usable addresses when subnetting.

Why the other options are wrong

16 would be the total addresses for a /28 mask (4 host bits), not the /27 mask specified.

30 is the number of usable host addresses (total addresses minus network and broadcast), not the total addresses.

64 would be the total addresses for a /26 mask (6 host bits), not the /27 mask specified.

Practice this question →

197

Multi-Selectmedium

Which TWO statements correctly describe differences between 802.11ac (Wi-Fi 5) and 802.11ax (Wi-Fi 6)?

Select 2 answers

A.802.11ac uses OFDMA, while 802.11ax uses only OFDM.

B.802.11ax supports 1024-QAM modulation, whereas 802.11ac supports up to 256-QAM.

C.Both 802.11ac and 802.11ax operate exclusively in the 5 GHz band.

D.802.11ax operates in both the 2.4 GHz and 5 GHz bands, while 802.11ac operates only in the 5 GHz band.

E.802.11ac introduces target wake time (TWT) for improved power saving, but 802.11ax does not support it.

AnswersB, D

802.11ax increases the maximum modulation order to 1024-QAM, encoding 10 bits per subcarrier symbol, whereas 802.11ac caps at 256-QAM, encoding 8 bits per symbol. This yields a raw data rate increase of roughly 25% at equivalent channel width and coding rate, but only when signal-to-noise ratio is sufficient to support the denser constellation without excessive bit errors.

Why this answer

Options B and D are correct. 802.11ax (Wi-Fi 6) introduces 1024-QAM for higher data rates (B), while 802.11ac maxes at 256-QAM. Additionally, 802.11ax supports both 2.4 GHz and 5 GHz bands, whereas 802.11ac is limited to 5 GHz only (D). Option A is incorrect because it reverses the roles: 802.11ac uses OFDM, and 802.11ax uses OFDMA.

Option C is incorrect because 802.11ax also operates in 2.4 GHz. Option E is incorrect because Target Wake Time (TWT) is introduced in 802.11ax, not 802.11ac.

Exam trap

Cisco often tests the misconception that 802.11ac also uses OFDMA or that both standards operate in the same frequency bands, so candidates must remember that OFDMA is exclusive to 802.11ax and that 802.11ac is 5 GHz only.

Why the other options are wrong

This statement reverses the technologies: 802.11ac uses OFDM, and 802.11ax uses OFDMA.

802.11ax adds 2.4 GHz support for backward compatibility and better range.

TWT is a feature of 802.11ax, not 802.11ac.

Practice this question →

198

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure a WPA3 SSID on a Cisco WLC and complete a wireless client association.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The steps follow the standard WLC configuration sequence: create the WLAN, set WPA3-Personal security, enable it, then the client associates and gets an IP.

Exam trap

The trap is that candidates may think security can be configured after enabling the WLAN, or that client IP assignment occurs before association. Remember: always configure all settings before enabling the WLAN, and client DHCP occurs after association.

Practice this question →

199

MCQhard

An IPv6 host has a global unicast address and a correct default route learned from a router advertisement, but the next-hop entry shown on the host uses a link-local address rather than a global unicast address. What is the best explanation?

A.IPv6 hosts commonly use the router’s link-local address as the next hop on the local segment.

B.The host has learned the wrong default route because IPv6 gateways must always be global unicast.

C.The host can reach only local destinations when the next hop is link-local.

D.The router advertisement has failed because it did not provide a MAC address.

AnswerA

In IPv6, routers send Router Advertisements (RAs) on the local link with their link-local address as the source and as the advertised next-hop address. Hosts install a default route (::/0) pointing to that link-local address, which is reachable on the same link. This is standard operation; global unicast addresses are not required—or even preferred—for next-hop determination.

Why this answer

That behavior is normal in IPv6. In practical terms, the host only needs to reach the router on the local segment, so it uses the router’s link-local address as the next-hop target. The packet still leaves the local link toward remote destinations, but the immediate neighbor on that link is identified by link-local addressing.

This is an important IPv6 concept because many people assume the default gateway must be a globally routable address. It does not. On the local link, the host is really forwarding to its directly attached router interface, and the router’s link-local address is enough for that local handoff.

Exam trap

Don't assume that a default gateway must be a global unicast address in IPv6; link-local addresses are used for local communication.

Why the other options are wrong

This option is incorrect because IPv6 gateways do not have to be global unicast; link-local addresses are valid for routing within the local network segment. The host can use the link-local address of the router as the next hop for packets destined to other networks.

This option is incorrect because a host with a link-local next hop can still reach global unicast addresses, as link-local addresses are used only for communication within the same local network segment.

This option is wrong because a router advertisement does not need to provide a MAC address for the next-hop link-local address to be valid; link-local addresses are inherently usable for local communication without MAC address specification.

Practice this question →

200

Multi-Selectmedium

Which statement correctly describes a feature of WPA3 security in wireless LANs?

Select 1 answer

A.WPA3 uses TKIP encryption for backward compatibility with legacy devices.

B.WPA3 introduces Simultaneous Authentication of Equals (SAE) to resist offline dictionary attacks.

C.WPA3 relies solely on 802.1X/EAP authentication for both personal and enterprise modes.

D.WPA3 mandates the use of GCMP-256 encryption for enhanced security.

E.WPA3 makes Protected Management Frames (PMF) optional to support older clients.

AnswersB

WPA3 replaces the pre-shared key (PSK) four-way handshake with the Simultaneous Authentication of Equals (SAE) protocol, also known as Dragonfly. SAE uses a secure password-authenticated key exchange that provides forward secrecy and prevents an attacker from capturing the handshake and performing offline dictionary or brute-force attacks. Even if the password is weak, each guess requires interaction with the network, greatly increasing the difficulty of compromise.

Why this answer

WPA3 introduces Simultaneous Authentication of Equals (SAE), which uses a Dragonfly key exchange to resist offline dictionary attacks and provide forward secrecy. Option A is wrong because WPA3 does not use or support TKIP encryption; it mandates AES. Option C is wrong because WPA3-Personal uses SAE, not 802.1X/EAP.

Option D is wrong because GCMP-256 is only mandatory in the optional WPA3-Enterprise 192-bit security mode, not across all WPA3 deployments; standard WPA3-Personal uses AES-GCMP with 128-bit keys. Option E is wrong because WPA3 requires Protected Management Frames (PMF) by default, unlike WPA2.

Exam trap

Many candidates incorrectly assume WPA3 universally uses GCMP-256 encryption, confusing the optional enterprise mode with the baseline WPA3-Personal requirement.

Why the other options are wrong

WPA3 mandates AES encryption and does not include TKIP for any compatibility; TKIP was deprecated in WPA2.

WPA3-Personal uses SAE, not 802.1X/EAP; only WPA3-Enterprise relies on 802.1X.

GCMP-256 is only mandated in the optional WPA3-Enterprise 192-bit mode; standard WPA3 uses GCMP with 128-bit keys.

Protected Management Frames (PMF) are required, not optional, in WPA3 to mitigate management frame attacks.

Practice this question →

201

PBQhard

You are connected to R1. The link between R1 and R2 is experiencing packet loss and slow performance. Examine the following partial show interface output: R1# show interfaces gigabitEthernet 0/0 GigabitEthernet0/0 is up, line protocol is up Duplex: Full, Speed: Auto, 100Mb/s Input errors: 12345, CRC: 5000, frame: 0, overrun: 0, ignored: 0 R2# show interfaces gigabitEthernet 0/0 GigabitEthernet0/0 is up, line protocol is up Duplex: Half, Speed: Auto, 100Mb/s Input errors: 0, CRC: 0, collisions: 5000, late collisions: 0 Identify the root cause of the issue, and apply the necessary fix on R1 to resolve the problem.

Network Topology

Hints

•Look at the number of input errors versus CRC errors.
•Check the duplex setting on both interfaces.
•A high number of input errors without CRC often indicates a duplex mismatch.

A.Configure the interface with 'duplex half' to match the half-duplex setting on R2.

B.Configure the interface with 'speed 100' to force the link speed to 100 Mbps.

C.Replace the Ethernet cable with a new one to fix the physical layer issue.

D.Configure the interface with 'no shutdown' to bring the interface up.

AnswerA

solution

! R1
interface gigabitethernet0/0
duplex half

Why this answer

The output reveals a duplex mismatch. R1 is operating in full‑duplex mode, while R2 is in half‑duplex mode. On the full‑duplex side (R1), simultaneous transmissions from both ends result in corrupted frames, visible as a high count of CRC errors.

On the half‑duplex side (R2), ordinary collisions occur because R2 uses CSMA/CD, but no CRC errors are seen because it detects collisions and retransmits. The only immediate fix from R1—since R2 is fixed at half‑duplex—is to change R1's interface to half‑duplex using the command 'duplex half', which matches the settings and stops the corrupted frames. (Long‑term, both sides should ideally be set to full‑duplex, but that requires access to R2.)

Exam trap

A common mistake is to misinterpret the presence of CRC errors on R1 as indicating a cable fault. In a duplex mismatch, the full-duplex side (R1) experiences collisions that manifest as CRC errors (since it does not use CSMA/CD), while the half-duplex side (R2) shows collisions but no CRC errors. Therefore, high CRC errors on one side with no CRC errors but many collisions on the other side is a classic sign of a duplex mismatch, not a physical layer issue.

Why the other options are wrong

The specific factual error is that speed mismatch does not cause the high input error count without CRC errors; duplex mismatch does.

The specific factual error is that cable issues produce CRC errors, not just input errors; the absence of CRC errors rules out cable problems.

The specific factual error is that 'no shutdown' is used to enable an interface that is administratively down; here the interface is up and passing traffic.

Practice this question →

202

MCQmedium

A host with IP address 172.16.50.130 and mask 255.255.255.192 needs to reach 172.16.50.190. Which statement is correct?

A.The destination is on a remote subnet, so the host must send to the default gateway.

B.The destination is local, so the host ARPs for 172.16.50.190 directly.

C.The destination is a directed broadcast for the local subnet.

D.The source host is using the network address of the subnet.

AnswerB

With a /26 mask, 172.16.50.130 and 172.16.50.190 both reside in the 172.16.50.128/26 subnet, whose broadcast address is .191. Because the destination is on the same data-link segment, the host does not involve the default gateway; instead, it sends an ARP request for .190 and forwards the frame directly to that resolved MAC address.

Why this answer

Both 172.16.50.130 and 172.16.50.190 fall within the 172.16.50.128/26 subnet (range .128 to .191). Therefore, the destination is local, and the host will use ARP to resolve the destination IP directly. Option A is incorrect because the destination is not remote.

Option C is incorrect because the directed broadcast address for this subnet is 172.16.50.191, not .190. Option D is incorrect because 172.16.50.130 is a valid host address, not the network address (.128).

Exam trap

Be cautious of subnet mask calculations and ensure you understand the IP range it defines.

Why the other options are wrong

The destination is local to the same /26 subnet, so it does not need to go through the default gateway.

The subnet directed broadcast is 172.16.50.191 (the last address in the .128/26 range), not .190.

The source address 172.16.50.130 is a usable host address, not the network address of the subnet.

Practice this question →

203

Multi-Selectmedium

Which TWO statements about fiber optic cables and SFP/SFP+ transceivers are correct?

Select 2 answers

A.Single-mode fiber (SMF) uses a smaller core diameter than multimode fiber (MMF).

B.Multimode fiber supports longer distances than single-mode fiber.

C.SFP+ transceivers are commonly used for 10 Gigabit Ethernet connections.

D.SFP modules support data rates up to 10 Gbps.

E.Multimode fiber typically has a core diameter of 9 microns.

AnswersA, C

Single-mode fiber is engineered with a much smaller core—typically 9 microns—compared to multimode fiber's 50- or 62.5-micron core. This narrow core forces light to travel in a single straight path, virtually eliminating modal dispersion. As a result, SMF supports longer transmission distances and higher bandwidth than MMF, which is why it is used for long-haul and carrier-grade links.

Why this answer

Single-mode fiber (SMF) has a core diameter of about 9 microns, which is smaller than multimode fiber (MMF) cores of 50 or 62.5 microns. Option C is correct because SFP+ transceivers are indeed designed for 10 Gigabit Ethernet, supporting data rates up to 10 Gbps. Option B is wrong because multimode fiber is used for shorter distances (up to a few hundred meters) due to higher modal dispersion, while single-mode fiber supports longer distances (tens of kilometers).

Option D is wrong because standard SFP modules support up to 1 Gbps, not 10 Gbps; SFP+ modules handle 10 Gbps. Option E is wrong because a 9-micron core is characteristic of single-mode fiber, not multimode fiber.

Exam trap

Cisco often tests the misconception that 'multimode' implies longer reach due to its name, but the opposite is true because of modal dispersion limits.

Why the other options are wrong

Single-mode fiber supports much longer distances (up to 10 km or more) than multimode fiber (typically up to 550 m for 10 Gbps).

SFP is limited to 1 Gbps; for 10 Gbps, SFP+ is required.

This describes single-mode fiber, not multimode.

Practice this question →

204

MCQhard

A subnet must support at least 62 usable IPv4 host addresses. Which prefix is the most restrictive that meets the requirement?

A./27

B./26

C./25

D./24

AnswerB

This is correct because /26 provides 62 usable host addresses.

Why this answer

A /26 is the smallest valid answer. In practical terms, a /26 provides 64 total addresses and 62 usable host addresses after subtracting the network and broadcast addresses. A /27 would be too small because it provides only 30 usable hosts.

This is a standard minimum-prefix question because it checks whether you can work backward from the host requirement and choose the smallest subnet that fits.

Exam trap

Avoid confusing total addresses with usable ones; remember to subtract network and broadcast addresses.

Why the other options are wrong

A /27 subnet provides only 30 usable host addresses (32 total minus 2 for network and broadcast), which does not meet the requirement of at least 62 usable addresses.

Option C: /25 provides 126 usable host addresses, which exceeds the requirement of at least 62 usable addresses. However, it is not the smallest prefix that meets the requirement, as /26 suffices with 62 usable addresses.

Option D: /24 provides 256 total addresses, with 254 usable, which exceeds the requirement of at least 62 usable addresses. However, it is not the smallest prefix that meets the requirement.

Practice this question →

205

MCQmedium

A network administrator is configuring a new Windows 10 workstation on a network that uses DHCP. The workstation receives an IPv4 address of 169.254.10.20 with a subnet mask of 255.255.0.0 and no default gateway. The user cannot access the internet or other subnets. What is the most likely cause of this issue?

A.The workstation has a duplicate IP address conflict.

B.The workstation's DNS server configuration is incorrect.

C.The workstation's subnet mask is misconfigured.

D.The DHCP server is unreachable or not responding.

AnswerD

When a DHCP client fails to receive an IP address from a DHCP server, it self-assigns an APIPA address from the 169.254.0.0/16 range. This explains the observed address and the absence of a default gateway.

Why this answer

The IP address 169.254.10.20 with a /16 subnet mask is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP discovery broadcast (DHCPDISCOVER) fails to receive a response from a DHCP server. Without a valid DHCP lease, the workstation has no default gateway, so it cannot communicate outside its local subnet, explaining the lack of internet or inter-subnet access. The most likely cause is that the DHCP server is unreachable or not responding, forcing the client to self-assign an APIPA address.

Exam trap

Cisco often tests the misconception that a 169.254.x.x address indicates a duplicate IP or a subnet mask issue, but the real trap is that APIPA is a direct symptom of DHCP server unavailability, not a configuration error on the client.

Why the other options are wrong

Duplicate IP conflicts typically result in a warning but do not cause the system to assign a 169.254.x.x address.

DNS issues do not affect IP address assignment via DHCP.

The subnet mask is correct for the APIPA range; the problem is the lack of a DHCP server response.

Practice this question →

206

MCQhard

A network requires at least 500 usable host addresses in one IPv4 subnet. Which prefix is the smallest that meets the requirement?

A./24

B./23

C./22

D./25

AnswerB

This is correct because a /23 provides 510 usable host addresses.

Why this answer

To support at least 500 usable hosts, the subnet must provide at least 502 total addresses when the network and broadcast addresses are included. In plain language, that means 256 total addresses in a /24 are not enough, so the next larger power-of-two block is required. A /23 provides 512 total addresses and 510 usable host addresses, which satisfies the requirement while remaining the smallest valid option.

This is a classic host-capacity question because it checks whether you can work backward from a required usable host count and choose the smallest prefix that works without wasting more space than necessary.

Exam trap

Be careful not to confuse the total number of addresses with the number of usable host addresses. Remember to account for network and broadcast addresses.

Why the other options are wrong

A /24 subnet provides only 256 usable host addresses, which is insufficient for the requirement of at least 500 usable addresses. Therefore, it cannot be the correct answer.

Option C (/22) provides 1022 usable addresses, which exceeds the requirement of 500 usable addresses, but it is not the smallest prefix that meets the requirement. The correct answer is /23, which provides exactly 510 usable addresses.

Option D: /25 provides only 126 usable host addresses, which is insufficient for a requirement of at least 500 usable addresses in a single subnet.

Practice this question →

207

Multi-Selecteasy

An engineer is reviewing transport protocols for a new application. Which two characteristics are associated with TCP rather than UDP?

Select 2 answers

A.Connection establishment before data transfer

B.Best-effort delivery with no acknowledgments

C.Sequencing and retransmission support

D.Lower overhead because no session state is tracked

AnswersA, C

TCP performs a three-way handshake (SYN, SYN-ACK, ACK) to establish a connection before any application data is transmitted, ensuring both hosts are synchronized and ready. This connection-oriented process negotiates initial sequence numbers and window sizes, providing a reliable session foundation. UDP, in contrast, sends datagrams immediately without any setup, so this behavior is uniquely characteristic of TCP and therefore correct.

Why this answer

TCP is connection-oriented and provides reliability with sequence numbers, acknowledgments, and retransmissions. UDP is lighter but does not guarantee delivery.

Exam trap

Don't confuse reliability with speed; TCP's reliability features add overhead, making it slower than UDP.

Why the other options are wrong

Best-effort delivery with no acknowledgments is a characteristic of UDP, not TCP. TCP provides reliable delivery with acknowledgments and retransmission.

TCP has higher overhead because it maintains session state (sequence numbers, acknowledgments, etc.), while UDP is stateless and has lower overhead. The question asks for characteristics of TCP, not UDP.

Practice this question →

208

MCQhard

A host uses address 192.168.5.126/25. Which address is the broadcast address for its subnet?

A.192.168.5.63

B.192.168.5.127

C.192.168.5.128

D.192.168.5.255

AnswerB

The /25 CIDR notation specifies a subnet mask of 255.255.255.128, meaning the first 25 bits define the network portion. For the host 192.168.5.126, the network address is 192.168.5.0, as the 25th bit is 0. This subnet, 192.168.5.0/25, encompasses IP addresses from 192.168.5.0 to 192.168.5.127. The broadcast address is always the last address in the subnet range, where all host bits are set to one, which in this scenario is 192.168.5.127.

Why this answer

A /25 divides the /24 into two halves: 0–127 and 128–255. In plain language, the host address 192.168.5.126 is in the lower half, which runs from .0 through .127. The last address in that block is the broadcast address, so the broadcast is 192.168.5.127.

This is a classic subnetting question because it checks whether you can identify the correct block and then select the last address in that block as the broadcast address.

Exam trap

Remember that the broadcast address is the last address in the subnet, not the first address of the next subnet or the broadcast for the entire /24.

Why the other options are wrong

Option A (192.168.5.63) is incorrect because it does not fall within the subnet defined by the address 192.168.5.126/25, which has a valid range of 192.168.5.128 to 192.168.5.255 for host addresses.

The address 192.168.5.128 is incorrect because it falls outside the subnet defined by 192.168.5.126/25, which includes addresses from 192.168.5.0 to 192.168.5.127. The broadcast address for this subnet is 192.168.5.127.

Option D, 192.168.5.255, is incorrect because it is the broadcast address for the entire 192.168.5.0/24 subnet, not the /25 subnet specified in the question.

Practice this question →

209

MCQhard

A subnet has the network address 192.168.20.128/26. What is the broadcast address?

A.192.168.20.159

B.192.168.20.191

C.192.168.20.192

D.192.168.20.255

AnswerB

192.168.20.191 is the broadcast address for the 192.168.20.128/26 subnet. A /26 prefix leaves 6 host bits (32-26=6), yielding 2^6=64 addresses per subnet. Starting at network address .128, the valid addresses run from .129 through .190, and .191 is the final address (broadcast) before the next subnet begins at .192.

Why this answer

A /26 subnet uses blocks of 64 addresses. In plain language, the block that starts at 192.168.20.128 runs through 192.168.20.191. The first address in that block is the network address, and the last address is the broadcast address. That means the broadcast address is 192.168.20.191.

This is a standard subnetting calculation. Once the block size is identified, the broadcast address is simply the last address in the block.

Exam trap

Be careful not to confuse the broadcast address with the first address of the next subnet or with the broadcast address of a different subnet mask.

Why the other options are wrong

Option A (192.168.20.159) is incorrect because the broadcast address for the subnet 192.168.20.128/26 is 192.168.20.191, calculated as the highest address in the subnet range from 192.168.20.128 to 192.168.20.191.

The option C, 192.168.20.192, is incorrect because it falls outside the range of the subnet defined by 192.168.20.128/26, which has a valid broadcast address of 192.168.20.191.

The broadcast address for the subnet 192.168.20.128/26 is 192.168.20.191, not 192.168.20.255. The address 192.168.20.255 is the broadcast address for the entire 192.168.20.0/24 network, which is not relevant to the specified subnet.

Practice this question →

210

PBQmedium

You are connected to the console of SW1. The network administrator reports that a workstation connected to interface FastEthernet0/1 cannot communicate with the rest of the network. The workstation is configured for VLAN 10, but the interface is in VLAN 1.

Hints

•Use 'show vlan brief' to see VLAN assignments.
•The interface is currently in VLAN 1.
•Change the access VLAN to 10.

A.Configure the interface as a trunk port.

B.Configure the interface as an access port and assign it to VLAN 10.

C.Configure the interface as a trunk port and allow VLAN 10.

D.Configure the interface as a dynamic desirable port.

AnswerB

solution

! SW1
interface FastEthernet0/1
switchport access vlan 10

Why this answer

The port was in VLAN 1 instead of VLAN 10. By configuring 'switchport access vlan 10', the workstation is now in the correct VLAN and can communicate with the rest of the network.

Exam trap

This question tests your understanding of access ports versus trunk ports and how to assign a VLAN to an access port. A common trap is to think that trunking is needed to carry VLAN traffic, but for end devices, access ports are used. Remember that 'switchport access vlan' is the command to assign a VLAN to an access port.

Why the other options are wrong

Trunk ports are used to carry multiple VLANs between switches, not to assign a single workstation to a specific VLAN.

Trunk ports are designed to carry multiple VLANs and are typically used between switches, not for end-user devices.

DTP modes control whether a port becomes a trunk or remains an access port; they do not change the access VLAN.

211

MCQmedium

A branch LAN requires 50 usable IPv4 host addresses. What is the most efficient subnet mask that provides at least 50 usable hosts?

A./27

B./26

C./25

D./24

AnswerB

A /26 prefix has 6 host bits, so 2^6 = 64 total addresses, minus 2 for network and broadcast gives 62 usable hosts. This exactly satisfies the requirement of 50 usable addresses with headroom for future growth, and is the smallest prefix that meets the need, avoiding unnecessary address waste.

Why this answer

A /26 provides 64 total addresses and 62 usable host addresses, which is the smallest subnet mask (largest prefix length) that fits 50 hosts, making it the most efficient choice.

Exam trap

Read the requirement carefully. Cisco often uses subtle wording like 'most efficient' or 'industry standard' to eliminate technically correct but non-optimal answers.

Why the other options are wrong

A /27 subnet provides only 30 usable host addresses, which is insufficient for the requirement of 50 usable addresses. Therefore, it does not meet the needs of the branch LAN.

Option C: /25 provides 126 usable addresses, which exceeds the requirement of 50 usable addresses. However, it is not the smallest prefix that meets the requirement.

Option D, /24, provides 256 total addresses, which exceeds the requirement of 50 usable addresses. However, it is not the smallest prefix that meets the requirement, as /26 provides 64 addresses, which is sufficient and more efficient.

Practice this question →

212

PBQhard

You are connected to R1. The link between R1 and R2 is down. The output of 'show interfaces gigabitEthernet0/0' on R1 shows: 'GigabitEthernet0/0 is administratively down, line protocol is down (disabled)', with IP address 203.0.113.1/30, MTU 1500, and no input/output errors. Determine the root cause and configure the necessary fix to bring the interface up and restore connectivity.

Network Topology

Hints

•Check the interface status: 'show interfaces' reveals administratively down.
•The 'shutdown' command disables the interface; use 'no shutdown' to enable it.
•After enabling, verify with 'show ip interface brief'.

A.Enter interface configuration mode for GigabitEthernet0/0 and issue the 'no shutdown' command.

B.Enter interface configuration mode and issue the 'speed 100' command to match the remote interface speed.

C.Enter interface configuration mode and issue the 'duplex full' command to force full-duplex operation.

D.Enter interface configuration mode and issue the 'no keepalive' command to disable keepalives.

AnswerA

solution

! R1
configure terminal
interface gigabitethernet0/0
no shutdown

Why this answer

The interface status 'administratively down' means the interface was manually shut down using the 'shutdown' command. To bring it up, you must enter interface configuration mode and issue 'no shutdown', which administratively enables the interface. The other options are incorrect: setting speed to 100 Mbps or forcing full-duplex will not fix an administratively down state, and disabling keepalives is unrelated to the interface being disabled.

Exam trap

Candidates often miss the 'administratively down' keyword in show interfaces output and instead look for speed/duplex mismatches; always read the interface status first.

Why the other options are wrong

A speed mismatch would show 'up, line protocol down' and possibly increased input errors, but the interface here is 'administratively down'—manually disabled.

A duplex mismatch would cause late collisions or CRC errors, not an 'administratively down' status, which indicates a shutdown state.

Disabling keepalives has no effect on 'administratively down' because the interface is disabled at the administrative level, not because of a keepalive failure.

Practice this question →

213

MCQhard

A host is configured with 10.1.1.34/30. Which address is the broadcast address for its subnet?

A.10.1.1.31

B.10.1.1.35

C.10.1.1.32

D.10.1.1.36

AnswerB

The /30 subnet mask specified for the host 10.1.1.34 allocates two bits for host addresses. This creates a subnet containing four addresses in total. The network address for 10.1.1.34/30 is 10.1.1.32, where all host bits are zero. Consequently, the broadcast address is the last address in this subnet, where all host bits are set to one, which calculates to 10.1.1.35.

Why this answer

A /30 subnet has a block size of 4. In practical terms, the last-octet blocks are 0–3, 4–7, 8–11, and so on. Because 34 falls within the 32–35 block, the broadcast address is the last address in that block: 10.1.1.35.

This question tests whether you can identify the correct subnet block before choosing the broadcast address.

Exam trap

Ensure you correctly identify the subnet range and understand the roles of network, host, and broadcast addresses.

Why the other options are wrong

The address 10.1.1.31 is incorrect as a broadcast address for the subnet 10.1.1.34/30; the correct broadcast address is 10.1.1.35, derived from the subnet mask which allows for only 4 IP addresses (10.1.1.34 to 10.1.1.37).

The address 10.1.1.32 is not the broadcast address for the subnet 10.1.1.34/30; instead, it is the network address for the subnet, which is 10.1.1.32 to 10.1.1.35.

The address 10.1.1.36 is incorrect because it exceeds the valid range for a /30 subnet, which only allows for four IP addresses (two usable hosts, one network, and one broadcast). The broadcast address for the subnet 10.1.1.34/30 is 10.1.1.35.

Practice this question →

214

MCQhard

A network technician connects a new Cisco switch to an existing access switch using a Category 5e copper patch cable. The link fails to come up, and the interface status shows 'err-disabled'. The technician checks the interface diagnostics and the running configuration. What action should the technician take to resolve the problem?

A.Replace the Category 5e cable with a Category 6 cable to support Gigabit Ethernet.

B.Configure the interface as a trunk port and disable spanning-tree BPDU guard.

C.Replace the copper SFP with a fiber SFP to increase the distance.

D.Manually set the speed and duplex to 1000 Mbps and full duplex on both switches.

AnswerB

The port is in err-disabled because bpduguard is enabled. Since this is a connection between two switches, the port should be configured as a trunk (or at least not as an access port with portfast) and bpduguard should be disabled to prevent the errdisable state.

Why this answer

The most likely reason for the err-disabled state is a spanning-tree BPDU guard violation on the access switch's port configured with PortFast. When another switch is connected, it sends BPDUs, triggering BPDU guard to error-disable the port. Configuring the interface as a trunk port and disabling BPDU guard (option B) resolves the issue by allowing BPDUs without triggering the protection.

Option A is unnecessary because Category 5e supports Gigabit Ethernet. Option C is irrelevant since the problem is not distance-related. Option D is risky because auto-negotiation is preferred and manual settings can cause mismatches.

Exam trap

Cisco often tests the misconception that err-disabled is always caused by speed/duplex mismatches or cable issues, but the trap here is that BPDU guard on a PortFast access port is a frequent and specific cause when connecting another switch.

Why the other options are wrong

The symptom is err-disabled, not a speed or duplex mismatch; cable type is not the issue.

The port is a built-in copper port, not an SFP-based interface; distance is not the issue.

The err-disabled state is due to BPDU guard, not speed/duplex mismatch; manual settings would not fix the root cause.

Practice this question →

215

MCQhard

A network engineer is troubleshooting a link between two Cisco Catalyst 9300 switches that are connected via a single-mode fiber optic cable. The link is up, but the interface counters show a high number of CRC errors and frame check sequence (FCS) errors. The interface is configured for 1000 Mbps and full duplex on both ends. What is the most likely cause of these errors?

A.A speed or duplex mismatch between the two switches

B.Faulty or dirty fiber optic cable or connectors

C.Incorrect SFP+ module type inserted in the switch

D.Excessive cable length beyond the distance limit

AnswerB

The diagnostic optical monitoring (DOM) reports a receive power of -20 dBm on SwitchA, which falls well below the typical receive sensitivity range for 10GBASE-LR modules (often around -14.4 dBm for 10 Gbps, though less sensitive for 1 Gbps). Such excessive optical loss is usually caused by contamination on the fiber end faces, damaged fiber, or poor splices/connectors. Since the transmit power on the remote side may be within normal range, the large difference points to a physical-layer attenuation rather than a module failure.

Why this answer

CRC and FCS errors indicate corruption at the data-link layer, typically caused by physical-layer issues such as signal degradation. Since the link is up and both ends are configured for 1000 Mbps full duplex, a speed/duplex mismatch is ruled out. Dirty or faulty single-mode fiber connectors or the cable itself can introduce optical signal loss or reflections, leading to bit errors that manifest as CRC/FCS errors.

Exam trap

Cisco often tests the distinction between CRC errors (physical-layer signal integrity) and duplex mismatch symptoms (late collisions, runts), leading candidates to incorrectly choose a speed/duplex mismatch when the interface counters show CRC errors.

Why the other options are wrong

The exhibit confirms consistent speed and duplex settings.

The modules are correctly identified and match the fiber type.

There is no evidence of the cable length in the exhibit, and the low power is more indicative of a physical fault rather than simply exceeding distance limits.

Practice this question →

216

Multi-Selectmedium

Which TWO statements about SFP transceivers and fiber optic cabling are correct?

Select 2 answers

A.SFP transceivers are permanently installed on the switch motherboard and cannot be replaced.

B.1000BASE-SX SFP transceivers are designed for multimode fiber and typically support distances up to 550 meters.

C.Multimode fiber typically uses laser-based transmitters for long-distance transmission.

D.Single-mode fiber (SMF) with 1000BASE-LX SFP transceivers can support distances up to 5 km.

E.Single-mode fiber has a larger core diameter than multimode fiber, allowing longer distances.

AnswersB, D

1000BASE-SX uses multimode fiber with a 850 nm wavelength and supports distances up to 550 m (depending on fiber grade).

Why this answer

1000BASE-SX SFP transceivers are designed for multimode fiber (MMF) and use short-wavelength lasers (850 nm). Over 50/125 µm MMF, they support up to 550 meters. Option D is correct because 1000BASE-LX SFP transceivers are designed for single-mode fiber (SMF) and support distances up to 5 km according to the IEEE 802.3 standard (not 10 km, which is typically a vendor-specific LH extension).

Option A is false because SFPs are hot-swappable pluggable modules, not permanently installed. Option C is false because multimode fiber typically uses LED or VCSEL transmitters for short distances, not lasers for long-haul. Option E is false because single-mode fiber has a smaller core diameter (8-10 µm) than multimode fiber (50-62.5 µm), which reduces modal dispersion and allows longer distances.

Exam trap

Cisco often tests the misconception that multimode fiber always uses lasers for long distances, when in fact multimode fiber is optimized for shorter runs with LED or VCSEL sources, while single-mode fiber uses lasers for extended reach.

Why the other options are wrong

This statement is false because SFP slots are designed for modular, replaceable transceivers.

Laser transmitters are used in single-mode fiber for longer distances; multimode uses LED/VCSEL.

Single-mode fiber has a smaller core, not larger. The smaller core reduces dispersion and allows longer reach.

Practice this question →

217

Multi-Selectmedium

Which TWO statements correctly describe the OSI model layers and their corresponding PDU names during encapsulation?

Select 2 answers

A.The Transport layer encapsulates data into segments.

B.The Network layer encapsulates segments into packets.

C.The Data Link layer encapsulates packets into bits.

D.The Session layer encapsulates segments into sessions.

E.The Physical layer encapsulates frames into bits.

AnswersA, B

The Transport layer encapsulates upper-layer data (from the Session layer or Application layer) by adding a TCP or UDP header to create a segment. This header includes source and destination port numbers, and for TCP also sequence numbers, acknowledgment numbers, and window size, enabling reliable end-to-end delivery. This process of dividing data and prepending transport control information is exactly what produces the segment PDU, making this statement correct.

Why this answer

Both A and B are correct. During encapsulation, the Transport layer (Layer 4) adds a header to upper-layer data to form segments, and the Network layer (Layer 3) encapsulates those segments into packets by adding a network-layer header (e.g., IP). Option C is incorrect because the Data Link layer encapsulates packets into frames, not bits; bits are the raw transmission unit at the Physical layer.

Option D is incorrect because the Session layer manages sessions but does not produce a PDU called 'sessions'; encapsulation of segments only occurs at Layers 4 and below. Option E is incorrect because the Physical layer transmits frames as bits but does not perform encapsulation; encapsulation ends at the Data Link layer.

Exam trap

Cisco often tests the specific PDU names at each layer (e.g., segment vs. packet vs. frame vs. bit) and the order of encapsulation, so the trap here is confusing the Data Link layer PDU (frame) with bits or mixing up the Session layer's role with encapsulation.

Why the other options are wrong

The Data Link layer encapsulates packets into frames, not bits; bits are the PDU of the Physical layer.

The Session layer handles session management and does not perform encapsulation into 'sessions'; encapsulation at this layer is not defined.

The Physical layer transmits frames as bits but does not encapsulate frames into bits; encapsulation ends at Layer 2.

Practice this question →

218

MCQhard

A host is configured as 172.16.20.190/26. Which range contains the usable host addresses for that subnet?

A.172.16.20.129 to 172.16.20.190

B.172.16.20.128 to 172.16.20.191

C.172.16.20.130 to 172.16.20.191

D.172.16.20.193 to 172.16.20.254

AnswerA

This is correct because .128 is the network and .191 is the broadcast.

Why this answer

A /26 uses blocks of 64 addresses. In practical terms, the fourth-octet ranges are 0–63, 64–127, 128–191, and 192–255. Since 190 falls inside the 128–191 block, the network address is .128 and the broadcast address is .191. That leaves .129 through .190 as the usable range.

This is a strong test of whether you can identify the correct block and then exclude the reserved boundary addresses correctly.

Exam trap

A frequent exam trap is selecting an answer range that includes the network or broadcast address as usable hosts. For example, option B lists 172.16.20.128 to 172.16.20.191, which incorrectly includes the network (.128) and broadcast (.191) addresses. These addresses are reserved and cannot be assigned to hosts.

Another trap is excluding valid host addresses or including addresses from adjacent subnets, as seen in options C and D. Misidentifying subnet boundaries or forgetting to exclude reserved addresses causes these errors, leading to incorrect subnetting answers.

Why the other options are wrong

Option B incorrectly includes the network address (172.16.20.128) and broadcast address (172.16.20.191) as usable hosts, which are reserved and cannot be assigned to devices, making this option invalid.

Option C excludes the first usable host address (172.16.20.129) and incorrectly includes the broadcast address (172.16.20.191), which is not assignable to hosts, thus making it an incorrect range.

Option D lists a range starting at 172.16.20.193, which belongs to the next subnet block (192–255) and does not include the IP 172.16.20.190, so it is unrelated and incorrect for this question.

Practice this question →

219

MCQhard

A host is assigned 192.168.10.33/28. Which subnet contains that host?

A.192.168.10.16/28

B.192.168.10.32/28

C.192.168.10.48/28

D.192.168.10.0/28

AnswerB

A /28 prefix length yields a block size of 16 addresses, so subnets are aligned on multiples of 16: 0, 16, 32, 48, and so on. The host address 192.168.10.33 falls in the range 32–47, making 192.168.10.32/28 the correct subnet. Within that block, .33 is a usable address, as the network and broadcast addresses are .32 and .47 respectively.

Why this answer

A /28 subnet uses blocks of 16 addresses. In plain language, the last octet ranges move in increments of 16: 0–15, 16–31, 32–47, 48–63, and so on. Since the host address ends in 33, it belongs to the 32–47 block. That means the containing subnet is 192.168.10.32/28.

This style of subnetting question is common because it tests whether you can identify the correct network boundary quickly. The key is to recognize the block size from the prefix and then place the address inside the correct interval without confusing the host with the network address.

Exam trap

Be careful not to confuse the host address with the network address or miscalculate the subnet boundaries.

Why the other options are wrong

Option A (192.168.10.16/28) is incorrect because it represents a different subnet, specifically the range 192.168.10.16 to 192.168.10.31, which does not include the host 192.168.10.33.

Option C is wrong because the host IP 192.168.10.33/28 falls within the subnet range of 192.168.10.32 to 192.168.10.47, making 192.168.10.48/28 an entirely different subnet that does not include the host.

Option D (192.168.10.0/28) is incorrect because it represents a different subnet than the one containing the host 192.168.10.33. The subnet for 192.168.10.33/28 is 192.168.10.32/28, which includes IPs from 192.168.10.32 to 192.168.10.47.

Practice this question →

220

PBQhard

You are connected to R1. The network team reports intermittent connectivity between R1 and R2. Examine the following `show interface` output from R1 to identify the root cause of the issue. Then apply the necessary configuration commands on R1 to resolve the problem. GigabitEthernet0/0 is up, line protocol is up Internet address is 10.0.0.1/30 MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is RJ45 output flow-control is unsupported, input flow-control is unsupported Last input 00:00:01, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 100 packets input, 8000 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 100 input errors, 100 CRC, 0 frame, 0 overrun, 0 ignored 0 output errors, 0 collisions, 0 interface resets 0 output buffer failures, 0 output buffers swapped out

Network Topology

Hints

•CRC errors often indicate a duplex mismatch or faulty cabling.
•Check if the interface has manual speed/duplex settings that may conflict with the remote device.
•The remote device likely uses auto-negotiation; match its settings.

A.Enter interface configuration mode for the problematic interface and issue the 'no speed' and 'no duplex' commands to revert to auto-negotiation.

B.Enter interface configuration mode and issue the 'speed 100' and 'duplex full' commands to ensure both sides are set to the same values.

C.Enter interface configuration mode and issue the 'no shutdown' command to bring the interface up.

D.Enter interface configuration mode and issue the 'duplex half' command to match the remote side's duplex setting.

AnswerA

solution

! R1
configure terminal
interface GigabitEthernet0/0
no speed
no duplex
end

Why this answer

The show interface output reveals 100 CRC errors and 100 input errors, indicating a physical layer problem. Additionally, the interface is manually configured for full-duplex and 100 Mb/s. CRC errors often point to a duplex mismatch or faulty cable.

Since R1 is set to full-duplex, if R2 is set to auto-negotiation (or half-duplex), a mismatch occurs. The fix is to set both sides to auto-negotiation by removing manual speed and duplex settings. On R1, enter interface configuration mode and issue 'no speed' and 'no duplex' to revert to auto-negotiation, then verify with 'show interfaces' that the interface negotiates to full-duplex and errors stop incrementing.

Exam trap

Do not assume that manually setting speed and duplex is always correct. CRC errors often point to a duplex mismatch, and the standard fix is to enable auto-negotiation on both ends. Also, remember that 'no shutdown' is for administratively down interfaces, not for error conditions.

Why the other options are wrong

The specific factual error is that reapplying the same manual settings does not resolve a duplex mismatch; it may even perpetuate the mismatch if the remote side is set to auto-negotiation.

The specific factual error is that 'no shutdown' is used to enable an interface that is administratively down, but the interface is already up.

The specific factual error is that forcing half-duplex is unlikely to resolve the issue; it may worsen performance and still cause errors if the remote side is full-duplex.

Practice this question →

221

MCQhard

A subnet has the network address 192.168.30.0/26. What is the broadcast address?

A.192.168.30.63

B.192.168.30.64

C.192.168.30.255

D.192.168.30.31

AnswerA

The /26 prefix length means 26 network bits, leaving 6 host bits, so the block size is 64 addresses. Since the network address is 192.168.30.0, the usable host range is .1 through .62, and the broadcast address is the last address in the block, which is .63. This is the directed broadcast for this specific /26 subnet.

Why this answer

A /26 subnet contains 64 addresses. In plain language, the block that starts at 192.168.30.0 runs through 192.168.30.63. The first address is the network address and the last address is the broadcast address, so the broadcast for this subnet is 192.168.30.63.

This is a standard subnet-boundary calculation. Once the block size is identified, the broadcast address is simply the final address in that block.

Exam trap

Remember that the broadcast address is the last address in the subnet, not the first address of the next subnet or the last usable host address.

Why the other options are wrong

Option B is incorrect because the broadcast address for the subnet 192.168.30.0/26 is 192.168.30.63, not 192.168.30.64. The address 192.168.30.64 is actually the first address of the next subnet (192.168.30.64/26).

The address 192.168.30.255 is incorrect as the broadcast address for the subnet 192.168.30.0/26, which only spans IPs from 192.168.30.0 to 192.168.30.63. The broadcast address for this subnet is 192.168.30.63.

Option D, 192.168.30.31, is incorrect because it represents the last usable IP address in the subnet 192.168.30.0/26, not the broadcast address. The broadcast address for this subnet is 192.168.30.63.

Practice this question →

222

PBQhard

You are troubleshooting connectivity for a wireless client connected to the home network shown below. The client has obtained an APIPA address (169.254.x.x), indicating DHCP failure. Verify the DHCP server configuration on R1 and correct the issue so that the client receives a valid IP address from the 192.168.1.0/24 subnet.

Network Topology

Hints

•Check if the DHCP service is enabled globally on R1.
•APIPA addresses indicate that the client did not receive a DHCP offer.
•The DHCP pool and interface configuration are correct; the missing piece is the global DHCP service.

A.Enable the DHCP service globally using the 'service dhcp' command on R1.

B.Remove the 'ip dhcp excluded-address 192.168.1.1 192.168.1.10' command because it excludes too many addresses.

C.Change the DHCP pool network to 192.168.1.0/24 and add the default-router 192.168.1.1 command.

D.Configure the 'ip helper-address' command on the client's VLAN interface to forward DHCP requests to the server.

AnswerA

solution

! R1
configure terminal
service dhcp
end

Why this answer

The client obtained an APIPA address (169.254.x.x) because DHCP was not assigning addresses. The DHCP pool is correctly configured, but the global DHCP service must be enabled with the 'service dhcp' command on R1. The excluded-address range (192.168.1.1–192.168.1.10) uses only a small fraction of the /24 subnet, so it is not the issue.

Enabling 'service dhcp' allows the router to process DHCP requests and assign addresses from the pool.

Exam trap

Trap: Candidates often focus on pool configuration (network, default-router, excluded-address) when troubleshooting DHCP failures, but they forget that the DHCP service must be enabled globally with 'service dhcp'. Always check if the service is running before modifying pool parameters.

Why the other options are wrong

The specific factual error: Excluding 10 addresses does not exhaust the pool; the pool still has 244 addresses available.

The specific factual error: The pool configuration is already correct; modifying it does not address the disabled DHCP service.

The specific factual error: 'ip helper-address' is for DHCP relay across subnets; it is not needed when the server is local.

Practice this question →

223

PBQhard

You are troubleshooting a link between R1 (G0/0) and R2 (G0/0). The link is up but experiencing packet loss. You suspect an interface speed/duplex mismatch or SFP issue. Configure R1's interface to match the correct speed and duplex, and replace the SFP module if necessary to support a required distance of 40 km over single-mode fiber.

Network Topology

Hints

•Check the current speed and duplex configuration under the interface.
•Check the SFP module distance rating using 'show interfaces transceiver'.
•Remove explicit speed and duplex commands to allow auto-negotiation.

A.Remove manual speed/duplex settings, enable auto-negotiation, and replace the SFP with a long-reach module (e.g., 1000BASE-ZX) that supports 40 km over single-mode fiber.

B.Change the duplex to full and speed to 1000 Mbps manually, and keep the existing SFP.

C.Keep the manual speed/duplex settings but replace the SFP with a 1000BASE-SX module.

D.Enable auto-negotiation on both ends but keep the existing SFP.

AnswerA

solution

! R1
interface gigabitethernet 0/0
no speed
no duplex
end
copy running-config startup-config

Why this answer

The link is experiencing packet loss, likely due to a speed/duplex mismatch between the manually configured interface and the peer (which may use auto-negotiation) and/or an SFP module that cannot support the required 40 km distance over single-mode fiber. To resolve both potential issues, remove any manual speed and duplex settings to restore default auto-negotiation (using 'no speed' and 'no duplex'), and replace the SFP with a module rated for 40 km or more on SMF, such as a 1000BASE-ZX (or 1000BASE-EX) transceiver. Standard 1000BASE-LX/LH only reaches up to 10 km on SMF, so it is insufficient for this scenario.

Exam trap

This question tests your ability to identify and resolve both a speed/duplex mismatch and an SFP distance limitation. A common trap is to focus on only one issue (e.g., only fixing the mismatch or only replacing the SFP) while ignoring the other. Always verify that the SFP supports the required distance and fiber type.

Why the other options are wrong

The specific factual error is that manually setting speed/duplex does not guarantee compatibility with the remote end and does not address the SFP distance limitation.

The specific factual error is that 1000BASE-SX is for multimode fiber and short distances, not single-mode fiber at 40 km.

The specific factual error is that the SFP distance limitation is not addressed; auto-negotiation alone does not change the physical layer capability.

Practice this question →

224

Matchingmedium

Match each networking concept to its most accurate role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Defines network versus host portions of the address

Next hop used for off-subnet traffic

Local Layer 2 address for frame delivery

Data structure used to choose packet-forwarding paths

Why these pairings

Unicast communication involves one-to-one transmission between a single sender and a single receiver. Broadcast is one-to-all communication, where a packet is sent to every device on the local subnet. Multicast is one-to-many communication, where a single sender transmits to a specific group of interested receivers.

Anycast is one-to-one-of-many, where a packet is delivered to the nearest node among a group of potential receivers, typically used for services like DNS. The other options are incorrectly defined: Broadcast is not one-to-closest (that is anycast), Multicast is not one-to-all (that is broadcast), and Anycast is not one-to-group (that is multicast). Therefore, only option A is correctly matched.

Exam trap

Candidates often confuse multicast and anycast: multicast delivers to all members of a group, while anycast delivers to only the closest member. Also, broadcast is often mistakenly thought to be one-to-closest, but it is one-to-all.

Practice this question →

225

MCQhard

A network engineer is troubleshooting a link between two Cisco switches that are connected via a 1000BASE-LX SFP transceiver. Hosts on VLAN 10 on Switch A cannot ping the default gateway on Switch B. The interface on Switch A is up, but the engineer notices CRC errors incrementing. What should the engineer do to resolve this issue?

A.Replace the SFP with a 1000BASE-SX transceiver

B.Use a mode-conditioning patch cable between the SFP and the fiber patch panel

C.Configure the same VLAN on both switch interfaces

D.Replace the fiber cable with a single-mode fiber cable

AnswerB

A mode-conditioning patch cable corrects the mismatch when using a single-mode transceiver over multimode fiber, preventing signal dispersion.

Why this answer

The 1000BASE-LX SFP transceiver operates at 1310 nm over single-mode fiber (SMF). When connected to multimode fiber (MMF), the larger core diameter causes excessive modal dispersion, leading to CRC errors. A mode-conditioning patch cable (mode-conditioning patch cord) launches the laser off-center into the MMF core, reducing differential mode delay and restoring proper signal integrity.

This is a known Cisco best practice for LX transceivers on MMF links.

Exam trap

Cisco often tests the misconception that CRC errors always indicate a bad cable or transceiver, when in fact the root cause can be a mode mismatch between LX optics and multimode fiber that is fixed with a mode-conditioning patch cable rather than replacing the fiber or transceiver.

Why the other options are wrong

Using SX would not fix the issue because the fiber is multimode and LX is designed for longer distances; the problem is the cable type mismatch, not the transceiver type.

The interface is up/up, so VLAN mismatch is not the issue.

Although replacing with single-mode fiber would work, the exhibit does not show CRC errors, so the problem is more likely a mode-conditioning issue.

Practice this question →