CCNA Network Infrastructure and Connectivity Questions — Page 4 of 4

226

Multi-Selectmedium

Which TWO statements accurately describe wireless LAN fundamentals for CCNA 200-301 v2.0? (Choose two.)

Select 2 answers

A.802.11ax uses MU‑MIMO only for downlink transmissions.

B.802.11ac operates only in the 5 GHz frequency band.

C.Overlapping channels in the 2.4 GHz band are used to maximize non-overlapping channel availability.

D.WPA3 uses Simultaneous Authentication of Equals (SAE) to provide stronger password-based authentication.

E.A wireless LAN controller (WLC) is typically managed via its console port for day-to-day operations.

AnswersB, D

802.11ac (Wi-Fi 5) is strictly a 5 GHz standard; it does not support 2.4 GHz at all. Because of this, dual-band access points must fall back to 802.11n for 2.4 GHz clients. This design allows 802.11ac to use wider channels (80/160 MHz) and dense modulation (256-QAM) without the congestion and interference common in the 2.4 GHz band.

Why this answer

802.11ac (Wi‑Fi 5) operates exclusively in the 5 GHz band, leveraging wider channels (up to 160 MHz) and reduced interference. Option D is correct: WPA3 introduces Simultaneous Authentication of Equals (SAE) for robust password‑based authentication, replacing the weaker WPA2 four‑way handshake. Option A is wrong: 802.11ax (Wi‑Fi 6) supports MU‑MIMO for both uplink and downlink, not only downlink.

Option C is wrong: Overlapping channels in the 2.4 GHz band reduce throughput and are not used to maximize availability; instead, non‑overlapping channels (1, 6, 11) are recommended. Option E is wrong: A WLC is typically managed via a web GUI, SSH, or SNMP, not via its console port for routine operations; console access is used for initial setup or troubleshooting.

Exam trap

Cisco often tests the misconception that 802.11ac operates in both 2.4 GHz and 5 GHz bands, or that MU-MIMO in 802.11ax is exclusive to uplink, when in fact 802.11ax supports MU-MIMO bidirectionally and 802.11ac is strictly 5 GHz.

Why the other options are wrong

MU-MIMO is a feature of 802.11ac and 802.11ax, but 802.11ax primarily relies on OFDMA for multi-user support.

Overlapping channels reduce performance due to co-channel interference, not maximize non-overlapping channels.

Console port is used for initial configuration or troubleshooting, not for routine management.

Practice this question →

227

Drag & Dropmedium

Drag and drop the following steps into the correct order to sequence the TCP three-way handshake between a client and a server.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The TCP three-way handshake starts with the client sending a SYN, followed by the server responding with SYN-ACK, and finally the client sending an ACK to establish the connection.

Exam trap

A common trap is confusing the order of the handshake or thinking the server initiates the connection. Remember: the client always sends the first SYN, and the server's response is a SYN-ACK (not a separate SYN and ACK).

Practice this question →

228

Multi-Selectmedium

Which TWO statements about fiber optic cable types and SFP transceivers are correct?

Select 2 answers

A.Single-mode fiber uses a larger core (typically 62.5/125 µm) and supports longer distances than multimode fiber.

B.Multimode fiber is commonly used in campus and data center environments for distances up to several hundred meters.

C.SFP+ transceivers support data rates up to 1 Gbps and are backward compatible with standard SFP modules.

D.Single-mode fiber typically uses laser-based transceivers and can support distances exceeding 10 km.

E.Fiber optic cables must be run with EMI shielding when deployed in environments with high electromagnetic interference.

AnswersB, D

Multimode fiber is indeed the predominant medium for campus and data center links because its larger core and high numerical aperture permit the use of low-cost VCSELs or LEDs, and it provides sufficient bandwidth for reaches of 300–550 m at 10 Gbps using OM3/OM4 grades. Beyond these distances, modal dispersion becomes the limiting factor, making single-mode fiber more appropriate for longer backbone or WAN links.

Why this answer

Multimode fiber (MMF) has a larger core (typically 50/125 µm or 62.5/125 µm) and is used for short-reach, cost-effective connections up to a few hundred meters, making option B correct. Single-mode fiber (SMF) uses a much smaller core (~9 µm) and laser-based optics to achieve distances of 10 km or more, so option D is correct. Option A is wrong because it reverses the core size characteristic: SMF has a smaller core, and the given dimensions (62.5/125 µm) refer to multimode.

Option C is wrong because SFP+ is a 10 Gbps form factor and is not inherently backward compatible with 1 Gbps SFP modules unless the switch port explicitly supports dual-rate operation. Option E is incorrect because fiber optic cables are inherently immune to electromagnetic interference (EMI) and therefore never require EMI shielding in any environment; the false statement claims they need shielding.

Exam trap

Cisco often tests the misconception that SFP+ is backward compatible with SFP at the same speed, when in fact SFP+ is a 10 Gbps standard and requires specific port support or auto-negotiation to operate with 1 Gbps SFP modules.

Why the other options are wrong

Single-mode fiber uses a smaller core (~9 µm); the larger core dimensions (62.5/125 µm) belong to multimode fiber.

SFP+ transceivers support 10 Gbps speeds, not 1 Gbps, and are not universally backward compatible with standard SFP modules.

Fiber optic cables are immune to EMI and do not require any shielding; the claim that they need EMI shielding is false.

Practice this question →

229

MCQhard

A host is configured as 192.168.100.65/26. What is the valid host range for its subnet?

A.192.168.100.65 to 192.168.100.126

B.192.168.100.64 to 192.168.100.127

C.192.168.100.1 to 192.168.100.62

D.192.168.100.66 to 192.168.100.127

AnswerA

This is correct because the subnet is 192.168.100.64/26, leaving .65 through .126 as usable hosts.

Why this answer

A /26 creates blocks of 64 addresses. In plain language, the subnets in the last octet are 0–63, 64–127, 128–191, and 192–255. Because the host address is 192.168.100.65, it belongs to the 64–127 block. In that block, 192.168.100.64 is the network address and 192.168.100.127 is the broadcast address. That leaves 192.168.100.65 through 192.168.100.126 as the valid host range.

This checks whether you can identify both the subnet boundary and the usable range.

Exam trap

Remember to exclude the network and broadcast addresses when determining the valid host range.

Why the other options are wrong

This option is incorrect because it includes the network address (192.168.100.64) and the broadcast address (192.168.100.127) for the subnet, which are not valid host addresses. The valid host range for a /26 subnet starts from 192.168.100.65 to 192.168.100.126.

Option C is incorrect because it suggests a host range that does not align with the subnet mask /26, which allows for a range of 192.168.100.64 to 192.168.100.127, but excludes the actual valid hosts for the specified IP address.

Option D is incorrect because it suggests a host range that starts from 192.168.100.66, which is outside the valid range for the subnet 192.168.100.64/26. The correct range should include all hosts from 192.168.100.65 to 192.168.100.126.

Practice this question →

230

Multi-Selecthard

Which two statements accurately describe UDP compared with TCP?

Select 2 answers

A.UDP is connectionless.

B.UDP always guarantees delivery and sequencing.

C.UDP has lower overhead because it uses a simpler header and no session establishment.

D.UDP requires a three-way handshake before application data can be sent.

E.UDP cannot be used by DNS.

AnswersA, C

UDP is connectionless, meaning it treats each datagram independently and does not establish a persistent logical link before sending data. There is no initial handshake, and the sender does not maintain state about the receiver. This allows immediate transmission of application data without negotiation, which is essential for low-latency protocols like streaming or real-time communications.

Why this answer

UDP is designed for simplicity and speed rather than built-in reliability. In plain terms, it sends data without creating a formal conversation first. That is why it is called connectionless. Because it does not perform the same reliability features as TCP, its header is smaller and the protocol adds less overhead. This makes UDP a good fit for applications that care more about speed or low delay than guaranteed delivery at the transport layer.

UDP does not perform a three-way handshake, and it does not guarantee delivery. It is also used by many real services, including DNS in common query scenarios.

Exam trap

Be careful not to confuse the connection-oriented features of TCP with UDP, which is connectionless and does not guarantee delivery.

Why the other options are wrong

This option is wrong because UDP does not guarantee delivery or sequencing; it is designed for speed and efficiency, sacrificing reliability. TCP, on the other hand, ensures that data is delivered in order and without loss.

This option is wrong because UDP is a connectionless protocol that does not require a three-way handshake for data transmission, unlike TCP, which establishes a connection before sending data.

This option is wrong because UDP is widely used by DNS for its quick query-response nature, allowing for faster resolution of domain names without the overhead of connection establishment.

Practice this question →

231

PBQhard

You are connected to R1 via the console. The link between R1 and R2 is experiencing intermittent connectivity. A 'show interfaces GigabitEthernet0/0' output shows the interface is up/up, line protocol up, Full-duplex, 1000Mb/s, but there are 1234 input errors, including 567 CRC errors. Identify the root cause of the issue, and apply the necessary configuration fix to restore full connectivity.

Network Topology

Hints

•Check the duplex and speed settings on both ends of the link.
•High CRC errors often indicate a duplex mismatch.
•Auto-negotiation can resolve duplex mismatches if both devices support it.

A.Configure the interface with 'duplex full' and 'speed 1000'.

B.Configure the interface with 'duplex half' and 'speed 100'.

C.Configure the interface with 'no shutdown' to re-enable the interface.

D.Configure the interface with 'duplex auto' and 'speed auto'.

AnswerD

solution

! R1
interface GigabitEthernet0/0
duplex auto
speed auto

Why this answer

The output indicates high CRC errors on a GigabitEthernet interface operating at 1000 Mb/s and full-duplex. Since 1000BASE-T does not support half-duplex, a duplex mismatch is not possible. The CRC errors likely result from a speed or duplex negotiation mismatch where one side uses forced settings (e.g., speed 1000 duplex full) and the other uses auto-negotiation, causing physical layer instability.

Setting both sides to auto-negotiation ('duplex auto' and 'speed auto') allows them to properly agree on the highest common speed and duplex, resolving the errors. Option A forces full and 1000, which may not match R2 if it is set to auto, so it is not a reliable fix. Option B uses 'duplex half', which is invalid on Gigabit links and would break connectivity.

Option C's 'no shutdown' is irrelevant because the interface is already administratively up.

Exam trap

Do not assume that high CRC errors on a GigabitEthernet link indicate a duplex mismatch; at 1000 Mbps, half-duplex is not supported, so look for mismatched forced versus auto-negotiation settings instead.

Why the other options are wrong

Forcing full duplex and speed 1000 may not match R2 if it is set to auto-negotiation, potentially worsening the mismatch and not resolving CRC errors.

Half-duplex is not a valid mode for GigabitEthernet (1000BASE-T only supports full-duplex), so this configuration would prevent the link from working.

The interface is already up/up, so re-enabling it with 'no shutdown' has no effect and does not address the underlying CRC errors.

Practice this question →

232

MCQhard

A subnet must support 14 usable hosts. Which prefix is the smallest that meets the requirement?

A./29

B./28

C./27

D./26

AnswerB

A /28 prefix uses subnet mask 255.255.255.240, creating a block of 16 addresses per subnet. After reserving the network address and broadcast address, exactly 14 addresses remain available for hosts. This precisely matches the requirement of 14 usable hosts, making it the most efficient prefix length that meets the demand without wasting address space.

Why this answer

To support 14 usable hosts, the subnet must have 16 total addresses, because two are reserved for the network and broadcast addresses. In plain language, you need enough address slots so that after those two reserved entries are removed, 14 remain. A /28 provides exactly that: 16 total addresses and 14 usable addresses.

This is a classic minimum-subnet-size question because it tests whether you can work backward from host requirement to prefix length. A /29 would be too small, while a /27 would work but waste more addresses than necessary.

Exam trap

Avoid choosing a subnet size that either doesn't meet the host requirement or is unnecessarily large, leading to wasted addresses.

Why the other options are wrong

A /29 subnet provides only 6 usable host addresses, which is insufficient for the requirement of 14 usable hosts. Therefore, it does not meet the specified criteria.

Option C: /27 provides 30 usable hosts, which exceeds the requirement of 14 usable hosts. However, the question asks for the smallest prefix that meets the requirement, making /28 the correct choice.

Option D: /26 provides 62 usable hosts, which exceeds the requirement of 14 usable hosts. Therefore, it is not the smallest prefix that meets the specified need.

Practice this question →

233

MCQhard

Refer to the exhibit. An administrator notices that all interfaces on R1 are in an administratively down state. The administrator issues the show version command and sees the following output. What is the most likely cause of the issue?

A.The router IOS image is corrupted and needs to be reinstalled.

B.The interfaces have been manually shut down in the running configuration, and the startup-config file is empty.

C.The router experienced a memory error during boot and failed to load the startup configuration.

D.The configuration register is set to 0x2142, causing the router to ignore the startup configuration.

AnswerD

This is directly confirmed by the last line of the exhibit: 'Configuration register is 0x2142'. This setting tells the router to bypass loading the startup-config from NVRAM, resulting in a clean slate where all interfaces are administratively down.

Why this answer

The configuration register value 0x2142 tells the router to ignore the startup configuration during boot, loading only the default factory configuration. This causes all interfaces to be in an administratively down state because no interface configurations from the startup-config are applied. The administrator sees the interfaces as administratively down because the default configuration does not include any 'no shutdown' commands.

Exam trap

Cisco often tests the specific effect of configuration register 0x2142 (ignoring startup-config) versus 0x2102 (normal boot), and the trap here is that candidates may confuse it with a corrupted IOS or manual shutdown, not realizing the register value directly causes the default interface state.

Why the other options are wrong

Candidates may confuse a successful IOS boot with a corrupted image because both can lead to an unusable configuration, but the configuration register is the direct clue.

Candidates may focus on the symptom (interfaces down) and hypothesize a manual configuration error, but they miss the clear hardware boot-parameter issue indicated by the config register.

Candidates equate configuration loss with hardware faults, overlooking the intentional nature of the 0x2142 register value.

Practice this question →

234

Multi-Selectmedium

Which TWO statements correctly describe the encapsulation and de-encapsulation process at the transport layer of the OSI model?

Select 2 answers

A.During encapsulation, the transport layer adds a header to form a packet.

B.During encapsulation, the transport layer adds a header containing source and destination port numbers.

C.During de-encapsulation, the transport layer removes the IP header to extract the segment.

D.During de-encapsulation, the transport layer removes its header and passes the payload to the session layer.

E.During encapsulation, the transport layer adds a trailer for error detection.

AnswersB, D

During encapsulation, the transport layer encapsulates upper-layer data with a header that records source and destination port numbers. These ports identify the specific application processes on the sending and receiving hosts, enabling the OS to demultiplex incoming data to the correct service. In TCP, the header includes additional fields like sequence numbers and windows, but the port numbers are the essential addressing mechanism that distinguishes this layer from the network layer's IP addressing.

Why this answer

During encapsulation at the transport layer, the TCP or UDP header is added, which includes source and destination port numbers. These port numbers identify the specific application-layer processes on the sending and receiving hosts, enabling proper demultiplexing of data. Option D is correct because during de-encapsulation, the transport layer removes its own header (e.g., TCP or UDP header) and passes the remaining payload up to the session layer (or directly to the application layer in a simplified model).

Exam trap

Cisco often tests the precise PDU naming convention (segment vs. packet vs. frame) and which layer performs which header removal, causing candidates to confuse the transport layer's role with the network layer's role.

Why the other options are wrong

This statement confuses the PDU naming: packet belongs to Layer 3, not Layer 4.

This describes a Layer 3 de-encapsulation step, not a Layer 4 step.

Trailers are a Layer 2 feature; the transport layer uses header-based checksums for integrity.

Practice this question →

235

MCQhard

A network engineer is troubleshooting a wireless performance issue in a dense office environment. Clients on the 5 GHz band are experiencing low throughput even though they are close to the AP. The AP is a Cisco 9130AXI running IOS-XE 17.9. What is the most likely cause of the poor performance?

A.The AP is using an incorrect channel width of 80 MHz, which is not supported by 802.11ac.

B.The AP is operating in 802.11ac mode instead of 802.11ax, and the 80 MHz channel bonding is causing high interference in the dense environment.

C.The AP has DFS non-compliance, which prevents it from using channel 36 and causes the radio to operate at reduced power.

D.The AP is using WPA2-PSK instead of WPA3, which causes lower throughput due to weaker encryption.

AnswerB

The AP is running 802.11ac (Wi-Fi 5), which relies on OFDM and wide 80 MHz channels to achieve high peak rates, but in a dense deployment that wide channel exacerbates interference and medium contention. Migrating to 802.11ax (Wi-Fi 6) would use OFDMA to split the channel into resource units, letting multiple clients share the spectrum simultaneously and reducing collision overhead. The combination of a legacy PHY and an overly broad channel bond is exactly what degrades throughput here, making this the correct diagnosis.

Why this answer

In a dense office environment, using 80 MHz channel bonding with 802.11ac (Wave 2) increases the likelihood of co-channel interference and overlapping basic service sets (OBSS), which degrades throughput despite strong signal. The Cisco 9130AXI supports 802.11ax (Wi-Fi 6), which includes OFDMA and better spatial reuse, but if the AP is configured for 802.11ac mode, it loses these efficiency gains and suffers from the wide channel's interference penalty.

Exam trap

Cisco often tests the misconception that wider channels always improve performance, when in reality, in dense environments, 80 MHz or 160 MHz channels cause severe interference and throughput degradation, especially with 802.11ac's lack of spatial reuse mechanisms.

Why the other options are wrong

802.11ac supports 80 MHz channel bonding, so this is not incorrect.

DFS non-compliance does not directly reduce power; it may cause channel avoidance, but the power is set to maximum.

WPA2-PSK does not cause throughput degradation; the issue is interference and protocol mode.

Practice this question →

236

MCQhard

A network administrator is troubleshooting a Windows 10 client that cannot reach the internet. The client is connected to a Cisco switch port configured as an access port in VLAN 100. The administrator runs ipconfig on the client and sees an IP address of 169.254.10.15 with a subnet mask of 255.255.0.0. The switch port shows status up/up. What is the most likely cause of the issue?

A.The switch port is in err-disabled state due to a spanning-tree loop.

B.The switch is not configured with an ip helper-address on the VLAN 100 SVI to forward DHCP broadcasts to the DHCP server.

C.The client is in the wrong VLAN; the switch should be configured with VLAN 200.

D.There is a duplex mismatch between the client and the switch.

AnswerB

For a DHCP client in VLAN 100 to obtain an address from a server located in a different VLAN or subnet, the VLAN 100 SVI must include an 'ip helper-address' pointing to the DHCP server. DHCP requests are IP broadcast packets, and routers do not forward broadcasts across interfaces by default; without UDP forwarding configured, the DHCPDISCOVER is never relayed to the server, so the client receives no DHCPOFFER and may fall back to an APIPA address. The correct remedy is to configure 'interface vlan 100' with the 'ip helper-address' command referencing the DHCP server's IP address.

Why this answer

The 169.254.x.x address is an Automatic Private IP Addressing (APIPA) address, assigned by Windows when DHCP fails. Since the client is in VLAN 100 and the switch port is up/up, the most likely cause is that the VLAN 100 SVI lacks an ip helper-address command, so DHCP broadcast requests from the client are not forwarded to the DHCP server, leaving the client without a valid IP address.

Exam trap

Cisco often tests the misconception that an APIPA address indicates a physical or VLAN issue, when in fact it specifically points to DHCP failure, and the most common cause in a routed environment is the absence of ip helper-address on the SVI.

Why the other options are wrong

The port status is 'connected', not err-disabled.

No information suggests the client should be in VLAN 200; the configuration matches the intended VLAN.

Duplex mismatch would typically cause errors or speed/duplex issues, but the switch shows a-full, so this is not the problem.

Practice this question →

237

Multi-Selectmedium

Which TWO of the following are essential IPv4 host parameters that must be correctly configured for a host to communicate with devices on remote networks?

Select 2 answers

A.DNS server address

B.Default gateway

C.Subnet mask

D.MAC address

E.Host name

AnswersB, C

The default gateway is the router interface that resides on the host's local subnet and serves as the exit point for all traffic destined to remote networks. When a host determines a destination is not on the same subnet, it encapsulates the packet with the gateway's Layer 2 address and forwards it there, relying on the router to route it onward. Without a default gateway, the host will discard any packet intended for a different network, because it has no way to send traffic off its local segment, making this parameter essential for basic internetwork communication.

Why this answer

The default gateway is the IP address of the router interface on the local subnet; when a host needs to communicate with a device on a remote network, it must forward packets to the default gateway because the destination is not reachable locally. The subnet mask is equally essential because the host uses it (along with its own IP address) to determine whether a destination IP address is on the same local network or a remote network; without a correctly configured subnet mask, the host cannot make this determination and may misroute traffic. DNS server address is only for name resolution and is not required for IP-level connectivity, MAC address is a Layer 2 address already present on the NIC, and hostname is a local identifier irrelevant to routing.

Exam trap

Cisco often tests the misconception that a DNS server address is a mandatory host parameter for remote communication, but DNS is only a name-resolution service and not required for IP-level connectivity.

Why the other options are wrong

A host can communicate using IP addresses directly without DNS. DNS is a service, not a mandatory parameter for routing.

MAC addresses are not manually configured as part of IPv4 host parameters (they are burned into the NIC). The question asks for IPv4 host parameters that must be configured.

Host names are used for identification and can be resolved via DNS, but they are not essential for the host to send or receive IP packets.

Practice this question →

238

MCQhard

A network administrator is troubleshooting connectivity between two directly connected Cisco switches. Hosts on VLAN 10 connected to Switch A cannot ping the default gateway on Switch B. The interface on Switch A shows 'up/up' but there are excessive CRC errors and runts. The administrator checks the interface configuration on both switches. What is the most likely cause of the issue?

A.Replace the faulty Ethernet cable.

B.Mismatched duplex and speed settings between the interfaces.

C.Disable spanning tree on both interfaces to prevent loop prevention from blocking traffic.

D.Assign the interfaces to the same VLAN to ensure Layer 2 connectivity.

AnswerB

With one switch operating at full-duplex and 1000 Mbps while the other operates at half-duplex and 100 Mbps, the two interfaces cannot coordinate frame timing properly. The full-duplex side transmits without carrier sensing, while the half-duplex side detects a collision, sends a jam signal, and drops the corrupted frame—producing CRC errors on the half-duplex interface. Forcing both interfaces to the same speed (1000 Mbps) and full-duplex mode eliminates the mismatch, allowing the error counters to stop incrementing.

Why this answer

The presence of excessive CRC errors and runts on an interface that is 'up/up' strongly indicates a Layer 1 or Layer 2 duplex mismatch. When one switch is set to full-duplex and the other to half-duplex (or auto-negotiation fails), the half-duplex side will detect collisions and retransmit, while the full-duplex side will not, leading to frame corruption (CRC errors) and truncated frames (runts). Configuring both interfaces with the same duplex and speed settings (e.g., full-duplex and 1000 Mbps) resolves this mismatch, restoring proper connectivity for VLAN 10 traffic to the default gateway.

Exam trap

Cisco often tests the concept that 'up/up' does not guarantee error-free communication, and candidates mistakenly focus on cable replacement or VLAN misconfiguration instead of recognizing CRC errors and runts as classic symptoms of a duplex mismatch.

Why the other options are wrong

The exhibit shows both switches have different speed and duplex settings, indicating a configuration mismatch rather than a cable fault.

The interface is up/up and the errors are CRC, which are not related to spanning tree operation.

CRC errors indicate physical or duplex issues, not VLAN misconfiguration.

Practice this question →

239

MCQeasy

Which cable type is commonly used to connect a switch to a router when using standard Ethernet interfaces on modern devices with auto-MDIX support?

A.Rollover cable

B.Straight-through Ethernet cable

C.Serial DCE cable

D.Fiber patch cable only

AnswerB

A straight-through Ethernet cable maps pins 1-8 identically on both ends, following TIA/EIA-568-B wiring, and is the standard for connecting unlike devices such as a switch to a router. Switches and routers use different transmit/receive pairs, so the straight-through pinout properly aligns the outbound pairs of one with the inbound pairs of the other. Even with Auto-MDIX on modern gear, the straight-through cable remains the expected and most commonly cited answer for this link.

Why this answer

A straight-through Ethernet cable is the common expected answer for switch-to-router Ethernet connections. On modern interfaces, auto-MDIX often makes crossover requirements less important in practice.

Exam trap

Remember that auto-MDIX allows for the use of straight-through cables in situations where crossover cables were once required.

Why the other options are wrong

A rollover cable is used to connect a console port of a router or switch to a computer terminal, not for connecting switches to routers over Ethernet interfaces. In modern networking setups with auto-MDIX, a straight-through cable is the standard choice.

A serial DCE cable is used for connecting devices in a serial communication setup, typically for console access or point-to-point connections, not for standard Ethernet interfaces between a switch and a router.

A fiber patch cable is not used to connect a switch to a router over standard Ethernet interfaces, as it requires compatible fiber optic ports and transceivers. Ethernet interfaces typically use copper cabling, such as straight-through cables, for such connections.

Practice this question →

240

Matchingeasy

Match each basic networking service to its most accurate role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Hostname resolution

Automatic IP configuration

Clock synchronization

Centralized event and log reporting

Why these pairings

DNS converts domain names to IP addresses; DHCP automates IP configuration; NTP synchronizes clocks across devices; Syslog centralizes event and log reporting for monitoring and troubleshooting.

Exam trap

Cisco exams often test the specific function of each service. Do not confuse DNS with DHCP, or NTP with Syslog. Remember: DNS = name-to-IP, DHCP = IP assignment, NTP = clock sync, Syslog = logging.

Practice this question →

241

MCQhard

A host with address 192.168.1.130/26 needs to identify its local subnet. Which subnet does it belong to?

A.192.168.1.0/26

B.192.168.1.64/26

C.192.168.1.128/26

D.192.168.1.192/26

AnswerC

The /26 prefix length corresponds to a 255.255.255.192 subnet mask, which creates address blocks of 64 addresses. Because 192.168.1.130 falls in the range 128 through 191, its network address is 192.168.1.128, making 192.168.1.128/26 the correct subnet. This is the block where 130 is a valid host, with 129 through 190 as usable addresses.

Why this answer

A /26 creates subnets in blocks of 64 addresses each. In plain language, that means the fourth octet ranges are 0–63, 64–127, 128–191, and 192–255. Since 192.168.1.130 falls within the 128–191 block, the host belongs to the 192.168.1.128/26 subnet. That is the local network boundary the host will use to decide what is on-link and what requires the default gateway.

This kind of question is a very common CCNA subnetting task. The main challenge is not the arithmetic itself but recognizing the block size and locating the destination inside the correct range. Once you know a /26 moves in increments of 64, the right subnet becomes much easier to see.

Exam trap

Be careful to calculate subnet ranges accurately and avoid assuming proximity based on the first or last octet.

Why the other options are wrong

Option A is incorrect because the address 192.168.1.130 falls within the subnet range of 192.168.1.128/26, not 192.168.1.0/26, which covers addresses from 192.168.1.0 to 192.168.1.63.

Option B, 192.168.1.64/26, is incorrect because the host 192.168.1.130 falls within the subnet range of 192.168.1.128 to 192.168.1.191, not 192.168.1.64 to 192.168.1.127.

Option D, 192.168.1.192/26, is incorrect because the host address 192.168.1.130 falls within the subnet range of 192.168.1.128 to 192.168.1.191, making it part of the 192.168.1.128/26 subnet, not 192.168.1.192/26.

Practice this question →

242

MCQhard

A network technician is troubleshooting a connectivity issue between two directly connected switches, SW1 and SW2. Hosts on VLAN 10 connected to SW1 can ping each other but cannot ping the default gateway or any host on VLAN 10 connected to SW2. The interface on SW1 is up/up, but the interface on SW2 is up/down. What is the most likely cause of the problem?

A.Configure the interface on SW2 to use a different MTU value.

B.Ensure both switches are configured for the same duplex setting, preferably by enabling autonegotiation on both interfaces.

C.Replace the Ethernet cable connecting SW1 and SW2.

D.Check for late collisions on the interface and increase the collision window size.

AnswerB

The output from SW1 shows the interface is full-duplex, but SW2's interface is up/down. This is a classic symptom of a duplex mismatch, where one side is full and the other half-duplex. Configuring both ends to the same duplex (or enabling autonegotiation) will resolve the issue.

Why this answer

The interface on SW2 is up/down, which typically indicates a Layer 1 issue such as a duplex mismatch. Duplex mismatch occurs when one switch is manually set to full duplex and the other to half duplex or auto-negotiation fails, causing the side expecting full duplex to report up/down due to excessive errors. Option A is incorrect because MTU mismatch would cause connectivity issues but not an up/down interface state.

Option C is incorrect because a faulty cable would likely cause both interfaces to be down/down, not up/down. Option D is incorrect because late collisions are a symptom of duplex mismatch, not a separate cause; increasing collision window size is not a standard troubleshooting step. The correct solution is to ensure both switches use the same duplex setting, preferably via autonegotiation (IEEE 802.3u).

Exam trap

Cisco often tests the distinction between up/down (Layer 1 issue like duplex mismatch) and down/down (cable or power issue) to trap candidates who assume any interface problem is a bad cable.

Why the other options are wrong

Changing MTU values affects frame size but does not cause an interface to show up/down; that state is associated with Layer 1 issues like duplex mismatch.

A bad cable typically results in both interfaces showing down/down, not one up and the other up/down.

Late collisions are a consequence of duplex mismatch, not a root cause; adjusting collision window size is not a standard practice on modern switches.

Practice this question →

243

MCQmedium

Exhibit: A host has address 192.168.14.77/27. Which address is its valid default gateway if the first usable address in the subnet is chosen for the router interface?

A.192.168.14.63

B.192.168.14.64

C.192.168.14.65

D.192.168.14.95

AnswerC

That is the first usable address in 192.168.14.64/27.

Why this answer

A /27 has a block size of 32. Address 192.168.14.77 falls in the 192.168.14.64/27 subnet, where the usable host range is 192.168.14.65 through 192.168.14.94. The first usable address is 192.168.14.65.

Exam trap

Be careful not to confuse network and broadcast addresses with usable host addresses when identifying a default gateway.

Why the other options are wrong

Option A (192.168.14.63) is wrong because it is the last address in the subnet range (192.168.14.64 to 192.168.14.95) and is reserved for the broadcast address, not a valid default gateway.

Option B, 192.168.14.64, is incorrect because it is the first usable address in the subnet 192.168.14.64/27, which is reserved for the router interface and cannot be assigned as a default gateway for hosts in the subnet.

Option D, 192.168.14.95, is incorrect because it falls outside the subnet range defined by the 192.168.14.64/27 subnet, which spans from 192.168.14.64 to 192.168.14.94. Thus, it cannot be a valid default gateway for the host in question.

Practice this question →

244

MCQhard

A network administrator notices that a workstation connected to a Cisco switch port cannot communicate with other devices on the same VLAN. The switch port is up/up, but the workstation reports slow performance and intermittent connectivity. What is the most likely cause of this issue?

A.Replace the faulty Ethernet cable between the switch and the workstation.

B.A duplex mismatch between the switch port and the workstation.

C.Assign the switch port to the correct VLAN.

D.Disable spanning-tree on the port to prevent frequent topology changes.

AnswerB

A duplex mismatch between the switch port and the workstation is the correct cause because it creates a half-duplex device that performs CSMA/CD while the full-duplex peer transmits without sensing the medium. When both devices transmit simultaneously, the half-duplex side detects a late collision and backs off, while the full-duplex side is unaware and does not retransmit, causing dropped frames, high latency, and degraded throughput. The switch output would likely show a high number of late collisions or a significant rate of alignment errors, even though the link remains up/up, matching the symptom of a slow but stable connection.

Why this answer

A duplex mismatch occurs when one end of the link is set to full-duplex and the other to half-duplex. The half-duplex end detects collisions and the full-duplex end does not, causing late collisions, CRC errors, and retransmissions. This results in slow performance and intermittent connectivity even though the port is operationally up.

Exam trap

Cisco often tests the concept that a link being up/up does not guarantee error-free communication, and candidates mistakenly focus on VLAN or cable issues instead of recognizing duplex mismatch as the cause of slow performance and intermittent connectivity.

Why the other options are wrong

No cable-related errors are shown.

VLAN issues would typically prevent communication entirely or show input errors from misconfigured trunking.

The port is stable and not flapping.

Practice this question →

245

MCQmedium

A host address is 2001:db8:100:20::25/64. Which portion identifies the network prefix?

A.2001:db8:100

B.2001:db8:100:20

C.2001:db8:100:20::25

D.::25

AnswerB

The first four hextets in the address represent the 64-bit network prefix, so 2001:db8:100:20 identifies the subnet. In IPv6, a /64 prefix always uses exactly four hextets, and the remaining four hextets (::25) are the interface identifier. This is the portion that routers use to forward traffic to the destination subnet.

Why this answer

With a /64 prefix, the first 64 bits identify the network. That corresponds to the first four hextets: 2001:db8:100:20.

Exam trap

Be careful not to confuse the shorthand notation '::' with part of the network prefix. Remember, '::' represents a series of zeroes and is not part of the network prefix.

Why the other options are wrong

Option A is incorrect because it only includes the first three hextets of the IPv6 address, which does not represent the complete network prefix as defined by the /64 subnet mask. The correct network prefix includes the first four hextets.

Option C is incorrect because it includes the full address, which encompasses both the network prefix and the host portion. The question specifically asks for the network prefix, which is only the first 64 bits of the address.

Option D, '::25', is incorrect because it represents the host portion of the IPv6 address, not the network prefix. The network prefix is determined by the first 64 bits, which in this case is '2001:db8:100:20'.

Practice this question →

246

Drag & Dropmedium

Drag and drop the following steps into the correct order to troubleshoot a link-down issue on a GigabitEthernet interface using an SFP transceiver.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Troubleshooting begins by verifying the interface status and physical layer (steps 1-2). Next, you ensure the SFP is physically and logically recognized (step 3) before retrieving specific diagnostic data (step 4). Only after confirming the health of the transceiver do you take corrective action (step 5), because replacing hardware without diagnostics may waste resources.

Practice this question →

247

MCQmedium

A company wants private IPv4 addressing that can be routed internally but not on the public Internet. Which range meets that requirement?

A.198.51.100.0/24

B.172.20.0.0/16

C.169.254.0.0/16

D.224.0.0.0/4

AnswerB

172.20.0.0/16 is correct because it resides inside the RFC 1918 private block 172.16.0.0/12 (172.16.0.0 – 172.31.255.255). As a private address, it is not globally routable on the internet but is fully routable within an enterprise network, making it ideal for internal IPv4 design. The /16 prefix provides 65,534 usable host addresses, which is suitable for a large company's scalable internal infrastructure.

Why this answer

RFC 1918 defines private IPv4 ranges for internal routing: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. 172.20.0.0/16 falls within the 172.16.0.0/12 block, making it a valid private address. 198.51.100.0/24 is reserved for documentation (TEST-NET-2) and should not be used internally. 169.254.0.0/16 is link-local (APIPA), used only for automatic addressing on a single link. 224.0.0.0/4 is multicast, not routable as unicast and not private.

Exam trap

Be careful not to confuse reserved IP ranges for documentation or link-local use with private IP ranges.

Why the other options are wrong

198.51.100.0/24 is a documentation range (TEST-NET-2), not private or internally routable.

169.254.0.0/16 is link-local (APIPA), used only for automatic configuration on a single network segment, not for internal routing.

224.0.0.0/4 is reserved for multicast traffic and cannot be used as a private unicast range.

Practice this question →

248

Matchingmedium

Drag and drop the items on the left to the correct descriptions on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Displays optical transceiver diagnostic information including temperature and Tx/Rx power

Shows Ethernet physical layer diagnostics such as cable length, MDI/MDIX, and pair status

10 Gigabit Ethernet short-reach multimode fiber transceiver for 850 nm up to 300 m

Copper twisted-pair cabling standard supporting 10GBASE-T up to 100 meters

Small form-factor duplex fiber optic connector used with SFP/SFP+ modules

Why these pairings

show interface transceiver outputs Digital Optical Monitoring (DOM) data such as temperature, voltage, and Tx/Rx power for installed transceivers. show controllers ethernet-controller phy displays physical layer diagnostics including cable length estimates, MDI/MDI-X status, pair swaps, and link quality counters. SFP-10G-SR is a multimode fiber transceiver supporting 10 Gigabit Ethernet at 850nm over distances up to 300 meters. Cat6a is enhanced copper twisted-pair cabling rated for 10GBASE-T up to 100 meters with improved alien crosstalk performance.

LC connectors are the small form-factor duplex fiber connectors commonly used with SFP and SFP+ optical modules.

Practice this question →

249

PBQmedium

You are connected to SW1 via the console. The network uses VLANs 10 (Sales) and 20 (Engineering). A new switch SW2 is connected to SW1 via G0/1. You need to enable CDP to discover neighbor devices and verify that SW1 sees SW2. Currently, CDP is disabled globally.

Network Topology

Hints

•CDP is a Cisco proprietary protocol.
•The command to enable it globally is straightforward.
•After enabling, wait a few seconds for neighbor discovery.

A.Enable CDP globally with 'cdp run' and verify with 'show cdp neighbors'.

B.Enable CDP on interface G0/1 with 'cdp enable' and verify with 'show cdp neighbors'.

C.Enable CDP globally with 'cdp run' and verify with 'show cdp interface'.

D.Enable CDP globally with 'cdp enable' and verify with 'show cdp neighbors'.

AnswerA

solution

! SW1
cdp run

Why this answer

CDP is disabled globally with 'no cdp run'. Re-enabling with 'cdp run' allows SW1 to discover directly connected Cisco devices, including SW2. Option B is incorrect because interface-level 'cdp enable' requires CDP to already be enabled globally; since CDP is globally disabled, this command has no effect.

Option C is incorrect because 'show cdp interface' displays CDP parameters per interface, not the neighbor table; you need 'show cdp neighbors' to see discovered devices. Option D is incorrect because 'cdp enable' is not a valid global command; the correct global command is 'cdp run'.

Exam trap

Remember that CDP has both global and interface-level configuration. If CDP is disabled globally, interface-level commands have no effect. Always use 'cdp run' to enable globally and 'show cdp neighbors' to see neighbors.

Why the other options are wrong

Interface-level 'cdp enable' requires CDP to be enabled globally first; with global CDP disabled, this command is ineffective.

'show cdp interface' shows CDP status and counters on interfaces, not the list of neighboring devices; use 'show cdp neighbors' to see neighbors.

'cdp enable' is an interface command, not a global command; the global command to enable CDP is 'cdp run'.

250

Multi-Selectmedium

Which three of the following are characteristics of Layer 2 Ethernet switches that support VLANs? (Choose three.)

Select 3 answers

.They forward frames based on the destination MAC address.

.They can segment a LAN into multiple broadcast domains.

.They use ARP to resolve IP addresses to MAC addresses.

.They use the Spanning Tree Protocol to prevent Layer 2 loops.

.They perform routing between VLANs without a router.

.They forward frames based on the destination IP address.

Why this answer

Layer 2 Ethernet switches that support VLANs forward frames based on the destination MAC address, which is the fundamental switching decision. They can segment a LAN into multiple broadcast domains because each VLAN creates its own isolated broadcast domain, preventing unnecessary traffic propagation. They use the Spanning Tree Protocol (STP) to prevent Layer 2 loops by dynamically blocking redundant paths, ensuring a loop-free topology.

Exam trap

Cisco often tests the misconception that switches use ARP or that VLANs segment collision domains, when in fact VLANs segment broadcast domains and switches forward based on MAC addresses, not IP addresses.

Practice this question →

251

MCQhard

Refer to the exhibit. A network engineer is troubleshooting a serial link between two routers that is not coming up. The engineer issues the show controllers command on one router and sees the output shown. What is the most likely cause of the issue?

A.The clock rate command is missing on the DCE serial interface.

B.The serial cable type is incorrectly identified.

C.The encapsulation mismatch is causing the line protocol to stay down.

D.The serial interface is administratively shut down.

AnswerA

The show controllers output clearly states “DCE V.35, no clock rate” and “no clock rate configured,” confirming that the DCE side lacks the required clock rate. Without it, the serial interface cannot bring the line protocol up.

Why this answer

The 'show controllers' output indicates the router is the DCE (Data Communications Equipment) on the serial link, but no clock rate has been configured. For a serial interface to come up, the DCE end must provide clocking via the 'clock rate' command. Without it, the interface will remain down (line protocol down) because no clock signal is present to synchronize data transmission.

Exam trap

Cisco often tests the distinction between DCE and DTE roles; the trap here is that candidates assume the 'show controllers' output is irrelevant or that the issue is a Layer 2 problem (encapsulation) when the root cause is a missing Layer 1 clock signal on the DCE side.

Why the other options are wrong

Some candidates may misinterpret the DCE cable type as a problem, but the output merely states the detected cable type accurately, not a misidentification.

Candidates often fixate on encapsulation issues when line protocol is down, overlooking the explicit hardware-level clocking problem shown here.

Many candidates think that a non‑functioning interface might be shut down, but the exhibit explicitly shows an active hardware detection with a configuration error, not an administrative shutdown.

Practice this question →

252

MCQhard

A network administrator has recently upgraded the corporate wireless LAN to support 802.11ax (Wi-Fi 6) and is using WPA3-Enterprise with a central WLC. Several users with new 802.11ax laptops report that they can connect to the SSID, but after a few minutes their connections drop and then re-establish, while legacy 802.11ac clients work without issues. Which action will resolve this problem?

A.Downgrade the WLAN security to WPA2-Enterprise for backward compatibility.

B.Enable Protected Management Frames (PMF) as Required on the WLAN.

C.Disable OFDMA and MU-MIMO on the WLC for the affected APs.

D.Adjust the 5 GHz channel width from 80 MHz to 40 MHz to avoid interference.

AnswerB

Setting Protected Management Frames (PMF) to Required enforces 802.11w on the WLAN, ensuring all management frames are encrypted and integrity-protected. WPA3 and 802.11ax clients expect PMF mandatory during robust security network association (RSNA); if the AP advertises PMF as not required or disabled, clients may disassociate immediately after authentication. Requiring PMF eliminates negotiation mismatches and prevents unprotected robust management frames from triggering disconnections.

Why this answer

WPA3-Enterprise requires Protected Management Frames (PMF) to be set to 'Required' on the WLC. When PMF is not enabled or set to 'Optional', 802.11ax clients using WPA3 may experience intermittent disconnects because management frame protection is mandatory for WPA3 operation. Legacy 802.11ac clients using WPA2 do not require PMF, so they remain unaffected.

Exam trap

Cisco often tests the misconception that Wi-Fi 6 issues are caused by physical layer features like OFDMA or channel width, when the actual problem is a mandatory security configuration mismatch (PMF) between WPA3 and the WLC.

Why the other options are wrong

Downgrading to WPA2 is a common workaround when WPA3-related features aren't correctly configured, but it's not the correct solution for PMF-related disconnections.

Disabling Wi-Fi 6 features does not resolve authentication or management frame protection issues; this misconception stems from blaming new features for instability.

Changing channel width addresses co-channel interference and throughput, not authentication or management frame protection issues.

Practice this question →

253

Drag & Dropmedium

Drag and drop the following steps into the correct order to install a new fiber optic cable and SFP module on a Cisco switch, then verify the interface status.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct procedure for installing a fiber optic cable and SFP module on a modern Cisco switch is: first, insert the SFP module into the port while the switch is powered on (hot-swap); second, connect the fiber optic cable to the SFP module; third, verify the interface status using 'show interfaces status'. Option D is incorrect because fiber optic cables cannot connect directly to a switch port without an SFP module, and powering down the switch is unnecessary when hot-swapping SFPs.

Exam trap

Many learners assume that SFP modules require the switch to be powered down before installation, but modern Cisco switches support hot-swapping. Always verify the specific module and device documentation.

Practice this question →

254

MCQhard

Which IPv6 prefix is used for link-local addresses?

A.FC00::/7

B.FE80::/10

C.2000::/3

D.FF00::/8

AnswerB

IPv6 link-local addresses are uniquely identified by the FE80::/10 prefix, which is reserved for communication solely within a single network segment. This specific prefix ensures that packets with these source or destination addresses never traverse a router, satisfying the constraint of being confined to the local link. Every IPv6-enabled interface automatically configures a link-local address from this range, enabling essential neighbour discovery and stateless address autoconfiguration processes.

Why this answer

IPv6 link-local addresses come from FE80::/10. They are valid only on the local link and are commonly used for neighbor discovery and routing adjacency formation.

Exam trap

Don't confuse link-local prefixes with global unicast or multicast prefixes. Remember, link-local addresses are only valid within the local link.

Why the other options are wrong

The prefix FC00::/7 is designated for Unique Local Addresses (ULAs) in IPv6, not link-local addresses. Link-local addresses specifically use the FE80::/10 prefix.

C: 2000::/3 is incorrect because it designates global unicast addresses, not link-local addresses, which are specifically defined by the prefix FE80::/10.

D is incorrect because FF00::/8 is reserved for multicast addresses in IPv6, not link-local addresses. Link-local addresses specifically use the FE80::/10 prefix.

Practice this question →

255

Drag & Dropmedium

Drag and drop the following steps into the correct order to configure an IPv4 static address on a Windows host, generate an IPv6 EUI-64 address on a Cisco router, verify the router's IPv6 EUI-64 address, and confirm connectivity from the Windows host.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order is: first set a static IPv4 address on the Windows host to establish its network settings, then configure the IPv6 EUI-64 address on the Cisco router to enable IPv6, then verify the generated EUI-64 address on the router to ensure correct configuration, and finally confirm connectivity from the Windows host to the router to validate end-to-end communication. This sequence logically progresses from configuration to verification to testing.

Exam trap

Candidates often confuse the order of configuration and verification steps. Remember that configuration always comes before verification, and the final step is always a connectivity test from the end host.

Practice this question →

256

Multi-Selectmedium

Which two statements accurately describe a default gateway from a host perspective?

Select 2 answers

A.It is the next-hop path a host uses for destinations outside the local subnet.

B.It is typically the IP address of a local router or Layer 3 interface on the same subnet.

C.It replaces the need for a subnet mask.

D.It is the same thing as a DNS server.

E.It is used only for ARP broadcasts.

AnswersA, B

A default gateway is the designated next-hop router that a host uses to send IP packets to destinations outside its local subnet. The host compares its destination IP against its own subnet mask; if the destination is not local, it frames the packet for the gateway's MAC address, while keeping the final destination IP. Thus, the gateway is the exit point for all off-subnet traffic.

Why this answer

A default gateway is the local router or Layer 3 interface that a host uses for traffic destined beyond its own subnet. In plain language, the host uses the gateway when the destination is not local. The default gateway does not replace the host’s own IP address or subnet mask; it complements them by providing the next-hop path for remote communication.

This is a foundational host-networking concept because many connectivity issues come from misunderstanding what the gateway actually does. The two correct answers are the ones that describe remote-traffic forwarding and the local next-hop role of the gateway.

Exam trap

Avoid confusing the gateway's role with local traffic handling or address replacement. Focus on its function in remote communication.

Why the other options are wrong

This option is wrong because a default gateway does not replace the need for a subnet mask; both are essential for proper IP communication. The subnet mask defines the network portion of an IP address, while the default gateway routes traffic to external networks.

This option is wrong because a default gateway and a DNS server serve different purposes; the default gateway routes traffic outside the local subnet, while a DNS server resolves domain names to IP addresses.

This option is wrong because a default gateway is not limited to ARP broadcasts; it is used for routing packets to destinations outside the local subnet, which involves more than just ARP communication.

Practice this question →

257

MCQhard

Refer to the exhibit. A network engineer is troubleshooting intermittent connectivity between a branch router and the upstream switch. The switch port is manually configured for full-duplex, and the Ethernet cable has been tested and is working properly. The engineer runs the show interfaces GigabitEthernet0/0 command on the router and receives the output shown. Based on the output, what is the most likely cause of the problem?

A.The switch port is configured for half-duplex instead of the expected full-duplex.

B.The cable is faulty, causing excessive late collisions and CRC errors.

C.The router interface is operating in half-duplex while the switch port is full-duplex, causing a duplex mismatch.

D.The excessive input errors are a result of a broadcast storm on the network.

AnswerC

The output shows 'Half-duplex, 1000Mb/s' and reports 17 late collisions and 23 CRC errors. With the switch known to be full-duplex, this is a classic duplex mismatch scenario, where the full-duplex switch transmits without sensing the medium, while the half-duplex router interprets simultaneous traffic as collisions (many of them late because the switch may start transmitting after the router has already begun its frame).

Why this answer

The output shows the router interface is operating in half-duplex (as indicated by 'Half-duplex' in the show interfaces output), while the switch port is manually configured for full-duplex. This duplex mismatch causes the router to use CSMA/CD and detect collisions, while the switch transmits without collision detection, leading to late collisions, CRC errors, and intermittent connectivity. The correct fix is to set both sides to the same duplex setting, ideally full-duplex.

Exam trap

Cisco often tests duplex mismatch by showing output with late collisions and CRC errors, and the trap here is that candidates may blame the cable (Option B) or assume the switch port is half-duplex (Option A), when the real issue is the router interface operating in half-duplex against a full-duplex switch port.

Why the other options are wrong

Users often think any collision indicator points to both sides being half-duplex, ignoring the known switch configuration.

Late collisions are commonly associated with physical layer issues, leading candidates to assume a cable problem even when explicitly ruled out.

Candidates see input errors and CRC and prematurely conclude a loop or broadcast storm, overlooking that the output shows no broadcast activity and contains late collisions specific to duplex issues.

Practice this question →

258

MCQmedium

A network administrator receives a report that a user on a Windows laptop cannot connect to the internet, although other devices on the same subnet are working. The administrator runs `ipconfig` on the laptop and sees an IP address of 169.254.15.22 with a subnet mask of 255.255.0.0 and no default gateway. Based on this output, what is the most likely cause of the connectivity issue?

A.The laptop's DNS server settings are incorrect.

B.The DHCP server is unreachable or not responding to the laptop's DHCP request.

C.The laptop has a static IP address configured that conflicts with another device.

D.The Ethernet cable is faulty or disconnected.

AnswerB

APIPA is assigned when a DHCP client fails to receive a DHCPOFFER after sending DHCPDISCOVER messages. This typically means the DHCP server is down, misconfigured, or the laptop cannot reach it due to a network issue (e.g., VLAN mismatch, switch port problem).

Why this answer

The IP address 169.254.15.22 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP client fails to obtain a lease from a DHCP server. The absence of a default gateway confirms that the laptop cannot reach any DHCP server, as APIPA addresses are not routable and are only used for link-local communication. Therefore, the most likely cause is that the DHCP server is unreachable or not responding to the laptop's DHCP request.

Exam trap

Cisco often tests the distinction between APIPA and other IP assignment failures, and the trap here is that candidates may confuse a DHCP failure with a physical layer issue (faulty cable) or a DNS misconfiguration, not realizing that APIPA is a specific Windows behavior triggered only by DHCP unavailability.

Why the other options are wrong

The APIPA address indicates a DHCP failure, not a DNS problem.

A static IP conflict would not result in an APIPA address; the laptop would show the manually configured IP, not 169.254.x.x.

A physical cable issue would prevent link, so the laptop would not even attempt DHCP and would not get an APIPA address.

Practice this question →

259

Multi-Selectmedium

Which TWO statements correctly describe the causes or implications of CRC errors, runts, giants, or output errors as seen in the output of 'show interface' or 'show interface status'?

Select 2 answers

A.CRC errors are always caused by a faulty switch port and require port replacement.

B.A high number of runts on an interface typically indicates excessive collisions or a faulty NIC.

C.Giants are frames that exceed the maximum transmission unit (MTU) and are always discarded by the switch.

D.Output errors, including late collisions, can be caused by a duplex mismatch between the switch and the connected device.

E.The 'show controllers' command provides a detailed view of CRC errors but does not show runts or giants.

AnswersB, D

A runt is an Ethernet frame shorter than the 64-byte minimum, often generated when a collision aborts transmission or when a faulty NIC emits undersized frames. On a modern full-duplex link, collisions should not occur, so a persistent runt count usually points to a defective NIC, bad cabling, or a misconfigured interface. High runt counts can also indicate excessive network congestion in legacy half-duplex environments.

Why this answer

Runts—frames smaller than 64 bytes—often result from collisions truncating frames on half-duplex links or a faulty NIC. Option D is correct because duplex mismatch can cause late collisions, which appear as output errors in 'show interface'; a device on one side full-duplex and the other half-duplex leads to collisions and framing errors. Option A is wrong because CRC errors can stem from faulty cabling, interference, or a mismatched NIC, not exclusively a bad switch port.

Option C is wrong because giants (frames over maximum MTU) may be forwarded if the interface is configured with jumbo frames or the switch is set to accept oversize frames. Option E is wrong because 'show controllers' displays frame-size errors like runts and giants, including details beyond CRC errors.

Exam trap

Cisco often tests the misconception that CRC errors always indicate a bad port (trap A) and that giants are always discarded (trap C), when in reality both can have multiple causes and switches can be configured to forward larger frames.

Why the other options are wrong

This statement is too absolute; CRC errors often stem from Layer 1 issues like bad cables or noise, not always a defective port.

The statement is too definitive; giants can be forwarded if jumbo frame support is enabled.

This statement is incorrect because 'show controllers' often includes runt and giant counters on many Cisco platforms.

Practice this question →

260

PBQhard

You are connected to R1. Configure IPv4 and IPv6 addressing on R1's interfaces and verify reachability to R2. The current configuration has a wrong subnet mask on G0/0, missing default gateway for IPv4, and R1's IPv6 address is configured using EUI-64 while R2 uses a static IPv6 address. Fix these issues so that R1 can ping both R2's IPv4 and IPv6 addresses.

Network Topology

Hints

•Compare the subnet masks on R1 and R2's G0/0 interfaces.
•Check the IPv4 default route — the next-hop must be reachable.
•R1's IPv6 EUI-64 will not match the static address on R2; use a static assignment on the same subnet.

A.Change R1 G0/0 subnet mask to /30, add a default route via 192.0.2.2, and configure a static IPv6 address 2001:db8:1::1/64 on G0/0.

B.Change R1 G0/0 subnet mask to /30, add a default route via 192.0.2.254, and keep the EUI-64 IPv6 address on G0/0.

C.Change R1 G0/0 subnet mask to /24, add a default route via 192.0.2.2, and configure a static IPv6 address 2001:db8:1::1/64 on G0/0.

D.Change R1 G0/0 subnet mask to /30, add a default route via 192.0.2.2, and keep the EUI-64 IPv6 address on G0/0.

AnswerA

solution

! R1
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.0.2.1 255.255.255.252
no ipv6 address 2001:db8:1::/64 eui-64
ipv6 address 2001:db8:1::1/64
exit
no ip route 0.0.0.0 0.0.0.0 192.0.2.254
ip route 0.0.0.0 0.0.0.0 192.0.2.2
end
write memory

Why this answer

The problem had three issues: (1) R1's G0/0 subnet mask was /24 (255.255.255.0) but R2's G0/0 was /30 (255.255.255.252), causing an IP subnet mismatch. (2) R1 lacked a default gateway for IPv4; the static route pointed to 192.0.2.254 which is not reachable. (3) R1's IPv6 EUI-64 configuration on G0/0 generates an interface ID from the MAC, but R2 expects a static address 2001:db8:1::2/64, so R1 must use a static IPv6 address on the same subnet. The fix: change R1's G0/0 mask to /30, add a default route via R2's G0/0 IP (192.0.2.2), and configure a static IPv6 address (e.g., 2001:db8:1::1/64) on R1's G0/0.

Exam trap

Be careful not to confuse the default gateway with an arbitrary IP; it must be the next-hop router's interface IP on the same subnet. Also, remember that EUI-64 generates a unique interface ID from the MAC, which may not match a statically configured peer address—both sides must use consistent addressing methods.

Why the other options are wrong

The default gateway must be R2's directly connected interface IP (192.0.2.2), not 192.0.2.254. EUI-64 cannot be used if the peer expects a specific static address on the same subnet.

The subnet mask must be consistent on both ends of the link. A /24 mask on one side and /30 on the other creates overlapping subnets and routing issues.

EUI-64 does not guarantee that the resulting IPv6 address will be on the same subnet as a statically configured peer address. For direct connectivity, both routers must have addresses in the same subnet.

Practice this question →

261

MCQhard

A router interface is configured with the prefix 2001:db8:acad:12::/64 and uses EUI-64 to build the interface ID. What is the main purpose of EUI-64 in this context?

A.It automatically creates the interface ID portion of the IPv6 address from the MAC address.

B.It changes the /64 prefix into a /48 prefix for summarization.

C.It replaces the need for a link-local address.

D.It encrypts IPv6 traffic between neighbors.

AnswerA

EUI-64 is the interface ID generation method used when a router interface has no explicit 64-bit host portion configured. The 48-bit MAC address is split, the hex value FFFE is inserted between the OUI and the serial number, and the universal/local bit is flipped to form the 64-bit interface identifier. This automatically completes the IPv6 address and is why the statement is correct.

Why this answer

EUI-64 is used to automatically generate the interface identifier portion of the IPv6 address from the underlying MAC address. In practical terms, the /64 prefix provides the network portion, and EUI-64 helps derive the lower 64 bits without the administrator manually typing a full host portion. This can make addressing easier in environments where automatic formation is desired.

The important idea is that EUI-64 affects the interface ID, not the prefix length or the routing behavior of the network. It is an address-construction method, not a routing protocol.

Exam trap

Remember, EUI-64 is about address generation, not routing or network configuration. Focus on its role in forming the interface ID.

Why the other options are wrong

This option is incorrect because EUI-64 does not change the prefix length of an IPv6 address; it is used solely for generating the interface ID from a MAC address within the existing prefix.

This option is incorrect because EUI-64 does not replace the need for a link-local address; link-local addresses are essential for local network communication in IPv6, regardless of how the global address is generated.

This option is wrong because EUI-64 does not encrypt IPv6 traffic; it is used to generate the interface ID from the MAC address, which is unrelated to encryption processes.

Practice this question →

262

MCQhard

A host address is 10.77.4.141/28. Which address is the network address of the subnet?

A.10.77.4.128

B.10.77.4.143

C.10.77.4.144

D.10.77.4.112

AnswerA

The host address 10.77.4.141 falls within the /28 subnet that starts at 10.77.4.128, because the /28 block size is 16 addresses (128-143). The network address is the first address of that block, where all host bits are zero, so 10.77.4.128 is the correct network address. Any address in the range 10.77.4.129 through 10.77.4.142 is valid for hosts, while .143 is the broadcast.

Why this answer

A /28 subnet has a block size of 16. In practical terms, the last-octet blocks are 0-15, 16-31, 32-47, and so on. Because 141 falls within the 128-143 block, the network address is 10.77.4.128.

This is a clean addressing-boundary question that rewards careful block calculation rather than guesswork.

Exam trap

Be careful not to confuse host addresses with network addresses. Always calculate the subnet block to find the network address.

Why the other options are wrong

Option B, 10.77.4.143, is incorrect because it falls within the usable host range of the subnet defined by 10.77.4.128/28, which spans from 10.77.4.129 to 10.77.4.142. The network address must always be the first address in the subnet.

This option is wrong because 10.77.4.144 is not the network address for the subnet defined by 10.77.4.141/28; the correct network address is 10.77.4.128, which is the first address in the subnet range.

Option D, 10.77.4.112, is incorrect because it does not fall within the subnet defined by the CIDR notation /28, which covers addresses from 10.77.4.128 to 10.77.4.143. The network address for this subnet is 10.77.4.128.

Practice this question →

263

PBQhard

You are connected to the console of R1. The network team wants to secure remote access. R1 currently has no SSH configuration. The domain name is 'example.com' and you need to generate an RSA key pair of 2048 bits and enable SSH version 2 on vty lines.

Network Topology

Hints

•SSH requires a domain name and RSA keys.
•Use 'ip ssh version 2' to enforce SSHv2.
•The vty lines must accept SSH only, not Telnet.

A.Configure IP domain name, generate RSA key pair with 2048 bits, set SSH version 2, and configure vty lines to use SSH.

B.Generate RSA key pair with 2048 bits, set SSH version 2, and configure vty lines to use SSH. Domain name is optional.

C.Configure IP domain name, generate RSA key pair with 2048 bits, and set SSH version 2. No need to configure vty lines.

D.Configure IP domain name, generate RSA key pair with 1024 bits, set SSH version 2, and configure vty lines to use SSH.

AnswerA

solution

! R1
ip domain-name example.com
crypto key generate rsa modulus 2048
ip ssh version 2
line vty 0 4
transport input ssh

Why this answer

SSH requires a hostname and domain name to generate RSA keys. Use 'ip domain-name example.com' then 'crypto key generate rsa general-keys modulus 2048' (the 'general-keys' keyword is required to avoid interactive prompts). Set SSH version 2 with 'ip ssh version 2' and restrict vty lines to SSH only with 'line vty 0 4' and 'transport input ssh'.

Answer A includes all required steps correctly. Option B misses the domain name. Option C omits vty line configuration.

Option D uses the wrong key size.

Exam trap

A common mistake is using 'crypto key generate rsa modulus 2048' without 'general-keys'; IOS requires the keyword to generate the key non-interactively.

Why the other options are wrong

The specific factual error: The domain name is mandatory for RSA key generation in SSH configuration.

The specific factual error: Vty lines require transport input ssh to allow SSH connections.

The specific factual error: The key size must be 2048 bits as specified; 1024 bits is insufficient.

264

MCQhard

Refer to the exhibit. A network engineer is investigating intermittent connectivity complaints on a gigabit uplink between two distribution switches. The engineer runs the show interfaces GigabitEthernet0/0 command on one of the switches. Based on the output, what is the most likely cause of the errors?

A.The interface is configured with an incorrect encapsulation type.

B.A damaged or faulty cable is causing excessive CRC errors.

C.A duplex mismatch exists between the connected devices.

D.The interface is assigned to the wrong VLAN.

AnswerB

The exhibit displays 5200 CRC errors (more than 5000) and 5231 input errors. High CRC counts directly indicate that received frames are being corrupted by physical layer issues such as a damaged cable, loose connector, or EMI on the copper segment.

Why this answer

The output shows a high number of CRC errors and runts, which typically indicate a Layer 1 physical-layer issue such as a damaged or faulty cable. CRC errors occur when frames fail the cyclic redundancy check due to signal degradation, noise, or physical damage to the cabling. On a gigabit uplink, this is the most likely cause of intermittent connectivity.

Exam trap

Cisco often tests the distinction between CRC errors (physical layer) and late collisions (duplex mismatch), so the trap here is that candidates see errors and assume a duplex mismatch without checking for the specific error types like late collisions or alignment errors.

Why the other options are wrong

Encapsulation problems cause protocol failures, not corrupted frames with CRC errors.

Candidates often mistake high CRC counts for duplex issues. The absence of collision-related counters rules out a duplex mismatch.

A wrong VLAN does not generate CRC errors on the physical interface.

Practice this question →

265

MCQhard

A user reports that they cannot access a remote server at IP address 10.10.20.50. The user's PC has IP address 192.168.1.25/24, and the default gateway is 192.168.1.1. The user can successfully ping the default gateway and other hosts on the local subnet. However, pings to 10.10.20.50 fail, and a traceroute shows only the first hop (192.168.1.1) followed by timeouts. Which of the following is the most likely cause?

A.The user's PC has an incorrect subnet mask.

B.The default gateway lacks a route to the 10.10.20.0/24 network.

C.The remote server at 10.10.20.50 is powered off.

D.The user's DNS server is unreachable.

AnswerB

Since the client can ping the gateway but traceroute fails immediately after the first hop, the gateway does not know how to forward packets to 10.10.20.0/24. It either drops the packets or returns an ICMP destination unreachable, causing the observed behavior.

Why this answer

The user can reach local hosts and the default gateway, confirming that the PC's IP configuration and local switching are functional. The traceroute stopping at 192.168.1.1 with subsequent timeouts indicates that the default gateway receives the packets but does not know how to forward them to the 10.10.20.0/24 network. Therefore, the most likely cause is that the default gateway lacks a route to that remote subnet.

Exam trap

Cisco often tests the distinction between local connectivity issues (subnet mask, ARP) and routing issues (missing routes), trapping candidates who assume a failed ping to a remote IP must be due to the destination being down or a DNS problem.

Why the other options are wrong

The user can communicate with the default gateway and other local devices, so the subnet mask is correctly configured for the local network.

A powered-off server would cause timeouts only after the last router before the server, not immediately after the first hop.

Because the user is using the server's IP address, DNS is not involved in this connectivity test.

Practice this question →

266

MCQhard

A subnet requires 200 usable host addresses. Which prefix is the smallest that meets the requirement?

A./25

B./24

C./26

D./27

AnswerB

A /24 prefix allocates 8 bits for host addressing, producing 2^8 = 256 total addresses. After deducting the network and broadcast addresses, 254 usable host addresses remain, which comfortably exceeds the required 200. This makes /24 the correct prefix, as it is the smallest one that meets the requirement.

Why this answer

A /24 is the smallest valid choice. In plain language, the subnet needs enough total addresses so that after the network and broadcast addresses are reserved, 200 hosts still remain. A /25 is too small because it provides only 126 usable hosts. A /24 provides 254 usable hosts, which satisfies the requirement while being the next logical prefix size up.

This is a standard host-capacity planning question. The key is to work from usable hosts, not just total addresses, and then choose the smallest prefix that actually works.

Exam trap

Ensure you calculate usable addresses, not just total addresses, and choose the smallest prefix that meets the requirement.

Why the other options are wrong

A /25 subnet provides 126 usable host addresses, which is insufficient for a requirement of 200 usable addresses. Therefore, it does not meet the specified needs of the question.

A /26 subnet provides only 62 usable host addresses (64 total minus 2 for network and broadcast), which is insufficient for the requirement of 200 usable addresses.

Option D: /27 provides only 30 usable host addresses (32 total addresses minus 2 for network and broadcast), which is insufficient for the requirement of 200 usable host addresses.

Practice this question →

267

MCQhard

A network technician configures a Windows 10 PC with a static IPv6 address of 2001:db8:acad:1::100/64 and a default gateway of 2001:db8:acad:2::1. The PC can communicate with other hosts in the 2001:db8:acad:1::/64 subnet, but it cannot access any resources on other subnets, even though IPv4 connectivity through the same network works normally. What is the most likely reason for this issue?

A.The PC's default gateway address is in a different subnet than the PC's IPv6 address.

B.The PC's IPv6 stack has a corrupted binding that prevents routing.

C.The router's IPv6 routing table does not have a route back to the PC's subnet.

D.The DNS server for IPv6 resolution is misconfigured, causing all off-subnet traffic to fail.

AnswerA

An IPv6 host only uses a default gateway if it is on the same subnet. Since 2001:db8:acad:2::1 is in a different /64 subnet than the PC's 2001:db8:acad:1::100/64, the host considers the gateway unreachable and cannot send traffic beyond the local link.

Why this answer

The PC's IPv6 address is 2001:db8:acad:1::100/64, placing it in the 2001:db8:acad:1::/64 subnet. The configured default gateway is 2001:db8:acad:2::1, which belongs to the 2001:db8:acad:2::/64 subnet. For IPv6, a host will only consider a default gateway on the same link-local or on-link subnet; if the gateway address is not within the same /64 prefix as the host's address, the host cannot send packets to it directly, and all off-subnet traffic fails.

Exam trap

Cisco often tests the concept that an IPv6 host will only use a default gateway that is within the same subnet (same /64 prefix) as its own configured IPv6 address, unlike IPv4 where a gateway in a different subnet can still be used if the host has a route to it.

Why the other options are wrong

This is a less common and less specific cause; the symptom points directly to a misconfigured gateway address in a different subnet.

This option assumes a routing problem on the router, but the scenario indicates the PC cannot send packets to its gateway, which points to host configuration, not routing tables.

DNS misconfiguration would cause failures when using hostnames, but not for direct IP connectivity tests like pinging a remote IPv6 address.

Practice this question →

268

MCQhard

A host is configured as 10.10.20.190/26. Which range contains usable host addresses for that subnet?

A.10.10.20.129 to 10.10.20.190

B.10.10.20.128 to 10.10.20.191

C.10.10.20.130 to 10.10.20.191

D.10.10.20.193 to 10.10.20.254

AnswerA

A /26 prefix length yields a 64-address block. Since the address 10.10.20.128 falls on a 64-byte boundary, the subnet's network address is 10.10.20.128 and its broadcast address is 10.10.20.191. Therefore, the usable host addresses are exactly 10.10.20.129 through 10.10.20.190, as this excludes the network and broadcast identifiers while including every valid host in that range.

Why this answer

A /26 uses blocks of 64 addresses. In plain language, the ranges are 0–63, 64–127, 128–191, and 192–255. Since the host ends in 190, it belongs to the 128–191 block. In that block, 10.10.20.128 is the network address and 10.10.20.191 is the broadcast address. That leaves 10.10.20.129 through 10.10.20.190 as the usable host range.

This question checks whether you can identify the correct block and then exclude the reserved endpoints properly.

Exam trap

Be careful not to include the network and broadcast addresses as usable host addresses. Always calculate the subnet boundaries accurately.

Why the other options are wrong

Option B is incorrect because it includes the network address (10.10.20.128) and the broadcast address (10.10.20.191) for the subnet 10.10.20.128/26, which are not usable host addresses.

Option C is incorrect because the subnet mask /26 indicates a subnet range of 10.10.20.128 to 10.10.20.191, but the usable host addresses are from 10.10.20.129 to 10.10.20.190, excluding the network and broadcast addresses.

Option D is incorrect because the range 10.10.20.193 to 10.10.20.254 falls outside the subnet defined by 10.10.20.190/26, which only allows for usable addresses from 10.10.20.130 to 10.10.20.190.

Practice this question →

269

MCQhard

A technician is troubleshooting a connection between two routers, R1 and R2, connected back-to-back using Ethernet cables. Both routers have their interfaces configured and are in an 'up/up' state. R1's interface uses 192.168.1.1/24, and R2's interface uses 192.168.2.1/24. When the technician attempts to ping R2 from R1, the ping fails. What is the most likely cause?

A.The Ethernet cable is faulty, causing intermittent physical layer failures.

B.A duplex mismatch exists between R1 and R2, causing one-way communication.

C.A routing protocol is not configured to allow the routers to learn about each other's directly connected networks.

D.The IP addresses assigned to the interfaces belong to different subnets, preventing direct Layer 3 communication.

AnswerD

When two devices are in the same broadcast domain and have IP addresses in different subnets, they do not consider each other as local destinations. Router R1 will not attempt to ARP for 192.168.2.1 because it believes that address is in a different network, making the ping fail even though link status is up/up.

Why this answer

The ping fails because R1's interface is configured with IP address 192.168.1.1/24, which places it in the 192.168.1.0/24 subnet, while R2's interface uses 192.168.2.1/24, placing it in the 192.168.2.0/24 subnet. For two devices to communicate directly at Layer 3 over a single Ethernet link, their IP addresses must belong to the same subnet. Since these addresses are in different subnets, R1 will see the destination as unreachable and will not even attempt to send an ARP request for R2's MAC address, resulting in a failed ping.

Exam trap

Cisco often tests the concept that directly connected devices must share the same subnet, and the trap here is that candidates assume 'up/up' means Layer 3 connectivity is guaranteed, or they mistakenly think a routing protocol is needed to exchange routes between directly connected interfaces.

Why the other options are wrong

Candidates might suspect a physical issue first, but the up/up status definitively rules out a cable or hardware problem.

Candidates commonly associate ‘cannot ping’ with duplex mismatches, forgetting that the fundamental issue here is the IP subnet mismatch.

The trap is thinking that a routing protocol is always needed for inter-subnet communication, overlooking that directly connected devices on the same broadcast domain must share a common subnet.

Practice this question →

270

Multi-Selectmedium

Which TWO commands would a network engineer use to verify that a Windows client has received an IP address from a DHCP server and can resolve a domain name to an IP address?

Select 2 answers

A.ping 8.8.8.8

B.ipconfig /all

C.tracert www.courseiva.com

D.nslookup www.courseiva.com

E.arp -a

AnswersB, D

ipconfig /all is the correct command because it displays the full TCP/IP configuration for every network adapter on the system. It explicitly shows whether DHCP is enabled, the DHCP server address, the lease obtained and lease expiration times, and the IP address currently assigned by DHCP, which directly confirms that the DHCP process has completed successfully. It also lists the configured DNS servers and other vital Layer 3 details, making it the definitive tool for diagnosing IP addressing issues in a DHCP environment.

Why this answer

`ipconfig /all` displays the full TCP/IP configuration for all adapters, including whether the IP address was obtained from a DHCP server (the DHCP Enabled and DHCP Server fields). Option D is correct because `nslookup www.courseiva.com` queries the configured DNS server to resolve the domain name to an IP address, confirming DNS resolution works.

Exam trap

Cisco often tests the distinction between connectivity verification (ping) and configuration verification (ipconfig /all, nslookup), leading candidates to mistakenly select ping or tracert as tools for confirming DHCP and DNS functionality.

Why the other options are wrong

It checks network reachability, not DHCP or DNS.

It shows the path taken, not DHCP or DNS status.

It shows Layer 2 address mappings, not DHCP or DNS.

Practice this question →

271

Matchingmedium

Drag and drop the cable/transceiver types on the left to the correct distance and speed descriptions on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

100 m at 1 Gbps

300 m at 10 Gbps

5 km at 1 Gbps

55 m at 10 Gbps

10 km at 10 Gbps

Why these pairings

Option A is correct: Cat5e UTP supports 1000BASE-T at 100 m and 1 Gbps. Option B is incorrect: Cat6 supports 10GBASE-T only up to 55 m; it requires Cat6A for 100 m at 10 Gbps. Option C is correct: 1000BASE-LX over single-mode fiber has a standard reach of 5 km at 1 Gbps.

Option D is correct: 1000BASE-SX over 50 µm multimode fiber has a standard reach of 550 m at 1 Gbps.

Exam trap

Be careful not to assume that Cat6 supports 10 Gbps at 100 meters; IEEE specifies 55 meters for 10GBASE-T on Cat6. Also, remember that fiber standards have different distance capabilities.

Practice this question →

272

Multi-Selectmedium

Which two statements accurately describe the role of a switch MAC address table?

Select 2 answers

A.It maps learned MAC addresses to switch ports for local forwarding decisions.

B.It helps reduce unnecessary flooding when the destination MAC is known.

C.It stores the best Layer 3 routes to remote networks.

D.It contains the router’s OSPF authentication keys.

E.It assigns IP addresses to end hosts dynamically.

AnswersA, B

A switch builds its MAC address table by examining the source MAC addresses of incoming frames and associating them with the ingress port. This learned mapping is then used to make local forwarding decisions, allowing the switch to deliver frames directly to the port associated with the destination MAC address. This is the fundamental operation of Layer 2 switching.

Why this answer

A switch MAC address table helps the switch make local forwarding decisions efficiently. In plain language, the switch learns which MAC addresses appear on which ports and then uses that information to send frames only where they need to go instead of flooding every frame everywhere.

The MAC table is not the same thing as a routing table, and it is not used for OSPF neighbor storage or DHCP lease records.

Exam trap

Avoid confusing the MAC address table with routing tables or ARP tables, which involve IP addresses and routing information.

Why the other options are wrong

This option is wrong because a switch MAC address table does not store Layer 3 routing information; it specifically maps Layer 2 MAC addresses to switch ports for local traffic forwarding.

Option D is incorrect because a switch MAC address table does not store OSPF authentication keys; it is designed to map MAC addresses to switch ports for forwarding decisions within a Layer 2 network.

This option is wrong because a switch MAC address table does not handle IP address assignments; it specifically deals with mapping MAC addresses to switch ports for local traffic forwarding.

Practice this question →

273

MCQhard

A subnet uses the mask 255.255.255.224. How many usable host addresses does it provide?

A.14

B.30

C.62

D.126

AnswerB

The subnet mask 255.255.255.224 equates to a /27 prefix, which leaves only 3 bits for host addressing in the final octet. With 5 host bits total, the block contains 2^5 = 32 addresses. Subtracting the network and broadcast addresses yields exactly 32 - 2 = 30 usable host addresses.

Why this answer

A mask of 255.255.255.224 corresponds to a /27 prefix. In plain language, that leaves 5 host bits available in the address, which creates 32 total addresses in each subnet. Two of those are reserved: one for the network address and one for the broadcast address. That leaves 30 usable host addresses.

This is a classic subnetting question because it tests whether you can move from mask to prefix idea to host count without getting lost. Many learners remember the block size but forget to subtract the network and broadcast entries. The correct answer comes from that full logic chain: /27 means 32 total, and therefore 30 usable.

Exam trap

Remember to subtract the network and broadcast addresses from the total count of addresses in a subnet.

Why the other options are wrong

This option is wrong because a subnet mask of 255.255.255.224 provides 30 usable host addresses, not 14. The calculation is based on the formula 2^(number of host bits) - 2, where the number of host bits is 5 for this subnet mask.

This option is wrong because a subnet mask of 255.255.255.224 allows for 32 total addresses, of which 30 are usable after subtracting the network and broadcast addresses. The calculation is 2^(32-27) - 2 = 30 usable addresses.

Option D is incorrect because a subnet mask of 255.255.255.224 allows for 30 usable host addresses, not 126. The calculation is based on the formula 2^(32 - subnet bits) - 2, where the subnet bits for this mask is 27.

Practice this question →

274

MCQhard

A host address is 10.100.12.94/26. Which address is the broadcast address for that subnet?

A.10.100.12.63

B.10.100.12.127

C.10.100.12.64

D.10.100.12.128

AnswerB

This is correct because .94 is in the 64-127 /26 range.

Why this answer

A /26 subnet has a block size of 64, so the fourth-octet ranges are 0–63, 64–127, 128–191, and 192–255. The host address 10.100.12.94 lies in the 64–127 range, making the broadcast address the last address in that range: 10.100.12.127. Option A (10.100.12.63) is the broadcast of the previous subnet (0–63).

Option C (10.100.12.64) is the network address of the subnet containing the host. Option D (10.100.12.128) is the network address of the next subnet (128–191).

Exam trap

Be careful not to confuse host addresses or network addresses with the broadcast address. Remember, the broadcast address is the last address in the subnet range.

Why the other options are wrong

10.100.12.63 is the broadcast address of the 0–63 subnet, not the one containing 94.

10.100.12.64 is the network address of the 64–127 subnet, not the broadcast.

10.100.12.128 is the network address of the 128–191 subnet, not the broadcast.

Practice this question →

275

Multi-Selectmedium

Which three statements about Power over Ethernet (PoE) and PoE+ standards are correct? (Choose three.)

Select 3 answers

.PoE (IEEE 802.3af) can deliver up to 15.4 watts of power per port.

.PoE+ (IEEE 802.3at) can deliver up to 30 watts of power per port.

.Both PoE and PoE+ use the same four pairs of a twisted-pair cable for power delivery.

.Powered devices (PDs) can negotiate power requirements using Link Layer Discovery Protocol (LLDP) with PoE extensions.

.PoE+ requires Category 3 cabling or better.

.PoE automatically disables power if a non-PoE device is detected.

Why this answer

Option 1 is correct because the IEEE 802.3af PoE standard specifies a maximum power delivery of 15.4 watts per port at the PSE (Power Sourcing Equipment), with a minimum of 12.95 watts guaranteed at the PD (Powered Device) after cable losses. Option 2 is correct because the IEEE 802.3at PoE+ standard increases the maximum power per port to 30 watts at the PSE, with 25.5 watts available at the PD. Option 4 is correct because PDs can negotiate power requirements using LLDP with the IEEE 802.1AB LLDP-MED (Media Endpoint Discovery) extensions, which include PoE TLV (Type-Length-Value) fields for power negotiation beyond the simple classification method.

Option 3 (both PoE and PoE+ use the same four pairs) is incorrect because both standards deliver power over only two pairs (spare or data pairs depending on mode); four-pair power delivery is introduced in IEEE 802.3bt (PoE++). Option 5 (PoE+ requires Category 3 cabling) is incorrect because PoE+ requires at least Category 5e cabling to support the higher power levels without excessive heat or signal degradation. Option 6 (PoE automatically disables power if a non-PoE device is detected) is incorrect because the PSE first performs a detection phase to identify a valid PoE signature; if none is found, power is never applied—so it is not disabled after being enabled.

Exam trap

Cisco often tests the misconception that PoE and PoE+ both use all four pairs for power delivery, when in fact they use only two pairs, and the four-pair delivery is exclusive to the 802.3bt standard (PoE++).

Why the other options are wrong

Both PoE and PoE+ use only two pairs for power delivery, not four; four-pair delivery is exclusive to 802.3bt (PoE++).

PoE+ requires Category 5e or better cabling, as Category 3 cannot safely support the higher current.

PoE does not disable power on a non-PoE device; detection prevents power from ever being applied to non-compliant devices.

Practice this question →

276

MCQhard

A network engineer notices that the router interface GigabitEthernet0/1 is in an 'administratively down' state in the output of the show ip interface brief command, preventing connectivity to the subnet connected to that interface. What is the most likely cause?

A.The interface does not have an IP address assigned.

B.The shutdown command is configured on the interface.

C.The interface is configured with an incorrect subnet mask.

D.An access list is blocking traffic on the interface.

AnswerB

The 'administratively down' status is only displayed when the interface has been explicitly disabled using the shutdown command in configuration mode. This command sets a software flag that prevents the interface from forwarding any traffic and forces the line status to 'administratively down' regardless of the physical connection. It is a direct, intentional administrative action, and the interface will remain in this state until the no shutdown command is issued. Thus, the shutdown command is the definitive cause for this status.

Why this answer

The 'administratively down' state in the output of 'show ip interface brief' indicates that the interface has been manually disabled using the 'shutdown' command. This is a Layer 1/2 administrative state, not a protocol or connectivity issue. To bring the interface up, the 'no shutdown' command must be applied in interface configuration mode.

Exam trap

Cisco often tests the distinction between 'administratively down' (caused by the 'shutdown' command) and 'down/down' (caused by a physical layer issue like a disconnected cable), leading candidates to confuse the two states.

Why the other options are wrong

Candidates often confuse the lack of an IP address with a non-functional interface, believing it will be shown as down.

Students may think any IP misconfiguration could bring the interface down, but only the shutdown command causes 'administratively down'.

Because an ACL can stop traffic, candidates sometimes assume it would be reflected as a down state, but interface status is independent of ACLs.

Practice this question →

277

MCQhard

A subnet uses the prefix /29. How many usable host addresses are available in each subnet?

A.2

B.6

C.14

D.30

AnswerB

A /29 prefix leaves 3 host bits (32 - 29 = 3), yielding 2^3 = 8 total IPv4 addresses in the subnet. After reserving one address for the network identifier and one for the directed broadcast address, exactly 8 - 2 = 6 addresses remain assignable to hosts. This matches the formula 2^(32 - prefix) - 2, which is the standard way to calculate usable host capacity.

Why this answer

A /29 prefix leaves 3 host bits, which creates 8 total addresses per subnet. In plain language, two of those addresses cannot be assigned to hosts because one identifies the subnet itself and one is reserved as the broadcast address. That leaves 6 usable host addresses. This is a standard CCNA calculation because it checks whether you understand both the total address count and the subtraction of the reserved addresses.

Many candidates remember powers of two but forget to account for the network and broadcast addresses when the question asks for usable hosts. The safest process is to calculate the total size first and then reduce it by two. That is how you arrive at 6 usable addresses for a /29.

Exam trap

Remember to subtract the network and broadcast addresses from the total count to find usable addresses.

Why the other options are wrong

Option A is incorrect because a /29 subnet provides 8 total IP addresses, of which 6 are usable for hosts after accounting for the network and broadcast addresses.

Option C is wrong because a /29 subnet provides 8 total IP addresses, of which 6 are usable for hosts after reserving one for the network address and one for the broadcast address.

Option D is incorrect because a /29 subnet provides 8 total IP addresses, of which 6 are usable for hosts after accounting for the network and broadcast addresses. Therefore, stating that there are 30 usable addresses is inaccurate.

Practice this question →

278

PBQhard

You are connected to a Cisco 9800 WLC (WLC1) via its management interface. A wireless client reports association failures with SSID 'CorpNet'. The client uses WPA3-Personal, but the WLAN is configured for WPA2. Additionally, the SSID is hidden and the client is on the wrong VLAN (VLAN 20 instead of VLAN 100). Fix these issues so the client can associate successfully with WPA3, on VLAN 100, and with the SSID broadcast enabled.

Network Topology

Hints

•Check the WLAN security settings: WPA3 requires 'security wpa wpa3' and removal of 'wpa2'.
•The SSID is hidden; use 'broadcast-ssid' under the WLAN configuration.
•The policy tag assigns VLAN 20; change it to VLAN 100 to match client requirements.

A.Enable SSID broadcast, change security to WPA3-Personal, and assign VLAN 100 in the policy tag.

B.Enable SSID broadcast, change security to WPA2-PSK, and assign VLAN 20 in the policy tag.

C.Disable SSID broadcast, change security to WPA3-Personal, and assign VLAN 100 in the policy tag.

D.Enable SSID broadcast, change security to WPA3-Enterprise, and assign VLAN 100 in the policy tag.

AnswerA

solution

! WLC1
configure terminal
wlan CorpNet 1 CorpNet
broadcast-ssid
no security wpa wpa2
security wpa wpa3
security wpa psk set-ccmp 0 7 1234567890
exit
wireless tag policy default-policy
vlan 100
end
write memory

Why this answer

The WLAN was configured for WPA2-PSK with a hidden SSID, and the policy tag assigned VLAN 20 instead of VLAN 100. To fix: (1) Enable SSID broadcast with 'broadcast-ssid'. (2) Change security to WPA3-Personal by removing WPA2 and enabling WPA3 with 'security wpa wpa3' and 'security wpa psk set-ccmp'. (3) Assign VLAN 100 in the policy tag with 'vlan 100'. The client should then associate.

Exam trap

Be careful to distinguish between WPA2 and WPA3, and between Personal (PSK) and Enterprise (802.1X). Also, remember that a hidden SSID must be broadcast for clients to discover it, and VLAN assignment is done in the policy tag, not the SSID configuration.

Why the other options are wrong

The specific factual error is that the client uses WPA3-Personal, so changing to WPA2-PSK does not meet the requirement. Also, VLAN 20 is the wrong VLAN.

The specific factual error is that the SSID is currently hidden and the client cannot see it; enabling broadcast is required, not disabling.

The specific factual error is that WPA3-Personal uses a pre-shared key, while WPA3-Enterprise requires 802.1X authentication. The client is configured for Personal mode.

Practice this question →

279

PBQhard

You are connected to R1 via the console. The network administrator reports that PC1 (connected to R1's GigabitEthernet0/1) cannot reach the internet. Troubleshoot the issue step by step. The current configuration and show outputs are provided.

Hints

•Check if PC1 can ping the default gateway and the next-hop router.
•Verify R1's default route.
•If all local connectivity works, the issue is likely beyond R1 (ISP side).

A.PC1 has an incorrect default gateway configured.

B.R1 is missing a default route to the ISP.

C.routing or NAT issue beyond the local network

D.PC1 has a DNS resolution issue.

AnswerC

solution

! R1

Why this answer

The issue is that PC1 cannot reach the internet despite having correct IP, gateway, and DNS. PC1 can ping the default gateway and even the next-hop router (203.0.113.2), but fails to ping 8.8.8.8. This indicates that the problem is beyond the local network — likely a routing or NAT issue on the ISP side.

However, the task requires troubleshooting client connectivity; the provided outputs show no misconfiguration on PC1 or R1. The fault is external (ISP not routing or no NAT), but the candidate must verify that client configuration is correct and then escalate or check the ISP link. For the PBQ, the candidate should confirm that PC1's IP, subnet mask, gateway, and DNS are correct, and that R1 has a default route and can reach the next hop.

No configuration changes are needed on R1 or PC1; the problem is outside the scope of the local network.

Exam trap

The trap is that candidates may focus on local misconfigurations (gateway, DNS, routing) when the evidence shows local connectivity works. Always verify step by step: if the client can ping the gateway and next hop, the problem is external.

Why the other options are wrong

The specific factual error is that a reachable gateway implies correct configuration; if the gateway were wrong, pinging it would fail.

The specific factual error is that reachability to the next hop requires a route; if R1 were missing a default route, it could not forward packets to the next hop.

The specific factual error is that DNS is only needed for name resolution; pinging an IP address bypasses DNS entirely.

Practice this question →

280

MCQhard

A user reports that their computer cannot access the network. The technician checks the computer's IP configuration and finds an APIPA address (169.254.x.x). The computer is connected to a switch port on VLAN 20. The DHCP server is located on VLAN 1. The technician then examines the router's interfaces using 'show ip interface brief' and sees that all interfaces shown are up/up. What should the technician do next?

A.Check the DHCP server logs to see if it is receiving Discover messages.

B.Verify that the ip helper-address command is configured on the router's VLAN 20 interface.

C.Attempt to ping the DHCP server's IP address from the host's APIPA address.

D.Restart the DHCP service on the server and recheck the host.

AnswerB

The router is the intervlan router, and the DHCP server is on a different subnet. For a DHCP Discover broadcast to cross VLANs, the router must have an IP helper-address pointing to the DHCP server's IP address on the VLAN 20 interface. Since all ports are up/up, the problem is almost certainly the missing relay. Checking this config directly addresses the most probable cause.

Why this answer

The APIPA address (169.254.x.x) indicates the host failed to obtain a DHCP lease. Since the DHCP server is on VLAN 1 and the host is on VLAN 20, a DHCP relay (ip helper-address) must be configured on the router's VLAN 20 interface to forward DHCP broadcast messages to the server. The 'show ip interface brief' shows all interfaces are up/up, so the next logical step is to verify the relay configuration.

Exam trap

Cisco often tests the concept that a DHCP relay (ip helper-address) is required when the DHCP server is on a different subnet, and candidates mistakenly focus on server-side issues or ping tests instead of the router configuration.

Why the other options are wrong

This action assumes the DHCP request has already reached the server; it bypasses verifying the network path that would deliver the broadcast to the server, which is the most likely missing piece.

Candidates might think that if the ping fails, the problem is network connectivity, but APIPA addresses are non-routable and the test itself is invalid in this context.

Many techs jump to rebooting a service when a simple configuration check would reveal the real problem. This violates the principle of least intrusive troubleshooting.

Practice this question →

281

Drag & Dropmedium

Drag and drop the following steps into the correct order to describe how data is encapsulated as it travels down the OSI model layers.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Data originates at the application layer as user data. The transport layer then encapsulates this data by adding a header (e.g., TCP or UDP) to create a segment. The network layer further adds an IP header to the segment, forming a packet.

Next, the data link layer appends a frame header and trailer to the packet, resulting in a frame. Finally, the physical layer converts the entire frame into bits for electrical, optical, or radio transmission. This sequence follows the standard top-down encapsulation process in network communication.

Practice this question →

282

MCQhard

A host is configured with 192.168.10.129/25. Which subnet contains that host?

A.192.168.10.0/25

B.192.168.10.64/25

C.192.168.10.128/25

D.192.168.10.192/25

AnswerC

A /25 mask uses a 128-bit block size in the fourth octet, so the valid subnets within 192.168.10.0/24 are 192.168.10.0/25 and 192.168.10.128/25. The address .129 is within the upper block's range .128–.255, making it a host in that subnet. Its usable host range is .129–.254 with broadcast .255.

Why this answer

A /25 divides the /24 into two blocks: 0–127 and 128–255. In practical terms, 192.168.10.129 belongs to the upper half, so the containing subnet is 192.168.10.128/25.

This is a simple subnet-boundary question, but it is designed to confirm that you can identify the correct half of the /24 quickly and confidently.

Exam trap

A frequent exam trap is misidentifying the subnet boundaries for a /25 mask within a /24 network. Candidates often mistakenly believe that subnets start at .64 or .192, confusing /25 with other subnet sizes like /26 or /27. This leads to selecting incorrect subnets such as 192.168.10.64/25 or 192.168.10.192/25, which are invalid because /25 only divides the /24 into two halves starting at .0 and .128.

This misunderstanding causes errors in subnet identification and can result in wrong routing or access decisions in real networks.

Why the other options are wrong

192.168.10.0/25 covers IP addresses from 192.168.10.0 to 192.168.10.127. Since the host IP is 192.168.10.129, which is greater than .127, it does not belong to this subnet, making this option incorrect.

192.168.10.64/25 is not a valid /25 subnet boundary within a /24 network. /25 subnets split at .0 and .128 only, so this option is invalid and cannot contain the host 192.168.10.129.

192.168.10.192/25 is not a valid /25 subnet boundary within a /24 network. The /25 mask divides the network into two subnets only, starting at .0 and .128, so this option is incorrect.

Practice this question →

283

MCQmedium

A network technician is troubleshooting a connectivity issue where a user's email client cannot send messages, but the client can receive emails. The technician uses a protocol analyzer and sees that the client is successfully resolving the mail server's domain name to an IP address and establishing a TCP connection, but the server responds with an application-layer error. At which layers of the OSI model are the problem and the successful operations occurring, respectively?

A.The problem is at the Transport layer (Layer 4); successful operations are at the Application layer (Layer 7) only.

B.The problem is at the Application layer (Layer 7); successful operations are at the Application layer (Layer 7) and Transport layer (Layer 4).

C.The problem is at the Network layer (Layer 3); successful operations are at the Data Link layer (Layer 2) and Physical layer (Layer 1).

D.The problem is at the Presentation layer (Layer 6); successful operations are at the Session layer (Layer 5) and Transport layer (Layer 4).

AnswerB

The sequence of successful operations shows DNS resolution (Application layer, Layer 7) and a TCP handshake to the mail server's port 25 (Transport layer, Layer 4). These two layers are working end-to-end. The mail server returns an SMTP error after the connection is established, such as a rejected recipient or a policy violation. That error is an application-level protocol response, so the fault lies squarely in the Application layer (Layer 7), not in any lower layer.

Why this answer

The problem is at the Application layer (Layer 7) because the email client can resolve the domain name (DNS, Layer 7), establish a TCP connection (Transport layer, Layer 4), but the mail server returns an application-layer error (e.g., SMTP 550 or 554), indicating the issue lies in the email protocol itself (e.g., authentication failure, mailbox full, or rejected sender). Successful operations include DNS resolution (Application layer) and TCP three-way handshake (Transport layer), confirming layers 7 and 4 are functioning correctly.

Exam trap

Cisco often tests the distinction between successful lower-layer operations (DNS, TCP) and an application-layer failure, trapping candidates who assume any email problem must be at the Transport or Network layer because they confuse 'connection established' with 'protocol function working'.

Why the other options are wrong

The TCP handshake succeeded, so the Transport layer is working. The error message is generated by the application, not the transport protocol.

Successful TCP connection implies IP routing (Layer 3) is working. The error is not related to addressing or routing.

Email sending failures are typically application logic errors, not encryption/formatting or session problems. Also, DNS is an Application layer protocol, not Session or Presentation.

Practice this question →

284

Multi-Selectmedium

Which three of the following are correct steps in the process of CDP (Cisco Discovery Protocol) neighbor discovery? (Choose three.)

Select 3 answers

.CDP operates at Layer 2 and sends advertisements to the multicast address 01:00:0C:CC:CC:CC.

.CDP advertisements include the device identifier, platform, and capabilities.

.CDP is enabled by default on Cisco devices and runs over all interfaces that support SNAP headers.

.CDP advertisements are sent every 30 seconds by default.

.CDP can discover devices that are more than one Layer 2 hop away.

.CDP requires that both devices be in the same IP subnet.

Why this answer

CDP is a Cisco proprietary Layer 2 protocol that uses multicast MAC address 01:00:0C:CC:CC:CC to send advertisements to directly connected neighbors. Advertisements include device identifier, platform, and capabilities. CDP is enabled by default on Cisco devices and runs over interfaces supporting SNAP headers.

Incorrect options: CDP advertisements are sent every 60 seconds by default (not 30); CDP discovers only directly connected neighbors (not devices more than one L2 hop away); CDP does not require both devices to be in the same IP subnet because it operates at Layer 2.

Exam trap

A common mistake is thinking CDP uses a broadcast address or operates at Layer 3; another trap is confusing the default CDP timer (60 seconds) with the 30-second timer of other protocols like LLDP.

Why the other options are wrong

CDP advertisements are sent every 60 seconds by default, not 30.

CDP discovers only directly connected neighbors; it does not propagate beyond one Layer 2 hop.

CDP operates at Layer 2 and does not require devices to be in the same IP subnet.

Practice this question →

285

Drag & Drophard

Drag and drop the following steps into the correct order to configure a WLAN for WPA3-Enterprise on a Cisco WLC and sequence a wireless client association process.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The configuration creates the WLAN with WPA3-Enterprise security, enables it, then the client associates and completes 802.1X authentication before getting an IP.

Exam trap

Do not confuse the order of 802.1X authentication and DHCP. In WPA3-Enterprise, the client must authenticate before obtaining an IP address. Also, remember that a WLAN must be created before it can be enabled, and it must be enabled before clients can associate.

Practice this question →

286

PBQhard

You are connected to R1 via console. The link between R1 and R2 is experiencing packet loss and CRC errors. Configure interface speed and duplex on R1's GigabitEthernet0/0 to match R2's settings, then replace the SFP module with one that supports the required 2 km distance. Finally, verify the interface is operational without errors.

Network Topology

Hints

•CRC errors often indicate a duplex mismatch. Check the neighbor's configuration.
•Auto-negotiation must be disabled on both ends if one side is hardcoded.
•The current SFP is rated for 550m; for 2 km you need a long-range SFP (e.g., 1000BASE-LX).

A.Configure speed 1000, duplex full, and no negotiation auto on Gi0/0, then replace the SFP-GE-SX with SFP-GE-L.

B.Configure speed 1000 and duplex full on Gi0/0, then replace the SFP-GE-SX with SFP-GE-SX-MM.

C.Configure speed 100 and duplex full on Gi0/0, then replace the SFP-GE-SX with SFP-GE-L.

D.Configure no negotiation auto on Gi0/0, then replace the SFP-GE-SX with SFP-GE-L.

AnswerA

solution

! R1
configure terminal
interface GigabitEthernet0/0
speed 1000
duplex full
no negotiation auto
end
copy running-config startup-config

Why this answer

The CRC errors indicate a duplex mismatch or faulty medium. R1 is set to auto-negotiation while R2 is hardcoded to 1000/full, causing mismatch. First, set speed and duplex on R1 to match R2: 'speed 1000' and 'duplex full'.

Also disable auto-negotiation with 'no negotiation auto'. The existing SFP-GE-SX only supports 550m, but the link requires 2 km; replace it with a 1000BASE-LX/LH SFP (SFP-GE-L) which supports up to 10 km. After changes, verify with 'show interfaces Gi0/0' to confirm no CRC errors and correct speed/duplex.

Exam trap

Do not forget to disable auto-negotiation when manually setting speed and duplex on a Cisco interface. Also, remember that SFP types have specific distance limitations: SX for short reach (550m), LX/LH for long reach (10 km), and EX or ZX for even longer distances.

Why the other options are wrong

The SFP-GE-SX-MM is a multimode SFP with the same distance limitation as the original SFP-GE-SX.

The speed must match exactly; 100 Mbps is not compatible with 1000 Mbps.

When auto-negotiation is disabled, speed and duplex must be manually set; otherwise, the interface may default to half-duplex or other incompatible settings.

Practice this question →

287

MCQhard

A host address is 172.22.14.99/27. Which address is the broadcast address of the subnet?

A.172.22.14.95

B.172.22.14.127

C.172.22.14.96

D.172.22.14.128

AnswerB

172.22.14.127 is the broadcast address for the /27 subnet that contains host 172.22.14.99. Since the /27 mask creates 32-address blocks, the relevant block runs from 172.22.14.96 through 172.22.14.127, and the broadcast is always the final address in that block. The host bits in .127 are all ones, which identifies this as the directed broadcast for this subnet.

Why this answer

A /27 subnet has a block size of 32. In practical terms, the relevant blocks are 0-31, 32-63, 64-95, 96-127, and so on. Because 99 falls within the 96-127 block, the broadcast address is the last address in that block: 172.22.14.127.

This is a classic subnet-boundary question and remains important because addressing precision appears throughout the CCNA blueprint.

Exam trap

Be careful not to confuse network addresses with broadcast addresses, and ensure you are calculating the correct subnet range.

Why the other options are wrong

Option A is incorrect because the broadcast address for the subnet 172.22.14.99/27 is 172.22.14.127, not 172.22.14.95. The /27 subnet mask indicates that the last 5 bits are for host addresses, allowing for a range of addresses that ends at 172.22.14.127.

Option C (172.22.14.96) is incorrect because it falls within the usable host range of the subnet and is not the broadcast address. The broadcast address for the subnet 172.22.14.96/27 is actually 172.22.14.127.

Option D, 172.22.14.128, is incorrect because it does not fall within the subnet defined by 172.22.14.99/27, which has a valid range of 172.22.14.96 to 172.22.14.127. The broadcast address for this subnet is 172.22.14.127.

Practice this question →

288

MCQhard

An administrator deploys a new WLAN on a Cisco 9800 WLC using WPA3-Personal (SAE) with AES encryption. A single 802.11ax laptop running Windows 10 fails to connect, displaying an authentication timeout despite entering the correct passphrase. Other clients, including legacy 802.11ac devices, connect without issue.

A.The WLC’s WLAN is misconfigured for WPA3-Enterprise, and the laptop lacks a supplicant for 802.1X authentication.

B.The laptop’s wireless adapter does not support Protected Management Frames, which are mandatory for WPA3-Personal.

C.The WLC has disabled 802.11ax OFDMA on the 5 GHz band, preventing the 802.11ax laptop from associating.

D.The laptop’s driver is configured for 160 MHz channel width, which is incompatible with the WLC’s channel plan, causing authentication to fail.

AnswerB

For WPA3-Personal, the client and access point must negotiate Protected Management Frames (PMF) as part of the RSN information element during association; PMF is not optional but mandatory in WPA3. If the laptop's wireless adapter does not advertise or enable the Management Frame Protection Capable bit, the WLC cannot complete the handshake, causing SAE authentication to time out. This explains why only this 802.11ax-capable device fails while others succeed—it reflects a client-side capability gap, not a network-wide configuration error.

Why this answer

WPA3-Personal (SAE) mandates the use of Protected Management Frames (PMF) as defined in IEEE 802.11w. If the laptop's wireless adapter or driver does not support PMF, it cannot complete the SAE handshake, resulting in an authentication timeout. Legacy 802.11ac clients can connect because they are using WPA2, which does not require PMF.

Exam trap

Cisco often tests the mandatory dependency of Protected Management Frames (802.11w) for WPA3-Personal, leading candidates to incorrectly attribute the failure to channel width or OFDMA incompatibility.

Why the other options are wrong

Misidentifying the WLAN security type: WPA3-Personal does not require an enterprise supplicant, so this is not the cause.

Confusing radio resource management with connection establishment: OFDMA settings do not block initial association, only data transmission efficiency.

Misattributing connection failures to channel bandwidth settings; these are negotiated after successful association and do not impact the 802.11 authentication and association phases.

Practice this question →

289

MCQhard

Two routers, R1 and R2, are connected via a serial link. The interface on R1 shows 'Serial0/0 is up, line protocol is down' and no pings succeed across the link. You check the configuration and notice R1 has 'encapsulation ppp' but R2's serial interface was mistakenly left at the default encapsulation hdlc.

A.The IP addresses on the serial interfaces are in different subnets, so packets are dropped at Layer 3.

B.The mismatched encapsulation types prevent the routers from forming a Layer 2 connection, so the line protocol remains down.

C.The serial cable is faulty, causing physical layer issues that trigger the line protocol down state.

D.The routers are missing a routing protocol configuration, so they cannot route traffic across the link.

AnswerB

This is the correct diagnosis. The serial interfaces are configured with different encapsulations: one uses PPP and the other uses HDLC (or another incompatible type). Each encapsulation defines a distinct frame structure, and a router receiving a frame that does not match its configured format cannot interpret the contents or properly validate the keepalive messages. Consequently, the keepalive process fails, and the router marks the line protocol as 'down' even though the physical layer (carrier detect) remains active. This is a classic Layer 2 mismatch that prevents the routers from ever establishing a working data-link connection.

Why this answer

The line protocol on a serial interface requires both ends to agree on the Layer 2 encapsulation type. R1 is configured with PPP (encapsulation ppp), while R2 defaults to HDLC. Since these encapsulations are incompatible, the routers cannot establish a valid Layer 2 connection, causing the line protocol to remain down despite the physical layer being up.

Exam trap

Cisco often tests the distinction between 'line protocol is down' (Layer 2 issue) and 'Serial0/0 is down' (Layer 1 issue), and candidates mistakenly attribute a line protocol down state to physical problems or IP addressing errors rather than encapsulation mismatch.

Why the other options are wrong

The line protocol down state is a Layer 2 indicator, not a Layer 3 problem. It reflects the failure of the data link layer to establish a connection, independent of IP addressing.

The 'interface up' part of the status explicitly confirms that the physical layer (Layer 1) is operational. A faulty cable would cause both physical and line protocol to show down.

Line protocol down indicates a Layer 2 failure, which occurs before any routing decision. Even without a routing protocol, the line protocol would come up if Layer 2 were functional, because the interface status is independent of routing.

Practice this question →

290

MCQhard

A technician is troubleshooting a connectivity issue where a workstation connected to a Cisco switch port cannot ping other hosts that are in the same VLAN 10 segment. The technician runs the show mac address-table command and notices that the workstation's MAC address is listed on VLAN 1, not VLAN 10. What is the most likely cause?

A.The switch port is not configured with the switchport access vlan 10 command.

B.The switch port is configured as a trunk with native VLAN 1.

C.The MAC address table contains a stale entry that must be cleared.

D.Spanning Tree Protocol has placed the port in a blocking state.

AnswerA

When an access port's VLAN is not explicitly set, the port defaults to VLAN 1. The workstation's MAC is learned on VLAN 1, causing connectivity failure with VLAN 10 hosts. Adding the switchport access vlan 10 command resolves the issue.

Why this answer

The workstation's MAC address appears in VLAN 1 instead of VLAN 10 because the switch port is operating in the default VLAN (VLAN 1). The most likely cause is that the port has not been explicitly assigned to VLAN 10 using the `switchport access vlan 10` command. Without this command, the port remains in its default access VLAN (VLAN 1), so all frames from the workstation are associated with VLAN 1, preventing communication with hosts in VLAN 10.

Exam trap

Cisco often tests the default VLAN behavior (VLAN 1) and the fact that an access port without an explicit VLAN assignment remains in VLAN 1, leading candidates to overlook the missing `switchport access vlan` command and instead blame trunking, STP, or MAC table aging.

Why the other options are wrong

Candidates often assume any VLAN mismatch with VLAN 1 indicates a trunk misconfiguration, but a missing access VLAN is the more common and direct cause.

Candidates might think that an outdated MAC record is causing the VLAN display, but the dynamic learning process reflects the actual port VLAN.

Tempting because a blocked port can disrupt connectivity, but the MAC address table entry would still appear on the correct VLAN, not default to VLAN 1.

Practice this question →

291

MCQmedium

Exhibit: A host on VLAN 10 can ping the local SVI but not a server in VLAN 20. The Layer 3 switch has both VLAN interfaces up. What is the next item to verify first?

A.Whether the server in VLAN 20 has the correct default gateway

B.Whether the switch should disable IP routing

C.Whether VLAN 10 should be the native VLAN

D.Whether the host should use a /8 mask instead of /24

AnswerA

The most likely fault is that the server in VLAN 20 lacks a properly configured default gateway (or has a gateway that points to a different router/switch). When the VLAN 10 host pings the server, the ICMP echo request is routed by the switch's SVI to VLAN 20, but if the server cannot send the echo reply back through the correct next hop, the ping fails. This creates a one-way reachability issue that is a classic symptom of an end-host gateway misconfiguration, not a problem with the switch's routing table or trunking.

Why this answer

If the source host can reach its own default gateway, the local VLAN and access port are probably fine. The next practical check is whether the server in VLAN 20 has the correct IP address, mask, and default gateway configured.

Exam trap

A frequent exam trap is to overlook the remote device’s default gateway configuration and instead suspect the Layer 3 switch’s routing or VLAN setup. Candidates often assume that because the VLAN interfaces are up, routing must be functional. However, if the server in VLAN 20 lacks the correct default gateway pointing to its VLAN SVI, it cannot return traffic to the source host, causing failed pings.

This one-way communication failure can mislead candidates into troubleshooting switch settings unnecessarily, wasting time and missing the root cause.

Why the other options are wrong

Disabling IP routing on the Layer 3 switch would prevent inter-VLAN routing entirely. Since both VLAN interfaces are up and the host can ping its local SVI, IP routing is likely enabled, so this is not the first item to verify.

The native VLAN setting affects untagged traffic on trunk links but does not directly impact inter-VLAN routing or the ability of hosts to communicate across VLANs. It is not the primary cause of the described symptom.

Using a /8 mask instead of /24 would cause subnetting issues, but since the host can ping its own VLAN interface, the subnet mask is likely correct. This is not the first or most probable cause of the problem.

Practice this question →

292

MCQhard

A host address is 10.10.10.14/29. Which address is the broadcast address for its subnet?

A.10.10.10.7

B.10.10.10.15

C.10.10.10.8

D.10.10.10.16

AnswerB

The /29 CIDR notation specifies that the first 29 bits define the network portion, leaving 3 bits for host addresses. For the 10.10.10.14/29 subnet, the network address is 10.10.10.8. The broadcast address is always the last address within a subnet, derived by setting all host bits to one. In this scenario, setting the three host bits of the 10.10.10.8 network to one results in 10.10.10.15, which functions as the broadcast address for this specific subnet, satisfying the constraint of the /29 mask.

Why this answer

A /29 subnet has a block size of 8. In practical terms, the fourth-octet ranges are 0–7, 8–15, 16–23, and so on. Since 14 falls in the 8–15 block, the broadcast address is the last address in that block, which is 10.10.10.15.

This is a classic subnetting question that checks whether you can find the block first and then identify the final address in that block.

Exam trap

Avoid confusing the network address or a host address with the broadcast address. Remember, the broadcast address is the last address in the subnet range.

Why the other options are wrong

Option A, 10.10.10.7, is incorrect because it does not represent the broadcast address for the subnet defined by 10.10.10.14/29. The correct broadcast address is 10.10.10.15, which is the highest address in the subnet range.

The address 10.10.10.8 is not the broadcast address for the subnet 10.10.10.14/29. The correct broadcast address is 10.10.10.15, which is the highest address in the subnet range from 10.10.10.8 to 10.10.10.15.

The address 10.10.10.16 is outside the subnet defined by 10.10.10.14/29, which includes addresses from 10.10.10.8 to 10.10.10.15. Therefore, it cannot be the broadcast address for this subnet.

Practice this question →

293

MCQhard

A host with address 172.16.5.10/23 wants to determine whether 172.16.6.20 is on the same local network. What is the correct conclusion?

A.It is on the same local network because both addresses begin with 172.16.

B.It is on the same local network because /23 covers all addresses in 172.16.5.x and 172.16.6.x

C.It is on a different network, so the host should use the default gateway

D.It is on a different network, so ARP will resolve it across the router automatically

AnswerC

The host determines the network address by performing a bitwise AND operation between its IP address (172.16.5.10) and its /23 subnet mask (255.255.254.0), resulting in 172.16.4.0. It then applies the same subnet mask to the target IP (172.16.6.20), yielding 172.16.6.0. Since these calculated network addresses differ, the host concludes the target is on a different network. Consequently, it must forward traffic to its default gateway for routing.

Why this answer

A /23 prefix covers two consecutive /24 ranges. In plain language, that means the network boundaries move in blocks of 2 in the third octet. The address 172.16.5.10/23 belongs to the 172.16.4.0/23 network, which covers 172.16.4.x and 172.16.5.x. The destination 172.16.6.20 belongs to a different /23 block, so it is not on the same local network.

This question checks whether you can think beyond default /24 boundaries and understand how a broader prefix changes the local network range. The host would therefore need to use its default gateway to reach 172.16.6.20, because that destination is off-subnet relative to the /23 in use.

Exam trap

Don't assume addresses with the same initial octets are in the same subnet; always calculate based on the subnet mask.

Why the other options are wrong

This option is incorrect because the addresses 172.16.5.10 and 172.16.6.20 belong to different subnets; 172.16.6.20 is in the 172.16.6.0/23 subnet, while 172.16.5.10 is in the 172.16.5.0/23 subnet.

This option is incorrect because a /23 subnet mask allows for addresses in the range of 172.16.4.0 to 172.16.5.255, meaning 172.16.6.20 is outside this range and not on the same local network.

Option D is incorrect because ARP (Address Resolution Protocol) operates within the same local network and cannot resolve addresses across routers. Since 172.16.6.20 is on a different network than 172.16.5.10, ARP cannot automatically resolve it.

Practice this question →

294

PBQmedium

You are connected to the console of R1. The network has a point-to-point serial link between R1 and R2. The link is down and the line protocol is down. The cable is a DCE/DTE crossover, and R1 is the DCE. The initial configuration shows the interface with an IP address but no clock rate set.

Network Topology

Hints

•The DCE side must provide the clock rate.
•Check the cable type using 'show controllers'.
•Common clock rates are 64000, 128000, 256000, etc.

A.Configure the clock rate on R1's serial interface.

B.Configure the clock rate on R2's serial interface.

C.Replace the serial cable with a straight-through cable.

D.Set the encapsulation on both ends to PPP.

AnswerA

solution

! R1
interface Serial0/0/0
clock rate 128000

Why this answer

On a serial DCE cable, the DCE end must configure a clock rate to provide timing. Without it, the line protocol stays down. Setting 'clock rate 128000' on R1 resolved the issue.

Exam trap

Remember that 'down/down' indicates a Layer 1 issue. On serial links, the DCE must provide clocking. Do not confuse DCE/DTE roles or jump to Layer 2 solutions like encapsulation.

Why the other options are wrong

The DTE end does not set clock rate; only the DCE end does.

Serial cables are always DCE/DTE crossover; straight-through cables are for Ethernet.

Encapsulation mismatch causes protocol down, not line protocol down; the line protocol is down due to no clock.

295

Matchingmedium

Match each IPv4-related concept to its most accurate role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Defines which destinations are local versus remote

Next hop used for off-subnet traffic

Address used to reach all hosts in the local subnet

Address identifying one device in the subnet

Why these pairings

The IPv4 address uniquely identifies a host on an IP network. The subnet mask distinguishes the network and host portions of the address, determining the local subnet. The default gateway is the router interface that forwards traffic to destinations outside the local subnet.

The DNS server resolves domain names to IP addresses, enabling name-based communication. Each concept plays a distinct and essential role in IPv4 networking.

Exam trap

Do not confuse the function of the IP address with other network layer concepts like subnet mask or default gateway. The IP address is the unique identifier for a host.

Practice this question →

296

MCQeasy

Which IPv6 address type is automatically created on an interface and used for link-local communication?

A.Unique local

B.Global unicast

C.Link-local

D.Anycast

AnswerC

Link-local IPv6 addresses are automatically created on every IPv6-enabled interface without any manual configuration or stateful protocol. They use the FE80::/10 prefix and are derived from the interface's MAC address (or a privacy-generated value) using EUI-64 or RFC 7217. Their scope is strictly the local link, enabling Neighbor Discovery Protocol, address resolution, and router discovery even before any other global address is present. Because they are always present, they are the correct answer to which IPv6 address type is auto-created.

Why this answer

IPv6 interfaces automatically generate a link-local address in FE80::/10 for local-segment functions such as neighbor discovery.

Exam trap

Be careful not to confuse link-local addresses with global or unique local addresses, which are not automatically generated and serve different purposes.

Why the other options are wrong

Unique local addresses (ULAs) are designed for local communications within a site and are not automatically created on an interface for local-link communication. They require manual configuration and are not used for link-local purposes.

Global unicast addresses are routable addresses used for communication over the internet and are not automatically created for local-link communication. They require configuration and are not limited to a single local network segment.

Anycast addresses are not automatically created on an interface for local-link communication; they are assigned to multiple interfaces to allow for routing to the nearest one. Therefore, they do not serve the same purpose as link-local addresses.

Practice this question →