CCNA Network Infrastructure and Connectivity Questions — Page 4 of 5

226

MCQhard

A host is configured with 10.1.1.34/30. Which address is the broadcast address for its subnet?

A.10.1.1.31

B.10.1.1.35

C.10.1.1.32

D.10.1.1.36

AnswerB

The /30 subnet mask specified for the host 10.1.1.34 allocates two bits for host addresses. This creates a subnet containing four addresses in total. The network address for 10.1.1.34/30 is 10.1.1.32, where all host bits are zero. Consequently, the broadcast address is the last address in this subnet, where all host bits are set to one, which calculates to 10.1.1.35.

Why this answer

A /30 subnet has a block size of 4. In practical terms, the last-octet blocks are 0–3, 4–7, 8–11, and so on. Because 34 falls within the 32–35 block, the broadcast address is the last address in that block: 10.1.1.35.

This question tests whether you can identify the correct subnet block before choosing the broadcast address.

Exam trap

Ensure you correctly identify the subnet range and understand the roles of network, host, and broadcast addresses.

Why the other options are wrong

The address 10.1.1.31 is incorrect as a broadcast address for the subnet 10.1.1.34/30; the correct broadcast address is 10.1.1.35, derived from the subnet mask which allows for only 4 IP addresses (10.1.1.34 to 10.1.1.37).

The address 10.1.1.32 is not the broadcast address for the subnet 10.1.1.34/30; instead, it is the network address for the subnet, which is 10.1.1.32 to 10.1.1.35.

The address 10.1.1.36 is incorrect because it exceeds the valid range for a /30 subnet, which only allows for four IP addresses (two usable hosts, one network, and one broadcast). The broadcast address for the subnet 10.1.1.34/30 is 10.1.1.35.

Practice this question →

227

MCQhard

A network technician connects a new Cisco switch to an existing access switch using a Category 5e copper patch cable. The link fails to come up, and the interface status shows 'err-disabled'. The technician checks the interface diagnostics and the running configuration. What action should the technician take to resolve the problem?

A.Replace the Category 5e cable with a Category 6 cable to support Gigabit Ethernet.

B.Configure the interface as a trunk port and disable spanning-tree BPDU guard.

C.Replace the copper SFP with a fiber SFP to increase the distance.

D.Manually set the speed and duplex to 1000 Mbps and full duplex on both switches.

AnswerB

The port is in err-disabled because bpduguard is enabled. Since this is a connection between two switches, the port should be configured as a trunk (or at least not as an access port with portfast) and bpduguard should be disabled to prevent the errdisable state.

Why this answer

The most likely reason for the err-disabled state is a spanning-tree BPDU guard violation on the access switch's port configured with PortFast. When another switch is connected, it sends BPDUs, triggering BPDU guard to error-disable the port. Configuring the interface as a trunk port and disabling BPDU guard (option B) resolves the issue by allowing BPDUs without triggering the protection.

Option A is unnecessary because Category 5e supports Gigabit Ethernet. Option C is irrelevant since the problem is not distance-related. Option D is risky because auto-negotiation is preferred and manual settings can cause mismatches.

Exam trap

Cisco often tests the misconception that err-disabled is always caused by speed/duplex mismatches or cable issues, but the trap here is that BPDU guard on a PortFast access port is a frequent and specific cause when connecting another switch.

Why the other options are wrong

The symptom is err-disabled, not a speed or duplex mismatch; cable type is not the issue.

The port is a built-in copper port, not an SFP-based interface; distance is not the issue.

The err-disabled state is due to BPDU guard, not speed/duplex mismatch; manual settings would not fix the root cause.

Practice this question →

228

MCQhard

A network engineer is troubleshooting a link between two Cisco Catalyst 9300 switches that are connected via a single-mode fiber optic cable. The link is up, but the interface counters show a high number of CRC errors and frame check sequence (FCS) errors. The interface is configured for 1000 Mbps and full duplex on both ends. What is the most likely cause of these errors?

A.A speed or duplex mismatch between the two switches

B.Faulty or dirty fiber optic cable or connectors

C.Incorrect SFP+ module type inserted in the switch

D.Excessive cable length beyond the distance limit

AnswerB

The diagnostic optical monitoring (DOM) reports a receive power of -20 dBm on SwitchA, which falls well below the typical receive sensitivity range for 10GBASE-LR modules (often around -14.4 dBm for 10 Gbps, though less sensitive for 1 Gbps). Such excessive optical loss is usually caused by contamination on the fiber end faces, damaged fiber, or poor splices/connectors. Since the transmit power on the remote side may be within normal range, the large difference points to a physical-layer attenuation rather than a module failure.

Why this answer

CRC and FCS errors indicate corruption at the data-link layer, typically caused by physical-layer issues such as signal degradation. Since the link is up and both ends are configured for 1000 Mbps full duplex, a speed/duplex mismatch is ruled out. Dirty or faulty single-mode fiber connectors or the cable itself can introduce optical signal loss or reflections, leading to bit errors that manifest as CRC/FCS errors.

Exam trap

Cisco often tests the distinction between CRC errors (physical-layer signal integrity) and duplex mismatch symptoms (late collisions, runts), leading candidates to incorrectly choose a speed/duplex mismatch when the interface counters show CRC errors.

Why the other options are wrong

The exhibit confirms consistent speed and duplex settings.

The modules are correctly identified and match the fiber type.

There is no evidence of the cable length in the exhibit, and the low power is more indicative of a physical fault rather than simply exceeding distance limits.

Practice this question →

229

Multi-Selectmedium

Which TWO statements accurately describe the use of ipconfig, ping, and tracert when troubleshooting a client that cannot reach a remote server?

Select 2 answers

A.A successful ping to 127.0.0.1 confirms that the TCP/IP stack on the local host is functional.

B.If ping to the default gateway fails, the issue is certainly caused by a faulty Ethernet cable.

C.An ipconfig output showing an IPv4 address of 169.254.x.x indicates the DHCP client could not obtain an IP address and self-assigned an APIPA address.

D.A tracert that shows 'Request timed out' for the very first hop proves the local default gateway router is down or unreachable.

E.Running ipconfig /release followed by ipconfig /renew will always restore connectivity if the Ethernet cable is unplugged and re-plugged.

AnswersA, C

A successful ping to 127.0.0.1 validates the operation of the TCP/IP protocol stack on the local machine, because the loopback address routes packets directly back to the same host without leaving the computer. This test exercises the IP layer, ICMP, and the loopback interface, but it cannot confirm that the network adapter, cable, or any external path is working. The loopback ping is the most basic layer-3 test and must succeed before any network connectivity can be expected.

Why this answer

Option A is correct because pinging the loopback address 127.0.0.1 sends the ICMP Echo Request through the local host's own TCP/IP stack without touching any network hardware, so a successful reply verifies that the stack is installed and functioning. Option C is correct because the 169.254.0.0/16 range is the APIPA (Automatic Private IP Addressing) block that Windows assigns when a DHCP client cannot reach a DHCP server, so an ipconfig address in 169.254.x.x directly indicates DHCP failure. Option B is wrong because a failed ping to the default gateway could stem from many causes beyond a bad cable, such as a disabled NIC, wrong IP/subnet configuration, VLAN mismatch, or a down gateway interface.

Option D is wrong because 'Request timed out' on the first hop can also result from ICMP being blocked or rate-limited by the gateway, not only from the router being down. Option E is wrong because ipconfig /release and /renew only re-acquire a DHCP lease and cannot restore connectivity when the physical link is unplugged, since no DHCP traffic can traverse a disconnected cable.

Exam trap

Cisco often tests the misconception that a failed ping to the default gateway always points to a physical layer issue, when in fact it could be due to logical misconfigurations, firewall rules, or the gateway itself being operational but not responding to ICMP.

Why the other options are wrong

A single cable fault is only one of many possibilities; more testing is needed before concluding physical layer failure.

Timed-out hops in tracert do not directly prove the router is down; it may simply not be generating ICMP Time Exceeded messages.

These commands do not guarantee a lease; the DHCP server must be operational and reachable.

Practice this question →

230

Multi-Selectmedium

Which TWO statements about SFP transceivers and fiber optic cabling are correct?

Select 2 answers

A.SFP transceivers are permanently installed on the switch motherboard and cannot be replaced.

B.1000BASE-SX SFP transceivers are designed for multimode fiber and typically support distances up to 550 meters.

C.Multimode fiber typically uses laser-based transmitters for long-distance transmission.

D.Single-mode fiber (SMF) with 1000BASE-LX SFP transceivers can support distances up to 5 km.

E.Single-mode fiber has a larger core diameter than multimode fiber, allowing longer distances.

AnswersB, D

1000BASE-SX operates at 850 nm over multimode fibre, supporting up to 550 m on 50-micron OM2 cabling. This satisfies the stem's requirement for a correct statement pairing the SX transceiver with multimode media and its typical distance limit.

Why this answer

Option B is correct because 1000BASE-SX is the IEEE 802.3z standard for Gigabit Ethernet over multimode fiber (MMF), using short-wavelength 850 nm VCSEL/laser transmitters and supporting distances up to 550 m with 50-micron MMF (and 220–275 m with 62.5-micron MMF). Option D is correct because 1000BASE-LX uses long-wavelength 1310 nm optics and, when paired with single-mode fiber (SMF), can reach approximately 5 km (and up to 10 km in some implementations), making it suitable for campus backbone runs. Option A is wrong because SFP (Small Form-factor Pluggable) transceivers are hot-swappable modular devices that plug into SFP slots or cages, not permanently soldered to the motherboard.

Option C is wrong because multimode fiber is typically used with LED or VCSEL sources for shorter distances; long-distance transmission is the domain of single-mode fiber with laser transmitters. Option E is wrong because single-mode fiber has a much smaller core diameter (about 9 microns) than multimode fiber (50 or 62.5 microns), which is precisely what enables single-mode's lower modal dispersion and longer reach.

Exam trap

Cisco often tests the misconception that multimode fiber always uses lasers for long distances, when in fact multimode fiber is optimized for shorter runs with LED or VCSEL sources, while single-mode fiber uses lasers for extended reach.

Why the other options are wrong

This statement is false because SFP slots are designed for modular, replaceable transceivers.

Laser transmitters are used in single-mode fiber for longer distances; multimode uses LED/VCSEL.

Single-mode fiber has a smaller core, not larger. The smaller core reduces dispersion and allows longer reach.

Practice this question →

231

Multi-Selectmedium

Which TWO statements correctly describe the OSI model layers and their corresponding PDU names during encapsulation?

Select 2 answers

A.The Transport layer encapsulates data into segments.

B.The Network layer encapsulates segments into packets.

C.The Data Link layer encapsulates packets into bits.

D.The Session layer encapsulates segments into sessions.

E.The Physical layer encapsulates frames into bits.

AnswersA, B

The Transport layer encapsulates upper-layer data (from the Session layer or Application layer) by adding a TCP or UDP header to create a segment. This header includes source and destination port numbers, and for TCP also sequence numbers, acknowledgment numbers, and window size, enabling reliable end-to-end delivery. This process of dividing data and prepending transport control information is exactly what produces the segment PDU, making this statement correct.

Why this answer

Both A and B are correct. During encapsulation, the Transport layer (Layer 4) adds a header to upper-layer data to form segments, and the Network layer (Layer 3) encapsulates those segments into packets by adding a network-layer header (e.g., IP). Option C is incorrect because the Data Link layer encapsulates packets into frames, not bits; bits are the raw transmission unit at the Physical layer.

Option D is incorrect because the Session layer manages sessions but does not produce a PDU called 'sessions'; encapsulation of segments only occurs at Layers 4 and below. Option E is incorrect because the Physical layer transmits frames as bits but does not perform encapsulation; encapsulation ends at the Data Link layer.

Exam trap

Cisco often tests the specific PDU names at each layer (e.g., segment vs. packet vs. frame vs. bit) and the order of encapsulation, so the trap here is confusing the Data Link layer PDU (frame) with bits or mixing up the Session layer's role with encapsulation.

Why the other options are wrong

The Data Link layer encapsulates packets into frames, not bits; bits are the PDU of the Physical layer.

The Session layer handles session management and does not perform encapsulation into 'sessions'; encapsulation at this layer is not defined.

The Physical layer transmits frames as bits but does not encapsulate frames into bits; encapsulation ends at Layer 2.

Practice this question →

232

MCQhard

A host is configured as 172.16.20.190/26. Which range contains the usable host addresses for that subnet?

A.172.16.20.129 to 172.16.20.190

B.172.16.20.128 to 172.16.20.191

C.172.16.20.130 to 172.16.20.191

D.172.16.20.193 to 172.16.20.254

AnswerA

A /26 mask yields 64 addresses, so the subnet increments by 64 in the fourth octet: 172.16.20.128 to 172.16.20.191. Excluding the network (.128) and broadcast (.191) addresses leaves usable hosts 172.16.20.129 through 172.16.20.190, which matches the host's own subnet exactly.

Why this answer

A /26 uses blocks of 64 addresses. In practical terms, the fourth-octet ranges are 0–63, 64–127, 128–191, and 192–255. Since 190 falls inside the 128–191 block, the network address is .128 and the broadcast address is .191. That leaves .129 through .190 as the usable range.

This is a strong test of whether you can identify the correct block and then exclude the reserved boundary addresses correctly.

Exam trap

A frequent exam trap is selecting an answer range that includes the network or broadcast address as usable hosts. For example, option B lists 172.16.20.128 to 172.16.20.191, which incorrectly includes the network (.128) and broadcast (.191) addresses. These addresses are reserved and cannot be assigned to hosts.

Another trap is excluding valid host addresses or including addresses from adjacent subnets, as seen in options C and D. Misidentifying subnet boundaries or forgetting to exclude reserved addresses causes these errors, leading to incorrect subnetting answers.

Why the other options are wrong

Option B incorrectly includes the network address (172.16.20.128) and broadcast address (172.16.20.191) as usable hosts, which are reserved and cannot be assigned to devices, making this option invalid.

Option C excludes the first usable host address (172.16.20.129) and incorrectly includes the broadcast address (172.16.20.191), which is not assignable to hosts, thus making it an incorrect range.

Option D lists a range starting at 172.16.20.193, which belongs to the next subnet block (192–255) and does not include the IP 172.16.20.190, so it is unrelated and incorrect for this question.

Practice this question →

233

MCQhard

A host is assigned 192.168.10.33/28. Which subnet contains that host?

A.192.168.10.16/28

B.192.168.10.32/28

C.192.168.10.48/28

D.192.168.10.0/28

AnswerB

A /28 prefix length yields a block size of 16 addresses, so subnets are aligned on multiples of 16: 0, 16, 32, 48, and so on. The host address 192.168.10.33 falls in the range 32–47, making 192.168.10.32/28 the correct subnet. Within that block, .33 is a usable address, as the network and broadcast addresses are .32 and .47 respectively.

Why this answer

A /28 subnet uses blocks of 16 addresses. In plain language, the last octet ranges move in increments of 16: 0–15, 16–31, 32–47, 48–63, and so on. Since the host address ends in 33, it belongs to the 32–47 block. That means the containing subnet is 192.168.10.32/28.

This style of subnetting question is common because it tests whether you can identify the correct network boundary quickly. The key is to recognize the block size from the prefix and then place the address inside the correct interval without confusing the host with the network address.

Exam trap

Be careful not to confuse the host address with the network address or miscalculate the subnet boundaries.

Why the other options are wrong

Option A (192.168.10.16/28) is incorrect because it represents a different subnet, specifically the range 192.168.10.16 to 192.168.10.31, which does not include the host 192.168.10.33.

Option C is wrong because the host IP 192.168.10.33/28 falls within the subnet range of 192.168.10.32 to 192.168.10.47, making 192.168.10.48/28 an entirely different subnet that does not include the host.

Option D (192.168.10.0/28) is incorrect because it represents a different subnet than the one containing the host 192.168.10.33. The subnet for 192.168.10.33/28 is 192.168.10.32/28, which includes IPs from 192.168.10.32 to 192.168.10.47.

Practice this question →

234

PBQhard

You are connected to R1. The network team reports intermittent connectivity between R1 and R2. Examine the following `show interface` output from R1 to identify the root cause of the issue. Then apply the necessary configuration commands on R1 to resolve the problem. GigabitEthernet0/0 is up, line protocol is up Internet address is 10.0.0.1/30 MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation ARPA, loopback not set Keepalive set (10 sec) Full-duplex, 100Mb/s, media type is RJ45 output flow-control is unsupported, input flow-control is unsupported Last input 00:00:01, output 00:00:01, output hang never Last clearing of "show interface" counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/40 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 100 packets input, 8000 bytes, 0 no buffer Received 0 broadcasts, 0 runts, 0 giants, 0 throttles 100 input errors, 100 CRC, 0 frame, 0 overrun, 0 ignored 0 output errors, 0 collisions, 0 interface resets 0 output buffer failures, 0 output buffers swapped out

Network Topology

Hints

•CRC errors often indicate a duplex mismatch or faulty cabling.
•Check if the interface has manual speed/duplex settings that may conflict with the remote device.
•The remote device likely uses auto-negotiation; match its settings.

A.Enter interface configuration mode for the problematic interface and issue the 'no speed' and 'no duplex' commands to revert to auto-negotiation.

B.Enter interface configuration mode and issue the 'speed 100' and 'duplex full' commands to ensure both sides are set to the same values.

C.Enter interface configuration mode and issue the 'no shutdown' command to bring the interface up.

D.Enter interface configuration mode and issue the 'duplex half' command to match the remote side's duplex setting.

AnswerA

solution

! R1
configure terminal
interface GigabitEthernet0/0
no speed
no duplex
end

Why this answer

The show interface output reveals 100 CRC errors and 100 input errors, indicating a physical layer problem. Additionally, the interface is manually configured for full-duplex and 100 Mb/s. CRC errors often point to a duplex mismatch or faulty cable.

Since R1 is set to full-duplex, if R2 is set to auto-negotiation (or half-duplex), a mismatch occurs. The fix is to set both sides to auto-negotiation by removing manual speed and duplex settings. On R1, enter interface configuration mode and issue 'no speed' and 'no duplex' to revert to auto-negotiation, then verify with 'show interfaces' that the interface negotiates to full-duplex and errors stop incrementing.

Exam trap

Do not assume that manually setting speed and duplex is always correct. CRC errors often point to a duplex mismatch, and the standard fix is to enable auto-negotiation on both ends. Also, remember that 'no shutdown' is for administratively down interfaces, not for error conditions.

Why the other options are wrong

The specific factual error is that reapplying the same manual settings does not resolve a duplex mismatch; it may even perpetuate the mismatch if the remote side is set to auto-negotiation.

The specific factual error is that 'no shutdown' is used to enable an interface that is administratively down, but the interface is already up.

The specific factual error is that forcing half-duplex is unlikely to resolve the issue; it may worsen performance and still cause errors if the remote side is full-duplex.

Practice this question →

235

MCQhard

A network engineer is configuring OSPFv2 on a Cisco router. The router has two interfaces: GigabitEthernet0/0 with IP 10.1.1.1/24 and GigabitEthernet0/1 with IP 10.2.2.1/24. The engineer wants to enable OSPF on both interfaces but ensure that GigabitEthernet0/0 is elected as the Designated Router (DR) on its network segment. Which configuration achieves this?

A.interface GigabitEthernet0/0 ip ospf priority 0 interface GigabitEthernet0/1 ip ospf priority 100

B.router ospf 1 network 10.1.1.0 0.0.0.255 area 0 network 10.2.2.0 0.0.0.255 area 0 router-id 10.1.1.1

C.router ospf 1 network 10.1.1.0 0.0.0.255 area 0 network 10.2.2.0 0.0.0.255 area 0 dr-priority 100

D.interface GigabitEthernet0/0 ip ospf priority 100 interface GigabitEthernet0/1 ip ospf priority 0

AnswerD

Setting a higher OSPF priority on GigabitEthernet0/0 (100) increases its chances of becoming DR. Setting priority 0 on GigabitEthernet0/1 makes it ineligible to become DR or BDR. This configuration ensures that GigabitEthernet0/0 will be elected DR if there are no other routers with higher priority. The priority is configured per interface and influences the DR election process. This is the correct method to influence DR selection.

Why this answer

OSPF DR election is influenced by interface priority. A higher priority increases the chance of becoming DR, while priority 0 makes an interface ineligible. Setting GigabitEthernet0/0 to priority 100 and GigabitEthernet0/1 to 0 ensures GigabitEthernet0/0 becomes DR on its segment.

The priority is set per interface with 'ip ospf priority'. This is the correct approach to control DR selection.

Exam trap

The trap here is confusing the OSPF router-id with DR priority, or attempting to set DR priority in router configuration mode instead of interface configuration mode.

Practice this question →

236

MCQhard

A subnet has the network address 192.168.30.0/26. What is the broadcast address?

A.192.168.30.63

B.192.168.30.64

C.192.168.30.255

D.192.168.30.31

AnswerA

The /26 prefix length means 26 network bits, leaving 6 host bits, so the block size is 64 addresses. Since the network address is 192.168.30.0, the usable host range is .1 through .62, and the broadcast address is the last address in the block, which is .63. This is the directed broadcast for this specific /26 subnet.

Why this answer

A /26 subnet contains 64 addresses. In plain language, the block that starts at 192.168.30.0 runs through 192.168.30.63. The first address is the network address and the last address is the broadcast address, so the broadcast for this subnet is 192.168.30.63.

This is a standard subnet-boundary calculation. Once the block size is identified, the broadcast address is simply the final address in that block.

Exam trap

Remember that the broadcast address is the last address in the subnet, not the first address of the next subnet or the last usable host address.

Why the other options are wrong

Option B is incorrect because the broadcast address for the subnet 192.168.30.0/26 is 192.168.30.63, not 192.168.30.64. The address 192.168.30.64 is actually the first address of the next subnet (192.168.30.64/26).

The address 192.168.30.255 is incorrect as the broadcast address for the subnet 192.168.30.0/26, which only spans IPs from 192.168.30.0 to 192.168.30.63. The broadcast address for this subnet is 192.168.30.63.

Option D, 192.168.30.31, is incorrect because it represents the last usable IP address in the subnet 192.168.30.0/26, not the broadcast address. The broadcast address for this subnet is 192.168.30.63.

Practice this question →

237

PBQhard

You are troubleshooting connectivity for a wireless client connected to the home network shown below. The client has obtained an APIPA address (169.254.x.x), indicating DHCP failure. Verify the DHCP server configuration on R1 and correct the issue so that the client receives a valid IP address from the 192.168.1.0/24 subnet.

Network Topology

Hints

•Check if the DHCP service is enabled globally on R1.
•APIPA addresses indicate that the client did not receive a DHCP offer.
•The DHCP pool and interface configuration are correct; the missing piece is the global DHCP service.

A.Enable the DHCP service globally using the 'service dhcp' command on R1.

B.Remove the 'ip dhcp excluded-address 192.168.1.1 192.168.1.10' command because it excludes too many addresses.

C.Change the DHCP pool network to 192.168.1.0/24 and add the default-router 192.168.1.1 command.

D.Configure the 'ip helper-address' command on the client's VLAN interface to forward DHCP requests to the server.

AnswerA

solution

! R1
configure terminal
service dhcp
end

Why this answer

The client obtained an APIPA address (169.254.x.x) because DHCP was not assigning addresses. The DHCP pool is correctly configured, but the global DHCP service must be enabled with the 'service dhcp' command on R1. The excluded-address range (192.168.1.1–192.168.1.10) uses only a small fraction of the /24 subnet, so it is not the issue.

Enabling 'service dhcp' allows the router to process DHCP requests and assign addresses from the pool.

Exam trap

Trap: Candidates often focus on pool configuration (network, default-router, excluded-address) when troubleshooting DHCP failures, but they forget that the DHCP service must be enabled globally with 'service dhcp'. Always check if the service is running before modifying pool parameters.

Why the other options are wrong

The specific factual error: Excluding 10 addresses does not exhaust the pool; the pool still has 244 addresses available.

The specific factual error: The pool configuration is already correct; modifying it does not address the disabled DHCP service.

The specific factual error: 'ip helper-address' is for DHCP relay across subnets; it is not needed when the server is local.

Practice this question →

238

PBQhard

You are troubleshooting a link between R1 (G0/0) and R2 (G0/0). The link is up but experiencing packet loss. You suspect an interface speed/duplex mismatch or SFP issue. Configure R1's interface to match the correct speed and duplex, and replace the SFP module if necessary to support a required distance of 40 km over single-mode fiber.

Network Topology

Hints

•Check the current speed and duplex configuration under the interface.
•Check the SFP module distance rating using 'show interfaces transceiver'.
•Remove explicit speed and duplex commands to allow auto-negotiation.

A.Remove manual speed/duplex settings, enable auto-negotiation, and replace the SFP with a long-reach module (e.g., 1000BASE-ZX) that supports 40 km over single-mode fiber.

B.Change the duplex to full and speed to 1000 Mbps manually, and keep the existing SFP.

C.Keep the manual speed/duplex settings but replace the SFP with a 1000BASE-SX module.

D.Enable auto-negotiation on both ends but keep the existing SFP.

AnswerA

solution

! R1
interface gigabitethernet 0/0
no speed
no duplex
end
copy running-config startup-config

Why this answer

The link is experiencing packet loss, likely due to a speed/duplex mismatch between the manually configured interface and the peer (which may use auto-negotiation) and/or an SFP module that cannot support the required 40 km distance over single-mode fiber. To resolve both potential issues, remove any manual speed and duplex settings to restore default auto-negotiation (using 'no speed' and 'no duplex'), and replace the SFP with a module rated for 40 km or more on SMF, such as a 1000BASE-ZX (or 1000BASE-EX) transceiver. Standard 1000BASE-LX/LH only reaches up to 10 km on SMF, so it is insufficient for this scenario.

Exam trap

This question tests your ability to identify and resolve both a speed/duplex mismatch and an SFP distance limitation. A common trap is to focus on only one issue (e.g., only fixing the mismatch or only replacing the SFP) while ignoring the other. Always verify that the SFP supports the required distance and fiber type.

Why the other options are wrong

The specific factual error is that manually setting speed/duplex does not guarantee compatibility with the remote end and does not address the SFP distance limitation.

The specific factual error is that 1000BASE-SX is for multimode fiber and short distances, not single-mode fiber at 40 km.

The specific factual error is that the SFP distance limitation is not addressed; auto-negotiation alone does not change the physical layer capability.

Practice this question →

239

Matchingmedium

Match each networking concept to its most accurate role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Defines network versus host portions of the address

Next hop used for off-subnet traffic

Local Layer 2 address for frame delivery

Data structure used to choose packet-forwarding paths

Why these pairings

Unicast communication involves one-to-one transmission between a single sender and a single receiver. Broadcast is one-to-all communication, where a packet is sent to every device on the local subnet. Multicast is one-to-many communication, where a single sender transmits to a specific group of interested receivers.

Anycast is one-to-one-of-many, where a packet is delivered to the nearest node among a group of potential receivers, typically used for services like DNS. The other options are incorrectly defined: Broadcast is not one-to-closest (that is anycast), Multicast is not one-to-all (that is broadcast), and Anycast is not one-to-group (that is multicast). Therefore, only option A is correctly matched.

Exam trap

Candidates often confuse multicast and anycast: multicast delivers to all members of a group, while anycast delivers to only the closest member. Also, broadcast is often mistakenly thought to be one-to-closest, but it is one-to-all.

Practice this question →

240

Multi-Selectmedium

Which TWO statements accurately describe wireless LAN fundamentals for CCNA 200-301 v2.0? (Choose two.)

Select 2 answers

A.802.11ax uses MU‑MIMO only for downlink transmissions.

B.802.11ac operates only in the 5 GHz frequency band.

C.Overlapping channels in the 2.4 GHz band are used to maximize non-overlapping channel availability.

D.WPA3 uses Simultaneous Authentication of Equals (SAE) to provide stronger password-based authentication.

E.A wireless LAN controller (WLC) is typically managed via its console port for day-to-day operations.

AnswersB, D

802.11ac (Wi-Fi 5) is strictly a 5 GHz standard; it does not support 2.4 GHz at all. Because of this, dual-band access points must fall back to 802.11n for 2.4 GHz clients. This design allows 802.11ac to use wider channels (80/160 MHz) and dense modulation (256-QAM) without the congestion and interference common in the 2.4 GHz band.

Why this answer

802.11ac (Wi‑Fi 5) operates exclusively in the 5 GHz band, leveraging wider channels (up to 160 MHz) and reduced interference. Option D is correct: WPA3 introduces Simultaneous Authentication of Equals (SAE) for robust password‑based authentication, replacing the weaker WPA2 four‑way handshake. Option A is wrong: 802.11ax (Wi‑Fi 6) supports MU‑MIMO for both uplink and downlink, not only downlink.

Option C is wrong: Overlapping channels in the 2.4 GHz band reduce throughput and are not used to maximize availability; instead, non‑overlapping channels (1, 6, 11) are recommended. Option E is wrong: A WLC is typically managed via a web GUI, SSH, or SNMP, not via its console port for routine operations; console access is used for initial setup or troubleshooting.

Exam trap

Cisco often tests the misconception that 802.11ac operates in both 2.4 GHz and 5 GHz bands, or that MU-MIMO in 802.11ax is exclusive to uplink, when in fact 802.11ax supports MU-MIMO bidirectionally and 802.11ac is strictly 5 GHz.

Why the other options are wrong

MU-MIMO is a feature of 802.11ac and 802.11ax, but 802.11ax primarily relies on OFDMA for multi-user support.

Overlapping channels reduce performance due to co-channel interference, not maximize non-overlapping channels.

Console port is used for initial configuration or troubleshooting, not for routine management.

Practice this question →

241

Drag & Dropmedium

Drag and drop the following steps into the correct order to sequence the TCP three-way handshake between a client and a server.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The TCP three-way handshake starts with the client sending a SYN, followed by the server responding with SYN-ACK, and finally the client sending an ACK to establish the connection.

Exam trap

A common trap is confusing the order of the handshake or thinking the server initiates the connection. Remember: the client always sends the first SYN, and the server's response is a SYN-ACK (not a separate SYN and ACK).

Practice this question →

242

Multi-Selectmedium

Which TWO statements about fiber optic cable types and SFP transceivers are correct?

Select 2 answers

A.Single-mode fiber uses a larger core (typically 62.5/125 µm) and supports longer distances than multimode fiber.

B.Multimode fiber is commonly used in campus and data center environments for distances up to several hundred meters.

C.SFP+ transceivers support data rates up to 1 Gbps and are backward compatible with standard SFP modules.

D.Single-mode fiber typically uses laser-based transceivers and can support distances exceeding 10 km.

E.Fiber optic cables must be run with EMI shielding when deployed in environments with high electromagnetic interference.

AnswersB, D

Multimode fiber is indeed the predominant medium for campus and data center links because its larger core and high numerical aperture permit the use of low-cost VCSELs or LEDs, and it provides sufficient bandwidth for reaches of 300–550 m at 10 Gbps using OM3/OM4 grades. Beyond these distances, modal dispersion becomes the limiting factor, making single-mode fiber more appropriate for longer backbone or WAN links.

Why this answer

Multimode fiber (MMF) has a larger core (typically 50/125 µm or 62.5/125 µm) and is used for short-reach, cost-effective connections up to a few hundred meters, making option B correct. Single-mode fiber (SMF) uses a much smaller core (~9 µm) and laser-based optics to achieve distances of 10 km or more, so option D is correct. Option A is wrong because it reverses the core size characteristic: SMF has a smaller core, and the given dimensions (62.5/125 µm) refer to multimode.

Option C is wrong because SFP+ is a 10 Gbps form factor and is not inherently backward compatible with 1 Gbps SFP modules unless the switch port explicitly supports dual-rate operation. Option E is incorrect because fiber optic cables are inherently immune to electromagnetic interference (EMI) and therefore never require EMI shielding in any environment; the false statement claims they need shielding.

Exam trap

Cisco often tests the misconception that SFP+ is backward compatible with SFP at the same speed, when in fact SFP+ is a 10 Gbps standard and requires specific port support or auto-negotiation to operate with 1 Gbps SFP modules.

Why the other options are wrong

Single-mode fiber uses a smaller core (~9 µm); the larger core dimensions (62.5/125 µm) belong to multimode fiber.

SFP+ transceivers support 10 Gbps speeds, not 1 Gbps, and are not universally backward compatible with standard SFP modules.

Fiber optic cables are immune to EMI and do not require any shielding; the claim that they need EMI shielding is false.

Practice this question →

243

MCQhard

A host is configured as 192.168.100.65/26. What is the valid host range for its subnet?

A.192.168.100.65 to 192.168.100.126

B.192.168.100.64 to 192.168.100.127

C.192.168.100.1 to 192.168.100.62

D.192.168.100.66 to 192.168.100.127

AnswerA

A /26 mask yields 64-address blocks, so 192.168.100.64 is the network and .127 the broadcast. Usable hosts span .65 to .126, matching the option exactly and satisfying the stem's request for the valid host range.

Why this answer

A /26 creates blocks of 64 addresses. In plain language, the subnets in the last octet are 0–63, 64–127, 128–191, and 192–255. Because the host address is 192.168.100.65, it belongs to the 64–127 block. In that block, 192.168.100.64 is the network address and 192.168.100.127 is the broadcast address. That leaves 192.168.100.65 through 192.168.100.126 as the valid host range.

This checks whether you can identify both the subnet boundary and the usable range.

Exam trap

Remember to exclude the network and broadcast addresses when determining the valid host range.

Why the other options are wrong

This option is incorrect because it includes the network address (192.168.100.64) and the broadcast address (192.168.100.127) for the subnet, which are not valid host addresses. The valid host range for a /26 subnet starts from 192.168.100.65 to 192.168.100.126.

Option C is incorrect because it suggests a host range that does not align with the subnet mask /26, which allows for a range of 192.168.100.64 to 192.168.100.127, but excludes the actual valid hosts for the specified IP address.

Option D is incorrect because it suggests a host range that starts from 192.168.100.66, which is outside the valid range for the subnet 192.168.100.64/26. The correct range should include all hosts from 192.168.100.65 to 192.168.100.126.

Practice this question →

244

Multi-Selecthard

Which two statements accurately describe UDP compared with TCP?

Select 2 answers

A.UDP is connectionless.

B.UDP always guarantees delivery and sequencing.

C.UDP has lower overhead because it uses a simpler header and no session establishment.

D.UDP requires a three-way handshake before application data can be sent.

E.UDP cannot be used by DNS.

AnswersA, C

UDP is connectionless, meaning it treats each datagram independently and does not establish a persistent logical link before sending data. There is no initial handshake, and the sender does not maintain state about the receiver. This allows immediate transmission of application data without negotiation, which is essential for low-latency protocols like streaming or real-time communications.

Why this answer

UDP is designed for simplicity and speed rather than built-in reliability. In plain terms, it sends data without creating a formal conversation first. That is why it is called connectionless. Because it does not perform the same reliability features as TCP, its header is smaller and the protocol adds less overhead. This makes UDP a good fit for applications that care more about speed or low delay than guaranteed delivery at the transport layer.

UDP does not perform a three-way handshake, and it does not guarantee delivery. It is also used by many real services, including DNS in common query scenarios.

Exam trap

Be careful not to confuse the connection-oriented features of TCP with UDP, which is connectionless and does not guarantee delivery.

Why the other options are wrong

This option is wrong because UDP does not guarantee delivery or sequencing; it is designed for speed and efficiency, sacrificing reliability. TCP, on the other hand, ensures that data is delivered in order and without loss.

This option is wrong because UDP is a connectionless protocol that does not require a three-way handshake for data transmission, unlike TCP, which establishes a connection before sending data.

This option is wrong because UDP is widely used by DNS for its quick query-response nature, allowing for faster resolution of domain names without the overhead of connection establishment.

Practice this question →

245

MCQhard

A subnet must support 14 usable hosts. Which prefix is the smallest that meets the requirement?

A./29

B./28

C./27

D./26

AnswerB

A /28 prefix uses subnet mask 255.255.255.240, creating a block of 16 addresses per subnet. After reserving the network address and broadcast address, exactly 14 addresses remain available for hosts. This precisely matches the requirement of 14 usable hosts, making it the most efficient prefix length that meets the demand without wasting address space.

Why this answer

To support 14 usable hosts, the subnet must have 16 total addresses, because two are reserved for the network and broadcast addresses. In plain language, you need enough address slots so that after those two reserved entries are removed, 14 remain. A /28 provides exactly that: 16 total addresses and 14 usable addresses.

This is a classic minimum-subnet-size question because it tests whether you can work backward from host requirement to prefix length. A /29 would be too small, while a /27 would work but waste more addresses than necessary.

Exam trap

Avoid choosing a subnet size that either doesn't meet the host requirement or is unnecessarily large, leading to wasted addresses.

Why the other options are wrong

A /29 subnet provides only 6 usable host addresses, which is insufficient for the requirement of 14 usable hosts. Therefore, it does not meet the specified criteria.

Option C: /27 provides 30 usable hosts, which exceeds the requirement of 14 usable hosts. However, the question asks for the smallest prefix that meets the requirement, making /28 the correct choice.

Option D: /26 provides 62 usable hosts, which exceeds the requirement of 14 usable hosts. Therefore, it is not the smallest prefix that meets the specified need.

Practice this question →

246

MCQhard

Refer to the exhibit. An administrator notices that all interfaces on R1 are in an administratively down state. The administrator issues the show version command and sees the following output. What is the most likely cause of the issue?

A.The router IOS image is corrupted and needs to be reinstalled.

B.The interfaces have been manually shut down in the running configuration, and the startup-config file is empty.

C.The router experienced a memory error during boot and failed to load the startup configuration.

D.The configuration register is set to 0x2142, causing the router to ignore the startup configuration.

AnswerD

This is directly confirmed by the last line of the exhibit: 'Configuration register is 0x2142'. This setting tells the router to bypass loading the startup-config from NVRAM, resulting in a clean slate where all interfaces are administratively down.

Why this answer

The configuration register value 0x2142 tells the router to ignore the startup configuration during boot, loading only the default factory configuration. This causes all interfaces to be in an administratively down state because no interface configurations from the startup-config are applied. The administrator sees the interfaces as administratively down because the default configuration does not include any 'no shutdown' commands.

Exam trap

Cisco often tests the specific effect of configuration register 0x2142 (ignoring startup-config) versus 0x2102 (normal boot), and the trap here is that candidates may confuse it with a corrupted IOS or manual shutdown, not realizing the register value directly causes the default interface state.

Why the other options are wrong

Candidates may confuse a successful IOS boot with a corrupted image because both can lead to an unusable configuration, but the configuration register is the direct clue.

Candidates may focus on the symptom (interfaces down) and hypothesize a manual configuration error, but they miss the clear hardware boot-parameter issue indicated by the config register.

Candidates equate configuration loss with hardware faults, overlooking the intentional nature of the 0x2142 register value.

Practice this question →

247

Multi-Selectmedium

Which TWO statements correctly describe the encapsulation and de-encapsulation process at the transport layer of the OSI model?

Select 2 answers

A.During encapsulation, the transport layer adds a header to form a packet.

B.During encapsulation, the transport layer adds a header containing source and destination port numbers.

C.During de-encapsulation, the transport layer removes the IP header to extract the segment.

D.During de-encapsulation, the transport layer removes its header and passes the payload to the session layer.

E.During encapsulation, the transport layer adds a trailer for error detection.

AnswersB, D

During encapsulation, the transport layer encapsulates upper-layer data with a header that records source and destination port numbers. These ports identify the specific application processes on the sending and receiving hosts, enabling the OS to demultiplex incoming data to the correct service. In TCP, the header includes additional fields like sequence numbers and windows, but the port numbers are the essential addressing mechanism that distinguishes this layer from the network layer's IP addressing.

Why this answer

During encapsulation at the transport layer, the TCP or UDP header is added, which includes source and destination port numbers. These port numbers identify the specific application-layer processes on the sending and receiving hosts, enabling proper demultiplexing of data. Option D is correct because during de-encapsulation, the transport layer removes its own header (e.g., TCP or UDP header) and passes the remaining payload up to the session layer (or directly to the application layer in a simplified model).

Exam trap

Cisco often tests the precise PDU naming convention (segment vs. packet vs. frame) and which layer performs which header removal, causing candidates to confuse the transport layer's role with the network layer's role.

Why the other options are wrong

This statement confuses the PDU naming: packet belongs to Layer 3, not Layer 4.

This describes a Layer 3 de-encapsulation step, not a Layer 4 step.

Trailers are a Layer 2 feature; the transport layer uses header-based checksums for integrity.

Practice this question →

248

MCQhard

A network engineer is troubleshooting a wireless performance issue in a dense office environment. Clients on the 5 GHz band are experiencing low throughput even though they are close to the AP. The AP is a Cisco 9130AXI running IOS-XE 17.9. What is the most likely cause of the poor performance?

A.The AP is using an incorrect channel width of 80 MHz, which is not supported by 802.11ac.

B.The AP is operating in 802.11ac mode instead of 802.11ax, and the 80 MHz channel bonding is causing high interference in the dense environment.

C.The AP has DFS non-compliance, which prevents it from using channel 36 and causes the radio to operate at reduced power.

D.The AP is using WPA2-PSK instead of WPA3, which causes lower throughput due to weaker encryption.

AnswerB

The AP is running 802.11ac (Wi-Fi 5), which relies on OFDM and wide 80 MHz channels to achieve high peak rates, but in a dense deployment that wide channel exacerbates interference and medium contention. Migrating to 802.11ax (Wi-Fi 6) would use OFDMA to split the channel into resource units, letting multiple clients share the spectrum simultaneously and reducing collision overhead. The combination of a legacy PHY and an overly broad channel bond is exactly what degrades throughput here, making this the correct diagnosis.

Why this answer

In a dense office environment, using 80 MHz channel bonding with 802.11ac (Wave 2) increases the likelihood of co-channel interference and overlapping basic service sets (OBSS), which degrades throughput despite strong signal. The Cisco 9130AXI supports 802.11ax (Wi-Fi 6), which includes OFDMA and better spatial reuse, but if the AP is configured for 802.11ac mode, it loses these efficiency gains and suffers from the wide channel's interference penalty.

Exam trap

Cisco often tests the misconception that wider channels always improve performance, when in reality, in dense environments, 80 MHz or 160 MHz channels cause severe interference and throughput degradation, especially with 802.11ac's lack of spatial reuse mechanisms.

Why the other options are wrong

802.11ac supports 80 MHz channel bonding, so this is not incorrect.

DFS non-compliance does not directly reduce power; it may cause channel avoidance, but the power is set to maximum.

WPA2-PSK does not cause throughput degradation; the issue is interference and protocol mode.

Practice this question →

249

MCQhard

A network administrator is troubleshooting a Windows 10 client that cannot reach the internet. The client is connected to a Cisco switch port configured as an access port in VLAN 100. The administrator runs ipconfig on the client and sees an IP address of 169.254.10.15 with a subnet mask of 255.255.0.0. The switch port shows status up/up. What is the most likely cause of the issue?

A.The switch port is in err-disabled state due to a spanning-tree loop.

B.The switch is not configured with an ip helper-address on the VLAN 100 SVI to forward DHCP broadcasts to the DHCP server.

C.The client is in the wrong VLAN; the switch should be configured with VLAN 200.

D.There is a duplex mismatch between the client and the switch.

AnswerB

For a DHCP client in VLAN 100 to obtain an address from a server located in a different VLAN or subnet, the VLAN 100 SVI must include an 'ip helper-address' pointing to the DHCP server. DHCP requests are IP broadcast packets, and routers do not forward broadcasts across interfaces by default; without UDP forwarding configured, the DHCPDISCOVER is never relayed to the server, so the client receives no DHCPOFFER and may fall back to an APIPA address. The correct remedy is to configure 'interface vlan 100' with the 'ip helper-address' command referencing the DHCP server's IP address.

Why this answer

The 169.254.x.x address is an Automatic Private IP Addressing (APIPA) address, assigned by Windows when DHCP fails. Since the client is in VLAN 100 and the switch port is up/up, the most likely cause is that the VLAN 100 SVI lacks an ip helper-address command, so DHCP broadcast requests from the client are not forwarded to the DHCP server, leaving the client without a valid IP address.

Exam trap

Cisco often tests the misconception that an APIPA address indicates a physical or VLAN issue, when in fact it specifically points to DHCP failure, and the most common cause in a routed environment is the absence of ip helper-address on the SVI.

Why the other options are wrong

The port status is 'connected', not err-disabled.

No information suggests the client should be in VLAN 200; the configuration matches the intended VLAN.

Duplex mismatch would typically cause errors or speed/duplex issues, but the switch shows a-full, so this is not the problem.

Practice this question →

250

Multi-Selectmedium

Which TWO of the following are essential IPv4 host parameters that must be correctly configured for a host to communicate with devices on remote networks?

Select 2 answers

A.DNS server address

B.Default gateway

C.Subnet mask

D.MAC address

E.Host name

AnswersB, C

The default gateway is the router interface that resides on the host's local subnet and serves as the exit point for all traffic destined to remote networks. When a host determines a destination is not on the same subnet, it encapsulates the packet with the gateway's Layer 2 address and forwards it there, relying on the router to route it onward. Without a default gateway, the host will discard any packet intended for a different network, because it has no way to send traffic off its local segment, making this parameter essential for basic internetwork communication.

Why this answer

The default gateway is the IP address of the router interface on the local subnet; when a host needs to communicate with a device on a remote network, it must forward packets to the default gateway because the destination is not reachable locally. The subnet mask is equally essential because the host uses it (along with its own IP address) to determine whether a destination IP address is on the same local network or a remote network; without a correctly configured subnet mask, the host cannot make this determination and may misroute traffic. DNS server address is only for name resolution and is not required for IP-level connectivity, MAC address is a Layer 2 address already present on the NIC, and hostname is a local identifier irrelevant to routing.

Exam trap

Cisco often tests the misconception that a DNS server address is a mandatory host parameter for remote communication, but DNS is only a name-resolution service and not required for IP-level connectivity.

Why the other options are wrong

A host can communicate using IP addresses directly without DNS. DNS is a service, not a mandatory parameter for routing.

MAC addresses are not manually configured as part of IPv4 host parameters (they are burned into the NIC). The question asks for IPv4 host parameters that must be configured.

Host names are used for identification and can be resolved via DNS, but they are not essential for the host to send or receive IP packets.

Practice this question →

251

MCQhard

A network administrator is troubleshooting connectivity between two directly connected Cisco switches. Hosts on VLAN 10 connected to Switch A cannot ping the default gateway on Switch B. The interface on Switch A shows 'up/up' but there are excessive CRC errors and runts. The administrator checks the interface configuration on both switches. What is the most likely cause of the issue?

A.Replace the faulty Ethernet cable.

B.Mismatched duplex and speed settings between the interfaces.

C.Disable spanning tree on both interfaces to prevent loop prevention from blocking traffic.

D.Assign the interfaces to the same VLAN to ensure Layer 2 connectivity.

AnswerB

With one switch operating at full-duplex and 1000 Mbps while the other operates at half-duplex and 100 Mbps, the two interfaces cannot coordinate frame timing properly. The full-duplex side transmits without carrier sensing, while the half-duplex side detects a collision, sends a jam signal, and drops the corrupted frame—producing CRC errors on the half-duplex interface. Forcing both interfaces to the same speed (1000 Mbps) and full-duplex mode eliminates the mismatch, allowing the error counters to stop incrementing.

Why this answer

The presence of excessive CRC errors and runts on an interface that is 'up/up' strongly indicates a Layer 1 or Layer 2 duplex mismatch. When one switch is set to full-duplex and the other to half-duplex (or auto-negotiation fails), the half-duplex side will detect collisions and retransmit, while the full-duplex side will not, leading to frame corruption (CRC errors) and truncated frames (runts). Configuring both interfaces with the same duplex and speed settings (e.g., full-duplex and 1000 Mbps) resolves this mismatch, restoring proper connectivity for VLAN 10 traffic to the default gateway.

Exam trap

Cisco often tests the concept that 'up/up' does not guarantee error-free communication, and candidates mistakenly focus on cable replacement or VLAN misconfiguration instead of recognizing CRC errors and runts as classic symptoms of a duplex mismatch.

Why the other options are wrong

The exhibit shows both switches have different speed and duplex settings, indicating a configuration mismatch rather than a cable fault.

The interface is up/up and the errors are CRC, which are not related to spanning tree operation.

CRC errors indicate physical or duplex issues, not VLAN misconfiguration.

Practice this question →

252

MCQeasy

Which cable type is commonly used to connect a switch to a router when using standard Ethernet interfaces on modern devices with auto-MDIX support?

A.Rollover cable

B.Straight-through Ethernet cable

C.Serial DCE cable

D.Fiber patch cable only

AnswerB

A straight-through Ethernet cable maps pins 1-8 identically on both ends, following TIA/EIA-568-B wiring, and is the standard for connecting unlike devices such as a switch to a router. Switches and routers use different transmit/receive pairs, so the straight-through pinout properly aligns the outbound pairs of one with the inbound pairs of the other. Even with Auto-MDIX on modern gear, the straight-through cable remains the expected and most commonly cited answer for this link.

Why this answer

A straight-through Ethernet cable is the common expected answer for switch-to-router Ethernet connections. On modern interfaces, auto-MDIX often makes crossover requirements less important in practice.

Exam trap

Remember that auto-MDIX allows for the use of straight-through cables in situations where crossover cables were once required.

Why the other options are wrong

A rollover cable is used to connect a console port of a router or switch to a computer terminal, not for connecting switches to routers over Ethernet interfaces. In modern networking setups with auto-MDIX, a straight-through cable is the standard choice.

A serial DCE cable is used for connecting devices in a serial communication setup, typically for console access or point-to-point connections, not for standard Ethernet interfaces between a switch and a router.

A fiber patch cable is not used to connect a switch to a router over standard Ethernet interfaces, as it requires compatible fiber optic ports and transceivers. Ethernet interfaces typically use copper cabling, such as straight-through cables, for such connections.

Practice this question →

253

Matchingeasy

Match each basic networking service to its most accurate role.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Hostname resolution

Automatic IP configuration

Clock synchronization

Centralized event and log reporting

Why these pairings

DNS converts domain names to IP addresses; DHCP automates IP configuration; NTP synchronizes clocks across devices; Syslog centralizes event and log reporting for monitoring and troubleshooting.

Exam trap

Cisco exams often test the specific function of each service. Do not confuse DNS with DHCP, or NTP with Syslog. Remember: DNS = name-to-IP, DHCP = IP assignment, NTP = clock sync, Syslog = logging.

Practice this question →

254

MCQhard

A host with address 192.168.1.130/26 needs to identify its local subnet. Which subnet does it belong to?

A.192.168.1.0/26

B.192.168.1.64/26

C.192.168.1.128/26

D.192.168.1.192/26

AnswerC

The /26 prefix length corresponds to a 255.255.255.192 subnet mask, which creates address blocks of 64 addresses. Because 192.168.1.130 falls in the range 128 through 191, its network address is 192.168.1.128, making 192.168.1.128/26 the correct subnet. This is the block where 130 is a valid host, with 129 through 190 as usable addresses.

Why this answer

A /26 creates subnets in blocks of 64 addresses each. In plain language, that means the fourth octet ranges are 0–63, 64–127, 128–191, and 192–255. Since 192.168.1.130 falls within the 128–191 block, the host belongs to the 192.168.1.128/26 subnet. That is the local network boundary the host will use to decide what is on-link and what requires the default gateway.

This kind of question is a very common CCNA subnetting task. The main challenge is not the arithmetic itself but recognizing the block size and locating the destination inside the correct range. Once you know a /26 moves in increments of 64, the right subnet becomes much easier to see.

Exam trap

Be careful to calculate subnet ranges accurately and avoid assuming proximity based on the first or last octet.

Why the other options are wrong

Option A is incorrect because the address 192.168.1.130 falls within the subnet range of 192.168.1.128/26, not 192.168.1.0/26, which covers addresses from 192.168.1.0 to 192.168.1.63.

Option B, 192.168.1.64/26, is incorrect because the host 192.168.1.130 falls within the subnet range of 192.168.1.128 to 192.168.1.191, not 192.168.1.64 to 192.168.1.127.

Option D, 192.168.1.192/26, is incorrect because the host address 192.168.1.130 falls within the subnet range of 192.168.1.128 to 192.168.1.191, making it part of the 192.168.1.128/26 subnet, not 192.168.1.192/26.

Practice this question →

255

MCQhard

A network technician is troubleshooting a connectivity issue between two directly connected switches, SW1 and SW2. Hosts on VLAN 10 connected to SW1 can ping each other but cannot ping the default gateway or any host on VLAN 10 connected to SW2. The interface on SW1 is up/up, but the interface on SW2 is up/down. What is the most likely cause of the problem?

A.Configure the interface on SW2 to use a different MTU value.

B.Ensure both switches are configured for the same duplex setting, preferably by enabling autonegotiation on both interfaces.

C.Replace the Ethernet cable connecting SW1 and SW2.

D.Check for late collisions on the interface and increase the collision window size.

AnswerB

The output from SW1 shows the interface is full-duplex, but SW2's interface is up/down. This is a classic symptom of a duplex mismatch, where one side is full and the other half-duplex. Configuring both ends to the same duplex (or enabling autonegotiation) will resolve the issue.

Why this answer

The interface on SW2 is up/down, which typically indicates a Layer 1 issue such as a duplex mismatch. Duplex mismatch occurs when one switch is manually set to full duplex and the other to half duplex or auto-negotiation fails, causing the side expecting full duplex to report up/down due to excessive errors. Option A is incorrect because MTU mismatch would cause connectivity issues but not an up/down interface state.

Option C is incorrect because a faulty cable would likely cause both interfaces to be down/down, not up/down. Option D is incorrect because late collisions are a symptom of duplex mismatch, not a separate cause; increasing collision window size is not a standard troubleshooting step. The correct solution is to ensure both switches use the same duplex setting, preferably via autonegotiation (IEEE 802.3u).

Exam trap

Cisco often tests the distinction between up/down (Layer 1 issue like duplex mismatch) and down/down (cable or power issue) to trap candidates who assume any interface problem is a bad cable.

Why the other options are wrong

Changing MTU values affects frame size but does not cause an interface to show up/down; that state is associated with Layer 1 issues like duplex mismatch.

A bad cable typically results in both interfaces showing down/down, not one up and the other up/down.

Late collisions are a consequence of duplex mismatch, not a root cause; adjusting collision window size is not a standard practice on modern switches.

Practice this question →

256

MCQmedium

Exhibit: A host has address 192.168.14.77/27. Which address is its valid default gateway if the first usable address in the subnet is chosen for the router interface?

A.192.168.14.63

B.192.168.14.64

C.192.168.14.65

D.192.168.14.95

AnswerC

A /27 mask yields subnets in blocks of 32, so 192.168.14.77 falls in 192.168.14.64/27. The network address is .64, making .65 the first usable host address, which the stem assigns to the router interface as the gateway.

Why this answer

A /27 has a block size of 32. Address 192.168.14.77 falls in the 192.168.14.64/27 subnet, where the usable host range is 192.168.14.65 through 192.168.14.94. The first usable address is 192.168.14.65.

Exam trap

Be careful not to confuse network and broadcast addresses with usable host addresses when identifying a default gateway.

Why the other options are wrong

Option A (192.168.14.63) is wrong because it is the last address in the subnet range (192.168.14.64 to 192.168.14.95) and is reserved for the broadcast address, not a valid default gateway.

Option B, 192.168.14.64, is incorrect because it is the first usable address in the subnet 192.168.14.64/27, which is reserved for the router interface and cannot be assigned as a default gateway for hosts in the subnet.

Option D, 192.168.14.95, is incorrect because it falls outside the subnet range defined by the 192.168.14.64/27 subnet, which spans from 192.168.14.64 to 192.168.14.94. Thus, it cannot be a valid default gateway for the host in question.

Practice this question →

257

MCQhard

A network administrator notices that a workstation connected to a Cisco switch port cannot communicate with other devices on the same VLAN. The switch port is up/up, but the workstation reports slow performance and intermittent connectivity. What is the most likely cause of this issue?

A.Replace the faulty Ethernet cable between the switch and the workstation.

B.A duplex mismatch between the switch port and the workstation.

C.Assign the switch port to the correct VLAN.

D.Disable spanning-tree on the port to prevent frequent topology changes.

AnswerB

A duplex mismatch between the switch port and the workstation is the correct cause because it creates a half-duplex device that performs CSMA/CD while the full-duplex peer transmits without sensing the medium. When both devices transmit simultaneously, the half-duplex side detects a late collision and backs off, while the full-duplex side is unaware and does not retransmit, causing dropped frames, high latency, and degraded throughput. The switch output would likely show a high number of late collisions or a significant rate of alignment errors, even though the link remains up/up, matching the symptom of a slow but stable connection.

Why this answer

A duplex mismatch occurs when one end of the link is set to full-duplex and the other to half-duplex. The half-duplex end detects collisions and the full-duplex end does not, causing late collisions, CRC errors, and retransmissions. This results in slow performance and intermittent connectivity even though the port is operationally up.

Exam trap

Cisco often tests the concept that a link being up/up does not guarantee error-free communication, and candidates mistakenly focus on VLAN or cable issues instead of recognizing duplex mismatch as the cause of slow performance and intermittent connectivity.

Why the other options are wrong

No cable-related errors are shown.

VLAN issues would typically prevent communication entirely or show input errors from misconfigured trunking.

The port is stable and not flapping.

Practice this question →

258

MCQmedium

A host address is 2001:db8:100:20::25/64. Which portion identifies the network prefix?

A.2001:db8:100

B.2001:db8:100:20

C.2001:db8:100:20::25

D.::25

AnswerB

The first four hextets in the address represent the 64-bit network prefix, so 2001:db8:100:20 identifies the subnet. In IPv6, a /64 prefix always uses exactly four hextets, and the remaining four hextets (::25) are the interface identifier. This is the portion that routers use to forward traffic to the destination subnet.

Why this answer

With a /64 prefix, the first 64 bits identify the network. That corresponds to the first four hextets: 2001:db8:100:20.

Exam trap

Be careful not to confuse the shorthand notation '::' with part of the network prefix. Remember, '::' represents a series of zeroes and is not part of the network prefix.

Why the other options are wrong

Option A is incorrect because it only includes the first three hextets of the IPv6 address, which does not represent the complete network prefix as defined by the /64 subnet mask. The correct network prefix includes the first four hextets.

Option C is incorrect because it includes the full address, which encompasses both the network prefix and the host portion. The question specifically asks for the network prefix, which is only the first 64 bits of the address.

Option D, '::25', is incorrect because it represents the host portion of the IPv6 address, not the network prefix. The network prefix is determined by the first 64 bits, which in this case is '2001:db8:100:20'.

Practice this question →

259

Drag & Dropmedium

Drag and drop the following steps into the correct order to troubleshoot a link-down issue on a GigabitEthernet interface using an SFP transceiver.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Troubleshooting begins by verifying the interface status and physical layer (steps 1-2). Next, you ensure the SFP is physically and logically recognized (step 3) before retrieving specific diagnostic data (step 4). Only after confirming the health of the transceiver do you take corrective action (step 5), because replacing hardware without diagnostics may waste resources.

Practice this question →

260

MCQmedium

A company wants private IPv4 addressing that can be routed internally but not on the public Internet. Which range meets that requirement?

A.198.51.100.0/24

B.172.20.0.0/16

C.169.254.0.0/16

D.224.0.0.0/4

AnswerB

172.20.0.0/16 is correct because it resides inside the RFC 1918 private block 172.16.0.0/12 (172.16.0.0 – 172.31.255.255). As a private address, it is not globally routable on the internet but is fully routable within an enterprise network, making it ideal for internal IPv4 design. The /16 prefix provides 65,534 usable host addresses, which is suitable for a large company's scalable internal infrastructure.

Why this answer

RFC 1918 defines private IPv4 ranges for internal routing: 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. 172.20.0.0/16 falls within the 172.16.0.0/12 block, making it a valid private address. 198.51.100.0/24 is reserved for documentation (TEST-NET-2) and should not be used internally. 169.254.0.0/16 is link-local (APIPA), used only for automatic addressing on a single link. 224.0.0.0/4 is multicast, not routable as unicast and not private.

Exam trap

Be careful not to confuse reserved IP ranges for documentation or link-local use with private IP ranges.

Why the other options are wrong

198.51.100.0/24 is a documentation range (TEST-NET-2), not private or internally routable.

169.254.0.0/16 is link-local (APIPA), used only for automatic configuration on a single network segment, not for internal routing.

224.0.0.0/4 is reserved for multicast traffic and cannot be used as a private unicast range.

Practice this question →

261

Matchingmedium

Drag and drop the items on the left to the correct descriptions on the right.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Displays optical transceiver diagnostic information including temperature and Tx/Rx power

Shows Ethernet physical layer diagnostics such as cable length, MDI/MDIX, and pair status

10 Gigabit Ethernet short-reach multimode fiber transceiver for 850 nm up to 300 m

Copper twisted-pair cabling standard supporting 10GBASE-T up to 100 meters

Small form-factor duplex fiber optic connector used with SFP/SFP+ modules

Why these pairings

show interface transceiver outputs Digital Optical Monitoring (DOM) data such as temperature, voltage, and Tx/Rx power for installed transceivers. show controllers ethernet-controller phy displays physical layer diagnostics including cable length estimates, MDI/MDI-X status, pair swaps, and link quality counters. SFP-10G-SR is a multimode fiber transceiver supporting 10 Gigabit Ethernet at 850nm over distances up to 300 meters. Cat6a is enhanced copper twisted-pair cabling rated for 10GBASE-T up to 100 meters with improved alien crosstalk performance.

LC connectors are the small form-factor duplex fiber connectors commonly used with SFP and SFP+ optical modules.

Practice this question →

262

PBQmedium

You are connected to SW1 via the console. The network uses VLANs 10 (Sales) and 20 (Engineering). A new switch SW2 is connected to SW1 via G0/1. You need to enable CDP to discover neighbor devices and verify that SW1 sees SW2. Currently, CDP is disabled globally.

Network Topology

Hints

•CDP is a Cisco proprietary protocol.
•The command to enable it globally is straightforward.
•After enabling, wait a few seconds for neighbor discovery.

A.Enable CDP globally with 'cdp run' and verify with 'show cdp neighbors'.

B.Enable CDP on interface G0/1 with 'cdp enable' and verify with 'show cdp neighbors'.

C.Enable CDP globally with 'cdp run' and verify with 'show cdp interface'.

D.Enable CDP globally with 'cdp enable' and verify with 'show cdp neighbors'.

AnswerA

solution

! SW1
cdp run

Why this answer

CDP is disabled globally with 'no cdp run'. Re-enabling with 'cdp run' allows SW1 to discover directly connected Cisco devices, including SW2. Option B is incorrect because interface-level 'cdp enable' requires CDP to already be enabled globally; since CDP is globally disabled, this command has no effect.

Option C is incorrect because 'show cdp interface' displays CDP parameters per interface, not the neighbor table; you need 'show cdp neighbors' to see discovered devices. Option D is incorrect because 'cdp enable' is not a valid global command; the correct global command is 'cdp run'.

Exam trap

Remember that CDP has both global and interface-level configuration. If CDP is disabled globally, interface-level commands have no effect. Always use 'cdp run' to enable globally and 'show cdp neighbors' to see neighbors.

Why the other options are wrong

Interface-level 'cdp enable' requires CDP to be enabled globally first; with global CDP disabled, this command is ineffective.

'show cdp interface' shows CDP status and counters on interfaces, not the list of neighboring devices; use 'show cdp neighbors' to see neighbors.

'cdp enable' is an interface command, not a global command; the global command to enable CDP is 'cdp run'.

263

Multi-Selectmedium

Which three of the following are characteristics of Layer 2 Ethernet switches that support VLANs? (Choose three.)

Select 3 answers

.They forward frames based on the destination MAC address.

.They can segment a LAN into multiple broadcast domains.

.They use ARP to resolve IP addresses to MAC addresses.

.They use the Spanning Tree Protocol to prevent Layer 2 loops.

.They perform routing between VLANs without a router.

.They forward frames based on the destination IP address.

Why this answer

Layer 2 Ethernet switches that support VLANs forward frames based on the destination MAC address, which is the fundamental switching decision. They can segment a LAN into multiple broadcast domains because each VLAN creates its own isolated broadcast domain, preventing unnecessary traffic propagation. They use the Spanning Tree Protocol (STP) to prevent Layer 2 loops by dynamically blocking redundant paths, ensuring a loop-free topology.

Exam trap

Cisco often tests the misconception that switches use ARP or that VLANs segment collision domains, when in fact VLANs segment broadcast domains and switches forward based on MAC addresses, not IP addresses.

Practice this question →

264

MCQhard

Refer to the exhibit. A network engineer is troubleshooting a serial link between two routers that is not coming up. The engineer issues the show controllers command on one router and sees the output shown. What is the most likely cause of the issue?

A.The clock rate command is missing on the DCE serial interface.

B.The serial cable type is incorrectly identified.

C.The encapsulation mismatch is causing the line protocol to stay down.

D.The serial interface is administratively shut down.

AnswerA

The show controllers output clearly states “DCE V.35, no clock rate” and “no clock rate configured,” confirming that the DCE side lacks the required clock rate. Without it, the serial interface cannot bring the line protocol up.

Why this answer

The 'show controllers' output indicates the router is the DCE (Data Communications Equipment) on the serial link, but no clock rate has been configured. For a serial interface to come up, the DCE end must provide clocking via the 'clock rate' command. Without it, the interface will remain down (line protocol down) because no clock signal is present to synchronize data transmission.

Exam trap

Cisco often tests the distinction between DCE and DTE roles; the trap here is that candidates assume the 'show controllers' output is irrelevant or that the issue is a Layer 2 problem (encapsulation) when the root cause is a missing Layer 1 clock signal on the DCE side.

Why the other options are wrong

Some candidates may misinterpret the DCE cable type as a problem, but the output merely states the detected cable type accurately, not a misidentification.

Candidates often fixate on encapsulation issues when line protocol is down, overlooking the explicit hardware-level clocking problem shown here.

Many candidates think that a non‑functioning interface might be shut down, but the exhibit explicitly shows an active hardware detection with a configuration error, not an administrative shutdown.

Practice this question →

265

MCQhard

A network administrator has recently upgraded the corporate wireless LAN to support 802.11ax (Wi-Fi 6) and is using WPA3-Enterprise with a central WLC. Several users with new 802.11ax laptops report that they can connect to the SSID, but after a few minutes their connections drop and then re-establish, while legacy 802.11ac clients work without issues. Which action will resolve this problem?

A.Downgrade the WLAN security to WPA2-Enterprise for backward compatibility.

B.Enable Protected Management Frames (PMF) as Required on the WLAN.

C.Disable OFDMA and MU-MIMO on the WLC for the affected APs.

D.Adjust the 5 GHz channel width from 80 MHz to 40 MHz to avoid interference.

AnswerB

Setting Protected Management Frames (PMF) to Required enforces 802.11w on the WLAN, ensuring all management frames are encrypted and integrity-protected. WPA3 and 802.11ax clients expect PMF mandatory during robust security network association (RSNA); if the AP advertises PMF as not required or disabled, clients may disassociate immediately after authentication. Requiring PMF eliminates negotiation mismatches and prevents unprotected robust management frames from triggering disconnections.

Why this answer

WPA3-Enterprise requires Protected Management Frames (PMF) to be set to 'Required' on the WLC. When PMF is not enabled or set to 'Optional', 802.11ax clients using WPA3 may experience intermittent disconnects because management frame protection is mandatory for WPA3 operation. Legacy 802.11ac clients using WPA2 do not require PMF, so they remain unaffected.

Exam trap

Cisco often tests the misconception that Wi-Fi 6 issues are caused by physical layer features like OFDMA or channel width, when the actual problem is a mandatory security configuration mismatch (PMF) between WPA3 and the WLC.

Why the other options are wrong

Downgrading to WPA2 is a common workaround when WPA3-related features aren't correctly configured, but it's not the correct solution for PMF-related disconnections.

Disabling Wi-Fi 6 features does not resolve authentication or management frame protection issues; this misconception stems from blaming new features for instability.

Changing channel width addresses co-channel interference and throughput, not authentication or management frame protection issues.

Practice this question →

266

Drag & Dropmedium

Drag and drop the following steps into the correct order to install a new fiber optic cable and SFP module on a Cisco switch, then verify the interface status.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct procedure for installing a fiber optic cable and SFP module on a modern Cisco switch is: first, insert the SFP module into the port while the switch is powered on (hot-swap); second, connect the fiber optic cable to the SFP module; third, verify the interface status using 'show interfaces status'. Option D is incorrect because fiber optic cables cannot connect directly to a switch port without an SFP module, and powering down the switch is unnecessary when hot-swapping SFPs.

Exam trap

Many learners assume that SFP modules require the switch to be powered down before installation, but modern Cisco switches support hot-swapping. Always verify the specific module and device documentation.

Practice this question →

267

MCQhard

Which IPv6 prefix is used for link-local addresses?

A.FC00::/7

B.FE80::/10

C.2000::/3

D.FF00::/8

AnswerB

IPv6 link-local addresses are uniquely identified by the FE80::/10 prefix, which is reserved for communication solely within a single network segment. This specific prefix ensures that packets with these source or destination addresses never traverse a router, satisfying the constraint of being confined to the local link. Every IPv6-enabled interface automatically configures a link-local address from this range, enabling essential neighbour discovery and stateless address autoconfiguration processes.

Why this answer

IPv6 link-local addresses come from FE80::/10. They are valid only on the local link and are commonly used for neighbor discovery and routing adjacency formation.

Exam trap

Don't confuse link-local prefixes with global unicast or multicast prefixes. Remember, link-local addresses are only valid within the local link.

Why the other options are wrong

The prefix FC00::/7 is designated for Unique Local Addresses (ULAs) in IPv6, not link-local addresses. Link-local addresses specifically use the FE80::/10 prefix.

C: 2000::/3 is incorrect because it designates global unicast addresses, not link-local addresses, which are specifically defined by the prefix FE80::/10.

D is incorrect because FF00::/8 is reserved for multicast addresses in IPv6, not link-local addresses. Link-local addresses specifically use the FE80::/10 prefix.

Practice this question →

268

Multi-Selectmedium

Which two statements accurately describe a default gateway from a host perspective?

Select 2 answers

A.It is the next-hop path a host uses for destinations outside the local subnet.

B.It is typically the IP address of a local router or Layer 3 interface on the same subnet.

C.It replaces the need for a subnet mask.

D.It is the same thing as a DNS server.

E.It is used only for ARP broadcasts.

AnswersA, B

A default gateway is the designated next-hop router that a host uses to send IP packets to destinations outside its local subnet. The host compares its destination IP against its own subnet mask; if the destination is not local, it frames the packet for the gateway's MAC address, while keeping the final destination IP. Thus, the gateway is the exit point for all off-subnet traffic.

Why this answer

A default gateway is the local router or Layer 3 interface that a host uses for traffic destined beyond its own subnet. In plain language, the host uses the gateway when the destination is not local. The default gateway does not replace the host’s own IP address or subnet mask; it complements them by providing the next-hop path for remote communication.

This is a foundational host-networking concept because many connectivity issues come from misunderstanding what the gateway actually does. The two correct answers are the ones that describe remote-traffic forwarding and the local next-hop role of the gateway.

Exam trap

Avoid confusing the gateway's role with local traffic handling or address replacement. Focus on its function in remote communication.

Why the other options are wrong

This option is wrong because a default gateway does not replace the need for a subnet mask; both are essential for proper IP communication. The subnet mask defines the network portion of an IP address, while the default gateway routes traffic to external networks.

This option is wrong because a default gateway and a DNS server serve different purposes; the default gateway routes traffic outside the local subnet, while a DNS server resolves domain names to IP addresses.

This option is wrong because a default gateway is not limited to ARP broadcasts; it is used for routing packets to destinations outside the local subnet, which involves more than just ARP communication.

Practice this question →

269

MCQhard

Refer to the exhibit. A network engineer is troubleshooting intermittent connectivity between a branch router and the upstream switch. The switch port is manually configured for full-duplex, and the Ethernet cable has been tested and is working properly. The engineer runs the show interfaces GigabitEthernet0/0 command on the router and receives the output shown. Based on the output, what is the most likely cause of the problem?

A.The switch port is configured for half-duplex instead of the expected full-duplex.

B.The cable is faulty, causing excessive late collisions and CRC errors.

C.The router interface is operating in half-duplex while the switch port is full-duplex, causing a duplex mismatch.

D.The excessive input errors are a result of a broadcast storm on the network.

AnswerC

The output shows 'Half-duplex, 1000Mb/s' and reports 17 late collisions and 23 CRC errors. With the switch known to be full-duplex, this is a classic duplex mismatch scenario, where the full-duplex switch transmits without sensing the medium, while the half-duplex router interprets simultaneous traffic as collisions (many of them late because the switch may start transmitting after the router has already begun its frame).

Why this answer

The output shows the router interface is operating in half-duplex (as indicated by 'Half-duplex' in the show interfaces output), while the switch port is manually configured for full-duplex. This duplex mismatch causes the router to use CSMA/CD and detect collisions, while the switch transmits without collision detection, leading to late collisions, CRC errors, and intermittent connectivity. The correct fix is to set both sides to the same duplex setting, ideally full-duplex.

Exam trap

Cisco often tests duplex mismatch by showing output with late collisions and CRC errors, and the trap here is that candidates may blame the cable (Option B) or assume the switch port is half-duplex (Option A), when the real issue is the router interface operating in half-duplex against a full-duplex switch port.

Why the other options are wrong

Users often think any collision indicator points to both sides being half-duplex, ignoring the known switch configuration.

Late collisions are commonly associated with physical layer issues, leading candidates to assume a cable problem even when explicitly ruled out.

Candidates see input errors and CRC and prematurely conclude a loop or broadcast storm, overlooking that the output shows no broadcast activity and contains late collisions specific to duplex issues.

Practice this question →

270

MCQmedium

A network administrator receives a report that a user on a Windows laptop cannot connect to the internet, although other devices on the same subnet are working. The administrator runs `ipconfig` on the laptop and sees an IP address of 169.254.15.22 with a subnet mask of 255.255.0.0 and no default gateway. Based on this output, what is the most likely cause of the connectivity issue?

A.The laptop's DNS server settings are incorrect.

B.The DHCP server is unreachable or not responding to the laptop's DHCP request.

C.The laptop has a static IP address configured that conflicts with another device.

D.The Ethernet cable is faulty or disconnected.

AnswerB

APIPA is assigned when a DHCP client fails to receive a DHCPOFFER after sending DHCPDISCOVER messages. This typically means the DHCP server is down, misconfigured, or the laptop cannot reach it due to a network issue (e.g., VLAN mismatch, switch port problem).

Why this answer

The IP address 169.254.15.22 with a subnet mask of 255.255.0.0 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP client fails to obtain a lease from a DHCP server. The absence of a default gateway confirms that the laptop cannot reach any DHCP server, as APIPA addresses are not routable and are only used for link-local communication. Therefore, the most likely cause is that the DHCP server is unreachable or not responding to the laptop's DHCP request.

Exam trap

Cisco often tests the distinction between APIPA and other IP assignment failures, and the trap here is that candidates may confuse a DHCP failure with a physical layer issue (faulty cable) or a DNS misconfiguration, not realizing that APIPA is a specific Windows behavior triggered only by DHCP unavailability.

Why the other options are wrong

The APIPA address indicates a DHCP failure, not a DNS problem.

A static IP conflict would not result in an APIPA address; the laptop would show the manually configured IP, not 169.254.x.x.

A physical cable issue would prevent link, so the laptop would not even attempt DHCP and would not get an APIPA address.

Practice this question →

271

Multi-Selectmedium

Which TWO statements correctly describe the causes or implications of CRC errors, runts, giants, or output errors as seen in the output of 'show interface' or 'show interface status'?

Select 2 answers

A.CRC errors are always caused by a faulty switch port and require port replacement.

B.A high number of runts on an interface typically indicates excessive collisions or a faulty NIC.

C.Giants are frames that exceed the maximum transmission unit (MTU) and are always discarded by the switch.

D.Output errors, including late collisions, can be caused by a duplex mismatch between the switch and the connected device.

E.The 'show controllers' command provides a detailed view of CRC errors but does not show runts or giants.

AnswersB, D

A runt is an Ethernet frame shorter than the 64-byte minimum, often generated when a collision aborts transmission or when a faulty NIC emits undersized frames. On a modern full-duplex link, collisions should not occur, so a persistent runt count usually points to a defective NIC, bad cabling, or a misconfigured interface. High runt counts can also indicate excessive network congestion in legacy half-duplex environments.

Why this answer

Runts—frames smaller than 64 bytes—often result from collisions truncating frames on half-duplex links or a faulty NIC. Option D is correct because duplex mismatch can cause late collisions, which appear as output errors in 'show interface'; a device on one side full-duplex and the other half-duplex leads to collisions and framing errors. Option A is wrong because CRC errors can stem from faulty cabling, interference, or a mismatched NIC, not exclusively a bad switch port.

Option C is wrong because giants (frames over maximum MTU) may be forwarded if the interface is configured with jumbo frames or the switch is set to accept oversize frames. Option E is wrong because 'show controllers' displays frame-size errors like runts and giants, including details beyond CRC errors.

Exam trap

Cisco often tests the misconception that CRC errors always indicate a bad port (trap A) and that giants are always discarded (trap C), when in reality both can have multiple causes and switches can be configured to forward larger frames.

Why the other options are wrong

This statement is too absolute; CRC errors often stem from Layer 1 issues like bad cables or noise, not always a defective port.

The statement is too definitive; giants can be forwarded if jumbo frame support is enabled.

This statement is incorrect because 'show controllers' often includes runt and giant counters on many Cisco platforms.

Practice this question →

272

PBQhard

You are connected to R1. Configure IPv4 and IPv6 addressing on R1's interfaces and verify reachability to R2. The current configuration has a wrong subnet mask on G0/0, missing default gateway for IPv4, and R1's IPv6 address is configured using EUI-64 while R2 uses a static IPv6 address. Fix these issues so that R1 can ping both R2's IPv4 and IPv6 addresses.

Network Topology

Hints

•Compare the subnet masks on R1 and R2's G0/0 interfaces.
•Check the IPv4 default route — the next-hop must be reachable.
•R1's IPv6 EUI-64 will not match the static address on R2; use a static assignment on the same subnet.

A.Change R1 G0/0 subnet mask to /30, add a default route via 192.0.2.2, and configure a static IPv6 address 2001:db8:1::1/64 on G0/0.

B.Change R1 G0/0 subnet mask to /30, add a default route via 192.0.2.254, and keep the EUI-64 IPv6 address on G0/0.

C.Change R1 G0/0 subnet mask to /24, add a default route via 192.0.2.2, and configure a static IPv6 address 2001:db8:1::1/64 on G0/0.

D.Change R1 G0/0 subnet mask to /30, add a default route via 192.0.2.2, and keep the EUI-64 IPv6 address on G0/0.

AnswerA

solution

! R1
enable
configure terminal
interface GigabitEthernet0/0
ip address 192.0.2.1 255.255.255.252
no ipv6 address 2001:db8:1::/64 eui-64
ipv6 address 2001:db8:1::1/64
exit
no ip route 0.0.0.0 0.0.0.0 192.0.2.254
ip route 0.0.0.0 0.0.0.0 192.0.2.2
end
write memory

Why this answer

The problem had three issues: (1) R1's G0/0 subnet mask was /24 (255.255.255.0) but R2's G0/0 was /30 (255.255.255.252), causing an IP subnet mismatch. (2) R1 lacked a default gateway for IPv4; the static route pointed to 192.0.2.254 which is not reachable. (3) R1's IPv6 EUI-64 configuration on G0/0 generates an interface ID from the MAC, but R2 expects a static address 2001:db8:1::2/64, so R1 must use a static IPv6 address on the same subnet. The fix: change R1's G0/0 mask to /30, add a default route via R2's G0/0 IP (192.0.2.2), and configure a static IPv6 address (e.g., 2001:db8:1::1/64) on R1's G0/0.

Exam trap

Be careful not to confuse the default gateway with an arbitrary IP; it must be the next-hop router's interface IP on the same subnet. Also, remember that EUI-64 generates a unique interface ID from the MAC, which may not match a statically configured peer address—both sides must use consistent addressing methods.

Why the other options are wrong

The default gateway must be R2's directly connected interface IP (192.0.2.2), not 192.0.2.254. EUI-64 cannot be used if the peer expects a specific static address on the same subnet.

The subnet mask must be consistent on both ends of the link. A /24 mask on one side and /30 on the other creates overlapping subnets and routing issues.

EUI-64 does not guarantee that the resulting IPv6 address will be on the same subnet as a statically configured peer address. For direct connectivity, both routers must have addresses in the same subnet.

Practice this question →

273

MCQhard

A router interface is configured with the prefix 2001:db8:acad:12::/64 and uses EUI-64 to build the interface ID. What is the main purpose of EUI-64 in this context?

A.It automatically creates the interface ID portion of the IPv6 address from the MAC address.

B.It changes the /64 prefix into a /48 prefix for summarization.

C.It replaces the need for a link-local address.

D.It encrypts IPv6 traffic between neighbors.

AnswerA

EUI-64 is the interface ID generation method used when a router interface has no explicit 64-bit host portion configured. The 48-bit MAC address is split, the hex value FFFE is inserted between the OUI and the serial number, and the universal/local bit is flipped to form the 64-bit interface identifier. This automatically completes the IPv6 address and is why the statement is correct.

Why this answer

EUI-64 is used to automatically generate the interface identifier portion of the IPv6 address from the underlying MAC address. In practical terms, the /64 prefix provides the network portion, and EUI-64 helps derive the lower 64 bits without the administrator manually typing a full host portion. This can make addressing easier in environments where automatic formation is desired.

The important idea is that EUI-64 affects the interface ID, not the prefix length or the routing behavior of the network. It is an address-construction method, not a routing protocol.

Exam trap

Remember, EUI-64 is about address generation, not routing or network configuration. Focus on its role in forming the interface ID.

Why the other options are wrong

This option is incorrect because EUI-64 does not change the prefix length of an IPv6 address; it is used solely for generating the interface ID from a MAC address within the existing prefix.

This option is incorrect because EUI-64 does not replace the need for a link-local address; link-local addresses are essential for local network communication in IPv6, regardless of how the global address is generated.

This option is wrong because EUI-64 does not encrypt IPv6 traffic; it is used to generate the interface ID from the MAC address, which is unrelated to encryption processes.

Practice this question →

274

MCQhard

A host address is 10.77.4.141/28. Which address is the network address of the subnet?

A.10.77.4.128

B.10.77.4.143

C.10.77.4.144

D.10.77.4.112

AnswerA

The host address 10.77.4.141 falls within the /28 subnet that starts at 10.77.4.128, because the /28 block size is 16 addresses (128-143). The network address is the first address of that block, where all host bits are zero, so 10.77.4.128 is the correct network address. Any address in the range 10.77.4.129 through 10.77.4.142 is valid for hosts, while .143 is the broadcast.

Why this answer

A /28 subnet has a block size of 16. In practical terms, the last-octet blocks are 0-15, 16-31, 32-47, and so on. Because 141 falls within the 128-143 block, the network address is 10.77.4.128.

This is a clean addressing-boundary question that rewards careful block calculation rather than guesswork.

Exam trap

Be careful not to confuse host addresses with network addresses. Always calculate the subnet block to find the network address.

Why the other options are wrong

Option B, 10.77.4.143, is incorrect because it falls within the usable host range of the subnet defined by 10.77.4.128/28, which spans from 10.77.4.129 to 10.77.4.142. The network address must always be the first address in the subnet.

This option is wrong because 10.77.4.144 is not the network address for the subnet defined by 10.77.4.141/28; the correct network address is 10.77.4.128, which is the first address in the subnet range.

Option D, 10.77.4.112, is incorrect because it does not fall within the subnet defined by the CIDR notation /28, which covers addresses from 10.77.4.128 to 10.77.4.143. The network address for this subnet is 10.77.4.128.

Practice this question →

275

PBQhard

You are connected to the console of R1. The network team wants to secure remote access. R1 currently has no SSH configuration. The domain name is 'example.com' and you need to generate an RSA key pair of 2048 bits and enable SSH version 2 on vty lines.

Network Topology

Hints

•SSH requires a domain name and RSA keys.
•Use 'ip ssh version 2' to enforce SSHv2.
•The vty lines must accept SSH only, not Telnet.

A.Configure IP domain name, generate RSA key pair with 2048 bits, set SSH version 2, and configure vty lines to use SSH.

B.Generate RSA key pair with 2048 bits, set SSH version 2, and configure vty lines to use SSH. Domain name is optional.

C.Configure IP domain name, generate RSA key pair with 2048 bits, and set SSH version 2. No need to configure vty lines.

D.Configure IP domain name, generate RSA key pair with 1024 bits, set SSH version 2, and configure vty lines to use SSH.

AnswerA

solution

! R1
ip domain-name example.com
crypto key generate rsa modulus 2048
ip ssh version 2
line vty 0 4
transport input ssh

Why this answer

Enabling SSH on a Cisco router requires four steps: set a hostname and IP domain name (needed to generate the RSA key pair), generate the RSA crypto key with the specified modulus (2048 bits), set the SSH version to 2, and configure the vty lines with 'transport input ssh' and a local username. All four are mandatory; omitting any one leaves SSH non-functional.

Exam trap

200-301 often tests the misconception that the IP domain name is optional — candidates skip it, but IOS cannot generate the RSA key pair without a hostname and domain name, so SSH configuration fails.

Why the other options are wrong

The specific factual error: The domain name is mandatory for RSA key generation in SSH configuration.

The specific factual error: Vty lines require transport input ssh to allow SSH connections.

The specific factual error: The key size must be 2048 bits as specified; 1024 bits is insufficient.

276

MCQhard

Refer to the exhibit. A network engineer is investigating intermittent connectivity complaints on a gigabit uplink between two distribution switches. The engineer runs the show interfaces GigabitEthernet0/0 command on one of the switches. Based on the output, what is the most likely cause of the errors?

A.The interface is configured with an incorrect encapsulation type.

B.A damaged or faulty cable is causing excessive CRC errors.

C.A duplex mismatch exists between the connected devices.

D.The interface is assigned to the wrong VLAN.

AnswerB

The exhibit displays 5200 CRC errors (more than 5000) and 5231 input errors. High CRC counts directly indicate that received frames are being corrupted by physical layer issues such as a damaged cable, loose connector, or EMI on the copper segment.

Why this answer

The output shows a high number of CRC errors and runts, which typically indicate a Layer 1 physical-layer issue such as a damaged or faulty cable. CRC errors occur when frames fail the cyclic redundancy check due to signal degradation, noise, or physical damage to the cabling. On a gigabit uplink, this is the most likely cause of intermittent connectivity.

Exam trap

Cisco often tests the distinction between CRC errors (physical layer) and late collisions (duplex mismatch), so the trap here is that candidates see errors and assume a duplex mismatch without checking for the specific error types like late collisions or alignment errors.

Why the other options are wrong

Encapsulation problems cause protocol failures, not corrupted frames with CRC errors.

Candidates often mistake high CRC counts for duplex issues. The absence of collision-related counters rules out a duplex mismatch.

A wrong VLAN does not generate CRC errors on the physical interface.

Practice this question →

277

MCQhard

A user reports that they cannot access a remote server at IP address 10.10.20.50. The user's PC has IP address 192.168.1.25/24, and the default gateway is 192.168.1.1. The user can successfully ping the default gateway and other hosts on the local subnet. However, pings to 10.10.20.50 fail, and a traceroute shows only the first hop (192.168.1.1) followed by timeouts. Which of the following is the most likely cause?

A.The user's PC has an incorrect subnet mask.

B.The default gateway lacks a route to the 10.10.20.0/24 network.

C.The remote server at 10.10.20.50 is powered off.

D.The user's DNS server is unreachable.

AnswerB

Since the client can ping the gateway but traceroute fails immediately after the first hop, the gateway does not know how to forward packets to 10.10.20.0/24. It either drops the packets or returns an ICMP destination unreachable, causing the observed behavior.

Why this answer

The user can reach local hosts and the default gateway, confirming that the PC's IP configuration and local switching are functional. The traceroute stopping at 192.168.1.1 with subsequent timeouts indicates that the default gateway receives the packets but does not know how to forward them to the 10.10.20.0/24 network. Therefore, the most likely cause is that the default gateway lacks a route to that remote subnet.

Exam trap

Cisco often tests the distinction between local connectivity issues (subnet mask, ARP) and routing issues (missing routes), trapping candidates who assume a failed ping to a remote IP must be due to the destination being down or a DNS problem.

Why the other options are wrong

The user can communicate with the default gateway and other local devices, so the subnet mask is correctly configured for the local network.

A powered-off server would cause timeouts only after the last router before the server, not immediately after the first hop.

Because the user is using the server's IP address, DNS is not involved in this connectivity test.

Practice this question →

278

MCQhard

A subnet requires 200 usable host addresses. Which prefix is the smallest that meets the requirement?

A./25

B./24

C./26

D./27

AnswerB

A /24 prefix allocates 8 bits for host addressing, producing 2^8 = 256 total addresses. After deducting the network and broadcast addresses, 254 usable host addresses remain, which comfortably exceeds the required 200. This makes /24 the correct prefix, as it is the smallest one that meets the requirement.

Why this answer

A /24 is the smallest valid choice. In plain language, the subnet needs enough total addresses so that after the network and broadcast addresses are reserved, 200 hosts still remain. A /25 is too small because it provides only 126 usable hosts. A /24 provides 254 usable hosts, which satisfies the requirement while being the next logical prefix size up.

This is a standard host-capacity planning question. The key is to work from usable hosts, not just total addresses, and then choose the smallest prefix that actually works.

Exam trap

Ensure you calculate usable addresses, not just total addresses, and choose the smallest prefix that meets the requirement.

Why the other options are wrong

A /25 subnet provides 126 usable host addresses, which is insufficient for a requirement of 200 usable addresses. Therefore, it does not meet the specified needs of the question.

A /26 subnet provides only 62 usable host addresses (64 total minus 2 for network and broadcast), which is insufficient for the requirement of 200 usable addresses.

Option D: /27 provides only 30 usable host addresses (32 total addresses minus 2 for network and broadcast), which is insufficient for the requirement of 200 usable host addresses.

Practice this question →

279

MCQhard

A network technician configures a Windows 10 PC with a static IPv6 address of 2001:db8:acad:1::100/64 and a default gateway of 2001:db8:acad:2::1. The PC can communicate with other hosts in the 2001:db8:acad:1::/64 subnet, but it cannot access any resources on other subnets, even though IPv4 connectivity through the same network works normally. What is the most likely reason for this issue?

A.The PC's default gateway address is in a different subnet than the PC's IPv6 address.

B.The PC's IPv6 stack has a corrupted binding that prevents routing.

C.The router's IPv6 routing table does not have a route back to the PC's subnet.

D.The DNS server for IPv6 resolution is misconfigured, causing all off-subnet traffic to fail.

AnswerA

An IPv6 host only uses a default gateway if it is on the same subnet. Since 2001:db8:acad:2::1 is in a different /64 subnet than the PC's 2001:db8:acad:1::100/64, the host considers the gateway unreachable and cannot send traffic beyond the local link.

Why this answer

The PC's IPv6 address is 2001:db8:acad:1::100/64, placing it in the 2001:db8:acad:1::/64 subnet. The configured default gateway is 2001:db8:acad:2::1, which belongs to the 2001:db8:acad:2::/64 subnet. For IPv6, a host will only consider a default gateway on the same link-local or on-link subnet; if the gateway address is not within the same /64 prefix as the host's address, the host cannot send packets to it directly, and all off-subnet traffic fails.

Exam trap

Cisco often tests the concept that an IPv6 host will only use a default gateway that is within the same subnet (same /64 prefix) as its own configured IPv6 address, unlike IPv4 where a gateway in a different subnet can still be used if the host has a route to it.

Why the other options are wrong

This is a less common and less specific cause; the symptom points directly to a misconfigured gateway address in a different subnet.

This option assumes a routing problem on the router, but the scenario indicates the PC cannot send packets to its gateway, which points to host configuration, not routing tables.

DNS misconfiguration would cause failures when using hostnames, but not for direct IP connectivity tests like pinging a remote IPv6 address.

Practice this question →

280

MCQhard

A host is configured as 10.10.20.190/26. Which range contains usable host addresses for that subnet?

A.10.10.20.129 to 10.10.20.190

B.10.10.20.128 to 10.10.20.191

C.10.10.20.130 to 10.10.20.191

D.10.10.20.193 to 10.10.20.254

AnswerA

A /26 prefix length yields a 64-address block. Since the address 10.10.20.128 falls on a 64-byte boundary, the subnet's network address is 10.10.20.128 and its broadcast address is 10.10.20.191. Therefore, the usable host addresses are exactly 10.10.20.129 through 10.10.20.190, as this excludes the network and broadcast identifiers while including every valid host in that range.

Why this answer

A /26 uses blocks of 64 addresses. In plain language, the ranges are 0–63, 64–127, 128–191, and 192–255. Since the host ends in 190, it belongs to the 128–191 block. In that block, 10.10.20.128 is the network address and 10.10.20.191 is the broadcast address. That leaves 10.10.20.129 through 10.10.20.190 as the usable host range.

This question checks whether you can identify the correct block and then exclude the reserved endpoints properly.

Exam trap

Be careful not to include the network and broadcast addresses as usable host addresses. Always calculate the subnet boundaries accurately.

Why the other options are wrong

Option B is incorrect because it includes the network address (10.10.20.128) and the broadcast address (10.10.20.191) for the subnet 10.10.20.128/26, which are not usable host addresses.

Option C is incorrect because the subnet mask /26 indicates a subnet range of 10.10.20.128 to 10.10.20.191, but the usable host addresses are from 10.10.20.129 to 10.10.20.190, excluding the network and broadcast addresses.

Option D is incorrect because the range 10.10.20.193 to 10.10.20.254 falls outside the subnet defined by 10.10.20.190/26, which only allows for usable addresses from 10.10.20.130 to 10.10.20.190.

Practice this question →

281

MCQhard

A technician is troubleshooting a connection between two routers, R1 and R2, connected back-to-back using Ethernet cables. Both routers have their interfaces configured and are in an 'up/up' state. R1's interface uses 192.168.1.1/24, and R2's interface uses 192.168.2.1/24. When the technician attempts to ping R2 from R1, the ping fails. What is the most likely cause?

A.The Ethernet cable is faulty, causing intermittent physical layer failures.

B.A duplex mismatch exists between R1 and R2, causing one-way communication.

C.A routing protocol is not configured to allow the routers to learn about each other's directly connected networks.

D.The IP addresses assigned to the interfaces belong to different subnets, preventing direct Layer 3 communication.

AnswerD

When two devices are in the same broadcast domain and have IP addresses in different subnets, they do not consider each other as local destinations. Router R1 will not attempt to ARP for 192.168.2.1 because it believes that address is in a different network, making the ping fail even though link status is up/up.

Why this answer

The ping fails because R1's interface is configured with IP address 192.168.1.1/24, which places it in the 192.168.1.0/24 subnet, while R2's interface uses 192.168.2.1/24, placing it in the 192.168.2.0/24 subnet. For two devices to communicate directly at Layer 3 over a single Ethernet link, their IP addresses must belong to the same subnet. Since these addresses are in different subnets, R1 will see the destination as unreachable and will not even attempt to send an ARP request for R2's MAC address, resulting in a failed ping.

Exam trap

Cisco often tests the concept that directly connected devices must share the same subnet, and the trap here is that candidates assume 'up/up' means Layer 3 connectivity is guaranteed, or they mistakenly think a routing protocol is needed to exchange routes between directly connected interfaces.

Why the other options are wrong

Candidates might suspect a physical issue first, but the up/up status definitively rules out a cable or hardware problem.

Candidates commonly associate ‘cannot ping’ with duplex mismatches, forgetting that the fundamental issue here is the IP subnet mismatch.

The trap is thinking that a routing protocol is always needed for inter-subnet communication, overlooking that directly connected devices on the same broadcast domain must share a common subnet.

Practice this question →

282

Multi-Selectmedium

Which TWO commands would a network engineer use to verify that a Windows client has received an IP address from a DHCP server and can resolve a domain name to an IP address?

Select 2 answers

A.ping 8.8.8.8

B.ipconfig /all

C.tracert www.courseiva.com

D.nslookup www.courseiva.com

E.arp -a

AnswersB, D

ipconfig /all is the correct command because it displays the full TCP/IP configuration for every network adapter on the system. It explicitly shows whether DHCP is enabled, the DHCP server address, the lease obtained and lease expiration times, and the IP address currently assigned by DHCP, which directly confirms that the DHCP process has completed successfully. It also lists the configured DNS servers and other vital Layer 3 details, making it the definitive tool for diagnosing IP addressing issues in a DHCP environment.

Why this answer

`ipconfig /all` displays the full TCP/IP configuration for all adapters, including whether the IP address was obtained from a DHCP server (the DHCP Enabled and DHCP Server fields). Option D is correct because `nslookup www.courseiva.com` queries the configured DNS server to resolve the domain name to an IP address, confirming DNS resolution works.

Exam trap

Cisco often tests the distinction between connectivity verification (ping) and configuration verification (ipconfig /all, nslookup), leading candidates to mistakenly select ping or tracert as tools for confirming DHCP and DNS functionality.

Why the other options are wrong

It checks network reachability, not DHCP or DNS.

It shows the path taken, not DHCP or DNS status.

It shows Layer 2 address mappings, not DHCP or DNS.

Practice this question →

283

Multi-Selectmedium

Which TWO statements about SFP transceivers and their associated cable types are correct?

Select 2 answers

A.SFP-10G-SR transceivers require single-mode fiber.

B.SFP-10G-LR transceivers use 1310 nm wavelength and can reach up to 10 km over single-mode fiber.

C.SFP-10G-LR transceivers can only be used with multimode fiber.

D.SFP-10G-SR transceivers typically use 850 nm wavelength over multimode fiber.

E.SFP-10G-LR transceivers support distances up to 40 km over single-mode fiber.

AnswersB, D

SFP-10G-LR transceivers implement 10GBASE-LR as defined by IEEE 802.3ae. They use a 1310 nm laser (typically a Fabry-Perot or DFB) with a narrow optical launch that is optimized for the 9 µm core of single-mode fiber (SMF). At 1310 nm, SMF has low attenuation and minimal chromatic dispersion, allowing the link to span up to 10 km, which is the standard reach for this optic.

Why this answer

Option B is correct because the SFP-10G-LR (Long Reach) standard operates at a 1310 nm wavelength and supports distances up to 10 km over single-mode fiber (SMF), typically using LC connectors. Option D is correct because the SFP-10G-SR (Short Reach) standard uses an 850 nm vertical-cavity surface-emitting laser (VCSEL) over multimode fiber (MMF), reaching up to roughly 300-400 m depending on the fiber grade (OM3/OM4). Option A is wrong because SFP-10G-SR is designed for multimode fiber, not single-mode fiber.

Option C is wrong because SFP-10G-LR is intended for single-mode fiber, not multimode fiber. Option E is wrong because 40 km over single-mode fiber corresponds to the 10G-ER (Extended Reach) standard, not 10G-LR.

Exam trap

Cisco often tests the confusion between SR and LR transceivers, where candidates mistakenly associate LR with multimode fiber or incorrect distances, such as thinking LR supports 40 km instead of the correct 10 km.

Why the other options are wrong

SFP-10G-SR uses multimode fiber, not single-mode.

SFP-10G-LR requires single-mode fiber, not multimode.

SFP-10G-LR max is 10 km, not 40 km (ER is 40 km).

Practice this question →

284

Multi-Selectmedium

Which TWO statements about SFP transceivers and interface diagnostics are true?

Select 2 answers

A.SFP modules are hot-swappable, meaning they can be inserted or removed without powering off the switch.

B.Copper 1000BASE-T SFP modules can transmit data up to 10 km over Category 5e cabling.

C.The show interfaces transceiver command provides diagnostic details such as temperature, voltage, and optical power levels.

D.Multi-mode fiber uses a smaller core diameter, about 9 microns, compared to single-mode fiber.

E.Any SFP transceiver, regardless of vendor, will operate in a Cisco switch by default.

AnswersA, C

SFP modules are hot-swappable by design, meaning they can be inserted or removed from an active switch port without powering down the chassis or rebooting the device. This field-replaceable feature allows network administrators to change media types or replace faulty optics while maintaining uptime, though care must be taken to follow electrostatic discharge (ESD) precautions during handling.

Why this answer

Option A is correct because SFP (Small Form-factor Pluggable) transceivers are designed to be hot-swappable, so they can be inserted into or removed from an SFP port while the switch remains powered on, which is a key operational advantage for maintenance and upgrades. Option C is correct because the show interfaces transceiver command on Cisco switches reads the transceiver's digital diagnostic monitoring (DOM/DDM) data and reports real-time values such as temperature, supply voltage, bias current, and transmit/receive optical power levels. Option B is incorrect because 1000BASE-T copper SFPs are limited to about 100 meters over Category 5e/6 cabling, not 10 km; 10 km distances are achieved with single-mode fiber optics such as 1000BASE-LX/LH.

Option D is incorrect because it reverses the fiber types: single-mode fiber has a core of about 9 microns, while multi-mode fiber has a larger core, typically 50 or 62.5 microns. Option E is incorrect because Cisco switches generally require Cisco-branded or Cisco-compatible SFPs; third-party or uncoded transceivers are often rejected with an 'unsupported transceiver' error unless the switch is specifically configured to allow them.

Exam trap

Cisco often tests the distinction between copper and fiber SFP distance limits, and the trap here is assuming that a copper SFP can achieve fiber-like distances, when in reality 1000BASE-T is strictly limited to 100 meters.

Why the other options are wrong

1000BASE-T SFPs (such as the GLC-T) have a maximum reach of 100 m, not 10 km. 10 km is typical for 1000BASE-LX/LH single-mode fiber SFPs.

Multi-mode fibers have larger cores to allow multiple light paths, while single-mode’s narrow core supports only one path. The 9-micron core is characteristic of single-mode.

Cisco IOS checks the SFP EEPROM for vendor coding. Third-party SFPs might not be recognized, causing an error or link failure until unsupported transceiver mode is enabled.

Practice this question →

285

Multi-Selectmedium

Which two statements accurately describe the role of a switch MAC address table?

Select 2 answers

A.It maps learned MAC addresses to switch ports for local forwarding decisions.

B.It helps reduce unnecessary flooding when the destination MAC is known.

C.It stores the best Layer 3 routes to remote networks.

D.It contains the router’s OSPF authentication keys.

E.It assigns IP addresses to end hosts dynamically.

AnswersA, B

A switch builds its MAC address table by examining the source MAC addresses of incoming frames and associating them with the ingress port. This learned mapping is then used to make local forwarding decisions, allowing the switch to deliver frames directly to the port associated with the destination MAC address. This is the fundamental operation of Layer 2 switching.

Why this answer

A switch MAC address table helps the switch make local forwarding decisions efficiently. In plain language, the switch learns which MAC addresses appear on which ports and then uses that information to send frames only where they need to go instead of flooding every frame everywhere.

The MAC table is not the same thing as a routing table, and it is not used for OSPF neighbor storage or DHCP lease records.

Exam trap

Avoid confusing the MAC address table with routing tables or ARP tables, which involve IP addresses and routing information.

Why the other options are wrong

This option is wrong because a switch MAC address table does not store Layer 3 routing information; it specifically maps Layer 2 MAC addresses to switch ports for local traffic forwarding.

Option D is incorrect because a switch MAC address table does not store OSPF authentication keys; it is designed to map MAC addresses to switch ports for forwarding decisions within a Layer 2 network.

This option is wrong because a switch MAC address table does not handle IP address assignments; it specifically deals with mapping MAC addresses to switch ports for local traffic forwarding.

Practice this question →

286

MCQhard

A subnet uses the mask 255.255.255.224. How many usable host addresses does it provide?

A.14

B.30

C.62

D.126

AnswerB

The subnet mask 255.255.255.224 equates to a /27 prefix, which leaves only 3 bits for host addressing in the final octet. With 5 host bits total, the block contains 2^5 = 32 addresses. Subtracting the network and broadcast addresses yields exactly 32 - 2 = 30 usable host addresses.

Why this answer

A mask of 255.255.255.224 corresponds to a /27 prefix. In plain language, that leaves 5 host bits available in the address, which creates 32 total addresses in each subnet. Two of those are reserved: one for the network address and one for the broadcast address. That leaves 30 usable host addresses.

This is a classic subnetting question because it tests whether you can move from mask to prefix idea to host count without getting lost. Many learners remember the block size but forget to subtract the network and broadcast entries. The correct answer comes from that full logic chain: /27 means 32 total, and therefore 30 usable.

Exam trap

Remember to subtract the network and broadcast addresses from the total count of addresses in a subnet.

Why the other options are wrong

This option is wrong because a subnet mask of 255.255.255.224 provides 30 usable host addresses, not 14. The calculation is based on the formula 2^(number of host bits) - 2, where the number of host bits is 5 for this subnet mask.

This option is wrong because a subnet mask of 255.255.255.224 allows for 32 total addresses, of which 30 are usable after subtracting the network and broadcast addresses. The calculation is 2^(32-27) - 2 = 30 usable addresses.

Option D is incorrect because a subnet mask of 255.255.255.224 allows for 30 usable host addresses, not 126. The calculation is based on the formula 2^(32 - subnet bits) - 2, where the subnet bits for this mask is 27.

Practice this question →

287

MCQhard

A host address is 10.100.12.94/26. Which address is the broadcast address for that subnet?

A.10.100.12.63

B.10.100.12.127

C.10.100.12.64

D.10.100.12.128

AnswerB

A /26 mask leaves six host bits, so each subnet spans 64 addresses. The host 10.100.12.94 sits in the block 10.100.12.64–10.100.12.127, whose all-ones host portion yields the broadcast address 10.100.12.127, satisfying the subnet broadcast requirement.

Why this answer

A /26 subnet has a block size of 64, so the fourth-octet ranges are 0–63, 64–127, 128–191, and 192–255. The host address 10.100.12.94 lies in the 64–127 range, making the broadcast address the last address in that range: 10.100.12.127. Option A (10.100.12.63) is the broadcast of the previous subnet (0–63).

Option C (10.100.12.64) is the network address of the subnet containing the host. Option D (10.100.12.128) is the network address of the next subnet (128–191).

Exam trap

Be careful not to confuse host addresses or network addresses with the broadcast address. Remember, the broadcast address is the last address in the subnet range.

Why the other options are wrong

10.100.12.63 is the broadcast address of the 0–63 subnet, not the one containing 94.

10.100.12.64 is the network address of the 64–127 subnet, not the broadcast.

10.100.12.128 is the network address of the 128–191 subnet, not the broadcast.

Practice this question →

288

Multi-Selectmedium

Which three statements about Power over Ethernet (PoE) and PoE+ standards are correct? (Choose three.)

Select 3 answers

.PoE (IEEE 802.3af) can deliver up to 15.4 watts of power per port.

.PoE+ (IEEE 802.3at) can deliver up to 30 watts of power per port.

.Both PoE and PoE+ use the same four pairs of a twisted-pair cable for power delivery.

.Powered devices (PDs) can negotiate power requirements using Link Layer Discovery Protocol (LLDP) with PoE extensions.

.PoE+ requires Category 3 cabling or better.

.PoE automatically disables power if a non-PoE device is detected.

Why this answer

Option 1 is correct because the IEEE 802.3af PoE standard specifies a maximum power delivery of 15.4 watts per port at the PSE (Power Sourcing Equipment), with a minimum of 12.95 watts guaranteed at the PD (Powered Device) after cable losses. Option 2 is correct because the IEEE 802.3at PoE+ standard increases the maximum power per port to 30 watts at the PSE, with 25.5 watts available at the PD. Option 4 is correct because PDs can negotiate power requirements using LLDP with the IEEE 802.1AB LLDP-MED (Media Endpoint Discovery) extensions, which include PoE TLV (Type-Length-Value) fields for power negotiation beyond the simple classification method.

Option 3 (both PoE and PoE+ use the same four pairs) is incorrect because both standards deliver power over only two pairs (spare or data pairs depending on mode); four-pair power delivery is introduced in IEEE 802.3bt (PoE++). Option 5 (PoE+ requires Category 3 cabling) is incorrect because PoE+ requires at least Category 5e cabling to support the higher power levels without excessive heat or signal degradation. Option 6 (PoE automatically disables power if a non-PoE device is detected) is incorrect because the PSE first performs a detection phase to identify a valid PoE signature; if none is found, power is never applied—so it is not disabled after being enabled.

Exam trap

Cisco often tests the misconception that PoE and PoE+ both use all four pairs for power delivery, when in fact they use only two pairs, and the four-pair delivery is exclusive to the 802.3bt standard (PoE++).

Why the other options are wrong

Both PoE and PoE+ use only two pairs for power delivery, not four; four-pair delivery is exclusive to 802.3bt (PoE++).

PoE+ requires Category 5e or better cabling, as Category 3 cannot safely support the higher current.

PoE does not disable power on a non-PoE device; detection prevents power from ever being applied to non-compliant devices.

Practice this question →

289

MCQhard

A network engineer notices that the router interface GigabitEthernet0/1 is in an 'administratively down' state in the output of the show ip interface brief command, preventing connectivity to the subnet connected to that interface. What is the most likely cause?

A.The interface does not have an IP address assigned.

B.The shutdown command is configured on the interface.

C.The interface is configured with an incorrect subnet mask.

D.An access list is blocking traffic on the interface.

AnswerB

The 'administratively down' status is only displayed when the interface has been explicitly disabled using the shutdown command in configuration mode. This command sets a software flag that prevents the interface from forwarding any traffic and forces the line status to 'administratively down' regardless of the physical connection. It is a direct, intentional administrative action, and the interface will remain in this state until the no shutdown command is issued. Thus, the shutdown command is the definitive cause for this status.

Why this answer

The 'administratively down' state in the output of 'show ip interface brief' indicates that the interface has been manually disabled using the 'shutdown' command. This is a Layer 1/2 administrative state, not a protocol or connectivity issue. To bring the interface up, the 'no shutdown' command must be applied in interface configuration mode.

Exam trap

Cisco often tests the distinction between 'administratively down' (caused by the 'shutdown' command) and 'down/down' (caused by a physical layer issue like a disconnected cable), leading candidates to confuse the two states.

Why the other options are wrong

Candidates often confuse the lack of an IP address with a non-functional interface, believing it will be shown as down.

Students may think any IP misconfiguration could bring the interface down, but only the shutdown command causes 'administratively down'.

Because an ACL can stop traffic, candidates sometimes assume it would be reflected as a down state, but interface status is independent of ACLs.

Practice this question →

290

MCQhard

A subnet uses the prefix /29. How many usable host addresses are available in each subnet?

A.2

B.6

C.14

D.30

AnswerB

A /29 prefix leaves 3 host bits (32 - 29 = 3), yielding 2^3 = 8 total IPv4 addresses in the subnet. After reserving one address for the network identifier and one for the directed broadcast address, exactly 8 - 2 = 6 addresses remain assignable to hosts. This matches the formula 2^(32 - prefix) - 2, which is the standard way to calculate usable host capacity.

Why this answer

A /29 prefix leaves 3 host bits, which creates 8 total addresses per subnet. In plain language, two of those addresses cannot be assigned to hosts because one identifies the subnet itself and one is reserved as the broadcast address. That leaves 6 usable host addresses. This is a standard CCNA calculation because it checks whether you understand both the total address count and the subtraction of the reserved addresses.

Many candidates remember powers of two but forget to account for the network and broadcast addresses when the question asks for usable hosts. The safest process is to calculate the total size first and then reduce it by two. That is how you arrive at 6 usable addresses for a /29.

Exam trap

Remember to subtract the network and broadcast addresses from the total count to find usable addresses.

Why the other options are wrong

Option A is incorrect because a /29 subnet provides 8 total IP addresses, of which 6 are usable for hosts after accounting for the network and broadcast addresses.

Option C is wrong because a /29 subnet provides 8 total IP addresses, of which 6 are usable for hosts after reserving one for the network address and one for the broadcast address.

Option D is incorrect because a /29 subnet provides 8 total IP addresses, of which 6 are usable for hosts after accounting for the network and broadcast addresses. Therefore, stating that there are 30 usable addresses is inaccurate.

Practice this question →

291

PBQhard

You are connected to a Cisco 9800 WLC (WLC1) via its management interface. A wireless client reports association failures with SSID 'CorpNet'. The client uses WPA3-Personal, but the WLAN is configured for WPA2. Additionally, the SSID is hidden and the client is on the wrong VLAN (VLAN 20 instead of VLAN 100). Fix these issues so the client can associate successfully with WPA3, on VLAN 100, and with the SSID broadcast enabled.

Network Topology

Hints

•Check the WLAN security settings: WPA3 requires 'security wpa wpa3' and removal of 'wpa2'.
•The SSID is hidden; use 'broadcast-ssid' under the WLAN configuration.
•The policy tag assigns VLAN 20; change it to VLAN 100 to match client requirements.

A.Enable SSID broadcast, change security to WPA3-Personal, and assign VLAN 100 in the policy tag.

B.Enable SSID broadcast, change security to WPA2-PSK, and assign VLAN 20 in the policy tag.

C.Disable SSID broadcast, change security to WPA3-Personal, and assign VLAN 100 in the policy tag.

D.Enable SSID broadcast, change security to WPA3-Enterprise, and assign VLAN 100 in the policy tag.

AnswerA

solution

! WLC1
configure terminal
wlan CorpNet 1 CorpNet
broadcast-ssid
no security wpa wpa2
security wpa wpa3
security wpa psk set-ccmp 0 7 1234567890
exit
wireless tag policy default-policy
vlan 100
end
write memory

Why this answer

The WLAN was configured for WPA2-PSK with a hidden SSID, and the policy tag assigned VLAN 20 instead of VLAN 100. To fix: (1) Enable SSID broadcast with 'broadcast-ssid'. (2) Change security to WPA3-Personal by removing WPA2 and enabling WPA3 with 'security wpa wpa3' and 'security wpa psk set-ccmp'. (3) Assign VLAN 100 in the policy tag with 'vlan 100'. The client should then associate.

Exam trap

Be careful to distinguish between WPA2 and WPA3, and between Personal (PSK) and Enterprise (802.1X). Also, remember that a hidden SSID must be broadcast for clients to discover it, and VLAN assignment is done in the policy tag, not the SSID configuration.

Why the other options are wrong

The specific factual error is that the client uses WPA3-Personal, so changing to WPA2-PSK does not meet the requirement. Also, VLAN 20 is the wrong VLAN.

The specific factual error is that the SSID is currently hidden and the client cannot see it; enabling broadcast is required, not disabling.

The specific factual error is that WPA3-Personal uses a pre-shared key, while WPA3-Enterprise requires 802.1X authentication. The client is configured for Personal mode.

Practice this question →

292

PBQhard

You are connected to R1 via the console. The network administrator reports that PC1 (connected to R1's GigabitEthernet0/1) cannot reach the internet. Troubleshoot the issue step by step. The current configuration and show outputs are provided.

Hints

•Check if PC1 can ping the default gateway and the next-hop router.
•Verify R1's default route.
•If all local connectivity works, the issue is likely beyond R1 (ISP side).

A.PC1 has an incorrect default gateway configured.

B.R1 is missing a default route to the ISP.

C.routing or NAT issue beyond the local network

D.PC1 has a DNS resolution issue.

AnswerC

solution

! R1

Why this answer

The issue is that PC1 cannot reach the internet despite having correct IP, gateway, and DNS. PC1 can ping the default gateway and even the next-hop router (203.0.113.2), but fails to ping 8.8.8.8. This indicates that the problem is beyond the local network — likely a routing or NAT issue on the ISP side.

However, the task requires troubleshooting client connectivity; the provided outputs show no misconfiguration on PC1 or R1. The fault is external (ISP not routing or no NAT), but the candidate must verify that client configuration is correct and then escalate or check the ISP link. For the PBQ, the candidate should confirm that PC1's IP, subnet mask, gateway, and DNS are correct, and that R1 has a default route and can reach the next hop.

No configuration changes are needed on R1 or PC1; the problem is outside the scope of the local network.

Exam trap

The trap is that candidates may focus on local misconfigurations (gateway, DNS, routing) when the evidence shows local connectivity works. Always verify step by step: if the client can ping the gateway and next hop, the problem is external.

Why the other options are wrong

The specific factual error is that a reachable gateway implies correct configuration; if the gateway were wrong, pinging it would fail.

The specific factual error is that reachability to the next hop requires a route; if R1 were missing a default route, it could not forward packets to the next hop.

The specific factual error is that DNS is only needed for name resolution; pinging an IP address bypasses DNS entirely.

Practice this question →

293

MCQhard

A user reports that their computer cannot access the network. The technician checks the computer's IP configuration and finds an APIPA address (169.254.x.x). The computer is connected to a switch port on VLAN 20. The DHCP server is located on VLAN 1. The technician then examines the router's interfaces using 'show ip interface brief' and sees that all interfaces shown are up/up. What should the technician do next?

A.Check the DHCP server logs to see if it is receiving Discover messages.

B.Verify that the ip helper-address command is configured on the router's VLAN 20 interface.

C.Attempt to ping the DHCP server's IP address from the host's APIPA address.

D.Restart the DHCP service on the server and recheck the host.

AnswerB

The router is the intervlan router, and the DHCP server is on a different subnet. For a DHCP Discover broadcast to cross VLANs, the router must have an IP helper-address pointing to the DHCP server's IP address on the VLAN 20 interface. Since all ports are up/up, the problem is almost certainly the missing relay. Checking this config directly addresses the most probable cause.

Why this answer

The APIPA address (169.254.x.x) indicates the host failed to obtain a DHCP lease. Since the DHCP server is on VLAN 1 and the host is on VLAN 20, a DHCP relay (ip helper-address) must be configured on the router's VLAN 20 interface to forward DHCP broadcast messages to the server. The 'show ip interface brief' shows all interfaces are up/up, so the next logical step is to verify the relay configuration.

Exam trap

Cisco often tests the concept that a DHCP relay (ip helper-address) is required when the DHCP server is on a different subnet, and candidates mistakenly focus on server-side issues or ping tests instead of the router configuration.

Why the other options are wrong

This action assumes the DHCP request has already reached the server; it bypasses verifying the network path that would deliver the broadcast to the server, which is the most likely missing piece.

Candidates might think that if the ping fails, the problem is network connectivity, but APIPA addresses are non-routable and the test itself is invalid in this context.

Many techs jump to rebooting a service when a simple configuration check would reveal the real problem. This violates the principle of least intrusive troubleshooting.

Practice this question →

294

Drag & Dropmedium

Drag and drop the following steps into the correct order to describe how data is encapsulated as it travels down the OSI model layers.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Why this order

Data originates at the application layer as user data. The transport layer then encapsulates this data by adding a header (e.g., TCP or UDP) to create a segment. The network layer further adds an IP header to the segment, forming a packet.

Next, the data link layer appends a frame header and trailer to the packet, resulting in a frame. Finally, the physical layer converts the entire frame into bits for electrical, optical, or radio transmission. This sequence follows the standard top-down encapsulation process in network communication.

Practice this question →

295

MCQhard

A host is configured with 192.168.10.129/25. Which subnet contains that host?

A.192.168.10.0/25

B.192.168.10.64/25

C.192.168.10.128/25

D.192.168.10.192/25

AnswerC

A /25 mask uses a 128-bit block size in the fourth octet, so the valid subnets within 192.168.10.0/24 are 192.168.10.0/25 and 192.168.10.128/25. The address .129 is within the upper block's range .128–.255, making it a host in that subnet. Its usable host range is .129–.254 with broadcast .255.

Why this answer

A /25 divides the /24 into two blocks: 0–127 and 128–255. In practical terms, 192.168.10.129 belongs to the upper half, so the containing subnet is 192.168.10.128/25.

This is a simple subnet-boundary question, but it is designed to confirm that you can identify the correct half of the /24 quickly and confidently.

Exam trap

A frequent exam trap is misidentifying the subnet boundaries for a /25 mask within a /24 network. Candidates often mistakenly believe that subnets start at .64 or .192, confusing /25 with other subnet sizes like /26 or /27. This leads to selecting incorrect subnets such as 192.168.10.64/25 or 192.168.10.192/25, which are invalid because /25 only divides the /24 into two halves starting at .0 and .128.

This misunderstanding causes errors in subnet identification and can result in wrong routing or access decisions in real networks.

Why the other options are wrong

192.168.10.0/25 covers IP addresses from 192.168.10.0 to 192.168.10.127. Since the host IP is 192.168.10.129, which is greater than .127, it does not belong to this subnet, making this option incorrect.

192.168.10.64/25 is not a valid /25 subnet boundary within a /24 network. /25 subnets split at .0 and .128 only, so this option is invalid and cannot contain the host 192.168.10.129.

192.168.10.192/25 is not a valid /25 subnet boundary within a /24 network. The /25 mask divides the network into two subnets only, starting at .0 and .128, so this option is incorrect.

Practice this question →

296

MCQmedium

A network technician is troubleshooting a connectivity issue where a user's email client cannot send messages, but the client can receive emails. The technician uses a protocol analyzer and sees that the client is successfully resolving the mail server's domain name to an IP address and establishing a TCP connection, but the server responds with an application-layer error. At which layers of the OSI model are the problem and the successful operations occurring, respectively?

A.The problem is at the Transport layer (Layer 4); successful operations are at the Application layer (Layer 7) only.

B.The problem is at the Application layer (Layer 7); successful operations are at the Application layer (Layer 7) and Transport layer (Layer 4).

C.The problem is at the Network layer (Layer 3); successful operations are at the Data Link layer (Layer 2) and Physical layer (Layer 1).

D.The problem is at the Presentation layer (Layer 6); successful operations are at the Session layer (Layer 5) and Transport layer (Layer 4).

AnswerB

The sequence of successful operations shows DNS resolution (Application layer, Layer 7) and a TCP handshake to the mail server's port 25 (Transport layer, Layer 4). These two layers are working end-to-end. The mail server returns an SMTP error after the connection is established, such as a rejected recipient or a policy violation. That error is an application-level protocol response, so the fault lies squarely in the Application layer (Layer 7), not in any lower layer.

Why this answer

The problem is at the Application layer (Layer 7) because the email client can resolve the domain name (DNS, Layer 7), establish a TCP connection (Transport layer, Layer 4), but the mail server returns an application-layer error (e.g., SMTP 550 or 554), indicating the issue lies in the email protocol itself (e.g., authentication failure, mailbox full, or rejected sender). Successful operations include DNS resolution (Application layer) and TCP three-way handshake (Transport layer), confirming layers 7 and 4 are functioning correctly.

Exam trap

Cisco often tests the distinction between successful lower-layer operations (DNS, TCP) and an application-layer failure, trapping candidates who assume any email problem must be at the Transport or Network layer because they confuse 'connection established' with 'protocol function working'.

Why the other options are wrong

The TCP handshake succeeded, so the Transport layer is working. The error message is generated by the application, not the transport protocol.

Successful TCP connection implies IP routing (Layer 3) is working. The error is not related to addressing or routing.

Email sending failures are typically application logic errors, not encryption/formatting or session problems. Also, DNS is an Application layer protocol, not Session or Presentation.

Practice this question →

297

Multi-Selectmedium

Which three of the following are correct steps in the process of CDP (Cisco Discovery Protocol) neighbor discovery? (Choose three.)

Select 3 answers

.CDP operates at Layer 2 and sends advertisements to the multicast address 01:00:0C:CC:CC:CC.

.CDP advertisements include the device identifier, platform, and capabilities.

.CDP is enabled by default on Cisco devices and runs over all interfaces that support SNAP headers.

.CDP advertisements are sent every 30 seconds by default.

.CDP can discover devices that are more than one Layer 2 hop away.

.CDP requires that both devices be in the same IP subnet.

Why this answer

CDP is a Cisco proprietary Layer 2 protocol that uses multicast MAC address 01:00:0C:CC:CC:CC to send advertisements to directly connected neighbors. Advertisements include device identifier, platform, and capabilities. CDP is enabled by default on Cisco devices and runs over interfaces supporting SNAP headers.

Incorrect options: CDP advertisements are sent every 60 seconds by default (not 30); CDP discovers only directly connected neighbors (not devices more than one L2 hop away); CDP does not require both devices to be in the same IP subnet because it operates at Layer 2.

Exam trap

A common mistake is thinking CDP uses a broadcast address or operates at Layer 3; another trap is confusing the default CDP timer (60 seconds) with the 30-second timer of other protocols like LLDP.

Why the other options are wrong

CDP advertisements are sent every 60 seconds by default, not 30.

CDP discovers only directly connected neighbors; it does not propagate beyond one Layer 2 hop.

CDP operates at Layer 2 and does not require devices to be in the same IP subnet.

Practice this question →

298

Drag & Drophard

Drag and drop the following steps into the correct order to configure a WLAN for WPA3-Enterprise on a Cisco WLC and sequence a wireless client association process.

Drag or tap steps into the slots.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The configuration creates the WLAN with WPA3-Enterprise security, enables it, then the client associates and completes 802.1X authentication before getting an IP.

Exam trap

Do not confuse the order of 802.1X authentication and DHCP. In WPA3-Enterprise, the client must authenticate before obtaining an IP address. Also, remember that a WLAN must be created before it can be enabled, and it must be enabled before clients can associate.

Practice this question →

299

PBQhard

You are connected to R1 via console. The link between R1 and R2 is experiencing packet loss and CRC errors. Configure interface speed and duplex on R1's GigabitEthernet0/0 to match R2's settings, then replace the SFP module with one that supports the required 2 km distance. Finally, verify the interface is operational without errors.

Network Topology

Hints

•CRC errors often indicate a duplex mismatch. Check the neighbor's configuration.
•Auto-negotiation must be disabled on both ends if one side is hardcoded.
•The current SFP is rated for 550m; for 2 km you need a long-range SFP (e.g., 1000BASE-LX).

A.Configure speed 1000, duplex full, and no negotiation auto on Gi0/0, then replace the SFP-GE-SX with SFP-GE-L.

B.Configure speed 1000 and duplex full on Gi0/0, then replace the SFP-GE-SX with SFP-GE-SX-MM.

C.Configure speed 100 and duplex full on Gi0/0, then replace the SFP-GE-SX with SFP-GE-L.

D.Configure no negotiation auto on Gi0/0, then replace the SFP-GE-SX with SFP-GE-L.

AnswerA

solution

! R1
configure terminal
interface GigabitEthernet0/0
speed 1000
duplex full
no negotiation auto
end
copy running-config startup-config

Why this answer

The CRC errors indicate a duplex mismatch or faulty medium. R1 is set to auto-negotiation while R2 is hardcoded to 1000/full, causing mismatch. First, set speed and duplex on R1 to match R2: 'speed 1000' and 'duplex full'.

Also disable auto-negotiation with 'no negotiation auto'. The existing SFP-GE-SX only supports 550m, but the link requires 2 km; replace it with a 1000BASE-LX/LH SFP (SFP-GE-L) which supports up to 10 km. After changes, verify with 'show interfaces Gi0/0' to confirm no CRC errors and correct speed/duplex.

Exam trap

Do not forget to disable auto-negotiation when manually setting speed and duplex on a Cisco interface. Also, remember that SFP types have specific distance limitations: SX for short reach (550m), LX/LH for long reach (10 km), and EX or ZX for even longer distances.

Why the other options are wrong

The SFP-GE-SX-MM is a multimode SFP with the same distance limitation as the original SFP-GE-SX.

The speed must match exactly; 100 Mbps is not compatible with 1000 Mbps.

When auto-negotiation is disabled, speed and duplex must be manually set; otherwise, the interface may default to half-duplex or other incompatible settings.

Practice this question →

300

MCQhard

A host address is 172.22.14.99/27. Which address is the broadcast address of the subnet?

A.172.22.14.95

B.172.22.14.127

C.172.22.14.96

D.172.22.14.128

AnswerB

172.22.14.127 is the broadcast address for the /27 subnet that contains host 172.22.14.99. Since the /27 mask creates 32-address blocks, the relevant block runs from 172.22.14.96 through 172.22.14.127, and the broadcast is always the final address in that block. The host bits in .127 are all ones, which identifies this as the directed broadcast for this subnet.

Why this answer

A /27 subnet has a block size of 32. In practical terms, the relevant blocks are 0-31, 32-63, 64-95, 96-127, and so on. Because 99 falls within the 96-127 block, the broadcast address is the last address in that block: 172.22.14.127.

This is a classic subnet-boundary question and remains important because addressing precision appears throughout the CCNA blueprint.

Exam trap

Be careful not to confuse network addresses with broadcast addresses, and ensure you are calculating the correct subnet range.

Why the other options are wrong

Option A is incorrect because the broadcast address for the subnet 172.22.14.99/27 is 172.22.14.127, not 172.22.14.95. The /27 subnet mask indicates that the last 5 bits are for host addresses, allowing for a range of addresses that ends at 172.22.14.127.

Option C (172.22.14.96) is incorrect because it falls within the usable host range of the subnet and is not the broadcast address. The broadcast address for the subnet 172.22.14.96/27 is actually 172.22.14.127.

Option D, 172.22.14.128, is incorrect because it does not fall within the subnet defined by 172.22.14.99/27, which has a valid range of 172.22.14.96 to 172.22.14.127. The broadcast address for this subnet is 172.22.14.127.

Practice this question →