CCNA Network Infrastructure and Connectivity Practice Question
Which three of the following are correct steps in the process of CDP (Cisco Discovery Protocol) neighbor discovery? (Choose three.)
⚠ Common exam trap
A common mistake is thinking CDP uses a broadcast address or operates at Layer 3; another trap is confusing the default CDP timer (60 seconds) with the 30-second timer of other protocols like LLDP.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
CDP operates at Layer 2 and sends advertisements to the multicast address 01:00:0C:CC:CC:CC.
CDP is a Cisco proprietary Layer 2 protocol that uses multicast MAC address 01:00:0C:CC:CC:CC to send advertisements to directly connected neighbors. Advertisements include device identifier, platform, and capabilities. CDP is enabled by default on Cisco devices and runs over interfaces supporting SNAP headers. Incorrect options: CDP advertisements are sent every 60 seconds by default (not 30); CDP discovers only directly connected neighbors (not devices more than one L2 hop away); CDP does not require both devices to be in the same IP subnet because it operates at Layer 2.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
CDP operates at Layer 2 and sends advertisements to the multicast address 01:00:0C:CC:CC:CC.
Why this is correct
CDP is a Cisco proprietary Layer 2 protocol that encapsulates advertisements directly in SNAP frames and sends them to the reserved multicast MAC address 01:00:0C:CC:CC:CC. Because this address is below the IP layer, CDP operates without any Layer 3 configuration, allowing neighbor discovery even when interfaces lack IP addresses or use incompatible subnets.
- ✓
CDP advertisements include the device identifier, platform, and capabilities.
Why this is correct
CDP advertisements are structured as a series of Type-Length-Value (TLV) fields. The mandatory TLVs include Device ID (typically the hostname), Platform ID (exact hardware model and software version), and Capabilities (such as router, switch, or bridge). This information is captured to provide a real-time inventory of directly connected Cisco devices for documentation and troubleshooting.
- ✓
CDP is enabled by default on Cisco devices and runs over all interfaces that support SNAP headers.
Why this is correct
CDP is enabled by default on Cisco IOS devices, both globally and on each supported interface, and requires only that the underlying media support SNAP (Subnetwork Access Protocol). Ethernet, FastEthernet, GigabitEthernet, Frame Relay, and ATM interfaces all support SNAP, whereas some tunnel or tunnel-like interfaces may not. The global command `cdp run` and the per-interface command `cdp enable` control this behavior.
- ✗
CDP advertisements are sent every 30 seconds by default.
Why it's wrong here
The default CDP advertisement interval is not 30 seconds but 60 seconds, and the default holdtime is 180 seconds. After receiving a CDP packet, a router maintains the neighbor entry for 180 seconds and removes it if no further advertisements are received. Confusing CDP's 60-second timer with OSPF's 30-second retransmit timer or other protocol intervals is a common exam pitfall.
- ✗
CDP can discover devices that are more than one Layer 2 hop away.
Why it's wrong here
CDP is a strictly single-hop, Layer 2 discovery protocol; it never forwards or relays CDP advertisements to other links. Therefore, a router can only see neighbors that are directly connected at the data-link layer, such as an adjacent switch or router on the same cable or VLAN. To discover devices that are two or more Layer 2 hops away, you must log into an intermediate device and run CDP there.
- ✗
CDP requires that both devices be in the same IP subnet.
Why it's wrong here
CDP does not inspect IP addresses or subnets, and Layer 3 reachability is irrelevant to its operation. Since CDP frames are sent to a multicast MAC address and use SNAP encoding, they are processed at Layer 2 without any need for IP addressing. This allows CDP to discover neighbors even when both devices are in completely different IP subnets or when one or both have no IP address configured at all.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
IPv4 Addressing and Address Classes
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
Key term
Internet Group Management Protocol
IGMP is a communication protocol used by devices on a network to report their membership in multicast groups to nearby routers, enabling efficient group data delivery.
About these practice questions
Courseiva writes every 200-301 question from scratch — 1,389 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.