CCNA Network Infrastructure and Connectivity Practice Question
Which three options correctly describe how a router processes a packet destined for a remote network? (Choose three.)
⚠ Common exam trap
Cisco often tests the distinction between Layer 2 (MAC) and Layer 3 (IP) header changes, so the trap here is that candidates mistakenly think the source IP address is rewritten at each hop, confusing routing with NAT or PAT.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It decrements the Time-to-Live (TTL) field in the IP header.
When a router forwards a packet to a remote network, it first decrements the Time-to-Live (TTL) field in the IP header to prevent infinite loops. It then performs a routing table lookup for the destination IP address to determine the next-hop interface and IP. Finally, it rewrites the source and destination MAC addresses for the next hop, because MAC addresses are only relevant on the local link and must be updated at each Layer 3 hop.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It decrements the Time-to-Live (TTL) field in the IP header.
Why this is correct
The router decrements the Time-to-Live (TTL) field by at least one on every IPv4 packet it processes. This hop-count limit is the primary loop-prevention mechanism in IP networking, ensuring a packet caught in a routing loop is eventually discarded rather than circulating forever. If the decremented TTL reaches zero, the router drops the packet and sends an ICMP Time Exceeded message back to the source, which is also the mechanism traceroute relies on.
- ✓
It performs a lookup in the routing table for the destination IP address.
Why this is correct
Before forwarding, the router performs a longest-prefix-match lookup in its routing table (or forwarding information base) using the destination IP address from the packet header. This lookup determines the exit interface and the next-hop IP address, either directly connected or a remote router. Without this routing decision, the router cannot know which Layer 2 network to place the packet on next, making the lookup a mandatory first step in the forwarding process.
- ✓
It rewrites the source and destination MAC addresses for the next hop.
Why this is correct
A router, when forwarding a packet towards a remote network, must encapsulate the Layer 3 IP packet into a new Layer 2 frame for transmission across the next network segment. This process precisely involves rewriting the frame's source MAC address to that of the router's outgoing interface and the destination MAC address to that of the next hop device. This fundamental Layer 2 re-encapsulation at each hop is essential for a router to successfully process and forward packets across disparate network segments towards their remote destination.
- ✗
It replaces the source IP address with its own outgoing interface IP.
Why it's wrong here
A standard router never changes the source IP address while forwarding a packet; it only touches the Layer 2 headers and the TTL/checksum fields. Replacing the source IP with the router's outgoing interface IP would break the end-to-end principle and make return traffic route to the router instead of the original sender. That behavior is specific to Network Address Translation (NAT), typically masquerading, not ordinary IP routing.
- ✗
It sends an ARP request for every destination IP address in the packet.
Why it's wrong here
ARP is used only to resolve the Layer 2 address of the next-hop device on the directly attached segment, not for the final destination IP when that destination is on a remote network. If the destination is remote, the router looks up the destination IP in its routing table to find the next hop, then checks its ARP cache for that next-hop IP; if absent, it sends an ARP request for the next-hop IP. Sending an ARP request for every destination IP would be impossible because the final destination may be on an entirely different subnet and unreachable by ARP.
- ✗
It encapsulates the entire packet in a new Layer 2 frame with the original MAC addresses.
Why it's wrong here
While it is true that a router must wrap the IP packet in a new Layer 2 frame, it does not reuse the original MAC addresses; those belonged to the sending host and the router's ingress interface on the prior segment. Instead, the router rewrites the destination MAC to that of the next-hop device and the source MAC to that of its own outgoing interface. The original MAC addresses are discarded with the old frame and are irrelevant beyond the current local link, so keeping them in the new frame would prevent any device on the next segment from forwarding the packet correctly.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
IPv4 Addressing and Address Classes
Key term
Interface
An interface is a point of connection or interaction between two systems, devices, or software components that allows them to exchange information or signals.
Key term
Next hop
A next hop is the next immediate router or device that a packet is sent to on its path from source to destination.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.