CCNA Network Infrastructure and Connectivity Practice Question
Which two statements accurately describe subnet masks in IPv4?
⚠ Common exam trap
Avoid confusing subnet mask functions with encryption or DNS, as these are unrelated to IP address segmentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
It identifies the network-versus-host split in an IPv4 address.
A subnet mask tells the host which part of the IPv4 address refers to the network and which part refers to the host. In plain language, it helps the device determine whether a destination is local or remote. That decision is essential because it affects whether the host uses ARP directly or forwards traffic to the default gateway. The wrong answers usually attribute unrelated behaviors to the subnet mask, such as encryption or hostname resolution. The two correct answers are the ones that preserve its role in defining local scope and address structure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
It identifies the network-versus-host split in an IPv4 address.
Why this is correct
A subnet mask is a 32-bit value that uses contiguous 1s to mark the network portion of an IPv4 address and contiguous 0s to mark the host portion. By ANDing an IP address with its mask, you derive the network address, which reveals the exact boundary between the bits that identify the network and the bits assigned to hosts. This boundary is the mask's defining purpose, so saying it identifies the network-versus-host split is accurate.
- ✓
It helps a host determine whether a destination is local or remote.
Why this is correct
A host uses its own subnet mask to compute its local network address, then performs the same operation on the destination IP address. If the two resulting network addresses match, the destination is on the same local segment; if they differ, the destination is remote and traffic must be sent to a default gateway. Thus the mask directly determines whether a host will attempt local delivery or forward to a router, making this statement correct.
- ✗
It resolves hostnames into IP addresses.
Why it's wrong here
Hostname-to-IP-address resolution is performed by the Domain Name System (DNS), not by a subnet mask. A subnet mask is purely a binary pattern used for network/host division and contains no mapping information about names or addresses. It cannot resolve names because it lacks any table or service for translating human-friendly hostnames into routable IPv4 addresses, so this statement is false.
When this WOULD be correct
If the exam question were to ask about the functions of DNS or the process of hostname resolution, then option C would be correct. For example, a question might ask, 'What is the primary function of a DNS server in a network?'
- ✗
It encrypts packets before they leave the host.
Why it's wrong here
Subnet masks are Layer 3 addressing constructs used solely for determining network boundaries in IPv4; they do not alter the content of packets. Encryption, such as that provided by IPsec or TLS, is a separate security mechanism that ensures confidentiality and integrity by transforming the data itself. A subnet mask contains no cryptographic keys or algorithms and cannot encrypt anything before it leaves the host, making this statement incorrect.
When this WOULD be correct
If the exam question asked about the functions of network security protocols or methods for securing data transmission over IP networks, then option D could be correct. For instance, a question might ask which methods encrypt packets before transmission, where encryption is a key focus.
- ✗
It replaces the need for a default gateway.
Why it's wrong here
A subnet mask only defines the local network scope; it does not forward packets to different networks. For any destination outside the local subnet, a host must send the frame to a router configured as its default gateway, which then routes the packet onward. Without a default gateway, off-subnet traffic cannot leave the local segment even if a valid subnet mask is present, so the mask absolutely does not replace the need for a gateway.
When this WOULD be correct
In a question that asks about network configurations in a scenario where all devices are on the same subnet and no external routing is required, one might argue that a default gateway is unnecessary, making this option seem correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓It identifies the network-versus-host split in an IPv4 address.Correct answer▾
Why this is correct
A subnet mask is a 32-bit value that uses contiguous 1s to mark the network portion of an IPv4 address and contiguous 0s to mark the host portion. By ANDing an IP address with its mask, you derive the network address, which reveals the exact boundary between the bits that identify the network and the bits assigned to hosts. This boundary is the mask's defining purpose, so saying it identifies the network-versus-host split is accurate.
✗It resolves hostnames into IP addresses.Wrong answer — click to see why▾
Why this is wrong here
Subnet masks are used solely for IP addressing and routing purposes, not for name resolution. Hostname-to-IP-address resolution is performed by the Domain Name System (DNS), which is a completely different protocol and service.
★ When this WOULD be the correct answer
If the exam question were to ask about the functions of DNS or the process of hostname resolution, then option C would be correct. For example, a question might ask, 'What is the primary function of a DNS server in a network?'
Why candidates choose this
Students often confuse the roles of different network layer functions. Since subnet masks are involved in IP addressing, they might mistakenly think they also handle name resolution, especially when studying both topics in the same context.
✗It encrypts packets before they leave the host.Wrong answer — click to see why▾
Why this is wrong here
Subnet masks do not provide any encryption or security functionality. Encryption of packets is performed by protocols such as IPsec, TLS, or other cryptographic mechanisms, which operate independently of subnet masking.
★ When this WOULD be the correct answer
If the exam question asked about the functions of network security protocols or methods for securing data transmission over IP networks, then option D could be correct. For instance, a question might ask which methods encrypt packets before transmission, where encryption is a key focus.
Why candidates choose this
The term 'mask' might be misinterpreted as something that hides or protects data, leading some students to incorrectly associate it with encryption or security features.
✗It replaces the need for a default gateway.Wrong answer — click to see why▾
Why this is wrong here
A default gateway is still required for any traffic destined to a different subnet. The subnet mask only defines the local network boundary; it does not provide routing to other networks. Without a default gateway, a host cannot send packets off its subnet.
★ When this WOULD be the correct answer
In a question that asks about network configurations in a scenario where all devices are on the same subnet and no external routing is required, one might argue that a default gateway is unnecessary, making this option seem correct.
Why candidates choose this
Some students might think that if a subnet mask defines the local network, then all destinations within that mask are reachable directly, and they might overlook the need for a gateway to reach external networks.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
IPv4 Addressing and Address Classes
Key term
IPv4
IPv4 is the fourth version of the Internet Protocol, a set of rules that assigns unique numerical addresses to devices so they can communicate over networks like the internet.
Key term
Default gateway
A default gateway is a network device, typically a router, that acts as the exit point for traffic from a local network to other networks, including the internet.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.