CCNA Network Infrastructure and Connectivity Practice Question
Why does traceroute reveal each router hop along a path?
⚠ Common exam trap
Don't confuse traceroute's use of TTL and ICMP Time Exceeded messages with ping's use of ICMP Echo Requests.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Each router decrements TTL or hop limit, and expired packets trigger ICMP messages
Traceroute sends packets with increasing TTL or hop-limit values. When the value expires, the router that drops the packet returns an ICMP message, identifying that hop.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Each router appends its hostname to the packet payload
Why it's wrong here
Routers process the IP header only (decrementing TTL and updating checksums) and leave the payload untouched, so they have no mechanism to write their hostname into the data segment. Even when a router generates an ICMP Time Exceeded error, the original packet is encapsulated in the ICMP message, but the router's own hostname is not inserted anywhere—only its IP address is the source. Hostname insertion would also break end-to-end payload integrity and is not defined in RFC 792 or the traceroute mechanism.
When this WOULD be correct
In a different question asking how routers communicate their identities to the source host, where the context involves a network protocol that includes hostname information in the payload, this option could be correct. For example, if the question specified a protocol that includes hostnames in its data packets, such as DNS queries, this answer would apply.
- ✗
Each router sends an ARP response back to the source
Why it's wrong here
The Address Resolution Protocol (ARP) resolves a next-hop IP address to a MAC address only within a directly connected Ethernet segment. ARP requests are broadcast and replies are unicast, but the information never traverses a routed path, so ARP cannot reveal multiple router hops beyond the local link. Traceroute instead triggers ICMP errors at each Layer 3 hop.
When this WOULD be correct
If the question were about how devices communicate on a local network and the role of ARP in identifying devices, then this option could be correct. For example, a question asking how a device learns the MAC address of a router on the same subnet would make this option valid.
- ✓
Each router decrements TTL or hop limit, and expired packets trigger ICMP messages
Why this is correct
Traceroute sends packets with an incrementing IP time-to-live (TTL or IPv6 hop limit), starting at 1. Each router along the path decrements this value; when it reaches 0, the router discards the packet and sends an ICMP Time Exceeded message back to the source. That ICMP message carries the router's IP address in its source field, which reveals each hop in sequence as the TTL is increased.
- ✗
Each switch on the path sends a syslog message to the source host
Why it's wrong here
Layer 2 switches forward frames based on MAC addresses and do not modify or decrement the IP TTL, so they never generate ICMP TTL-expired messages. Syslog is an out-of-band logging mechanism that network devices use to send administrative messages to a configured server, not something any device spontaneously sends back to a traceroute source. Transit traffic passing through a switch does not cause the switch to consult or emit syslog messages.
When this WOULD be correct
In a different question asking about network monitoring or logging mechanisms, one could ask how switches communicate events to a central logging server. In this context, the option could be correct if the question specified that switches are configured to send syslog messages for certain events.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The 200-301 exam frequently reuses these exact scenarios with slightly different constraints.
✓Each router decrements TTL or hop limit, and expired packets trigger ICMP messagesCorrect answer▾
Why this is correct
Traceroute sends packets with an incrementing IP time-to-live (TTL or IPv6 hop limit), starting at 1. Each router along the path decrements this value; when it reaches 0, the router discards the packet and sends an ICMP Time Exceeded message back to the source. That ICMP message carries the router's IP address in its source field, which reveals each hop in sequence as the TTL is increased.
✗Each router appends its hostname to the packet payloadWrong answer — click to see why▾
Why this is wrong here
Routers do not modify packet payloads to add hostnames during normal forwarding. Traceroute relies on ICMP Time Exceeded messages generated by routers when TTL expires, not on payload modifications. Adding hostnames would violate IP packet integrity and is not a standard function.
★ When this WOULD be the correct answer
In a different question asking how routers communicate their identities to the source host, where the context involves a network protocol that includes hostname information in the payload, this option could be correct. For example, if the question specified a protocol that includes hostnames in its data packets, such as DNS queries, this answer would apply.
Why candidates choose this
A test-taker might think that since traceroute displays hostnames (if DNS resolution is enabled), routers must embed them. In reality, hostnames are resolved via reverse DNS lookups of the source IP addresses in ICMP messages, not from the packet payload.
✗Each router sends an ARP response back to the sourceWrong answer — click to see why▾
Why this is wrong here
ARP (Address Resolution Protocol) operates only within a local network segment to map IP addresses to MAC addresses. It is not used for path discovery across multiple routed hops. Traceroute uses TTL expiry to trigger ICMP responses, not ARP replies.
★ When this WOULD be the correct answer
If the question were about how devices communicate on a local network and the role of ARP in identifying devices, then this option could be correct. For example, a question asking how a device learns the MAC address of a router on the same subnet would make this option valid.
Why candidates choose this
Students may associate ARP with network discovery and assume it plays a role in traceroute. However, ARP is limited to Layer 2 and cannot traverse routers, making it unsuitable for multi-hop path tracing.
✗Each switch on the path sends a syslog message to the source hostWrong answer — click to see why▾
Why this is wrong here
Switches operate at Layer 2 and do not decrement TTL or generate ICMP Time Exceeded messages for traceroute. Syslog is a logging protocol used for network device event reporting, not for hop-by-hop path discovery. Traceroute relies on ICMP or UDP/TCP probes, not syslog messages.
★ When this WOULD be the correct answer
In a different question asking about network monitoring or logging mechanisms, one could ask how switches communicate events to a central logging server. In this context, the option could be correct if the question specified that switches are configured to send syslog messages for certain events.
Why candidates choose this
Students may confuse syslog with the ICMP messages used in traceroute, as both involve network devices sending messages. However, syslog is unrelated to the TTL-based mechanism of traceroute.
Analysis generated from the official 200-301blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
ICMP and Ping
Key term
TTL
TTL (Time to Live) is a value in network packets that limits how many hops or seconds the packet can travel before being discarded, preventing infinite loops and network congestion.
Key term
Router
A router is a networking device that connects different networks together and directs data traffic between them by choosing the best path for data to travel.
About these practice questions
This 200-301 question is part of Courseiva's 1,389-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.