Infrastructure practice questions

CoS 5, DSCP AF41

Why wrong: AF41 (Assured Forwarding 4.1) is an admission-controlled video marking, not a voice marking. Voice traffic requires the strict-priority forwarding behavior of EF (Expedited Forwarding) to guarantee low latency, low jitter, and minimal loss; AF41, by contrast, is a lower-priority class that can be dropped during congestion. Using CoS 5 with DSCP AF41 creates a mismatch where Layer 2 says high priority but Layer 3 treats the traffic as ordinary video, leading to suboptimal queuing and potential voice quality degradation.

CoS 5, DSCP CS3

Why wrong: CS3 (Class Selector 3) is a DiffServ marking used for lower-priority traffic such as signaling or multimedia conferencing, not for voice bearer traffic. In the standard QoS model, voice must be marked as EF (DSCP 46) to receive strict-priority treatment; CS3, with a lower numerical DSCP value, gets placed in a lower queue and is subject to congestion-related delays and drops. Combining CoS 5 with DSCP CS3 contradicts the intended high-priority voice classification and causes inconsistent behavior on devices that trust only one marking.

CoS 4, DSCP EF

Why wrong: CoS 4 is conventionally assigned to video conferencing traffic on Cisco switches, placing it in a lower-priority queue to prevent it from starving voice. Although DSCP EF is correct for voice at Layer 3, pairing it with CoS 4 creates a marking conflict: a switch that trusts only CoS will classify this traffic as video, not as strict-priority voice. This mismatch can lead to voice frames being queued with video and experiencing delay or jitter, so the proper pairing for voice is CoS 5 with DSCP EF, not CoS 4.

switchport access vlan 100

Why wrong: The interface configuration command 'switchport access vlan 100' assigns an interface to access VLAN 100, but it does not create the VLAN itself. If VLAN 100 has not been created with the 'vlan 100' command, this command will fail because the VLAN must already exist in the switch's database. This command is used only after VLAN creation, to place a port into that VLAN, making it a post-creation assignment step, not a VLAN creation method.

vlan database

Why wrong: The legacy command 'vlan database' enters a special VLAN database mode used in older IOS versions, but it does not create any VLAN by itself. This mode required you to then type 'vlan 100' inside that mode, and it stored VLAN information separately in a vlan.dat file rather than in the running configuration. It is deprecated in modern Catalyst switches, and its use is unnecessary and non-standard for creating a new VLAN in current IOS, making it an incorrect answer.

interface vlan 100

Why wrong: The command 'interface vlan 100' creates a Switch Virtual Interface (SVI), which is a Layer 3 logical interface representing a VLAN. However, this command does not create the underlying L2 VLAN; VLAN 100 must already exist in the switch's VLAN database for the SVI to function properly. An SVI is used for routing between VLANs, and its creation without an existing VLAN would cause it to be inactive or unsupported, so it cannot be used to create a VLAN itself.

The interfaces must be on the same physical switch.

Why wrong: HSRP is intentionally designed for two separate physical switches to provide gateway redundancy, such as in an access-distribution or distribution-core topology. The protocol relies on Layer 2 multicast, which only requires a trunk or VLAN that spans both devices; the physical chassis is irrelevant. As long as the VLAN is allowed on the inter-switch link, the two interfaces can be on different switches and form an HSRP group. Requiring the same physical switch is therefore incorrect and would undermine the device-level redundancy HSRP is meant to provide.

The interfaces must be Layer 2 switchports.

Why wrong: HSRP operates at Layer 3 because it requires an interface with an IP address and the capability to route frames; a Layer 2 switchport is purely a frame-forwarding port with no IP configuration. On a multilayer switch, HSRP is enabled on an SVI (VLAN interface) or a routed port, both of which are Layer 3 constructs. A Layer 2 switchport simply forwards Ethernet frames to the local VLAN and cannot run the HSRP election or own a virtual IP. Therefore, this option is incorrect.

The interfaces must have the same IP address.

Why wrong: Each HSRP participant must have its own unique real IP address in the same subnet to source hello packets and identify itself during the election process. The shared virtual IP is a service address configured with the standby command, and it is not used as the source IP in hello messages—each router uses its real IP instead. If both interfaces were assigned the same IP, an address conflict would occur, breaking routing and ARP. Thus, the interfaces need different real IPs plus one common virtual IP.

The AS number is incorrect.

Why wrong: If the AS number were incorrect, the BGP neighbors would fail to establish a session because the OPEN message would contain a conflicting AS number, triggering a NOTIFICATION and transitioning to Idle/Active state. Since the session is already established and routes are being exchanged, an AS number mismatch is not the cause of the missing route. This condition specifically prevents peering, not route installation after peering is up.

The BGP session is using an incorrect interface.

Why wrong: Configuring the BGP session on the wrong interface would mean the TCP connection to the peer could never be established, as BGP would send packets from an interface that cannot reach the peer's IP address. The fact that the session is up proves the interface selection and underlying IP connectivity are correct. Therefore, an incorrect interface cannot be the reason a specific route is absent from the routing table.

The network is not advertised under BGP.

Why wrong: Not advertising a network under BGP only affects what the local router sends to its peers; it has no effect on the routes received from an established neighbor. If the network is missing from BGP updates, the problem would be on the advertising side, not on this router's inability to install a received route. Since the issue is about a route not being received or installed, this option does not explain the symptom.

switchport mode trunk

Why wrong: The 'switchport mode trunk' command unconditionally enables trunking, but it does not specify the encapsulation protocol. On older Catalyst switches that support both ISL and 802.1Q, the default encapsulation may be ISL, so this command alone does not directly configure 802.1Q trunking. To ensure 802.1Q, an explicit encapsulation command is required, making this option incomplete for the stated task.

switchport mode access

Why wrong: The 'switchport mode access' command forcibly disables trunking by setting the interface as an access port, which carries traffic for only a single VLAN and sends all frames untagged. This is the opposite of trunking and, therefore, cannot be used to configure 802.1Q trunking. Even if a remote switch is configured for trunk, an access port will not form a trunk link.

switchport trunk native vlan 1

Why wrong: The 'switchport trunk native vlan 1' command only designates VLAN 1 as the native VLAN for an existing trunk, and does not enable trunking itself. This command is applied after trunking is established, and it controls which VLAN is sent untagged on the trunk. Without first configuring trunk mode and encapsulation, this command has no effect on enabling 802.1Q trunking.

Matching authentication (if configured)

Why wrong: Authentication is optional in OSPF, so in a default configuration there is no authentication parameter to compare and adjacencies form without it. Only when authentication is explicitly enabled must the type (null, simple, cryptographic) and the password or key ID match, causing Hello packets to be discarded if a mismatch occurs. Since it is contingent on configuration, it is not a universal requirement for adjacency establishment.

Same subnet mask

Why wrong: The Hello protocol checks that the network number of the receiving interface matches the network number of the sending interface, but it does not compare subnet masks directly. Two routers can form an adjacency if their IP addresses belong to the same subnet even if the configured masks differ, because OSPF derives the network number from the address and mask. On point-to-point links, the mask is ignored entirely, further confirming that identical subnet masks are not a prerequisite.

Backup Designated Router

Why wrong: In OSPF's DR/BDR election process on a broadcast or non-broadcast multi-access network, a router with interface priority 0 is explicitly marked as ineligible to become either the Designated Router or the Backup Designated Router. Since the exhibit shows priority 0 for r1, it cannot fulfill the BDR role, making this option incorrect. The BDR role would only be possible if the priority were greater than 0 and r1 lost the DR election to a higher-priority router.

Regular router

Why wrong: The term 'regular router' is not a valid OSPF state or role in the neighbor state machine. OSPF defines specific states for routers on multi-access networks: DR, BDR, and DROther, along with neighbor states like Full and Two-Way. Calling r1 a 'regular router' is vague and incorrect because it does not correspond to any protocol-specific function. In the context of OSPF operation, r1's actual role is DROther.

Designated Router

Why wrong: The Designated Router (DR) election also uses the router priority value, and a priority of 0 disqualifies r1 from becoming the DR on this segment. Even if r1 has the highest router ID, its configured priority of 0 overrides that and prevents any chance of winning the election. Therefore, r1 cannot be the DR, and the exhibit's priority 0 setting directly contradicts this option.

The new switch is not configured with the same VLANs as the distribution switches.

Why wrong: A lack of identical VLAN configurations does not create loops; instead, it causes per-VLAN connectivity failures because traffic for missing VLANs is simply not forwarded. The switch can still run STP and maintain a loop-free topology for the VLANs it does carry. The described symptoms of broadcast storms and severe degradation are not consistent with a simple VLAN mismatch, which would affect only specific VLAN traffic.

The new switch has a lower bridge priority than the current root bridge.

Why wrong: Setting a lower bridge priority makes the new switch more eligible to become the root bridge, but STP still ensures a loop-free environment regardless of which switch is root. The root bridge is a legitimate role, and changing it merely alters the topology paths, causing some traffic to take different routes. It would not by itself generate the broadcast storms or MAC flapping indicative of a Layer 2 loop, so this is not the cause.

The new switch has become the root bridge and is sending inferior BPDUs.

Why wrong: The root bridge does not send inferior BPDUs; it sends superior BPDUs with a higher priority that other switches accept as the best. Becoming the root bridge is a normal condition and does not inherently create loops. This option is incorrect because it both mischaracterizes BPDU behavior and confuses a topology change with a loop, which is the actual cause.

The default route on the CE is overriding the BGP routes.

Why wrong: A default route (0.0.0.0/0) on the CE has the least specific prefix length, so it is used only for destinations that do not match a more specific route. BGP-advertised prefixes (e.g., /24s) are more specific and will always be preferred over the default route for matching traffic, regardless of the administrative distance. Thus, a default route cannot override or mask BGP routes; it simply provides a fallback when no specific route exists.

The routes have an AS path that is too long.

Why wrong: AS path length is a BGP best-path selection criterion, not a route-installation filter. BGP accepts and installs any valid route from a peer, even if its AS path is very long, as long as it passes basic validation (e.g., next-hop reachability). In practice, an AS path would have to exceed the 255-attribute segment limit to be considered invalid, which is extremely rare and not a typical reason for missing routes.

The CE is not advertising its routes to the PEs.

Why wrong: This explanation confuses outbound route advertisement with inbound route reception. The CE not advertising its own routes to the PEs would affect what the PE learns and can redistribute, but it does not prevent the CE from receiving BGP routes that the PE sends. The issue described is that the CE is not receiving/installing routes from the PE, which is a problem with the BGP session or the route attributes (like next-hop reachability), not with what the CE advertises.

Disable PortFast on all access ports to force proper RSTP convergence.

Why wrong: Disabling PortFast on access ports does not affect root port selection and would only slow down convergence for end devices; it does not solve the equal-cost path flapping.

Configure spanning-tree vlan 10 priority 4096 on DS1 to ensure it remains the root and that AS2 selects the uplink to DS1 as root port.

Why wrong: Lowering DS1's priority to 4096 is unnecessary because DS1 is already the root bridge (priority 32768 by default). This does not change the fact that both uplinks from AS2 have equal cost, so flapping continues.

Increase DS2's priority to 8192 to make it less likely to become the root.

Why wrong: Increasing DS2's priority to 8192 makes it even less likely to become root, but since it is not the root, this does not affect the equal-cost path selection from AS2; the tie remains.

The network statement uses an incorrect subnet mask.

Why wrong: EIGRP network statement uses wildcard mask, not subnet mask.

One router has a loopback interface that is not advertised.

Why wrong: Loopback interfaces are not required for EIGRP adjacency.

The hello and hold timers do not match.

Why wrong: EIGRP hello and hold timers do not need to match for adjacency to form.

Configure the port as a dynamic desirable port.

Why wrong: Dynamic desirable is a DTP mode, not a trunk.

Configure the port as a routed port.

Why wrong: Routed ports are Layer 3 interfaces.

Configure the port as an access port.

Why wrong: Access ports carry only one VLAN.

WPA3-PSK with AES

Why wrong: WPA3 uses SAE, not PSK.

WPA2-PSK with TKIP

Why wrong: TKIP does not use AES.

WEP with AES

Why wrong: WEP does not support AES.

The router ID is the same on both routers.

Why wrong: Duplicate router IDs cause a different issue.

The area ID is different.

Why wrong: Area ID mismatch causes INIT or DOWN.

The hello timer is set to 30 seconds on one router.

Why wrong: Hello timer mismatch causes INIT.

Apply an extended ACL to the vty lines.

Why wrong: Extended ACLs are not necessary for source-only filtering.

Apply a named ACL to the interface.

Why wrong: ACL should be applied to vty lines, not interface.

Apply an ACL to the console line.

Why wrong: Console line does not require ACL for SSH.

Enable AAA authentication.

Why wrong: AAA is a broader framework.

Use the service password-encryption command.

Why wrong: Encrypts passwords but does not set enable password.

Configure login local on the console line.

Why wrong: This is for user authentication, not enable.

ICMP traffic from any source

Why wrong: ICMP is not permitted.

FTP traffic from 192.168.1.0/24

Why wrong: FTP is not permitted.

SSH traffic from 192.168.1.0/24

Why wrong: SSH is not permitted.

It runs a single spanning-tree instance for all VLANs.

Why wrong: Incorrect: That's MST; Rapid PVST+ runs per VLAN.

It eliminates the need for BPDUs.

Why wrong: Incorrect: BPDUs are still used for topology discovery.

It supports PortFast to enable immediate transition to forwarding.

Why wrong: Correct: PortFast allows edge ports to skip listening/learning.

One route has a higher administrative distance.

Why wrong: Incorrect: Both routes have AD 110.

A default route is overriding the specific route.

Why wrong: Incorrect: No default route is shown.

The route via 10.0.2.2 is an E1 route.

Why wrong: Incorrect: Both are E2 as shown.

Step 1: Configure trunk ports → Step 2: Configure VTP mode → Step 3: Configure VTP domain name → Step 4: Verify VTP status

Why wrong: This is incorrect because trunk ports should be configured after VTP mode and domain are set; otherwise, VTP advertisements may not be propagated correctly without a proper domain.

Step 1: Configure VTP domain name → Step 2: Configure VTP mode → Step 3: Configure trunk ports → Step 4: Verify VTP status

Why wrong: This is incorrect because while domain name can be set before mode, the recommended order is to set mode first; domain is necessary but mode defines the switch's behavior. Still, this order might work but deviates from best practice.

Step 1: Configure VTP mode → Step 2: Configure trunk ports → Step 3: Configure VTP domain name → Step 4: Verify VTP status

Why wrong: This is incorrect because the VTP domain name must be set before or simultaneously with trunking; without a domain, VTP advertisements are not accepted on trunk ports.