Cisco Certified Support Technician - Networking (100-150) — Questions 1–75

The default gateway represents the router interface that knows how to route traffic to external subnets. By directing non-local traffic to this address, devices ensure their data reaches its destination beyond the local segment, enabling global connectivity for all local endpoints.

The output explicitly states 'Gateway of last resort is not set'. A router requires a default route (0.0.0.0/0) to forward packets to destinations outside of its directly connected subnets. Without this, any traffic destined for the internet is dropped by the router because it has no path information.

A /30 subnet mask leaves 2 bits for host addresses, yielding 2^2 - 2 = 2 usable addresses. This is ideal for point-to-point links because it minimizes address waste, providing exactly one address for each end of the link while reserving the network and broadcast addresses.

A duplex mismatch typically causes late collisions when the full-duplex side transmits while the half-duplex side is already sending. This leads to CRC errors and performance degradation. The combination of late collisions and CRC errors is a classic indicator of duplex mismatch, making this the correct symptom.

The workstation successfully reaches its default gateway and local hosts, proving Layer 1-3 connectivity to the gateway is intact. The traceroute shows the gateway responds but no further hops, indicating the gateway cannot forward traffic beyond itself. A missing route on the gateway to the destination subnet would cause exactly this symptom, as the gateway would drop packets destined for an unknown network.

The /28 mask indicates a block size of 16. The subnet range for 172.16.5.0/28 starts at 172.16.5.0 and ends at 172.16.5.15. The address 172.16.5.15 serves as the broadcast address, which is the final address in the specific subnet block reserved for the interface.

The most common way to recover an interface from an 'err-disabled' state is to manually toggle the port. By entering 'shutdown' and then 'no shutdown' on the specific interface, the software state is reset, allowing the port to attempt to transition back to an 'up/up' status after the error.

Fiber optics use light to transmit data, providing total immunity to electromagnetic interference. This allows for significantly longer distances and higher data rates than copper-based alternatives, making it the ideal choice for backbone connections and outdoor high-performance network segments in noisy environments.

A /28 subnet mask uses 28 bits for the network portion, leaving exactly 4 bits for host identification. Calculating two to the power of four results in 16 total addresses, but after subtracting the mandatory network and broadcast addresses, 14 usable IPs remain for assignment to networking equipment.

Switching operations rely on the MAC address table to map destination hardware addresses to specific ports. When a frame enters, the switch examines the destination MAC and directs the frame only to the appropriate physical interface, reducing traffic congestion across the local network.

Class C addresses begin with a first octet in the range 192-223. Since 192 falls within this range, 192.168.1.1 is correctly identified as a Class C address. This classification was historically important for defining the default subnet mask as /24, which is still the most commonly used default setting today.

Port Security enables the restriction of input to an interface by limiting and identifying the MAC addresses of the stations allowed to access the port. This provides granular control over physical access, ensuring that only pre-approved hardware can establish a link and transmit data through the switch port.

A cable tester is designed to check the continuity, pinout, and wiring faults of twisted-pair cables. It can detect opens, shorts, crossed pairs, and split pairs, which would cause a link light but no data transmission. Using a cable tester on the patch cord will quickly identify any miswiring that prevents proper communication.

The LC connector is a small form-factor fiber optic connector that uses a 1.25mm ferrule. It is highly popular in high-density environments because its size allows for more ports on a switch faceplate or patch panel, and it features a locking tab similar to an RJ-45.

A Denial of Service attack is explicitly intended to render a network, application, or service unavailable by overwhelming it with an excessive amount of traffic or requests. This consumes critical infrastructure resources such as CPU, memory, or bandwidth, effectively blocking legitimate users from accessing the system.

RTP is specifically designed to carry real-time data, including voice and video. It includes sequence numbers and timestamps to help the receiver reassemble the stream in the correct order and handle jitter, which is essential for maintaining the continuous flow required for high-quality voice communication.

Single-mode fiber features a very small core that carries light in a single path, which effectively eliminates modal dispersion. This allows it to carry signals over much longer distances than any other media type, often reaching up to 40 kilometers or more, which easily accommodates the 1.5-kilometer requirement.

Shielded Twisted Pair includes a foil or braided shield around the wire pairs to protect against external electromagnetic interference. This shield acts as a Faraday cage, blocking EMI from the machinery and ensuring that the electrical signals inside the cable remain clean and readable by the endpoints.

Link-local addresses are automatically generated by every IPv6-enabled interface. They are used for communication between devices on the same local link and for neighbor discovery protocols. These addresses are not routable beyond the local segment, making them perfect for internal overhead tasks and initial configuration before a global address is assigned.

Platform as a Service provides the environment, including runtime and middleware, needed to deploy custom applications. The provider manages the hardware, networking, and operating systems, allowing the startup to focus solely on developing and managing their application code without worrying about patching servers or configuring low-level infrastructure.

The second step of the three-way handshake is a SYN-ACK segment sent by the server in response to the client's SYN. The server sets both SYN and ACK flags, acknowledges the client's sequence number, and sends its own sequence number. Here, source port 80 indicates the server, and destination port 49152 is the client's ephemeral port.

Phishing involves sending fraudulent communications that appear to come from a reputable source, such as a bank or an IT department. The goal is to steal sensitive data like login credentials or credit card numbers. It is a widespread threat because it exploits human trust rather than technical vulnerabilities.

Loopback interfaces remain up even if physical ports fail, making them ideal for router identification, management access (like SSH), and as an anchor for OSPF/BGP neighbor adjacencies. This stability ensures that management access remains available for troubleshooting even during significant physical network instability or link outages.

When the forward and reverse paths differ, the latency experienced by each stream is inconsistent. This discrepancy in delay can cause the receiving device's jitter buffer to overflow or underflow, resulting in choppy audio quality and perceived latency, as the media stream fails to arrive in a timely manner.

Creating a dedicated management VLAN and assigning the switch's management IP to it isolates SSH and SNMP traffic from user data. Only ports connected to management devices are members of that VLAN, so user traffic cannot reach the management IP at Layer 2. This is the recommended practice for secure switch management.

A /27 mask means 27 bits are set to one. The first three octets are 24 bits. The last octet has 3 bits set (11100000), resulting in 224. This matches the provided decimal mask, confirming that /27 is the correct CIDR prefix for this network segment configuration.

The primary purpose of DHCP is to assign a unique Layer 3 IP address to the client from a managed pool. Without this, the client cannot communicate using the IP protocol suite. This address is the most fundamental piece of information contained within the DHCP ACK message during the assignment process.

Firewalls function by analyzing incoming and outgoing traffic against a set of predefined security rules. They permit or deny traffic based on these policies, acting as a gatekeeper that ensures only authorized communication enters or exits the protected network perimeter.

Confidentiality is the correct principle because it involves protecting data from unauthorized disclosure. By using encryption and permissions, the business ensures that only individuals with the correct credentials and clearance can read the financial records, which is the core definition of maintaining data privacy.

When no table entry matches the destination, the switch has no known path, so it floods the frame to every other port in the same VLAN. This unknown-unicast flooding ensures delivery while the destination is still unknown. Once the destination replies, its source address is learned and subsequent frames are forwarded only to the correct port.

A duplex mismatch occurs when one side of a link is set to full-duplex and the other to half-duplex. This results in late collisions and CRC errors, which are recorded as input errors on the interface. This is a classic Layer 1/2 troubleshooting scenario that causes significant performance degradation and packet loss.

Category 6a is specifically designed to support 10 Gbps (10GBASE-T) for the full 100-meter distance standard for horizontal cabling. It features improved shielding and tighter twists that reduce alien crosstalk, making it the industry standard for high-speed server connectivity and modern enterprise backbone links over copper.

The subnet mask is a 32-bit number that, when applied to an IP address, filters out the host-specific part to reveal the network ID. This informs the device whether it can communicate directly with the destination or if it needs to use a gateway.

Reaching the final hop indicates the network path is valid. If the ping fails at the final hop, the server is either dropping ICMP packets via a firewall or the server process itself is non-responsive. This isolates the problem to the destination host's configuration rather than the network infrastructure.

RJ-45 is the eight-position modular connector used for twisted-pair Ethernet copper cabling such as Cat 5e, Cat 6, and Cat 6a. It is the correct interface for connecting a workstation NIC to a wall jack in a standard office LAN, and it supports the full pinout needed for 10/100/1000 Mbps and faster links.

Dynamic ARP Inspection intercepts ARP packets on untrusted ports and checks each sender IP-to-MAC pairing against the DHCP snooping binding table, or static ARP ACLs for fixed addresses. Forged replies, such as an attacker claiming the gateway's address, are dropped and logged, so hosts' ARP caches cannot be poisoned. Uplinks are marked trusted, and untrusted ports are rate-limited to stop ARP floods.

The Core layer is the high-speed backbone of the network. It is built for raw performance and reliability, ensuring that traffic between distribution layers is moved as quickly as possible. It avoids complex packet manipulation to maintain the highest possible throughput across the enterprise campus environment.

VLANs segment a physical switch into isolated logical broadcast domains. This restricts the scope of broadcast frames to only those ports assigned to the same VLAN, significantly reducing network overhead and preventing performance degradation caused by excessive background traffic on large networks.

Category 6a (Augmented) is specifically engineered to support 10 Gbps data rates over the full 100-meter distance. It features improved insulation and tighter twists that reduce alien crosstalk, making it the industry standard for high-speed copper connectivity in modern enterprise environments and data centers.

This command displays the status of the interface including CRC errors, runts, and collisions. High counts of these errors indicate a faulty cable, bad transceiver, or duplex mismatch, which are primary causes of intermittent connectivity. It is the fundamental starting point for diagnosing physical layer degradation in Cisco environments.

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table and drops ARP replies that do not match a valid IP-to-MAC binding. Since DHCP snooping is already enabled, DAI can immediately use the binding table to block the attacker's forged gateway ARP replies. This directly stops the ARP cache poisoning and protects hosts from having their traffic redirected.

DNS acts as the phonebook of the internet, translating domain names into IP addresses. It is an Application layer service that enables seamless user experience by abstracting the numeric complexity of the underlying network addressing infrastructure into manageable, mnemonic names.

Splitting the flat network into separate VLANs creates distinct broadcast domains, so broadcasts no longer flood every segment. Layer 3 interfaces then route traffic between those segments, preserving connectivity. This directly contains broadcast propagation while retaining inter-VLAN reachability.

PoE priority assigns each port a critical, high, or low ranking, so when the power budget is exhausted the switch sheds low-priority ports first and preserves power to critical devices. This directly prevents unexpected drops for VoIP phones and access points during budget exhaustion.

The TTL field in the IPv4 header is decremented by one at each router hop. When it reaches zero, the router discards the packet and sends an ICMP Time Exceeded message back to the source. This mechanism prevents packets from circulating indefinitely due to routing loops. The technician's suspicion directly points to this field as the cause of the packet being dropped.

A site-to-site VPN connects two entire networks to each other, such as a branch office to a main corporate headquarters. This type of VPN is typically established between two dedicated routers or firewalls, allowing users at both locations to access resources as if they were on the same network.

Multi-Factor Authentication is the correct term for using multiple independent categories of credentials: something you know (password) and something you have (mobile device). This layered approach provides much stronger security than relying on a password alone, which can be easily compromised through phishing or brute-force attacks.

The Network Layer uses IP addresses to route packets through routers to their final destination across multiple subnets. It is the primary layer for logical path selection and global addressing. In this scenario, the failure to reach a different subnet typically points to a configuration issue at this layer.

The ipconfig /release command releases the current DHCP lease, which in this case is the APIPA address. Releasing the lease clears the existing configuration and prepares the workstation to request a new lease from a DHCP server. This is a necessary step before attempting to renew or obtain a new address, especially when the current address is an APIPA address that indicates DHCP failure.

Link-local addresses are automatically created as soon as IPv6 is enabled on an interface. They use the FE80::/10 prefix and provide the necessary connectivity for nodes to discover each other on the local wire, even before any global or local routing has been established by an administrator.

Auto-MDIX is a Cisco feature that automatically senses whether a crossover or straight-through cable is needed and reconfigures the interface to make the connection work. This removes the need for specific crossover cables when connecting similar devices, such as two switches or a switch and a router.

802.3af is the original IEEE Power over Ethernet standard that supplies up to 15.4 W of DC power per port over standard Ethernet cabling. This is sufficient to power a typical IP phone while simultaneously carrying voice data on the same cable, which is exactly what the branch deployment requires.

The Network Layer is specifically designed for routing and logical addressing. It uses IP addresses to identify devices across different subnets and employs routing protocols to determine the optimal path for packets to reach their destination. This layer provides the connectivity and path selection logic that allows the internet to function as a collection of networks.

The default gateway is the IP address of the router interface that connects the local subnet to the rest of the network. If this address is missing or incorrectly configured, the workstation will not know where to send packets destined for remote networks, effectively trapping all communication within the local broadcast domain.

DNS is the service that resolves human-friendly hostnames like 'cisco.com' into the numerical IP addresses used by routers. If the user can ping the IP directly but cannot use the name, it indicates that the computer is unable to receive a valid response from the configured DNS server to perform the necessary translation.

IEEE 802.3at (PoE+) delivers up to 30 watts per port, exceeding the 25.5-watt draw of each camera. The earlier 802.3af standard supplies only 15.4 watts, which is insufficient, so the switch ports must support 802.3at to power these devices reliably.

A USB-to-RJ-45 Ethernet adapter adds a physical Ethernet port to a laptop that lacks one. It converts USB signaling to Ethernet frames and allows the laptop to connect to the copper wall jack with a standard patch cable. This is the correct endpoint media solution for the scenario.

Port security limits how many MAC addresses can be learned on a port. When the limit is exceeded, the switch can drop or restrict traffic, preventing an attacker from filling the MAC address table with forged entries. This directly counters the flooding behavior caused by MAC table overflow.

A trunk port carries traffic for multiple VLANs by tagging frames with IEEE 802.1Q VLAN identifiers. Since the server's NIC is VLAN-aware and will tag its own frames, a trunk port allows the switch to correctly forward traffic for both voice and data VLANs. This configuration is essential for interconnecting devices that need to participate in multiple VLANs.

Restrict mode drops packets with unknown source addresses and increments the security violation counter. It also generates a SNMP trap and a syslog message to alert administrators of the breach. This provides a balance between security and availability without disabling the port entirely, which is useful in active monitoring.

Ransomware is a specific category of malware that encrypts a victim's files and demands a payment, usually in cryptocurrency, to provide the decryption key. This attack directly targets the availability of data, forcing organizations to choose between paying the ransom or attempting to restore their systems from off-site backup files.

Softphones act as software clients on computers, tablets, or smartphones. They utilize the existing network interface of the host device and do not require specialized hardware, allowing for rapid deployment and easy integration with existing computer-based workflows or enterprise mobile device management solutions.

When port security detects a MAC address beyond the configured maximum, the violation mode determines the action. Setting it to restrict drops offending frames and generates log and SNMP messages, while shutdown places the port in err-disabled state. Either mode enforces the limit and stops MAC flooding or unauthorized devices from continuing to send traffic through that port.

The show interfaces gigabitethernet0/1 command displays detailed information about a specific interface, including duplex, speed, and error statistics. This is the most direct way to verify the duplex setting on the port connected to the workstation. It will show whether the interface is set to full-duplex or half-duplex, and also show any input errors that might indicate a mismatch. This command is essential for troubleshooting duplex issues.

The command 'switchport access vlan 10' assigns the port to VLAN 10 when the port is in access mode. This is the correct command to associate the access port with VLAN 10. It must be executed in interface configuration mode. The port will then carry traffic for VLAN 10, and the connected PC will be in that VLAN.

PAT, also called NAT overload, allows many internal hosts to share a single public IPv4 address by translating both IP addresses and source port numbers. Each session is uniquely identified by the translated port, so thousands of internal devices can communicate simultaneously using one public address. This directly matches the requirement of sharing a single ISP-assigned address.

A protocol analyzer, such as Wireshark, allows for the inspection of packet headers and traffic statistics. It is the ideal tool for detecting excessive broadcast or multicast traffic by analyzing the frame distribution, which helps pinpoint the source of congestion or loops within a local area network segment.

SSH provides encrypted communication for remote management, protecting administrative credentials and command traffic from eavesdropping. It is the mandatory secure alternative to Telnet for all remote sessions. Implementing SSH is the most basic requirement for maintaining the confidentiality and integrity of administrative sessions on Cisco devices.

A trunk port carries traffic for multiple VLANs simultaneously using VLAN tagging, such as 802.1Q. When configured on the switch port connected to a server, it allows the server to communicate across multiple VLANs without needing an external router, provided the server supports VLAN tagging.

A /27 mask creates 8 subnets by borrowing 3 host bits, satisfying the minimum of 5 subnets. Each subnet contains 32 total addresses, yielding 30 usable IP addresses which satisfies the requirement for at least 25 hosts.

The laptop's wireless adapter being configured with the wrong SSID is the most likely cause because the user cannot connect to the corporate Wi-Fi, while other devices can. If the SSID is incorrect, the laptop will not associate with the correct access point, even though it sees available networks. This is a common issue when a user manually configures a profile or connects to a neighboring network. Correcting the SSID would resolve the issue.

The 2.4 GHz band is the most widely supported frequency for Wi-Fi, offering excellent range and the ability to pass through solid objects like walls. However, it is prone to interference from non-Wi-Fi devices such as microwaves and Bluetooth, making it more congested in crowded office environments.

This command provides a real-time breakdown of CPU usage by process. It allows the administrator to pinpoint if the spike is caused by routing updates, SNMP polling, or packet-switching tasks. This is the most accurate diagnostic method for determining why the switch CPU is currently over-utilized.

telnet can be used to test TCP connectivity to a specific port. If the connection to port 445 succeeds, the SMB service is reachable; if it fails or times out, a firewall or service issue is likely. This directly tests the file-sharing protocol port and helps isolate whether the problem is port-specific filtering.

Security policies establish the guidelines and requirements for securing information systems. They ensure that all stakeholders understand their responsibilities regarding data protection, network access, and incident reporting. This document serves as the foundation for all technical controls implemented by the networking team to protect the organizational infrastructure and assets.