Cisco Certified Support Technician - Networking (100-150) — Questions 151–225

The /23 subnet mask (255.255.254.0) creates a block of 512 total addresses. For the 172.16.0.0 network, the range spans from 172.16.0.0 to 172.16.1.255. Subtracting the network and broadcast addresses leaves 172.16.1.254 as the final IP address that can be manually or dynamically assigned to a host.

The Network layer uses routing tables to identify the next hop for a packet based on the destination IP address. This capability to route traffic across disparate networks is the primary function of Layer 3 devices like routers and multilayer switches.

In a /29 network, the subnets increment by 8. The host 172.16.50.131 falls into the 172.16.50.128 subnet. The broadcast address is always the last address in the block, which is calculated as the next network ID (128 + 8 = 136) minus one, resulting in 172.16.50.135.

Attenuation is the gradual loss of signal intensity as it travels through a medium like copper or fiber. In copper cabling, the electrical resistance of the wire causes the signal to weaken over distance. At 100 meters, the signal reaches the limit of what can be reliably interpreted.

A Switched Virtual Interface requires at least one active physical port in the corresponding VLAN to bring the line protocol up. If all ports are down or blocked by Spanning Tree, the SVI protocol status remains down.

When a loop exists at Layer 2, broadcast frames (which are flooded to all ports) are caught in an infinite cycle. Because Ethernet frames lack a Time-to-Live (TTL) field, they never expire. This leads to a broadcast storm that saturates links and overwhelms switch processors, resulting in the symptoms described.

When a switching loop exists, broadcast frames circulate endlessly, causing the switch to learn the same MAC address on multiple ports as frames arrive from different directions. This is a classic symptom of a Layer 2 loop. Spanning Tree Protocol should prevent loops, but if it is disabled or misconfigured, loops can occur, leading to MAC address flapping.

Router-on-a-stick uses a single physical router interface divided into logical subinterfaces, each assigned to a VLAN. This allows the router to route traffic between VLANs without needing multiple physical interfaces. It is a common and efficient method for inter-VLAN routing in small to medium networks, exactly matching the administrator's goal.

Smishing is phishing conducted through SMS text messages. The attacker impersonates a trusted entity, such as a bank fraud department, and tries to trick the recipient into revealing credentials or clicking a malicious link. Because the lure arrived as a text message rather than email or a phone call, smishing is the precise classification for this scenario.

Physical obstacles like concrete and metal are highly effective at absorbing or reflecting radio frequency signals. This causes significant attenuation, where the signal strength drops sharply as it attempts to penetrate these materials. In outdoor settings, metal fences or reinforced building exteriors often create dead zones for wireless endpoints.

Restricting payroll access to the finance group protects confidentiality by ensuring only authorized personnel view sensitive data, and logging every access provides accountability by recording who did what. Together these map directly to the security objectives of confidentiality and accountability, which is what the policy is enforcing at the network level.

ICMP Echo Replies include timing information that the ping utility uses to calculate the delay between sending the request and receiving the response. This metric is essential for diagnosing network latency issues and determining if the performance degradation is occurring at the network transport layer or the application layer.

A default gateway is required to route packets destined for networks outside the local subnet. Without it, the workstation can only communicate with devices on the same subnet, which matches the symptom of successful local pings but failed remote access. Configuring the correct gateway address would resolve the problem.

The 'violation shutdown' command explicitly causes the interface to transition to the err-disabled state upon a MAC address limit breach. This is a secure default that forces the port to stop passing all traffic until the administrator intervenes, ensuring unauthorized devices cannot gain network access.

Setting an enable secret protects privileged EXEC mode with a hashed password, and creating local usernames with appropriate privilege levels ensures that only authenticated administrators can log in and make configuration changes. This directly hardens the management plane by requiring credentials for access. It is a fundamental step in securing a Cisco switch and is recommended in Cisco hardening guidance.

On a Windows workstation, ipconfig /all displays the complete TCP/IP configuration, including the default gateway address, subnet mask, DNS servers, and DHCP lease details. Since the user can reach local resources but not remote ones, verifying the default gateway setting is a critical first step, and ipconfig /all provides that information directly.

The show interfaces command displays detailed statistics for all interfaces, including duplex mode, speed, and error counters such as late collisions, FCS errors, and runts. These errors are indicative of a duplex mismatch. By examining the output for the specific interface, the administrator can confirm whether the duplex setting is correct and whether errors are accumulating, which would support the suspicion of a duplex mismatch.

Single-mode fiber uses a thin core to transmit a single light mode, allowing for extremely high bandwidth over distances spanning kilometers. It is completely immune to EMI and is the standard choice for high-speed, long-distance inter-building connections, ensuring reliable data transfer where copper would fail.

Single-mode fiber has a small core diameter that allows only one mode of light to propagate, reducing attenuation and dispersion. It supports very long distances, often up to 10 kilometers or more, and provides high bandwidth. For a 500-meter building-to-building link, single-mode fiber ensures reliable, high-speed connectivity.

A certificate warning means the browser could not verify that the site's certificate was issued by a trusted certificate authority for that exact hostname, so the authenticity of the server is in question. Since the user's clock is correct, the most likely cause is an untrusted, expired, or mismatched certificate, directly undermining trust in the site's identity.

Single-mode fiber uses a laser light source and a narrow core to transmit data over very long distances, often exceeding 10 kilometers. It is the ideal choice for this 500-meter span because it provides high bandwidth, low signal loss, and total immunity to any external electromagnetic interference between buildings.

The trust command must be applied to ports that lead to legitimate DHCP servers or to other trusted switches via uplink ports. This tells the switch that DHCP server responses, such as DHCPOFFER and DHCPACK, are allowed to enter the switch through these specific interfaces, ensuring clients receive valid addresses.

Each layer has a defined role: access connects users, distribution aggregates and applies policy, and core moves traffic quickly between blocks. New buildings or floors are added as new access and distribution blocks connected to the core, without redesigning the rest of the network, so growth is predictable and modular, and each block can be standardised and replicated.

Cat 5e UTP supports 1000BASE-T up to 100 meters. A 120-meter run exceeds this limit, which leads to attenuation, impedance mismatches, and signal reflections. These physical-layer issues manifest as FCS errors and late collisions because the NIC and switch cannot reliably interpret the weakened signals. Shortening the cable or adding a repeater is the appropriate fix for this scenario.

A /30 subnet mask (255.255.255.252) provides 4 total addresses, with 2 usable host addresses after reserving the network and broadcast addresses. This is the most efficient mask for point-to-point links, maximizing the number of subnets. It perfectly meets the requirement of exactly two usable IP addresses.

The output of show interfaces trunk indicates which VLANs are allowed and active on the trunk. If VLAN 10 is not listed, it means the trunk is not permitting VLAN 10. This can be due to the switchport trunk allowed vlan command excluding VLAN 10. The administrator must add VLAN 10 to the allowed list on both ends of the trunk for traffic to pass.

When a client configured for dynamic addressing fails to receive a response from a DHCP server, it assigns itself an APIPA address. This signifies a breakdown in communication between the client and the DHCP server, which could be caused by server downtime, a full address pool, or physical layer connectivity issues.

The LC connector is the industry-standard small form factor fiber connector. It features a push-pull tab mechanism that provides a secure lock and is roughly half the size of an SC connector. This allows for high-density configurations in data center switches and patch panels.

WPA2 with AES encrypts wireless traffic between clients and the access point using strong cryptography, preventing neighbors from reading the data. It is the standard security mode for modern Wi-Fi networks and directly satisfies the requirement for privacy on the wireless link.

Using a password plus a one-time code from an authenticator app implements multi-factor authentication. The stolen password alone is insufficient because the attacker also needs the time-based code generated on the user's device. This directly satisfies the requirement that password theft alone cannot grant access.

An incomplete ARP entry can also result from a physical layer issue, such as a disconnected cable or faulty NIC, preventing any frames from being sent or received. Verifying link lights and interface status confirms whether the workstation can communicate on the local segment. If the link is down, no ARP replies can be received, causing the incomplete entry.

Port security allows the administrator to define a specific MAC address or a maximum number of addresses for an interface. If an unauthorized device connects, the port can be placed into an error-disabled state, effectively blocking the device and notifying the network management system of a security policy violation.

Configuring multiple SSIDs and mapping each to a different VLAN creates separate Layer 2 domains for guest and employee traffic. The access point tags frames appropriately, and upstream switches or a controller enforce isolation. This directly satisfies the requirement to keep guest devices from reaching internal resources.

A /23 mask provides 9 host bits, yielding 510 usable hosts per subnet, which satisfies the 500-host minimum. It also creates 128 subnets from the /16 block, maximizing subnet count while meeting the host requirement. This is the most efficient choice because a /22 would provide more hosts than necessary and reduce the subnet total.

By utilizing a modular approach, hierarchical designs isolate broadcast domains and make it easier to add new segments or services. This structure ensures that updates or failures in one layer remain contained, allowing the network to grow efficiently without significant re-architecting.

Borrowing two bits from the host portion of a /24 network creates four subnets with 62 usable addresses each. The mask 255.255.255.192 correctly identifies the boundary for 64-address blocks, ensuring that the technician can adequately support four separate departments while maximizing the available host capacity for each.

Modern switches with auto-MDI/MDIX automatically detect the required pinout and internally cross the transmit and receive pairs as needed. Because of this feature, a standard straight-through cable will work for a switch-to-switch connection without any special wiring, making it the practical and correct choice in this scenario.

Because the destination MAC address is missing from the table, the switch floods the frame to all other ports in VLAN 1. In this specific exhibit, FastEthernet 0/2 is the only other active port shown. This process ensures the frame reaches its destination wherever it might be connected.

A Layer 2 switch examines the destination MAC address of an incoming frame to determine which physical port it should be sent out. This process is much faster and more efficient than using Layer 3 IP addresses, as it happens in specialized hardware known as Application-Specific Integrated Circuits (ASICs) within the switch.

Physically isolating management paths ensures complete separation of control planes and data planes. Administrators maintain uninterrupted access during network events like spanning tree reconvergence, routing table corruptions, or major security incidents affecting the production environment.

Simultaneous Authentication of Equals replaces the Pre-Shared Key (PSK) method used in WPA2. It provides a more secure handshake that is resistant to offline dictionary attacks. This enhancement ensures that even if users choose weak passwords, the initial exchange between the client and the access point remains much safer.

Flooding the frame out of all active ports in the same VLAN, excluding the ingress port, is the standard behavior for unknown unicast traffic. This allows the destination device to receive the frame and respond, which then allows the switch to learn the destination's MAC address for future frames.

The nslookup command queries the configured DNS server to resolve a hostname to an IP address. Since ping to the IP succeeds but hostname access fails, the issue is likely name resolution. Running nslookup will show whether the DNS server returns the correct IP for intranet.corp.local or if it fails, confirming a DNS problem. This directly tests the suspected issue.

A /30 mask, 255.255.255.252, leaves 2 host bits. That yields 4 total addresses, of which 2 are usable after reserving the network and broadcast addresses. This is the standard choice for point-to-point WAN links because it provides exactly the two addresses needed while conserving address space.

This describes the cumulative process of adding headers (and sometimes trailers) as data descends the OSI model. Each layer's header contains the necessary information for that layer to perform its function at the destination. For example, the Network layer adds an IP header to create a packet from a segment.

A /27 mask provides 30 usable host addresses. This is the smallest possible subnet size that accommodates 25 hosts, adhering to the requirement for maximum efficiency. It leaves only 5 addresses wasted per subnet, which is the optimal mathematical balance for this specific host count requirement.

nslookup sends a query directly to the configured DNS server and reports the resolved address or an error. Since the user can ping the IP but not the hostname, name resolution is the suspected fault. nslookup confirms whether the DNS server responds and whether it returns the correct record, making it the right diagnostic tool for this scenario.

The IP address 169.254.10.20 falls within the link-local address range (169.254.0.0/16), which is automatically assigned by Windows when a DHCP server cannot be reached. This indicates that the workstation did not receive a valid IP configuration from DHCP. Without a valid IP address and default gateway, the workstation cannot communicate beyond its local link, and even local communication may be limited.

G.729 offers excellent compression, consuming significantly less bandwidth per call than uncompressed standards. This makes it the preferred choice for branch offices or remote locations where WAN links have limited capacity and need to support multiple simultaneous voice conversations without experiencing congestion.

The default gateway is the IP address of a router interface on the local subnet. When a device needs to communicate with a remote network, it sends packets to the default gateway, which then routes them. Without a default gateway, a device can only communicate within its local subnet, so this parameter is essential for internet access.

A TCP segment with only the SYN flag set is used to initiate a connection. It is the first step in the three-way handshake, where the client sends a SYN to the server to request a connection. The server responds with a SYN-ACK, and the client completes the handshake with an ACK. This segment does not carry data and is solely for synchronization of sequence numbers.

A 'line protocol is down' status often results from a duplex mismatch where one side is hard-coded to full-duplex and the other is set to half-duplex. This prevents the successful exchange of frames at the Data Link layer, even though the physical layer detects a valid signal.

VLANs allow an administrator to group ports logically, effectively creating separate broadcast domains within a single physical switch. This reduces the impact of broadcast traffic, as broadcasts sent in one VLAN do not propagate to ports associated with other VLANs, thereby enhancing network performance and security.

A PoE-capable switch acts as the Power Sourcing Equipment (PSE) by detecting if a connected device requires power and then delivering it safely over the UTP cable. This eliminates the need for separate power adapters at each desk, simplifying deployment and management of network endpoints.

When an IPv6 address is configured on a Cisco router interface, the interface automatically generates a link-local address (starting with fe80::) using the EUI-64 format by default, unless a link-local address is manually configured. This link-local address is used for neighbor discovery and routing protocols.

TCP tracks sequence numbers and acknowledgments, so when a segment is not acknowledged within a timeout, TCP retransmits it. This provides reliable delivery. UDP has no acknowledgment or retransmission mechanism; lost datagrams are simply lost. Retransmission is therefore a TCP characteristic that UDP lacks.

Each hextet can drop leading zeros, so 0db8 becomes db8 and 0001 becomes 1. This reduces visual clutter without changing the address value. Trailing zeros within a group, however, cannot be dropped, because doing so would alter the numeric value of that hextet and produce a different address.

Without the locking clip, the RJ-45 connector cannot stay firmly seated in the port. Even slight vibrations or tension on the cable can cause the pins to lose contact with the port, resulting in the link going up and down unexpectedly, which disrupts network traffic to the endpoint.

The 'ipconfig' command displays the current TCP/IP network configuration on a Windows machine. It is the quickest way to verify if the PC has obtained an IP address, the correct subnet mask, and a valid default gateway, which is the foundational step for troubleshooting any network connectivity issue.

Checking the ARP table is critical for determining if the host can map the gateway IP to a physical MAC address. If the entry is incomplete or missing, it indicates a failure in layer 2 frames reaching the gateway, suggesting a VLAN mismatch or blocked port on the switch.

A /30 mask provides exactly two usable host addresses, which is the perfect amount for a point-to-point router connection. It eliminates address wastage and is the industry-standard prefix for serial or Ethernet links connecting two devices directly, making it the most efficient choice for this specific networking scenario.

RADIUS is a widely used AAA protocol that provides centralized authentication, authorization, and accounting for network access. It allows network devices to delegate authentication to a central server, ensuring that users are properly verified before being granted network resources, which is a standard requirement for secure enterprise access.

The Session layer (Layer 5) establishes, manages, and terminates sessions between applications on different hosts. It handles dialogue control, synchronization, and checkpointing to keep application conversations organized. This matches the requirement exactly, as the administrator needs to document the layer responsible for session management, not data transport or routing.

For two devices to communicate directly at Layer 3, their interfaces must be in the same subnet. If Router A is 192.168.1.1/24 and Router B is 192.168.2.1/24, they will not be able to ping each other because they do not consider the other's IP to be on the local link.

The default violation mode is restrict, so when a second MAC address appears on a port limited to one secure MAC, the switch discards frames from the unauthorized address, increments the security violation counter, and can generate a syslog or SNMP notification. The port remains up, which matches the scenario's stated default behavior.

A /27 mask provides 30 usable host addresses, which satisfies the 25-host requirement while maximizing subnet density. This prefix length is the most efficient choice because any larger mask would reduce host availability below the threshold, and any smaller mask would unnecessarily waste IP address space.

The IPv6 specification allows for the omission of leading zeros within each hexadecimal quartette. For example, 0db8 becomes db8. This convention significantly reduces the length of written addresses, making them easier for network administrators to manage, read, and type into device configuration files without introducing errors.

A firewall acts as a gatekeeper for the network, controlling the flow of traffic based on a defined set of security rules. It can block unauthorized access while allowing legitimate communication to pass through. It is the first line of defense in most network architectures, separating trusted internal networks from untrusted ones.

Dynamic ARP Inspection validates ARP packets on untrusted ports against the DHCP snooping binding table, dropping replies that map an IP address to the wrong MAC. Because DHCP snooping is already operational, DAI can immediately use those bindings to stop the forged ARP replies that redirect the user's traffic to the attacker's workstation.

A rollover cable, often light blue in color, is the standard cable used to connect a terminal or PC to a Cisco console port. Its pins are reversed at one end, which aligns with the serial pinout of the console port, allowing the technician to access the command-line interface.

Neighbor Discovery Protocol uses ICMPv6 and multicast to perform address resolution and find routers on the local link. By using multicast instead of broadcast, only the nodes interested in the specific discovery message process it, which significantly reduces unnecessary traffic and improves performance across the entire local network.

SSH provides secure, encrypted communication between a client and a server. It creates a secure tunnel over an insecure network, ensuring that all transmitted data, including authentication credentials, is encrypted, thus maintaining the confidentiality of the session against eavesdropping attempts.

The longest prefix match is the primary rule for routing decisions. When multiple routes match a destination IP, the router chooses the path with the most specific subnet mask, ensuring that traffic is directed to the most precise destination possible within the network hierarchy.

In a /24 network, the broadcast address is calculated by setting all host bits (the last 8 bits) to one. 11111111 in binary is 255. Therefore, 172.16.20.255 is the broadcast address, which is the correct identifier for sending traffic to all hosts residing on this specific local subnet.

show spanning-tree displays the STP status for each VLAN, including root bridge, port roles, and port states. If a loop exists, STP will place redundant ports in blocking state. This command reveals which ports are blocking and can confirm whether STP is actively preventing a loop, helping diagnose high CPU caused by topology changes.