Cisco Certified Support Technician - Networking (100-150) — Questions 226–297

The first line allows TCP port 80 (HTTP) from any source to any destination. The second line explicitly denies all other IP traffic. This effectively creates a strict filter that only allows web browsing, blocking all other protocols like FTP, SSH, or DNS, which are not explicitly permitted.

FF:FF:FF:FF:FF:FF is the reserved Ethernet broadcast address. When a frame carries this destination, every device on the same broadcast domain (VLAN) accepts and processes it. This is used by protocols such as ARP requests and DHCP Discover, which need to reach all hosts because the sender does not yet know a specific unicast MAC address.

Enabling IPv6 on an interface, with 'ipv6 enable' or by configuring any IPv6 address, automatically creates a link-local address in FE80::/10, on Cisco routers usually from the MAC address using modified EUI-64. Link-local addresses are used for neighbour discovery, router advertisements and routing protocol neighbours, and are never routed. Many engineers set them manually, such as FE80::1, to make gateways easier to read.

The router functions as the default gateway that examines the destination IP address of packets. It performs route lookups in its routing table to determine the next hop for the destination subnet, enabling communication across separate logical networks and bridging the broadcast domain separation.

Endpoint protection detects and blocks known malicious files and behaviors on the host itself, which is the last line of defense if a dangerous attachment or download slips past other controls. Regular signature and engine updates are essential because new malware variants appear constantly, so this directly addresses the stated risk with modest administrative effort.

If the switched virtual interface for VLAN 40 is down or misaddressed, hosts in other VLANs cannot route to it even though VLAN 20 and VLAN 30 work fine. Checking the SVI status and addressing is the most direct first step because it targets the specific failing destination. A down SVI commonly results from no active access ports or a missing VLAN definition.

SSH provides encrypted, secure remote access to the CLI. It is the industry standard for managing network infrastructure because it prevents eavesdropping on administrative sessions, ensuring that credentials and configuration commands remain private as they traverse the network between the technician and the device.

Minimizing active services and ports reduces the overall attack surface of a device. Each enabled service, such as HTTP or Finger, represents a potential vulnerability. By shutting down everything that is not explicitly required for operation, you eliminate unnecessary entry points that attackers could otherwise leverage.

PortFast is a Cisco feature that allows an access port to bypass the listening and learning STP states, immediately entering the forwarding state. It is designed for ports connected to end devices like servers or workstations, reducing the time they wait for network connectivity. However, it should not be used on ports connecting to switches to avoid loops.

show interfaces gigabitEthernet 0/1 displays detailed statistics for the specified interface, including duplex mode, speed, and error counters such as late collisions, FCS errors, and runts. These errors are characteristic of a duplex mismatch. This command provides the necessary information to confirm or rule out duplex issues on that port.

The presence of late collisions is the classic indicator of a duplex mismatch. This happens when the switch port sends data assuming full-duplex, but the endpoint is operating in half-duplex mode. The endpoint detects a collision after the initial transmission window has passed, leading to the specific error counters shown.

This command displays the switch's CAM (Content Addressable Memory) table, listing every learned MAC address and its corresponding physical interface. It is the primary way to verify which endpoint is physically reachable on a specific port and to troubleshoot connectivity at the Data Link layer.

By terminating one end as T568A and the other as T568B, the technician has manually swapped the transmit (pins 1 and 2) and receive (pins 3 and 6) pairs. This results in a crossover cable, which was traditionally used to connect two switches or two PCs together directly.

Disabling Dynamic Trunking Protocol and forcing ports into access mode prevents the switch from negotiating a trunk link with connected devices. Without a trunk link, the switch will not process double-tagged frames as intended by the attacker, effectively neutralizing the double-tagging attack vector at the switch port level.

1000BASE-SX is designed for short-wavelength (850 nm) transmission over multimode fiber, and the IEEE standard specifies a maximum distance of 550 meters on 50-micron multimode fiber (and 275 meters on 62.5-micron fiber). Since the buildings are 550 meters apart, the link is at the edge of the supported range and should work if the installed fiber is 50-micron multimode with adequate modal bandwidth.

StackWise or Virtual Switching System merges physical switches into one logical control plane, so the distribution layer presents a single loop-free topology. This eliminates Layer 2 loops without blocking links and enables sub-second failover through rapid state synchronisation between chassis.

Auto-MDIX (Automatic Medium-Dependent Interface Crossover) is a feature that allows a switch interface to automatically detect the required cable type. It electronically swaps the transmit and receive pairs if necessary, allowing a straight-through cable to work even when a crossover cable would traditionally be required.

The SFP-10G-SR module is designed specifically for multi-mode fiber (MMF). It uses a lower-cost laser to transmit data over the relatively wide core of multi-mode glass, making it the standard choice for high-speed 10 Gbps links within a data center or between adjacent equipment rooms.

In the 192.168.50.0/24 network, the first usable host address is 192.168.50.1, since .0 is the network address and .255 is the broadcast address. This address falls within the valid host range of .1 through .254 and can be assigned to a device interface without conflict.

The reason 'psecure-violation' indicates that port security detected a MAC address not allowed on the port. The correct first step is to identify and remove the offending device or MAC address, or update the port security configuration if the device is authorized. Re-enabling the port without fixing the violation would just trigger the violation again. Addressing the root cause is the proper resolution.

Category 5e is specifically enhanced to handle Gigabit Ethernet speeds up to 1000 Mbps over distances of 100 meters. It features tighter twists and better shielding against near-end crosstalk compared to standard Cat5. This makes it the most cost-effective minimum requirement for a standard office environment needing reliable Gigabit connectivity over 85 meters.

Encryption provided by HTTPS (port 443) ensures that data remains private and cannot be read by eavesdroppers. This configuration enforces the concept of confidentiality by blocking unencrypted HTTP traffic, which transmits data in cleartext. Protecting sensitive user data or credentials requires this move to secure transport protocols.

ACLs provide a way to define explicit rules that permit or deny traffic based on IP addresses or protocols. By applying these lists to interfaces, you effectively restrict access to network resources, ensuring that only authorized traffic flows between specified endpoints, thus hardening the network against intruders.

By default, all ports are untrusted and block DHCP server-originated messages. The 'ip dhcp snooping trust' command explicitly configures the interface as a source of legitimate DHCP traffic, permitting server-side messages to reach clients, which is necessary for proper DHCP functionality in a snooping-enabled environment.

Removing leading zeros is a standard compression method that simplifies the appearance of an address without changing its value. For example, the quartet '0db8' can be written as 'db8'. This reduces the character count and makes the address easier for network technicians to read and document.

Auto-MDIX automatically detects whether a straight-through or crossover cable is connected and adjusts the transmit and receive pins accordingly. This allows a switch-to-switch link to work with either cable type without manual intervention. Enabling Auto-MDIX meets the requirement of avoiding manual crossover configuration.

nslookup is a command-line tool that queries DNS servers to resolve hostnames to IP addresses. Running nslookup allows the technician to test whether the configured DNS server is reachable and responding to queries. If nslookup fails or times out, it indicates a DNS server issue, which aligns with the symptom of being unable to access websites by name while IP connectivity works.

The 10.0.0.0/8 block is the largest private address range, spanning from 10.0.0.0 to 10.255.255.255. It is commonly used in enterprise environments to facilitate internal communication across large-scale distributed networks without the need for public IP address registration for every internal host on the network.

Control Plane Policing allows administrators to filter traffic destined for the device CPU. By applying policy maps to the control plane, traffic can be rate-limited or dropped, preventing DoS attacks from exhausting the CPU resources and maintaining device stability during high traffic loads or malicious packet floods.

A management VLAN is specifically created to isolate management traffic, such as SSH, SNMP, and syslog, from user data. By assigning an SVI on this VLAN, the engineer enables secure management access to the switch while keeping that traffic separate. This exactly matches the scenario's requirement to isolate management traffic from user data traffic.

The show interfaces switchport command displays detailed switchport information for all interfaces, including the administrative and operational mode (access or trunk), the access VLAN, and the trunking VLANs allowed. This is essential for verifying whether both ends of the link are configured with matching VLAN assignments, which is critical when troubleshooting a suspected VLAN mismatch between switches.

Enabling SSH provides encrypted remote management, while disabling Telnet prevents unencrypted, insecure access. This is a critical step to ensure that only authorized personnel can access the switch securely. It directly addresses the requirement for secure remote management and should be paired with a management IP address.

Authorization is the process of granting or denying specific rights and permissions to a user. In a networking context, this determines which commands a user can run or which services they can access. It ensures that users operate within their assigned roles and cannot perform unauthorized configuration changes.

Port security caps the number of source MAC addresses a port can learn, which directly mitigates MAC flooding attacks that attempt to overflow the CAM table. It also helps prevent unauthorized devices from attaching to an access port. This is a standard Layer 2 hardening step and fits the goal of reducing MAC flooding and rogue device risk on edge switch ports.

The ping utility uses ICMP to verify that a specific destination IP address is reachable and to measure the round-trip time. It is the most common first step in troubleshooting connectivity because it quickly confirms if the target device is online and responding to basic network layer requests.

IEEE 802.3af, 802.3at, and 802.3bt define a detection phase in which the PSE applies a low voltage and measures the signature resistance of the connected device. Only when a valid resistance (typically around 25 kΩ) is detected does the PSE proceed to classification and full power delivery. This prevents damage to non-PoE devices and is a fundamental part of the negotiation process described in the scenario.

RFI occurs when non-network devices emit signals on the same frequency as the wireless network. This noise lowers the Signal-to-Noise Ratio (SNR), forcing the wireless devices to use lower data rates and retransmit corrupted frames. This is a common environmental diagnostic issue in 2.4GHz Wi-Fi deployments near household appliances.

This command initiates the TDR test on the specified interface. It is the standard method for a switch to perform a physical layer check on the cabling. It reports the results of the test, including any potential faults such as opens, shorts, or cable length issues for the copper medium.

Dual-stack is the most common transition mechanism, allowing interfaces to support both protocol versions at the same time. This ensures compatibility with legacy IPv4-only hosts while enabling native IPv6 traffic for modern devices, providing a seamless operational transition within the enterprise network architecture without requiring an immediate, complete overhaul.

Link-local addresses starting with FE80 are automatically generated or manually assigned to facilitate communication within a single local segment. Because no global unicast address is present, the router cannot forward packets from this interface to remote networks or receive traffic originating from outside the local broadcast domain.

DHCP Snooping validates DHCP messages and limits the rate at which hosts can request IP addresses on untrusted ports. By tracking legitimate bindings in a database and rate-limiting incoming discovery messages, it effectively thwarts starvation attacks that aim to exhaust the scope of available IP addresses.

Shielded Twisted Pair (STP) cabling includes a metallic foil or braid that surrounds the internal conductors to block external electromagnetic interference. By grounding the shield properly, the electrical noise from the power lines is diverted, protecting the data signals and preventing the intermittent drops experienced with UTP.

If the user can access websites by IP address but not by name, it indicates that IP connectivity is working but name resolution is failing. The most common cause is an incorrect or unreachable DNS server address configured on the computer. Checking the DNS settings and verifying connectivity to the DNS server would resolve the issue.

OM3 laser-optimised multimode fibre supports 10GBASE-SR to 300 metres, exactly meeting the horizontal run constraint. Its 850 nm VCSEL-optimised core handles 10 Gigabit Ethernet where copper twinax caps at shorter distances, and LC duplex termination suits standard SFP+ transceiver ports.

Port security limits how many MAC addresses can be learned on a port, which directly counters MAC flooding attacks that attempt to overflow the CAM table and force the switch to flood frames. By capping the number of allowed addresses and taking action on violations, the switch preserves its normal forwarding behavior and prevents the attacker from turning it into a hub.

The primary role of the subnet mask is to identify which bits of an IPv4 address belong to the network prefix and which bits belong to the individual host. This binary comparison allows the device to route traffic to the correct local or remote network segment accurately.

The original SFP standard was designed primarily for Gigabit Ethernet and 1G Fiber Channel. While very reliable, it is limited to a maximum throughput of 1 Gbps. It is commonly used for connecting access layer switches to the distribution layer in smaller networks where 10G is not yet required.

The 'notconnect' status on a switch port means that the physical layer link is not established. Even if the device is powered on and the cable is good, the NIC might be disabled, faulty, or configured to not auto-negotiate properly. This would prevent the switch from detecting a link, resulting in 'notconnect'. Checking the NIC status, drivers, or trying a different device would confirm.

The default gateway serves as the interface on the local network that forwards traffic to other networks. By directing non-local traffic to this gateway, the host ensures that packets can successfully reach their destination even when they reside on a different broadcast domain or remote network.

A /30 mask uses 30 network bits, leaving 2 host bits, which yields exactly 4 addresses: two usable hosts plus network and broadcast. This is the traditional smallest subnet for point-to-point links and conserves address space efficiently. Cisco serial interfaces commonly use this mask for WAN connections between routers.

Domain Name System is responsible for mapping hostnames to IP addresses. The ability to connect via IP address proves that the physical and network layers are operational, but the failure to resolve the hostname indicates that the client cannot obtain the destination IP address from the DNS server, suggesting a configuration error.

SSH is the industry-standard protocol for secure remote access. It uses public-key cryptography to authenticate the remote computer and encrypt the data being transferred. This prevents eavesdropping and ensures that administrative commands and credentials remain private while traversing potentially untrusted or public network segments.

When duplex modes disagree, frames collide with traffic already on the wire, corrupting them in transit. The receiving device calculates the frame check sequence and finds a mismatch, incrementing input errors such as CRC and FCS failures. A steadily rising CRC or FCS error count on the switch port alongside slow throughput strongly supports a duplex mismatch diagnosis.

When connecting two switches, the transmit pair on one must connect to the receive pair on the other. Without Auto-MDIX, a straight-through cable connects transmit-to-transmit and receive-to-receive, preventing link. A crossover cable swaps the pairs, enabling communication. Auto-MDIX would automatically detect and correct the pinout, but if the new switch lacks it, a crossover cable is required.

Each VLAN is its own broadcast domain, and hosts in different VLANs cannot communicate at Layer 2 because there is no shared broadcast segment. Forwarding between VLANs requires a Layer 3 device such as a router or multilayer switch performing inter-VLAN routing. Because the branch has only a Layer 2 access switch, no device exists to route traffic between VLAN 10 and VLAN 20, so the finance hosts cannot reach the sales server.

UDP does not establish a formal session before sending data, which reduces latency and overhead. This connectionless nature means that the sender simply transmits packets to the destination without verifying if the receiver is ready. This is ideal for time-sensitive applications like VOIP or online gaming where speed is a primary concern.

DHCP Snooping allows administrators to configure specific ports as 'trusted' for DHCP server traffic. All other ports are considered untrusted by default, and any DHCP server messages (such as DHCPOFFER or DHCPACK) originating from these untrusted ports are dropped, preventing rogue servers from interfering with network clients.

When an interface is 'up' but the protocol is 'down', it indicates that the physical connection is good, but the switch cannot communicate at the Data Link layer. This can be caused by mismatched VLANs on a trunk, speed/duplex negotiation failures, or incompatible encapsulation settings between the two connected devices.

An IP access control list filters packets by source and destination address and can be applied to the management VLAN's switched virtual interface. Permitting only the management station subnets and denying all other sources enforces the requirement, and Cisco access lists can log matches, satisfying the auditing need without affecting other VLANs.

An access point can associate a client on an SSID even when the VLAN mapped to that SSID is not carried on the uplink trunk. Association happens at Layer 2 over the radio, but DHCP requires the client's broadcast to traverse the trunk into the correct VLAN. If that VLAN is missing from the trunk, DHCP requests never reach the server, and the client falls back to an APIPA address.

Category 6 twisted-pair cabling supports high-speed Ethernet standards and full-duplex operation, which allows simultaneous transmit and receive paths. By isolating these paths, collisions are eliminated, and the port operates as a point-to-point link, maximizing bandwidth utilization and throughput for the workstation.

A duplex mismatch occurs when one side of a link is set to half-duplex and the other to full-duplex. This causes collisions and frame fragmentation, which result in high CRC and alignment errors. The switch reports these as malformed frames that fail the cyclic redundancy check.

Port security allows the administrator to restrict which MAC addresses can send traffic on a port. By configuring static MAC addresses and setting the violation mode to shutdown, the port will be disabled if a frame with a different source MAC address is received. This meets the requirement of allowing only known devices and shutting down on violation.

VTP allows switches to share and synchronize VLAN information within a VTP domain. This reduces the administrative burden by ensuring that all switches are aware of the same VLAN numbering and naming schemes, which is crucial for consistent network operations across a multi-switch campus environment.

In a /24 subnetting scheme derived from a /16, each increment of 1 in the third octet represents a new network. 10.50.1.0 is the network ID for the second available /24 subnet within the 10.50.0.0/16 block, providing 254 usable host addresses for that specific segment.

The Time to Live (TTL) field is an 8-bit value that acts as a hop counter. Every router that forwards the packet decreases the TTL by one. When the TTL reaches zero, the router discards the packet and usually sends an ICMP 'Time Exceeded' message back to the source, effectively breaking any potential infinite loops.

IEEE 802.1D Spanning Tree Protocol is designed specifically to prevent Layer 2 loops by electing a root bridge, selecting root and designated ports, and placing redundant ports in a blocking state. If the active path fails, STP reconverges and unblocks the alternative port, satisfying the automatic failover requirement.

This command provides an immediate view of the settings currently being used by the device's operating system. It reflects all changes made in the current session, making it the primary command used for confirming configurations before committing them to non-volatile memory for long-term storage.

When a device needs to send a packet to another host on the same local network, it knows the destination IP but needs the destination MAC to build the Ethernet frame. ARP broadcasts a request asking who owns that IP, and the target host replies with its MAC address, allowing communication to proceed.

A router acts as a gateway between subnets, analyzing the destination IP address of incoming packets against its routing table. It strips Layer 2 headers and rebuilds them to forward traffic toward the destination network, providing the essential connectivity required for multi-segment infrastructure.

In the absence of a route, the router cannot determine the next hop. To prevent the packet from circling or consuming resources, it drops the packet and notifies the source host via an ICMP unreachable message, which is standard behavior for IP routers.

A /30 mask leaves only two host bits, so each subnet has four addresses: network, two usable hosts, and broadcast. For 10.10.10.1/30, the network is 10.10.10.0, usable hosts are .1 and .2, and the broadcast is .3. This is the standard addressing for point-to-point links.