Refer to the Exhibit Practice Questions

A faulty SFP module in the switch

Why it fails: The output indicates the media type is 10/100/1000BaseTX, which is a standard copper RJ-45 port rather than a fiber optic SFP interface. While a faulty transceiver can cause CRC errors, it would not typically result in late collisions, which are a specific symptom of timing and duplex issues on copper links.

Excessive cable length beyond 100 meters

Why it fails: While cables exceeding 100 meters can cause late collisions due to propagation delay, the combination of late collisions and CRC errors on a modern gigabit port strongly points toward a duplex mismatch. Standards-compliant installations rarely exceed the distance limit so significantly that they produce thousands of errors in a short period.

Electromagnetic interference from nearby power lines

Why it fails: Electromagnetic interference usually manifests as general input errors or CRC errors without the presence of late collisions. Late collisions are a specific logical timing error in the Ethernet CSMA/CD process, whereas EMI is a physical layer noise issue that corrupts the bits without necessarily triggering the collision detection logic.

Single-mode fiber optic cable

Why it fails: Single-mode fiber requires an 'LR' (Long Range) or 'ER' (Extended Range) SFP module. Using single-mode fiber with an 'SR' module will cause significant signal loss or complete link failure because the light source and core diameter are not matched for the characteristics of single-mode glass.

Category 6a copper cable

Why it fails: The 'Te1/1/1' interface is an SFP+ slot populated with an optical transceiver, not a fixed RJ-45 copper port. While 10GBASE-T SFP modules exist for copper, the 'SR' designation specifically identifies an optical module that uses light pulses rather than electrical signals over twisted-pair copper cabling.

Twinaxial (DAC) copper cable

Why it fails: Direct Attach Copper (DAC) cables are integrated units where the SFP+ connectors are permanently attached to a twinaxial copper cable. While they fit in the same slot, the exhibit shows a specific 'SR' transceiver module is already installed, which requires a separate multi-mode fiber patch cord.

The router can communicate with any host on the internet.

Why it fails: Internet communication requires a globally routable address, known as a Global Unicast Address. Since the exhibit explicitly states that no global unicast address is configured, the router is restricted to the local segment and cannot send or receive traffic from the public internet or other remote networks.

The interface is disabled because it lacks a global address.

Why it fails: The exhibit clearly shows that the interface is 'up' and 'line protocol is up', which means it is fully operational at Layers 1 and 2. IPv6 is also enabled, so the interface can function perfectly well for local management and protocol exchanges despite lacking a globally routable IP address.

The router will use the FF02::1 address to route external traffic.

Why it fails: The FF02::1 address is an all-nodes multicast address used for local communication within the segment. It is not a routable address and cannot be used as a source or destination for traffic intended for external networks. Multicast addresses serve to reach groups of hosts rather than providing routing paths.

A VLAN mismatch between the switch and the connected device.

Why it fails: A VLAN mismatch would prevent traffic from being associated with the correct network segment but would not typically manifest as CRC or frame errors. Such a configuration error would result in connectivity loss for specific traffic types rather than physical layer data corruption symptoms.

The switch port has been disabled by Port Security.

Why it fails: When a port is disabled by Port Security, the line protocol status shows as down (err-disabled). The output shows the interface is currently up and connected, which contradicts a security shutdown scenario. Furthermore, security violations do not produce CRC errors on active data frames.

An incorrect IP address assigned to the interface.

Why it fails: IP addressing operates at Layer 3 and has no impact on Layer 2 physical transmission integrity. An incorrect IP address would prevent the device from communicating at the network level, but it would not cause the switch to detect frame check sequence errors at the physical interface.

Data Integrity

Why it fails: While HTTPS provides integrity through hashing, the primary goal of this specific rule is to ensure encrypted communication. Integrity ensures that the data has not been tampered with, but the act of switching from port 80 to 443 is more broadly about moving from plaintext to ciphertext.

Availability

Why it fails: This security concept focuses on ensuring that systems and data are accessible to authorized users when needed. Blocking a port (port 80) actually reduces accessibility for users who might only use HTTP, so the policy is not designed to improve availability, but rather to harden the security posture.

Physical Security

Why it fails: This refers to the protection of hardware, personnel, and facilities from physical threats like theft or damage. The exhibit shows a logical security policy implemented in software. Physical security involves locks, cameras, and biometric scanners, which are entirely separate from the management of TCP port traffic on a firewall.

The physical cable is disconnected.

Why it fails: If the physical cable were disconnected, the interface status would show as 'down/down' or 'administratively down'. The 'up' status for the first part of the output indicates that the hardware detects a carrier signal from the connected endpoint, confirming that the physical electrical connection is intact.

The switch port has been administratively disabled.

Why it fails: If the administrator had manually disabled the port using the shutdown command, the output would clearly state 'administratively down, line protocol is down'. Since the interface is 'up', it means the port is enabled and attempting to communicate with the device on the other end.

The MAC address on the server is incorrect.

Why it fails: MAC addresses are burned into the hardware and do not cause a line protocol to go down simply by being 'incorrect'. The switch learns MAC addresses from incoming frames; while a security policy like Port Security might disable a port, it would typically result in an err-disabled state.

The interface has a duplex mismatch.

Why it fails: A duplex mismatch would manifest as an increase in collision counts or CRC errors on the interface. Since the error count is zero, the interface is successfully processing frames, but it is simply overwhelmed by the volume of traffic relative to its configured speed capacity.

The cable is faulty and causing retransmissions.

Why it fails: A faulty cable would increase the error rate and potentially cause the link state to flap or drop. Because the status is 'up/up' and there are zero errors, the physical integrity of the cable is confirmed to be healthy, ruling out physical layer problems as the cause.

The interface MTU is configured incorrectly.

Why it fails: Incorrect MTU settings typically lead to fragmented packets or dropped packets with 'MTU exceeded' errors. While this causes performance issues, it does not explain the discrepancy between input traffic and bandwidth capacity shown in the interface statistics, which is the primary indicator of the performance bottleneck here.

The switch has learned the MAC address but the port is blocked.

Why it fails: If the switch had learned the MAC address, it would be listed in the table regardless of whether Spanning Tree was blocking the port. The absence of the MAC address indicates that no frames have reached the switch's processing engine from that specific physical port since the table was last cleared.

Port Fa0/2 is configured as a trunk port and is filtering traffic.

Why it fails: Trunk ports still learn MAC addresses for all the VLANs they carry. If Fa0/2 were a trunk, you would likely see multiple MAC addresses from various VLANs associated with it. The total absence of the port in the table indicates a lack of any incoming traffic, not a specific VLAN filtering issue.

The host on Fa0/2 is using a static IP address.

Why it fails: The use of a static IP address does not prevent a switch from learning a MAC address. As long as the host sends any Ethernet frame (such as an ARP request or a gratuitous ARP), the switch will record the source MAC address. The MAC table tracks hardware addresses, which are independent of IP configuration.

It forces the port to drop all DHCP traffic.

Why it fails: The 'trust' command is the exact opposite of blocking traffic. It explicitly tells the switch that this interface is connected to an authorized DHCP server, allowing the server to communicate with clients through this port. Ports not marked as trusted would block these server responses.

It enables port security on the interface.

Why it fails: DHCP Snooping and Port Security are two distinct features. Marking an interface as a trusted DHCP port does not activate MAC-address-based port security. Port security requires independent configuration commands and serves a completely different purpose related to physical device identification and access restriction.

It prevents ARP spoofing on the port.

Why it fails: Trusting an interface for DHCP snooping has no direct effect on ARP packet validation. ARP spoofing protection is provided by Dynamic ARP Inspection (DAI), which requires its own specific configuration and uses the DHCP snooping database, but is not enabled simply by trusting the interface.

The port is configured for 'protect' mode.

Why it fails: In 'protect' mode, the port would drop traffic from unauthorized MAC addresses but would remain in an 'up' state. The exhibit explicitly shows the interface status as 'Secure-shutdown', confirming that the violation mode is set to 'shutdown' rather than the 'protect' or 'restrict' modes.

The aging time has expired for the port.

Why it fails: The output explicitly shows that 'Aging Time' is set to 0 minutes, which means aging is disabled for this interface. Therefore, the port shutdown cannot be caused by an aging timeout. The shutdown state is solely the result of a MAC address violation occurring on the secured port interface.

The switch has lost power to the interface.

Why it fails: If the switch lost power, the interface status would typically be 'down' or 'administratively down', not 'Secure-shutdown'. 'Secure-shutdown' is a specific state indicating that the port security feature has intentionally disabled the port due to a security violation, which is a logic-based event rather than a physical failure.

The cable is disconnected.

Why it fails: If the cable were disconnected, the interface status would show as 'down/down'. The 'up' portion of the status indicates that the physical layer (Layer 1) detects a signal, meaning the link is physically connected, but the data link layer is failing.

The IP address is incorrectly configured.

Why it fails: IP configuration errors are Layer 3 issues. If the IP address were incorrect or duplicated, the interface status would still show as 'up/up', as Layer 3 errors do not prevent the Layer 1 and Layer 2 link from initializing and establishing connectivity.

The router is administratively shut down.

Why it fails: If an interface is administratively shut down, it is explicitly disabled by the administrator. This causes both the physical and data link layers to be down, resulting in an 'administratively down' status, which differs from the 'up/down' state observed in the exhibit.

The SVI administrative configuration contains a mismatched IP subnet mask compared to the connected default gateway.

Why it fails: A subnet mask mismatch affects routing and IP packet forwarding, but it does not cause the interface line protocol to transition to the down state. The line protocol reflects Layer 2 operational framing and physical readiness.

The global routing command has not been enabled on the multilayer switch using the ip routing configuration command.

Why it fails: Without ip routing the switch cannot route between VLANs, but the SVI still comes up when the VLAN exists and has an active access port; line protocol down instead indicates no active member ports or a VLAN mismatch. It is tempting because routing is needed for inter-VLAN traffic, yet that is a separate requirement from SVI protocol state.

The physical transceiver connected to GigabitEthernet0/1 has experienced a complete hardware optical laser failure.

Why it fails: A laser failure would drop the physical link, so line protocol on the physical port would go down and Vlan100 would show down/down, not up/down. It is tempting because optical transceiver faults do cause interface outages, but they manifest as a down physical interface rather than a VLAN SVI with line protocol down.

The port will remain up and drop the traffic.

Why it fails: The 'shutdown' violation mode specifically dictates that the interface must be disabled upon a violation. Dropping traffic without changing the port status is characteristic of the 'protect' violation mode, which is not configured here. Therefore, the interface will not remain active if a violation occurs.

The port will alert the console but stay active.

Why it fails: The 'restrict' violation mode would alert the administrator via SNMP traps and log messages while keeping the port active and dropping traffic. Since 'shutdown' is configured, the port will not remain active; it will enter a disabled state to prevent any further communication from the unauthorized device.

The switch will replace the existing MAC.

Why it fails: Port security does not replace existing MAC addresses when a violation occurs. It enforces the maximum limit defined. Once the limit of one is reached, any new MAC address is considered a violation, and the port will respond according to the configured violation mode, which is shutdown.

The subnets overlap, causing a routing conflict.

Why it fails: The subnets are 172.16.5.0/28, 172.16.5.16/28, and 172.16.5.32/28. These blocks start at increments of 16, ensuring that each subnet is distinct. Since the ranges do not overlap, there is no routing conflict, and the device can effectively route traffic between these segments without packet loss.

The configuration will fail because the IP addresses are not on the same network.

Why it fails: Interfaces on a router can belong to different subnets simultaneously. The router acts as the gateway for these distinct networks. As long as the physical layer is operational and the subnets are logically separated, the router will successfully route packets between these different network segments as expected.

The mask /28 is invalid for these specific IP addresses.

Why it fails: A /28 mask is a valid CIDR representation for an IPv4 address. It corresponds to a subnet mask of 255.255.255.240. The assignment of these addresses is mathematically sound and adheres to standard subnetting rules for IPv4, allowing the router to calculate network boundaries correctly for local packet forwarding.

The interface is disabled and needs to be enabled.

Why it fails: The status 'up' and protocol 'up' indicate the interface is already active and operational. If it were disabled, the status would show 'administratively down'. The interface is perfectly functional, and no changes are required to bring the port into an operational state for the local network.

The interface has no IP address assigned to it.

Why it fails: The output clearly shows an IP address of '10.1.1.1' assigned to FastEthernet 0/1. The 'Method' column shows 'manual', confirming a static IP address has been configured. Therefore, the statement that it has no IP address is factually incorrect based on the provided CLI output exhibit.

There is a physical layer problem preventing connectivity.

Why it fails: The 'up/up' status is the primary indicator of a healthy physical connection. If there were a physical layer problem like a bad cable or incorrect speed setting, the status or protocol would be 'down'. The interface is currently fully operational, which contradicts the claim of a physical problem.