Router R1 Cannot Reach R3 Practice Questions

Share a single administrator account among all staff so everyone can fix problems quickly.

Why it fails: Shared administrator accounts destroy accountability because actions cannot be attributed to an individual, and they grant excessive privileges that malware can abuse when any one user is compromised. Least privilege with individual named accounts is the correct approach, so this measure worsens rather than improves the security posture.

Disable automatic operating system updates to prevent unexpected reboots.

Why it fails: Disabling automatic updates leaves known vulnerabilities unpatched, and malicious websites routinely exploit unpatched browsers and plugins to install malware. This measure increases risk rather than reducing it, and the reboot inconvenience is normally handled with maintenance windows instead of turning off patching entirely.

Allow all outbound traffic from the internal network to simplify troubleshooting.

Why it fails: Permitting every outbound connection lets infected hosts contact command-and-control servers and exfiltrate data, and it removes any chance of blocking malicious destinations at the perimeter. This is a permissive posture that enlarges the attack surface instead of protecting against email and web threats.

Reconfigure the default gateway on all hosts in VLAN 20 to point to the VLAN 40 SVI address.

Why it fails: Hosts should point to the gateway address of their own VLAN, not to another VLAN's interface. Changing VLAN 20 clients to use the VLAN 40 SVI would break their existing connectivity to VLAN 30 as well. This misconfiguration would widen the outage instead of fixing the VLAN 40 reachability problem.

Replace the Layer 3 switch with a router that has physical interfaces for each VLAN.

Why it fails: Replacing hardware is a drastic action that ignores diagnosis. The existing Layer 3 switch already routes between two working VLANs, so its routing capability is proven. The failure is isolated to one destination VLAN, which points to a configuration or status issue rather than a hardware limitation. This step would disrupt the working network without addressing the root cause.

Disable inter-VLAN routing and rely on Layer 2 flooding to deliver traffic between VLANs.

Why it fails: Layer 2 flooding cannot cross VLAN boundaries because each VLAN is a separate broadcast domain. Disabling routing would eliminate the working connectivity between VLAN 20 and VLAN 30 and would not make VLAN 40 reachable. This action misunderstands how inter-VLAN communication actually occurs, which always requires a Layer 3 function.

Implementing a standard Access Control List.

Why it fails: Standard ACLs filter traffic based on source IP address alone. They cannot inspect or strip 802.1Q tags, nor can they prevent the underlying mechanism of double-tagging from occurring. Therefore, they are ineffective against layer 2 VLAN hopping attacks, which operate below the IP layer where standard ACLs are applied.

Configuring PortFast on all access ports.

Why it fails: PortFast is designed to expedite the transition of a port to the forwarding state by bypassing the Spanning Tree Protocol listening and learning states. It provides no security benefit regarding VLAN hopping or frame tagging and, if misconfigured, can potentially lead to bridging loops in the network environment.

Enabling VTP pruning on the switch.

Why it fails: VTP pruning is used to optimize network bandwidth by restricting unnecessary traffic to switches that do not have active ports in specific VLANs. While it improves efficiency, it does not provide any security features to prevent frame manipulation or tag-based attacks, such as double-tagging or switch spoofing.

Dynamic Host Configuration Protocol (DHCP)

Why it fails: DHCP is responsible for assigning IP addresses to clients. Since the user can ping a public IP address, they clearly have a valid IP, subnet mask, and default gateway already assigned to their interface. If DHCP were failing, the user would likely have no connectivity at all or would be using an APIPA address.

Network Address Translation (NAT)

Why it fails: NAT allows private internal IP addresses to be translated into public addresses for internet access. If NAT were failing, the user would not be able to ping the public IP address '72.163.4.161' because their private packets would not be routable on the internet. Successful pinging proves that NAT is currently working correctly.

Address Resolution Protocol (ARP)

Why it fails: ARP resolves IP addresses to MAC addresses on the local network segment. If ARP were failing, the computer would not be able to send any packets to the local gateway, which would prevent both the ping to the IP and the attempt to reach the website. ARP is clearly functioning if any external traffic is successful.

show ip route

Why it fails: The IP routing table shows the paths to network destinations and is managed by layer 3 protocols. While useful for path selection issues, it does not provide information regarding physical layer errors or interface flapping, making it ineffective for diagnosing physical media or hardware-related intermittent connectivity problems in the network.

show ip arp

Why it fails: The ARP table links IP addresses to MAC addresses within the local network segment. While ARP issues can cause connectivity loss, they are related to layer 2 logical addressing and not physical layer integrity. Therefore, this command will not help identify physical errors or flapping ports on the switch.

show ip protocols

Why it fails: This command provides information about the active dynamic routing protocols and their status. It is used to troubleshoot layer 3 routing logic and neighbor adjacencies. Since it does not report interface-level statistics or physical status changes, it is irrelevant for diagnosing intermittent connectivity caused by layer 1 hardware issues.

It forwards the packet to all connected ports.

Why it fails: Unlike a switch, a router does not flood packets. Flooding is a Layer 2 switching behavior used for unknown unicast or broadcast frames. A router makes intelligent forwarding decisions, and if no route is found, it discards the packet to prevent network congestion.

It stores the packet until a route is learned.

Why it fails: Routers do not buffer or queue packets indefinitely while waiting for routing table updates. Buffering in this manner would lead to memory exhaustion and massive latency, so the standard procedure is to discard the packet immediately when no forwarding path exists.

It sends a request to the DNS server for the path.

Why it fails: DNS is used to map hostnames to IP addresses, not to provide routing path information. A router relies on its routing table and routing protocols to determine paths; it never queries a DNS server to decide where to send an IP packet.

Incorrect DNS server

Why it fails: While an incorrect DNS server prevents users from resolving hostnames to IP addresses, it does not stop a technician from reaching remote resources via direct IP pings. Since the technician cannot reach any resources outside the subnet, the issue lies deeper in the routing logic than simple name resolution services.

Duplicate IP address

Why it fails: A duplicate IP address usually causes intermittent connectivity or total failure for the specific host involved, often triggering an ARP error message on the operating system. It would typically affect local connectivity as much as remote connectivity, which does not match the symptoms of local success but remote failure.

Faulty Cat6 cabling

Why it fails: Faulty cabling would generally impact all network traffic, regardless of whether the destination is local or remote. If the technician can successfully ping local servers, the physical layer connectivity between the host and the switch is confirmed to be working, ruling out a basic hardware failure in the cable.

The DNS server address is missing.

Why it fails: A missing DNS server would prevent the host from resolving hostnames to IP addresses, but it would not prevent communication with remote hosts if their IP addresses were used directly. The scenario describes a complete lack of reachability to other subnets, which is a fundamental routing issue at the network layer.

The subnet mask is too restrictive.

Why it fails: If the subnet mask were too restrictive, the host might misidentify local hosts as being on a remote network or vice versa. However, the host can already communicate with local hosts correctly. The inability to reach 'any' host on 'different' subnets points toward a failure to pass traffic to the router.

The NIC is configured for the wrong duplex mode.

Why it fails: A duplex mismatch would cause performance issues, collisions, and packet loss for all types of traffic, including local communication. Since the host can communicate perfectly with other hosts on the same subnet, the physical link and basic framing are operational, ruling out a simple duplex or physical layer mismatch.

It forces the port to drop all DHCP traffic.

Why it fails: The 'trust' command is the exact opposite of blocking traffic. It explicitly tells the switch that this interface is connected to an authorized DHCP server, allowing the server to communicate with clients through this port. Ports not marked as trusted would block these server responses.

It enables port security on the interface.

Why it fails: DHCP Snooping and Port Security are two distinct features. Marking an interface as a trusted DHCP port does not activate MAC-address-based port security. Port security requires independent configuration commands and serves a completely different purpose related to physical device identification and access restriction.

It prevents ARP spoofing on the port.

Why it fails: Trusting an interface for DHCP snooping has no direct effect on ARP packet validation. ARP spoofing protection is provided by Dynamic ARP Inspection (DAI), which requires its own specific configuration and uses the DHCP snooping database, but is not enabled simply by trusting the interface.

The routers are using different routing protocols.

Why it fails: Routing protocols like OSPF or EIGRP are used to share information about 'remote' networks. They are not required for two routers to ping each other on a directly connected link. Direct connectivity only requires correct Layer 1 and Layer 2 operation and matching Layer 3 subnet configurations on both interfaces.

The DNS server is not configured on the routers.

Why it fails: DNS is used to resolve hostnames to IP addresses. Since the technician is attempting to ping the interface IP address directly, DNS is not involved in the process. The failure of an IP-to-IP ping indicates a more fundamental problem with the network layer configuration or the path between the two devices.

The 'no shutdown' command was not issued.

Why it fails: The scenario states that both interfaces are in an 'up/up' state. If the 'no shutdown' command had not been issued, the interfaces would show as 'administratively down'. Since they are 'up', the physical and data link layers are functional, and the issue must lie within the logical IP configuration settings.

The specific MAC address of the destination device.

Why it fails: The ping command operates at Layer 3 of the OSI model and does not display the MAC address of the destination in its standard output. While the ARP table may be updated as a side effect of the ping, the ICMP reply itself only confirms IP-level reachability and packet timing.

The list of every router hop along the path.

Why it fails: Identifying every router hop is the function of the 'traceroute' command, not 'ping'. Ping only confirms that the destination is reachable and provides statistics on that specific end-to-end path. It does not provide visibility into the intermediate devices or the specific path taken by the packets through the internetwork.

The TCP port numbers that are currently open on the host.

Why it fails: ICMP is a separate protocol from TCP and does not use port numbers. A ping cannot determine which applications or services are listening on the destination host. To check for open ports, a technician would need to use a port scanner or attempt a specific TCP connection like Telnet or SSH.

The switch needs the ip routing global configuration command enabled so that it can forward frames between VLAN 10 and VLAN 20.

Why it fails: The ip routing command enables Layer 3 routing functionality on a multilayer switch that supports it, but this branch switch is described as a Layer 2 access switch with no routing capability. Enabling that command on a Layer 2-only platform has no effect and would not create a path between VLANs. The real issue is the absence of any Layer 3 device, not a disabled feature on the access switch.

The access ports must be configured as trunk ports so that frames from both VLANs can be carried between them.

Why it fails: Trunk ports carry traffic for multiple VLANs between network devices such as switches, but they do not route traffic between VLANs. Configuring an access port as a trunk would not allow a host in VLAN 10 to reach a host in VLAN 20, because the frames still need a Layer 3 decision. The problem is the missing router or multilayer switch, not the port mode of the access ports.

Spanning Tree Protocol has blocked the redundant path between the two VLANs, preventing traffic from flowing between them.

Why it fails: Spanning Tree Protocol operates within a Layer 2 topology to prevent loops by blocking redundant links; it does not create or block paths between separate VLANs. VLAN 10 and VLAN 20 do not share a Layer 2 forwarding path at all, so STP state is irrelevant to their mutual reachability. The connectivity failure stems from the lack of Layer 3 routing, not from a blocked spanning-tree port.

Protocol

Why it fails: The Protocol field indicates which upper-layer protocol (like TCP, UDP, or ICMP) is contained within the IP packet's data area. It helps the receiving host determine how to process the payload and is unrelated to loop prevention or packet forwarding longevity.

Fragment Offset

Why it fails: The Fragment Offset field is used during packet reassembly when a large packet has been fragmented into smaller pieces to fit the MTU of a network link. It ensures the data segments are placed in the correct sequence, not for loop prevention.

Header Checksum

Why it fails: The Header Checksum is used for error detection within the IPv4 header. It allows the receiving device to verify that the header information was not corrupted during transit. It does not provide any mechanism to track hop count or limit the lifespan of packets.

Perform a traceroute to the internet gateway.

Why it fails: Traceroute is a Layer 3 diagnostic tool that relies on successful ICMP or UDP communication. If the initial ARP resolution for the default gateway fails, the traceroute will time out immediately at the first hop, providing no additional visibility into the root cause of the local layer 2 connectivity failure.

Flush the DNS cache on the workstation.

Why it fails: DNS is a layer 7 protocol used for domain name resolution and has no impact on local network connectivity. Even if DNS resolution were failing, the workstation would still be able to ping the default gateway by its IP address, making this step irrelevant to troubleshooting layer 2 connectivity issues.

Reboot the switch connected to the workstation.

Why it fails: Rebooting network infrastructure is a disruptive and drastic troubleshooting measure that should only be performed after precise diagnosis. It provides no immediate technical insight into why a single workstation cannot communicate and may temporarily hide intermittent issues without addressing the underlying configuration or physical layer faults in the network.

MAC address filtering

Why it fails: MAC address filtering permits or denies devices based on their hardware addresses. It can restrict access but does not create separate logical networks or isolate guest traffic from internal resources. It also requires maintaining lists and can be bypassed by spoofing, so it does not meet the separation requirement.

WPA2-Personal with a shared passphrase

Why it fails: WPA2-Personal encrypts wireless traffic using a pre-shared key, but all users of that SSID share the same key and the same logical network. It does not separate guests from employees or prevent guest devices from reaching internal hosts. Encryption alone is not segmentation.

SSID broadcast suppression

Why it fails: Hiding the SSID stops the network name from appearing in scan results, but it does not separate guest traffic from employee traffic. Clients that know the SSID can still associate, and the hidden network remains on the same Layer 2 domain. This is a weak security measure, not a segmentation feature.