Courseiva

CCNA Diagnosing Problems Questions

51 questions · Diagnosing Problems topic · All types, answers revealed

Practice these questionsExam hubAll questions
1
MCQmedium

Refer to the exhibit. Why is the router unable to reach the internet?

A.The interface is shut down.
B.The default route is missing.
C.The subnet mask is incorrect.
D.The router has no IP address assigned.
AnswerB

The output explicitly states 'Gateway of last resort is not set'. A router requires a default route (0.0.0.0/0) to forward packets to destinations outside of its directly connected subnets. Without this, any traffic destined for the internet is dropped by the router because it has no path information.

Why this answer

The routing table shows only local subnets and lacks a gateway of last resort, which is required for routing traffic to external networks like the internet. Without a default route (0.0.0.0/0), the router does not know where to send packets destined for non-local addresses. Configuring a static default route pointing to the ISP is the standard fix to enable internet access on this device.

Practice this question →
2
MCQmedium

A network technician is troubleshooting a workstation that cannot reach any resources on a remote subnet. The workstation can ping its default gateway and other hosts on the local subnet. The technician runs 'tracert' from the workstation to a remote server and sees the first hop (the default gateway) respond, but all subsequent hops time out. Which is the most likely cause?

A.The workstation's DNS server is unreachable.
B.A firewall on the remote server is blocking ICMP echo requests.
C.The default gateway is missing a route to the remote subnet.
D.The workstation has an incorrect subnet mask.
AnswerC

The workstation successfully reaches its default gateway and local hosts, proving Layer 1-3 connectivity to the gateway is intact. The traceroute shows the gateway responds but no further hops, indicating the gateway cannot forward traffic beyond itself. A missing route on the gateway to the destination subnet would cause exactly this symptom, as the gateway would drop packets destined for an unknown network.

Why this answer

The workstation can reach its default gateway and local subnet, so local configuration and Layer 1-3 connectivity are fine. The traceroute shows the gateway responding but no further hops, indicating the gateway cannot forward packets to the remote subnet. This is consistent with a missing route on the gateway.

An incorrect subnet mask or DNS issue would not produce this exact pattern, and a remote firewall would not stop intermediate hops from responding.

Exam trap

The trap here is assuming that a successful ping to the default gateway means the gateway is fully functional for routing, when in fact it may lack a route to the destination network.

Practice this question →
3
MCQmedium

While troubleshooting a connectivity issue, a technician discovers a switch port is in the 'err-disabled' state. What is the standard first step to attempt to bring the port back online after identifying and fixing the root cause?

A.Reload the entire switch to clear the buffer.
B.Issue the 'shutdown' followed by 'no shutdown' commands.
C.Change the VLAN assignment of the port.
D.Clear the MAC address table for that interface.
AnswerB

The most common way to recover an interface from an 'err-disabled' state is to manually toggle the port. By entering 'shutdown' and then 'no shutdown' on the specific interface, the software state is reset, allowing the port to attempt to transition back to an 'up/up' status after the error.

Why this answer

The 'err-disabled' state is a feature that automatically shuts down a port when certain error conditions are detected, such as port security violations or duplex mismatches. To recover the port manually, the interface must be reset. This process ensures that the administrator acknowledges the error and confirms that the underlying issue has been resolved.

Exam trap

Candidates often try to use 'no shutdown' immediately without realizing that if the interface is already administratively 'up', issuing 'no action' does nothing until it is first placed in a down state.

Practice this question →
4
MCQeasy

What is the primary function of a loopback interface in troubleshooting network devices?

A.To act as a physical bridge between two VLANs.
B.To provide a stable interface for management and testing.
C.To increase the total bandwidth of the router.
D.To provide power over Ethernet to connected devices.
AnswerB

Loopback interfaces remain up even if physical ports fail, making them ideal for router identification, management access (like SSH), and as an anchor for OSPF/BGP neighbor adjacencies. This stability ensures that management access remains available for troubleshooting even during significant physical network instability or link outages.

Why this answer

A loopback interface is a logical, virtual interface that is always 'up' as long as the router is running. It is primarily used for management, testing, and as a stable source IP for routing protocols like OSPF and BGP. Because it is never dependent on physical cable status, it provides a reliable point for testing connectivity and management access regardless of physical link failures.

Exam trap

Candidates frequently confuse loopback interfaces with physical port loopback plugs used for hardware testing, missing that a logical loopback is a stable virtual routing endpoint.

Practice this question →
5
Multi-Selectmedium

A network engineer is troubleshooting a potential DHCP issue. Which THREE components are provided to a client during a successful DHCP 'Acknowledgment' (ACK) message? (Choose three.)

Select 3 answers
A.IP address for the client.
B.Default gateway address.
C.Subnet mask.
D.The MAC address of the DHCP server.
E.The SSH private key for the management console.
AnswersA, B, C

The primary purpose of DHCP is to assign a unique Layer 3 IP address to the client from a managed pool. Without this, the client cannot communicate using the IP protocol suite. This address is the most fundamental piece of information contained within the DHCP ACK message during the assignment process.

Why this answer

The DHCP ACK is the final step in the DORA process where the server confirms the lease of an IP address. Understanding the specific parameters delivered in this message is crucial for diagnosing configuration errors that affect host connectivity, name resolution, and the ability of devices to reach resources outside their local network segment.

Exam trap

Candidates frequently mistake dynamic assignment parameters like MAC addresses or lease timers as items delivered by the server, rather than recognizing core network settings like subnet masks.

Practice this question →
6
Multi-Selecthard

Which THREE conditions are common causes of 'Input Errors' appearing on a Cisco switch interface? (Choose three.)

Select 3 answers
A.Duplex mismatch between the switch and the connected host.
B.Faulty or damaged Ethernet cabling.
C.Excessive broadcast traffic originating from a loop.
D.A malfunctioning Network Interface Card (NIC) on the host.
E.The interface being administratively shut down.
AnswersA, B, D

A duplex mismatch occurs when one side of a link is set to full-duplex and the other to half-duplex. This results in late collisions and CRC errors, which are recorded as input errors on the interface. This is a classic Layer 1/2 troubleshooting scenario that causes significant performance degradation and packet loss.

Why this answer

Input errors on an interface indicate that the switch received frames it could not process correctly. This is often a sign of physical layer degradation or configuration mismatches. Monitoring these counters is a vital part of proactive network maintenance, as they often precede a total link failure or significantly impact application performance due to retransmissions.

Exam trap

Candidates often select higher-layer transport or routing issues when troubleshooting physical input errors, forgetting that CRC and frame errors stem from physical layer problems.

Practice this question →
7
MCQeasy

A user cannot reach a web server. You perform a ping and it fails, but a traceroute shows the packets reaching the last hop before the server. What does this indicate?

A.The intermediate router is down.
B.The destination server is likely unreachable or blocking ICMP.
C.The default gateway is misconfigured.
D.The DNS server is down.
AnswerB

Reaching the final hop indicates the network path is valid. If the ping fails at the final hop, the server is either dropping ICMP packets via a firewall or the server process itself is non-responsive. This isolates the problem to the destination host's configuration rather than the network infrastructure.

Why this answer

A successful traceroute to the last hop before the destination, combined with a failed ping, indicates the path is intact up to that point but the final destination is not responding to ICMP echo requests. This commonly means the server is down, its firewall is blocking ICMP, or it is otherwise unreachable at Layer 3. The traceroute output confirms intermediate routers are forwarding traffic correctly, so the problem is localized to the destination host or its immediate network.

Exam trap

The trap is assuming that a failed ping always means the host is offline; candidates forget that ICMP is frequently blocked by firewalls, so a successful traceroute to the last hop is the key clue that the path is fine and the issue is at the destination.

How to eliminate wrong answers

Option A is wrong because if an intermediate router were down, traceroute would show timeouts or stop before reaching the last hop — the fact that packets reach the final hop proves the routers are up. Option C is wrong because a misconfigured default gateway would prevent the source host from reaching any remote network, yet traceroute successfully traversed the path. Option D is wrong because DNS failure would cause name resolution errors (e.g., 'unknown host'), not a successful traceroute to the destination IP.

Practice this question →
8
Multi-Selecthard

A user reports intermittent connectivity to the internal server. Which TWO commands are most useful to identify if the issue is caused by physical layer flapping or interface errors?

Select 2 answers
A.show interfaces
B.show ip route
C.show logging
D.show ip arp
E.show ip protocols
AnswersA, C

This command displays the status of the interface including CRC errors, runts, and collisions. High counts of these errors indicate a faulty cable, bad transceiver, or duplex mismatch, which are primary causes of intermittent connectivity. It is the fundamental starting point for diagnosing physical layer degradation in Cisco environments.

Why this answer

Identifying physical layer issues requires inspecting interface statistics and state changes. 'show interfaces' reveals error counters like CRC, giants, and runts which signify physical layer degradation. 'show logging' provides a chronological history of interface state changes, allowing the technician to correlate connectivity drops with physical link flaps. Together, these tools provide a comprehensive view of the physical health of the connection between the host and the switch infrastructure.

Practice this question →
9
Multi-Selectmedium

A technician is troubleshooting a workstation that cannot connect to the network. The workstation has a link light, but ipconfig shows an IP address of 169.254.10.20. The technician suspects a DHCP-related issue. Which two commands should the technician use to attempt to obtain a new IP address from the DHCP server? (Choose two.)

Select 2 answers
A.ipconfig /release
B.ipconfig /flushdns
C.ipconfig /displaydns
D.netstat -a
E.ipconfig /renew
AnswersA, E

The ipconfig /release command releases the current DHCP lease, which in this case is the APIPA address. Releasing the lease clears the existing configuration and prepares the workstation to request a new lease from a DHCP server. This is a necessary step before attempting to renew or obtain a new address, especially when the current address is an APIPA address that indicates DHCP failure.

Why this answer

An IP address in the 169.254.x.x range indicates that the workstation failed to obtain a lease from a DHCP server and self-assigned an APIPA address. To resolve this, the technician should first release the current APIPA address using ipconfig /release, then request a new lease with ipconfig /renew. These two commands together attempt to re-establish DHCP communication and obtain a valid IP configuration.

Exam trap

The trap here is thinking that ipconfig /flushdns can resolve DHCP issues, but it only clears DNS cache and has no effect on obtaining a new IP address.

Practice this question →
10
MCQmedium

Which tool is best suited for identifying a slow network segment caused by excessive broadcast traffic?

A.Cisco DNA Center.
B.Protocol analyzer.
C.SNMP Manager.
D.TDR cable tester.
AnswerB

A protocol analyzer, such as Wireshark, allows for the inspection of packet headers and traffic statistics. It is the ideal tool for detecting excessive broadcast or multicast traffic by analyzing the frame distribution, which helps pinpoint the source of congestion or loops within a local area network segment.

Why this answer

Broadcast storms or high volumes of traffic can severely degrade network performance. A protocol analyzer, or network sniffer, allows a technician to capture packets and examine the distribution of traffic types. By looking at the percentage of broadcast traffic compared to unicast traffic, one can identify if a specific segment is being overwhelmed by broadcast frames, which is critical for maintaining network latency and stability.

Practice this question →
11
MCQhard

A network is experiencing high latency. The administrator finds that the switch has high CPU utilization. Which diagnostic step is most appropriate to identify the cause?

A.Check the ARP table for excessive entries.
B.Run 'show processes cpu' to identify the top processes.
C.Clear the interface statistics.
D.Disable spanning-tree on all ports.
AnswerB

This command provides a real-time breakdown of CPU usage by process. It allows the administrator to pinpoint if the spike is caused by routing updates, SNMP polling, or packet-switching tasks. This is the most accurate diagnostic method for determining why the switch CPU is currently over-utilized.

Why this answer

High CPU on a switch often indicates that the control plane is being overwhelmed by traffic that requires processing rather than hardware switching. By using the 'show processes cpu' command, the administrator can identify which specific process is consuming resources. This allows for distinguishing between legitimate traffic spikes, management overhead, or an ongoing denial-of-service attack, which helps in applying the correct mitigation strategy to restore network performance.

Practice this question →
12
MCQmedium

A network technician is investigating why a user cannot access a file server at 10.1.1.100. The user's workstation can ping the server successfully, but when the user tries to open a shared folder, the connection times out. The technician verifies that other users can access the same share. Which tool should the technician use to determine if a firewall is blocking the specific file-sharing protocol?

A.tracert 10.1.1.100
B.ping 10.1.1.100 -t
C.nslookup 10.1.1.100
D.telnet 10.1.1.100 445
AnswerD

telnet can be used to test TCP connectivity to a specific port. If the connection to port 445 succeeds, the SMB service is reachable; if it fails or times out, a firewall or service issue is likely. This directly tests the file-sharing protocol port and helps isolate whether the problem is port-specific filtering.

Why this answer

Successful ping proves IP reachability, but file sharing uses TCP ports such as 445 or 139. A firewall could block those ports while allowing ICMP. Testing TCP port 445 with telnet determines whether the SMB service is reachable.

If telnet fails, a firewall or service problem is indicated; if it succeeds, the issue may be at the application or authentication layer.

Exam trap

The trap here is thinking that a successful ping guarantees all services are reachable, ignoring that firewalls can block specific TCP or UDP ports while permitting ICMP.

Practice this question →
13
MCQmedium

Refer to the exhibit. What is the most likely cause of poor performance on this link?

A.The interface has a duplex mismatch.
B.The link is experiencing excessive congestion.
C.The cable is faulty and causing retransmissions.
D.The interface MTU is configured incorrectly.
AnswerB

When the input traffic rate exceeds the interface's bandwidth, the link becomes congested. This results in buffer overflows and packet drops as the device cannot egress the traffic fast enough. The provided statistics clearly show that the input traffic far exceeds the physical limitations of the port.

Why this answer

The exhibit shows an input rate of 1000 Mbps on an interface with a bandwidth of only 100 Mbps. This indicates massive oversubscription and congestion. The interface is attempting to process ten times the amount of data it is capable of handling, leading to packet drops, buffer exhaustion, and significant latency.

This is a capacity issue rather than a physical error or protocol mismatch, requiring a bandwidth upgrade or traffic shaping.

Exam trap

Candidates often confuse traffic volume indicators with physical errors like CRC errors or duplex mismatches, assuming hardware failure when the issue is simply high capacity oversubscription.

Practice this question →
14
MCQmedium

Refer to the exhibit. A host connected to port FastEthernet0/2 is unable to communicate with other devices in VLAN 10. Based on the output, what can be concluded about port Fa0/2?

A.The switch has learned the MAC address but the port is blocked.
B.The host on Fa0/2 has not sent any traffic to the switch.
C.Port Fa0/2 is configured as a trunk port and is filtering traffic.
D.The host on Fa0/2 is using a static IP address.
AnswerB

Switches build their MAC address tables dynamically by looking at the source MAC address of incoming frames. If Fa0/2 is missing from the table, it means the switch hasn't received any frames from the connected device, which could be due to a bad cable, a dead NIC, or the device being silent.

Why this answer

The MAC address table shows which devices are currently communicating through the switch. If a host is connected but its MAC address does not appear in the table, the switch has not received any valid frames from that device. This points to a failure in the initial communication process, likely at the physical or data link layer.

Exam trap

Candidates often assume the device is misconfigured or has a VLAN mismatch. They ignore the simplest fact: if the MAC address is missing from the table, the switch never received a frame.

Practice this question →
15
MCQmedium

A user on VLAN 20 reports that they cannot reach a server on VLAN 30, but they can reach other devices on VLAN 20 and the Internet. The network uses a Layer 3 switch for inter-VLAN routing. The technician verifies that the user's PC has the correct IP address, subnet mask, and default gateway. Which command should the technician run on the Layer 3 switch to verify that inter-VLAN routing is enabled and functioning?

A.show vlan brief
B.show interfaces trunk
C.show ip route
D.show mac address-table
AnswerC

The show ip route command displays the routing table, which on a Layer 3 switch includes directly connected networks for each VLAN interface (SVI). If inter-VLAN routing is enabled, the route for VLAN 30's subnet should appear as directly connected via the corresponding SVI. Missing or incorrect routes indicate a problem with SVI configuration or routing, directly addressing the issue.

Why this answer

The show ip route command reveals the routing table, which on a Layer 3 switch includes directly connected routes for each configured SVI. If inter-VLAN routing is active, the route for the server's VLAN subnet should be present as directly connected. Absence of that route would point to a missing or misconfigured SVI, explaining the connectivity failure.

Exam trap

The trap here is assuming that successful local VLAN communication and Internet access automatically prove inter-VLAN routing is working, when those can function independently of the SVI configuration.

Practice this question →
16
MCQeasy

A technician is troubleshooting a workstation that cannot reach any network resources. The workstation's IP configuration shows an address of 169.254.10.22 and a subnet mask of 255.255.0.0. Which condition does this indicate?

A.The workstation successfully received an IP address from a DHCP server.
B.The workstation has a static IP address that conflicts with another device.
C.The workstation is configured with an incorrect default gateway.
D.The workstation is using an APIPA address because it could not contact a DHCP server.
AnswerD

The 169.254.0.0/16 range is reserved for Automatic Private IP Addressing (APIPA), which Windows and other systems self-assign when DHCP discovery fails. The presence of this address confirms the workstation never received a lease, so it has no valid gateway or DNS and cannot reach network resources. This is the definitive explanation for the observed configuration.

Why this answer

The 169.254.0.0/16 address range is reserved for APIPA, which a host self-assigns when its DHCP discover broadcasts receive no response. This means the workstation has no valid IP, gateway, or DNS information, explaining why all network resources are unreachable. The correct diagnosis is a DHCP communication failure, not a configuration conflict or gateway error.

Exam trap

The trap here is assuming a 169.254.x.x address is a normal private IP rather than recognizing it as an APIPA fallback indicating DHCP failure.

Practice this question →
17
MCQhard

A technician can successfully ping local servers on the same 192.168.10.0/24 subnet but cannot reach any resources on a different VLAN or the Internet. The technician verifies the local IP address and subnet mask are correct. Which component is the most likely source of the connectivity failure?

A.Incorrect DNS server
B.Duplicate IP address
C.Misconfigured default gateway
D.Faulty Cat6 cabling
AnswerC

The default gateway is the exit point for traffic destined for other networks. If this address is missing or incorrectly pointed to a non-existent or wrong IP on the local segment, the host will not know where to send packets intended for external destinations, effectively isolating it to its own subnet.

Why this answer

Successful communication within a local subnet proves that the Network Interface Card and local switching are functional. However, the inability to reach remote networks typically indicates a configuration error regarding the default gateway. Technicians must verify that the gateway address resides on the local subnet and that the router is actively forwarding traffic for that specific VLAN.

Exam trap

Candidates often troubleshoot the router or the ISP connection. They fail to realize that if local traffic works but remote traffic fails, the host's default gateway is likely missing or incorrect.

Practice this question →
18
MCQhard

A technician is troubleshooting a PC that can communicate with other hosts on the same subnet but cannot reach any hosts on different subnets. Which configuration on the PC is most likely incorrect?

A.The DNS server address is missing.
B.The subnet mask is too restrictive.
C.The default gateway address is incorrect.
D.The NIC is configured for the wrong duplex mode.
AnswerC

The default gateway is essential for inter-subnet communication. When a host determines that a destination IP is outside its local subnet (based on its own IP and subnet mask), it forwards the frame to the MAC address of the default gateway. If this address is wrong, remote communication fails entirely.

Why this answer

The default gateway is the local router interface that allows a host to send traffic to remote networks. If a host can communicate locally, its IP and subnet mask are likely correct for the segment, but without a functional gateway, it has no path to send packets destined for any address outside its own subnet.

Exam trap

Candidates often assume that if a PC has any network connectivity (like local file sharing), its IP configuration must be entirely correct, missing the fact that local traffic bypasses the default gateway entirely.

Practice this question →
19
Multi-Selecthard

A network administrator is troubleshooting a Cisco Catalyst switch where a host connected to port Gi1/0/10 is experiencing intermittent connectivity. The administrator suspects a physical layer issue. Which TWO commands would provide the most direct evidence of physical layer problems on that interface? (Choose two.)

Select 2 answers
A.show mac address-table interface Gi1/0/10
B.show vlan brief
C.show ip interface brief
D.show controllers ethernet-controller Gi1/0/10 phy
E.show interfaces Gi1/0/10
AnswersD, E

The 'show controllers ethernet-controller phy' command provides low-level PHY statistics, including signal quality, link status, and error counters specific to the physical layer. It can reveal issues like poor signal integrity, which might not be obvious from standard interface counters. This command is particularly useful for diagnosing intermittent physical layer problems on a specific port.

Why this answer

Physical layer problems are best diagnosed by examining interface error counters and PHY-level statistics. The 'show interfaces' command reveals CRC errors, runts, giants, and input errors that indicate cabling or hardware issues. The 'show controllers ethernet-controller phy' command provides deeper physical layer diagnostics, including signal quality.

Commands like 'show mac address-table', 'show ip interface brief', and 'show vlan brief' focus on Layer 2/3 configuration and status, not physical layer error conditions.

Exam trap

The trap here is assuming that any 'show' command related to the interface will reveal physical layer problems, when in fact only specific commands that display error counters and PHY statistics are useful.

Practice this question →
20
MCQmedium

A technician is troubleshooting a workstation that can reach servers on the local subnet but cannot reach any host on a remote subnet. The workstation's IP address, subnet mask, and DNS server are correct, and pinging the default gateway succeeds. Which command should the technician use to verify the workstation's default gateway and interface configuration?

A.ipconfig /all
B.route print
C.netstat -ano
D.nslookup
AnswerA

ipconfig /all displays the full TCP/IP configuration for every adapter, including IP address, subnet mask, default gateway, DNS servers, MAC address, and DHCP lease details. Since the workstation can ping its gateway but not remote subnets, confirming the default gateway value and confirming the correct adapter is active is the logical next step. This command reveals both in one output on Windows clients.

Why this answer

When a host can reach its local subnet and its gateway but nothing beyond, the fault usually lies in the default gateway value, the subnet mask, or the routing configuration on the gateway itself. ipconfig /all shows the complete interface configuration on a Windows client, including the default gateway and subnet mask, which are the values most likely to be misconfigured in this scenario.

Exam trap

The trap here is reaching for route print because the symptom sounds like routing, when the question asks for the command that verifies both the gateway and the interface configuration.

Practice this question →
21
MCQeasy

When a network administrator uses the 'ping' command to test connectivity, what is the primary purpose of the ICMP 'Echo Request' and 'Echo Reply' process?

A.To establish a TCP session for data transfer.
B.To verify reachability and basic network connectivity.
C.To resolve a hostname to an IP address.
D.To encrypt packets for secure communication.
AnswerB

The primary goal of the ICMP echo mechanism is to check if a remote host is accessible. By sending an echo request, the administrator validates that the routing is correct, the destination is online, and the path back is also functioning, which confirms fundamental network connectivity.

Why this answer

ICMP is a control protocol used for reporting network conditions. The 'Echo Request' and 'Echo Reply' messages are specifically designed to verify end-to-end connectivity between two IP hosts. When a request is sent, the destination host replies, confirming that the path is active and the host is reachable.

This is the simplest way to confirm that layers 1, 2, and 3 are functioning correctly.

Exam trap

Candidates often mistake ICMP for a troubleshooting tool that checks application-layer connectivity. It only confirms the path to the host at the Network layer, not the status of specific services.

Practice this question →
22
MCQeasy

A user calls the help desk and reports that a laptop cannot reach any websites or internal servers. The technician runs ipconfig and sees that the laptop has an IPv4 address of 169.254.88.12 with a subnet mask of 255.255.0.0 and no default gateway. Which action should the technician take FIRST to resolve the problem?

A.Restart the DHCP service on the Windows server that serves the user's subnet.
B.Configure a static IP address, subnet mask, and default gateway on the laptop.
C.Clear the DNS resolver cache on the laptop with ipconfig /flushdns.
D.Check the physical Ethernet cable and the switch port link status for the laptop.
AnswerD

The 169.254.x.x address is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when a DHCP server cannot be reached. This usually indicates the laptop has no working Layer 1 or Layer 2 connection to the network. Verifying the cable, wall jack, and switch port link status is the correct first step before investigating DHCP server scope or other higher-layer configuration issues.

Why this answer

An address in the 169.254.0.0/16 range is assigned automatically by the operating system when DHCP attempts fail, so the laptop never obtained a valid lease. The most likely causes are a disconnected or faulty cable, a disabled switch port, or a VLAN mismatch. Confirming the physical link and the switch port status is the fastest, least disruptive first step before changing any server or client configuration.

Exam trap

The trap here is assuming a 169.254 address points to a DHCP server outage, when it more often points to a local link or switch port problem on that one client.

Practice this question →
23
MCQhard

A user reports they can access the Internet but cannot connect to a specific internal accounting server. Other users in the same department can access the server without issue. What should the technician check first?

A.The status of the default gateway.
B.An Access Control List (ACL) blocking the user's IP.
C.The health of the DNS server.
D.A duplex mismatch on the user's switch port.
AnswerB

ACLs are used to filter traffic based on various criteria, including the source IP address. If an ACL on a router or the server's firewall has a 'deny' statement for that specific user's IP address, they will be unable to connect while others on the same subnet remain unaffected and functional.

Why this answer

When a single user is restricted from a specific resource that others can reach, the issue is often a specific security policy or local configuration. Access Control Lists (ACLs) can be applied based on source IP addresses, meaning one specific host could be blocked while its neighbors are allowed. This requires investigating the router or firewall policies.

Exam trap

Candidates often assume a server outage when only one user is affected, failing to realize that targeted security policies or device-specific access rules are usually the culprit.

Practice this question →
24
Multi-Selecthard

A technician is troubleshooting a workstation that cannot connect to the network. The workstation has a valid IP address, subnet mask, and default gateway. The technician can ping the default gateway but cannot ping a server on a remote subnet. Which two commands should the technician use to further isolate the problem? (Choose two.)

Select 2 answers
A.nslookup <remote server hostname>
B.ping <remote server IP>
C.ping <default gateway IP>
D.tracert <remote server IP>
E.ipconfig /all
AnswersB, D

The technician already attempted to ping the remote server and it failed. However, re-running the ping while observing the results can confirm the failure is consistent and not intermittent. More importantly, combining it with tracert helps correlate the last successful hop with the ping failure. While the initial ping failed, repeating it as part of a structured test is a valid step to confirm the issue persists.

Why this answer

The technician can reach the default gateway but not a remote server, indicating a problem beyond the local subnet. Using tracert will show the path and identify the last hop that responds, narrowing down where packets are dropped. Repeating the ping to the remote server confirms the failure is consistent.

Together, these commands help isolate whether the issue is with an intermediate router, a routing table, or the destination network.

Exam trap

The trap here is selecting commands that retest already-verified information, like pinging the gateway or checking IP configuration, instead of focusing on the remote path where the failure actually occurs.

Practice this question →
25
MCQmedium

While monitoring a network, an administrator sees a sudden spike in CPU usage on all switches and very high levels of broadcast traffic. What is the most likely cause of this behavior?

A.A Layer 2 loop in the topology.
B.A malfunctioning DHCP server.
C.An IP address conflict on the gateway.
D.The use of the 'traceroute' command by a user.
AnswerA

When a loop exists at Layer 2, broadcast frames (which are flooded to all ports) are caught in an infinite cycle. Because Ethernet frames lack a Time-to-Live (TTL) field, they never expire. This leads to a broadcast storm that saturates links and overwhelms switch processors, resulting in the symptoms described.

Why this answer

A switching loop occurs when there are multiple active paths between switches without Spanning Tree Protocol (STP) preventing a loop. This causes broadcast frames to circulate endlessly, multiplying and consuming all available bandwidth and CPU resources. This 'broadcast storm' is a critical Layer 2 failure that can bring down an entire network.

Exam trap

Candidates often guess 'DDoS attack' or 'malware' due to the high CPU usage. They fail to associate broadcast traffic spikes specifically with Layer 2 loops where frames circulate and multiply indefinitely.

Practice this question →
26
Multi-Selectmedium

A network administrator is using the 'ping' command to troubleshoot connectivity. Which TWO pieces of information can be determined specifically from the ICMP Echo Reply messages? (Choose two.)

Select 2 answers
A.The approximate round-trip time between source and destination.
B.The specific MAC address of the destination device.
C.The percentage of packet loss occurring on the link.
D.The list of every router hop along the path.
E.The TCP port numbers that are currently open on the host.
AnswersA, C

ICMP Echo Replies include timing information that the ping utility uses to calculate the delay between sending the request and receiving the response. This metric is essential for diagnosing network latency issues and determining if the performance degradation is occurring at the network transport layer or the application layer.

Why this answer

The ping utility is a fundamental tool for verifying Layer 3 reachability. It provides critical diagnostic data such as round-trip time and packet loss statistics. Understanding how to interpret ping results allows technicians to distinguish between complete outages, intermittent physical issues, and potential congestion or routing delays within the network path.

Practice this question →
27
MCQeasy

A help desk technician is troubleshooting a Windows workstation that cannot reach any resources on the local subnet. The technician runs ipconfig /all and notices the workstation has an IP address of 192.168.1.50 with a subnet mask of 255.255.255.0, but the default gateway field is blank. The workstation can ping other hosts on the same subnet. What is the most likely cause of the inability to reach remote networks?

A.The default gateway is missing, so the workstation cannot forward traffic to remote networks.
B.The DNS server address is not configured, preventing name resolution for remote hosts.
C.The workstation is configured with an APIPA address and cannot communicate off-subnet.
D.The workstation has an incorrect subnet mask, preventing it from identifying remote networks.
AnswerA

A default gateway is required to route packets destined for networks outside the local subnet. Without it, the workstation can only communicate with devices on the same subnet, which matches the symptom of successful local pings but failed remote access. Configuring the correct gateway address would resolve the problem.

Why this answer

The workstation can ping local hosts, so the local IP and subnet mask are functional. The missing default gateway means the host has no route for destinations outside its own subnet. Without a gateway, packets for remote networks are dropped, which explains why only local communication works.

Assigning the correct gateway address restores remote connectivity.

Exam trap

The trap here is assuming that a valid IP address and subnet mask are enough for full connectivity, overlooking the need for a default gateway to reach remote networks.

Practice this question →
28
MCQmedium

A technician is troubleshooting a user's workstation that cannot reach any resources on a remote subnet, though local subnet communication works fine. The technician suspects a routing or default gateway issue. Which command should be used on the workstation to verify the configured default gateway address?

A.ipconfig /all
B.ping localhost
C.netstat -r
D.nslookup
AnswerA

On a Windows workstation, ipconfig /all displays the complete TCP/IP configuration, including the default gateway address, subnet mask, DNS servers, and DHCP lease details. Since the user can reach local resources but not remote ones, verifying the default gateway setting is a critical first step, and ipconfig /all provides that information directly.

Why this answer

When a workstation can communicate on the local subnet but fails to reach remote networks, the default gateway configuration is a primary suspect. The ipconfig /all command on Windows provides a comprehensive view of the IP configuration, including the default gateway address, allowing the technician to confirm whether it is correctly set or missing.

Exam trap

The trap here is confusing routing table display commands with interface configuration commands, as netstat -r shows the default route but not the configured gateway parameter.

Practice this question →
29
MCQmedium

A network administrator is troubleshooting a connectivity issue between two devices on the same VLAN. The administrator suspects a duplex mismatch on a switch port. Which command should be used on the Cisco switch to verify the duplex settings and error statistics on the interface?

A.show cdp neighbors
B.show running-config
C.show version
D.show interfaces
AnswerD

The show interfaces command displays detailed statistics for all interfaces, including duplex mode, speed, and error counters such as late collisions, FCS errors, and runts. These errors are indicative of a duplex mismatch. By examining the output for the specific interface, the administrator can confirm whether the duplex setting is correct and whether errors are accumulating, which would support the suspicion of a duplex mismatch.

Why this answer

A duplex mismatch often results in performance degradation and specific error counters such as late collisions, FCS errors, and runts. The show interfaces command provides a comprehensive view of the interface status, including duplex mode and error statistics. By checking these counters, the administrator can confirm whether a duplex mismatch is present and take corrective action, such as manually setting matching duplex settings on both ends.

Exam trap

The trap here is relying on show running-config to verify duplex, but that only shows the configured setting, not the operational status or error counters that reveal a mismatch.

Practice this question →
30
MCQeasy

A technician notices a laptop has an IP address of 169.254.11.45. The laptop cannot access the internet or local servers. What is the most likely cause of this issue?

A.The laptop has a duplicate IP address on the network.
B.The DNS server is currently offline.
C.The DHCP server is unreachable or the scope is full.
D.The subnet mask is incorrectly configured manually.
AnswerC

When a client configured for dynamic addressing fails to receive a response from a DHCP server, it assigns itself an APIPA address. This signifies a breakdown in communication between the client and the DHCP server, which could be caused by server downtime, a full address pool, or physical layer connectivity issues.

Why this answer

The 169.254.0.0/16 range is reserved for Automatic Private IP Addressing (APIPA), which is used when a device is configured for DHCP but cannot reach a server. This diagnostic indicator points directly to a failure in the DORA process. Identifying APIPA addresses helps technicians quickly narrow down connectivity issues to the DHCP server or local cabling.

Exam trap

Candidates often misdiagnose APIPA addresses as manual static configurations or misconfigured subnet masks, failing to recognize that the 169.254.x.x range explicitly indicates a DHCP failure.

Practice this question →
31
Multi-Selecthard

A network administrator is troubleshooting a workstation that cannot access network resources. The administrator runs the command arp -a and sees an incomplete entry for the default gateway. Which two actions should the administrator take to resolve the issue? (Choose two.)

Select 2 answers
A.Restart the workstation to force a new DHCP lease.
B.Check the physical connection and link status on the workstation's network interface.
C.Clear the DNS cache using ipconfig /flushdns.
D.Verify that the default gateway IP address is correctly configured on the workstation.
E.Run a traceroute to the default gateway to identify the failing hop.
AnswersB, D

An incomplete ARP entry can also result from a physical layer issue, such as a disconnected cable or faulty NIC, preventing any frames from being sent or received. Verifying link lights and interface status confirms whether the workstation can communicate on the local segment. If the link is down, no ARP replies can be received, causing the incomplete entry.

Why this answer

An incomplete ARP entry for the default gateway indicates the workstation cannot learn the gateway's MAC address. This can be due to an incorrect gateway IP configuration or a physical link problem. Verifying the gateway address and checking the physical connection are the two most direct actions to identify and resolve the issue.

Other steps like DNS cache flush or traceroute do not address Layer 2 ARP resolution.

Exam trap

The trap here is focusing on higher-layer tools like DNS or traceroute when the symptom points to a Layer 2 ARP resolution failure that requires checking IP configuration and physical connectivity.

Practice this question →
32
MCQhard

A technician is investigating why a user cannot access a web server at 10.1.1.50. The technician runs 'ping 10.1.1.50' and receives a reply, but when the user tries to access the web server via its hostname 'intranet.corp.local', it fails. The user's workstation has a DNS server configured as 10.1.1.10. Which command should the technician use to verify DNS resolution?

A.ipconfig /all
B.arp -a
C.tracert 10.1.1.50
D.nslookup intranet.corp.local
AnswerD

The nslookup command queries the configured DNS server to resolve a hostname to an IP address. Since ping to the IP succeeds but hostname access fails, the issue is likely name resolution. Running nslookup will show whether the DNS server returns the correct IP for intranet.corp.local or if it fails, confirming a DNS problem. This directly tests the suspected issue.

Why this answer

Since the IP address is reachable but the hostname fails, the problem is name resolution. The nslookup command directly queries the DNS server and shows whether it can resolve intranet.corp.local to the correct IP. This isolates the failure to DNS rather than network connectivity, allowing the technician to further investigate the DNS server or its records.

Exam trap

The trap here is assuming that a successful ping to the IP means the network is fully functional, overlooking that DNS resolution is a separate step that must be tested independently.

Practice this question →
33
MCQmedium

A network technician is investigating why a user cannot reach a public website by its hostname, even though the user can ping the website's IP address successfully. The workstation's default gateway and IP configuration are correct. Which command should the technician run to verify whether the workstation's configured DNS servers are responding?

A.ping www.example.com
B.arp -a
C.tracert 203.0.113.10
D.nslookup www.example.com
AnswerD

nslookup sends a query directly to the configured DNS server and reports the resolved address or an error. Since the user can ping the IP but not the hostname, name resolution is the suspected fault. nslookup confirms whether the DNS server responds and whether it returns the correct record, making it the right diagnostic tool for this scenario.

Why this answer

The ability to ping the IP address while the hostname fails isolates the problem to name resolution. Running nslookup against the configured DNS server shows whether that server answers and what it returns, distinguishing a nonresponsive DNS server from a wrong record or a client-side DNS setting problem. This makes it the most direct diagnostic for the reported symptom.

Exam trap

The trap here is using ping by hostname, which triggers resolution but hides which DNS server failed or what response it gave.

Practice this question →
34
MCQmedium

A network administrator is troubleshooting a workstation that cannot communicate with any other device on the network. The administrator runs 'ipconfig' and sees that the workstation has an IP address of 169.254.10.20 with a subnet mask of 255.255.0.0. The workstation is connected to a switch port that is up and forwarding. Which is the most likely explanation for the workstation's inability to communicate?

A.The workstation has a static IP address that conflicts with another device.
B.The workstation's NIC is faulty and cannot transmit frames.
C.The workstation failed to obtain an IP address from a DHCP server.
D.The switch port is configured for the wrong VLAN.
AnswerC

The IP address 169.254.10.20 falls within the link-local address range (169.254.0.0/16), which is automatically assigned by Windows when a DHCP server cannot be reached. This indicates that the workstation did not receive a valid IP configuration from DHCP. Without a valid IP address and default gateway, the workstation cannot communicate beyond its local link, and even local communication may be limited.

Why this answer

The IP address 169.254.10.20 is an Automatic Private IP Addressing (APIPA) address, which Windows assigns when it cannot contact a DHCP server. This means the workstation did not receive a valid IP configuration. Without a proper IP address and default gateway, it cannot communicate with other devices.

The switch port being up and forwarding confirms physical connectivity, so the issue is DHCP-related, such as a DHCP server outage or a VLAN misconfiguration preventing DHCP requests from reaching the server.

Exam trap

The trap here is assuming that a 169.254.x.x address is a valid static configuration, when it is actually a self-assigned address indicating DHCP failure.

Practice this question →
35
Multi-Selecthard

A network technician is troubleshooting a PC that cannot access internal network resources. Which TWO steps are recommended to verify if the PC is receiving a valid IP address?

Select 2 answers
A.Run ipconfig on the workstation.
B.Check the switch interface status.
C.Verify the DHCP server lease pool status.
D.Perform a traceroute to the local gateway.
E.Reset the switch configuration.
AnswersA, C

The 'ipconfig' command displays the current TCP/IP network configuration on a Windows machine. It is the quickest way to verify if the PC has obtained an IP address, the correct subnet mask, and a valid default gateway, which is the foundational step for troubleshooting any network connectivity issue.

Why this answer

Verifying the IP configuration is essential when network access fails. Using 'ipconfig' allows the technician to see if the PC has a valid address, subnet mask, and gateway. Checking the DHCP server configuration ensures that the scope is not exhausted and that the client is actually communicating with the server.

These two steps confirm if the layer 3 addressing is correct before moving on to more complex layer 2 or routing issues.

Practice this question →
36
MCQmedium

A network administrator observes that a workstation cannot ping its default gateway. The physical link light is active, and the local IP configuration appears correct. Which diagnostic step should be performed first to isolate the layer 2 connectivity issue?

A.Perform a traceroute to the internet gateway.
B.Flush the DNS cache on the workstation.
C.Check the ARP table for the gateway IP address.
D.Reboot the switch connected to the workstation.
AnswerC

Checking the ARP table is critical for determining if the host can map the gateway IP to a physical MAC address. If the entry is incomplete or missing, it indicates a failure in layer 2 frames reaching the gateway, suggesting a VLAN mismatch or blocked port on the switch.

Why this answer

Verifying the ARP table is the most effective initial step when IP connectivity fails despite physical link status. It confirms whether the device can successfully resolve the MAC address of the default gateway, which is a prerequisite for layer 3 communication. If the ARP request fails, the issue is likely within the local broadcast domain, such as an incorrect VLAN assignment or a misconfigured trunk port on the connected switch.

Practice this question →
37
MCQmedium

A technician is troubleshooting a router that can ping its own interface but cannot ping a directly connected router's interface. The technician verifies that both interfaces are 'up/up'. What is the most likely cause?

A.The routers are using different routing protocols.
B.The IP addresses are in different subnets.
C.The DNS server is not configured on the routers.
D.The 'no shutdown' command was not issued.
AnswerB

For two devices to communicate directly at Layer 3, their interfaces must be in the same subnet. If Router A is 192.168.1.1/24 and Router B is 192.168.2.1/24, they will not be able to ping each other because they do not consider the other's IP to be on the local link.

Why this answer

When two routers are directly connected, they must share the same logical subnet to communicate. If the IP addresses are on different subnets or the subnet masks are mismatched, they will not be able to exchange packets. This is a common configuration error that occurs during initial setup or after a network change.

Exam trap

Candidates often assume a routing protocol failure or an ACL issue. They overlook the basic Layer 3 requirement that directly connected interfaces must reside within the same logical subnet to communicate successfully.

Practice this question →
38
MCQmedium

A network administrator is troubleshooting a switch that is experiencing high CPU utilization. The administrator suspects a switching loop. Which command should be used to verify whether Spanning Tree Protocol has blocked any ports to prevent a loop?

A.show interfaces status
B.show running-config
C.show spanning-tree
D.show mac address-table
AnswerC

show spanning-tree displays the STP status for each VLAN, including root bridge, port roles, and port states. If a loop exists, STP will place redundant ports in blocking state. This command reveals which ports are blocking and can confirm whether STP is actively preventing a loop, helping diagnose high CPU caused by topology changes.

Why this answer

Spanning Tree Protocol prevents loops by blocking redundant ports. When a loop is suspected, checking STP status is essential. The show spanning-tree command provides detailed information about port roles and states, including which ports are blocking.

If STP is functioning correctly, it will have blocked ports to break the loop, though high CPU may still occur during topology changes.

Exam trap

The trap here is relying on configuration or MAC table commands to verify STP operation, when only operational STP commands show current port states and blocking.

Practice this question →
39
MCQhard

A network technician is troubleshooting intermittent connectivity to a server. The technician suspects a duplex mismatch on a switch port connected to the server. Which command should be used to check the duplex setting and error statistics on the switch port?

A.show cdp neighbors gigabitEthernet 0/1
B.show controllers gigabitEthernet 0/1
C.show ip interface gigabitEthernet 0/1
D.show interfaces gigabitEthernet 0/1
AnswerD

show interfaces gigabitEthernet 0/1 displays detailed statistics for the specified interface, including duplex mode, speed, and error counters such as late collisions, FCS errors, and runts. These errors are characteristic of a duplex mismatch. This command provides the necessary information to confirm or rule out duplex issues on that port.

Why this answer

A duplex mismatch often causes late collisions, FCS errors, and runts on the side configured for half-duplex. The show interfaces command provides duplex mode and error counters for a specific interface. By examining these statistics, the technician can confirm whether a mismatch exists and take corrective action, such as setting both sides to auto-negotiate or matching duplex settings manually.

Exam trap

The trap here is using Layer 3 or neighbor discovery commands to diagnose a physical layer duplex issue, missing the need for interface error counters and duplex status.

Practice this question →
40
MCQmedium

A network administrator is troubleshooting a switch port that connects to a user's PC. The port shows a status of 'err-disabled' and the reason is 'psecure-violation.' Which action should the administrator take first to resolve this?

A.Shut down and re-enable the interface with the shutdown and no shutdown commands.
B.Configure the port as a trunk to allow multiple MAC addresses.
C.Replace the Ethernet cable connecting the PC to the switch port.
D.Remove the unauthorized device or MAC address causing the port security violation.
AnswerD

The reason 'psecure-violation' indicates that port security detected a MAC address not allowed on the port. The correct first step is to identify and remove the offending device or MAC address, or update the port security configuration if the device is authorized. Re-enabling the port without fixing the violation would just trigger the violation again. Addressing the root cause is the proper resolution.

Why this answer

The 'psecure-violation' reason indicates that port security has detected an unauthorized MAC address on the interface. The administrator must first identify and remove the device or MAC address causing the violation, or adjust the port security configuration if the device is legitimate. Simply re-enabling the port without resolving the violation will cause it to become err-disabled again.

Exam trap

The trap here is thinking that cycling the interface with shutdown/no shutdown fixes the problem, when it only temporarily clears the state without removing the violation cause.

Practice this question →
41
MCQeasy

A user reports that they cannot access any websites by name, but they can reach them by typing the IP address directly into the browser. The technician confirms that the workstation has a valid IP address, subnet mask, and default gateway. Which command should the technician use to test whether the DNS server is responding to queries?

A.nslookup
B.tracert 8.8.8.8
C.ping 8.8.8.8
D.ipconfig /release
AnswerA

nslookup is a command-line tool that queries DNS servers to resolve hostnames to IP addresses. Running nslookup allows the technician to test whether the configured DNS server is reachable and responding to queries. If nslookup fails or times out, it indicates a DNS server issue, which aligns with the symptom of being unable to access websites by name while IP connectivity works.

Why this answer

The ability to reach websites by IP address but not by name strongly suggests a DNS resolution problem. The nslookup command directly queries the DNS server, allowing the technician to confirm whether the server is reachable and resolving names correctly. If nslookup fails, the technician can then investigate DNS server configuration or network connectivity to the DNS server.

Exam trap

The trap here is assuming that a successful ping to a public IP address validates DNS, when in fact it only confirms IP-level connectivity and bypasses name resolution entirely.

Practice this question →
42
MCQhard

A network technician is troubleshooting a connectivity issue between two switches. The link between them is up, but users on one switch cannot reach devices on the other. The technician suspects a VLAN mismatch. Which command should be used on a Cisco switch to verify the VLAN assignments on a specific interface?

A.show vlan brief
B.show ip interface brief
C.show interfaces switchport
D.show mac address-table
AnswerC

The show interfaces switchport command displays detailed switchport information for all interfaces, including the administrative and operational mode (access or trunk), the access VLAN, and the trunking VLANs allowed. This is essential for verifying whether both ends of the link are configured with matching VLAN assignments, which is critical when troubleshooting a suspected VLAN mismatch between switches.

Why this answer

A VLAN mismatch between switches typically occurs when the trunk link does not allow the required VLANs or when access ports are assigned to different VLANs. The show interfaces switchport command provides a comprehensive view of the switchport configuration, including access VLAN, trunk native VLAN, and allowed VLANs. By comparing the output on both switches, the technician can quickly identify and correct any mismatch.

Exam trap

The trap here is relying on show vlan brief to verify interface VLAN assignments, but that command lists VLAN-to-port mappings without showing the operational mode or trunking details needed for inter-switch links.

Practice this question →
43
Multi-Selectmedium

A user reports they cannot access a web server at 192.168.50.10. Which TWO commands would provide the most useful initial diagnostic information regarding the path and reachability to this destination from a Windows workstation? (Choose two).

Select 2 answers
A.ping 192.168.50.10
B.tracert 192.168.50.10
C.ipconfig /renew
D.netstat -a
E.nslookup 192.168.50.10
AnswersA, B

The ping utility uses ICMP to verify that a specific destination IP address is reachable and to measure the round-trip time. It is the most common first step in troubleshooting connectivity because it quickly confirms if the target device is online and responding to basic network layer requests.

Why this answer

Ping and Traceroute are the primary tools used to diagnose reachability and path issues across an IP network. Ping tests basic end-to-end connectivity using ICMP Echo Requests, while Traceroute identifies each hop along the path, helping to pinpoint exactly where a packet is being dropped. Mastering these utilities allows technicians to isolate faults between local, ISP, or remote segments.

Exam trap

Candidates often suggest layer 2 tools like ARP or spanning-tree commands when asked to check the path across a network to a specific remote web server.

Practice this question →
44
MCQmedium

Users in an office report that the wireless network is extremely slow during the middle of the day. A technician discovers a microwave oven and several 2.4GHz cordless phones in the breakroom near the Access Point. What is the cause of this performance issue?

A.The Access Point is experiencing a DHCP exhaustion attack.
B.Radio Frequency Interference (RFI) is degrading the signal.
C.The Access Point is configured with the wrong SSID.
D.The switch port connecting the Access Point is in half-duplex mode.
AnswerB

RFI occurs when non-network devices emit signals on the same frequency as the wireless network. This noise lowers the Signal-to-Noise Ratio (SNR), forcing the wireless devices to use lower data rates and retransmit corrupted frames. This is a common environmental diagnostic issue in 2.4GHz Wi-Fi deployments near household appliances.

Why this answer

Wireless networks using the 2.4GHz band are highly susceptible to electromagnetic interference from non-802.11 devices. Microwaves and cordless phones operate on similar frequencies, creating noise that disrupts Wi-Fi signals. This results in high packet loss and retransmissions, which the users perceive as slow speeds or intermittent connectivity during peak usage times.

Exam trap

Candidates frequently attribute wireless slowness to bandwidth exhaustion by user traffic, overlooking non-Wi-Fi sources of Radio Frequency Interference like microwaves operating on the 2.4GHz band.

Practice this question →
45
MCQmedium

A technician suspects a cable issue on a copper link. Which command should they use to check for electrical issues like shorts or opens?

A.test cable-diagnostics tdr interface <int>
B.show cable status
C.ping -t <ip>
D.show interfaces summary
AnswerA

This command initiates the TDR test on the specified interface. It is the standard method for a switch to perform a physical layer check on the cabling. It reports the results of the test, including any potential faults such as opens, shorts, or cable length issues for the copper medium.

Why this answer

The TDR (Time Domain Reflectometer) feature available on many modern Cisco switches allows the administrator to perform a diagnostic test on the physical copper cable. By sending a pulse of energy and measuring the reflection, the switch can accurately identify if there is an open or short circuit, or if the cable length is within operational limits, providing clear physical layer diagnostic data without additional hardware.

Exam trap

Candidates often select generic monitoring commands like 'show interfaces' or 'ping', forgetting that specialized physical layer tools like TDR are required to detect internal cable shorts or opens.

Practice this question →
46
MCQeasy

A user reports that they cannot access any websites by name, but they can access websites by typing their IP addresses directly into the browser. The user's computer has a valid IP address, subnet mask, and default gateway, and can ping the default gateway successfully. Which is the most likely cause of the problem?

A.The default gateway is down.
B.The web browser is configured with a proxy server that is offline.
C.The user's computer has an incorrect subnet mask.
D.The DNS server address is misconfigured on the user's computer.
AnswerD

If the user can access websites by IP address but not by name, it indicates that IP connectivity is working but name resolution is failing. The most common cause is an incorrect or unreachable DNS server address configured on the computer. Checking the DNS settings and verifying connectivity to the DNS server would resolve the issue.

Why this answer

The ability to access websites by IP address but not by name is a classic symptom of DNS resolution failure. The user's computer can route traffic to the internet (since IP access works), but it cannot resolve domain names to IP addresses. This points to a misconfigured DNS server address, an unreachable DNS server, or a DNS service issue.

Checking the DNS settings and testing resolution with nslookup or ping by name would confirm the diagnosis.

Exam trap

The trap here is assuming that any inability to browse websites is a connectivity issue, when the ability to use IP addresses proves connectivity is fine and the problem is name resolution.

Practice this question →
47
MCQhard

A network engineer is investigating why a switch port Gi1/0/5 is not forwarding traffic, even though the connected device is powered on and the cable is known to be good. The engineer runs 'show interfaces Gi1/0/5 switchport' and sees that the administrative mode is dynamic auto, and the operational mode is access. The port status is 'notconnect'. Which is the most likely reason the port is not forwarding?

A.The switch port is configured with the wrong speed and duplex settings.
B.The connected device's network interface card is not transmitting a link signal.
C.The port is in an err-disabled state due to a violation.
D.The port is configured as a trunk and the connected device is sending untagged frames.
AnswerB

The 'notconnect' status on a switch port means that the physical layer link is not established. Even if the device is powered on and the cable is good, the NIC might be disabled, faulty, or configured to not auto-negotiate properly. This would prevent the switch from detecting a link, resulting in 'notconnect'. Checking the NIC status, drivers, or trying a different device would confirm.

Why this answer

The 'notconnect' status on a switch port indicates that the physical link is down. Since the cable is known good and the device is powered on, the most likely cause is that the connected device's NIC is not sending a link signal. This could be due to a disabled NIC, faulty NIC, or driver issue.

The administrative mode being dynamic auto and operational mode access are not causing the link failure; they only affect VLAN and trunking behavior once a link is established.

Exam trap

The trap here is focusing on VLAN or trunking configuration when the port status 'notconnect' clearly points to a physical layer link problem.

Practice this question →
48
MCQmedium

A help desk technician is troubleshooting a user who can access internal network shares using an IP address but cannot reach the same shares using the server's hostname. Which network service should the technician investigate first?

A.Default Gateway
B.DNS
C.DHCP
D.ARP
AnswerB

Domain Name System is responsible for mapping hostnames to IP addresses. The ability to connect via IP address proves that the physical and network layers are operational, but the failure to resolve the hostname indicates that the client cannot obtain the destination IP address from the DNS server, suggesting a configuration error.

Why this answer

DNS resolution translates human-readable hostnames into IP addresses required for routing across the network. When a user can reach internal services via IP but fails via hostname, the underlying network transport is functional, but the application-layer mapping service is failing. Diagnosing this involves checking the configured DNS server address on the client and verifying connectivity.

Practice this question →
49
Multi-Selectmedium

Users on a floor of an office building report that file transfers to a server are slow and sometimes stall. The technician suspects a duplex mismatch on the switch port connecting the server. Which TWO symptoms or outputs would confirm a duplex mismatch on that link? (Choose two.)

Select 2 answers
A.The switch logs show the port entering the err-disabled state repeatedly.
B.The switch port shows the line protocol as down while the physical link remains up.
C.The server's NIC reports a negotiated speed of 1000 Mb/s and full duplex.
D.The switch interface shows a high number of FCS and CRC errors on received frames.
E.The switch interface counters show late collisions increasing on the port.
AnswersD, E

When duplex modes disagree, frames collide with traffic already on the wire, corrupting them in transit. The receiving device calculates the frame check sequence and finds a mismatch, incrementing input errors such as CRC and FCS failures. A steadily rising CRC or FCS error count on the switch port alongside slow throughput strongly supports a duplex mismatch diagnosis.

Why this answer

A duplex mismatch produces collisions on the half-duplex side while the full-duplex side keeps transmitting, corrupting frames in flight. The two clearest confirmations are late collisions counted on the half-duplex interface and CRC or FCS errors counted on received frames. Both counters rise steadily under load, and throughput drops because corrupted frames must be retransmitted by upper-layer protocols.

Exam trap

The trap here is treating any interface error counter as proof of a duplex mismatch, when only late collisions and CRC or FCS errors specifically fit that failure mode.

Practice this question →
50
MCQmedium

Refer to the exhibit. A technician is investigating why a device connected to FastEthernet0/1 cannot communicate. Based on the output, what is the most likely issue?

A.The cable is disconnected or the remote device is powered off.
B.There is a Layer 2 framing or protocol mismatch.
C.The interface has been manually disabled by an administrator.
D.The IP address has not been assigned to the interface.
AnswerB

When an interface is 'up' but the protocol is 'down', it indicates that the physical connection is good, but the switch cannot communicate at the Data Link layer. This can be caused by mismatched VLANs on a trunk, speed/duplex negotiation failures, or incompatible encapsulation settings between the two connected devices.

Why this answer

The 'up/down' status on a Cisco interface specifically points to a Layer 2 problem. This means the physical layer (Layer 1) is sensing a signal, but the data link layer (Layer 2) cannot establish a connection. Common causes include encapsulation mismatches, lack of keepalives, or specific protocol failures like spanning-tree blocking the port.

Exam trap

Candidates often confuse 'up/down' with a physical cable break. They assume Layer 1 is the issue, failing to recognize that 'up/down' confirms physical signal exists but the data link layer handshake failed.

Practice this question →
51
MCQhard

A technician is troubleshooting a wireless client that associates successfully with an access point but cannot obtain an IP address from the DHCP server on the wired network. The access point is configured with a management IP on the correct VLAN, and other wired clients on that VLAN obtain leases normally. Which is the MOST likely cause?

A.The access point's radio is operating on a channel with high interference from neighboring APs.
B.The DHCP server's scope for the wired VLAN has run out of available leases.
C.The wireless client is associated to an SSID mapped to a VLAN that is not trunked to the access point.
D.The wireless client has an incorrect DNS server address configured manually.
AnswerC

An access point can associate a client on an SSID even when the VLAN mapped to that SSID is not carried on the uplink trunk. Association happens at Layer 2 over the radio, but DHCP requires the client's broadcast to traverse the trunk into the correct VLAN. If that VLAN is missing from the trunk, DHCP requests never reach the server, and the client falls back to an APIPA address.

Why this answer

When a wireless client associates but never receives a DHCP lease while wired clients on the same VLAN work, the fault lies between the access point and the wired network. The most common cause is that the VLAN mapped to the SSID is not allowed on the trunk uplink, so the client's broadcast DHCP request cannot reach the server. Verifying the trunk configuration resolves the issue.

Exam trap

The trap here is blaming the DHCP server or the wireless radio, when successful association with failed DHCP on one VLAN points to the trunk carrying that VLAN.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Diagnosing Problems questions.

Start 20-question session