Infrastructure practice questions

Access Layer

Why it fails: The access layer connects end devices to the network. It focuses on port density, security, and initial traffic tagging, rather than providing the high-speed backbone switching required for connecting major network segments within the enterprise architecture.

Distribution Layer

Why it fails: The core layer is the backbone, but the distribution layer performs routing and policy enforcement. In many designs, the core is responsible for high-speed transport, acting as the high-capacity conduit that links the distribution blocks together for efficient global traffic transit.

Edge Layer

Why it fails: The edge layer typically refers to the boundary where the enterprise network meets an external provider, such as the internet. It focuses on security, NAT, and external connectivity rather than serving as the high-speed internal backbone for the entire company.

Cat 3 UTP

Why it fails: Cat 3 is rated for 10 Mbps and was designed for voice-grade cabling, so it cannot carry 1 Gbps at any useful distance. It is also unshielded and would be just as vulnerable to the ballast interference as any other UTP cable. This option fails both the bandwidth and the interference- immunity requirements of the scenario.

Cat 5e UTP

Why it fails: Cat 5e UTP supports 1 Gbps up to 100 meters, so the distance is fine, but the unshielded twisted pairs offer no protection against the electromagnetic interference produced by the fluorescent ballasts. In this shared tray the signal can be corrupted, causing CRC errors and retransmissions. A shielded or fiber solution is required instead.

Cat 6a UTP

Why it fails: Cat 6a UTP handles 10 Gbps to 100 meters and would meet the bandwidth need, yet it remains unshielded. Because the cable tray contains fluorescent ballasts that radiate EMI, the twisted pairs can still pick up noise and produce frame errors. Distance and bandwidth are satisfied, but the interference requirement is not.

1000BASE-SX

Why it fails: 1000BASE-SX is a Gigabit Ethernet standard that operates over multimode fiber optic cabling, not twisted-pair copper. It supports full-duplex and is used for short-range fiber connections. Since the scenario specifies twisted-pair copper, this standard is not appropriate. It does not meet the cabling requirement.

100BASE-TX

Why it fails: 100BASE-TX is a Fast Ethernet standard that operates over twisted-pair copper (Category 5). It supports full-duplex but only provides 100 Mbps, which is not considered high-speed for modern small office networks. While it uses copper, the requirement for high-speed connections implies Gigabit or higher, so this standard does not meet the performance criteria.

100BASE-FX

Why it fails: 100BASE-FX is a Fast Ethernet standard that operates over fiber optic cabling, not twisted-pair copper. It supports full-duplex but requires multimode fiber and is used for longer distances. Since the requirement specifies twisted-pair copper, this standard does not meet the criteria. It is not suitable for the described scenario.

The workstation's network interface card is disabled.

Why it fails: If the workstation's NIC were disabled, the switch port would likely show 'down' for both physical and line protocol status because no link would be established. The output indicates that the physical layer is up, so the NIC is not disabled. Therefore, this is not the cause.

There is a speed or duplex mismatch between the switch port and the workstation.

Why it fails: A speed or duplex mismatch typically results in the interface being 'up' with line protocol 'up', but with errors such as late collisions or FCS errors. The line protocol would not go down solely due to a mismatch. Thus, this is unlikely to cause the line protocol to be down.

The cable is faulty or not connected properly.

Why it fails: If the cable were faulty or disconnected, the interface would show 'down' in both the physical and line protocol status. The output shows 'up' for the physical layer, indicating that the cable and physical connection are functional. Therefore, a cable issue is not the cause of the line protocol being down.

255.255.255.192

Why it fails: A /26 mask yields 62 usable host addresses, which is more than the 45 required, but the goal is to conserve addresses by choosing the smallest mask that still fits. The /27 provides 30 usable addresses, which is too few. This mask works technically but wastes 17 addresses compared with the smaller option.

255.255.255.0

Why it fails: A /24 mask provides 254 usable host addresses, easily supporting 45 hosts, but it allocates an entire Class C block and wastes more than 200 addresses. For a small branch subnet this is inefficient and ignores the instruction to conserve addressing space. It is valid but not the smallest mask that satisfies the host requirement.

255.255.255.128

Why it fails: A /25 mask provides 126 usable host addresses, which does accommodate 45 hosts, but it consumes half of a /24 block and wastes far more addresses than necessary. The requirement is to conserve addresses with the smallest mask that still fits, so this oversized subnet does not meet the design intent even though it functions.

ip address negotiated

Why it fails: This command is used on interfaces such as PPP or IPsec tunnels where the address is negotiated by the link-layer protocol rather than by DHCP. It is not the correct mechanism for an Ethernet handoff from an ISP that offers DHCP. Using it on an Ethernet interface would not produce a valid address.

ip dhcp pool

Why it fails: This command, entered in global configuration mode, creates a DHCP server pool that the router uses to hand out addresses to clients. The scenario requires the router to receive an address from the provider, which is the opposite role. Configuring a server pool does not address the WAN interface itself.

ip helper-address

Why it fails: This command forwards broadcast DHCP requests from clients on a local subnet to a remote DHCP server. It is used to relay requests, not to make the router itself a client that obtains an address. On an ISP-facing interface it would not configure the interface's own addressing, so it does not satisfy the requirement.

Verify that the interface is not administratively shut down.

Why it fails: An administratively shut down interface would show 'administratively down' in the status, not 'notconnect'. 'Notconnect' indicates that the physical layer is not detecting a link, often due to cabling or hardware issues. Checking the administrative state is a valid step but does not match the observed status message.

Configure the interface speed and duplex settings to match on both switches.

Why it fails: While a speed/duplex mismatch can cause link issues, the status 'notconnect' typically indicates a physical layer problem, such as no signal or a faulty cable. Speed and duplex mismatches usually result in a link that comes up but performs poorly, with errors. Therefore, this is not the first action to take for a 'notconnect' status.

Replace the straight-through cable with a crossover cable.

Why it fails: A crossover cable is traditionally used to connect similar devices like switch-to-switch, but auto-MDIX on both switches automatically detects and compensates for the cable type. Replacing the cable would not address the root cause if auto-MDIX is functioning. The issue is more likely a speed/duplex mismatch or a faulty port, not the cable pinout.

switchport port-security switchport port-security mac-address 00:1A:2B:3C:4D:5E switchport port-security violation shutdown

Why it fails: This sequence enables port security and statically configures the allowed MAC address, but it does not set the maximum number of MAC addresses to 1. Without 'switchport port-security maximum 1', the default maximum is 1, so it might work, but the violation mode is set to shutdown, which meets the requirement. However, the missing maximum command is not required because the default is 1. Actually, the command 'switchport port-security mac-address' alone does not restrict to only that MAC unless maximum is set to 1. The default maximum is 1, so it is correct. But wait, the correct answer is B, which includes 'switchport port-security maximum 1' explicitly. This option is incomplete because it lacks the maximum command, but since default is 1, it could work. However, the exam expects explicit configuration. This option is considered incorrect because it does not explicitly set the maximum, which could lead to confusion if defaults change. The violation shutdown is correct.

switchport port-security switchport port-security mac-address sticky 00:1A:2B:3C:4D:5E switchport port-security violation restrict

Why it fails: This sequence enables port security and uses the sticky option to dynamically learn the MAC address, but sticky learning allows the first MAC seen to be added to the running configuration. It does not guarantee that only the specified MAC is allowed; if a different MAC connects first, it would be learned. Also, the violation mode is restrict, which drops packets but does not shut down the interface, contrary to the requirement.

switchport port-security switchport port-security maximum 2 switchport port-security mac-address 00:1A:2B:3C:4D:5E switchport port-security violation shutdown

Why it fails: This sequence sets the maximum number of MAC addresses to 2, which would allow one additional MAC address beyond the specified one. The requirement is to allow only the specified MAC, so setting maximum to 2 is incorrect. The violation shutdown is correct, but the maximum value allows unauthorized devices, defeating the purpose.

Coaxial cable with half-duplex settings

Why it fails: Coaxial cabling is largely obsolete for modern desktop connectivity and inherently supports half-duplex operations through shared media. This approach forces nodes to contend for access, leading to collisions and poor performance in a switched architecture, which is contrary to current industry standard practices.

Fiber optic cable with half-duplex settings

Why it fails: Fiber optic media is capable of full-duplex transmission, but configuring it for half-duplex is technically counterproductive. Half-duplex modes on any medium introduce contention, requiring CSMA/CD mechanisms that limit efficiency and throughput compared to full-duplex configurations on modern switched Ethernet interfaces.

Category 3 twisted-pair cable with full-duplex settings

Why it fails: Category 3 cabling is restricted to low data rates and is insufficient for modern enterprise gigabit requirements. While it supports full-duplex, its bandwidth limitations make it unsuitable for current workstation connections, leading to significant performance bottlenecks and potential incompatibility with modern 1000BASE-T switch ports.

Layer 2 Switch

Why it fails: Layer 2 switches utilize MAC addresses to forward frames within a single broadcast domain or VLAN. They lack the logic to inspect IP header information, meaning they cannot route traffic between disparate subnets, which prevents communication between different network segments without external assistance.

Hub

Why it fails: A hub is a physical layer device that broadcasts incoming signals to all ports indiscriminately. It has no intelligence to process addressing, making it incapable of routing or segmenting traffic, which results in excessive collisions and poor performance in any modern networked environment.

Repeater

Why it fails: Repeaters are designed strictly for signal regeneration over long cable distances. They do not possess any routing capabilities or frame-processing intelligence, meaning they cannot translate traffic between subnets or perform any logic required to route data across different network segments.

Calculating the best path based on IP addresses

Why it fails: IP path calculation is a Layer 3 operation performed by routers using routing protocols and tables. Switches do not process IP headers for path selection, as they are concerned with local frame delivery via MAC addresses rather than global network routing logic.

Translating between different network topologies

Why it fails: Network topology translation is not a standard function of a Cisco switch. Switches manage physical links within the same topology, whereas translation between distinct architectures typically requires a gateway or router to handle protocol conversions and packet structure differences at higher layers.

Encapsulating data packets into segments

Why it fails: Packet encapsulation into segments is a Transport layer function, typically associated with TCP or UDP protocols. Data Link layer devices deal specifically with frame encapsulation, which wraps packets in headers containing source and destination MAC addresses for local transmission.

Source MAC address

Why it fails: Routers ignore source MAC addresses during the packet forwarding process, as these addresses are rewritten at every hop. Forwarding decisions rely strictly on the destination IP address, which provides the necessary context for the router to consult its routing table effectively.

Switching fabric capacity

Why it fails: Switching fabric capacity affects the overall performance and throughput of the device, but it does not influence the logic of path selection for individual packets. Forwarding decisions are based on the routing table contents, not the underlying hardware's theoretical bandwidth limits.

VLAN Trunking Protocol

Why it fails: VTP is a protocol used for propagating VLAN information across switches. It does not offer any port-level security or device restriction capabilities, making it irrelevant for preventing unauthorized access to specific physical ports in an enterprise environment.

Spanning Tree Protocol

Why it fails: Spanning Tree Protocol is designed to prevent Layer 2 loops in a switched network. While it is essential for availability, it does not provide mechanisms to restrict or authorize individual devices attempting to connect to physical switch ports.

Dynamic ARP Inspection

Why it fails: Dynamic ARP Inspection validates ARP packets in the network to prevent man-in-the-middle attacks. While it is a security feature, it does not manage physical port access or prevent unrecognized devices from obtaining a link-level connection to the switch.

Increased physical cabling requirements

Why it fails: VLANs actually decrease the need for physical cabling by allowing users in different locations to belong to the same logical segment. Implementing VLANs simplifies the physical infrastructure, as logical grouping is handled by software configuration on the switches themselves.

Automatic encryption of all traffic

Why it fails: VLANs provide isolation but do not encrypt data. Traffic between VLANs is typically routed in clear text unless higher-layer security protocols like IPsec or TLS are implemented. Relying on VLANs for encryption is a common misconception that creates significant security vulnerabilities.

Elimination of the need for routers

Why it fails: VLANs do not eliminate the need for routers; in fact, they necessitate inter-VLAN routing for communication between segments. Because each VLAN is a distinct subnet, a Layer 3 device is required to facilitate traffic flow between them, making routers essential.

Shielded Twisted Pair (STP)

Why it fails: While STP offers better protection than UTP, it still relies on electrical signals over copper. It is susceptible to ground loops and signal degradation over long distances, making it inferior to fiber optics for long-haul enterprise backbone applications where performance and noise immunity are critical.

Unshielded Twisted Pair (UTP)

Why it fails: UTP is the industry standard for indoor desktop connectivity, but it is highly vulnerable to EMI and has strict distance limitations of 100 meters. It is unsuitable for long-distance links or environments with significant electrical noise, as signal integrity will quickly collapse.

Coaxial Cable

Why it fails: Coaxial cable is capable of shielding against interference, but it is bulky, difficult to install, and has limited bandwidth compared to modern fiber optics. It is generally not used in contemporary enterprise LAN backbones for high-speed, long-distance data transmission purposes.

To resolve domain names to IP addresses

Why it fails: Domain name resolution is the responsibility of a DNS server. The default gateway provides physical path forwarding for packets, not the translation of user-friendly names into numerical addresses, which is an entirely different application-layer process handled by specialized network services.

To manage the local broadcast domain traffic

Why it fails: The default gateway does not manage local broadcast traffic. Broadcast traffic is handled by the local switch fabric. The gateway's sole purpose is to act as a bridge for traffic destined for remote networks that exist outside the current broadcast domain.

To perform dynamic IP address assignment

Why it fails: Dynamic IP assignment is performed by a DHCP server. The default gateway is a static or protocol-assigned address for routing, not for the configuration or distribution of IP addresses to network hosts, which is handled by centralized DHCP services.

Telnet

Why it fails: Telnet sends all data, including usernames and passwords, in plain text. It is considered highly insecure for modern network management. Using Telnet exposes the infrastructure to credential interception, making it a critical security risk in any production network that requires protected management traffic.

ICMP

Why it fails: ICMP is a diagnostic protocol used for connectivity testing, such as ping and traceroute. It does not provide an interface for device management or configuration, and it is not intended for administrative terminal access to Cisco network equipment operating systems.

SMTP

Why it fails: SMTP is a protocol used exclusively for sending emails. It has no role in the remote management of network devices or the execution of CLI commands, making it completely irrelevant to the secure administration of Cisco routers and switches.

To forward frames as soon as the destination address is read

Why it fails: Forwarding frames based on the destination address alone is known as 'cut-through' switching. This method prioritizes speed over integrity, as it does not check the frame for errors, which can result in the propagation of corrupted data throughout the network infrastructure.

To route packets between different IP subnets

Why it fails: Switching methods, including store-and-forward, operate strictly at the Data Link layer for frame delivery. Routing between subnets is a Layer 3 operation performed by processors or specialized hardware, entirely independent of the frame-buffering process used by switches to move frames.

To provide high-speed connections for wireless access

Why it fails: Switching methods are independent of the network access type, whether wired or wireless. Store-and-forward is a frame-processing technique used by switches to improve reliability, and it is not specifically designed for wireless access or any other specific end-user device connectivity.

Broadcast storm suppression

Why it fails: Broadcast storm suppression is a safety feature that limits the volume of broadcast traffic, but it is not the mechanism that prevents loops. STP actively blocks ports to stop loops from forming in the first place, whereas suppression merely mitigates the symptoms of an existing loop.

Source MAC address learning

Why it fails: MAC address learning is the standard process for building a forwarding table. It does not prevent loops; in fact, redundant links without STP cause MAC table instability, leading to frame duplication and network saturation as the switch receives the same address from multiple ports simultaneously.

Packet TTL expiration

Why it fails: Time-to-Live (TTL) is a Layer 3 field used to prevent packets from looping indefinitely in a routed network. It has no effect on Layer 2 frames, which do not contain a TTL field, meaning Layer 2 loops require a protocol like STP for mitigation.

Configure a dedicated management VLAN on the primary production access switches with restricted access control lists.

Why it fails: Utilizing a production VLAN shares the identical physical forwarding hardware and switch backplane as user traffic. This exposes management sessions to denial-of-service vulnerabilities, spanning-tree recalculation disruptions, and broadcast storms that can isolate network administrators during critical outages.

Implement Virtual Routing and Forwarding instances inside the core routing layer for carrying all administrative terminal sessions.

Why it fails: Virtual Routing and Forwarding isolates control and data planes logically inside the software architecture, but devices still share physical links and hardware ASICs. A physical link failure or interface buffer exhaustion on the shared medium will disrupt the isolated routing instance.

Tunnel all interactive administrative SSH sessions through high-priority IP Service Level Agreements and weighted fair queuing.

Why it fails: Quality of service mechanisms prioritize traffic queues on active interfaces, but they cannot protect management access if the underlying physical interface experiences total hardware failure, fiber cuts, or complete power loss affecting the active forwarding line cards.