Network Fundamentals practice questions

A network engineer is troubleshooting slow connectivity between two sites connected via a WAN link. The engineer suspects packet loss due to collisions. Which interface counter should be examined to confirm this?

Trap 1: Runts

Runts are frames smaller than 64 bytes, not collision-specific.

Trap 2: Output errors

Output errors are a general category, not specific to collisions.

Trap 3: Giants

Giants are frames larger than maximum size, not collision-specific.

A
Runts
Why wrong: Runts are frames smaller than 64 bytes, not collision-specific.
B
CRC errors
CRC errors indicate frame checksum failures often caused by collisions.
C
Output errors
Why wrong: Output errors are a general category, not specific to collisions.
D
Giants
Why wrong: Giants are frames larger than maximum size, not collision-specific.

Question 2hardmultiple choice

A DevOps team is deploying a containerized application across multiple hosts. They need to ensure that traffic between containers on the same host is isolated from other tenants. Which network implementation best meets this requirement?

Trap 1: Linux bridge with ebtables rules

Linux bridge lacks native multi-tenant isolation.

Trap 2: NAT with port forwarding

NAT does not provide layer 2 isolation.

Trap 3: 802.1Q VLANs on the host switch

VLANs are limited to single switch and do not scale across hosts.

A
Linux bridge with ebtables rules
Why wrong: Linux bridge lacks native multi-tenant isolation.
B
NAT with port forwarding
Why wrong: NAT does not provide layer 2 isolation.
C
VXLAN overlays with a distributed virtual switch
VXLAN provides scalable network isolation across hosts.
D
802.1Q VLANs on the host switch
Why wrong: VLANs are limited to single switch and do not scale across hosts.

Question 3easymultiple choice

An engineer notices that a switch port configured as an access port in VLAN 10 is not forwarding traffic. The switch shows the port is up/up. What is the most likely cause?

Trap 1: Spanning Tree Protocol blocking the port

STP blocking would show in show spanning-tree.

Trap 2: Speed/duplex mismatch

Would cause errors or down state.

Trap 3: VLAN 10 does not exist in the VLAN database

VLAN 10 would be created automatically if not present.

A
Spanning Tree Protocol blocking the port
Why wrong: STP blocking would show in show spanning-tree.
B
The connected device is sending 802.1Q tagged frames
Access ports drop tagged frames.
C
Speed/duplex mismatch
Why wrong: Would cause errors or down state.
D
VLAN 10 does not exist in the VLAN database
Why wrong: VLAN 10 would be created automatically if not present.

Read the full network assurance explanation →

Question 4mediummultiple choice

A network administrator is configuring SNMPv3 on a router for secure monitoring. Which combination of parameters is required to ensure authentication and encryption?

Trap 1: SNMPv3 with noAuthNoPriv

No security level.

Trap 2: SNMPv3 with authNoPriv

Authentication only.

Trap 3: SNMPv2c with a complex community string

Community strings are sent in plaintext.

A
SNMPv3 with authPriv
Provides authentication and encryption.
B
SNMPv3 with noAuthNoPriv
Why wrong: No security level.
C
SNMPv3 with authNoPriv
Why wrong: Authentication only.
D
SNMPv2c with a complex community string
Why wrong: Community strings are sent in plaintext.

Question 5hardmultiple choice

During a network migration, an engineer needs to replace a legacy core switch with a new one without disrupting the existing STP topology. The new switch supports RSTP and will be connected via two trunk links. Which configuration should be applied to the new switch to prevent it from becoming the root bridge?

Trap 1: Enable root guard on the trunk ports

Root guard protects against inferior BPDUs, does not prevent this switch from becoming root.

Trap 2: Enable BPDU guard on the trunk ports

BPDU guard disables ports if BPDU received, not related to root election.

Trap 3: Set the bridge priority to 0

Priority 0 makes it the root.

A
Enable root guard on the trunk ports
Why wrong: Root guard protects against inferior BPDUs, does not prevent this switch from becoming root.
B
Configure the bridge priority to 61440
High priority makes it less likely to become root.
C
Enable BPDU guard on the trunk ports
Why wrong: BPDU guard disables ports if BPDU received, not related to root election.
D
Set the bridge priority to 0
Why wrong: Priority 0 makes it the root.

Read the full DNS explanation →

Question 6easymultiple choice

A technician needs to verify the IP address of a remote server using DNS. Which command should be used on a Cisco IOS device?

Trap 1: traceroute server.example.com

Traceroute uses DNS but does not explicitly show resolution.

Trap 2: show hosts server.example.com

Show hosts displays static entries, not dynamic lookup.

Trap 3: ping server.example.com

Ping uses DNS but does not show the resolved address.

A
traceroute server.example.com
Why wrong: Traceroute uses DNS but does not explicitly show resolution.
B
show hosts server.example.com
Why wrong: Show hosts displays static entries, not dynamic lookup.
C
ping server.example.com
Why wrong: Ping uses DNS but does not show the resolved address.
D
nslookup server.example.com
Performs DNS lookup and returns IP address.

Question 7mediummultiple choice

A network engineer is designing a data center network with leaf-spine topology. The requirement is to minimize latency and maximize bandwidth for east-west traffic. Which type of links should be used between leaf and spine switches?

Trap 1: Multiple links with VSS

VSS is proprietary and not standard for leaf-spine.

Trap 2: Single link with LACP

LACP bundles ports but still single logical link.

Trap 3: Single link with STP

STP blocks redundant links, reducing bandwidth.

A
Multiple links with VSS
Why wrong: VSS is proprietary and not standard for leaf-spine.
B
Single link with LACP
Why wrong: LACP bundles ports but still single logical link.
C
Multiple parallel links with ECMP routing
ECMP allows all links to be active, increasing bandwidth and reducing latency.
D
Single link with STP
Why wrong: STP blocks redundant links, reducing bandwidth.

Question 8hardmultiple choice

An organization uses Cisco ISE for network access control. A user reports inability to access the network. The switch port shows the authenticator state as 'connecting'. What does this indicate?

Trap 1: The client has successfully authenticated

Success state is 'authenticated'.

Trap 2: The port is in a held state due to multiple failures

Held state is 'auth-fail-vlan' or similar.

Trap 3: Authentication has failed

Failure state is 'failed'.

A
The client is in the process of 802.1X authentication
'Connecting' means authentication is ongoing.
B
The client has successfully authenticated
Why wrong: Success state is 'authenticated'.
C
The port is in a held state due to multiple failures
Why wrong: Held state is 'auth-fail-vlan' or similar.
D
Authentication has failed
Why wrong: Failure state is 'failed'.

Question 9mediummulti select

Which TWO statements are true about VXLAN? (Choose two.)

Trap 1: VXLAN requires MPLS in the underlay

VXLAN can run over any IP network.

Trap 2: VXLAN uses IP-in-IP encapsulation

VXLAN uses MAC-in-UDP.

Trap 3: VXLAN operates at Layer 2 only

VXLAN is an overlay over Layer 3.

A
VXLAN requires MPLS in the underlay
Why wrong: VXLAN can run over any IP network.
B
VXLAN encapsulates Ethernet frames in UDP packets
VXLAN uses UDP encapsulation.
C
VXLAN uses IP-in-IP encapsulation
Why wrong: VXLAN uses MAC-in-UDP.
D
VXLAN operates at Layer 2 only
Why wrong: VXLAN is an overlay over Layer 3.
E
VXLAN supports up to 16 million logical networks
24-bit VNI provides 16 million segments.

Review the full OSPF breakdown →

Question 10hardmulti select

Which THREE factors influence the convergence time of OSPF in a large enterprise network? (Choose three.)

Trap 1: Bidirectional Forwarding Detection (BFD) implementation

BFD is not part of OSPF itself.

Trap 2: DUAL algorithm processing time

DUAL is used by EIGRP, not OSPF.

A
CPU processing power for SPF calculations
SPF computation time affects convergence.
B
Hello and dead interval timers
Shorter timers speed failure detection.
C
Bidirectional Forwarding Detection (BFD) implementation
Why wrong: BFD is not part of OSPF itself.
D
DUAL algorithm processing time
Why wrong: DUAL is used by EIGRP, not OSPF.
E
LSA propagation delay across the network
Flooding LSAs takes time.

Question 11easymulti select

Which TWO functions are performed by the data plane in a network device? (Choose two.)

Trap 1: Building the routing table using OSPF

Control plane function.

Trap 2: Maintaining ARP cache entries

Control plane function.

Trap 3: Establishing OSPF neighbor adjacencies

Control plane function.

A
Building the routing table using OSPF
Why wrong: Control plane function.
B
Forwarding packets based on destination MAC address
Data plane performs forwarding.
C
Applying ACLs to permit or deny traffic
Data plane performs packet filtering.
D
Maintaining ARP cache entries
Why wrong: Control plane function.
E
Establishing OSPF neighbor adjacencies
Why wrong: Control plane function.

Question 12mediummultiple choice

An engineer configures a trunk port as shown. A device connected to this port sends an untagged frame. Which VLAN will the switch associate the frame with?

Exhibit

Refer to the exhibit.
```
interface GigabitEthernet0/1
 switchport mode trunk
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,30
```

Trap 1: VLAN 1

Native VLAN is configured as 99.

Trap 2: The frame is dropped

Untagged frames are accepted on trunk.

Trap 3: VLAN 10

Only tagged frames use allowed VLANs.

A
VLAN 1
Why wrong: Native VLAN is configured as 99.
B
The frame is dropped
Why wrong: Untagged frames are accepted on trunk.
C
VLAN 10
Why wrong: Only tagged frames use allowed VLANs.
D
VLAN 99
Untagged frames are placed in native VLAN.

Review the full OSPF breakdown →

Question 13hardmultiple choice

Based on the routing table, what type of OSPF route is the default route (0.0.0.0/0)?

Exhibit

Refer to the exhibit.
```
R1# show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route

Gateway of last resort is 10.0.0.1 to network 0.0.0.0

O*E2 0.0.0.0/0 [110/1] via 10.0.0.1, 00:00:34, GigabitEthernet0/0
O    10.0.0.0/8 [110/2] via 10.0.0.1, 00:00:34, GigabitEthernet0/0
O    172.16.0.0/16 [110/3] via 192.168.1.1, 00:00:34, GigabitEthernet0/1
C    192.168.1.0/24 is directly connected, GigabitEthernet0/1
```

Trap 1: OSPF inter-area route

Inter-area routes show as O IA.

Trap 2: OSPF NSSA external type 1 route

NSSA routes display as N1 or N2.

Trap 3: OSPF intra-area route

Intra-area routes show as O without asterisk.

A
OSPF inter-area route
Why wrong: Inter-area routes show as O IA.
B
OSPF NSSA external type 1 route
Why wrong: NSSA routes display as N1 or N2.
C
OSPF intra-area route
Why wrong: Intra-area routes show as O without asterisk.
D
OSPF external type 2 route
O*E2 indicates external type 2 default.

Open the full BGP breakdown →

Question 14hardmultiple choice

A company has a three-tier data center architecture with access, aggregation, and core layers. The network team is migrating to a leaf-spine architecture to support increasing east-west traffic. The current network uses STP for loop prevention, and the team wants to eliminate STP in the new design. They plan to use VXLAN overlays with BGP EVPN for control plane. During a pilot deployment, the team notices that some legacy servers that rely on traditional VLANs are not reachable across the new fabric. The servers are connected to access switches that are part of the leaf layer. The access switches are configured as VXLAN tunnel endpoints (VTEPs) but the legacy servers are still using traditional VLANs. The team needs to ensure connectivity between the legacy VLAN-based servers and the new VXLAN-based network. What is the best approach to integrate these legacy servers without changing their configuration?

Trap 1: Create a separate VRF for legacy VLANs and redistribute into BGP…

This adds complexity and does not solve L2 connectivity.

Trap 2: Configure the same VLAN on all leaf switches and use VXLAN to…

Stretching VLANs is not recommended for large fabrics.

Trap 3: Reconfigure the legacy servers to use VXLAN encapsulation

Server configuration change is to be avoided.

A
Create a separate VRF for legacy VLANs and redistribute into BGP EVPN
Why wrong: This adds complexity and does not solve L2 connectivity.
B
Implement a Layer 2 gateway (L2GW) on the leaf switches to bridge VLANs to VXLAN using IRB
IRB provides seamless bridging between VLAN and VXLAN.
C
Configure the same VLAN on all leaf switches and use VXLAN to stretch the VLAN across the fabric
Why wrong: Stretching VLANs is not recommended for large fabrics.
D
Reconfigure the legacy servers to use VXLAN encapsulation
Why wrong: Server configuration change is to be avoided.

Question 15mediummultiple choice

A university campus network uses Cisco switches with 802.1X for wired authentication. Recently, users in a dormitory report intermittent connectivity: they can connect initially but are disconnected after a few minutes. The network team checks the switch logs and sees messages like 'Authentication failure for MAC address xxxx.xxxx.xxxx on port GigabitEthernet1/0/5' but the users claim they are using valid credentials. The same users can connect from other ports without issues. The port configuration for Gi1/0/5 is: switchport mode access, authentication port-control auto, dot1x pae authenticator, authentication periodic, authentication timer reauthenticate 3600. The team suspects a misconfiguration. What is the most likely cause of the intermittent disconnections?

Trap 1: The port is a trunk port but configured as access, causing VLAN…

Port is access mode.

Trap 2: The port is configured in multi-auth host mode, causing conflicts

Host mode not shown; default is single-host.

Trap 3: The switch is using MAC authentication bypass (MAB) as a fallback,…

MAB is not configured in the snippet.

A
The port is a trunk port but configured as access, causing VLAN mismatch
Why wrong: Port is access mode.
B
The port is configured in multi-auth host mode, causing conflicts
Why wrong: Host mode not shown; default is single-host.
C
The 'authentication periodic' command forces reauthentication every 3600 seconds, and the client fails to reauthenticate
Periodic reauthentication can cause disconnections if client fails.
D
The switch is using MAC authentication bypass (MAB) as a fallback, which fails for some devices
Why wrong: MAB is not configured in the snippet.

Question 16mediummulti select

A network engineer is troubleshooting an issue where hosts in VLAN 100 cannot reach a server at 10.1.1.100. The switch interfaces are configured as access ports in VLAN 100, and the default gateway is 10.1.1.1. The engineer checks the switch and finds that the ARP table does not contain the server's MAC address. Which two actions should the engineer take to resolve the issue? (Choose two.)

Trap 1: Ping the server's IP address from the switch management interface.

The switch management interface may be in a different VLAN, so this does not test the specific VLAN 100 path.

Trap 2: Ping the default gateway from a host in VLAN 100.

This checks Layer 3 connectivity but does not directly address the missing ARP entry for the server.

Trap 3: Check the MAC address table on the switch for the server's MAC.

The MAC address table shows Layer 2 paths, but the issue is ARP resolution which is Layer 3.

A
Ping the server's IP address from the switch management interface.
Why wrong: The switch management interface may be in a different VLAN, so this does not test the specific VLAN 100 path.
B
Ping the default gateway from a host in VLAN 100.
Why wrong: This checks Layer 3 connectivity but does not directly address the missing ARP entry for the server.
C
Check the ARP table on the default gateway router.
The hosts need to resolve the server's MAC, not the gateway's. The issue is on the switch or host side.
D
Check the MAC address table on the switch for the server's MAC.
Why wrong: The MAC address table shows Layer 2 paths, but the issue is ARP resolution which is Layer 3.
E
Verify that the switch port connected to the server is in VLAN 100.
If the server is on an access port in a different VLAN, the hosts in VLAN 100 cannot reach it.

Question 17hardmultiple choice

Refer to the exhibit. A switch is configured with the shown trunk port. After connecting the uplink, the switch logs show repeated 'errdisable' state transitions on this port. The core switch is configured with the same allowed VLAN list. Which configuration change is most likely to resolve the issue?

Exhibit

Refer to the exhibit.

"""
interface GigabitEthernet0/1
 description Uplink to Core
 switchport mode trunk
 switchport trunk allowed vlan 10,20,30
 spanning-tree portfast trunk
"""

Trap 1: Change the switchport mode to dynamic desirable.

The core is likely configured as trunk, so dynamic desirable may cause negotiation issues, not errdisable.

Trap 2: Add VLAN 1 to the allowed VLAN list.

VLAN 1 is native by default and does not need to be explicitly allowed; adding it would not fix errdisable.

Trap 3: Add the spanning-tree bpduguard enable command to the interface.

BPDU guard would disable the port if it receives BPDUs, which is normal on a trunk to another switch, worsening the issue.

A
Change the switchport mode to dynamic desirable.
Why wrong: The core is likely configured as trunk, so dynamic desirable may cause negotiation issues, not errdisable.
B
Add VLAN 1 to the allowed VLAN list.
Why wrong: VLAN 1 is native by default and does not need to be explicitly allowed; adding it would not fix errdisable.
C
Remove the spanning-tree portfast trunk command from the interface.
Portfast trunk is designed for host-facing trunks (e.g., to servers) and can cause STP issues when connecting to another switch.
D
Add the spanning-tree bpduguard enable command to the interface.
Why wrong: BPDU guard would disable the port if it receives BPDUs, which is normal on a trunk to another switch, worsening the issue.

Question 18easymulti select

A network administrator is deploying a new application that requires high availability and load balancing across multiple servers. The servers are connected to a pair of switches that use StackWise virtual technology. The application team requests that the servers be configured with NIC teaming in active-active mode. Which two requirements must be met for this configuration to work correctly? (Choose two.)

Trap 1: Spanning-tree PortFast must be enabled on the switch ports…

PortFast is not required and may cause issues if BPDUs are expected.

Trap 2: The NIC team must use LACP for load balancing.

LACP is optional; static aggregation can also be used.

Trap 3: Both NIC team members should connect to the same switch module for…

For redundancy, they should connect to different switch modules.

A
The two switches must be part of a single stack or virtual switch fabric.
This allows the NIC team to see the two switches as one logical switch and use both links simultaneously.
B
Spanning-tree PortFast must be enabled on the switch ports connected to the servers.
Why wrong: PortFast is not required and may cause issues if BPDUs are expected.
C
Both NIC team members must be configured in the same VLAN.
Active-active teaming requires both links to belong to the same VLAN to avoid traffic asymmetry.
D
The NIC team must use LACP for load balancing.
Why wrong: LACP is optional; static aggregation can also be used.
E
Both NIC team members should connect to the same switch module for consistency.
Why wrong: For redundancy, they should connect to different switch modules.

Question 19mediumdrag order

Drag and drop the steps to configure a Cisco switch for remote management (SSH) into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 20mediummatching