Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 1Question →

A network security administrator is deploying a site-to-site IPsec VPN tunnel between two corporate edge routers across a private WAN. The security policy requires data confidentiality and integrity for the IP payload. To minimize encapsulation overhead, the design mandates retaining the original IP packet header rather than encapsulating the packet with an additional new IP header. Which IPsec protocol and mode combination fulfills these requirements?

Show answer & explanation

Answer: Encapsulating Security Payload (ESP) in transport mode

Answer

Encapsulating Security Payload (ESP) in transport mode
Encapsulating Security Payload (ESP) provides confidentiality through data encryption as well as data integrity and origin authentication. In transport mode, ESP encrypts only the IP payload while keeping the original IP header intact, satisfying both the security policy for confidentiality and the constraint to minimize packet overhead.

Step-by-Step Solution

1
Identify the protocol requirement for data confidentiality and integrity.
Encapsulating Security Payload (ESP) must be selected because Authentication Header (AH) does not support encryption (confidentiality).
AH provides integrity and authentication only, whereas ESP provides encryption, integrity, and authentication.
2
Determine the operational mode based on IP header overhead constraints.
Transport mode must be used rather than tunnel mode.
Transport mode encrypts only the payload and retains the original IP header, avoiding the extra overhead of adding a new outer IP header as required in tunnel mode.

Key Concept

IPsec Security Protocols (AH vs ESP) and Operational Modes (Transport vs Tunnel)
Question 2Question →

A network administrator is troubleshooting a DHCP relay issue on a Cisco IOS router. Host devices on VLAN 30 (172.16.30.0/24172.16.30.0/24) use subinterface GigabitEthernet0/0.30 (172.16.30.1172.16.30.1) as their default gateway. The centralized DHCP server is located at 10.10.10.5010.10.10.50, connected off router interface GigabitEthernet0/1 (10.10.10.110.10.10.1).

Packet captures at the DHCP server reveal that incoming relayed DHCP DISCOVER messages contain a Relay Agent IP Address (`giaddr`) of 10.10.10.110.10.10.1 instead of 172.16.30.1172.16.30.1. Consequently, the DHCP server fails to assign addresses from the intended 172.16.30.0/24172.16.30.0/24 pool.

Which router misconfiguration causes the `giaddr` field to be set to 10.10.10.110.10.10.1?

Show answer & explanation

Answer: The `ip helper-address 10.10.10.50` command was incorrectly applied to interface GigabitEthernet0/1 instead of subinterface GigabitEthernet0/0.30.

Answer

The `ip helper-address 10.10.10.50` command was incorrectly applied to interface GigabitEthernet0/1 instead of subinterface GigabitEthernet0/0.30.
When a Cisco router acts as a DHCP relay agent, it listens for broadcast UDP port 67 messages on interfaces configured with `ip helper-address <server_ip>`. When a DISCOVER packet is received on such an interface, the router converts the broadcast to a unicast packet sent to the helper IP and populates the `giaddr` (Gateway IP Address) field with the primary IP address of the INCOMING interface. Because `giaddr` was set to 10.10.10.110.10.10.1, the `ip helper-address` command was erroneously placed on interface GigabitEthernet0/1. Moving the command to GigabitEthernet0/0.30 ensures `giaddr` is populated as 172.16.30.1172.16.30.1, allowing the DHCP server to allocate from the correct 172.16.30.0/24172.16.30.0/24 pool.

Step-by-Step Solution

1
Analyze how a Cisco IOS DHCP Relay Agent populates the Relay Agent IP Address (`giaddr`) field.
When a router receives a client broadcast DHCP DISCOVER message on an interface enabled with `ip helper-address`, it sets the `giaddr` field to the primary IP address of the INGRESS interface where the request was received.
The DHCP server uses the `giaddr` field to determine which subnet scope/pool to select for IP address assignment.
2
Evaluate the captured `giaddr` IP address value (10.10.10.110.10.10.1).
10.10.10.110.10.10.1 corresponds to interface GigabitEthernet0/1, which is the egress interface connected to the DHCP server subnet, rather than ingress subinterface GigabitEthernet0/0.30 (172.16.30.1172.16.30.1).
This indicates that the `ip helper-address` command was mistakenly configured under interface GigabitEthernet0/1.
3
Identify the corrective configuration step.
Remove `ip helper-address 10.10.10.50` from interface GigabitEthernet0/1 and place it under subinterface GigabitEthernet0/0.30.
Placing the helper address on GigabitEthernet0/0.30 ensures the router intercepts VLAN 30 client broadcasts and sets `giaddr` to 172.16.30.1172.16.30.1.

Key Concept

DHCP Relay Agent Ingress Interface Binding and giaddr Population
Question 3Question →

Which physical security control uses a set of two interlocking doors to directly prevent unauthorized individuals from tailgating into a secure data center facility?

Show answer & explanation

Answer: A mantrap vestibule

Answer

A mantrap vestibule is the correct physical security control designed specifically to prevent tailgating by utilizing interlocking doors.
A mantrap vestibule features two interlocking doors where only one door can be open at a time. Once a user scans their credentials to enter the first door, that door must close fully before the second door unlocks, isolating individuals and preventing unauthorized tailgating into restricted areas.

Step-by-Step Solution

1
Identify the primary threat described in the scenario.
The target threat is tailgating (piggybacking), where an unauthorized individual physically follows an authorized person through a secure doorway.
Preventing tailgating requires physical barriers capable of enforcing single-person entry verification.
2
Differentiate physical security controls from logical network security controls.
A mantrap vestibule physically holds an individual between two interlocking doors until identity/access is verified. Logical controls (ACLs, AAA, Port Security) operate entirely inside network software/hardware interfaces.
Only physical access controls like mantraps physically constrain human movement at facility entrances.

Key Concept

Physical Access Controls - Mantraps
Question 4Question →

Match each OSPFv2 network type or interface configuration on the left to its corresponding DR/BDR election requirement and default timer profile on the right.

Click a left item, then click its matching right item

Items

Broadcast
Point-to-Point
Point-to-Multipoint
OSPF Interface Priority set to 0

Matches

Show answer & explanation

Answer

Broadcast pairs with DR/BDR election and 10s/40s timers; Point-to-Point pairs with no DR/BDR election and 10s/40s timers; Point-to-Multipoint pairs with no DR/BDR election and 30s/120s timers; Priority 0 explicitly excludes the interface from DR/BDR election.
Broadcast network types perform DR/BDR elections with 10s/40s timers to minimize link-state information flooding across shared multiaccess media. Point-to-Point network types suppress DR/BDR elections since only two endpoints exist, using 10s/40s timers. Point-to-Multipoint network types also suppress DR/BDR elections but use 30s/120s timers suitable for WAN connections. Configuring an OSPF priority of 0 explicitly forces the interface to act strictly as a DROther, avoiding DR or BDR role assignment.

Step-by-Step Solution

1
Identify network types that perform DR/BDR elections
Only Broadcast (and Non-Broadcast Multiaccess / NBMA) network types conduct DR/BDR elections.
Multiaccess segments require a central router (DR) to reduce adjacency overhead from n(n-1)/2 to n-1.
2
Differentiate default Hello and Dead timers among non-DR network types
Point-to-Point uses 10s Hello / 40s Dead timers, whereas Point-to-Multipoint uses 30s Hello / 120s Dead timers.
Point-to-Multipoint is designed for hub-and-spoke topologies where slower timers account for WAN link characteristics.
3
Determine the impact of setting interface priority to 0
An OSPF priority of 0 disqualifies the interface from becoming DR or BDR.
The priority range is 0-255, where 0 explicitly excludes the router from election, keeping it as a DROther regardless of Router ID.

Key Concept

OSPFv2 Network Types and DR/BDR Selection Rules
Question 5Question →

An enterprise network team is replacing standard server deployments with hypervisor-based virtualization. During the architecture review, an engineer explains that Type 1 hypervisors provide superior performance and lower latency for enterprise workloads compared to Type 2 hypervisors. Which architectural feature directly accounts for this performance advantage in Type 1 hypervisors?

Show answer & explanation

Answer: It accesses host hardware components directly without relying on an underlying host operating system.

Answer

The Type 1 hypervisor accesses host hardware components directly without relying on an underlying host operating system.
Type 1 (bare-metal) hypervisors install directly onto physical server hardware without requiring a host operating system. By managing physical hardware resources natively, Type 1 hypervisors eliminate the scheduling overhead and latency inherent to hosted (Type 2) hypervisors.

Step-by-Step Solution

1
Analyze the architecture of Type 1 (bare-metal) hypervisors.
Type 1 hypervisors run directly on physical hardware without a host OS.
Eliminating the host operating system reduces latency and resource overhead, allowing direct hardware interaction for virtual machines.
2
Compare Type 1 architecture with Type 2 (hosted) hypervisors.
Type 2 hypervisors require a host operating system to manage system calls, hardware devices, and memory allocation.
Host OS mediation introduces processing overhead, making Type 2 hypervisors less suitable for high-performance enterprise workloads.

Key Concept

Type 1 vs Type 2 Hypervisor Architecture
Question 6Question →

Which two statements accurately describe Rapid PVST+ port roles and operational port states? (Select two.)

Select all that apply

Show answer & explanation

Answer: An Alternate port maintains a backup path to the root bridge and remains in the Discarding state.; Rapid PVST+ reduces the legacy 802.1D Disabled, Blocking, and Listening states into a single Discarding state.

Answer

An Alternate port maintains a backup path to the root bridge and remains in the Discarding state, and Rapid PVST+ reduces the legacy 802.1D Disabled, Blocking, and Listening states into a single Discarding state.
Rapid PVST+ (802.1w) optimizes Spanning Tree by consolidating the 802.1D Disabled, Blocking, and Listening states into a single Discarding state. Under this model, an Alternate port provides a backup path to the root bridge and stays in the Discarding state during normal operation.

Step-by-Step Solution

1
Identify the port states supported by Rapid PVST+ (802.1w).
Rapid PVST+ consolidates legacy 802.1D port states (Disabled, Blocking, Listening) into a single Discarding state.
This reduces operational complexity and improves convergence time.
2
Analyze the function and state of an Alternate port role in Rapid PVST+.
An Alternate port offers an alternate path to the root bridge and remains discarded (not forwarding traffic) unless the primary root port loses connectivity.
Alternate ports provide rapid failover without needing to undergo standard convergence delays.

Key Concept

Rapid PVST+ Port Roles and Port States
Question 7Question →

A network administrator is deploying a Cisco Lightweight Access Point (AP) connected to a Layer 2 switch port configured as an 802.1Q trunk. The AP is intended to exchange CAPWAP control messages with the Wireless LAN Controller (WLC) management interface over the native VLAN while carrying client traffic on tagged VLANs. Switch syslogs immediately report a 'Native VLAN mismatch' notification on the interface, and the AP fails to join the controller. Which condition explains why management access between the AP and the WLC is failing?

Show answer & explanation

Answer: Untagged CAPWAP discovery and management packets sent by the AP arrive on a mismatched native VLAN at the switch, placing management traffic into an unintended VLAN segment.

Answer

Untagged CAPWAP discovery and management packets sent by the AP arrive on a mismatched native VLAN at the switch, placing management traffic into an unintended VLAN segment.
Cisco Lightweight Access Points transmit their initial CAPWAP discovery and management control traffic as untagged frames by default. When connected to an 802.1Q trunk port, these untagged frames are mapped directly to the switch port's native VLAN. A native VLAN mismatch causes the switch to place the AP's management frames into an incorrect VLAN segment, preventing IP communication with the Wireless LAN Controller (WLC) management interface.

Step-by-Step Solution

1
Identify the transmission mode of AP management and CAPWAP control traffic on an 802.1Q trunk port.
By default, Cisco Lightweight Access Points transmit CAPWAP management packets as untagged frames.
The AP relies on the native VLAN of the connected switchport to process untagged management traffic.
2
Analyze the impact of a Native VLAN mismatch on untagged frames.
When a switch port's native VLAN does not match the configured subnet or opposing link expectation, untagged packets are forwarded onto the incorrect VLAN.
Layer 2 switches assign incoming untagged frames to the port's configured native VLAN.
3
Determine the effect on WLC management access and CAPWAP tunnel establishment.
Because the AP management frames enter the wrong VLAN/IP subnet, IP routing to the WLC management IP fails and the CAPWAP state machine cannot complete.
CAPWAP discovery and join requests require bidirectional IP connectivity between the AP management IP and the WLC management interface IP.

Key Concept

AP and WLC Management Access over 802.1Q Native VLANs
Question 8Question →

Match each Cisco AP and Wireless LAN Controller (WLC) connection type to its corresponding switchport configuration requirement.

Click a left item, then click its matching right item

Items

Cisco AP operating in Local Mode
Cisco AP operating in FlexConnect Mode with local switching
Cisco WLC Management Interface physical connection
Cisco WLC Service Port physical connection

Matches

Show answer & explanation

Answer

Local Mode AP matches Access port assigned to the dedicated AP management VLAN; FlexConnect Mode AP matches 802.1Q trunk port carrying tagged VLANs for local client traffic and a native VLAN for AP management; WLC Management Interface matches 802.1Q trunk port carrying tagged traffic for dynamic interfaces and controller management; WLC Service Port matches Access port isolated for out-of-band controller administration without 802.1Q VLAN tagging.
Each connection type matches its mandatory physical switch port requirement based on whether the link supports single VLAN access, 802.1Q trunking, or isolated out-of-band management.

Step-by-Step Solution

1
Analyze AP traffic modes to determine switchport configuration requirements.
Local mode APs send all client traffic inside CAPWAP tunnels to the WLC, requiring only a single-VLAN access port. FlexConnect APs with local switching forward client frames locally, requiring an 802.1Q trunk port with a native VLAN for CAPWAP management.
Understanding AP deployment modes determines whether single-VLAN access or multi-VLAN trunking is required at the access layer switch.
2
Analyze WLC interface physical connection requirements.
The main WLC distribution system port connects to an 802.1Q trunk port to multiplex controller management and dynamic VLANs. The physical service port connects to an access port dedicated to out-of-band management.
Controller architecture separates in-band multi-VLAN trunking from out-of-band isolated access management.

Key Concept

Switchport Configuration for AP and WLC Management Access Connections
Question 9Question →

Match each Cisco Access Point (AP) mode to its primary operational behavior.

Click a left item, then click its matching right item

Items

Local Mode
FlexConnect Mode
Sniffer Mode
Monitor Mode

Matches

Show answer & explanation

Answer

Local Mode matches default central CAPWAP switching to the WLC; FlexConnect Mode matches branch local traffic switching during normal operation or WAN outage; Sniffer Mode matches capturing over-the-air wireless frames for analysis; Monitor Mode matches functioning strictly as a security sensor without servicing client connections.
Each Cisco AP mode serves a specific operational purpose: Local mode centrally tunnels client data to the controller via CAPWAP, FlexConnect supports local switching for branch offices, Sniffer mode redirects raw 802.11 frames to a network analyzer, and Monitor mode acts purely as a non-client-serving security sensor.

Step-by-Step Solution

1
Identify the role of Local Mode.
Local Mode is the default operational state for Cisco lightweight APs where client data is tunneled back to the central WLC.
Lightweight AP architectures rely on centralized traffic control by default.
2
Identify the role of FlexConnect Mode.
FlexConnect Mode handles remote branch office deployments.
It allows local traffic switching at the access layer without sending all traffic over the WAN back to the central controller.
3
Identify the role of Sniffer Mode.
Sniffer Mode collects packet captures on a configured channel.
It acts as a remote wireless probe for troubleshooting and packet analysis.
4
Identify the role of Monitor Mode.
Monitor Mode performs continuous threat analysis and location services.
The radio refrains from serving client connections so it can constantly cycle through channels to detect rogues and intrusion attempts.

Key Concept

Cisco Wireless Access Point Modes and Operational Behaviors
Question 10Question →

A network administrator is configuring out-of-band management access for a Cisco Wireless LAN Controller (WLC). The administrator connects the WLC Service Port to an isolated management network while connecting the WLC Management Interface to an 802.1Q trunk port on the distribution switch. Which operational characteristic uniquely applies to the Service Port on a Cisco WLC?

Show answer & explanation

Answer: It operates strictly out-of-band, supports only untagged traffic, and maintains a dedicated default gateway separate from the main controller routing table.

Answer

The Service Port operates strictly out-of-band, supports only untagged traffic, and maintains a dedicated default gateway separate from the main controller routing table.
The Cisco WLC Service Port provides dedicated out-of-band management capability. It is completely isolated from the controller's data plane, does not support 802.1Q VLAN tagging (untagged traffic only), and maintains its own independent default gateway settings separate from the controller's main routing table.

Step-by-Step Solution

1
Identify the primary role and architecture of the WLC Service Port.
The Service Port is a dedicated, physical, out-of-band management interface isolated from client and AP CAPWAP traffic.
Out-of-band management ports provide access for administrative GUI/CLI tasks even during main network or controller interface outages.
2
Evaluate framing and encapsulation requirements for the Service Port.
The Service Port only accepts untagged Ethernet frames (802.1Q tagging is not supported).
It connects to an access port on an isolated management network switch.
3
Analyze routing behavior for out-of-band traffic vs in-band traffic.
The Service Port uses a separate, independent default gateway configuration specifically defined for service port management traffic.
Traffic arriving on the Service Port must route back out through its own gateway rather than using the controller's main system routing table.

Key Concept

Cisco WLC Service Port vs Management Interface characteristics
Estimated Time:1m 30s
Question 11Question →

Which Cisco Access Point (AP) mode operates by dedicating its radios to capturing wireless traffic and forwarding all raw 802.11 frames over a CAPWAP tunnel to a specified IP address for analysis by packet analyzer software such as Wireshark?

Show answer & explanation

Answer: Sniffer mode

Answer

Sniffer mode dedicatedly captures raw 802.11 frames on a specified channel and sends them via a CAPWAP tunnel to a designated workstation running network analysis software.
In Sniffer mode, the lightweight access point dedicates its radio to a specific channel, captures all 802.11 wireless traffic, and encapsulates those frames into CAPWAP packets sent to a destination server running a network protocol analyzer.

Step-by-Step Solution

1
Identify the AP mode configured specifically for remote packet capturing.
Sniffer mode allows an engineer to remotely capture wireless frames on a target channel without being physically present with a wireless packet capture card.
When an AP is placed in Sniffer mode, it stops serving clients and redirects all received radio traffic to a specified IP destination for decode and troubleshooting.

Key Concept

Cisco Lightweight AP Operational Modes
Estimated Time:45s
Question 12Question →

A network administrator is configuring a router interface for IPv6 stateless address autoconfiguration (SLAAC) using EUI-64. The interface is assigned the IPv6 prefix 2001:db8:cafe:10::/642001:\text{db8}:\text{cafe}:10::/64 and has a MAC address of B4A9.5A12.3456\text{B4A9.5A12.3456}. Which complete IPv6 global unicast address will be generated for this interface?

Show answer & explanation

Answer: 2001:db8:cafe:10:b6a9:5aff:fe12:3456

Answer

2001:db8:cafe:10:b6a9:5aff:fe12:3456
The address ending in 'b6a9:5aff:fe12:3456' is correct because EUI-64 splits the MAC address B4:A9:5A:12:34:56 into two equal parts, inserts the 16-bit hex value FFFE into the middle, and flips the 7th bit of the first byte (changing 0xB4, which is 1011 0100 binary, into 0xB6, which is 1011 0110 binary).

Step-by-Step Solution

1
Split the MAC address into two 24-bit halves and insert FFFE in the middle.
The MAC address B4:A9:5A : 12:34:56 becomes B4A9:5AFF:FE12:3456.
EUI-64 expands a 48-bit MAC address into a 64-bit interface identifier by inserting the 16-bit hex value FFFE between the OUI and the NIC specific serial number.
2
Invert the 7th bit (Universal/Local bit) of the first byte.
First byte 0xB4 in binary is 1011 0100. Inverting the 7th bit gives 1011 0110, which is 0xB6. The interface ID becomes b6a9:5aff:fe12:3456.
RFC 4291 requires flipping the 7th bit of the first byte to indicate universal scope for IEEE MAC-derived interface identifiers.
3
Combine the /64 network prefix with the generated 64-bit interface identifier.
2001:db8:cafe:10:b6a9:5aff:fe12:3456.
The full IPv6 address is constructed by appending the EUI-64 interface ID to the assigned /64 network subnet prefix.

Key Concept

EUI-64 Interface Identifier Generation
Estimated Time:1m 15s
Question 13Question →

A network administrator is deploying Cisco Lightweight Access Points (APs) operating in Local mode across an enterprise network. The APs must establish CAPWAP tunnels back to a central Wireless LAN Controller (WLC) whose Management interface resides on VLAN 10. The switch ports connected to the APs are configured as access ports assigned to VLAN 20, where an infrastructure DHCP server provides IP addressing along with DHCP Option 43. A junior engineer proposes reconfiguring all AP switch ports as 802.1Q trunk ports with PortFast enabled.

Which statement accurately evaluates this switchport configuration recommendation for Local mode AP access?

Show answer & explanation

Answer: Local mode APs transmit and receive management traffic as untagged frames, making access ports in the AP management VLAN standard; configuring 802.1Q trunks is unnecessary unless FlexConnect mode with local VLAN mapping is used.

Answer

Local mode APs transmit and receive management traffic as untagged frames, making access ports in the AP management VLAN standard; configuring 802.1Q trunks is unnecessary unless FlexConnect mode with local VLAN mapping is used.
In Cisco centralized wireless architecture, an AP in Local mode tunnels all wireless client traffic to the Wireless LAN Controller using CAPWAP. The AP itself only needs a single IP address on an untagged access port (or untagged native VLAN) within its management VLAN to establish communication with the WLC. Configuring an 802.1Q trunk on the AP switch port is unnecessary for Local mode APs and is primarily used when deploying APs in FlexConnect mode with local VLAN switching.

Step-by-Step Solution

1
Analyze the operational mode of the Cisco Lightweight Access Point.
The AP operates in Local mode, which means all user traffic is encapsulated within CAPWAP data tunnels and sent directly to the Wireless LAN Controller (WLC).
Local mode APs do not switch wireless client traffic locally onto the switch.
2
Determine the interface and VLAN requirement for the AP switch connection.
The AP only requires a single Layer 3 IP address to establish a CAPWAP control and data tunnel to the WLC Management interface.
Because all wireless SSID traffic is tunneled to the WLC, multiple VLAN tags do not pass over the physical switch link connected to a Local mode AP.
3
Evaluate the necessity of 802.1Q trunking vs access ports.
An access port assigned to the AP management VLAN (VLAN 20) is sufficient and recommended. 802.1Q trunks are typically only required when APs are operating in FlexConnect mode with local traffic switching across multiple VLANs.
Configuring trunks for Local mode APs adds unnecessary complexity and potential misconfigurations.

Key Concept

Lightweight AP and WLC Management Interconnects (Local vs FlexConnect AP Modes)
Question 14Question →

A network engineer needs to configure a static IEEE 802.1Q trunk link on Cisco switch interface GigabitEthernet0/1, disable Dynamic Trunking Protocol (DTP) negotiation, and configure VLAN 99 as the untagged native VLAN. Place the following CLI configuration commands in the correct logical execution sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution order is: interface GigabitEthernet0/1, switchport trunk encapsulation dot1q, switchport mode trunk, switchport nonegotiate, and switchport trunk native vlan 99.
The CLI commands follow strict Cisco IOS configuration order dependencies. First, access the interface mode with 'interface GigabitEthernet0/1'. Second, set encapsulation using 'switchport trunk encapsulation dot1q'. Third, enable static trunking with 'switchport mode trunk'. Fourth, disable DTP frames using 'switchport nonegotiate' (which fails if the port is in dynamic DTP mode). Finally, assign untagged traffic processing using 'switchport trunk native vlan 99'.

Step-by-Step Solution

1
Enter interface configuration mode
Context changes to Switch(config-if)# for GigabitEthernet0/1
CLI commands affecting a specific port require entering that interface context first.
2
Set trunk encapsulation to IEEE 802.1Q
Interface protocol encapsulation set to dot1q
Cisco IOS platforms supporting both ISL and 802.1Q require explicit encapsulation specification before changing mode to trunk.
3
Configure operational mode to static trunk
Interface changes state to unconditional trunking mode
Establishes trunk operational state.
4
Disable Dynamic Trunking Protocol negotiation
DTP frame transmission is stopped on the interface
The 'switchport nonegotiate' command is rejected by Cisco IOS if the interface remains in dynamic auto or dynamic desirable mode.
5
Modify the native VLAN identifier
VLAN 99 becomes the untagged VLAN for IEEE 802.1Q traffic
Applies non-default native VLAN parameter to prevent native VLAN mismatch security issues.

Key Concept

IEEE 802.1Q Trunk Configuration and DTP Suppression Sequence
Estimated Time:1m 30s
Question 15Question →

A network administrator configures Cisco STP PortFast globally on an access switch (`spanning-tree portfast default`) to streamline host initialization. To evaluate the impact of this command on switch behavior and topology stability, which TWO statements accurately describe the operational characteristics and benefits of enabling PortFast on an access switch interface?

Select all that apply

Show answer & explanation

Answer: The interface transitions immediately from the Blocking state to the Forwarding state upon link up, completely bypassing the Listening and Learning states.; Link status transitions on the PortFast-enabled port do not generate Topology Change Notifications (TCNs) across the Spanning Tree domain.

Answer

PortFast enables immediate transition from Blocking to Forwarding by skipping Listening and Learning states, and it prevents link flaps on edge ports from generating Topology Change Notifications (TCNs).
Enabling PortFast allows access ports connected to end devices to bypass the classic 802.1D Listening and Learning states (saving 30 seconds of convergence delay) and move straight to Forwarding. Furthermore, PortFast suppresses Topology Change Notification (TCN) generation when the port flaps, preventing unnecessary MAC address table flushing across the switch network.

Step-by-Step Solution

1
Analyze the state transition mechanics of Cisco STP PortFast.
Standard 802.1D STP transitions through Blocking (20s max age) -> Listening (15s forward delay) -> Learning (15s forward delay) -> Forwarding (30-50s total). PortFast bypasses Listening and Learning, bringing the port directly from Blocking to Forwarding instantly upon link establishment.
This direct transition prevents DHCP request timeouts and initial bootup delays for end-user workstations.
2
Evaluate the topology change control mechanisms introduced by PortFast.
Normal STP interfaces generate TCN BPDUs whenever link status changes, instructing the Root Bridge to broadcast a topology change flag that shortens MAC address table aging timers to the forward delay period (15s). PortFast suppresses TCN generation for edge ports.
Preventing TCNs on workstation ports avoids unnecessary MAC table flooding and performance degradation across the entire Spanning Tree domain when end devices power on or off.
3
Verify BPDU processing behavior on PortFast interfaces.
PortFast ports still originate outbound BPDUs and continue to evaluate incoming BPDUs. Receiving a BPDU causes PortFast to be revoked operational status so normal loop prevention mechanics can take over.
PortFast alone does not filter or block BPDUs in either direction.

Key Concept

STP PortFast operational mechanics: Immediate Forwarding state bypass and TCN suppression.
Question 16Question →

A network engineer needs to manually configure VLAN 30 named Engineering on a Cisco Catalyst switch and assign interface GigabitEthernet0/1 as an explicit static access port belonging to VLAN 30. Place the Cisco IOS CLI configuration steps in the correct chronological order required to accomplish this configuration starting from Privileged EXEC mode.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with entering global configuration mode ('configure terminal'), creating and naming VLAN 30 ('vlan 30' and 'name Engineering'), navigating to interface configuration mode ('interface gigabitethernet0/1'), enforcing access mode ('switchport mode access'), and assigning the port to VLAN 30 ('switchport access vlan 30').
The CLI hierarchy in Cisco IOS demands starting in Privileged EXEC mode, moving to global configuration mode, defining the VLAN object and its name, entering the target interface configuration context, defining the port mode as access, and lastly binding the port to the intended VLAN ID.

Step-by-Step Solution

1
Execute 'configure terminal' at the Privileged EXEC prompt (Switch#).
Transitions the CLI prompt to global configuration mode (Switch(config)#).
CLI commands for creating VLANs and accessing interfaces require global configuration privileges.
2
Execute 'vlan 30', followed by 'name Engineering' and 'exit'.
Creates VLAN 30 in the VLAN database and assigns the alphanumeric label 'Engineering'.
Defining the VLAN explicitly in global configuration mode ensures proper Layer 2 broadcast domain setup and labeling.
3
Execute 'interface gigabitethernet0/1'.
Transitions the CLI prompt to interface configuration mode (Switch(config-if)#).
Interface parameters can only be altered when inside the specific interface configuration context.
4
Execute 'switchport mode access'.
Statically sets the port mode to access, disabling DTP trunk negotiation.
Best security and operational practices dictate explicit configuration of access ports rather than relying on dynamic negotiation defaults.
5
Execute 'switchport access vlan 30'.
Associates interface GigabitEthernet0/1 with VLAN 30 for untagged frame traffic.
Assigns the access interface to forward untagged traffic on VLAN 30.

Key Concept

Cisco IOS CLI Hierarchy for VLAN Creation and Static Access Port Configuration
Question 17Question →

A network engineer deploys lightweight Cisco Access Points (APs) across multiple remote branch offices linked via a wide area network (WAN) to a centralized Wireless LAN Controller (WLC) in the main datacentre. During a unexpected WAN outage, wireless users at Branch 1 lose all network access to local site servers, whereas wireless users at Branch 2 continue accessing local network resources uninterrupted. Which configuration difference regarding AP modes and traffic handling accounts for this behavior during the WAN failure?

Show answer & explanation

Answer: Branch 2 deployed APs in FlexConnect mode with local switching configured for the WLAN, whereas Branch 1 deployed APs in standard Local mode, which relies on CAPWAP data tunnels to centralize all traffic at the WLC.

Answer

Branch 2 deployed APs in FlexConnect mode with local switching configured for the WLAN, whereas Branch 1 deployed APs in standard Local mode, which relies on CAPWAP data tunnels to centralize all traffic at the WLC.
In Cisco wireless architectures, standard Local mode APs encapsulate all user traffic inside CAPWAP data tunnels and route it back to the centralized Wireless LAN Controller (WLC) regardless of destination. If the WAN link connecting a remote branch to the central WLC drops, Local mode APs cannot process or forward client packets. Conversely, FlexConnect APs are designed for remote/branch deployments; when configured for local switching, client data frames are bridged directly onto the local wired network switch port at the branch. This allows local network connectivity to persist even during a WAN link or WLC failure.

Step-by-Step Solution

1
Analyze the operational requirements of AP modes during WAN link failure scenarios.
Identified that Local mode requires active CAPWAP control and data tunnels back to the central WLC for all traffic forwarding.
Standard Local mode APs depend entirely on the WLC to process and switch client data packets.
2
Evaluate the behavior of FlexConnect AP mode when WAN connectivity breaks.
FlexConnect mode allows APs to drop into standalone mode and switch client data packets locally to the access switch on configured local VLANs.
FlexConnect separates the control plane from the data plane, allowing local subnet resources to stay reachable locally when the central WLC is unreachable.
3
Determine why other listed modes (Monitor, Sniffer, Rogue Detector) do not apply.
Specialized AP modes (Monitor, Sniffer, Rogue Detector) do not broadcast SSIDs or handle client traffic.
Only client-serving modes like Local and FlexConnect support active client associations.

Key Concept

Cisco Lightweight AP Modes and FlexConnect Local vs Central Switching
Question 18Question →

A network administrator needs to assign interface GigabitEthernet0/4 on a Cisco Catalyst switch to VLAN 25. Which Cisco IOS command must be executed in interface configuration mode to set the active VLAN assignment for this access port?

Show answer & explanation

Answer: switchport access vlan 25

Answer

The command switchport access vlan 25 correctly assigns an access port interface to VLAN 25 in Cisco IOS.
Executing switchport access vlan 25 in interface configuration mode directly sets the VLAN associated with an operational access port. If the specified VLAN does not already exist in the switch VLAN database, Cisco IOS automatically creates it upon executing this command.

Step-by-Step Solution

1
Enter interface configuration mode for the specified port (e.g., interface GigabitEthernet0/4).
The switch prompt changes to Switch(config-if)#.
Port-specific VLAN assignments must be applied within the interface configuration context.
2
Execute switchport access vlan 25.
The port is assigned to transmit untagged traffic for VLAN 25.
The switchport access vlan <vlan-id> command sets the broadcast domain/VLAN for an access interface.

Key Concept

VLAN Configuration and Access Port Setup
Question 19Question →

Match each transport layer characteristic or protocol mechanism on the left to its corresponding protocol operation on the right.

Click a left item, then click its matching right item

Items

Three-way handshake (SYN, SYN-ACK, ACK)
Fixed 8-byte header structure without sequence numbers
Dynamic sliding windowing mechanism
Best-effort transmission without retransmissions

Matches

Show answer & explanation

Answer

The three-way handshake matches stateful connection establishment in TCP; the fixed 8-byte header matches low-overhead encapsulation in UDP; dynamic sliding windowing matches flow control in TCP; and best-effort transmission matches stateless data delivery in UDP.
Each feature correctly pairs with its protocol operation: TCP manages state initializations via the three-way handshake and regulates sender rate using sliding window flow control. Conversely, UDP minimizes encapsulation with an 8-byte header and delivers packets statelessly without retransmissions.

Step-by-Step Solution

1
Identify session initialization characteristics for TCP.
TCP establishes connection state prior to transferring application payload by exchanging SYN, SYN-ACK, and ACK control flags during the three-way handshake.
TCP requires explicit state synchronization between endpoints.
2
Analyze UDP header composition and encapsulation efficiency.
UDP utilizes a lightweight 8-byte header consisting of four 16-bit fields (Source Port, Destination Port, Length, Checksum).
UDP omits connection tracking fields like sequence numbers, acknowledgment numbers, and window size to minimize overhead.
3
Evaluate flow control mechanics in TCP.
TCP uses the Window Size field to implement dynamic sliding windowing, regulating how much data a sender can transmit before receiving an acknowledgment.
Flow control prevents a fast sender from flooding a receiver's incoming socket buffer.
4
Match delivery semantics for latency-sensitive applications.
UDP transmits datagrams using best-effort delivery without waiting for acknowledgments or initiating retransmissions.
Real-time applications (such as VoIP or live video streaming) prioritize low delay over guaranteed error correction.

Key Concept

Comparison of stateful, reliable TCP mechanics versus lightweight, connectionless UDP operations
Question 20Question →

A network administrator is evaluating Rapid PVST+ spanning-tree behavior across a multi-switch enterprise topology containing VLAN 10 and VLAN 20. Switch-A is configured with `spanning-tree vlan 10 priority 4096`, while Switch-B is configured with `spanning-tree vlan 20 priority 8192`. Switch-C connects to both Switch-A and Switch-B via 802.1Q trunk links with default Rapid PVST+ settings. Which two statements correctly describe the resulting Rapid PVST+ bridge operations, port roles, and configuration rules? (Select two choices.)

Select all that apply

Show answer & explanation

Answer: For VLAN 10, Switch-A advertises a total Bridge ID priority value of 4106 in its outbound BPDUs due to the addition of the 12-bit System ID Extension.; On Switch-C, an interface assigned the Alternate port role remains in the Discarding state while receiving superior BPDUs from a designated switch.

Answer

The correct statements are that Switch-A advertises a total priority value of 4106 for VLAN 10 due to the System ID Extension, and an Alternate port on Switch-C remains in the Discarding state while receiving superior BPDUs.
In Rapid PVST+, the Bridge ID priority calculation incorporates the 12-bit System ID Extension, resulting in an advertised priority of 4096+10=41064096 + 10 = 4106 for VLAN 10 on Switch-A. Additionally, an Alternate port provides a backup root path and resides in the Discarding state while continuing to process superior BPDUs from the designated bridge.

Step-by-Step Solution

1
Calculate the total Bridge ID priority advertised by Switch-A for VLAN 10.
Total Priority = Base Priority (4096) + System ID Extension (VLAN 10) = 4106.
Rapid PVST+ dynamically includes the VLAN ID inside the 12-bit System ID Extension field of the 16-bit Bridge Priority structure.
2
Verify Cisco IOS syntax rules for configuring STP bridge priority.
Configuring a value such as 4100 is rejected by Cisco IOS.
STP base priority values must be exact multiples of 4096 (0,4096,8192,…,614400, 4096, 8192, \dots, 61440).
3
Determine the state and behavior of an Alternate port in Rapid PVST+.
The Alternate port is placed in the Discarding state.
An Alternate port offers an alternate path to the root bridge but remains blocked (Discarding state) as long as it receives superior BPDUs from another switch.
4
Evaluate the operational mechanics of PortFast on switch links.
PortFast transitions ports directly to Forwarding, not Learning, and does not disable BPDU traffic.
PortFast is intended exclusively for single-host end devices to skip STP listening/learning phases. Applying it to trunk links connecting switches threatens network stability.

Key Concept

Rapid PVST+ Bridge ID Structure, Port Roles, and Port States
Page 1 / 100Next