All practice questions

Question 1Question →

Match each OSPFv2 network type or interface configuration on the left to its corresponding DR/BDR election requirement and default timer profile on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Broadcast pairs with DR/BDR election and 10s/40s timers; Point-to-Point pairs with no DR/BDR election and 10s/40s timers; Point-to-Multipoint pairs with no DR/BDR election and 30s/120s timers; Priority 0 explicitly excludes the interface from DR/BDR election.

Broadcast network types perform DR/BDR elections with 10s/40s timers to minimize link-state information flooding across shared multiaccess media. Point-to-Point network types suppress DR/BDR elections since only two endpoints exist, using 10s/40s timers. Point-to-Multipoint network types also suppress DR/BDR elections but use 30s/120s timers suitable for WAN connections. Configuring an OSPF priority of 0 explicitly forces the interface to act strictly as a DROther, avoiding DR or BDR role assignment.

Step-by-Step Solution

1

Identify network types that perform DR/BDR elections

Only Broadcast (and Non-Broadcast Multiaccess / NBMA) network types conduct DR/BDR elections.

Multiaccess segments require a central router (DR) to reduce adjacency overhead from n(n-1)/2 to n-1.

2

Differentiate default Hello and Dead timers among non-DR network types

Point-to-Point uses 10s Hello / 40s Dead timers, whereas Point-to-Multipoint uses 30s Hello / 120s Dead timers.

Point-to-Multipoint is designed for hub-and-spoke topologies where slower timers account for WAN link characteristics.

3

Determine the impact of setting interface priority to 0

An OSPF priority of 0 disqualifies the interface from becoming DR or BDR.

The priority range is 0-255, where 0 explicitly excludes the router from election, keeping it as a DROther regardless of Router ID.

Key Concept

OSPFv2 Network Types and DR/BDR Selection Rules

Question 2Question →

Match each Cisco AP and Wireless LAN Controller (WLC) connection type to its corresponding switchport configuration requirement.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Local Mode AP matches Access port assigned to the dedicated AP management VLAN; FlexConnect Mode AP matches 802.1Q trunk port carrying tagged VLANs for local client traffic and a native VLAN for AP management; WLC Management Interface matches 802.1Q trunk port carrying tagged traffic for dynamic interfaces and controller management; WLC Service Port matches Access port isolated for out-of-band controller administration without 802.1Q VLAN tagging.

Each connection type matches its mandatory physical switch port requirement based on whether the link supports single VLAN access, 802.1Q trunking, or isolated out-of-band management.

Step-by-Step Solution

1

Analyze AP traffic modes to determine switchport configuration requirements.

Local mode APs send all client traffic inside CAPWAP tunnels to the WLC, requiring only a single-VLAN access port. FlexConnect APs with local switching forward client frames locally, requiring an 802.1Q trunk port with a native VLAN for CAPWAP management.

Understanding AP deployment modes determines whether single-VLAN access or multi-VLAN trunking is required at the access layer switch.

2

Analyze WLC interface physical connection requirements.

The main WLC distribution system port connects to an 802.1Q trunk port to multiplex controller management and dynamic VLANs. The physical service port connects to an access port dedicated to out-of-band management.

Controller architecture separates in-band multi-VLAN trunking from out-of-band isolated access management.

Key Concept

Switchport Configuration for AP and WLC Management Access Connections

Question 3Question →

Match each Cisco Access Point (AP) mode to its primary operational behavior.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Local Mode matches default central CAPWAP switching to the WLC; FlexConnect Mode matches branch local traffic switching during normal operation or WAN outage; Sniffer Mode matches capturing over-the-air wireless frames for analysis; Monitor Mode matches functioning strictly as a security sensor without servicing client connections.

Each Cisco AP mode serves a specific operational purpose: Local mode centrally tunnels client data to the controller via CAPWAP, FlexConnect supports local switching for branch offices, Sniffer mode redirects raw 802.11 frames to a network analyzer, and Monitor mode acts purely as a non-client-serving security sensor.

Step-by-Step Solution

1

Identify the role of Local Mode.

Local Mode is the default operational state for Cisco lightweight APs where client data is tunneled back to the central WLC.

Lightweight AP architectures rely on centralized traffic control by default.

2

Identify the role of FlexConnect Mode.

FlexConnect Mode handles remote branch office deployments.

It allows local traffic switching at the access layer without sending all traffic over the WAN back to the central controller.

3

Identify the role of Sniffer Mode.

Sniffer Mode collects packet captures on a configured channel.

It acts as a remote wireless probe for troubleshooting and packet analysis.

4

Identify the role of Monitor Mode.

Monitor Mode performs continuous threat analysis and location services.

The radio refrains from serving client connections so it can constantly cycle through channels to detect rogues and intrusion attempts.

Key Concept

Cisco Wireless Access Point Modes and Operational Behaviors

Question 4Question →

Match each transport layer characteristic or protocol mechanism on the left to its corresponding protocol operation on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The three-way handshake matches stateful connection establishment in TCP; the fixed 8-byte header matches low-overhead encapsulation in UDP; dynamic sliding windowing matches flow control in TCP; and best-effort transmission matches stateless data delivery in UDP.

Each feature correctly pairs with its protocol operation: TCP manages state initializations via the three-way handshake and regulates sender rate using sliding window flow control. Conversely, UDP minimizes encapsulation with an 8-byte header and delivers packets statelessly without retransmissions.

Step-by-Step Solution

1

Identify session initialization characteristics for TCP.

TCP establishes connection state prior to transferring application payload by exchanging SYN, SYN-ACK, and ACK control flags during the three-way handshake.

TCP requires explicit state synchronization between endpoints.

2

Analyze UDP header composition and encapsulation efficiency.

UDP utilizes a lightweight 8-byte header consisting of four 16-bit fields (Source Port, Destination Port, Length, Checksum).

UDP omits connection tracking fields like sequence numbers, acknowledgment numbers, and window size to minimize overhead.

3

Evaluate flow control mechanics in TCP.

TCP uses the Window Size field to implement dynamic sliding windowing, regulating how much data a sender can transmit before receiving an acknowledgment.

Flow control prevents a fast sender from flooding a receiver's incoming socket buffer.

4

Match delivery semantics for latency-sensitive applications.

UDP transmits datagrams using best-effort delivery without waiting for acknowledgments or initiating retransmissions.

Real-time applications (such as VoIP or live video streaming) prioritize low delay over guaranteed error correction.

Key Concept

Comparison of stateful, reliable TCP mechanics versus lightweight, connectionless UDP operations

Question 5Question →

Match each IPv6 address scope or functional type on the left with its standardized reserved prefix or address range on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Global Unicast matches

2000::/3

; Link-Local matches

\text{fe80}::/10

; Unique Local matches

\text{fc00}::/7

; Multicast matches

\text{ff00}::/8

; Loopback matches

::1/128

.

Each IPv6 address type is mapped directly to its standard RFC 4291 prefix definition: Global Unicast to

2000::/3

, Link-Local to

\text{fe80}::/10

, Unique Local to

\text{fc00}::/7

, Multicast to

\text{ff00}::/8

, and Loopback to

::1/128

.

Step-by-Step Solution

1

Identify IPv6 unicast address scopes.

Global Unicast is assigned

2000::/3

, Link-Local is assigned

\text{fe80}::/10

, and Unique Local is assigned

\text{fc00}::/7

.

RFC 4291 partitions the IPv6 address space into well-defined unicast functional scopes.

2

Identify special and multicast IPv6 prefixes.

Multicast addresses use

\text{ff00}::/8

, and the single host loopback address is

::1/128

.

Multicast replaces IPv4 broadcasts and uses the

\text{ff00}::/8

prefix, while

::1/128

is reserved exclusively for loopback operations.

Key Concept

IPv6 Reserved Prefixes and Address Scopes

Question 6Question →

Match each IPv6 addressing scenario or network description on the left with its corresponding prefix length or field bit length on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The SLAAC end-user LAN subnet requires a /64 prefix length; the enterprise customer ISP allocation is typically a /48 prefix length; the point-to-point inter-router link uses a /127 prefix length; and the host Interface Identifier occupies 64 bits.

Each scenario maps directly to IPv6 architectural conventions: SLAAC requires a /64 prefix, enterprise sites typically receive a /48 prefix, point-to-point inter-router links use /127 per RFC 6164, and the host Interface ID portion is 64 bits.

Step-by-Step Solution

1

Analyze SLAAC prefix length requirements.

SLAAC requires a /64 prefix length.

SLAAC relies on receiving a /64 prefix advertisement in ICMPv6 Router Advertisement (RA) messages to combine with a 64-bit Interface ID.

2

Determine standard enterprise IPv6 allocation from an ISP.

An enterprise customer site typically receives a /48 prefix.

A /48 global routing prefix leaves bits 49 through 64 (16 bits) available for the enterprise organization to construct up to 65,536 distinct /64 subnets.

3

Evaluate point-to-point link prefix standards.

Point-to-point router links use a /127 prefix length.

Per RFC 6164, using a /127 mask limits available addresses on the link to two, preventing ping-pong routing loops and ND CPU exhaustion attacks.

4

Identify the Interface ID length in a standard IPv6 unicast address.

The Interface ID is exactly 64 bits.

IPv6 address architecture divides a standard 128-bit address into a 64-bit network prefix and a 64-bit host Interface ID.

Key Concept

IPv6 Address Structure and Prefix Allocation Rules

Question 7Question →

Match each transport layer protocol operational characteristic or header structure property on the left with its corresponding description on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

20-byte minimum header size matches TCP header structure accommodating sequence numbers, window size, and control flags; 8-byte fixed header size matches UDP header structure containing only source port, destination port, length, and checksum; Explicit Congestion Notification (ECN) matches TCP mechanism for network routers to signal impending network congestion to endpoints; Stateless datagram transmission matches UDP operational mode providing low-latency delivery without session setup or state maintenance.

TCP uses a minimum 20-byte header to support sequence numbers, acknowledgment numbers, control flags, and flow control mechanisms like ECN. UDP uses a minimal 8-byte fixed header containing only ports, length, and checksum to provide lightweight, connectionless datagram delivery.

Step-by-Step Solution

1

Analyze transport layer header length specifications for TCP and UDP.

TCP headers require at least 20 bytes of overhead due to sequence/ACK tracking and windowing fields, whereas UDP headers are strictly fixed at 8 bytes.

Transport layer operational guarantees directly determine header field complexity.

2

Evaluate transport layer signaling and congestion management features.

ECN allows network infrastructure to communicate buffer pressure to TCP endpoints so they can dynamically reduce transmission rates.

TCP maintains stateful mechanisms for connection flow control and congestion avoidance.

3

Compare connection state and delivery requirements.

UDP operates in a stateless datagram model that avoids connection setup latency and session state overhead.

Applications using UDP prioritize rapid, low-overhead transmission over packet delivery verification.

Key Concept

Transport Layer Header Fields and Operational Characteristics (TCP vs. UDP)

Question 8Question →

A network administrator is configuring and verifying Layer 2 discovery protocols across a enterprise topology consisting of Cisco and multi-vendor switches. Match each Cisco IOS command on the left with its corresponding operational scope and function on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct matches pair 'cdp run' with 'Global configuration command that enables Cisco Discovery Protocol across all supported device interfaces.', 'no cdp enable' with 'Interface configuration command that disables Cisco Discovery Protocol on a specific interface.', 'lldp transmit' with 'Interface configuration command that selectively enables sending Link Layer Discovery Protocol packets out of an interface.', and 'show lldp neighbors detail' with 'Privileged EXEC mode command that displays expanded neighbor information, including management IP addresses and system capabilities.'

Each Cisco IOS command corresponds directly to a specific scope and function: 'cdp run' turns on CDP globally across the chassis, 'no cdp enable' disables CDP on an individual port, 'lldp transmit' enables outbound LLDP packet transmission on a specific port, and 'show lldp neighbors detail' provides detailed neighbor operational information.

Step-by-Step Solution

1

Identify the configuration scope (global vs. interface vs. EXEC mode) for each command.

'cdp run' is global configuration; 'no cdp enable' and 'lldp transmit' are interface configuration; 'show lldp neighbors detail' is EXEC mode verification.

Understanding mode syntax is critical for proper Layer 2 discovery protocol deployment.

2

Distinguish CDP single-state toggle from LLDP directional interface controls.

CDP uses 'cdp enable' / 'no cdp enable' per interface, whereas LLDP uses separate 'lldp transmit' and 'lldp receive' commands per interface.

LLDP provides granular directional transmission control that CDP does not.

3

Map each command to its precise definition.

Match left_1 to right_1, left_2 to right_2, left_3 to right_3, and left_4 to right_4.

Validates proper CLI syntax and operational scope for Cisco IOS discovery protocols.

Key Concept

CDP and LLDP CLI Syntax, Configuration Scopes, and Verification Commands

Question 9Question →

Match each Cisco Lightweight Access Point (AP) operational mode on the left with its corresponding functional behavior and traffic forwarding characteristics on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Local Mode pairs with central CAPWAP tunnel encapsulation; FlexConnect Mode pairs with local switching and WAN failover fallback; Monitor Mode pairs with continuous channel scanning for WIDS/rogue detection; Rogue Detector Mode pairs with wired ARP/MAC table monitoring; Sniffer Mode pairs with capturing and forwarding raw 802.11 frames to a packet analyzer.

Each AP mode matches its precise Cisco implementation standards: Local mode centralizes traffic over CAPWAP tunnels; FlexConnect mode allows local switching and standalone branch operation; Monitor mode scans wireless channels without serving clients; Rogue Detector correlates wired ARP/MAC tables with reported rogue lists; Sniffer mode captures raw 802.11 frames for analysis.

Step-by-Step Solution

1

Classify client-serving operational modes in Cisco centralized vs branch architectures.

Local mode centralizes all data and control traffic via CAPWAP tunnels to the controller. FlexConnect mode provides local data switching and standalone operation for branch offices.

Differentiating central switching from decentralized local switching in AP architectures.

2

Analyze non-client-serving specialized AP modes.

Monitor, Rogue Detector, and Sniffer modes disable standard client associations to perform specialized monitoring tasks.

Identifying the operational focus of specialized Cisco wireless modes.

3

Map specific interface behaviors to non-client-serving modes.

Monitor mode continuously cycles radios across channels; Rogue Detector disables radios to inspect wired ARP/MAC tables; Sniffer mode captures raw 802.11 frames on designated channels.

Distinguishing between radio scanning, wired correlation, and packet capture mechanisms.

Key Concept

Cisco Access Point Operational Modes and Traffic Forwarding Architectures

Question 10Question →

Match each VPN framework element on the left with its primary functional purpose on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Diffie-Hellman (DH) Group pairs with deriving shared secret keys over unsecure networks; Encapsulating Security Payload (ESP) pairs with providing confidentiality through encryption along with integrity; Authentication Header (AH) pairs with providing data integrity without confidentiality; Internet Key Exchange (IKE) pairs with establishing control channels and negotiating SAs.

Each IPsec component performs a distinct function: Diffie-Hellman derives shared secret keys over an untrusted link, ESP delivers packet encryption and integrity, AH delivers authentication without confidentiality, and IKE manages negotiation and Security Associations.

Step-by-Step Solution

1

Identify the key exchange method

Diffie-Hellman allows peer routers to compute a shared secret key over an unsecure medium.

Symmetric encryption key material must be securely established before encrypting tunnel data.

2

Differentiate between IPsec data encapsulation protocols

ESP provides payload encryption (confidentiality) plus authentication. AH provides authentication only, leaving payload plaintext.

AH lacks an encryption algorithm, whereas ESP encapsulates and encrypts payload data.

3

Identify the management and SA negotiation protocol

IKE negotiates security parameters and manages Security Associations (SAs).

IKE handles control plane negotiation prior to data plane forwarding.

Key Concept

IPsec Protocol Framework Components

Question 11Question →

Match each Layer 2 security feature on the left with its primary mitigation purpose or operation on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Port Security matches limiting ingress traffic based on source MAC addresses. DHCP Snooping matches filtering untrusted DHCP messages and building the IP-to-MAC binding database. Dynamic ARP Inspection (DAI) matches intercepting and verifying ARP packets against a binding database to prevent ARP poisoning.

Each feature secures a distinct Layer 2 operation: Port Security controls MAC-level access, DHCP Snooping filters DHCP traffic while tracking legitimate IP-MAC assignments, and DAI utilizes those assignments to drop spoofed ARP frames.

Step-by-Step Solution

1

Identify the role of Port Security.

Port Security operates at the MAC layer to restrict ingress traffic based on authorized source MAC addresses.

It prevents unauthorized devices from attaching to a switch port.

2

Identify the role of DHCP Snooping.

DHCP Snooping blocks unauthorized DHCP servers and records valid IP-to-MAC address assignments in its binding database.

It ensures rogue DHCP servers cannot distribute invalid network configurations and provides binding context for other features.

3

Identify the role of Dynamic ARP Inspection (DAI).

DAI inspects ARP packets and uses the DHCP snooping binding database to validate ARP requests and responses.

It prevents man-in-the-middle attacks caused by malicious ARP poisoning or spoofing.

Key Concept

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

Question 12Question →

Match each traditional network management practice on the left with its primary operational benefit provided by network automation on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Manual per-device CLI configuration matches with Rapid, consistent deployment using centralized templates; Periodic NMS SNMP polling matches with Near real-time data collection via model-driven push telemetry; Ad-hoc manual changes per router match with Reduction of human error and prevention of configuration drift.

Automation impacts network management by enabling centralized template-driven provisioning to replace CLI entries, utilizing push telemetry instead of polling, and establishing continuous compliance to eliminate configuration drift.

Step-by-Step Solution

1

Identify the automated alternative to manual CLI provisioning.

Centralized controllers or scripts use templates to apply standardized configurations rapidly across many devices simultaneously.

Automation eliminates the need to connect to each network device individually via SSH or console.

2

Identify the automated advancement over legacy SNMP polling.

Streaming telemetry continuously pushes device performance data to monitoring systems.

Traditional SNMP pulls data periodically, whereas telemetry provides immediate visibility with lower CPU overhead.

3

Identify the operational benefit of eliminating ad-hoc per-device changes.

Standardized automated change execution prevents configuration drift and reduces human error.

Manual changes create inconsistent device states over time, which automation actively prevents.

Key Concept

Operational transformation from manual, per-device management to centralized, telemetry-driven automated network administration.

Question 13Question →

Match each component of the AAA security framework to its core administrative function.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Authentication maps to identity verification; Authorization maps to privilege and resource permission determination; Accounting maps to tracking, logging, and usage recording.

Authentication is responsible for verifying identity, Authorization restricts or allows actions based on permissions, and Accounting logs session and command activity for auditing purposes.

Step-by-Step Solution

1

Identify the primary role of Authentication in the AAA framework.

Authentication answers 'Who are you?' by verifying credentials against a local database or remote AAA server.

Establishing identity is the essential first step before any network privileges can be evaluated.

2

Identify the primary role of Authorization in the AAA framework.

Authorization answers 'What are you allowed to do?' by specifying permissible CLI commands or VLAN assignments.

Access control policy enforcement requires explicit permission checks per user session.

3

Identify the primary role of Accounting in the AAA framework.

Accounting answers 'What did you do and for how long?' by capturing log entries and session statistics.

Auditing and compliance depend on maintaining accurate time-stamped logs of administrative actions.

Key Concept

Core Pillars of the AAA Security Framework (Authentication, Authorization, Accounting)

Question 14Question →

Match each IPv6 address or prefix on the left with its corresponding functional characteristic or property on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The correct pairings are: 2001:db8:abc:1200::/56 matches the global unicast prefix providing 256 subnets of /64 length; fd00:db8:abc:1200::/64 matches the unique local address prefix; fe80::200:5eff:fe00:5301 matches the link-local address created using EUI-64 from MAC 00:00:5e:00:53:01; and ff02::1:ff00:5301 matches the solicited-node multicast address.

Each IPv6 address and prefix matches its exact functional specification: 2001:db8:abc:1200::/56 yields 256 subnets of /64 size; fd00::/8 addresses are Unique Local Addresses; fe80::200:5eff:fe00:5301 correctly applies the 7th-bit flip and FFFE insertion to MAC 00:00:5e:00:53:01; and ff02::1:ff00:5301 uses the exact low 24 bits of the interface ID appended to the solicited-node multicast prefix.

Step-by-Step Solution

1

Analyze the prefix length calculation for 2001:db8:abc:1200::/56

Difference between /64 and /56 is 8 bits (

64 - 56 = 8

).

2^8 = 256

subnets.

Standard IPv6 subnets are designated at the /64 boundary.

2

Identify the IPv6 scope for fd00:db8:abc:1200::/64

Prefix starting with fd00::/8 is within fc00::/7.

fc00::/7 defines Unique Local Addresses (ULA), equivalent to IPv4 private addresses.

3

Perform Modified EUI-64 conversion on MAC 00:00:5e:00:53:01

First byte 0x00 binary (00000000) flipped 7th bit becomes 0x02 (00000010). Insert FFFE in center (0000:5E -> 0000:5EFF:FE00:5301). Prepend fe80:: prefix -> fe80::200:5eff:fe00:5301.

Modified EUI-64 flips the 7th bit (Universal/Local) and inserts FFFE between OUI and NIC specific bytes.

4

Derive the solicited-node multicast address for interface ID 0200:5eff:fe00:5301

Extract last 24 bits (00:5301) and append to prefix ff02::1:ff00:0/104 -> ff02::1:ff00:5301.

Solicited-node multicast addresses always start with ff02::1:ff00:0/104 and take the lowest 24 bits of the unicast address.

Key Concept

IPv6 Address Representation, Subnetting, Scopes, and EUI-64 / Solicited-Node Multicast Generation

Question 15Question →

Match each Cisco IOS interface status or error counter symptom to its corresponding physical or data-link troubleshooting root cause.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Late collisions match duplex mismatch; CRC errors match physical cable corruption or noise; Interface up / line protocol down matches Layer 2 encapsulation mismatch; Interface administratively down matches the interface being disabled with the shutdown command.

Matching interface symptoms correctly pairs late collisions with duplex mismatches, CRC error increments with physical cabling damage or electrical noise, 'up/down' status with Layer 2 framing/encapsulation issues, and 'administratively down' status with the interface shutdown configuration command.

Step-by-Step Solution

1

Examine the Layer 1 physical symptoms and Cisco IOS interface counters.

Differentiate between physical layer errors (CRC, late collisions), interface operational states (up/down), and administrative states (administratively down).

Each Cisco IOS interface statistic isolates specific Layer 1 or Layer 2 network faults.

2

Map each interface symptom to its underlying root cause.

Pair late collisions with duplex mismatch, CRC errors with cable/interference issues, up/down line protocol with encapsulation/keepalive failures, and administratively down with the shutdown command.

Accurate pairing ensures effective troubleshooting of physical and data link layer issues.

Key Concept

Cisco IOS Interface Troubleshooting and Diagnostics

Question 16Question →

Match each enterprise network infrastructure component on the left with its primary operational function and architectural role on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Next-Generation Firewall matches deep packet inspection up to Layer 7; Wireless LAN Controller matches centralized access point provisioning and RF management; Type 1 Hypervisor Virtual Switch matches bridging vNICs to physical network interfaces on bare metal; Layer 3 Access Switch matches hardware-based ASIC inter-VLAN packet forwarding.

Each network component is correctly paired with its defining enterprise function: Next-Generation Firewalls perform deep packet inspection up to Layer 7; Wireless LAN Controllers manage centralized AP configurations, radio frequencies, and roaming; Type 1 Hypervisor Virtual Switches bridge virtual machine vNICs directly on bare-metal hardware; and Layer 3 Access Switches utilize dedicated ASICs for wire-speed inter-VLAN packet routing.

Step-by-Step Solution

1

Identify the primary operational scope of enterprise security appliances.

Determine that Next-Generation Firewalls (NGFW) inspect packet payloads through Layer 7 to provide application identification, IPS functionality, and threat prevention.

Traditional firewalls evaluate only Layer 3 and Layer 4 headers, whereas NGFWs integrate deep packet inspection at Layer 7.

2

Analyze centralized management functions for campus wireless networks.

Recognize that Wireless LAN Controllers (WLC) serve as central control points for Lightweight Access Points (LAPs), handling channel management, transmit power, and client roaming coordination.

Cisco split-MAC architecture places real-time MAC functions on the LAP and management/control functions on the WLC.

3

Evaluate hypervisor types and virtual networking architectures.

Determine that a Type 1 Hypervisor operates natively on physical hardware without a host OS, using embedded virtual switches to interconnect vNICs to physical NIC uplinks.

Type 1 bare-metal hypervisors bypass consumer operating system overhead, presenting direct hardware interfaces to virtual switches.

4

Examine high-speed LAN switching and routing mechanisms.

Identify that Layer 3 switches use Application-Specific Integrated Circuits (ASICs) to forward IP packets between VLANs at line rate.

Layer 3 switches combine traditional switch port density with dedicated routing ASICs to remove software routing bottlenecks.

Key Concept

Roles, operational layers, and architectural responsibilities of primary enterprise network components.

Question 17Question →

Match each Cisco IOS interface status or error symptom on the left to its most probable underlying root cause on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Interface down/down matches physical Layer 1 failure; Interface up/down matches Layer 2 encapsulation or keepalive failure; Interface administratively down matches manual shutdown command; Interface up/up with late collisions matches duplex mismatch.

Interface diagnostic states directly correlate with specific OSI layers and configurations: physical cable disconnects cause 'down/down'; Layer 2 framing errors cause 'up/down'; the 'shutdown' command displays 'administratively down'; and late collisions on an active link indicate a duplex mismatch.

Step-by-Step Solution

1

Analyze 'Interface is down, line protocol is down'.

Identified physical Layer 1 signal loss.

When electrical/optical carrier signal is missing due to a disconnected or broken cable, both status and line protocol report down.

2

Analyze 'Interface is up, line protocol is down'.

Identified Layer 2 protocol/framing failure.

Physical carrier (Layer 1) is detected, but Data Link layer communication failed due to mismatched encapsulation or lost keepalives.

3

Analyze 'Interface is administratively down, line protocol is down'.

Identified manual administrative disablement.

This explicit status string appears only when an administrator applies the 'shutdown' configuration command.

4

Analyze 'Interface is up, line protocol is up (with rapidly incrementing late collisions)'.

Identified duplex mismatch error pattern.

Late collisions occur when an interface set to half-duplex transmits while a full-duplex remote end transmits without checking for collisions past the slot time window.

Key Concept

Cisco IOS Interface Status Diagnostics and Troubleshooting

Question 18Question →

Match each Layer 2 discovery protocol attribute or configuration parameter on the left to its corresponding protocol or timer specification on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The Cisco proprietary protocol matches Cisco Discovery Protocol (CDP). The IEEE 802.1AB standard matches Link Layer Discovery Protocol (LLDP). The 60-second update and 180-second holdtime match CDP Default Timers. The 30-second update and 120-second holdtime match LLDP Default Timers.

Each left-side item correctly correlates to its designated discovery protocol origin, governing IEEE specification, or default timer values.

Step-by-Step Solution

1

Differentiate between proprietary and open standard Layer 2 discovery protocols.

Identify CDP as Cisco proprietary and LLDP as IEEE 802.1AB standard.

CDP operates exclusively on Cisco devices by default, whereas LLDP allows interoperability across heterogeneous vendor environments.

2

Compare default advertisement and holdtime timers for CDP and LLDP.

Map 60s update / 180s holdtime to CDP, and 30s update / 120s holdtime to LLDP.

CDP sends updates less frequently (60s) than LLDP (30s) under default Cisco IOS configurations.

Key Concept

Layer 2 Discovery Protocols (CDP vs LLDP standards, ownership, and default timers)

Question 19Question →

A network security architect is reviewing the organization's defense-in-depth posture following a risk assessment. Match each enterprise security threat scenario on the left with its most appropriate primary mitigation control on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

NTP UDP amplification pairs with Control Plane Policing and NTP query restrictions; Adversary-in-the-Middle phishing pairs with FIDO2/WebAuthn domain-bound hardware key authentication; CAM table MAC flooding pairs with Port Security MAC limits; Password spraying across multiple accounts pairs with risk-based smart lockout policies.

Each security threat scenario directly maps to its precise technological defense: NTP amplification relies on CoPP and NTP service hardening; AiTM phishing proxies require FIDO2 domain binding; switch CAM flooding requires Port Security limits; and password spraying requires tenant-wide risk-based lockout controls.

Step-by-Step Solution

1

Analyze threat scenario 1 (NTP UDP traffic with spoofed IPs).

Identified as a Distributed Denial of Service (DDoS) reflection/amplification attack targeting network control planes.

Control Plane Policing (CoPP) rate-limits incoming control plane traffic and restricting open NTP query access prevents amplification.

2

Analyze threat scenario 2 (Proxy capturing session cookies and SMS 2FA).

Identified as an Adversary-in-the-Middle (AiTM) phishing attack targeting authentication mechanisms.

Phishing-resistant authentication protocols such as FIDO2/WebAuthn use origin-bound public key cryptography that fails if the domain name in the browser does not match.

3

Analyze threat scenario 3 (Flooding dynamic switch ports with generated MAC addresses).

Identified as a Layer 2 CAM table overflow/MAC flooding attack.

Port Security enforces maximum MAC address limits per access port, preventing switch CAM table exhaustion and fail-open behaviors.

4

Analyze threat scenario 4 (Low-and-slow execution of common passwords across many accounts).

Identified as a password spraying attack.

Traditional account lockout triggers per-user failure limits; smart/risk-based lockout policies evaluate tenant-wide password attempt patterns to block spraying.

Key Concept

Key Security Concepts, Threats, Vulnerabilities, and Mitigations

Question 20Question →

Match each transport layer protocol characteristic on the left to its corresponding protocol on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

TCP corresponds to connection establishment via a 3-way handshake and dynamic flow control via windowing. UDP corresponds to low overhead with an 8-byte header and stateless best-effort delivery for latency-sensitive applications.

TCP provides stateful session establishment, reliable delivery, and flow control mechanisms, making it suitable for applications requiring guaranteed data delivery. UDP maintains no connection state, operates with an 8-byte header, and prioritizes rapid transmission for traffic where timeliness matters more than missing packet retransmission.

Step-by-Step Solution

1

Analyze connection-oriented and reliability features

The 3-way handshake and dynamic windowing/acknowledgments belong to TCP.

TCP provides reliable, ordered, and flow-controlled communication.

2

Analyze connectionless and overhead features

The 8-byte fixed header and stateless delivery for real-time applications belong to UDP.

UDP trades error recovery and sequencing for maximum speed and minimal overhead.

Key Concept

Transport layer protocol comparison: TCP connection-oriented reliability vs. UDP connectionless efficiency

Estimated Time:1m 0s

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept