All practice questions

229 questions

Question 201Question

Match each Simple Network Management Protocol (SNMP) mechanism or operational requirement on the left with its corresponding protocol characteristic or SNMP message type on the right.

Click a left item, then click its matching right item

Items

Unacknowledged event notification sent from a managed network device to an NMS using UDP port 162
Reliable event notification that requires the destination NMS to send an explicit response PDU back upon receipt
SNMPv3 security level providing both message authentication (HMAC-SHA/MD5) and packet encryption (AES/DES)
Request PDU sent by an NMS on UDP port 161 to sequentially traverse and retrieve entries from a MIB table

Matches

Show answer & explanation

Answer

Unacknowledged notifications correspond to SNMP Trap; reliable notifications requiring acknowledgment correspond to SNMP Inform; authentication with encryption corresponds to SNMPv3 authPriv; sequential MIB traversal corresponds to SNMP GetNext.
Each SNMP concept is paired to its defining technical attribute: Traps are unacknowledged notifications (UDP 162), Informs provide explicit acknowledgment and retransmission, authPriv adds cryptographic encryption alongside authentication, and GetNext handles sequential MIB walking (UDP 161).

Step-by-Step Solution

1
Analyze notification reliability types.
Unacknowledged messages sent to UDP port 162 are Traps, whereas acknowledged notifications are Informs.
Traps use best-effort UDP transport without application-layer confirmations, while Informs retransmit until an acknowledgment PDU is returned.
2
Evaluate SNMPv3 security levels.
The combination of authentication (auth) and privacy/encryption (priv) defines the authPriv security model.
noAuthNoPriv uses plain community-like checks, authNoPriv adds hashing without encryption, and authPriv adds payload encryption.
3
Identify MIB querying operational PDU types.
Retrieving the next lexicographical object instance in a MIB tree corresponds to the GetNext operation.
Get requests retrieve a specific OID instance, whereas GetNext accesses the subsequent entry, enabling MIB walk capabilities.

Key Concept

SNMP Operational Mechanics, Traps vs. Informs, and SNMPv3 Security Levels
Question 202Question

Match each network configuration management tool to its corresponding architectural characteristics and operational model.

Click a left item, then click its matching right item

Items

Ansible
Puppet
Chef

Matches

Show answer & explanation

Answer

Ansible corresponds to the agentless, push-based model using SSH/NETCONF and YAML playbooks. Puppet corresponds to the agent-based, pull-based model using Puppet DSL manifests over TCP port 8140. Chef corresponds to the agent-based, pull-based model using Ruby DSL recipes/cookbooks over TCP port 443.
Ansible is characterized by being agentless, push-based, using SSH/NETCONF, and using YAML playbooks. Puppet relies on agents, operates in a pull model over TCP port 8140, and uses Puppet DSL manifests. Chef relies on agents, operates in a pull model over TCP port 443 (HTTPS), and uses Ruby DSL recipes and cookbooks.

Step-by-Step Solution

1
Identify the operational architecture of Ansible.
Ansible is agentless, uses SSH or NETCONF to communicate with target network devices, operates via a push mechanism, and uses YAML formatted playbooks.
Ansible does not require software agent installation on managed devices.
2
Identify the operational architecture of Puppet.
Puppet relies on agents, operates via a pull mechanism using TCP port 8140, and uses Puppet DSL for manifests.
Puppet agents periodically check in with the Puppet master to pull desired configuration states.
3
Identify the operational architecture of Chef.
Chef relies on agents (Chef client), operates via a pull mechanism using HTTPS over TCP port 443, and uses Ruby DSL for cookbooks and recipes.
Chef client agents pull configuration policy directly from the Chef server over encrypted web traffic.

Key Concept

Capabilities and Architecture of Configuration Management Tools (Ansible, Puppet, Chef)
Question 203Question

Which of the following Quality of Service (QoS) mechanisms and header fields correctly match their corresponding binary/decimal representations or operational behaviors? Match each QoS term on the left with its correct description on the right.

Click a left item, then click its matching right item

Items

Expedited Forwarding (EF) PHB
Assured Forwarding 31 (AF31) PHB
IEEE 802.1Q Class of Service (CoS)
Traffic Policing Mechanism

Matches

Show answer & explanation

Answer

Expedited Forwarding (EF) maps to DSCP 46 (1011102101110_2) for low-latency traffic. Assured Forwarding 31 (AF31) maps to DSCP 26 (0110102011010_2) representing Class 3 with low drop probability. IEEE 802.1Q CoS maps to the 3-bit PCP field in the Layer 2 Ethernet tag. Traffic Policing maps to rate-limiting that drops or remarks traffic without queuing delay.
Each QoS term accurately matches its technical bit value or functional mechanism: Expedited Forwarding (EF) is DSCP 46 (1011102101110_2), Assured Forwarding AF31 is DSCP 26 (0110102011010_2), IEEE 802.1Q CoS uses the 3-bit PCP field, and Traffic Policing limits bandwidth by dropping or remarking excess traffic without buffering.

Step-by-Step Solution

1
Analyze Expedited Forwarding (EF) DSCP bit structure
EF uses DSCP binary 1011102101110_2, which converts to decimal 4646. It is designed for strict low-latency priority queuing.
EF is a single standardized Per-Hop Behavior for real-time traffic.
2
Calculate Assured Forwarding (AF31) DSCP decimal value
For AFxy, Class x=3x=3 yields binary 011011, Drop precedence y=1y=1 yields binary 0101, followed by trailing 00. This forms 0110102=26011010_2 = 26.
AF class and drop precedence bits directly map to their DiffServ field values.
3
Identify Layer 2 classification header location and field size
Layer 2 CoS relies on the 33-bit Priority Code Point (PCP) field within the IEEE 802.1Q VLAN header tag.
Ethernet frames lack IP TOS headers, so priority is encoded inside the 802.1Q tag.
4
Differentiate Traffic Policing mechanics from Traffic Shaping
Policing compares incoming packet rates against CIR and instantly drops or remarks out-of-profile traffic without buffering.
Shaping buffers excess traffic to smooth bursts, whereas policing acts immediately without introducing latency.

Key Concept

QoS Per-Hop Behaviors, Classification, Marking, Queuing, and Traffic Shaping/Policing
Question 204Question

Match each Simple Network Management Protocol (SNMP) operational element or security configuration on the left with its corresponding defining characteristic or transport mechanism on the right.

Click a left item, then click its matching right item

Items

SNMP Trap
SNMP Inform
SNMP GetNext
SNMPv3 authPriv

Matches

Show answer & explanation

Answer

SNMP Trap matches the unacknowledged notification sent to UDP 162; SNMP Inform matches the reliable notification requiring confirmation sent to UDP 162; SNMP GetNext matches the request to traverse MIB entries sequentially via UDP 161; SNMPv3 authPriv matches the security level providing authentication and encryption.
SNMP Traps are unacknowledged alerts sent to UDP port 162. SNMP Informs are reliable alerts sent to UDP port 162 that mandate confirmation. SNMP GetNext requests allow walking MIB structures sequentially using UDP port 161. SNMPv3 authPriv adds both authentication hashing and encryption privacy.

Step-by-Step Solution

1
Differentiate SNMP notification types based on acknowledgment mechanisms
Traps are unacknowledged best-effort notifications. Informs are application-layer acknowledged notifications that retransmit if no response is received.
Informs add reliability over UDP by requiring an explicit response from the SNMP receiver.
2
Identify polling operations and transport ports
GetNext queries are initiated by the manager to pull the subsequent OID in a MIB tree over agent listening port UDP 161.
SNMP managers query agents using port 161, whereas agents send notifications to manager port 162.
3
Evaluate SNMPv3 security levels
authPriv combines packet hashing for identity verification with data encryption for confidentiality.
SNMPv3 defines three levels: noAuthNoPriv (no auth/crypto), authNoPriv (auth without crypto), and authPriv (both auth and crypto).

Key Concept

SNMP operations, message types, transport ports, and SNMPv3 security models.
Question 205Question

A network administrator is reviewing the output of the 'show ip route' command on a Cisco IOS router. Match each routing table component or source code on the left with its correct functional definition on the right.

Click a left item, then click its matching right item

Items

Administrative Distance
Metric
Prefix Length
Source Code 'D'

Matches

Show answer & explanation

Answer

Administrative Distance matches the trustworthiness of the route source; Metric matches the protocol-specific path cost; Prefix Length matches the subnet mask bit count used for longest prefix matching; Source Code 'D' matches routes dynamically learned via EIGRP.
Each field in a Cisco IPv4 routing table entry provides distinct information: Administrative Distance prioritizes between routing protocols; Metric determines the optimal path within a single protocol; Prefix Length defines mask length for longest prefix match logic; and the code 'D' identifies routes learned via EIGRP.

Step-by-Step Solution

1
Identify the definition of Administrative Distance.
Administrative Distance rates the trustworthiness of routing protocol sources.
It allows the router to choose the preferred route source when the same network prefix is advertised by different routing sources.
2
Identify the role of Metric in a routing table entry.
Metric represents path cost calculated by an individual routing protocol.
When multiple candidate paths to a destination exist within the same protocol, the route with the lowest metric value is selected.
3
Determine the function of Prefix Length.
Prefix length denotes the subnet mask bit count and determines match specificity.
Routers evaluate prefix lengths to perform longest prefix matching as the primary criteria during packet lookup.
4
Identify the Cisco IOS routing table source code indicator 'D'.
'D' corresponds to EIGRP-learned routes.
Cisco utilizes 'D' for EIGRP (referencing its DUAL algorithm) because 'E' was historically assigned to EGP.

Key Concept

Routing Table Components and Operational Roles
Question 206Question

Evaluate the following VPN deployment requirements and protocol operational mechanics. Pair each specific VPN design scenario on the left with its corresponding protocol behavior or cryptographic implementation on the right.

Click a left item, then click its matching right item

Items

Establishing dynamic, direct spoke-to-spoke encrypted tunnels on demand across a multipoint WAN without relaying data plane traffic through a central hub router.
Providing secure remote access for unmanaged endpoint devices restricted to web-based applications without granting full network-layer IP address extension.
Passing routing protocol multicast updates (such as OSPF hellos) across an IPsec site-to-site tunnel established between two edge gateways.
Preserving IPsec packet payload integrity and session state when traversing an intermediate network boundary performing Port Address Translation (PAT).

Matches

Show answer & explanation

Answer

Each VPN architectural requirement matches its specific protocol mechanism: dynamic spoke-to-spoke tunnels correspond to DMVPN combining mGRE, NHRP, and IPsec; browser-only unmanaged endpoint access corresponds to Clientless SSL/TLS VPN; routing multicast transport over IPsec corresponds to GRE over IPsec encapsulation; and PAT traversal for ESP traffic corresponds to NAT-T utilizing UDP port 4500.
Matching each requirement to its protocol characteristic demonstrates a accurate understanding of VPN topologies and encapsulation layers: DMVPN solves hub-spoke scale limitations by establishing dynamic spoke-to-spoke mGRE tunnels via NHRP; Clientless SSL VPN provides browser-restricted access for third parties without full network extension; GRE over IPsec accommodates multicast routing protocols by wrapping multicast into unicast GRE before ESP encryption; and NAT-T enables PAT traversal by encapsulating ESP inside UDP 4500.

Step-by-Step Solution

1
Analyze dynamic multipoint requirements
Dynamic spoke-to-spoke connectivity requires NHRP for endpoint mapping and mGRE for multipoint tunnel interfaces secured by IPsec, which defines Cisco DMVPN.
Traditional site-to-site IPsec tunnels require static point-to-point peer definitions and force spoke traffic through the central hub.
2
Analyze unmanaged remote access requirements
Restricting access to web applications without full network client drivers maps to Clientless SSL/TLS VPN.
Full remote access IPsec or SSL clients provision a virtual network adapter (Layer 3 extension), whereas clientless SSL provides web-based reverse proxy application access.
3
Evaluate multicast transport constraints across IPsec
Multicast updates require GRE tunneling wrapped inside IPsec ESP (GRE over IPsec).
IPsec Security Associations (SAs) only encrypt unicast IP traffic; GRE creates a virtual unicast point-to-point header capable of encapsulating multicast payloads.
4
Identify NAT/PAT interoperability solutions for IPsec ESP
Traversing PAT boundaries requires NAT-T, which wraps protocol 50 ESP inside UDP port 4500 packets.
PAT devices rely on TCP/UDP port numbers to translate conversations. Standard ESP lacks Layer 4 headers, causing PAT devices to drop or fail to track returned tunnel packets.

Key Concept

VPN Architectural Models and Protocol Capabilities
Question 207Question

Security controls in an enterprise network fall into physical access controls, user security awareness elements, or administrative policies. Which of the following correctly matches each security control to its corresponding security program element or physical control function?

Click a left item, then click its matching right item

Items

Mantrap vestibule with interlocking doors
Simulated phishing exercises and user training
Formal incident response plan

Matches

Show answer & explanation

Answer

Mantrap vestibules correspond to physical access control preventing tailgating; simulated phishing and user training correspond to human-focused security awareness against social engineering; formal incident response plans correspond to administrative policy elements for breach mitigation.
Each item maps directly to its core function: mantraps physically control facility access to stop tailgating; phishing campaigns build human security awareness against social engineering; and incident response plans provide administrative governance for managing security breaches.

Step-by-Step Solution

1
Analyze the function of the mantrap vestibule control.
Identified as a physical barrier preventing piggybacking or tailgating into restricted areas.
Physical access controls regulate physical entry to server rooms and data centers.
2
Analyze the function of user training and phishing simulation.
Identified as a security program element aimed at personnel awareness.
User awareness programs mitigate social engineering risks by training humans.
3
Analyze the function of an incident response plan.
Identified as an administrative policy defining organizational response procedures.
Administrative controls consist of policies, governance frameworks, and operational guidelines.

Key Concept

Classification of physical access controls, security awareness elements, and administrative security policies.
Question 208Question

Match each Quality of Service (QoS) concept on the left with its corresponding operational description on the right.

Click a left item, then click its matching right item

Items

Expedited Forwarding (EF)
Class-Based Weighted Fair Queuing (CBWFQ)
Low Latency Queuing (LLQ)
Trust Boundary

Matches

Show answer & explanation

Answer

Expedited Forwarding (EF) matches with the description for low latency voice traffic using DSCP 46. Class-Based Weighted Fair Queuing (CBWFQ) matches with minimum bandwidth guarantees per class without a strict priority queue. Low Latency Queuing (LLQ) matches with bandwidth guarantees combined with a strict priority queue. Trust Boundary matches with the network location where QoS markings are validated or re-marked.
Each QoS term correctly aligns with its architectural definition: EF delivers low-latency PHB (DSCP 46); CBWFQ guarantees bandwidth allocations per class; LLQ incorporates a strict priority queue alongside CBWFQ; and the Trust Boundary dictates where packet QoS fields are evaluated and trusted.

Step-by-Step Solution

1
Identify the primary function of Expedited Forwarding (EF).
EF uses DSCP 46 (101110) to deliver a low-loss, low-latency, low-jitter service ideal for voice.
Understanding PHB standards is fundamental for matching traffic types to QoS markings.
2
Differentiate between CBWFQ and LLQ queuing algorithms.
CBWFQ provides class-based bandwidth guarantees. LLQ builds on CBWFQ by adding a strict priority queue to service real-time traffic first.
Real-time voice traffic requires a strict priority queue provided by LLQ to minimize jitter.
3
Determine the role of a Trust Boundary in enterprise QoS deployments.
It defines the device or port threshold where packet markings are either accepted as trusted or re-marked to default values.
Enforcing trust boundaries prevents end-user devices from inappropriately elevating their traffic priority.

Key Concept

QoS Per-Hop Behaviors, Queuing Mechanisms (CBWFQ vs LLQ), and Trust Boundary Architecture
Question 209Question

An enterprise network administrator is conducting a security risk assessment across the organization's infrastructure. Match each security incident description on the left to its appropriate technical mitigation control on the right.

Click a left item, then click its matching right item

Items

An attacker uses botnets to flood an enterprise internet edge router with ICMP traffic, causing link saturation and preventing legitimate user access.
A rogue device connected to an unmonitored switch port rapidly transmits frames with randomized source MAC addresses to overflow the switch MAC lookup table.
An external malicious actor executes an automated password-spraying script against an exposed network management portal to gain privileged access.
An unauthorized host on a shared VLAN captures cleartext management session traffic containing administrative credentials sent to network devices.

Matches

Show answer & explanation

Answer

DDoS flood attacks pair with upstream DDoS mitigation and edge ACLs. MAC table flooding pairs with Port Security limits. Password-spraying attacks pair with Multi-Factor Authentication (MFA) and lockout policies. Cleartext credential sniffing pairs with SSHv2 enforcement.
Each attack vector targets a specific network plane or resource: DDoS targets bandwidth availability (mitigated via upstream filtering), CAM table flooding targets Layer 2 switch buffer resources (mitigated via Port Security limits), password spraying targets authentication mechanisms (mitigated via MFA/lockout policies), and cleartext sniffing targets data confidentiality (mitigated via SSHv2 encryption).

Step-by-Step Solution

1
Analyze the attack mechanism in the first scenario (flooding edge router with ICMP traffic).
Identify this as a Distributed Denial of Service (DDoS) attack targeting network availability.
DDoS attacks require boundary defenses such as edge ACLs and upstream scrubbing services.
2
Analyze the attack mechanism in the second scenario (randomized source MAC frames filling switch table).
Identify this as a MAC address table (CAM table) overflow attack targeting Layer 2 switch operations.
Port Security enforces maximum MAC learning limits on access ports to block unauthorized MAC generation.
3
Analyze the attack mechanism in the third scenario (automated password-spraying script).
Identify this as a brute-force credential attack targeting authentication mechanisms.
MFA and account lockout rules prevent single factor password guessing from compromising accounts.
4
Analyze the attack mechanism in the fourth scenario (capturing cleartext management session traffic).
Identify this as an eavesdropping/sniffing vulnerability resulting from unencrypted management protocols.
SSHv2 provides cryptographic encryption and integrity checks for remote management, mitigating eavesdropping.

Key Concept

Key Security Concepts, Threats, Vulnerabilities, and Mitigations
Question 210Question

Match each IPsec VPN framework component or feature on the left with its correct primary operational function on the right.

Click a left item, then click its matching right item

Items

Internet Key Exchange (IKE)
Encapsulating Security Payload (ESP)
Diffie-Hellman (DH) Group
NAT Traversal (NAT-T)

Matches

Show answer & explanation

Answer

Internet Key Exchange (IKE) pairs with negotiating security parameters, authenticating peers, and managing SAs. Encapsulating Security Payload (ESP) pairs with providing data confidentiality, data integrity, and origin authentication for IP payloads. Diffie-Hellman (DH) Group pairs with enabling peers to securely derive a shared symmetric encryption key over an untrusted network. NAT Traversal (NAT-T) pairs with encapsulating ESP packets inside UDP port 4500 to traverse intermediate PAT devices.
Each IPsec component fulfills a distinct cryptographic or transport requirement: IKE handles control-plane negotiations and SA creation; ESP encrypts data payload and validates integrity; Diffie-Hellman allows safe secret derivation over public IP backbones; and NAT-T wraps ESP into UDP port 4500 so port address translation devices do not drop or modify the encrypted traffic.

Step-by-Step Solution

1
Identify the control plane protocol responsible for authentication, parameter negotiation, and Security Association (SA) management.
Match Internet Key Exchange (IKE) with SA negotiation and peer authentication.
IKE (v1 or v2) is specifically responsible for establishing control channels and negotiating cryptographic sets (SAs).
2
Distinguish between data protection mechanisms and key exchange mechanisms within the IPsec suite.
Match Encapsulating Security Payload (ESP) with data encryption and integrity, and Diffie-Hellman (DH) with shared key calculation.
ESP (IP protocol 50) encrypts user data, while DH public-key exchange algorithms generate matching symmetric keys on both endpoints.
3
Determine the solution used to overcome IPsec header modification issues caused by address translation devices.
Match NAT Traversal (NAT-T) with UDP port 4500 encapsulation.
Because ESP headers lack Layer 4 port numbers required for PAT, NAT-T inserts a UDP port 4500 header in front of the ESP packet.

Key Concept

IPsec VPN Protocol Framework and NAT Traversal Operations
Question 211Question

Match each VPN deployment scenario or operational requirement on the left with the corresponding VPN technology or protocol implementation on the right.

Click a left item, then click its matching right item

Items

Connecting two fixed corporate branch office routers across an untrusted WAN using static peer IP addresses and pre-shared keys without dynamic overlay routing.
Providing web-browser-only remote access to internal intranet web portals for external contractors without installing software on endpoint devices.
Authenticating mobile teleworkers using dedicated endpoint software to secure all IP network layer traffic with optional split-tunnel capabilities.
Establishing scalable dynamic spoke-to-spoke encrypted tunnels between multiple enterprise sites using Multipoint GRE and Next Hop Resolution Protocol.

Matches

Show answer & explanation

Answer

Static branch gateway connections match Static Site-to-Site IPsec VPN. Browser-only contractor access matches Clientless SSL VPN. Mobile endpoint client software matches Client-Based Remote Access VPN. Scalable dynamic spoke-to-spoke using mGRE/NHRP matches DMVPN.
Each requirement maps precisely to its characteristic VPN architecture: standard point-to-point router links map to Static Site-to-Site IPsec, browser-bound contractor access maps to Clientless SSL VPN, full network layer remote connectivity maps to Client-Based Remote Access VPN, and dynamic multi-site scaling with mGRE/NHRP maps to DMVPN.

Step-by-Step Solution

1
Analyze fixed gateway requirements
Connecting static branch routers with fixed peer IPs corresponds to standard Site-to-Site IPsec VPN.
Site-to-Site IPsec provides seamless, transparent network-to-network connectivity between static gateways.
2
Analyze clientless endpoint access requirements
Web portal access via web browser without endpoint software installation corresponds to Clientless SSL VPN.
Clientless SSL VPN operates via TLS within standard browsers to grant restricted access to intranet applications.
3
Analyze full network layer remote access client requirements
Dedicated endpoint software managing split-tunneling and IP layer security corresponds to Client-Based Remote Access VPN.
Client software like Cisco AnyConnect encapsulates and encrypts IP layer traffic for mobile users.
4
Analyze dynamic multi-site topology requirements
Combining mGRE, NHRP, and IPsec for dynamic direct spoke-to-spoke tunnels corresponds to DMVPN.
DMVPN simplifies hub-and-spoke and mesh topologies by dynamically resolving and establishing tunnels between spoke routers.

Key Concept

Classification and operational mechanics of Remote Access (Clientless SSL and Client-based AnyConnect) versus Site-to-Site VPN architectures (Static IPsec and DMVPN).
Question 212Question

A network security engineering team is analyzing threat vectors affecting enterprise switch and router infrastructure. Match each security threat scenario on the left with its primary technical mitigation mechanism on the right.

Click a left item, then click its matching right item

Items

An attacker transmits forged ARP responses on a campus VLAN to intercept traffic intended for the default gateway.
An attacker floods an edge router with high volumes of TCP SYN packets to exhaust CPU and control plane resources.
An unauthorized laptop connects to an unassigned Ethernet port in a conference room to gain access to internal subnet resources.
An attacker performs automated dictionary login attempts against exposed SSH remote management endpoints.

Matches

Show answer & explanation

Answer

Forged ARP responses map to Dynamic ARP Inspection (DAI). Control plane TCP SYN flooding maps to Control Plane Policing (CoPP). Unauthorized wired switch port connection maps to 802.1X Port-Based Network Access Control. Automated SSH dictionary attacks map to Multi-Factor Authentication (MFA) and Rate Limiting.
Dynamic ARP Inspection checks ARP packets against trusted bindings to stop ARP poisoning. Control Plane Policing protects router processing resources by enforcing rate limits on traffic destined to the control plane. 802.1X enforces identity verification before opening switch port access. Multi-Factor Authentication combined with login rate limiting neutralizes automated password guessing.

Step-by-Step Solution

1
Analyze Layer 2 address spoofing attacks on local switch subnets.
Identify ARP spoofing / poisoning as the threat vector.
Dynamic ARP Inspection intercepts and verifies invalid IP-to-MAC bindings using the DHCP snooping database.
2
Evaluate infrastructure plane threats targeting router CPU processing.
Identify control plane Denial-of-Service (DoS) exhaust attacks.
Control Plane Policing applies QoS policies directly to CPU-bound traffic queues to throttle malicious floods.
3
Examine physical access security and port-level network access control.
Identify unauthorized host connectivity on campus switch ports.
802.1X authenticates endpoints at Layer 2 before permitting traffic forwarding on the access switch port.
4
Assess administrative application threats targeting remote login services.
Identify credential harvesting and brute-force password attacks.
MFA ensures stolen or guessed passwords alone are insufficient, while rate limiting restricts high-frequency login attempts.

Key Concept

Classification of Network Security Threats and Primary Mitigation Controls
Estimated Time:2m 0s
Question 213Question

Match each Cisco Layer 2 security feature or interface trust state on the left with its correct operational behavior or dependency on the right.

Click a left item, then click its matching right item

Items

Dynamic ARP Inspection (DAI)
DHCP Snooping Untrusted Interface
Port Security Sticky MAC Learning
DHCP Snooping Binding Database

Matches

Show answer & explanation

Answer

Dynamic ARP Inspection matches with validating ARP packets against IP-to-MAC mappings. DHCP Snooping Untrusted Interface matches with dropping unauthorized DHCP server responses. Port Security Sticky MAC Learning matches with adding dynamically learned MAC addresses to the running configuration. DHCP Snooping Binding Database matches with tracking IP, MAC, VLAN, and interface bindings.
Dynamic ARP Inspection operates by validating incoming ARP packets against trusted IP-to-MAC bindings stored in the DHCP snooping binding database. An untrusted DHCP snooping interface blocks incoming server response messages (OFFER/ACK) to prevent rogue DHCP server deployment. Port Security sticky MAC learning writes dynamically learned host MAC addresses directly into the running configuration. The DHCP Snooping Binding Database stores client IP, MAC, VLAN, and port associations which are referenced by security features like DAI.

Step-by-Step Solution

1
Analyze Dynamic ARP Inspection (DAI) functionality
DAI inspects ARP packets on untrusted ports and compares their source MAC and IP against trusted database entries.
DAI mitigates ARP spoofing by verifying ARP packet payload integrity.
2
Analyze DHCP Snooping interface trust states
Untrusted ports only permit DHCP client requests (DISCOVER, REQUEST); server responses (OFFER, ACK) are dropped.
Access ports default to untrusted to prevent unauthorized rogue DHCP servers.
3
Analyze Port Security sticky MAC learning behavior
Learned MAC addresses are written to the running configuration under the interface context.
Sticky MAC allows automatic MAC learning while preserving learned entries across link resets without manual static entry.
4
Identify the role of the DHCP Snooping Binding Database
It holds the IP-MAC-VLAN-Port binding entries populated by DHCP ACK messages.
Other L2 security mechanisms like DAI rely on this database to validate packets.

Key Concept

Layer 2 Security Mechanisms and Dependencies (Port Security, DHCP Snooping, DAI)
Question 214Question

Match each network management operational mechanism under an automated network model to its primary operational impact.

Click a left item, then click its matching right item

Items

Declarative State Model
Streaming Telemetry
Centralized API Orchestration
Automated Compliance Auditing

Matches

Show answer & explanation

Answer

Declarative State Model matches with reconciling device configurations to eliminate drift; Streaming Telemetry matches with pushing real-time performance metrics to replace polling overhead; Centralized API Orchestration matches with executing standardized change templates across multiple nodes; Automated Compliance Auditing matches with detecting unauthorized out-of-band changes.
Each automated network management mechanism aligns directly with its primary operational benefit: Declarative models remove state drift, streaming telemetry delivers real-time push visibility, API orchestration enables scaled consistent changes, and compliance auditing flags unauthorized manual changes.

Step-by-Step Solution

1
Analyze Declarative State Model
Declarative models specify 'what' the end state should be rather than 'how' to perform step-by-step commands. This enables automated reconciliation against a single source of truth, removing configuration drift.
Matching core intent of declarative automation.
2
Analyze Streaming Telemetry
Streaming telemetry uses subscription-based push mechanisms (e.g., gRPC, NETCONF/RESTCONF push) to stream structured data continuously, avoiding SNMP pull polling overhead.
Differentiating push telemetry from legacy poll-based SNMP monitoring.
3
Analyze Centralized API Orchestration
Centralized API orchestration interacts with network devices or network controllers via northbound/southbound REST/NETCONF APIs to push rapid, consistent infrastructure changes.
Understanding API-driven scale vs per-device CLI administration.
4
Analyze Automated Compliance Auditing
Automated compliance tools regularly evaluate active configurations against defined baseline rules, highlighting unauthorized ad-hoc changes.
Identifying governance and risk reduction benefits of automation.

Key Concept

Operational Benefits of Network Automation Mechanisms
Estimated Time:1m 30s
Question 215Question

In Cisco Software-Defined Access (SD-Access) architectures, clear functional boundary separation exists between the underlay, overlay, control plane, and data plane components. Match each SDN fabric component or protocol on the left with its correct primary architectural role or operational mechanism on the right.

Click a left item, then click its matching right item

Items

Locator/ID Separation Protocol (LISP)
Virtual Extensible LAN (VXLAN)
Underlay Routing Infrastructure
Fabric Edge Node

Matches

Show answer & explanation

Answer

Locator/ID Separation Protocol (LISP) matches with tracking EID-to-RLOC mappings in the overlay control plane. Virtual Extensible LAN (VXLAN) matches with encapsulating original Layer 2 frames in UDP headers for data plane transport. Underlay Routing Infrastructure matches with establishing physical topology connectivity and IP reachability using an IGP. Fabric Edge Node matches with authenticating endpoints and updating the control plane mapping database.
Each component is mapped accurately according to Cisco SD-Access fabric architecture definitions: LISP manages EID-to-RLOC control plane resolution; VXLAN handles data plane encapsulation; the underlay IGP ensures physical node reachability; and the Fabric Edge Node authenticates end hosts and connects them to the fabric.

Step-by-Step Solution

1
Identify the primary function of Locator/ID Separation Protocol (LISP) within SDN fabric architecture.
LISP separates an endpoint's identity (EID) from its network location (RLOC) and operates as the control plane to map host locations.
Control plane operations track where endpoints reside without broadcasting MAC addresses throughout the physical core.
2
Determine the role of Virtual Extensible LAN (VXLAN).
VXLAN encapsulates Layer 2 ethernet frames inside UDP packets (destination port 4789) for overlay data plane transport.
VXLAN provides virtualized Layer 2 and Layer 3 overlay transport across an IP underlay without requiring Layer 2 stretching in the physical infrastructure.
3
Analyze the responsibility of the Underlay Routing Infrastructure.
The underlay provides hop-by-hop physical IP transport using IGP protocols like IS-IS or OSPF.
Overlay tunnel endpoints (VTEPs / RLOCs) rely strictly on underlay IP reachability to exchange encapsulated traffic.
4
Evaluate the operational scope of the Fabric Edge Node.
The Fabric Edge Node connects end devices, handles client onboarding/security, and registers host EIDs with the LISP Control Plane Node.
Edge nodes function as the entry point into the SD-Access fabric for user traffic and telemetry.

Key Concept

Software-Defined Architecture Roles: Overlay, Underlay, Control Plane (LISP), and Data Plane (VXLAN)
Question 216Question

An enterprise network engineering team is evaluating architectural shifts during a migration from traditional per-device managed networking to a software-defined, controller-based model. Match each architectural component or interface on the left with its corresponding operational role on the right.

Click a left item, then click its matching right item

Items

Traditional Distributed Control Plane
Controller-Based Centralized Control Plane
Southbound Interface (SBI)
Northbound Interface (NBI)

Matches

Show answer & explanation

Answer

Traditional Distributed Control Plane matches with local protocol processing on individual nodes; Controller-Based Centralized Control Plane matches with off-node global topology calculation and state pushing; Southbound Interface (SBI) matches with controller-to-device communication using NETCONF/RESTCONF/OpenFlow; Northbound Interface (NBI) matches with RESTful APIs exposed to management applications and scripts.
In traditional networking, each network device operates its own distributed control plane locally to compute paths and populate its forwarding tables. In SDN controller-based architectures, control plane intelligence is decoupled from network hardware and centralized within an SDN controller. The controller relies on Southbound Interfaces (SBIs) using protocols such as NETCONF, RESTCONF, or OpenFlow to manage data plane devices, and presents Northbound Interfaces (NBIs) using RESTful APIs to higher-level management applications and scripts.

Step-by-Step Solution

1
Analyze control plane distribution in traditional versus controller-based models.
Identify that traditional networks run control plane calculations independently per device, whereas SDN controllers centralize the control plane intelligence off-node.
Traditional devices build local RIBs using distributed routing protocols, while SDN controllers maintain global topology visibility.
2
Distinguish between Northbound and Southbound directional interfaces relative to the SDN controller.
Confirm that Southbound interfaces communicate down to network elements, whereas Northbound interfaces communicate up to orchestrators and management applications.
Southbound protocols (NETCONF, RESTCONF, OpenFlow) handle device-level provisioning; Northbound REST APIs allow software programs to dictate network behavior.
3
Map each component ID to its exact functional description.
Pair traditional control plane to local autonomous table building, centralized control plane to global off-node calculation, SBI to NETCONF/RESTCONF device control, and NBI to RESTful application APIs.
Ensures accurate architectural alignment with Cisco SDN framework principles.

Key Concept

Architectural plane separation, centralized control plane dynamics, and Southbound versus Northbound interface roles in Software-Defined Networking.
Question 217Question

Match each HTTP request method and header combination used in Cisco REST-based API operations (such as RESTCONF and Cisco DNA Center) to its correct operational behavior and CRUD/idempotency characteristic.

Click a left item, then click its matching right item

Items

HTTP POST with Content-Type: application/yang-data+json to a data root container
HTTP PUT with a complete resource payload targeting an existing interface URI
HTTP PATCH containing specific updated fields targeting an existing device configuration URI
HTTP GET with Accept: application/yang-data+xml targeting an operational state endpoint
HTTP DELETE targeting an established RESTCONF configuration path

Matches

Show answer & explanation

Answer

Each HTTP verb and header pair matches directly to its operational CRUD semantics: POST creates child resources, PUT replaces whole resources idempotently, PATCH modifies targeted fields, GET retrieves state data matching the Accept header, and DELETE removes resources idempotently.
Each HTTP verb cleanly maps to a fundamental CRUD operation with defined idempotency and header role rules: POST (Create, non-idempotent), PUT (Replace, idempotent), PATCH (Partial Modify), GET (Read, safe/idempotent with Accept header controlling response format), and DELETE (Delete, idempotent).

Step-by-Step Solution

1
Analyze HTTP POST semantics and Content-Type header
POST creates new resources under a parent URI and is non-idempotent. Content-Type indicates payload format sent by the client.
Creating a new child resource is the core definition of RESTful POST operations.
2
Differentiate between PUT and PATCH operations
PUT completely replaces the resource at the URI (idempotent), whereas PATCH updates only specified fields (partial modification).
Understanding full replacement vs partial delta update is critical for REST API configuration management.
3
Evaluate GET request and Accept header mechanics
GET retrieves data without modifying state (safe/idempotent). The Accept header dictates the payload format returned by the server.
Accept header controls response media type formatting (XML in this scenario).
4
Verify DELETE operational semantics
DELETE removes the specified resource path and returns success status code 204 No Content upon removal.
DELETE corresponds strictly to the Delete operation of CRUD.

Key Concept

Mapping HTTP Verbs to CRUD Operations, Idempotency Characteristics, and Header Controls in REST APIs
Question 218Question

Match each network operation or architectural mechanism to its corresponding structural component in traditional vs. controller-based networking.

Click a left item, then click its matching right item

Items

Autonomous path computation executed locally on individual routing nodes using distributed routing protocols
RESTful API abstractions that enable network applications and orchestrators to communicate policy intent to a centralized platform
Centralized software engine maintaining a global network topology view and dictating forwarding logic across the fabric
Data-model driven communication protocols (such as NETCONF, RESTCONF, or OpenFlow) used to program physical switch tables

Matches

Show answer & explanation

Answer

Autonomous local path computation maps to the Traditional Network Control Plane. RESTful APIs for applications map to the Controller-Based Northbound Interface (NBI). The central software engine maintaining global topology maps to the Controller-Based Centralized Control Plane. Protocols like NETCONF/RESTCONF programming hardware map to the Controller-Based Southbound Interface (SBI).
Autonomous local path computation corresponds to the traditional distributed control plane. RESTful application interaction corresponds to the Northbound Interface. The central topology engine corresponds to the controller's centralized control plane. Protocol mechanisms like NETCONF/RESTCONF/OpenFlow correspond to the Southbound Interface.

Step-by-Step Solution

1
Analyze control plane distribution differences
Identify that local autonomous path computation is characteristic of distributed traditional control planes, whereas a central software engine represents controller-based control planes.
Traditional networks rely on distributed node intelligence, while SDN architecture centralizes control logic.
2
Evaluate API directional roles in controller architecture
Distinguish between application-to-controller communication (Northbound) and controller-to-device communication (Southbound).
Northbound APIs interface with business applications; Southbound APIs interface with physical/virtual forwarding infrastructure.
3
Correlate protocols to their respective interfaces and planes
Confirm that NETCONF, RESTCONF, and OpenFlow function as Southbound protocols programming the data plane.
SBIs are responsible for translating controller decisions into hardware forwarding table entries.

Key Concept

Decoupling and centralization of control planes and API classification (NBI vs SBI) in controller-based networking
Question 219Question

A network administrator retrieves interface state data from a Cisco IOS XE device using a RESTCONF GET request. Match each JSON key from the returned payload to its correct JSON data structure or data type based on standard JSON syntax rules.

{
"ietf-interfaces:interface": {
"name": "GigabitEthernet0/0/1",
"enabled": true,
"speed": 1000,
"ietf-ip:ipv4": {
"address": [
{
"ip": "10.0.12.1",
"netmask": "255.255.255.0"
}
]
}
}
}

Which JSON data type or structure corresponds to each specified key?

Click a left item, then click its matching right item

Items

"enabled"
"speed"
"address"
"ietf-ip:ipv4"

Matches

Show answer & explanation

Answer

"enabled" matches Boolean value; "speed" matches Number value; "address" matches Array / List; "ietf-ip:ipv4" matches Object / Dictionary.
Each key in a JSON payload corresponds to a specific primitive data type or data structure: key "enabled" value `true` is a Boolean, key "speed" value `1000` is a Number, key "address" value `[...]` is an Array, and key "ietf-ip:ipv4" value `{...}` is a nested Object.

Step-by-Step Solution

1
Locate key "enabled" in the JSON structure
The value associated with "enabled" is `true`, which is unquoted and represents a Boolean value.
In JSON, unquoted `true` or `false` represents a boolean primitive.
2
Locate key "speed" in the JSON structure
The value associated with "speed" is `1000`, an unquoted sequence of digits representing a Number.
Numbers in JSON are written directly without double quotes.
3
Locate key "address" in the JSON structure
The value associated with "address" begins with `[` and ends with `]`, identifying an Array.
Square brackets `[]` delimit ordered collections/arrays in JSON syntax.
4
Locate key "ietf-ip:ipv4" in the JSON structure
The value associated with "ietf-ip:ipv4" begins with `{` and ends with `}`, identifying an Object.
Curly braces `{}` delimit key-value object dictionaries in JSON syntax.

Key Concept

JSON syntax data types (Strings, Numbers, Booleans, Objects, and Arrays)
Question 220Question

Match each Quality of Service (QoS) mechanism or Per-Hop Behavior (PHB) on the left to its corresponding operational characteristic or header specification on the right.

Click a left item, then click its matching right item

Items

Expedited Forwarding (EF)
Assured Forwarding 41 (AF41)
Traffic Policing
Traffic Shaping

Matches

Show answer & explanation

Answer

Expedited Forwarding matches DSCP decimal 46 / Strict Priority Queue service; Assured Forwarding 41 matches DSCP decimal 34 / Class 4 low drop probability; Traffic Policing matches immediately dropping or remarking excess traffic without queuing; Traffic Shaping matches buffering excess traffic to smooth bursty egress rates.
Expedited Forwarding (EF) is standard DSCP 46 (010110) intended for real-time traffic requiring low latency/jitter via priority queuing. Assured Forwarding 41 (AF41) corresponds to DSCP 34 (100010) offering Class 4 high-priority bandwidth with a low drop probability. Traffic Policing measures rate limits and drops or remarks exceeding traffic immediately. Traffic Shaping regulates egress rate spikes by holding overflow packets in memory buffers.

Step-by-Step Solution

1
Identify Differentiated Services Code Point (DSCP) values and binary encodings for Per-Hop Behaviors (PHBs).
EF uses DSCP 46 (010110). AF41 uses class 4 (001) with low drop (01) plus trailing zero (100010 = 34).
DiffServ DSCP uses 6 bits in the IPv4 ToS field. EF guarantees strict priority service while AFxy defines class x (1-4) and drop preference y (1-3).
2
Differentiate traffic enforcement mechanisms based on memory buffer utilization.
Policing discards/remarks non-conforming packets without delay; Shaping delays non-conforming packets in egress buffers.
Policers do not support queuing/buffering and operate inbound or outbound, whereas shapers require queue buffers and operate outbound only.

Key Concept

QoS Per-Hop Behaviors (EF/AF) and Rate Enforcement (Policing vs Shaping)
PreviousPage 11 / 12Next
All practice questions — Cisco CCNA | Examkin