Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 221Question →

A network engineer is configuring a virtualized server that runs a bare-metal hypervisor. Multiple virtual machines (VMs) residing on the same host belong to different IP subnets. Which device or functional role is required to route traffic between these subnets while maintaining separate broadcast domains?

Show answer & explanation

Answer: A Layer 3 routing function (router or Layer 3 switch) that interconnects subnets and bounds broadcast traffic

Answer

A Layer 3 routing function (router or Layer 3 switch) that interconnects subnets and bounds broadcast traffic.
Inter-subnet traffic requires a Layer 3 device (router or L3 switch/vRouter). Layer 3 devices terminate Layer 2 broadcast domains, ensuring broadcast packets do not cross subnet boundaries while allowing unicast packets to be routed between different networks.

Step-by-Step Solution

1
Identify the requirement for inter-subnet communication and broadcast separation.
IP subnets represent separate Layer 3 networks, which require Layer 3 routing to forward packets between them.
Layer 2 switches only forward frames within the same broadcast domain (VLAN).
2
Evaluate the role of Layer 3 devices in broadcast domain management.
Routers and Layer 3 switches drop Layer 2 broadcast frames by default, creating boundaries for broadcast domains.
This prevents broadcast storms from traversing between distinct subnets.

Key Concept

Layer 3 Routing and Broadcast Domain Separation
Estimated Time:1m 30s
Question 222Question →

Match each enterprise network component on the left to its primary operational role on the right.

Click a left item, then click its matching right item

Items

Core Router
Wireless LAN Controller (WLC)
Layer 2 Switch
Next-Generation IPS (NGIPS)

Matches

Show answer & explanation

Answer

Core Router maps to Layer 3 path selection and broadcast domain separation; Wireless LAN Controller maps to centralized AP configuration and RF management; Layer 2 Switch maps to frame forwarding via MAC address table within a single broadcast domain; Next-Generation IPS maps to deep packet inspection for real-time malicious payload prevention.
Each component is correctly matched to its defined operational role: core routers route packets between subnets and delineate broadcast domains; WLCs manage lightweight wireless deployments centrally; Layer 2 switches forward frames using MAC tables within a broadcast domain; and NGIPS performs deep inspection on packet payloads.

Step-by-Step Solution

1
Identify the OSI layer and primary functional scope for each listed network component.
Categorize Core Router (Layer 3 routing/broadcast boundary), WLC (centralized wireless control plane), Layer 2 Switch (Layer 2 frame switching), and NGIPS (deep packet security inspection).
Matching components requires isolating their exact architectural responsibilities within enterprise network infrastructure.
2
Correlate each device with its matching operational descriptor.
Pair left_1 to right_2, left_2 to right_1, left_3 to right_4, and left_4 to right_3.
Each functional statement accurately describes the core operation of the corresponding hardware or software control component.

Key Concept

Enterprise Network Components Roles and Functions
Estimated Time:1m 30s
Question 223Question →

A network engineer is deploying a high-availability infrastructure using Type 1 hypervisors in an enterprise data center. Which two statements accurately describe the operational and structural characteristics of Type 1 hypervisors and their virtual network components? (Select two.)

Select all that apply

Show answer & explanation

Answer: The hypervisor runs directly on the host hardware substrate without requiring an underlying general-purpose operating system.; Virtual switches inside the hypervisor forward Layer 2 frames between local virtual machines and map traffic to physical network interface cards.

Answer

The correct statements are that the hypervisor runs directly on the host hardware substrate without requiring an underlying general-purpose operating system, and that virtual switches inside the hypervisor forward Layer 2 frames between local virtual machines and map traffic to physical network interface cards.
Type 1 hypervisors (such as VMware ESXi or Cisco UCS hypervisors) operate directly on bare-metal server hardware without requiring a host operating system layer. Inside the hypervisor environment, software-defined virtual switches perform Layer 2 forwarding between virtual machine virtual NICs (vNICs) and multiplex frame traffic onto physical network interface card (pNIC) uplinks.

Step-by-Step Solution

1
Examine hypervisor architecture classification
Type 1 (bare-metal) hypervisors install directly on hardware without an intermediate host OS layer.
Hypervisor architecture determines resource overhead and direct hardware interaction capabilities.
2
Analyze virtual switch operation and frame forwarding
Virtual switches manage internal Layer 2 frame switching between vNICs and connect them to physical NIC (pNIC) uplinks.
Virtual switches provide network abstraction within hypervisor memory to bridge virtual interfaces to physical network ports.
3
Evaluate loop prevention mechanisms in virtual switches
Virtual switches prevent loops by architectural design (disallowing frame bridging directly between physical uplinks) rather than running STP elections.
Standard vSwitches do not process or exchange STP BPDUs across uplinks to form topology loops.

Key Concept

Type 1 Hypervisor Architecture and Virtual Switch Functionality
Question 224Question →

When IEEE 802.1Q encapsulation is applied to an Ethernet frame traversing a trunk link, how many bytes are inserted into the original frame header for the 802.1Q tag?

Show answer & explanation

Answer: 4 bytes

Answer

The 802.1Q header inserts a total of 4 bytes into the original Ethernet frame header.
The correct answer is 4 bytes. An IEEE 802.1Q tag inserts 4 bytes (32 bits) into the Ethernet frame header. This includes 2 bytes for the Tag Protocol Identifier (TPID, fixed at 0x8100) and 2 bytes for Tag Control Information (TCI, containing 802.1p priority bits, DEI, and the 12-bit VLAN ID).

Step-by-Step Solution

1
Identify the structure of an IEEE 802.1Q tagged frame.
The 802.1Q header is inserted directly after the Source MAC address field.
This allows intermediate switches to identify VLAN membership without re-encapsulating the entire payload.
2
Break down the components of the 802.1Q tag.
The tag consists of a 2-byte Tag Protocol Identifier (TPID: 0x8100) and a 2-byte Tag Control Information (TCI) field containing Priority Code Point (3 bits), Drop Eligible Indicator (1 bit), and VLAN ID (12 bits).
Summing 2 bytes for TPID and 2 bytes for TCI equals a total header size of 4 bytes.

Key Concept

802.1Q Frame Tagging Header Architecture
Estimated Time:45s
Question 225Question →

A network engineer is auditing wireless performance metrics across an enterprise deployment. Match each wireless radio frequency (RF) metric or unit on the left to its corresponding definition on the right.

Click a left item, then click its matching right item

Items

RSSI
Noise Floor
SNR
dBm

Matches

Show answer & explanation

Answer

RSSI matches the relative measurement vendor index; Noise Floor matches the background RF energy measure; SNR matches the comparative decibel difference between signal and noise; dBm matches the absolute unit of power referenced to 1 milliwatt.
RSSI is a relative vendor index for received power, Noise Floor is the total ambient background RF energy, SNR represents the decibel difference between signal strength and noise floor, and dBm is an absolute unit of power referenced to 1 milliwatt.

Step-by-Step Solution

1
Differentiate absolute power measurements from relative indicators.
dBm is an absolute power value referenced to 1 milliwatt (0 dBm=1 mW0\text{ dBm} = 1\text{ mW}), while RSSI is a relative vendor-dependent index of signal strength.
Understanding absolute versus relative units prevents mistaking arbitrary scales for standardized power measurements.
2
Identify environmental RF characteristics.
The noise floor measures ambient background RF interference from natural and non-Wi-Fi sources.
Establishing the noise floor baseline is required for assessing overall RF channel quality.
3
Evaluate the signal quality calculation.
SNR calculates the difference between the received signal level and the noise floor (SNR=Signal Power−Noise Floor\text{SNR} = \text{Signal Power} - \text{Noise Floor}).
A higher SNR value directly correlates with higher data transmission rates and lower frame retry rates.

Key Concept

Wireless RF Measurement Metrics and Units
Question 226Question →

A Cisco router displays the following routing table output:

text
Gateway of last resort is not set

10.0.0.0/8 is variably subnetted, 4 subnets, 3 masks
O 10.75.0.0/16 [110/20] via 192.168.12.2, 00:14:22, GigabitEthernet0/0
D 10.75.96.0/19 [90/307200] via 192.168.13.2, 01:42:05, GigabitEthernet0/1
S 10.75.100.0/24 [1/0] via 192.168.14.2, 03:02:10, GigabitEthernet0/2
O IA 10.75.100.32/27 [110/65] via 192.168.15.2, 00:05:10, GigabitEthernet0/3

The router receives an IP packet destined for 10.75.100.5010.75.100.50. Which next-hop IP address and outgoing interface will the router select to forward this packet?

Show answer & explanation

Answer: 192.168.15.2 via GigabitEthernet0/3

Answer

Next-hop address 192.168.15.2 via interface GigabitEthernet0/3
When a router receives a packet, it compares the destination IP address against all entries in its routing table and selects the route with the longest prefix match (most specific subnet mask). The destination address 10.75.100.50 matches four routes in the routing table: /16, /19, /24, and /27. The /27 route (10.75.100.32/27) has the most matching network bits (27 bits), so the router forwards the packet to next-hop 192.168.15.2 out interface GigabitEthernet0/3.

Step-by-Step Solution

1
Identify all candidate routes that encompass destination IP 10.75.100.50
The address 10.75.100.50 falls within 10.75.0.0/16, 10.75.96.0/19 (10.75.96.0 - 10.75.127.255), 10.75.100.0/24 (10.75.100.0 - 10.75.100.255), and 10.75.100.32/27 (10.75.100.32 - 10.75.100.63).
A packet destination must match the subnet range of a candidate route entry.
2
Apply the Longest Prefix Match (LPM) rule across all matching routes
The prefix lengths are /16, /19, /24, and /27. The longest prefix match is /27 (10.75.100.32/27).
Cisco routers always prefer the route with the most specific prefix (longest subnet mask) regardless of administrative distance or metric.
3
Extract the next-hop IP and outgoing interface from the longest prefix match route entry
The entry 10.75.100.32/27 specifies next-hop 192.168.15.2 via interface GigabitEthernet0/3.
The router uses the forward destination components listed in the winning routing table entry.

Key Concept

Longest Prefix Match Rule
Estimated Time:1m 15s
Question 227Question →

A network engineer is troubleshooting event notifications on a Cisco IOS XE router. During periods of heavy WAN link congestion, critical interface state notifications sent to the Network Management System (NMS) are occasionally dropped and lost. The organization mandates that all management notifications must require an explicit application-layer acknowledgment from the NMS to trigger retransmissions if unacknowledged, while ensuring message integrity, authentication, and payload encryption. Which SNMP configuration change satisfies both the operational delivery guarantee and security requirements?

Show answer & explanation

Answer: Configure the router to send SNMP Informs rather than Traps, and define the SNMPv3 host with the authPriv security level.

Answer

Configure the router to send SNMP Informs rather than Traps, and define the SNMPv3 host with the authPriv security level.
SNMP Traps are unidirectional, unacknowledged UDP messages sent to port 162. Under congested network conditions, lost Traps are never retransmitted. In contrast, SNMP Informs require the receiving Network Management System (NMS) to return an SNMP response back to the agent; if an acknowledgment is not received within a timeout period, the router retransmits the notification. Additionally, SNMPv3 authPriv provides both HMAC authentication and payload encryption (privacy), satisfying the strict security policy.

Step-by-Step Solution

1
Analyze notification delivery requirements.
Identified that SNMP Traps are unacknowledged UDP messages (fire-and-forget), whereas SNMP Informs require an application-layer SNMP response (acknowledgment) from the NMS and will retransmit if no response is received.
To survive packet drops during WAN congestion, application-layer acknowledgments provided by SNMP Informs are required.
2
Analyze security model requirements.
Identified that authentication (integrity/hashing) plus payload encryption (privacy) corresponds strictly to the SNMPv3 authPriv security level.
authNoPriv provides authentication without encryption, and noAuthNoPriv provides neither authentication nor encryption.
3
Combine operational mechanics and security configuration.
Selected SNMP Informs combined with SNMPv3 authPriv as the correct solution.
This combination satisfies both reliable delivery via retransmissions and strict data confidentiality/integrity.

Key Concept

SNMP Informs vs Traps operational mechanics and SNMPv3 Security Levels (authPriv)
Question 228Question →

A network engineer needs to manually configure an IEEE 802.1Q trunk link on a Cisco Catalyst switch interface (GigabitEthernet1/0/1) while following security best practices to disable Dynamic Trunking Protocol (DTP) and restrict active VLANs. What is the correct sequence of Cisco IOS CLI commands to accomplish this configuration on an interface supporting multi-protocol trunk encapsulation?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of commands begins with entering interface configuration mode (`interface GigabitEthernet1/0/1`), setting 802.1Q encapsulation (`switchport trunk encapsulation dot1q`), enabling trunk mode statically (`switchport mode trunk`), turning off DTP negotiation (`switchport nonegotiate`), and finally restricting the allowed VLAN list (`switchport trunk allowed vlan 10,20,30`).
The correct sequence respects Cisco IOS CLI syntax dependency rules: interface mode must be accessed first, followed by defining 802.1Q encapsulation prior to setting static trunk mode. Static trunking must be active before DTP frame transmission can be disabled with `switchport nonegotiate`, and allowed VLAN parameters are applied to restrict trunk traffic.

Step-by-Step Solution

1
Enter interface configuration mode
Access the interface context for GigabitEthernet1/0/1.
CLI commands affecting a specific switchport can only be applied within interface configuration mode.
2
Specify 802.1Q encapsulation protocol
Set trunk encapsulation type to dot1q.
On multi-encapsulation Catalyst switches, Cisco IOS requires explicit encapsulation definition before allowing the port mode to be changed to trunk.
3
Set port mode to static trunking
Force port state into unconditional trunk mode.
Static trunk mode disables dynamic negotiation behavior requirement and prepares the port for non-negotiation.
4
Disable Dynamic Trunking Protocol (DTP)
Stop sending DTP frames out of the interface.
The `switchport nonegotiate` command prevents DTP negotiation but is rejected by Cisco IOS if the interface is still set to dynamic auto or dynamic desirable.
5
Configure allowed VLAN list
Restrict VLAN traffic traversing the trunk to VLANs 10, 20, and 30.
Prunes unauthorized VLAN traffic from crossing the interswitch trunk link as part of security hardening.

Key Concept

Cisco IOS CLI trunk configuration sequence and DTP operational state requirements for 802.1Q trunking
Estimated Time:1m 30s
Question 229Question →

A network engineer is troubleshooting latency spikes in a real-time financial market data feed. Packet analysis reveals that when minor packet loss occurs on the WAN link, the receiving application experiences head-of-line blocking, holding back newly arrived live data while waiting for lost segments to be retransmitted. The application developers require a transport solution that delivers incoming data segments immediately to the application layer upon arrival, accepting unacknowledged data loss in exchange for minimal overhead and zero retransmission delay. Which transport layer design recommendation satisfies these requirements?

Show answer & explanation

Answer: Migrate the streaming protocol to UDP and handle any required packet ordering at the application layer, reducing header overhead from 20 bytes to 8 bytes and eliminating TCP retransmission buffer delays.

Answer

Migrating the streaming protocol to UDP and handling any required packet ordering at the application layer satisfies the requirements by reducing header overhead from 20 bytes to 8 bytes and eliminating head-of-line blocking.
Migrating to UDP removes transport-layer retransmissions and stream sequencing delays. UDP operates connectionlessly with a fixed 8-byte header overhead (compared to TCP's minimum 20-byte header), allowing out-of-order packets to be delivered to the application immediately upon arrival without head-of-line blocking.

Step-by-Step Solution

1
Analyze the application requirements and current failure mode.
The current setup uses TCP, which enforces connection-oriented, reliable, strictly ordered delivery. When a packet is dropped, TCP receiver buffers hold subsequent segments (head-of-line blocking) while awaiting retransmission, causing latency spikes.
Real-time applications prioritize low latency and immediate processing of recent data over complete reliability.
2
Compare TCP and UDP transport characteristics and header structures.
TCP uses a minimum 20-byte header with fields for Sequence Number, Acknowledgment Number, and Window size to provide flow control and reliability. UDP uses a lean, 8-byte fixed header (Source Port, Destination Port, Length, Checksum) with zero retransmission mechanisms or connection setup overhead.
UDP eliminates head-of-line blocking and reduces per-packet transport overhead.
3
Select the appropriate transport protocol migration strategy.
Transitioning to UDP provides connectionless delivery. If sequence tracking is still necessary, the application layer can inspect embedded timestamps or sequence numbers without waiting for transport-layer retransmissions.
This directly fulfills the requirement for zero retransmission delay and minimal transport header overhead.

Key Concept

TCP vs UDP Transport Characteristics and Header Overhead
Question 230Question →

An organization is assigned the IPv6 global routing prefix 2001:db8:abc0::/482001:\text{db8}:\text{abc0}::/48. A network engineer needs to configure the 16th subnet (subnet index 15 in hexadecimal count starting from 0) using standard /64/64 subnets. The router interface on this subnet is configured to dynamically derive its 64-bit interface identifier using EUI-64 based on its MAC address of 70-69-79-A1-B2-C3\text{70-69-79-A1-B2-C3}. Which fully formed and compressed IPv6 global unicast address will be assigned to this interface?

Show answer & explanation

Answer: 2001:db8:abc0:f:7269:79ff:fea1:b2c3

Answer

The correct IPv6 address is 2001:db8:abc0:f:7269:79ff:fea1:b2c3.
The correct answer properly converts the 16th subnet index (15) to hexadecimal 'f', inserts the 'FFFE' pattern into the MAC address, and flips the 7th bit of the first byte (from 0x70 to 0x72) to form the valid EUI-64 interface identifier.

Step-by-Step Solution

1
Determine the Subnet ID
The subnet ID is 0x000F (compressed to 'f').
Starting from subnet index 0 (2001:db8:abc0:0::/642001:\text{db8}:\text{abc0}:0::/64), the 16th subnet corresponds to index 15, which in hexadecimal is 0x000F.
2
Insert FFFE into the MAC address
7069:79FF:FEA1:B2C3
EUI-64 construction requires splitting the 48-bit MAC address (70-69-79-A1-B2-C3) into two 24-bit halves and inserting 0xFFFE between them.
3
Invert the Universal/Local (7th) bit of the first byte
First byte changes from 0x70 to 0x72.
The first byte 0x70 in binary is 0111 0000. Inverting the 7th bit (bit position 7 from MSB) yields 0111 0010, which is 0x72 in hexadecimal. Thus, the interface ID becomes 7269:79ff:fea1:b2c3.
4
Combine the network prefix, subnet ID, and interface ID
2001:db8:abc0:f:7269:79ff:fea1:b2c3
Combining 2001:db8:abc0::2001:\text{db8}:\text{abc0}:: + f::f:: + 7269:79ff:fea1:b2c37269:79\text{ff}:\text{fea1}:b2c3 produces the complete IPv6 address.

Key Concept

EUI-64 Interface Identifier Construction and Hexadecimal IPv6 Subnetting
Question 231Question →

A network administrator is troubleshooting an issue where Lightweight Access Points (LAPs) across a WAN link are unable to form control tunnels with the central Wireless LAN Controller (WLC). ICMP reachability between the LAPs and the WLC is verified, but CAPWAP tunnel negotiation fails at the transport layer due to firewall filtering. Which transport protocol and destination port must be permitted on perimeter firewalls to allow CAPWAP control traffic to establish?

Show answer & explanation

Answer: UDP port 5246

Answer

UDP port 5246 is required for CAPWAP control traffic between Lightweight Access Points and the Wireless LAN Controller.
The Control and Provisioning of Wireless Access Points (CAPWAP) protocol uses UDP as its transport layer protocol. Specifically, CAPWAP Control messages operate over UDP port 5246 (secured via DTLS), enabling the LAP to join the WLC, receive configuration updates, and exchange management metrics. Permitting UDP port 5246 allows the control channel to initialize successfully.

Step-by-Step Solution

1
Identify the protocol used for Cisco Split-MAC architecture management plane communications.
Lightweight APs use the Control and Provisioning of Wireless Access Points (CAPWAP) protocol to communicate with the WLC.
CAPWAP establishes two distinct tunnels: a control tunnel for AP management/configuration and a data tunnel for encapsulated wireless client traffic.
2
Determine the transport protocol and port numbers assigned to CAPWAP control and data planes.
CAPWAP Control uses UDP port 5246 (secured with DTLS), while CAPWAP Data uses UDP port 5247.
UDP is chosen for lower overhead and real-time processing performance, relying on DTLS for control channel reliability and security.
3
Match the requirement in the scenario to the correct port.
To resolve the control tunnel initialization failure, UDP port 5246 must be allowed through the firewall.
Allowing UDP port 5246 ensures the LAP can perform CAPWAP discovery, join, and configuration state exchanges with the WLC.

Key Concept

CAPWAP Transport Layer Ports (Control vs Data)
Question 232Question →

An administrator is configuring a direct point-to-point link between two router interfaces (Router1 GigabitEthernet0/0/0 and Router2 GigabitEthernet0/0/0) in a lab. Auto-MDIX has been manually disabled on both interfaces. After connecting the routers using a standard straight-through Ethernet cable, the administrator checks Router1 with the following command:

text
Router1# show interfaces gigabitEthernet 0/0/0
GigabitEthernet0/0/0 is down, line protocol is down (disabled)
Hardware is Gigabit Ethernet, address is 0050.56be.1a01 (bia 0050.56be.1a01)
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255

Which physical layer issue is the primary cause of both the interface status and line protocol remaining in a down/down state?

Show answer & explanation

Answer: An incorrect pinout cable type is used between two like MDI devices when Auto-MDIX is disabled.

Answer

The primary cause is the use of a straight-through cable between like devices (router to router) when Auto-MDIX is disabled, which requires a crossover cable to complete the physical circuit.
The correct answer identifies that connecting two like devices (router to router) without Auto-MDIX enabled requires a crossover cable. A straight-through cable maps transmit pins to transmit pins and receive pins to receive pins, which prevents physical carrier detection and leaves the link in a down/down state.

Step-by-Step Solution

1
Analyze the CLI interface state
The output shows 'GigabitEthernet0/0/0 is down, line protocol is down', indicating a Layer 1 physical connectivity issue.
When both interface and line protocol are down, physical signal electrical detection has failed.
2
Evaluate cabling requirements for like devices
Routers are MDI devices. Connecting MDI to MDI directly requires pin 1/2 (Tx) to connect to pin 3/6 (Rx).
A straight-through cable connects pin 1 to 1 and pin 2 to 2, causing both routers to transmit on the same pins and receive on the same pins.
3
Factor in the Auto-MDIX setting
Because Auto-MDIX is disabled, the interfaces cannot automatically adjust pin assignments electronically, requiring a physical crossover cable.
Without Auto-MDIX or a crossover cable, no link pulse/signal is detected, keeping the link down/down.

Key Concept

Ethernet Cable Pinouts and Auto-MDIX Operation
Question 233Question →

A Cisco Catalyst switch receives an Ethernet frame on interface FastEthernet0/1. The frame contains a source MAC address that does not currently exist in the MAC address table, and a destination MAC address that is already registered to interface FastEthernet0/4. In what correct sequential order does the switch perform its internal frame processing and forwarding tasks?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

1. Receive the Ethernet frame on interface FastEthernet0/1 and inspect the Layer 2 header for source and destination MAC addresses.
2. Check the MAC address table for the source MAC address and create a dynamic entry associating it with FastEthernet0/1.
3. Perform a lookup in the MAC address table using the destination MAC address to identify the associated egress port.
4. Forward the unicast frame exclusively out interface FastEthernet0/4 without flooding.
When a switch receives a frame, it sequentially executes two main phases: MAC learning followed by frame forwarding. First, it extracts the header information on the ingress port. Second, it inspects the source MAC address; if missing from the MAC address table, it records a dynamic entry associating the source MAC with the receiving port and VLAN. Third, it checks the destination MAC address against its MAC address table. Fourth, because a matching entry exists for FastEthernet0/4, the switch forwards the frame directly out that single interface without flooding.

Step-by-Step Solution

1
Frame Ingress Inspection
Source and destination MAC address fields are read from the incoming Ethernet frame header.
The switch must inspect the frame header on port FastEthernet0/1 to extract the Layer 2 addressing information.
2
Source MAC Learning
A new entry is added to the MAC address table mapping the source MAC address to interface FastEthernet0/1.
Layer 2 switches learn source MAC addresses upon ingress prior to making any forwarding decisions.
3
Destination Address Table Query
The destination MAC address is matched to existing entry for interface FastEthernet0/4.
The switch inspects its Content Addressable Memory (CAM) table to determine where to direct the frame.
4
Known Unicast Egress Forwarding
The frame is transmitted directly out interface FastEthernet0/4.
Matching a known destination MAC address triggers point-to-point unicast forwarding instead of unknown unicast flooding.

Key Concept

Layer 2 frame processing pipeline: MAC learning occurs on ingress before destination lookup and forwarding.
Question 234Question →

An administrator executes the command `show interfaces trunk` on a Cisco Catalyst switch and notices that VLAN 50 is included in the "VLANs allowed on trunk" section, but it does not appear in the "VLANs allowed and active in management domain" section. Which condition accounts for this operational state?

Show answer & explanation

Answer: VLAN 50 has not been created in the switch's local VLAN database.

Answer

VLAN 50 has not been created in the switch's local VLAN database.
For a VLAN to appear under 'VLANs allowed and active in management domain' in the `show interfaces trunk` output, it must be permitted by the trunk allowed list AND exist locally in the switch's VLAN database. If the VLAN has not been created using the `vlan 50` global configuration command, it remains inactive on the switch and will not appear in the active management domain output.

Step-by-Step Solution

1
Analyze the operational sections of the `show interfaces trunk` CLI output.
The 'VLANs allowed on trunk' output reflects the interface configuration (e.g., `switchport trunk allowed vlan`), while 'VLANs allowed and active in management domain' shows VLANs from that allowed list that currently exist in the local VLAN database and are not in a shut-down state.
Understanding Cisco IOS trunk verification logic is essential for accurately interpreting command output.
2
Identify why an allowed VLAN is excluded from the active management domain.
Because VLAN 50 is allowed by configuration but absent from the active list, it has not been instantiated in the switch database (using `vlan 50` in global configuration mode) or is currently disabled.
A switch cannot forward or locally activate trunk traffic for a VLAN that does not exist in its VLAN database.

Key Concept

802.1Q Trunk Verification and Local VLAN Database Dependencies
Estimated Time:1m 15s
Question 235Question →

A network engineer is troubleshooting performance degradation on switch interface FastEthernet0/1. The output of the `show interfaces fastethernet 0/1` command is shown below:

text
FastEthernet0/1 is up, line protocol is up (connected)
Hardware is FastEthernet, address is 0019.e762.a801 (bia 0019.e762.a801)
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Half-duplex, 100Mb/s, media type is 100BaseTX
input flow-control is off, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:02, output 00:00:01, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/40 (size/max)
5 minute input rate 32000 bits/sec, 28 packets/sec
5 minute output rate 88000 bits/sec, 64 packets/sec
521098 packets input, 68191044 bytes, 0 underruns
Received 42 broadcasts (0 multicasts)
0 runts, 0 giants, 0 throttles
12480 input errors, 12472 CRC, 8 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
889123 packets output, 118129033 bytes, 0 underruns
0 output errors, 38102 collisions, 9841 late collision, 0 deferred

Based on the CLI output, which two underlying issues could be causing the observed interface counters? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A duplex mismatch where the local interface is operating in half-duplex while the connected endpoint is operating in full-duplex; The Ethernet cable length exceeds the maximum 100-meter distance limit defined by Category 5e/6 specifications

Answer

The two probable causes are a duplex mismatch (where the local interface is operating in half-duplex while the remote end is in full-duplex) and an Ethernet cabling run that exceeds the maximum allowed 100-meter distance specification.
Late collisions are defined as collisions occurring after the first 64 bytes (512 bits) of a frame have been transmitted. The two primary causes of late collisions on an Ethernet link are: 1) A duplex mismatch where one end operates in half-duplex and the opposing end operates in full-duplex (the full-duplex side transmits without listening, interrupting ongoing transmissions after 64 bytes), and 2) Physical cable lengths exceeding the maximum specification (100 meters for UTP), which causes propagation delays longer than the 512-bit slot time.

Step-by-Step Solution

1
Analyze the interface operating mode and error counters from the CLI output
The interface is set to Half-duplex mode at 100 Mbps and shows significant late collision counters (9,841) and CRC errors (12,472).
Late collisions occur when a collision is detected after the first 64 bytes (512 bits) of a frame have already been transmitted.
2
Evaluate duplex mismatch mechanics
A full-duplex endpoint transmits at any time without performing carrier sensing, sending frames that collide with the half-duplex interface after its 64-byte transmission window has passed.
The full-duplex device ignores half-duplex collision domain rules, causing late collisions on the half-duplex receiver.
3
Evaluate physical cable distance limits
Exceeding the 100-meter UTP distance limit increases signal propagation delay beyond the standard Ethernet 512-bit slot time.
When propagation delay exceeds the slot time, normal collisions arrive too late to be handled as standard collisions, incrementing the late collision counter instead.

Key Concept

Late collisions on Ethernet interfaces are primarily caused by duplex mismatches or physical cable length limit violations (>100m).
Estimated Time:2m 0s
Question 236Question →

A network administrator needs to manually configure a switch port as an IEEE 802.1Q trunk link and limit the traffic traversing the link to specific VLANs. What is the correct sequence of CLI configuration commands to perform this setup on a Cisco Catalyst switch interface from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of configuration commands is: 1) Enter interface configuration mode (interface GigabitEthernet0/1), 2) Set encapsulation to dot1q (switchport trunk encapsulation dot1q), 3) Set mode to trunk (switchport mode trunk), and 4) Specify allowed VLANs (switchport trunk allowed vlan 10,20).
The proper administrative sequence requires entering the target interface configuration mode first, setting the 802.1Q encapsulation protocol second, forcing the port into permanent trunking mode third, and finally defining the list of allowed VLANs to prune unwanted traffic.

Step-by-Step Solution

1
Navigate to the targeted physical interface context.
Enters interface configuration sub-mode prompt Switch(config-if)#.
Interface parameters can only be altered from within interface configuration sub-mode.
2
Define 802.1Q encapsulation.
Configures IEEE 802.1Q frame tagging as the trunking method.
Cisco IOS switches supporting both ISL and 802.1Q reject the 'switchport mode trunk' command until encapsulation is explicitly defined.
3
Configure static trunk mode.
Forces the interface into an active trunking operational state.
This command turns off dynamic port mode negotiation and forces the port into a permanent trunking state.
4
Apply allowed VLAN list filtering.
Limits trunk traffic to VLAN 10 and VLAN 20.
Pruning unneeded VLANs improves security and reduces broadcast traffic across switch links.

Key Concept

IEEE 802.1Q Trunk Interface CLI Configuration Workflow
Question 237Question →

An enterprise data center environment utilizes bare-metal Type 1 hypervisors connected to an upstream physical Layer 3 switch acting as the default gateway for all host subnets. Host-A contains Virtual Machine 1 (VM-1) on VLAN 10 (10.1.10.0/2410.1.10.0/24) and Virtual Machine 2 (VM-2) on VLAN 20 (10.1.20.0/2410.1.20.0/24). The virtual switch (vSwitch) running inside Host-A operates strictly as a Layer 2 virtual device with no internal Layer 3 routing interface configured. When VM-1 sends the initial packet to establish a session with VM-2, which network component makes the forwarding decision to route traffic between these two virtual machines?

Show answer & explanation

Answer: The upstream physical Layer 3 switch receives the frame via the trunk link, performs a routing table lookup, and routes the packet back down the trunk to Host-A's vSwitch for delivery to VM-2.

Answer

The upstream physical Layer 3 switch receives the frame via the trunk link, performs a routing table lookup, and routes the packet back down the trunk to Host-A's vSwitch for delivery to VM-2.
Because VM-1 and VM-2 are situated on different VLANs (10.1.10.0/2410.1.10.0/24 and 10.1.20.0/2410.1.20.0/24), communication between them requires Layer 3 routing. Since the vSwitch on Host-A is explicitly operating as a Layer 2 switch without L3 capabilities, it cannot route packets between VLANs internally. Therefore, VM-1 sends the packet to its default gateway, causing the frame to exit Host-A via a trunk interface, reach the physical Layer 3 switch where the inter-VLAN routing decision occurs, and return back down the trunk to Host-A for delivery to VM-2.

Step-by-Step Solution

1
Determine the source and destination subnets
VM-1 (10.1.10.0/2410.1.10.0/24) and VM-2 (10.1.20.0/2410.1.20.0/24) belong to distinct IP subnets and VLANs.
Traffic between different IP subnets requires a Layer 3 routing decision (inter-VLAN routing).
2
Evaluate the capabilities of the host's virtual network infrastructure
The local vSwitch operates strictly at Layer 2 and lacks L3 routing interfaces.
A Layer 2 device can only switch frames within the same broadcast domain (VLAN). It cannot rewrite MAC headers or cross VLAN boundaries.
3
Trace the packet path for inter-VLAN routing
VM-1 sends the frame to its default gateway MAC address. The vSwitch forwards the frame up the physical trunk link to the physical Layer 3 switch. The L3 switch routes the packet from VLAN 10 to VLAN 20 and sends it back down the trunk to the vSwitch, which delivers it to VM-2.
Even though both VMs reside on the same hypervisor host, inter-VLAN traffic must traverse the default gateway on the upstream L3 switch ('router-on-a-stick' / external L3 forwarding pattern).

Key Concept

Inter-VLAN Routing and Layer 2 Virtual Switch Boundaries
Estimated Time:2m 0s
Question 238Question →

A network engineer is troubleshooting a custom financial trading application that streams tick data across an enterprise WAN link. During micro-burst traffic spikes, application logs report severe latency variations and out-of-order message processing, despite zero interface drops recorded on local router interfaces. Wireshark analysis reveals that the Layer 4 header of the application frames is fixed at 8 bytes in length, with no explicit Sequence Number or Acknowledgment Number fields present. However, the software development team insists that the transport protocol itself is executing dynamic windowing flow control to handle the latency. Which statement correctly identifies the transport protocol in use and explains why the developer's claim regarding Layer 4 flow control is incorrect?

Show answer & explanation

Answer: The protocol is UDP; UDP has a fixed 8-byte header and is completely connectionless and stateless, meaning any reliability, sequencing, or reordering mechanisms must be implemented in the application layer rather than at Layer 4.

Answer

The protocol is UDP; UDP has a fixed 8-byte header and is completely connectionless and stateless, meaning any reliability, sequencing, or reordering mechanisms must be implemented in the application layer rather than at Layer 4.
The correct answer identifies that an 8-byte L4 header without sequence or ACK fields uniquely characterizes UDP. UDP prioritizes speed and low overhead over reliability. It does not provide flow control, error recovery, or reordering at the transport layer. Any ordering or reliability logic must be built into the upper-layer application protocol.

Step-by-Step Solution

1
Analyze the Layer 4 header size provided in the packet analysis.
The packet capture indicates a fixed 8-byte Layer 4 header length.
UDP headers are always 8 bytes (containing Source Port, Destination Port, Length, and Checksum), whereas standard TCP headers have a minimum length of 20 bytes.
2
Examine the presence of reliability and flow control fields.
The capture shows no Sequence Number, Acknowledgment Number, or Window Size fields.
TCP requires these fields (within its 20-byte base header) to provide stateful, reliable connection management, retransmission, and sliding-window flow control. UDP omits all state management fields.
3
Evaluate the software developer's claim regarding transport layer flow control.
The claim is invalid for Layer 4; any sequencing or buffering mechanisms must reside at the application layer (Layer 7).
Because UDP operates without transport-layer state, applications using UDP must handle packet loss detection, reordering, and rate control within custom higher-layer protocols.

Key Concept

UDP versus TCP Header Fields and Reliability Mechanics
Question 239Question →

A Cisco Catalyst switch receives an untagged Ethernet frame on an interface configured as an 802.1Q trunk port. Place the operational steps performed by the switch in the correct order from ingress frame arrival to egress transmission.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: (1) Frame reception on 802.1Q trunk, (2) Internal classification into ingress native VLAN, (3) Ingress trunk allowed VLAN list verification, (4) MAC address table lookup within native VLAN context, and (5) Egress transmission untagged on matching native VLAN trunk.
When an untagged frame is received on an 802.1Q trunk port, the switch first accepts the frame and assigns it internally to the interface's native VLAN. It then validates whether that native VLAN is permitted according to the trunk's allowed VLAN configuration. Next, it performs a Layer 2 MAC table lookup restricted to that native VLAN's broadcast domain to select the egress port. Finally, when transmitting out another trunk port configured with the same native VLAN, the switch leaves the frame untagged according to 802.1Q specification.

Step-by-Step Solution

1
Identify the ingress frame state upon arrival.
The frame arrives on the 802.1Q trunk interface lacking a 4-byte 802.1Q VLAN header.
802.1Q trunks expect untagged frames to belong to the designated native VLAN.
2
Map untagged ingress traffic to the port's native VLAN.
The switch internal ASIC assigns the frame to the configured native VLAN ID of the receiving trunk port.
All frames moving through a Catalyst switch fabric must be associated with a specific VLAN domain.
3
Check interface trunk filtering rules (allowed VLAN list).
The switch confirms that the native VLAN ID is present in the `switchport trunk allowed vlan` filter for that interface.
If the native VLAN was explicitly removed from the allowed list, the switch would drop the frame at ingress.
4
Determine the Layer 2 egress destination.
The switch queries its MAC address table within the scope of the assigned native VLAN.
VLAN isolation requires that MAC lookups occur strictly within the MAC table instance dedicated to that specific VLAN.
5
Apply egress 802.1Q tagging rules prior to transmission.
The frame is forwarded out the destination trunk port untagged because its VLAN matches the destination port's configured native VLAN.
Standard IEEE 802.1Q behavior specifies that frames belonging to a trunk's native VLAN are transmitted across the link without an 802.1Q tag header.

Key Concept

IEEE 802.1Q Native VLAN Ingress Classification, Filtering, and Egress Tagging Lifecycle
Estimated Time:2m 0s
Question 240Question →

Match each Cisco IOS interface line status and line protocol state combination to its corresponding root cause.

Click a left item, then click its matching right item

Items

GigabitEthernet0/1 is down, line protocol is down
GigabitEthernet0/1 is administratively down, line protocol is down
GigabitEthernet0/1 is up, line protocol is down
GigabitEthernet0/1 is up, line protocol is up (disabled)

Matches

Show answer & explanation

Answer

The interface states map to their corresponding root causes based on Layer 1 vs. Layer 2 status: down/down indicates a Layer 1 physical connectivity issue; administratively down indicates the port is shut down by configuration; up/down indicates a Layer 2 encapsulation or keepalive failure; and up/up (disabled) indicates an err-disabled state triggered by switch security features.
Matching interface states to their root causes requires analyzing Layer 1 and Layer 2 status lines: 'down/down' corresponds to a Layer 1 physical failure like an unplugged cable; 'administratively down' corresponds to an interface disabled by the 'shutdown' command; 'up/down' indicates Layer 1 is operational while Layer 2 framing or keepalives failed; and 'up/up (disabled)' corresponds to a port placed in the err-disabled state due to security or protocol violations.

Step-by-Step Solution

1
Analyze 'down / down' interface output
Identified as a Layer 1 physical problem.
Lack of carrier signal or physical link pulse forces both the interface and protocol status to down.
2
Analyze 'administratively down / down' interface output
Identified as a software configuration shutdown state.
The 'shutdown' command explicitly disables the interface in software.
3
Analyze 'up / down' interface output
Identified as a Layer 2 Data Link problem.
Physical signal detection is successful ('up'), but protocol negotiation, keepalives, or encapsulation failed ('down').
4
Analyze 'up / up (disabled)' interface output
Identified as an error-disabled (err-disabled) port state.
Cisco IOS automatically disables active ports when severe error thresholds or port security limits are breached.

Key Concept

Cisco IOS Interface Status and Line Protocol Troubleshooting
Estimated Time:1m 0s
PreviousPage 12 / 100Next
All practice questions — Cisco CCNA | Examkin