Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 21Question →

Match each IPv6 address scope or functional type on the left with its standardized reserved prefix or address range on the right.

Click a left item, then click its matching right item

Items

Global Unicast
Link-Local
Unique Local
Multicast
Loopback

Matches

Show answer & explanation

Answer

Global Unicast matches 2000::/32000::/3; Link-Local matches fe80::/10\text{fe80}::/10; Unique Local matches fc00::/7\text{fc00}::/7; Multicast matches ff00::/8\text{ff00}::/8; Loopback matches ::1/128::1/128.
Each IPv6 address type is mapped directly to its standard RFC 4291 prefix definition: Global Unicast to 2000::/32000::/3, Link-Local to fe80::/10\text{fe80}::/10, Unique Local to fc00::/7\text{fc00}::/7, Multicast to ff00::/8\text{ff00}::/8, and Loopback to ::1/128::1/128.

Step-by-Step Solution

1
Identify IPv6 unicast address scopes.
Global Unicast is assigned 2000::/32000::/3, Link-Local is assigned fe80::/10\text{fe80}::/10, and Unique Local is assigned fc00::/7\text{fc00}::/7.
RFC 4291 partitions the IPv6 address space into well-defined unicast functional scopes.
2
Identify special and multicast IPv6 prefixes.
Multicast addresses use ff00::/8\text{ff00}::/8, and the single host loopback address is ::1/128::1/128.
Multicast replaces IPv4 broadcasts and uses the ff00::/8\text{ff00}::/8 prefix, while ::1/128::1/128 is reserved exclusively for loopback operations.

Key Concept

IPv6 Reserved Prefixes and Address Scopes
Question 22Question →

A network technician is configuring administration settings for a Cisco Wireless LAN Controller (WLC). Which two statements correctly describe the features and capabilities of the WLC Service Port and Management Interface? (Select two.)

Select all that apply

Show answer & explanation

Answer: The Service Port is dedicated to out-of-band management and traffic on this port is kept isolated from wireless client data network paths.; The Management Interface operates in-band to handle administrative SSH/HTTPS access as well as CAPWAP control communications with Access Points.

Answer

The Service Port provides dedicated out-of-band management isolated from client data paths, while the Management Interface handles in-band administration and CAPWAP tunnel traffic across routed networks.
The correct options accurately identify that the Service Port is used for isolated, out-of-band management access, whereas the Management Interface handles in-band administrative access (such as HTTPS and SSH) alongside CAPWAP control messaging across routed infrastructure.

Step-by-Step Solution

1
Identify the primary role and connectivity model of the WLC Service Port.
Recognize that the Service Port is a physical interface reserved for out-of-band management, initial setup, and emergency recovery, operating separately from client data.
Out-of-band interfaces isolate network management from general data plane congestion or failures.
2
Identify the primary function of the WLC Management Interface.
Recognize that the Management Interface is the default in-band interface used for CAPWAP management protocols between APs and WLC, as well as in-band Web/SSH administration.
In-band interfaces allow centralized administration and AP control traffic to traverse routed enterprise networks.

Key Concept

Distinction between out-of-band (Service Port) and in-band (Management Interface) management access connections on Cisco Wireless LAN Controllers.
Question 23Question →

A network administrator is migrating a medium-sized enterprise campus from a traditional Cisco three-tier architecture (Access, Distribution, Core) to a two-tier collapsed core architecture. Which statement accurately describes the architectural shift in responsibilities resulting from this topology change?

Show answer & explanation

Answer: The core switches combine high-speed backbone switching with distribution-layer functions such as inter-VLAN routing, security policy enforcement, and QoS boundary control.

Answer

The core switches combine high-speed backbone switching with distribution-layer functions such as inter-VLAN routing, security policy enforcement, and QoS boundary control.
In a two-tier collapsed core enterprise design, the traditional distribution and core layers are merged into a single switch tier. Consequently, the collapsed core switches must handle both high-speed packet transport (core function) and policy/routing enforcement such as inter-VLAN routing, ACLs, and QoS boundaries (distribution function).

Step-by-Step Solution

1
Analyze the traditional Cisco Three-Tier hierarchy roles
Access layer provides end-node connectivity; Distribution layer provides routing, ACL policy enforcement, and VLAN aggregation; Core layer provides high-speed backbone transport.
Understanding individual tier responsibilities is necessary to evaluate topology consolidation.
2
Evaluate the effect of collapsing the distribution layer into the core layer
The physical distribution tier is eliminated, and its functional boundaries (inter-VLAN routing, filtering, security policies) are merged into the core devices.
A two-tier collapsed core design saves cost and reduces latency in smaller enterprise environments while combining distribution and core roles into a single switch tier.

Key Concept

Two-Tier Collapsed Core Topology Functions
Estimated Time:1m 30s
Question 24Question →

A network administrator deploys Cisco Lightweight Access Points (APs) in FlexConnect mode at a remote branch office. Which two statements correctly describe the characteristics of FlexConnect mode when connected to the Cisco Wireless LAN Controller (WLC)? (Select two.)

Select all that apply

Show answer & explanation

Answer: Wireless client data traffic can be switched locally on the branch access switch rather than tunneled back to the WLC.; Control plane traffic and central management functions are maintained over a CAPWAP tunnel with the central WLC.

Answer

FlexConnect mode allows wireless client data traffic to be switched locally on the local branch network while maintaining control plane management via a CAPWAP tunnel to the central Wireless LAN Controller.
FlexConnect mode provides remote branch offices with operational flexibility by enabling local switching of user data traffic directly onto the local LAN. At the same time, it relies on a CAPWAP control tunnel back to the central WLC for control plane tasks, configuration updates, and management oversight.

Step-by-Step Solution

1
Identify the primary purpose of FlexConnect mode in Cisco wireless architecture.
FlexConnect is designed for branch office deployments connected over WAN links to a centralized controller.
It optimizes WAN bandwidth by permitting local switching of user traffic at the branch.
2
Analyze how data traffic and control traffic are handled in FlexConnect mode.
User data traffic can be switched locally onto the branch switch, while control and management traffic travel over the CAPWAP tunnel to the WLC.
This split-MAC capability avoids sending branch-to-branch or branch-to-internet user traffic back to the central WLC.

Key Concept

Cisco FlexConnect AP Mode Operational Characteristics
Estimated Time:1m 0s
Question 25Question →

An enterprise deploys Cisco lightweight Access Points (APs) configured in FlexConnect mode at a remote branch location connected via a WAN link to a centralized Wireless LAN Controller (WLC). The branch supports two SSIDs: an Enterprise WLAN configured for local switching with 802.1X (EAP) using FlexConnect Local Authentication, and a Guest WLAN configured for central switching and central authentication. If the WAN connection between the branch APs and the centralized WLC fails, causing the APs to transition to standalone mode, which statement correctly describes the resulting wireless client behavior?

Show answer & explanation

Answer: Clients on the Enterprise WLAN can successfully authenticate and maintain local data switching, while clients attempting to connect to the Guest WLAN are unable to authenticate or pass traffic.

Answer

Clients on the Enterprise WLAN can successfully authenticate and maintain local data switching, while clients attempting to connect to the Guest WLAN are unable to authenticate or pass traffic.
In Cisco wireless architectures, FlexConnect APs in standalone mode maintain functionality for WLANs configured for local switching and local authentication. Because the Enterprise WLAN uses local switching and FlexConnect Local Authentication, clients on this SSID can continue to authenticate and forward traffic directly onto the local branch network. Conversely, WLANs configured for central switching rely on the CAPWAP data tunnel to the WLC; when WAN connectivity to the controller is lost, centrally switched WLANs like the Guest WLAN become completely disabled.

Step-by-Step Solution

1
Analyze AP mode and controller connectivity state.
The lightweight APs are operating in FlexConnect mode and lose their CAPWAP connection to the centralized WLC, placing them in standalone mode.
FlexConnect APs are specifically designed for branch office deployments where WAN link loss to the WLC may occur.
2
Evaluate the behavior of the Enterprise WLAN.
Because the Enterprise WLAN is configured for local switching and FlexConnect Local Authentication, the AP handles 802.1X authentication and switches user traffic locally to the branch VLAN without requiring active WLC communication.
FlexConnect Local Authentication enables the AP or local RADIUS/FlexConnect Group to process authentication requests locally during WAN outages.
3
Evaluate the behavior of the Guest WLAN.
Because the Guest WLAN relies on central switching (CAPWAP data tunnel to WLC) and central authentication, it becomes completely non-functional when the CAPWAP tunnel is down.
Centrally switched traffic must traverse the CAPWAP data tunnel back to the WLC, which is impossible when WAN connectivity to the controller is disconnected.

Key Concept

Cisco FlexConnect AP Standalone Mode Operations and Local vs. Central Switching
Question 26Question →

Place the steps of IEEE 802.1Q frame processing in sequential order, starting from when a host sends traffic on VLAN 20 until it is delivered to a host on another switch across an 802.1Q trunk link.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The sequence starts when the ingress switch receives an untagged frame from a host on a VLAN 20 access port, inserts a 4-byte 802.1Q tag into the frame header, transmits the tagged frame over the trunk link, the egress switch reads the VLAN ID from the tag, removes the 802.1Q header, and delivers the untagged frame out the access port to the destination host.
When a frame traverses an IEEE 802.1Q trunk link, the ingress switch inserts a 4-byte tag into the frame header to identify the originating VLAN (unless it is the native VLAN). The frame travels across the physical trunk link carrying this tag. Upon reaching the remote switch, the egress switch inspects the tag to determine the VLAN association, strips the 4-byte tag header, and delivers the original untagged Ethernet frame to the destination device connected to an access port in that VLAN.

Step-by-Step Solution

1
Receive untagged frame at ingress switch.
The ingress switch accepts the standard frame from the host on a port configured as an access port in VLAN 20.
Host end devices transmit standard untagged Ethernet frames.
2
Encapsulate frame with 802.1Q tag.
The switch inserts a 4-byte 802.1Q header between the Source MAC address and Length/Type fields.
IEEE 802.1Q tagging allows multiplexing multiple VLANs over a single interswitch trunk.
3
Send frame across trunk link.
The tagged frame is transmitted over the trunk interface toward the neighboring switch.
The tag remains intact during transmission across the trunk.
4
Process tag at egress switch.
The egress switch receives the frame and reads the 12-bit VLAN ID (VID) field in the 802.1Q header.
The receiving switch uses the VLAN ID to associate the frame with internal VLAN 20.
5
Decapsulate (strip) 802.1Q header.
The 4-byte 802.1Q tag is removed from the frame header.
End-user devices do not expect 802.1Q tags on access port connections.
6
Forward untagged frame to destination host.
The frame is sent out the matching VLAN 20 access port to the end device.
This completes the end-to-end Layer 2 delivery across switches.

Key Concept

IEEE 802.1Q Frame Encapsulation, Tagging, and Decapsulation Mechanics
Question 27Question →

Match each IPv6 addressing scenario or network description on the left with its corresponding prefix length or field bit length on the right.

Click a left item, then click its matching right item

Items

The standard prefix length required for an enterprise end-user LAN subnet to support Stateless Address Autoconfiguration (SLAAC)
The typical prefix length allocated by a Regional Internet Registry (RIR) or ISP to an enterprise customer site
The RFC 6164 recommended prefix length for point-to-point inter-router link interfaces
The standard bit length allocated strictly for the host Interface Identifier (ID) portion of a Global Unicast Address

Matches

Show answer & explanation

Answer

The SLAAC end-user LAN subnet requires a /64 prefix length; the enterprise customer ISP allocation is typically a /48 prefix length; the point-to-point inter-router link uses a /127 prefix length; and the host Interface Identifier occupies 64 bits.
Each scenario maps directly to IPv6 architectural conventions: SLAAC requires a /64 prefix, enterprise sites typically receive a /48 prefix, point-to-point inter-router links use /127 per RFC 6164, and the host Interface ID portion is 64 bits.

Step-by-Step Solution

1
Analyze SLAAC prefix length requirements.
SLAAC requires a /64 prefix length.
SLAAC relies on receiving a /64 prefix advertisement in ICMPv6 Router Advertisement (RA) messages to combine with a 64-bit Interface ID.
2
Determine standard enterprise IPv6 allocation from an ISP.
An enterprise customer site typically receives a /48 prefix.
A /48 global routing prefix leaves bits 49 through 64 (16 bits) available for the enterprise organization to construct up to 65,536 distinct /64 subnets.
3
Evaluate point-to-point link prefix standards.
Point-to-point router links use a /127 prefix length.
Per RFC 6164, using a /127 mask limits available addresses on the link to two, preventing ping-pong routing loops and ND CPU exhaustion attacks.
4
Identify the Interface ID length in a standard IPv6 unicast address.
The Interface ID is exactly 64 bits.
IPv6 address architecture divides a standard 128-bit address into a 64-bit network prefix and a 64-bit host Interface ID.

Key Concept

IPv6 Address Structure and Prefix Allocation Rules
Question 28Question →

When a router processes an incoming IP packet to make a forwarding decision, it evaluates matching candidate routes using a deterministic precedence hierarchy. Place the following routing decision criteria in the correct order of evaluation from first (1st) to last (4th).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for router forwarding decision logic is: 1) Longest prefix match, 2) Administrative distance, 3) Metric, and 4) Equal-cost load balancing.
A router evaluates forwarding decisions using a strict hierarchy: first, it determines the longest prefix match (most specific subnet mask matching the destination IP). If multiple routes have the exact same prefix length, it evaluates Administrative Distance to select the route from the most trustworthy source. If multiple routes come from the same routing source with identical prefix lengths, it compares the Metric to pick the path with the lowest cost. Finally, if prefix length, Administrative Distance, and Metric are all equal, the router performs equal-cost load balancing.

Step-by-Step Solution

1
Evaluate subnet mask specificity for candidate routes matching the destination IP.
Longest prefix match is evaluated first.
The router always prefers the most specific route (longest prefix length) regardless of protocol or AD.
2
Compare routing sources when matching routes have identical prefix lengths.
Administrative Distance (AD) is evaluated second.
Lower AD indicates a more believable/trustworthy routing source (e.g., Static route AD 1 vs OSPF AD 110).
3
Compare route metrics for paths learned via the same routing protocol with identical prefix lengths.
Metric is evaluated third.
Within a single routing protocol, lower metric indicates a lower-cost, more efficient network path.
4
Handle remaining candidate routes where prefix length, AD, and metric are all identical.
Equal-cost load balancing is applied fourth.
When all criteria are tied, the router installs multiple next-hops into the forwarding table for traffic sharing.

Key Concept

Router Forwarding Precedence Hierarchy
Question 29Question →

A network administrator is connecting two Cisco Catalyst switches via a multi-link bundle using Link Aggregation Control Protocol (LACP). Which two conditions or configuration settings are required for the EtherChannel bundle to form and operate correctly? (Select two.)

Select all that apply

Show answer & explanation

Answer: At least one of the switches must have its physical member interfaces configured in LACP active mode.; All physical member interfaces in the bundle must be configured with identical speed, duplex, and VLAN settings.

Answer

The EtherChannel bundle successfully forms when at least one side is configured in LACP active mode and all member interfaces share matching operational parameters such as speed, duplex, and VLAN configurations.
For an LACP EtherChannel to form, at least one endpoint must actively send LACP packets (active mode), allowing negotiation when paired with an active or passive remote interface. Additionally, all bundled physical interfaces must have identical speed, duplex, switchport mode, native VLAN, and allowed VLAN attributes.

Step-by-Step Solution

1
Analyze LACP negotiation modes
LACP modes must be compatible (active-active or active-passive). Matching passive-passive modes will fail to initiate negotiation.
Passive mode only responds to LACP packets received; if neither end initiates, no negotiation occurs.
2
Evaluate member interface attribute requirements
All member links must match speed, duplex, trunking status, allowed VLANs, and native VLAN.
EtherChannel treats bundled physical links as a single logical interface, requiring identical physical and Layer 2 properties.

Key Concept

LACP Mode Compatibility and Prerequisite Interface Matching for EtherChannel
Question 30Question →

A network technician is configuring a new Wireless LAN on a Cisco Wireless LAN Controller (WLC) using the web interface. The technician has created the WLAN profile, assigned the SSID, and selected the interface mapping under the General tab. However, access points are not broadcasting the new network and wireless clients cannot connect. Which checkbox under the WLANs > Edit 'General' tab must be selected to make the WLAN active and operational?

Show answer & explanation

Answer: Status

Answer

The Status checkbox must be selected under the General tab to administratively enable the WLAN.
Newly created WLANs on a Cisco WLC are disabled by default. Under the General tab of the WLANs > Edit configuration page, checking the Status box (Enabled) is required to administratively activate the WLAN so that assigned Access Points can broadcast the SSID and process client association requests.

Step-by-Step Solution

1
Navigate to the WLANs menu in the Cisco WLC GUI and click on the newly created WLAN ID.
The WLANs > Edit configuration screen appears showing the General tab.
This menu contains basic identity and status controls for the specific WLAN.
2
Locate the Status field on the General tab page.
The Status checkbox is unchecked by default upon WLAN creation.
Cisco WLC creates WLANs in an administratively disabled state to prevent broadcasting incomplete network settings.
3
Check the Status box to set it to Enabled and click Apply.
The WLAN state changes to Enabled and Access Points begin broadcasting the SSID.
Enabling Status activates the WLAN operational state across all assigned APs.

Key Concept

WLAN Administrative Enablement via WLC GUI
Question 31Question →

Match each transport layer protocol operational characteristic or header structure property on the left with its corresponding description on the right.

Click a left item, then click its matching right item

Items

20-byte minimum header size
8-byte fixed header size
Explicit Congestion Notification (ECN)
Stateless datagram transmission

Matches

Show answer & explanation

Answer

20-byte minimum header size matches TCP header structure accommodating sequence numbers, window size, and control flags; 8-byte fixed header size matches UDP header structure containing only source port, destination port, length, and checksum; Explicit Congestion Notification (ECN) matches TCP mechanism for network routers to signal impending network congestion to endpoints; Stateless datagram transmission matches UDP operational mode providing low-latency delivery without session setup or state maintenance.
TCP uses a minimum 20-byte header to support sequence numbers, acknowledgment numbers, control flags, and flow control mechanisms like ECN. UDP uses a minimal 8-byte fixed header containing only ports, length, and checksum to provide lightweight, connectionless datagram delivery.

Step-by-Step Solution

1
Analyze transport layer header length specifications for TCP and UDP.
TCP headers require at least 20 bytes of overhead due to sequence/ACK tracking and windowing fields, whereas UDP headers are strictly fixed at 8 bytes.
Transport layer operational guarantees directly determine header field complexity.
2
Evaluate transport layer signaling and congestion management features.
ECN allows network infrastructure to communicate buffer pressure to TCP endpoints so they can dynamically reduce transmission rates.
TCP maintains stateful mechanisms for connection flow control and congestion avoidance.
3
Compare connection state and delivery requirements.
UDP operates in a stateless datagram model that avoids connection setup latency and session state overhead.
Applications using UDP prioritize rapid, low-overhead transmission over packet delivery verification.

Key Concept

Transport Layer Header Fields and Operational Characteristics (TCP vs. UDP)
Question 32Question →

Refer to the following routing table output from a Cisco router:

Codes: C - connected, S - static, R - RIP, O - OSPF
Gateway of last resort is not set

10.0.0.0/8 is subnetted, 4 subnets
O 10.1.1.0/24 [110/20] via 192.168.1.2, 00:04:12, GigabitEthernet0/0
S 10.1.0.0/16 [1/0] via 192.168.1.1, GigabitEthernet0/1
O 10.1.1.128/25 [110/30] via 192.168.1.3, 00:02:15, GigabitEthernet0/2
S* 0.0.0.0/0 [1/0] via 192.168.1.254

When the router receives a packet destined for host 10.1.1.130, which next-hop IP address will the router use to forward the packet?

Show answer & explanation

Answer: 192.168.1.3

Answer

The router will forward the packet to next-hop 192.168.1.3.
When a router makes a forwarding decision, it evaluates all routes in the routing table that cover the destination address and selects the one with the longest prefix mask (most specific match). Destination host 10.1.1.130 matches 10.1.0.0/16, 10.1.1.0/24, and 10.1.1.128/25. The route 10.1.1.128/25 is the most specific match with 25 matching bits, so the router forwards the packet to its next-hop IP address, 192.168.1.3.

Step-by-Step Solution

1
Identify all matching routes for destination IP address 10.1.1.130.
Matching routes are 10.1.0.0/16, 10.1.1.0/24, 10.1.1.128/25, and 0.0.0.0/0.
10.1.1.130 falls within the range of 10.1.0.0–10.1.255.255 (/16), 10.1.1.0–10.1.1.255 (/24), 10.1.1.128–10.1.1.255 (/25), and default route.
2
Compare prefix lengths of all matching routes to determine the Longest Prefix Match (LPM).
10.1.1.128/25 has a 25-bit subnet mask, which is longer than /24, /16, and /0.
The router always prefers the route with the most specific (longest) prefix match before considering Administrative Distance or Metric.
3
Identify the next-hop address associated with the longest prefix match route.
The route 10.1.1.128/25 uses next-hop 192.168.1.3.
The forwarding table specifies via 192.168.1.3 for 10.1.1.128/25.

Key Concept

Longest Prefix Match (LPM) Rule
Estimated Time:1m 0s
Question 33Question →

Which two statements accurately describe the operational characteristics of port roles and port states in Cisco Rapid PVST+ (802.1w)?

Select all that apply

Show answer & explanation

Answer: An Alternate port provides an alternate path toward the Root Bridge and remains in the Discarding state under normal operation.; Rapid PVST+ consolidates the legacy 802.1D Listening, Blocking, and Disabled states into a single Discarding state.

Answer

The statement that an Alternate port serves as a backup path in the Discarding state and the statement that Rapid PVST+ merges Listening, Blocking, and Disabled states into a single Discarding state are both correct.
Rapid PVST+ streamlines STP operation by using only three states: Discarding, Learning, and Forwarding. The Discarding state merges the old 802.1D Disabled, Blocking, and Listening states. An Alternate port is a designated backup path toward the Root Bridge that remains in the Discarding state while receiving BPDUs from other switches.

Step-by-Step Solution

1
Analyze Rapid PVST+ port states
Rapid PVST+ (802.1w) reduces port states to Discarding, Learning, and Forwarding.
Legacy 802.1D states of Disabled, Blocking, and Listening are combined into the Discarding state in 802.1w.
2
Analyze Rapid PVST+ port roles
An Alternate port is a backup path to the Root Bridge that stays in Discarding state until the primary Root Port fails.
Alternate ports receive superior BPDUs from neighboring switches but are blocked from forwarding frame traffic to maintain a loop-free topology.
3
Evaluate distractor regarding PortFast
PortFast is designed only for end-host (edge) access ports, not switch-to-switch trunks.
Configuring PortFast on trunks can lead to transient or persistent Layer 2 switching loops.
4
Evaluate distractor regarding bridge priority configuration
Bridge priority values must be assigned in multiples of 4096.
The 16-bit Bridge ID consists of a 4-bit priority field (increments of 4096) and a 12-bit System ID Extension carrying the VLAN ID.

Key Concept

Rapid PVST+ Port Roles, States, and Priority Configuration
Question 34Question →

A network engineer connects a new point-to-point link between Switch-1 and Switch-2 in an enterprise network running Rapid PVST+. Place the steps of the RSTP Proposal/Agreement fast convergence mechanism in the correct chronological order from link initialization to the Designated Port entering the Forwarding state.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for the Rapid PVST+ Proposal/Agreement handshake is: 1) Switch-1 sends a BPDU with the Proposal bit set on its Designated Port (in Discarding state) toward Switch-2. 2) Switch-2 receives the superior BPDU, selects the receiving port as its new Root Port, and enters the synchronization phase. 3) Switch-2 blocks all of its non-edge Designated Ports by placing them into the Discarding state. 4) Switch-2 transmits an Agreement BPDU back to Switch-1 out of its newly selected Root Port. 5) Switch-1 receives the Agreement BPDU and immediately transitions its Designated Port to the Forwarding state.
In Rapid PVST+ (IEEE 802.1w), fast convergence on point-to-point links relies on an explicit proposal/agreement handshake. When a link initializes, the upstream switch sends a BPDU with the Proposal bit set while its Designated Port is in the Discarding state. The downstream switch evaluates the BPDU, adopts the interface as its new Root Port, and enters the sync phase by blocking (placing in Discarding) all non-edge Designated Ports to eliminate loop potential. Once synchronized, the downstream switch sends an Agreement BPDU back out its Root Port. Upon receiving the Agreement BPDU, the upstream switch immediately transitions its Designated Port into the Forwarding state without waiting for traditional 802.1D timers.

Step-by-Step Solution

1
Initiate the handshake proposal
Switch-1 sends a BPDU with the Proposal bit set while its port is in the Discarding state.
Rapid PVST+ relies on active proposal/agreement handshake frames across point-to-point links rather than passive timer delays.
2
Process the proposal on the receiving switch
Switch-2 identifies the interface as its new Root Port upon evaluating the superior BPDU.
Accepting a superior BPDU triggers Switch-2 to sync its topology before confirming agreement.
3
Synchronize downstream ports to prevent loops
Switch-2 forces all non-edge Designated Ports into the Discarding state (sync process).
Isolating local non-edge ports guarantees that no active switching loop can form while transitioning the new Root Port.
4
Send agreement confirmation
Switch-2 transmits an Agreement BPDU back to Switch-1.
The Agreement BPDU explicitly informs Switch-1 that Switch-2 has safely synchronized its downstream ports.
5
Complete rapid transition to Forwarding
Switch-1 transitions its Designated Port directly into the Forwarding state.
Because Switch-2 confirmed loop safety via the Agreement BPDU, Switch-1 can bypass legacy 802.1D listening and learning timers.

Key Concept

Rapid PVST+ Proposal/Agreement Handshake Mechanism
Question 35Question →

Refer to the exhibit displaying an abbreviated routing table for router R1:

text
Gateway of last resort is 192.168.4.1 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 192.168.4.1, Serial0/0/0
S 10.1.1.0/24 [1/0] via 192.168.1.1, GigabitEthernet0/0
D 10.1.1.64/26 [90/307200] via 192.168.2.1, GigabitEthernet0/1
O 10.1.1.64/28 [110/20] via 192.168.3.1, GigabitEthernet0/2

Router R1 receives an IP packet addressed to destination host 10.1.1.6710.1.1.67. Which next-hop IP address and outbound interface will R1 use to forward this packet?

Show answer & explanation

Answer: 192.168.3.1 via GigabitEthernet0/2

Answer

192.168.3.1 via GigabitEthernet0/2
When forwarding a packet, a router first evaluates all routes in its routing table to find matches for the destination IP address. If multiple routes match, the router strictly enforces the Longest Prefix Match (LPM) rule. For destination IP 10.1.1.67, matching prefixes are /24, /26, and /28. The /28 prefix (10.1.1.64/28) is the longest match. Therefore, R1 forwards the packet to next-hop 192.168.3.1 via interface GigabitEthernet0/2, completely ignoring Administrative Distance when prefix lengths differ.

Step-by-Step Solution

1
Determine subnet ranges for matching routes in the routing table for destination IP 10.1.1.6710.1.1.67
The IP 10.1.1.6710.1.1.67 matches three specific routes: 10.1.1.0/24 (range .0 to .255), 10.1.1.64/26 (range .64 to .127), and 10.1.1.64/28 (range .64 to .79), as well as the default route 0.0.0.0/0.
Before comparing routing protocols or metrics, a router determines which routes encompass the destination IP address.
2
Compare matching prefix lengths to apply the Longest Prefix Match (LPM) rule
Prefix lengths are /24, /26, and /28. The /28 prefix length is the longest (most specific) match.
Cisco routers always prefer the route with the longest matching subnet mask (/28 > /26 > /24 > /0) regardless of Administrative Distance or Metric.
3
Identify the next-hop IP address and egress interface for the winning /28 route
The route `10.1.1.64/28` points to next-hop IP `192.168.3.1` out interface `GigabitEthernet0/2`.
The parameters associated with the longest prefix match determine the forwarding destination for the packet.

Key Concept

Router Forwarding Decision Logic & Longest Prefix Match (LPM)
Estimated Time:1m 30s
Question 36Question →

A network administrator configures a Cisco Catalyst switch running Rapid PVST+ with the command `spanning-tree vlan 50 priority 8192`. What total bridge priority value will this switch include in its outgoing Bridge Protocol Data Units (BPDUs) for VLAN 50?

Show answer & explanation

Answer: 82428242

Answer

The total bridge priority included in BPDUs for VLAN 50 is 82428242.
In Cisco Rapid PVST+, the 16-bit Bridge Priority field is divided into a 4-bit configurable priority value (in increments of 4096) and a 12-bit System ID Extension representing the VLAN ID. When a base priority of 81928192 is configured for VLAN 50, the switch combines the base priority with the VLAN ID (8192+50=82428192 + 50 = 8242) to form the total bridge priority advertised in BPDUs.

Step-by-Step Solution

1
Identify the base bridge priority configured on the switch.
The configured base bridge priority is 81928192.
The CLI command explicitly sets the base priority to 81928192.
2
Determine the System ID Extension for the specified VLAN.
The System ID Extension is equal to the VLAN ID, which is 5050.
Rapid PVST+ uses the 12-bit System ID Extension field to encode the VLAN number into the Bridge ID.
3
Calculate the total bridge priority advertised in BPDUs.
8192+50=82428192 + 50 = 8242.
Total Bridge Priority = Base Priority + System ID Extension.

Key Concept

Rapid PVST+ Bridge ID Structure and System ID Extension
Question 37Question →

A security review on an enterprise switch named Core-SW1 reveals that virtual terminal sessions allow plain-text remote management and bypass local account verification. To harden management access on Core-SW1, which TWO commands must be configured specifically under line VTY configuration mode (config-line) to enforce local account credentials and restrict incoming traffic exclusively to SSH?

Select all that apply

Show answer & explanation

Answer: login local; transport input ssh

Answer

The correct commands to configure under line VTY configuration mode are 'login local' and 'transport input ssh'.
Securing virtual terminal (VTY) lines requires configuration within line subconfiguration mode (config-line). The command 'login local' ensures that any user connecting via VTY lines must authenticate against locally configured username accounts. The command 'transport input ssh' locks down line access so that only encrypted SSH sessions are permitted, disabling clear-text protocols like Telnet.

Step-by-Step Solution

1
Identify the CLI context required for line-specific remote access security controls.
Line configuration mode (config-line) is accessed via the command 'line vty 0 15'.
VTY lines handle inbound network connection sessions.
2
Select the line command that requires local database credentials.
The 'login local' command binds line authentication to local user accounts created in global configuration mode.
Without 'login local', VTY lines either request a simple line password or permit unauthenticated access.
3
Select the line command that filters inbound remote management traffic protocols.
The 'transport input ssh' command restricts incoming protocol traffic exclusively to SSH.
By default, Cisco IOS line VTY sessions allow incoming Telnet connections unless restricted.

Key Concept

VTY Line Security Configuration for SSH Access
Question 38Question →

A network administrator is configuring and verifying Layer 2 discovery protocols across a enterprise topology consisting of Cisco and multi-vendor switches. Match each Cisco IOS command on the left with its corresponding operational scope and function on the right.

Click a left item, then click its matching right item

Items

cdp run
no cdp enable
lldp transmit
show lldp neighbors detail

Matches

Show answer & explanation

Answer

The correct matches pair 'cdp run' with 'Global configuration command that enables Cisco Discovery Protocol across all supported device interfaces.', 'no cdp enable' with 'Interface configuration command that disables Cisco Discovery Protocol on a specific interface.', 'lldp transmit' with 'Interface configuration command that selectively enables sending Link Layer Discovery Protocol packets out of an interface.', and 'show lldp neighbors detail' with 'Privileged EXEC mode command that displays expanded neighbor information, including management IP addresses and system capabilities.'
Each Cisco IOS command corresponds directly to a specific scope and function: 'cdp run' turns on CDP globally across the chassis, 'no cdp enable' disables CDP on an individual port, 'lldp transmit' enables outbound LLDP packet transmission on a specific port, and 'show lldp neighbors detail' provides detailed neighbor operational information.

Step-by-Step Solution

1
Identify the configuration scope (global vs. interface vs. EXEC mode) for each command.
'cdp run' is global configuration; 'no cdp enable' and 'lldp transmit' are interface configuration; 'show lldp neighbors detail' is EXEC mode verification.
Understanding mode syntax is critical for proper Layer 2 discovery protocol deployment.
2
Distinguish CDP single-state toggle from LLDP directional interface controls.
CDP uses 'cdp enable' / 'no cdp enable' per interface, whereas LLDP uses separate 'lldp transmit' and 'lldp receive' commands per interface.
LLDP provides granular directional transmission control that CDP does not.
3
Map each command to its precise definition.
Match left_1 to right_1, left_2 to right_2, left_3 to right_3, and left_4 to right_4.
Validates proper CLI syntax and operational scope for Cisco IOS discovery protocols.

Key Concept

CDP and LLDP CLI Syntax, Configuration Scopes, and Verification Commands
Question 39Question →

An engineer wants to configure a floating static route on a Cisco router to serve as a backup for a primary route learned via OSPF (Administrative Distance 110). Which two statements correctly describe the requirements and operational behavior of this floating static route?

Select all that apply

Show answer & explanation

Answer: The administrative distance assigned to the floating static route must be set higher than 110.; The floating static route will remain inactive and out of the routing table as long as the primary OSPF route is active.

Answer

The floating static route must be configured with an administrative distance greater than 110, and it will remain inactive in the routing table while the primary OSPF route is operational.
A floating static route functions as a backup and must be configured with an administrative distance higher than that of the active primary routing protocol (OSPF AD 110). Because Cisco routers select routes with lower administrative distance values for forwarding, the floating static route remains hidden from the routing table until the primary OSPF route fails.

Step-by-Step Solution

1
Determine the administrative distance of the primary route.
OSPF has a default administrative distance of 110.
To create a floating static backup route, the configured administrative distance must be higher than that of the primary route.
2
Analyze router path selection logic.
The router selects the route with the lowest administrative distance for installation into the active routing table.
Because the static route's administrative distance is higher than 110, it stays out of the routing table until the primary OSPF route disappears.

Key Concept

Floating Static Route Administrative Distance Requirements
Estimated Time:1m 0s
Question 40Question →

A network administrator is configuring interface GigabitEthernet1/0/14 on a Cisco Catalyst switch to connect an end-user workstation. The workstation must be placed into VLAN 30, and the interface must be explicitly prevented from negotiating a trunk link. Which TWO commands must be executed under interface configuration mode to accomplish this setup? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: switchport mode access; switchport access vlan 30

Answer

The correct commands to execute in interface configuration mode are 'switchport mode access' and 'switchport access vlan 30'.
Configuring an access port on a Cisco Catalyst switch requires setting the administrative mode to access using 'switchport mode access' and binding the port to a target VLAN using 'switchport access vlan 30'. Both commands must be run within the interface configuration mode.

Step-by-Step Solution

1
Set the operational mode of GigabitEthernet1/0/14 to static access mode.
Interface is locked into access mode using 'switchport mode access'.
Prevents accidental trunk negotiation with connected end-user devices via DTP.
2
Assign the access port to the designated VLAN.
Interface is assigned to VLAN 30 using 'switchport access vlan 30'.
Places untagged frames received on this interface into the Layer 2 broadcast domain of VLAN 30.

Key Concept

Static Access Port Assignment and VLAN Configuration
PreviousPage 2 / 100Next
All practice questions — Cisco CCNA | Examkin