Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 41Question →

A network engineer is configuring a backup floating IPv6 static route on router R1 toward destination prefix 2001:db8:7410:a1::/642001:\text{db8}:7410:\text{a1}::/64. The next-hop router is identified by its link-local address fe80::cafe:1\text{fe80}::\text{cafe}:1 over local interface GigabitEthernet0/0/0\text{GigabitEthernet0/0/0}. The route must be configured with an administrative distance of 140140. Fill in the missing parameters in the command snippet below.

Fill in the blanks below

R1(config)# ipv6 route 2001:db8:7410:a1::/64 fe80::cafe:1
Show answer & explanation

Answer

The first blank requires specifying the local exit interface GigabitEthernet0/0/0, and the second blank requires the administrative distance value of 140.
When configuring an IPv6 static route using a link-local address as the next-hop, Cisco IOS strictly requires the explicit specification of the local exit interface. The syntax is 'ipv6 route <prefix/mask> <exit-interface> <link-local-address> [AD]'. Therefore, the first blank requires the local interface GigabitEthernet0/0/0, and the second blank requires the administrative distance of 140.

Step-by-Step Solution

1
Identify the mandatory components of a fully-specified IPv6 static route using a link-local address.
When a link-local address (fe80::/10) is used as the next-hop IPv6 address, the exit interface must be specified because link-local addresses are only unique to the local link.
Without an exit interface, Cisco IOS cannot resolve which interface to send traffic out of when using a link-local address.
2
Determine the position of the exit interface parameter in the command syntax.
The correct command syntax is: ipv6 route <destination-prefix/prefix-length> <exit-interface> <link-local-next-hop> [administrative-distance].
The exit interface GigabitEthernet0/0/0 fills the position immediately following the destination IPv6 prefix.
3
Identify the position of the floating administrative distance parameter.
The administrative distance value of 140 is placed at the end of the command string.
Setting an administrative distance higher than the default static route distance of 1 makes this route a floating static backup route.

Key Concept

IPv6 Static Route Syntax with Link-Local Next-Hop and Administrative Distance
Estimated Time:1m 30s
Question 42Question →

An enterprise router has populated its IPv4 routing table with the following entries:

text
D 10.50.0.0/16 [90/2560512] via 10.1.1.1, 01:12:40, GigabitEthernet0/0
O 10.50.12.0/24 [110/20] via 10.1.1.2, 00:45:12, GigabitEthernet0/1
S 10.50.12.80/28 [1/0] via 10.1.1.3
S 10.50.12.80/29 [250/0] via 10.1.1.4

The router receives a packet with a destination IP address of 10.50.12.8510.50.12.85. Which next-hop IP address will the router select to forward this packet?

Show answer & explanation

Answer: 10.1.1.4

Answer

10.1.1.4 via the longest prefix match route 10.50.12.80/29
When a router processes a packet destination address, it searches the routing table for all matching network prefixes and selects the route with the longest prefix length (most specific mask). The destination address 10.50.12.85 falls within the range 10.50.12.80 - 10.50.12.87 defined by 10.50.12.80/29. Because /29 is longer than /28, /24, and /16, the router forwards the packet using the next-hop 10.1.1.4 regardless of its high administrative distance value of 250.

Step-by-Step Solution

1
Determine which routing table entries match the destination IP address 10.50.12.85.
All four entries (10.50.0.0/16, 10.50.12.0/24, 10.50.12.80/28, and 10.50.12.80/29) contain the IP address 10.50.12.85 within their subnet range.
10.50.12.80/29 spans 10.50.12.80 through 10.50.12.87, which includes 10.50.12.85.
2
Compare the prefix lengths (subnet masks) of all matching entries.
/29 is longer (more specific) than /28, /24, and /16.
Cisco routers use the Longest Prefix Match (LPM) rule as the primary criteria for forwarding decisions.
3
Identify the next-hop address associated with the longest matching prefix.
The route 10.50.12.80/29 points to next-hop 10.1.1.4.
Administrative distance is only evaluated when comparing routes with identical prefix lengths from different sources, not when selecting among matching routes of varying prefix lengths.

Key Concept

Longest Prefix Match (LPM) rule in IPv4 routing decision logic
Estimated Time:1m 15s
Question 43Question →

A network technician is adding a secondary path on Router-HQ to reach the internal subnet 172.16.40.0/24172.16.40.0/24. The primary link currently learns this destination via EIGRP with an administrative distance of 90. To ensure the secondary static path through next-hop IP 10.1.1.210.1.1.2 serves strictly as a backup when the primary link is down, which Cisco IOS command must be configured?

Show answer & explanation

Answer: ip route 172.16.40.0 255.255.255.0 10.1.1.2 100

Answer

The command 'ip route 172.16.40.0 255.255.255.0 10.1.1.2 100' correctly configures a floating static route by specifying an administrative distance higher than the primary routing protocol.
A floating static route functions as a backup path by configuring an administrative distance (AD) higher than the primary active route's protocol. Since the primary route is learned via internal EIGRP (AD 90), assigning an AD of 100 to the static route keeps it out of the active routing table until the EIGRP path becomes unavailable.

Step-by-Step Solution

1
Identify the primary route's Administrative Distance (AD)
EIGRP internal route has an AD of 90.
Floating static routes rely on AD values to determine precedence.
2
Determine the required AD for a floating static backup route
The floating static route must have an AD strictly greater than 90 (e.g., 100).
Lower administrative distances are preferred in the IP routing table.
3
Construct the Cisco IOS static route command syntax
'ip route <destination> <mask> <next-hop> [administrative-distance]'
Applying this syntax yields 'ip route 172.16.40.0 255.255.255.0 10.1.1.2 100'.

Key Concept

Floating Static Route Administrative Distance Calibration
Question 44Question →

A network administrator is evaluating transport layer requirements for a real-time voice conferencing application and a critical database replication service. Which two operational characteristics accurately describe User Datagram Protocol (UDP) when compared to Transmission Control Protocol (TCP)? (Select two.)

Select all that apply

Show answer & explanation

Answer: UDP operates as a connectionless protocol that transmits data without establishing a initial session handshake.; UDP utilizes a fixed 8-byte header overhead to minimize latency and processing burden.

Answer

UDP is characterized by its connectionless operation without a session handshake and its compact 8-byte fixed header structure.
The statements highlighting UDP as a connectionless protocol without session handshakes and noting its fixed 8-byte header overhead are correct. UDP provides low-latency transmission by dispensing with connection setup and header complexity.

Step-by-Step Solution

1
Analyze transport protocol connection state requirements.
Identify that UDP does not initiate sessions using a three-way handshake (SYN, SYN-ACK, ACK), making it connectionless.
Eliminates delay associated with connection establishment, ideal for time-sensitive applications like voice conferencing.
2
Compare transport layer header fields and overhead.
Confirm that UDP headers consist of only 4 fields totaling 8 bytes, whereas TCP headers require a minimum of 20 bytes.
The smaller header footprint minimizes processing overhead and reduces bandwidth consumption.
3
Evaluate distractor claims against UDP capabilities.
Recognize that sequence/acknowledgment tracking and sliding window flow control belong to stateful TCP operations.
UDP leaves packet ordering and reliability functions to higher-layer application protocols if needed.

Key Concept

Connectionless vs Connection-Oriented Transport Protocols and Header Overhead
Estimated Time:1m 15s
Question 45Question →

A network administrator needs to establish out-of-band administrative access to a Cisco Wireless LAN Controller (WLC) for system maintenance. The out-of-band management network uses subnet 192.168.100.0/24192.168.100.0/24, which is completely isolated from production wireless client traffic and general infrastructure VLANs. Which physical interface and configuration method on the WLC should the administrator use to achieve this isolated management connection?

Show answer & explanation

Answer: Configure the physical Service Port with an IP address on the 192.168.100.0/24192.168.100.0/24 subnet, as it provides dedicated out-of-band management access and maintains a separate routing table.

Answer

The Service Port should be configured with an IP address on the out-of-band network because it is physically isolated and maintains a distinct routing table from the main distribution system ports.
The Cisco WLC Service Port is specifically designed for out-of-band management. It operates independently from the controller's distribution system ports and maintains its own routing table, allowing network administrators to access the WLC GUI, SSH, or SNMP even if the production network or in-band interfaces are unreachable.

Step-by-Step Solution

1
Identify the specific functional requirement from the scenario.
The requirement specifies completely isolated out-of-band management connectivity on subnet 192.168.100.0/24192.168.100.0/24.
Different Cisco WLC interfaces serve distinct roles (Management vs. Service Port vs. Dynamic vs. Virtual).
2
Evaluate the role of the WLC Service Port.
The Service Port is a 10/100/1000 Ethernet port dedicated solely to out-of-band management access (GUI/SSH/SNMP).
It operates outside the main data-plane distribution system trunk lines and uses a dedicated non-routable interface context.
3
Compare against in-band logical interfaces.
The Management Interface, Virtual Interface, and Dynamic Interfaces reside on distribution system ports and handle in-band traffic, client mapping, or mobility features.
Only the physical Service Port satisfies strict out-of-band isolation demands.

Key Concept

Cisco WLC Interface Types (Service Port vs. Management Interface)
Question 46Question →

A network administrator is evaluating campus design options for a multi-floor office building with modest bandwidth requirements. The team decides to implement a 2-Tier Collapsed Core topology instead of a traditional 3-Tier Cisco Campus architecture. Which of the following statements accurately describe the structural and operational traits of this Collapsed Core design? (Select two.)

Select all that apply

Show answer & explanation

Answer: The core and distribution layer functions are merged onto the same physical switch platform or redundant switch pair.; It reduces hardware expenditure and management overhead while providing adequate scalability for smaller to medium-sized networks.

Answer

The correct statements are that the core and distribution layer functions are merged onto the same physical switch platform or redundant switch pair, and that the design reduces hardware expenditure and management overhead while providing adequate scalability for smaller to medium-sized networks.
A 2-Tier Collapsed Core architecture combines the functional responsibilities of the distribution layer (routing boundaries, policy enforcement, VLAN aggregation) and core layer (high-speed transport) into a single logical or physical layer. This approach lowers equipment expenditures, simplifies maintenance, and provides an efficient design for small-to-medium enterprise campuses.

Step-by-Step Solution

1
Analyze the structural definition of a 2-Tier Collapsed Core architecture.
Identify that the core and distribution layers of a traditional 3-Tier model are combined into unified hardware.
This consolidation eliminates one tier of switches to simplify network complexity for smaller deployments.
2
Evaluate the financial and operational benefits of collapsing the core and distribution layers.
Recognize that fewer physical devices result in lower capital costs and simplified management.
Smaller campus environments do not generate enough inter-building aggregate traffic to justify a standalone core layer.
3
Differentiate access layer responsibilities and STP configuration rules.
Confirm that access switches remain necessary and that PortFast must not be applied to switch-to-switch trunks.
PortFast applied to switch interconnects leads to bridging loops, while access switches provide endpoint connectivity and local security enforcement.

Key Concept

Cisco 2-Tier Collapsed Core Campus Architecture
Question 47Question →

Match each Cisco Lightweight Access Point (AP) operational mode on the left with its corresponding functional behavior and traffic forwarding characteristics on the right.

Click a left item, then click its matching right item

Items

Local Mode
FlexConnect Mode
Monitor Mode
Rogue Detector Mode
Sniffer Mode

Matches

Show answer & explanation

Answer

Local Mode pairs with central CAPWAP tunnel encapsulation; FlexConnect Mode pairs with local switching and WAN failover fallback; Monitor Mode pairs with continuous channel scanning for WIDS/rogue detection; Rogue Detector Mode pairs with wired ARP/MAC table monitoring; Sniffer Mode pairs with capturing and forwarding raw 802.11 frames to a packet analyzer.
Each AP mode matches its precise Cisco implementation standards: Local mode centralizes traffic over CAPWAP tunnels; FlexConnect mode allows local switching and standalone branch operation; Monitor mode scans wireless channels without serving clients; Rogue Detector correlates wired ARP/MAC tables with reported rogue lists; Sniffer mode captures raw 802.11 frames for analysis.

Step-by-Step Solution

1
Classify client-serving operational modes in Cisco centralized vs branch architectures.
Local mode centralizes all data and control traffic via CAPWAP tunnels to the controller. FlexConnect mode provides local data switching and standalone operation for branch offices.
Differentiating central switching from decentralized local switching in AP architectures.
2
Analyze non-client-serving specialized AP modes.
Monitor, Rogue Detector, and Sniffer modes disable standard client associations to perform specialized monitoring tasks.
Identifying the operational focus of specialized Cisco wireless modes.
3
Map specific interface behaviors to non-client-serving modes.
Monitor mode continuously cycles radios across channels; Rogue Detector disables radios to inspect wired ARP/MAC tables; Sniffer mode captures raw 802.11 frames on designated channels.
Distinguishing between radio scanning, wired correlation, and packet capture mechanisms.

Key Concept

Cisco Access Point Operational Modes and Traffic Forwarding Architectures
Question 48Question →

A network administrator is allocated the IPv6 prefix block 2001:db8:acad:4000::/522001:\text{db8}:\text{acad}:4000::/52 for a corporate branch network. The administrator needs to divide this block into standard /64/64 subnets for local LAN segments. How many /64/64 subnets can be created from this /52/52 prefix block?

Show answer & explanation

Answer: 4,096

Answer

4,096 subnets can be created from a /52 prefix block when using a /64 prefix length.
To calculate the number of /64/64 subnets created from a /52/52 prefix, subtract the assigned prefix length from the target subnet length (64−52=1264 - 52 = 12 bits). Raising 2 to the power of the subnet bit count (2122^{12}) gives 4,096 unique /64/64 subnets.

Step-by-Step Solution

1
Determine the number of bits available for subnetting
Subnet bits = 64−52=1264 - 52 = 12 bits
The difference between the target prefix length (/64) and the assigned prefix length (/52) defines the subnet ID space.
2
Calculate total subnets using powers of 2
212=4,0962^{12} = 4,096
Each additional binary bit doubles the number of available subnets.

Key Concept

IPv6 Prefix Subnetting
Question 49Question →

An administrator needs to create a new WPA2-Personal WLAN using the Cisco Wireless LAN Controller (WLC) GUI. Place the steps in the correct chronological order to complete this configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts by selecting 'Create New' on the WLANs page, defining the Profile Name and SSID, enabling the WLAN and mapping the interface under the General tab, and finally configuring PSK under the Layer 2 Security tab.
The correct order follows standard WLC GUI workflow: first initiating creation via the drop-down menu on the WLANs page, defining the WLAN identity (Profile Name and SSID), enabling the WLAN and selecting its interface under the General tab, and finally defining authentication parameters under the Layer 2 Security tab.

Step-by-Step Solution

1
Initiate WLAN creation
Access the creation interface by choosing 'Create New' on the WLANs menu.
The controller requires starting a new instance from the main WLAN management page.
2
Define WLAN identification
Specify the Profile Name, broadcast SSID, and numerical WLAN ID.
Applying these parameters creates the WLAN entry and opens the WLAN Edit configuration sub-menus.
3
Configure General settings
Map the WLAN to its target interface/VLAN and set the WLAN Status to Enabled.
Clients cannot connect unless the WLAN is bound to an active interface and enabled.
4
Configure Security settings
Set Layer 2 Security to WPA2/WPA3, select PSK under Auth Key Management, and set the password.
This establishes the WPA2-Personal authentication requirements for connecting clients.

Key Concept

WLC GUI WLAN Configuration Sequence
Question 50Question →

A Cisco router receives an IP packet and initiates a route lookup process to select the optimal path. Arrange the router forwarding decision logic steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for router forwarding decision logic is: 1) Identify matching routing table entries, 2) Select the route with the Longest Prefix Match, 3) Break ties using Administrative Distance for different sources, 4) Break ties using Metric for identical sources, and 5) Forward the packet using the selected next-hop/exit interface.
The router forwarding process strictly follows a hierarchical evaluation sequence: First, the router checks for matching network entries in the routing table. Second, if multiple matching routes exist, it selects the route with the Longest Prefix Match (LPM), which represents the most specific path. Third, if multiple routes have the exact same prefix length but come from different sources, the router uses Administrative Distance (AD) to select the most reliable source. Fourth, if the prefix length and routing source are the same, the router uses the protocol's Metric to choose the optimal path. Finally, the packet is forwarded out the resulting egress interface to the next-hop IP.

Step-by-Step Solution

1
Scan routing table for matching prefix entries
Candidate routes matching the destination IP address are identified
The router performs a bitwise AND operation on the destination IP with subnet masks in the table to find matches.
2
Apply Longest Prefix Match (LPM) rule
The candidate route with the longest mask length is prioritized above all others
LPM takes precedence over Administrative Distance and Metric regardless of the routing protocol source.
3
Compare Administrative Distance (AD)
Ties between identical prefix lengths from different routing protocols are broken
Lower AD indicates a more believable/trustworthy route source (e.g., Connected=0, Static=1, OSPF=110).
4
Compare Metric values
Ties between identical prefix lengths from the same routing protocol are broken
Protocol-specific metrics (cost, hop count, bandwidth) determine the best path within that specific protocol.
5
Execute packet forwarding
The packet is encapsulated and sent via the designated exit interface or next-hop IP
The decision path concludes with Layer 2 rewrite and transmission.

Key Concept

Cisco Router Forwarding Decision Hierarchy (LPM -> AD -> Metric)
Question 51Question →

An engineer is attempting to deploy a routed Layer 3 EtherChannel between two distribution switches. The logical interface `Port-channel 1` has been configured with `no switchport` and assigned an IPv4 address. However, executing `show etherchannel summary` reveals the following output:

text
Flags: D - down P - bundled in port-channel
I - stand-alone s - suspended
H - Hot-standby (LACP only)
R - Layer3 S - Layer2
U - in use f - failed to allocate aggregator

Group Port-channel Protocol Ports
------+-------------+----------+-----------------------------------------------
1 Po1(SD) LACP Gi0/1(I) Gi0/2(I)

Which configuration step is required on the local switch to resolve this issue and bring the EtherChannel to an operational `SU` state?

Show answer & explanation

Answer: Execute the `no switchport` command on physical interfaces GigabitEthernet0/1 and GigabitEthernet0/2 before bundling them into the channel group.

Answer

Execute the `no switchport` command on physical interfaces GigabitEthernet0/1 and GigabitEthernet0/2 before bundling them into the channel group.
In Cisco IOS/IOS-XE, creating a routed (Layer 3) EtherChannel requires disabling Layer 2 switching capabilities using `no switchport` on both the physical member interfaces (GigabitEthernet0/1 and GigabitEthernet0/2) and the logical Port-Channel interface. When physical ports remain configured as Layer 2 switchports while the port-channel is routed, the physical ports cannot be bundled, showing flag `I` (stand-alone), and the port-channel shows flag `S` (Layer 2) and `D` (Down).

Step-by-Step Solution

1
Analyze the `show etherchannel summary` flags
Po1 status is `SD` (Layer 2, Down) and member ports Gi0/1 and Gi0/2 are marked with flag `I` (Stand-alone).
The flag `S` indicates the port-channel is operating in Layer 2 mode instead of Layer 3 (`R`), causing a capability mismatch with the Layer 3 logical interface setup.
2
Identify missing physical interface commands
The physical member interfaces Gi0/1 and Gi0/2 still have default Layer 2 `switchport` operational characteristics.
For a routed Layer 3 EtherChannel, `no switchport` must be applied to all participating physical member interfaces as well as the logical Port-Channel interface.
3
Determine the corrective configuration change
Entering interface range configuration mode for Gi0/1 - 2 and issuing `no switchport` converts the physical member interfaces to Layer 3, allowing them to successfully bundle (`P`) under `Po1(RU)`.
Layer matching across physical member ports and logical channel interfaces is mandatory for successful LACP aggregation.

Key Concept

Layer 3 EtherChannel Physical and Logical Port Matching
Question 52Question →

In a Cisco centralized wireless network deployment, how does a Lightweight Access Point (LAP) operating in default Local mode handle wireless client data traffic?

Show answer & explanation

Answer: It encapsulates all client data traffic within a CAPWAP tunnel and forwards it directly to the Wireless LAN Controller (WLC) for switching.

Answer

In default Local mode, a Cisco Lightweight AP encapsulates all wireless client data traffic into a CAPWAP tunnel and sends it to the WLC for centralized processing and switching.
In a Cisco centralized wireless architecture, an AP operating in default Local mode sends all client traffic through a CAPWAP data tunnel directly to the Wireless LAN Controller (WLC). The controller then centrally processes and switches this traffic onto the wired LAN.

Step-by-Step Solution

1
Identify the operation mode of the access point.
The access point is operating in standard default Local mode under a centralized Cisco WLC architecture.
Local mode is the default state for a Lightweight AP connected to a WLC.
2
Determine the data path for client traffic in Local mode.
Wireless client data frames received by the AP are encapsulated in CAPWAP data packets and tunneled to the WLC.
Split-MAC architecture designates real-time 802.11 functions to the AP while management, authentication, and data switching are centralized at the controller.

Key Concept

Cisco Centralized Wireless Architecture and Local AP Mode CAPWAP Data Tunneling
Estimated Time:45s
Question 53Question →

An administrator is configuring client connectivity for a new wireless network using the Cisco Wireless LAN Controller (WLC) web interface. The WLAN must use WPA2-Personal (PSK) authentication and be mapped to a dedicated dynamic interface. Arrange the GUI configuration steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of configuration steps is: 1) Select Create New and click Go on the WLANs page; 2) Define the Profile Name and SSID, then click Apply; 3) Map the dynamic interface under the General tab; 4) Configure WPA2-Personal (PSK) under Security > Layer 2; 5) Check the Status Enabled box on the General tab and click Apply.
Configuring a WLAN via the Cisco WLC GUI follows a defined procedural sequence. First, the administrator must navigate to WLANs > WLANs, select 'Create New', and click 'Go'. Second, the Profile Name and SSID are specified, followed by clicking 'Apply' to generate the profile entry. Third, under the General tab, the administrator maps the WLAN to the designated dynamic interface. Fourth, under Security > Layer 2, WPA2 Policy is enabled alongside PSK key management and the pre-shared key value. Fifth, the administrator returns to the General tab to check the Status checkbox to Enabled, clicking Apply to operationalize the WLAN.

Step-by-Step Solution

1
Initiate WLAN Creation
Navigating to WLANs > WLANs, selecting 'Create New' from the drop-down menu, and clicking 'Go' opens the initial setup page.
You must create a new profile instance before configuring parameters.
2
Define Profile Name and SSID
Entering the Profile Name and SSID and clicking 'Apply' instantiates the WLAN entry in the controller configuration.
The WLC requires an established Profile Name and SSID identifier before opening the full edit menu.
3
Bind Dynamic Interface
Selecting the dynamic interface on the General tab binds wireless client traffic to the appropriate VLAN.
Interface mapping determines client IP address assignment and network access.
4
Configure Layer 2 Security
Selecting WPA+WPA2, enabling WPA2 Policy, enabling PSK, and entering the pre-shared key secures client connections.
Layer 2 security options must be configured under Security > Layer 2 rather than Layer 3 or AAA tabs.
5
Enable and Save WLAN
Checking the 'Status: Enabled' box on the General tab and clicking 'Apply' activates the SSID across associated APs.
WLAN profiles are disabled by default during creation and must be explicitly enabled after all configurations are set.

Key Concept

Cisco WLC GUI WLAN Configuration Sequence
Estimated Time:1m 15s
Question 54Question →

A network engineer is configuring IP address assignments for client workstations within a corporate VLAN allocated the 10.150.32.0/2110.150.32.0/21 IPv4 block. Which two IP addresses are valid host addresses that can be assigned to devices on this subnet?

Select all that apply

Show answer & explanation

Answer: 10.150.35.25510.150.35.255; 10.150.39.25410.150.39.254

Answer

The valid host addresses are 10.150.35.25510.150.35.255 and 10.150.39.25410.150.39.254.
For the prefix /21/21, the subnet mask is 255.255.248.0255.255.248.0, giving a block size of 88 in the third octet. The subnet 10.150.32.0/2110.150.32.0/21 ranges from network address 10.150.32.010.150.32.0 to broadcast address 10.150.39.25510.150.39.255. The usable host range is 10.150.32.110.150.32.1 through 10.150.39.25410.150.39.254. Both 10.150.35.25510.150.35.255 and 10.150.39.25410.150.39.254 fall within this usable range.

Step-by-Step Solution

1
Determine the subnet mask and block size for a /21 prefix
Prefix /21 corresponds to subnet mask 255.255.248.0. The third octet block size is 256 - 248 = 8.
Calculating block size in the interesting octet establishes subnet boundaries.
2
Calculate the network and broadcast addresses for the 10.150.32.0/21 subnet
Network address is 10.150.32.0. The next subnet starts at 10.150.40.0. Therefore, the broadcast address is 10.150.39.255.
Subnet boundaries define the start and end of the address block.
3
Determine the usable host IP address range
Usable host range spans from 10.150.32.1 to 10.150.39.254 inclusive.
Usable host IPs exclude the network ID (all host bits 0) and broadcast ID (all host bits 1).
4
Evaluate the given options against the usable host range
10.150.35.255 and 10.150.39.254 lie between 10.150.32.1 and 10.150.39.254. Address 10.150.39.255 is the broadcast IP and 10.150.40.0 belongs to the next subnet.
Verifies which IP addresses fall within the valid host envelope.

Key Concept

Usable host address range determination for IPv4 subnets with non-byte-aligned prefixes
Question 55Question →

An infrastructure analyst is performing a security review of an enterprise management network. The organization requires per-command authorization for administrative CLI access on routers and switches, along with full packet payload encryption between network devices and the central AAA server. Which security protocol satisfies these requirements?

Show answer & explanation

Answer: TACACS+, because it encrypts the entire packet payload and separates authentication, authorization, and accounting functions.

Answer

TACACS+, because it encrypts the entire packet payload and separates authentication, authorization, and accounting functions.
TACACS+ operates over TCP port 49 and separates the authentication, authorization, and accounting (AAA) functions. This modular separation permits granular authorization checks for every individual administrative command entered on a network device. Furthermore, TACACS+ encrypts the full body of every packet after the standard header, meeting the requirement for complete payload confidentiality.

Step-by-Step Solution

1
Analyze requirement 1: Full payload encryption.
TACACS+ encrypts the entire packet payload after the header, whereas RADIUS only encrypts the password attribute.
Security requirement demands full payload protection during network transmission.
2
Analyze requirement 2: Per-command authorization.
TACACS+ decouples authentication, authorization, and accounting, allowing every CLI command to be individually authorized by the TACACS+ server.
RADIUS binds authentication and authorization together, which prevents per-command authorization.
3
Select protocol matching both conditions.
TACACS+ meets both full payload encryption and granular per-command authorization criteria.
Only TACACS+ satisfies all architectural constraints.

Key Concept

TACACS+ vs RADIUS Protocol Characteristics and AAA Separation
Question 56Question →

Match each VPN framework element on the left with its primary functional purpose on the right.

Click a left item, then click its matching right item

Items

Diffie-Hellman (DH) Group
Encapsulating Security Payload (ESP)
Authentication Header (AH)
Internet Key Exchange (IKE)

Matches

Show answer & explanation

Answer

Diffie-Hellman (DH) Group pairs with deriving shared secret keys over unsecure networks; Encapsulating Security Payload (ESP) pairs with providing confidentiality through encryption along with integrity; Authentication Header (AH) pairs with providing data integrity without confidentiality; Internet Key Exchange (IKE) pairs with establishing control channels and negotiating SAs.
Each IPsec component performs a distinct function: Diffie-Hellman derives shared secret keys over an untrusted link, ESP delivers packet encryption and integrity, AH delivers authentication without confidentiality, and IKE manages negotiation and Security Associations.

Step-by-Step Solution

1
Identify the key exchange method
Diffie-Hellman allows peer routers to compute a shared secret key over an unsecure medium.
Symmetric encryption key material must be securely established before encrypting tunnel data.
2
Differentiate between IPsec data encapsulation protocols
ESP provides payload encryption (confidentiality) plus authentication. AH provides authentication only, leaving payload plaintext.
AH lacks an encryption algorithm, whereas ESP encapsulates and encrypts payload data.
3
Identify the management and SA negotiation protocol
IKE negotiates security parameters and manages Security Associations (SAs).
IKE handles control plane negotiation prior to data plane forwarding.

Key Concept

IPsec Protocol Framework Components
Question 57Question →

During a physical security compliance evaluation of a remote edge facility, an auditor notes three vulnerability findings: unauthorized personnel entering the main telecommunications enclosure by following authorized employees (tailgating), unmonitored physical patch panel connections in public hallways, and employee badges left unattended at desktop terminals. To address these vulnerabilities, the security team must implement controls classified specifically under physical access control mechanisms and administrative security program elements. Which combination of measures correctly pairs a physical access control with an administrative security program element to directly address these findings?

Show answer & explanation

Answer: Installing mantrap vestibules with biometric authentication at enclosure entry points, and mandating recurring security awareness training alongside clear desk and badge policies.

Answer

Installing mantrap vestibules with biometric authentication at enclosure entry points, and mandating recurring security awareness training alongside clear desk and badge policies.
The correct response accurately identifies physical access controls (mantrap vestibules and biometric access systems, which physically block unauthorized piggybacking/tailgating) and administrative security program elements (security awareness training and physical badge management policies, which establish governance and educate users on physical security standards).

Step-by-Step Solution

1
Analyze the audit findings and categorize required remediation domains.
Findings involve physical perimeter breaches (tailgating), exposed wiring closet access, and poor employee security habits.
Security measures fall into three primary categories: physical controls, technical/logical controls, and administrative/program controls.
2
Evaluate candidate controls for physical access control classification.
Mantrap vestibules, biometric readers, locks, and physical barriers directly restrict physical access to hardware enclosures.
Physical access controls prevent unauthorized physical contact with network assets and prevent physical intrusion techniques like tailgating.
3
Evaluate candidate controls for administrative security program element classification.
Security awareness training programs, badge handling procedures, and clear desk policies represent organizational policies and human governance.
Administrative controls focus on human policy enforcement, compliance, awareness campaigns, and operational guidelines.

Key Concept

Physical Access Controls vs. Administrative Security Program Elements
Estimated Time:1m 30s
Question 58Question →

A network administrator is configuring Quality of Service (QoS) classification using Differentiated Services (DiffServ) on an enterprise router. How many bits are allocated to the Differentiated Services Code Point (DSCP) field within the IPv4 Type of Service (ToS) byte?

Show answer & explanation

Answer: 6 bits

Answer

6 bits are allocated to the DSCP field within the IPv4 header.
The correct option stating 6 bits is right because Differentiated Services (DiffServ) redefines the 8-bit IPv4 Type of Service (ToS) byte such that the first 6 bits are used for the DSCP value, providing 64 different classification values (0−630-63). The remaining 2 bits are used for Explicit Congestion Notification (ECN).

Step-by-Step Solution

1
Identify the IPv4 header field used for Differentiated Services QoS classification.
The IPv4 header contains an 8-bit Type of Service (ToS) byte (also referred to as the Differentiated Services field).
DiffServ redefines the ToS byte to provide backward-compatible QoS classification capabilities.
2
Determine the allocation of bits within the ToS byte for DSCP marking.
The 6 most significant bits (26=642^6 = 64 possible values) form the DSCP field, while the remaining 2 least significant bits are reserved for Explicit Congestion Notification (ECN).
This 6-bit field allows granular classification of traffic into Per-Hop Behaviors (PHBs) such as Expedited Forwarding (EF) and Assured Forwarding (AF).

Key Concept

DSCP Field Bit Length and Structure
Question 59Question →

A network administrator is using Software Image Management (SWIM) within Cisco DNA Center to upgrade a Catalyst switch. Place the steps of the standard SWIM deployment workflow in the correct operational sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for Software Image Management (SWIM) in Cisco DNA Center is: 1) Import or discover the target software image into the Cisco DNA Center image repository, 2) Designate the software image as the 'Golden Image' for the corresponding device family and role, 3) Perform pre-upgrade readiness checks to verify storage capacity, hardware compatibility, and device health, 4) Distribute the software image file from Cisco DNA Center to the local storage of the target device, and 5) Activate the software image on the device and initiate a system reboot to complete the upgrade.
The Cisco DNA Center Software Image Management (SWIM) process follows a logical zero-downtime staging sequence: ingesting the image file into the central controller, tagging it as the Golden Image standard for device role compliance, running automated pre-upgrade checks to validate disk space and device health, distributing the image file to local device flash storage, and finally activating the software image through a boot configuration change and system restart.

Step-by-Step Solution

1
Import the target software image into the Cisco DNA Center repository.
The operating system image binary is ingested and stored centrally.
Cisco DNA Center cannot manage, verify, or push image files until they exist in its software image repository.
2
Designate the imported software image as a Golden Image.
Cisco DNA Center marks device models lacking this software version as non-compliant.
Establishing a Golden Image defines the software standard for a specific physical device model and site function.
3
Run pre-upgrade readiness checks on the target device.
Flash storage capacity, hardware platform compatibility, and network stability are confirmed.
Pre-checks prevent distribution failures caused by missing prerequisites or insufficient disk space.
4
Distribute the image file to the network device.
The image file is staged in the target switch's flash memory.
Transferring the image staged in device flash separates file transfer from the maintenance window reboot.
5
Activate the image and initiate a device reboot.
The device modifies its boot statement and reboots into the new operating system.
Activation finalizes the software upgrade process by applying the newly staged image to operational memory upon reboot.

Key Concept

Cisco DNA Center Software Image Management (SWIM) Workflow Sequence
Question 60Question →

A network administrator is onboarding a brand-new Cisco Catalyst switch into an enterprise network using Cisco Catalyst Center (formerly Cisco DNA Center) Network Plug and Play (PnP). Place the steps of the Day-0 PnP device discovery and provisioning process into the correct operational sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with the switch extracting the controller address from DHCP Option 43, establishing a secure TLS connection to transmit its serial number, matching the serial number to claim the device in Cisco Catalyst Center, provisioning the Golden software image and Day-0 configuration template, and finally rebooting to establish full Assurance telemetry integration.
The standard Network Plug and Play (PnP) zero-touch onboarding workflow follows a strict deterministic sequence: 1) The unconfigured device boots and uses DHCP Option 43 to obtain the Cisco Catalyst Center IP. 2) It opens a TLS connection to the controller and reports its serial number and Product ID (PID). 3) Cisco Catalyst Center matches the serial number, claims the device, and assigns it to a site hierarchy. 4) The controller pushes the designated Golden software image (SWIM) and Day-0 configuration template. 5) The switch reboots with the new image/config and registers for telemetry/Assurance monitoring.

Step-by-Step Solution

1
Identify initial network discovery
The device receives network settings and decodes vendor-specific DHCP Option 43 containing the controller IP.
Factory-default switches require an automated mechanism (DHCP Option 43 or Cloud PnP Redirect) to locate Cisco Catalyst Center without local console intervention.
2
Establish control channel and device identification
The device initiates a secure TLS session to Cisco Catalyst Center and sends identity parameters (serial number and PID).
The controller requires cryptographic session establishment and device identification before executing any management operations.
3
Claim device and map site policy
Cisco Catalyst Center claims the serial number and maps it to a designated network site.
Site assignment dictates which software image policies (SWIM) and Day-0 configuration templates apply to the device.
4
Deploy image and template configuration
Cisco Catalyst Center transfers the Golden IOS XE image and provisions the Day-0 configuration.
Provisioning software compliance and base network configuration must occur prior to operational activation.
5
Finalize activation and assurance telemetry registration
The switch reloads into the new image, applies the configuration, and syncs telemetry with Assurance.
Applying the golden image and configuration requires a system reload, completing the zero-touch onboarding lifecycle.

Key Concept

Cisco Catalyst Center Network Plug and Play (PnP) Day-0 Device Onboarding Workflow
PreviousPage 3 / 100Next
All practice questions — Cisco CCNA | Examkin