Examkin

All practice questions

203 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 41Question →

A network administrator needs to configure a new WPA2-Enterprise Wireless LAN (WLAN) for client connectivity using the Cisco Wireless LAN Controller (WLC) GUI. Arrange the steps in the correct chronological order required to successfully create, configure security settings for, enable, and apply this WLAN.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct procedural order is: 1) Navigate to WLANs > WLANs and select Create New, 2) Define Profile Name, SSID, and WLAN ID then click Apply, 3) Select the dynamic interface and enable Status under the General tab, 4) Configure WPA2 Policy with 802.1X under the Security > Layer 2 tab, and 5) Select the RADIUS authentication server under the AAA Servers tab and click Apply.
Creating a WLAN via the Cisco WLC web GUI follows a strict sequential process. First, navigating to WLANs > WLANs and executing 'Create New' allows entry of the basic identifying information (Profile Name, SSID, and WLAN ID). Clicking Apply creates the WLAN instance and presents the edit menu. On the General tab, the administrator maps the WLAN to a dynamic interface for VLAN access and enables the WLAN status. Next, under Security > Layer 2, WPA2 Policy and 802.1X Key Management are specified. Finally, under the AAA Servers tab, the specific RADIUS server is attached to handle 802.1X authentication, and clicking Apply saves the full configuration.

Step-by-Step Solution

1
Initiate WLAN Creation
Access the WLAN creation workflow by selecting 'Create New' from the drop-down menu on the WLANs page and clicking 'Go'.
The controller requires creating a new WLAN object before configurable tabs become available.
2
Configure Basic Identifiers
Assign the Profile Name, wireless network SSID, and unique WLAN ID, then click 'Apply'.
Applying these parameters registers the WLAN and automatically opens the WLANs > Edit page with specific configuration tabs.
3
Configure Interface Mapping & Administrative Status
On the General tab, select the mapped dynamic VLAN interface and check the Enabled box for Status.
Clients will fail to receive IP addressing or transmit traffic if the WLAN is not mapped to an operational interface and enabled.
4
Configure Layer 2 Security Mechanisms
Navigate to Security > Layer 2, select WPA+WPA2 parameters, enable WPA2 Policy, and choose 802.1X under Auth Key Management.
WPA2-Enterprise relies on 802.1X Key Management rather than PSK.
5
Bind AAA RADIUS Server & Save Settings
Navigate to the AAA Servers tab, choose the configured RADIUS server under Server 1, and click 'Apply' in the top-right corner.
802.1X authentication requests must be forwarded to a external RADIUS server for identity validation.

Key Concept

WLC GUI WLAN Creation and 802.1X Security Configuration Order
Estimated Time:2m 0s
Question 42Question →

An engineer configures a next-hop IPv4 static route on a Cisco router using the command `ip route 10.1.2.0 255.255.255.0 192.168.12.2`. Place the processing steps in the correct sequential order from first to last that the router performs when forwarding an incoming packet destined for 10.1.2.4510.1.2.45.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for packet forwarding with a next-hop static route is: First, match the packet destination IP 10.1.2.4510.1.2.45 to the static route entry pointing to next-hop 192.168.12.2192.168.12.2. Second, perform a recursive lookup in the routing table for 192.168.12.2192.168.12.2 to find the outgoing interface. Third, look up the MAC address of 192.168.12.2192.168.12.2 in the ARP table. Fourth, encapsulate the packet into a Layer 2 frame and transmit it out the egress interface.
When a static route specifies only a next-hop IPv4 address (recursive static route), the router must first identify the static route via longest-prefix match. Next, it performs a recursive RIB lookup on the next-hop IP address to determine the exit interface. After identifying the exit interface, it performs an ARP table lookup to find the next-hop MAC address, and finally encapsulates and transmits the frame.

Step-by-Step Solution

1
Evaluate incoming packet destination IP against routing table entries.
The destination address 10.1.2.4510.1.2.45 matches static route 10.1.2.0/2410.1.2.0/24 with next-hop 192.168.12.2192.168.12.2.
Routing decisions begin with a longest-prefix match lookup in the RIB.
2
Perform recursive routing lookup for next-hop IP address 192.168.12.2192.168.12.2.
The router identifies the directly connected network prefix and egress interface used to reach 192.168.12.2192.168.12.2.
Static routes configured solely with a next-hop IP require a recursive lookup to identify the exit interface.
3
Resolve Layer 2 destination hardware address via ARP cache lookup for 192.168.12.2192.168.12.2.
The target next-hop MAC address is retrieved for frame header construction.
Ethernet interfaces require the next-hop MAC address to format the data-link layer encapsulation.
4
Encapsulate IPv4 packet into Layer 2 Ethernet frame and send out the egress interface.
The packet is transmitted on the physical wire.
All forwarding requirements (interface and Layer 2 rewrite info) are complete.

Key Concept

IPv4 Static Route Recursive Lookup & Forwarding Process
Estimated Time:1m 30s
Question 43Question →

An administrator connects a switch access port to a user workstation without enabling Cisco PortFast. Place the standard IEEE 802.1D Spanning Tree Protocol (STP) port states in the chronological sequence that the interface transitions through from initial physical link up to active user data forwarding.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence of IEEE 802.1D STP port state transitions is: Blocking state, Listening state, Learning state, and Forwarding state.
In classic IEEE 802.1D Spanning Tree Protocol (STP), an edge port not configured with PortFast undergoes a strict 30-second convergence timer sequence: Blocking (initial loop prevention) -> Listening (15s, BPDU exchange and role selection) -> Learning (15s, MAC table population without data forwarding) -> Forwarding (active data packet processing).

Step-by-Step Solution

1
Identify initial link state
Port enters Blocking state
Standard 802.1D STP defaults unconfigured edge ports to Blocking to safely prevent loops during initial topology evaluation.
2
Transition to neighbor discovery and role determination
Port enters Listening state for 15 seconds (Forward Delay)
BPDUs are transmitted and processed to elect root bridges and designate root/designated port roles.
3
Prepare Layer 2 forwarding tables
Port enters Learning state for 15 seconds (Forward Delay)
MAC addresses are learned from incoming frames to populate the CAM table, mitigating flooding when forwarding begins.
4
Complete convergence to operational status
Port enters Forwarding state
With topology determined and MAC table initialized, user frames are actively forwarded.

Key Concept

IEEE 802.1D STP Port State Transitions
Estimated Time:1m 15s
Question 44Question →

An administrator needs to enable Link Aggregation (LAG) on a Cisco Wireless LAN Controller (WLC) connected to an upstream switch stack. Place the configuration and operational steps in the correct chronological sequence from start to finish.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with saving the WLC configuration, enabling LAG in the controller settings, saving and rebooting the WLC to apply the change, and finally configuring the connected switch ports as a static EtherChannel (mode on).
The sequence follows the standard Cisco procedure for turning on controller-wide Link Aggregation (LAG). First, current configuration state is saved. Second, LAG is enabled in the WLC settings menu. Third, the WLC configuration is saved and the controller is rebooted to apply the change. Fourth, the corresponding switch ports are configured into a static EtherChannel using 'channel-group mode on' to complete the physical and logical aggregation.

Step-by-Step Solution

1
Save the existing WLC configuration
Establishes a baseline configuration state before initiating a system reboot
It is essential to safeguard existing controller configuration prior to changing structural hardware modes.
2
Enable LAG in WLC settings
Places the WLC into a pending LAG state
The controller feature knob for LAG must be explicitly enabled before hardware interface aggregation takes effect.
3
Save and reboot the WLC
The controller reboots with LAG operational across all physical distribution system ports
Enabling LAG on a Cisco WLC requires a reboot to reconfigure internal interface mappings.
4
Configure static EtherChannel on the upstream switch
The switch ports bundle into a single logical link matching the WLC LAG mode
Cisco WLC LAG requires static frame grouping ('mode on') on the switch side since WLCs do not support LACP or PAgP negotiation.

Key Concept

WLC Link Aggregation (LAG) configuration workflow and switch port requirements
Question 45Question →

When a Cisco router receives an IP packet, it evaluates several parameters to determine the best route to place into the routing decision process. Place the path selection criteria in the correct sequential order, from the primary (first evaluated) factor to the final tie-breaker factor.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of router decision criteria is: 1) Longest Prefix Match, 2) Administrative Distance, 3) Metric, 4) Equal-Cost Multi-Path.
Router forwarding decision logic evaluates parameters in a strict hierarchical order. First, Longest Prefix Match identifies the most specific network prefix for the destination IP address. If multiple routes exist with the exact same prefix length from different protocols, Administrative Distance breaks the tie by choosing the lower value. If multiple candidate routes come from the same routing protocol with identical prefix lengths, the Metric is used as the next tie-breaker. Finally, if prefix length, Administrative Distance, and metric are all identical, Equal-Cost Multi-Path load balancing is performed.

Step-by-Step Solution

1
Determine primary routing lookup criteria
Longest Prefix Match is checked first.
Prefix specificity always takes precedence over AD and metric.
2
Evaluate tie-breaker between different routing protocols for the exact same prefix length
Administrative Distance is compared.
Lower AD indicates a more trustworthy routing source.
3
Evaluate tie-breaker within the same routing protocol
Metric is compared.
Lower metric indicates a lower internal routing protocol cost.
4
Handle identical tie-breaker results
Equal-Cost Multi-Path load balancing is applied.
When all parameters match identically, the router balances traffic across the equal routes.

Key Concept

Router Forwarding Decision Logic Sequence
Question 46Question →

A network administrator needs to convert two physical switch interfaces (GigabitEthernet0/1 and GigabitEthernet0/2) on a Cisco Catalyst switch into a routed (Layer 3) EtherChannel bundle using dynamic LACP active mode. In what sequential order should the Cisco IOS configuration commands be executed to successfully establish the routed port-channel interface and configure its IP addressing?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct CLI configuration sequence is: enter physical interface range mode ('interface range GigabitEthernet0/1 - 2'), convert physical links to routed mode ('no switchport'), assign interfaces to dynamic LACP group ('channel-group 10 mode active'), enter logical port-channel mode ('interface Port-channel 10'), and assign the IP address ('ip address 10.10.10.1 255.255.255.252').
To build a routed (Layer 3) EtherChannel using LACP, an engineer must first enter physical interface configuration mode ('interface range GigabitEthernet0/1 - 2'), disable Layer 2 processing on those physical member links using 'no switchport', and bind them into an active LACP bundle with 'channel-group 10 mode active'. Once the bundle is formed, the engineer enters the logical interface mode ('interface Port-channel 10') and applies the IPv4 network parameters using 'ip address 10.10.10.1 255.255.255.252'.

Step-by-Step Solution

1
Select physical member interfaces using 'interface range GigabitEthernet0/1 - 2'
Enters interface range configuration mode for both physical ports simultaneously.
Configuration commands must target the physical interfaces that will compose the EtherChannel.
2
Disable Layer 2 functionality on physical links using 'no switchport'
Converts physical member interfaces from Layer 2 switchports to Layer 3 routed interfaces.
If interfaces remain in Layer 2 mode when assigned to a channel group, a Layer 2 port-channel will be created instead of a Layer 3 port-channel.
3
Bind physical interfaces into an LACP group using 'channel-group 10 mode active'
Creates logical Port-channel 10 and initiates LACP active negotiation on physical member links.
The 'active' keyword specifies dynamic LACP negotiation protocol mode.
4
Enter logical bundle interface configuration using 'interface Port-channel 10'
Moves CLI focus to the newly spawned logical interface Port-channel 10.
Layer 3 IP attributes must be configured on the parent logical bundle rather than individual member links.
5
Configure the IP address using 'ip address 10.10.10.1 255.255.255.252'
Assigns Layer 3 IPv4 addressing to Port-channel 10 for routing.
In a Layer 3 EtherChannel, routing parameters reside on the logical Port-channel interface.

Key Concept

Layer 3 LACP EtherChannel CLI Configuration Sequence
Question 47Question →

Place the following Cisco IOS configuration commands in the correct order to create VLAN 30, assign it the name 'ENGINEERING', and configure interface GigabitEthernet1/0/15 as a static access port in VLAN 30, starting from privileged EXEC mode (`Switch#`).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts by entering global configuration mode (`configure terminal`), creating and naming the VLAN (`vlan 30` followed by `name ENGINEERING`), navigating to the interface (`interface GigabitEthernet1/0/15`), statically setting access mode (`switchport mode access`), and finally assigning the port to VLAN 30 (`switchport access vlan 30`).
The CLI prompt hierarchy in Cisco IOS enforces a strict order of operations: privileged EXEC mode (`Switch#`) must first transition to global configuration mode (`configure terminal`), followed by entering the VLAN submode (`vlan 30`) to set parameters like `name ENGINEERING`. Once VLAN creation and naming are complete, navigating to interface configuration mode (`interface GigabitEthernet1/0/15`) allows setting the operational mode (`switchport mode access`) and assigning the port membership (`switchport access vlan 30`).

Step-by-Step Solution

1
Enter Global Configuration mode from privileged EXEC mode.
Prompt changes to `Switch(config)#`.
CLI global context is needed to instantiate VLANs and select target interfaces.
2
Execute `vlan 30` in global configuration mode.
Prompt changes to `Switch(config-vlan)#`.
VLAN sub-configuration mode is required to configure specific properties such as the VLAN name.
3
Execute `name ENGINEERING` in VLAN configuration mode.
VLAN 30 is named ENGINEERING in the switch VLAN database.
VLAN name commands can only be issued within the `Switch(config-vlan)#` prompt context.
4
Navigate to the interface context using `interface GigabitEthernet1/0/15`.
Prompt changes to `Switch(config-if)#`.
Port configuration commands require interface configuration context.
5
Configure the port operational mode using `switchport mode access`.
Interface GigabitEthernet1/0/15 is set to static access mode.
Static access mode prevents DTP negotiation and ensures frames are untagged on host links.
6
Assign the port membership using `switchport access vlan 30`.
GigabitEthernet1/0/15 is placed into VLAN 30.
Associates the access interface with the intended broadcast domain.

Key Concept

VLAN Creation and Access Port Assignment in Cisco IOS
Question 48Question →

A Cisco router receives an IPv4 unicast packet destined for 10.150.45.6710.150.45.67. The router's Routing Information Base (RIB) and Forwarding Information Base (FIB) contain multiple overlapping routes, static entries, and dynamic routing protocol paths. In what exact sequence does the router evaluate routing parameters and process the packet from ingress lookup to physical egress forwarding? Arrange the steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct evaluation sequence for router forwarding decision logic is: 1) Longest Prefix Match evaluation, 2) Administrative Distance tie-breaking for identical prefixes across different protocols, 3) Metric tie-breaking for identical prefixes within the same protocol, 4) ARP lookup for next-hop MAC address resolution, and 5) Layer 2 encapsulation rewrite, TTL decrement, checksum update, and frame transmission.
The router forwarding process follows a strict hierarchy: Longest Prefix Match (LPM) is evaluated first across all routes in the routing table. If multiple routes from different protocol sources share the exact same prefix length, Administrative Distance (AD) breaks the tie. If multiple routes from the same protocol share the exact same prefix length, protocol metric breaks the tie. Once the best route and next-hop are chosen, the router resolves the next-hop MAC via ARP/NDP, updates IP header fields (TTL decrement by 1 and checksum update), rewrites the Layer 2 header, and transmits the frame out the egress interface.

Step-by-Step Solution

1
Perform destination IP lookup using Longest Prefix Match (LPM).
The router identifies all matching subnet routes and selects the route entry with the highest number of matching network bits (most specific mask length).
LPM supersedes lower Administrative Distance values or routing metrics. A /28/28 route will always be chosen over a /24/24 route regardless of whether the /24/24 is static or connected.
2
Compare Administrative Distance (AD) if multiple sources present identical prefix masks.
The route from the source with the lowest AD (e.g., Static 11 vs. OSPF 110110) is preferred.
AD measures route source believability and only arbitrates between identical prefix masks from different routing processes.
3
Compare routing protocol metrics for ties within the same protocol.
The path with the lowest metric (cost, hop count, composite metric) is selected for RIB insertion.
Metrics only compare routes of the exact same prefix length learned via the same routing protocol algorithm.
4
Perform Layer 2 address resolution for the resolved next-hop address.
The router locates the next-hop IPv4 address in the ARP cache to retrieve its target MAC address.
Layer 3 forwarding decision requires binding the IP next-hop to a physical Layer 2 destination MAC address.
5
Execute packet header modifications and physical transmission.
The IPv4 TTL is decremented by 11, header checksum recalculated, source MAC updated to egress interface MAC, destination MAC updated to next-hop MAC, and the frame is serialized onto the wire.
Routers act as Layer 3 boundaries and must rebuild the Layer 2 frame header for each routed hop.

Key Concept

Router Forwarding Decision Logic and Longest Prefix Match Hierarchical Precedence
Question 49Question →

What is the correct sequential order of steps required to deploy a new baseline software update across enterprise switches using Cisco DNA Center Software Image Management (SWIM)?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order for Cisco DNA Center Software Image Management (SWIM) is: 1) Import the software image into the repository, 2) Tag the image as Golden for the target device family, 3) Perform a compliance audit against inventory devices, and 4) Distribute and activate the image on non-compliant devices.
The standard Cisco DNA Center Software Image Management (SWIM) workflow follows four logical phases: image intake into the central repository, designating the image as Golden to define baseline compliance rules, performing compliance audits against managed network inventory, and finally scheduling distribution and activation to upgrade non-compliant hardware.

Step-by-Step Solution

1
Ingest software image
The software file is available locally within Cisco DNA Center image management.
The controller cannot manage or deploy images that have not been ingested into its central repository.
2
Define Golden Image standard
A software baseline is established for a specific switch family or role.
Designating an image as Golden tells the controller which version devices of that family are expected to run.
3
Execute compliance audit
Devices running mismatched software versions are marked non-compliant.
Compliance audits compare active device inventory versions against the assigned Golden image baseline.
4
Deploy image (distribute & activate)
Target devices are upgraded to the Golden software image.
Distributing transfers the file to device storage, and activation applies the update and reboots the hardware.

Key Concept

Cisco DNA Center Software Image Management (SWIM) Lifecycle
Question 50Question →

A network administrator is executing an automated software upgrade for a cluster of Cisco Catalyst access switches using Cisco DNA Center Software Image Management (SWIM). What is the correct sequence of steps required to complete the complete end-to-end SWIM deployment workflow?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order for the Cisco DNA Center Software Image Management (SWIM) workflow is: 1) Upload the software image file into the Cisco DNA Center Image Repository, 2) Designate the software image as Golden for the specific Catalyst switch model family, 3) Initiate the Image Distribution job to copy the binary file to switch flash storage, 4) Run Pre-checks validation to verify system readiness, and 5) Execute the Image Activation job to set boot variables, reboot the device, and run Post-checks.
The Cisco DNA Center SWIM lifecycle follows a strict logical process. First, the installation file is uploaded into the central repository. Next, administrators tag the image as 'Golden' for the targeted switch family to establish compliance baseline. Then, distribution transfers the binary onto the managed switch's local storage. Pre-checks validate storage capacity and configuration state prior to disruption. Finally, activation updates boot parameters, reloads the node into the new release, and executes post-checks to confirm full network recovery.

Step-by-Step Solution

1
Add the installation binary to the system repository
The target Cisco IOS XE image is stored in Cisco DNA Center Image Repository
Cisco DNA Center cannot manage, evaluate compliance for, or deploy an image that has not been imported into its local repository.
2
Set the Golden Image compliance standard
The image is marked as Golden for the selected device family
Marking an image as Golden defines the standardized baseline operating system version for all devices assigned to that family/role.
3
Distribute the software image to target switches
The image binary file is transferred to local flash memory on the switches
Distribution moves the image onto the device storage in advance so that activation can take place swiftly during a designated maintenance window.
4
Run Pre-upgrade check validations
System checks confirm sufficient disk space, configuration compatibility, and stack stability
Pre-checks prevent failed upgrades by identifying potential issues (such as insufficient flash storage or corrupt configuration statements) before the reboot sequence starts.
5
Activate the image and run Post-checks
Boot configuration is modified, device reboots, and Post-checks confirm healthy status
Activation updates the startup system boot statements and reboots the switch to complete the upgrade, followed by post-check verification to validate operational health.

Key Concept

Cisco DNA Center Software Image Management (SWIM) Workflow
Question 51Question →

A network administrator needs to perform a Software Image Management (SWIM) upgrade on enterprise switches using Cisco DNA Center. What is the correct chronological sequence of steps required to complete this software deployment workflow from start to finish?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for a Cisco DNA Center Software Image Management (SWIM) upgrade is: 1) Import the software image into the Image Repository, 2) Mark the image as Golden for the device family, 3) Run pre-checks on target devices, 4) Distribute the software image to the switch storage, and 5) Activate the software image to reboot the switch into the new version.
The correct workflow in Cisco DNA Center Software Image Management (SWIM) begins with importing the software binary into the repository, followed by marking it as a Golden Image for the target device family to set compliance standards. Next, pre-checks are run to ensure devices have sufficient storage space and satisfy health conditions. Once verified, the image is distributed (staged) to the target storage, and finally activated to reboot the switch into the updated software version.

Step-by-Step Solution

1
Import the software image into Cisco DNA Center.
The binary image file is indexed within Cisco DNA Center's Image Repository.
Cisco DNA Center requires image files to reside in its repository before they can be evaluated or assigned.
2
Tag the image as Golden for the target hardware platform.
Devices running older or non-matching code are flagged as non-compliant.
Golden image tagging establishes the compliant baseline version within the network hierarchy.
3
Perform readiness pre-checks on candidate switches.
Flash storage, running configuration integrity, and hardware compatibility are verified.
Pre-checks prevent distribution or activation failures due to insufficient memory or incompatible settings.
4
Initiate image distribution.
The software file is copied across the network onto the switch flash storage.
Staging the file beforehand allows distribution to occur prior to a scheduled maintenance window.
5
Execute image activation.
Boot configuration is updated and the switch reboots using the new software image.
Activation completes the upgrade cycle by rebooting the hardware to run the distributed binary.

Key Concept

Cisco DNA Center Software Image Management (SWIM) Workflow
Estimated Time:1m 30s
Question 52Question →

A network administrator is using Cisco DNA Center to onboard and configure a newly discovered switch. What is the correct order of steps required to complete the device provisioning workflow from start to finish?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for provisioning a device in Cisco DNA Center is: 1) Select the switch from unassigned inventory, 2) Assign it to a network site, 3) Apply network settings and configuration templates, 4) Review the generated CLI preview and deployment schedule, and 5) Deploy the configuration and verify the switch status becomes Provisioned.
The Cisco DNA Center device provisioning workflow follows a strict logical sequence: first selecting the device from the unassigned inventory pool, assigning it to a site location in the network hierarchy, binding the relevant settings and CLI templates, reviewing the synthesized CLI configuration diff, and finally deploying the job to update the device status to Provisioned.

Step-by-Step Solution

1
Locate the device in inventory
The target switch is selected under Provision > Network Devices > Inventory.
Provisioning must target an unassigned device discovered by Cisco DNA Center.
2
Assign device to site hierarchy
The device is mapped to a specific Area/Building/Floor location.
Site assignment determines which global/site-level policies and settings (DNS, Syslog, SNMP, NTP) apply to the device.
3
Configure templates and device settings
CLI configuration templates and site settings are associated with the switch.
Day-N operational settings and day-1 configuration templates must be attached prior to building the deployment payload.
4
Preview configuration and set schedule
The administrator validates the generated CLI diff and selects immediate or scheduled execution.
Previewing ensures configuration accuracy and prevents unintended network outages.
5
Execute deployment and verify state
Cisco DNA Center applies the configuration and updates inventory status to Provisioned.
Successful execution completes the provisioning cycle, allowing Assurance monitoring to track device health.

Key Concept

Cisco DNA Center Device Provisioning Workflow
Question 53Question →

A network administrator configures a static route using only a next-hop IP address. Place the operational steps in the correct order that a Cisco IOS router performs to process and forward a packet using this recursive static route.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of packet forwarding steps for a recursive static route is: 1) Evaluate destination against routing table for longest prefix match, 2) Identify matching static route and extract next-hop IP, 3) Perform recursive lookup to resolve next-hop IP to an exit interface, 4) Query ARP table for next-hop MAC address on that interface, 5) Encapsulate frame and forward out the exit interface.
When an IPv4 static route is configured using only a next-hop IP address, Cisco IOS must resolve the outgoing interface by performing a second (recursive) lookup in the routing table. First, the router matches the packet destination address to the static route entry. Second, it extracts the next-hop IP. Third, it recursively resolves that next-hop IP to a connected interface. Fourth, it uses ARP on that interface to determine the next-hop MAC address. Finally, it encapsulates the packet and forwards it out the interface.

Step-by-Step Solution

1
Examine incoming packet destination
Longest match matching the static route prefix is found
Cisco IOS routing logic always evaluates the destination IPv4 address against all known routes using longest prefix matching first.
2
Extract next-hop IP address
Next-hop IPv4 address identified
Static routes configured in the format 'ip route prefix mask next-hop-ip' do not explicitly define the outgoing interface.
3
Perform recursive routing lookup
Exit interface and directly connected network identified
The router must locate a connected or dynamic route entry that covers the next-hop IP address to find the exit interface.
4
Resolve Layer 2 address
Next-hop MAC address obtained from ARP cache
For multi-access Ethernet interfaces, the router requires the destination MAC address of the next-hop gateway.
5
Frame encapsulation and transmission
Packet successfully transmitted
The packet is encapsulated with the local exit interface source MAC and next-hop destination MAC address.

Key Concept

Recursive Static Route Lookup and Packet Forwarding Process
Question 54Question →

A network administrator configures a Cisco IOS router to synchronize its time with an upstream NTP server operating at Stratum 2. Arrange the following steps in the correct chronological order from the initial synchronization attempt to successful time synchronization on the router.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with transmitting the NTP request packet (UDP 123), followed by receiving the server response with Stratum 2 details, calculating offset and delay, updating the local clock to Stratum 3, and finally marking the peer association as synchronized (∗*).
The NTP synchronization process must follow a logical operational sequence: first, sending a client poll via UDP port 123; second, receiving the server's timestamp and Stratum 2 payload; third, computing time drift and transit delay; fourth, adjusting the local clock and incrementing stratum to 3; and fifth, marking the verified peer as synchronized (∗*) in system output.

Step-by-Step Solution

1
Initiate NTP request
The router sends a client mode NTP packet on UDP port 123.
Synchronization begins when the client actively polls the configured NTP server.
2
Receive server payload
The server sends back an NTP packet indicating Stratum 2 and authoritative timestamp info.
The server provides the reference time data needed for calculation.
3
Compute clock offset and network delay
The router uses the four timestamps (origin, receive, transmit, destination) to determine offset.
Transit delay must be accounted for to accurately adjust the local clock.
4
Adjust system time and increment stratum
System clock is synchronized and stratum becomes 3 (2+12 + 1).
An NTP client's stratum is defined as the server's stratum plus one hop distance.
5
Flag active system peer
The peer displays an asterisk (∗*) in `show ntp associations`.
The asterisk denotes the configured NTP source currently selected for system clock synchronization.

Key Concept

NTP Client-Server Synchronization Sequence and Stratum Hierarchy Propagation
Question 55Question →

Four OSPFv2 routers are connected to a shared multi-access Ethernet segment. Place the steps of the OSPF Designated Router (DR) election logic in the correct order of evaluation, from the initial eligibility filter to the final operational behavior.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: Exclude routers with an OSPF priority of 0, select the candidate with the highest interface priority, break ties using the highest OSPF Router ID, and finally enforce non-preemption so an established DR remains active.
On multi-access broadcast networks, OSPF DR/BDR election begins by filtering out any router configured with priority 0. For remaining eligible routers, the router with the highest OSPF interface priority is preferred. If priorities are equal, the router with the highest Router ID breaks the tie. Once a DR is elected, the process is non-preemptive, meaning new routers joining the segment will not replace an active DR even if they have superior metrics.

Step-by-Step Solution

1
Filter out non-candidate routers.
Routers with `ip ospf priority 0` are excluded from election participation.
Setting priority to 0 explicitly forces a router to remain a DROTHER.
2
Evaluate interface priority values.
The candidate with the highest interface priority (range 1-255) is designated as winner.
Interface priority is the primary metric in OSPF DR/BDR elections.
3
Evaluate Router IDs if priorities match.
The router with the highest Router ID is selected.
Router ID acts as the definitive tie-breaker when OSPF priorities are tied.
4
Apply non-preemptive election rules.
The elected DR retains its role until the process or link resets.
OSPF prevents network instability and adjacencies reset by disallowing preemption.

Key Concept

OSPFv2 DR/BDR Election Logic and Precedence Rules
Question 56Question →

A network engineer is configuring logging thresholds on a Cisco IOS router and needs to categorize Syslog severity levels according to their standard numerical hierarchy. Arrange the following Syslog severity names in order from the MOST severe (lowest numerical level) to the LEAST severe (highest numerical level).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order from most severe (lowest numerical value) to least severe (highest numerical value) is: Critical (level 2), Error (level 3), Warning (level 4), and Informational (level 6).
Syslog levels range from 0 (Emergency) down to 7 (Debugging). Ordering the specified levels from most severe to least severe requires listing them in ascending order of their numerical values: Critical (2), Error (3), Warning (4), and Informational (6).

Step-by-Step Solution

1
Identify the numerical Syslog severity level assigned to each named severity.
Critical = Level 2, Error = Level 3, Warning = Level 4, Informational = Level 6.
Cisco IOS Syslog protocol assigns integer values from 0 (most urgent) to 7 (least urgent).
2
Sort the severity names by their numerical levels in ascending order.
Level 2 (Critical) < Level 3 (Error) < Level 4 (Warning) < Level 6 (Informational).
Lower numerical values indicate higher severity and greater urgency.
3
Construct the final sequence based on the sorted values.
Critical -> Error -> Warning -> Informational.
This sequence properly orders the Syslog messages from highest urgency to lowest urgency.

Key Concept

Cisco IOS Syslog Severity Levels and Hierarchy
Question 57Question →

A network administrator is configuring time synchronization on a newly installed Cisco IOS router. Arrange the following operational events in the correct chronological order, from initial CLI configuration to serving downstream clients.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence is: 1) Executing `ntp server 10.1.1.50` on the router, 2) Exchanging NTP polling messages to calculate delay and offset, 3) Adjusting the local system clock, 4) Transitioning to a synchronized state at Stratum 3 (upstream + 1), and 5) Responding to downstream client requests at Stratum 3.
The NTP operation sequence begins with establishing the peer/server relationship via `ntp server`. Polling packets are then exchanged to calculate offset and dispersion. Once metrics are validated, the local clock synchronizes, allowing the router to assign itself Stratum 3 (upstream Stratum 2 + 1). Finally, the router serves downstream clients accurately.

Step-by-Step Solution

1
Identify the initial configuration trigger
The command `ntp server 10.1.1.50` creates the server association.
No NTP message exchange can take place until the target IP server is defined in the configuration.
2
Analyze the packet exchange sequence
The router initiates NTP polling requests over UDP port 123.
Timestamped control packets must be exchanged to filter dispersion and compute clock offset.
3
Determine system clock adjustment
The system clock synchronizes to the upstream reference time.
Clock offset calculation must be completed before the router can adjust its internal clock.
4
Calculate the local stratum level
Stratum level becomes Stratum 2 + 1 = Stratum 3.
NTP protocol rules state that a device takes on the stratum level of its reference server plus one.
5
Identify downstream server operation
The router acts as an authoritative time source for internal network devices.
A Cisco router only advertises valid, authoritative time to clients after its own clock is synchronized.

Key Concept

NTP Synchronization Sequence and Stratum Propagation
Estimated Time:1m 30s
Question 58Question →

A Cisco router receives an IPv4 packet destined for 192.168.10.45192.168.10.45. The router has a single static route configured as follows: `ip route 192.168.10.0 255.255.255.0 10.1.1.2`. Arrange the steps of the router's lookup and packet forwarding process in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps for processing a recursive static route lookup is: (1) Receive the IPv4 packet on an ingress interface, (2) Match the destination IP to the static route prefix 192.168.10.0/24192.168.10.0/24, (3) Identify next-hop IP 10.1.1.210.1.1.2 and initiate a recursive lookup, (4) Resolve the next-hop IP to connected route 10.1.1.0/3010.1.1.0/30 on interface GigabitEthernet0/1, and (5) Encapsulate the packet into a Layer 2 frame and transmit out GigabitEthernet0/1.
When a static route is configured using a next-hop IP address rather than an explicit exit interface (e.g., `ip route 192.168.10.0 255.255.255.0 10.1.1.2`), Cisco IOS performs a recursive lookup process. The router first matches the packet's destination IPv4 address to the static route entry. Next, it extracts the next-hop IP address and performs a second routing table lookup to find which interface connects to that next-hop subnet. Once the exit interface is identified from a connected or secondary route, the router encapsulates the packet in a Layer 2 frame and sends it out the resolved interface.

Step-by-Step Solution

1
Receive IPv4 packet
Packet destination IP 192.168.10.45192.168.10.45 is extracted for table inspection.
Ingress processing triggers the forwarding decision engine.
2
Match static route prefix
Destination matches `192.168.10.0/24` with next-hop `10.1.1.2`.
Static route entry specifies the destination network reachable via a next-hop IP address.
3
Perform recursive route lookup
Secondary lookup query initiated for IP address 10.1.1.210.1.1.2.
Static routes configured with only a next-hop IP address require a recursive lookup to identify the outgoing physical interface.
4
Resolve outbound interface
Next-hop 10.1.1.210.1.1.2 resolves to connected interface GigabitEthernet0/1.
The routing table contains a directly connected prefix 10.1.1.0/3010.1.1.0/30 attached to GigabitEthernet0/1.
5
Encapsulate and forward frame
Packet is sent out GigabitEthernet0/1.
Final packet transmission requires determining the Layer 2 header rewrite details for the specific exit interface.

Key Concept

IPv4 Static Route Recursive Lookup Mechanism
Question 59Question →

A network administrator enables HSRP version 2 on a Cisco IOS router interface configured with the highest priority in the group. In what order does the router progress through the standard HSRP operational states from initial interface bring-up to becoming the primary gateway?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence of HSRP states during router initialization is Initial State, Listen State, Speak State, Standby State, and Active State.
HSRP routers follow a strict finite state machine sequence during initialization: Initial (interface up/config ready) -> Listen (receiving Hello messages passively) -> Speak (sending Hello messages to participate in election) -> Standby (acting as immediate backup) -> Active (handling virtual MAC/IP traffic).

Step-by-Step Solution

1
Identify the initial state upon interface bring-up
The router starts in the Initial state where protocol operations have not yet actively begun.
HSRP configuration is loaded but no network messages have been processed or sent.
2
Determine passive monitoring phase
The router transitions to the Listen state.
In Listen state, the router receives Hello packets to discover active group routers without sending any.
3
Identify active election participation
The router transitions to the Speak state.
In Speak state, the router starts transmitting Hello packets to announce its presence and priority.
4
Determine intermediate role election
The router moves into the Standby state.
Before becoming Active, the router becomes the Standby router monitoring the virtual IP group.
5
Identify final forwarding state
The router enters the Active state.
Because it possesses the highest priority, it claims the Active role and begins processing virtual MAC frames.

Key Concept

HSRP Finite State Machine (Initial -> Listen -> Speak -> Standby -> Active)
Question 60Question →

A network security architect is hardening a newly initialized Cisco IOS XE enterprise router. Arrange the following CLI configuration commands in the mandatory order required to establish local database authentication for remote management, ensuring that local privileged credentials using scrypt hashing are created prior to entering the line context, local authentication is bound to the VTY lines, and unencrypted management sessions are blocked.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of CLI operations begins in global configuration mode by defining the local administrative account with scrypt secret encryption ('username netsec_admin privilege 15 algorithm-type scrypt secret C!sc0_Sec#2026'). Next, enter line subconfiguration mode ('line vty 0 4'). Within the line context, enable local database lookup ('login local'), and finally restrict line access protocols strictly to SSH ('transport input ssh').
The proper administrative sequence requires creating the global local database account first using 'username netsec_admin privilege 15 algorithm-type scrypt secret C!sc0_Sec#2026'. Once the account exists, the administrator enters VTY line submode with 'line vty 0 4', binds line authentication to the local database using 'login local', and secures line transport by executing 'transport input ssh'.

Step-by-Step Solution

1
Define local administrative credentials in global configuration mode.
The local database contains an administrative account with privilege level 15 secured with a high-strength Type 9 scrypt hash.
Creating the account first prevents administrator lockout when local line login enforcement is applied.
2
Navigate into line configuration context for remote VTY interfaces.
The terminal prompt changes to line configuration submode (config-line).
Subsequent line-specific authentication and transport parameters can only be applied inside the line subconfiguration context.
3
Configure VTY lines to enforce local database authentication.
Inbound connection attempts on VTY lines 0-4 now require authentication matching accounts defined in the local running-config database.
The 'login local' command replaces default password checking or unauthenticated line access with local username/password verification.
4
Enforce secure management transport protocols on VTY lines.
Telnet and all other unencrypted remote access protocols are prohibited; only encrypted SSH connections are accepted.
Restricting transport input guarantees remote login credentials and session data are protected against eavesdropping across the network.

Key Concept

Cisco IOS CLI hierarchy and local authentication dependency sequence
PreviousPage 3 / 11Next
All practice questions — Cisco CCNA | Examkin