Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 701Question →

A network administrator is implementing the AAA framework on an enterprise switch to manage access. Match each administrative operational task on the left to its corresponding AAA framework pillar on the right.

Click a left item, then click its matching right item

Items

Validating user credentials against a centralized database before granting access
Restricting an authenticated engineer to specific privilege levels and CLI commands
Logging session start times, duration, and executed commands for compliance tracking

Matches

Show answer & explanation

Answer

Validating user credentials matches Authentication; Restricting privilege levels and CLI commands matches Authorization; Logging session times and executed commands matches Accounting.
Authentication verifies identity ('who you are'), Authorization determines permissions and command rights ('what you can do'), and Accounting logs user activity and session details ('what you did').

Step-by-Step Solution

1
Analyze the task of validating user credentials.
Credential validation verifies identity (Who are you?), which is the function of Authentication.
Authentication is the first pillar of AAA responsible for verifying identity.
2
Analyze the task of restricting privilege levels and CLI commands.
Restricting access and capabilities enforces permission rules (What can you do?), which is the function of Authorization.
Authorization determines the scope of actions granted to an authenticated identity.
3
Analyze the task of logging session details and command history.
Logging activities creates an audit trail (What did you do?), which is the function of Accounting.
Accounting measures resource consumption and records session event logs.

Key Concept

Core Pillars of the AAA Framework (Authentication, Authorization, Accounting)
Estimated Time:45s
Question 702Question →

Match each network operational model feature to its corresponding architectural characteristic when comparing traditional networks with controller-based networking environments.

Click a left item, then click its matching right item

Items

Distributed Control Plane
Centralized Control Plane
Manual Hop-by-Hop Management
Intent-Based Orchestration

Matches

Show answer & explanation

Answer

Distributed Control Plane pairs with localized independent routing decisions; Centralized Control Plane pairs with a software controller maintaining an end-to-end network view; Manual Hop-by-Hop Management pairs with configuring devices individually via CLI; Intent-Based Orchestration pairs with defining high-level policies translated automatically across the fabric.
Distributed control planes refer to traditional networks where every node builds its own routing table. Centralized control planes belong to SDN/controller-based models where a central controller manages routing logic. Manual hop-by-hop management describes per-device CLI configuration sessions, whereas intent-based orchestration represents centralized policy translation across the network fabric.

Step-by-Step Solution

1
Analyze control plane placement in traditional vs. software-defined models.
Distributed control planes correspond to independent per-device protocol execution, whereas centralized control planes rely on a single controller for network-wide intelligence.
Control plane separation is the foundational distinction between traditional and controller-based architectures.
2
Analyze management paradigms and configuration methods.
Manual hop-by-hop configuration corresponds to CLI management per device, while intent-based orchestration maps to centralized GUI/API policy translation across the network.
Software-defined networking eliminates direct per-box CLI tasks in favor of automated, controller-driven policy deployment.

Key Concept

Contrasting Traditional Network Architecture with Controller-Based Software-Defined Networking
Question 703Question →

A network engineer has configured VRRPv2 between Router A (Master) and Router B (Backup) to provide default gateway redundancy for hosts on VLAN 10. Router A suddenly loses power and stops functioning. What is the correct sequence of operational events from the initial failure of Router A to the complete restoration of host traffic flow through Router B?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of events is: 1) Router A stops transmitting VRRP Master Advertisement multicast frames. 2) The Master_Down_Interval timer on Router B expires after three missed intervals plus skew time. 3) Router B transitions its internal state from Backup to Master. 4) Router B broadcasts a Gratuitous ARP (GARP) frame mapping the VRRP virtual IP to its virtual MAC address. 5) Layer 2 switches update their MAC address tables to forward host traffic to Router B.
During a VRRP Master router failure, the active Master first stops transmitting VRRP advertisement multicast messages. The Backup router notices the missing messages and waits until its Master_Down_Interval timer (calculated as 3 x Advertisement Interval + Skew Time) expires. When the timer elapses, the Backup router transitions into the Master state. Immediately after becoming Master, it broadcasts a Gratuitous ARP (GARP) packet containing the virtual IP and virtual MAC address. Connected Layer 2 switches receive this GARP and update their MAC address tables so that outbound host traffic destined for the virtual default gateway is properly directed to the new Master router.

Step-by-Step Solution

1
Identify the initial link/device failure event.
Router A fails and immediately ceases broadcasting VRRP Master Advertisement messages to multicast address 224.0.0.18.
Power loss prevents Router A from generating periodic advertisement packets.
2
Determine the backup router timer monitoring phase.
Router B detects silence on VLAN 10 and waits for the Master_Down_Interval timer (3 * Advertisement_Interval + Skew_Time) to expire.
The timer ensures transient network delays do not trigger unneeded master election failovers.
3
Analyze the state transition on the backup router.
Once the Master_Down_Interval timer expires, Router B moves from Backup state to Master state.
VRRP finite state machine rules require a Backup router to assume Master status if advertisements stop.
4
Identify how the new Master announces its presence to Layer 2 infrastructure.
Router B broadcasts a Gratuitous ARP frame containing the virtual IP and virtual MAC address across the segment.
Notifies connected Layer 2 switches that frames sent to the virtual MAC address should be delivered to Router B's port.
5
Trace the Layer 2 forwarding table update and traffic resumption.
Switches update their MAC address tables and forward subsequent host gateway traffic to Router B.
Hosts continue sending packets to the unchanged virtual MAC, which switches now forward to Router B.

Key Concept

VRRP Master Failover and Convergence Sequence
Question 704Question →

A network administrator notices that bursty data transfers sent across a 100 Mbps physical interface to a service provider are experiencing heavy packet loss. The service provider enforces a strict 20 Mbps Committed Information Rate (CIR) using a policer at their ingress edge. Which Quality of Service (QoS) mechanism should the administrator configure on the local router's egress interface to prevent provider-side packet drops by smoothing out the traffic rate?

Show answer & explanation

Answer: Traffic shaping to buffer out-of-profile packets in memory and release them at a steady rate matching the contracted limit.

Answer

Traffic shaping to buffer out-of-profile packets in memory and release them at a steady rate matching the contracted limit.
Traffic shaping is designed to rate-limit outbound traffic to a contracted Committed Information Rate (CIR) by buffering bursts in memory and transmitting packets continuously at a steady rate. This prevents the provider's ingress policer from seeing rate spikes and dropping packets.

Step-by-Step Solution

1
Analyze the problem scenario and bandwidth mismatch.
The local physical interface sends traffic at 100 Mbps, but the service provider polices incoming traffic at 20 Mbps.
Bursty transmissions exceeding 20 Mbps cause the provider's policer to drop excess packets immediately.
2
Compare Quality of Service traffic conditioning mechanisms (Policing vs. Shaping).
Traffic policing drops/remarks excess packets without queuing, whereas traffic shaping buffers excess packets in memory queues to smooth out micro-bursts.
To avoid packet loss while adhering to a sub-rate CIR on a faster physical link, outbound traffic must be shaped.
3
Select the appropriate egress QoS tool.
Configure egress traffic shaping targeting the 20 Mbps rate.
Shaping smooths egress burstiness, holding out-of-profile packets in a queue rather than letting the provider's policer discard them.

Key Concept

Differences in operational mechanics between QoS Traffic Policing and Traffic Shaping
Question 705Question →

An enterprise network security team is designing an access control architecture for two distinct use cases: granular CLI command authorization with full packet encryption for network engineers managing infrastructure devices via SSH, and port-based 802.1X authentication for wireless clients where authentication and authorization must be evaluated together in a single protocol transaction. Which protocol deployment strategy correctly fulfills both technical requirements based on their underlying operational characteristics?

Show answer & explanation

Answer: Deploy TACACS+ over TCP port 49 for infrastructure management because it encrypts the entire packet body and separates AAA functions; deploy RADIUS over UDP ports 1812 and 1813 for 802.1X access control because it encrypts only the password field and combines authentication with authorization.

Answer

Deploy TACACS+ over TCP port 49 for infrastructure management because it encrypts the entire packet body and separates AAA functions; deploy RADIUS over UDP ports 1812 and 1813 for 802.1X access control because it encrypts only the password field and combines authentication with authorization.
The correct strategy specifies TACACS+ over TCP port 49 for infrastructure management and RADIUS over UDP ports 1812/1813 for 802.1X network access control. TACACS+ encrypts the entire packet payload and decouples the AAA pillars, making it ideal for command-level authorization during SSH administration sessions. RADIUS encrypts only the user password field and combines authentication and authorization into single Access-Accept messages, making it the industry standard for 802.1X client authentication.

Step-by-Step Solution

1
Analyze device administration requirements
Device management requires per-command authorization and payload encryption for sensitive CLI interactions.
TACACS+ runs on TCP port 49, encrypts the entire packet body (providing confidentiality for command parameters), and strictly separates Authentication, Authorization, and Accounting, allowing dynamic per-command authorization checks.
2
Analyze 802.1X network access control requirements
Network access control requires combined authentication and authorization decisions for endpoint network admission.
RADIUS operates over UDP ports 1812 (authentication/authorization) and 1813 (accounting). It combines authentication and authorization into single Access-Request and Access-Accept/Reject transactions, while encrypting only the password attribute in the header.
3
Synthesize protocol selection
TACACS+ satisfies device administration; RADIUS satisfies 802.1X access control.
Matching TACACS+ (TCP 49, full encryption, modular AAA) with RADIUS (UDP 1812/1813, password-only encryption, coupled auth/assoc) fulfills all design criteria.

Key Concept

TACACS+ vs RADIUS Protocol Architecture and Operational Differences
Question 706Question →

A network engineer enables Dynamic ARP Inspection (DAI) on VLAN 20 of a Cisco Catalyst switch where DHCP Snooping is also active. All access interfaces on VLAN 20 are left in the default untrusted state. A critical host connected to interface GigabitEthernet1/0/12 is configured with a static IP address (192.168.20.50/24192.168.20.50/24) and MAC address (0050.56a1.23bc0050.56a1.23bc). Consequently, DAI drops all ARP requests sent by this host because no entry exists for it in the DHCP snooping binding database. The engineer must allow this host to communicate while keeping GigabitEthernet1/0/12 untrusted and maintaining DAI protection on VLAN 20. Which command sequence must be configured on the switch to resolve this issue?

Show answer & explanation

Answer: Define an ARP ACL using 'arp access-list STATIC_HOST', permit IP 192.168.20.50 and MAC 0050.56a1.23bc, and apply it with 'ip arp inspection filter STATIC_HOST vlan 20'.

Answer

Configure an ARP access list matching the static IP and MAC addresses ('arp access-list STATIC_HOST' followed by 'permit ip host 192.168.20.50 mac host 0050.56a1.23bc') and bind it to DAI on the VLAN using 'ip arp inspection filter STATIC_HOST vlan 20'.
Dynamic ARP Inspection (DAI) validates ARP requests and responses on untrusted ports against the DHCP snooping binding database. Because hosts with static IP configurations do not request IP addresses via DHCP, their IP-to-MAC mappings do not exist in the snooping database. To support static hosts without configuring the port as trusted (which would disable DAI checks entirely on that interface), an ARP access list (ARP ACL) must be configured with the host IP and MAC address, then applied to the VLAN using the 'ip arp inspection filter' command.

Step-by-Step Solution

1
Analyze the cause of packet drops under Dynamic ARP Inspection (DAI).
DAI inspects ARP packets on untrusted ports against the DHCP snooping binding database. Statically addressed hosts do not generate DHCP requests, so they lack database entries and their ARP traffic is dropped.
Untrusted ports undergo mandatory IP-to-MAC binding verification by DAI.
2
Identify the Cisco IOS mechanism for bypassing DHCP snooping database checks for static hosts while preserving DAI.
Configuring an ARP ACL allows administrators to manually define static IP-to-MAC bindings.
DAI evaluates configured ARP ACLs first before falling back to the DHCP snooping binding database.
3
Apply the ARP ACL to the targeted VLAN.
The command 'ip arp inspection filter <acl-name> vlan <vlan-id>' explicitly permits the static host ARP traffic on untrusted ports.
This maintains port untrusted security status for all other hosts while granting an exception for the static host.

Key Concept

Dynamic ARP Inspection (DAI) ARP ACL Integration for Statically Configured Hosts
Estimated Time:2m 0s
Question 707Question →

A network administrator reviews a Cisco IOS XE router configuration and notices the following line in the running configuration:

`username netadmin privilege 15 password 7 08221509421E05150C`

This entry was created after a technician executed `username netadmin privilege 15 password 0 SecretPass123` followed by `service password-encryption`.

Which statement accurately describes the primary security risk of using this password storage method compared to configuring `username netadmin secret SecretPass123`?

Show answer & explanation

Answer: The Type 7 algorithm uses weak vigenère-based obfuscation that can be easily reversed to plain text using standard tools.

Answer

The Type 7 algorithm uses weak vigenère-based obfuscation that can be easily reversed to plain text using standard tools.
The statement identifying Type 7 as a weak, reversible algorithm is correct. In Cisco IOS, using the `password` command combined with `service password-encryption` produces a Type 7 obfuscated password string. Type 7 uses a simple vigenère-style cipher designed purely to prevent shoulder surfing. It is easily reversible back to plain text. To secure local credentials, administrators should use the `username <name> secret <password>` command, which uses secure one-way hash algorithms (Type 5, Type 8, or Type 9).

Step-by-Step Solution

1
Analyze the password syntax used in the configuration command
The command `username netadmin password 0 SecretPass123` creates a local database account using plain text (Type 0).
The `password` keyword in Cisco IOS specifies unhashed or weak password storage unless superseded by `secret`.
2
Evaluate the effect of `service password-encryption`
It converts plain text passwords into Type 7 obfuscated strings in the configuration file.
Type 7 encryption uses a well-known, simple reversible cipher intended solely to protect against visual inspection over an admin's shoulder.
3
Compare Type 7 password storage with the `secret` keyword
The `secret` keyword applies strong one-way cryptographic hashing (Type 5 MD5, Type 8 PBKDF2 SHA-256, or Type 9 scrypt), which cannot be reversed back to plain text.
Hardening Cisco IOS device access requires non-reversible hashing algorithms rather than reversible Type 7 obfuscation.

Key Concept

Local Password Hashing vs Type 7 Obfuscation in Cisco IOS
Question 708Question →

An enterprise is transitioning from a traditional distributed network architecture to a controller-based software-defined networking (SDN) model. Which two statements describe key operational characteristics of a controller-based networking approach? (Select two.)

Select all that apply

Show answer & explanation

Answer: Control plane intelligence is centralized on a software controller rather than executing independently on each individual device.; Network policies and configurations are programmatically deployed across the fabric via centralized management interfaces and APIs.

Answer

Control plane intelligence is centralized on a software controller rather than executing independently on each individual device, and network policies and configurations are programmatically deployed across the fabric via centralized management interfaces and APIs.
Controller-based networking centralizes control plane intelligence into a software controller rather than running isolated control plane protocols on every individual network node. Additionally, network provisioning is executed programmatically through centralized management platforms and APIs rather than individual CLI connections.

Step-by-Step Solution

1
Examine control plane placement in controller-based networking.
Identify that SDN decouples and centralizes control plane decisions onto a software controller.
Unlike traditional networks where every node runs its own control plane, SDN centralizes intelligence.
2
Evaluate policy deployment methods in controller-based architectures.
Recognize that configuration and management are handled programmatically through central APIs.
Centralized controllers eliminate device-by-device manual CLI provisioning by utilizing programmatic API integration.

Key Concept

Decoupling and centralization of the control plane and centralized API orchestration in controller-based networking versus distributed traditional networks.
Question 709Question →

Match each Quality of Service (QoS) mechanism, field, or per-hop behavior on the left to its corresponding operational description or header specification on the right.

Click a left item, then click its matching right item

Items

Assured Forwarding (AF31)
Class of Service (CoS)
Traffic Shaping
Strict Priority Queuing (PQ)

Matches

Show answer & explanation

Answer

Assured Forwarding (AF31) corresponds to the 6-bit DSCP value specifying Class 3 traffic with low drop probability (011010); Class of Service (CoS) corresponds to the 3-bit PCP field in the IEEE 802.1Q header; Traffic Shaping corresponds to buffering excess egress packets in memory queues to smooth traffic bursts; Strict Priority Queuing corresponds to servicing delay-sensitive traffic ahead of all other queues.
Each term correctly aligns with its exact QoS definition: AF31 represents DSCP value 26 (011010), CoS utilizes the 3-bit 802.1Q header field, Traffic Shaping smooths bursts via packet buffering, and Strict Priority Queuing services high-priority packets ahead of all other queues.

Step-by-Step Solution

1
Identify Layer 3 marking specifications for Per-Hop Behaviors (PHBs).
Assured Forwarding (AF) uses 6 bits in the DSCP field. AF31 breaks down into Class 3 (3×8=243 \times 8 = 24, or binary 011000) with low drop probability (add 2, resulting in decimal 26 or binary 011010).
DSCP AF values use the formula 8x+2y8x + 2y where xx is the class (1-4) and yy is the drop precedence (1-3).
2
Identify Layer 2 marking specifications.
Class of Service (CoS) resides exclusively in the 3-bit Priority Code Point (PCP) field of the 802.1Q VLAN tag header.
CoS is a Layer 2 QoS marking mechanism and does not persist across non-trunked Ethernet hops or Layer 3 boundaries.
3
Differentiate between traffic conditioning mechanisms (shaping vs policing).
Traffic Shaping uses software queues to buffer packets that exceed the configured rate, smoothing egress flow.
Unlike policing (which drops or remarks excess packets), shaping delays out-of-profile traffic by placing it into memory queues.
4
Evaluate queuing algorithms and packet scheduling.
Strict Priority Queuing always services its designated queue first until empty before serving lower-priority queues.
Strict priority scheduling provides minimal latency for real-time traffic (such as voice), but requires policing to prevent queue starvation of other traffic classes.

Key Concept

QoS Classification, Marking, Queuing, and Traffic Conditioning Mechanics
Question 710Question →

A network administrator is implementing Layer 2 security controls on Cisco Catalyst access switches. Match each Layer 2 security feature mechanism on the left to its corresponding operational behavior on the right.

Click a left item, then click its matching right item

Items

DHCP Snooping Option 82 Insertion
Dynamic ARP Inspection (DAI)
Port Security Sticky MAC Learning
Port Security Restrict Violation Mode

Matches

Show answer & explanation

Answer

DHCP Snooping Option 82 Insertion attaches relay agent information to DHCP requests on untrusted ports. Dynamic ARP Inspection (DAI) intercepts and checks ARP requests against the DHCP binding database on untrusted interfaces. Port Security Sticky MAC Learning dynamically converts learned MAC addresses into running configuration entries. Port Security Restrict Violation Mode drops unauthorized frames, increments the violation counter, and sends a Syslog message without shutting down the interface.
Each feature is paired with its precise Layer 2 operational behavior. DHCP Snooping Option 82 inserts circuit details into client requests. DAI mitigates ARP poisoning by cross-referencing ARP headers against the DHCP snooping database. Sticky MAC converts dynamic address learning into explicit running-configuration statements. Restrict mode drops offending frames and logs an alert while preserving link availability.

Step-by-Step Solution

1
Analyze DHCP Snooping Option 82 mechanism
Identified that Option 82 adds relay agent metadata (such as switch chassis ID and port interface ID) to client requests on untrusted ports.
Option 82 provides location information to help DHCP servers assign IP addresses and policy parameters.
2
Analyze Dynamic ARP Inspection (DAI) verification mechanism
Determined that DAI validates incoming ARP packets against IP-to-MAC mappings stored in the DHCP snooping binding table.
DAI prevents ARP spoofing and poisoning by dropping invalid ARP packets on untrusted ports.
3
Examine Port Security sticky MAC functionality
Confirmed that sticky MAC dynamically discovers connected devices and writes them to running-config as static MAC entries.
Sticky MAC saves administrators from manually entering host MAC addresses while enforcing access restrictions.
4
Differentiate Port Security violation modes (protect vs restrict vs shutdown)
Matched restrict mode to dropping frames, logging Syslog messages, and incrementing violation counters without err-disabling the interface.
Protect mode drops frames silently without logging, whereas shutdown mode disables the interface entirely.

Key Concept

Layer 2 Security Mechanisms and Operational Characteristics
Question 711Question →

A network administrator needs to configure a fully specified IPv4 static route on a Cisco router to reach destination subnet 10.50.0.0/1610.50.0.0/16. The next-hop router interface IP address is 172.16.1.2172.16.1.2, and the outbound multiaccess Ethernet interface on the local router is GigabitEthernet0/0. Which command correctly establishes this route while avoiding recursive routing table lookups?

Show answer & explanation

Answer: ip route 10.50.0.0 255.255.0.0 GigabitEthernet0/0 172.16.1.2

Answer

The command `ip route 10.50.0.0 255.255.0.0 GigabitEthernet0/0 172.16.1.2` correctly configures a fully specified static route.
A fully specified static route on a broadcast multiaccess interface requires both the local outbound interface name and the next-hop IP address. In Cisco IOS, the command structure is `ip route <prefix> <mask> <exit-interface> <next-hop-ip>`. The option specifying `ip route 10.50.0.0 255.255.0.0 GigabitEthernet0/0 172.16.1.2` adheres strictly to this syntax.

Step-by-Step Solution

1
Identify the target network address and subnet mask.
Destination prefix is 10.50.0.010.50.0.0 with mask 255.255.0.0255.255.0.0 (/16).
Cisco IOS IPv4 static route syntax requires the destination prefix followed by its subnet mask in dotted-decimal format.
2
Apply Cisco IOS fully specified static route syntax rules.
The correct parameter order after prefix and mask is the exit interface followed by the next-hop IP address.
Specifying both parameters explicitly prevents ARP resolution issues on multiaccess Ethernet segments and eliminates recursive lookup overhead.
3
Verify parameter placement and values.
Interface GigabitEthernet0/0 precedes next-hop IP 172.16.1.2172.16.1.2.
The next-hop must belong to the adjacent downstream router, not the local router.

Key Concept

Fully Specified IPv4 Static Route Syntax
Question 712Question →

A network security engineer analyzes packet traces captured during remote access sessions to network infrastructure and 802.1X wireless client authentications. Which TWO statements correctly describe the architectural and packet-level differences between TACACS+ and RADIUS operations?

Select all that apply

Show answer & explanation

Answer: TACACS+ separates authentication and authorization into independent transaction pairs, whereas RADIUS combines authentication and authorization within its access-request and access-accept exchanges.; TACACS+ uses TCP port 49 to ensure reliable transport for fine-grained command-by-command authorization, whereas RADIUS relies on UDP ports 1812 and 1813 for authentication and accounting traffic.

Answer

The correct statements state that TACACS+ separates authentication and authorization into independent transactions while RADIUS combines them, and that TACACS+ operates over TCP port 49 while RADIUS uses UDP ports 1812 and 1813.
TACACS+ provides modular separation of authentication and authorization, enabling independent transaction pairs, and runs over TCP port 49 for reliable transmission. RADIUS bundles authentication and authorization together within single Access-Request/Accept exchanges and operates over UDP ports 1812 and 1813.

Step-by-Step Solution

1
Analyze protocol architectural modularity for AAA functions.
Identify that TACACS+ decouples Authentication, Authorization, and Accounting into separate protocol flows, whereas RADIUS combines Authentication and Authorization into a unified Access-Request/Access-Accept exchange.
Modular functional separation allows granular per-command authorization in TACACS+.
2
Evaluate transport layer protocols and port assignments.
Confirm TACACS+ utilizes connection-oriented TCP over port 49, whereas RADIUS utilizes connectionless UDP ports 1812 (Authentication/Authorization) and 1813 (Accounting).
TCP provides session reliability required for administrative control, while UDP minimizes overhead for network access control.
3
Evaluate packet payload encryption mechanisms to reject false statements.
Recognize that TACACS+ encrypts the entire packet payload (excluding the header), while RADIUS encrypts only the password attribute in the Access-Request packet.
Misidentifying payload encryption scope is a common protocol confusion.

Key Concept

Operational and protocol mechanics distinguishing TACACS+ and RADIUS within the AAA framework.
Question 713Question →

An inbound IPv4 extended Access Control List (ACL) named SECURE_IN is applied to interface GigabitEthernet0/1 on a Cisco router with the following configuration:

ip access-list extended SECURE_IN
10 permit tcp 172.16.10.0 0.0.0.255 host 192.168.1.100 eq 80
20 permit tcp host 172.16.10.15 192.168.1.0 0.0.0.255 eq 22
30 permit ip host 172.16.10.20 192.168.1.0 0.0.0.255

A host with IPv4 address 172.16.10.15172.16.10.15 sends a packet destined for 192.168.1.100192.168.1.100 targeting TCP port 443 (HTTPS). What action will the router take when processing this packet?

Show answer & explanation

Answer: The router drops the packet because it fails to match any explicit permit statement and is caught by the implicit deny clause.

Answer

The router drops the packet because it fails to match any explicit permit statement and is caught by the implicit deny clause.
Extended ACLs are processed sequentially from top to bottom. Each rule requires matching all specified criteria, including source/destination IP parameters and protocol port numbers. Because the packet on TCP port 443 fails to match lines 10, 20, and 30, it encounters the implicit 'deny ip any any' at the end of the ACL and is dropped.

Step-by-Step Solution

1
Evaluate line 10 against the incoming packet parameters.
Line 10 permits TCP traffic from 172.16.10.0/24 to host 192.168.1.100 on port 80. The packet uses port 443, so line 10 does not match.
Extended ACLs require all specified layer 3 and layer 4 conditions to match.
2
Evaluate line 20 against the incoming packet parameters.
Line 20 permits TCP traffic from host 172.16.10.15 to subnet 192.168.1.0/24 on port 22. The packet uses port 443, so line 20 does not match.
Port 443 (HTTPS) does not match port 22 (SSH).
3
Evaluate line 30 against the incoming packet parameters.
Line 30 permits IP traffic from host 172.16.10.20 to subnet 192.168.1.0/24. The packet source is 172.16.10.15, so line 30 does not match.
The specific source host IP address specified in line 30 does not match 172.16.10.15.
4
Apply the implicit ACL processing behavior at the end of the list.
The packet is dropped.
All Cisco IPv4 ACLs conclude with an unwritten, implicit 'deny ip any any' statement.

Key Concept

Top-down sequential evaluation of Extended IPv4 ACLs and the implicit deny clause
Estimated Time:1m 30s
Question 714Question →

A network administrator is designing default gateway redundancy for VLAN 50 using HSRPv1 and VRRPv2 across Cisco IOS switches. Which two statements correctly describe default operational behaviors or attributes of these protocols?

Select all that apply

Show answer & explanation

Answer: VRRPv2 enables preemption by default, allowing a higher-priority backup router to immediately assume the Master role upon startup.; HSRPv1 uses the virtual MAC address structure 0000.0c07.acXX0000.0c07.acXX, where XXXX represents the group number in hexadecimal format.

Answer

The two correct statements are that VRRPv2 enables preemption by default, allowing a higher-priority router to assume the Master role, and that HSRPv1 uses the virtual MAC address format 0000.0c07.acXX with the group number encoded in hexadecimal.
VRRPv2 enables preemption by default, enabling higher priority devices to immediately claim the Master role upon boot. Additionally, HSRPv1 uses the well-known virtual MAC prefix 0000.0c07.acXX, where XX represents the HSRP group number encoded in two hexadecimal digits.

Step-by-Step Solution

1
Evaluate preemption defaults for HSRPv1 and VRRPv2.
HSRPv1 has preemption disabled by default, whereas VRRPv2 has preemption enabled by default.
Understanding default preemption prevents unexpected active/master router elections after node reboots.
2
Analyze virtual MAC address structure for HSRPv1.
HSRPv1 uses 0000.0c07.acXX (where XX is the group number in hex), whereas VRRPv2 uses 0000.5e00.01XX.
Proper identification of FHRP MAC address formats is required for troubleshooting L2 MAC address tables.
3
Verify virtual IP address assignment constraints.
HSRP prohibits setting the virtual IP equal to a router's physical IP, while VRRP allows the master router to IP-address-own the virtual IP.
Distinguishes Virtual Router IP ownership capabilities between HSRP and VRRP.

Key Concept

HSRPv1 and VRRPv2 default operational parameters and virtual MAC structures
Question 715Question →

An enterprise organization is updating its Cisco Wireless Controller infrastructure to enforce WPA3-Enterprise 192-bit security mode across critical WLANs. During client validation, legacy 802.1X supplicants configured with AES-CCMP-128 encryption and EAP-TLS fail to associate with the SSID, whereas modern clients configured for 192-bit security connect successfully. Which technical requirement of WPA3-Enterprise 192-bit mode causes these legacy WPA2-Enterprise clients to fail association?

Show answer & explanation

Answer: WPA3-Enterprise 192-bit mode mandates GCMP-256 encryption and required Protected Management Frames (PMF), making CCMP-128 client suites incompatible.

Answer

WPA3-Enterprise 192-bit mode mandates GCMP-256 encryption and required Protected Management Frames (PMF), making CCMP-128 client suites incompatible.
WPA3-Enterprise 192-bit mode enforces a strict suite of cryptographic algorithms defined in CNSA (Commercial National Security Algorithm) guidelines. This requires Galois/Counter Mode Protocol with a 256-bit key (GCMP-256), HMAC-SHA384 key derivation, and mandatory Protected Management Frames (PMF) using BIP-GMAC-256. Clients offering legacy AES-CCMP-128 cannot satisfy these stringent RSN security capabilities and are rejected during association.

Step-by-Step Solution

1
Analyze WPA3-Enterprise 192-bit security requirements.
Identified that WPA3-Enterprise 192-bit mode requires specific robust cryptographic primitives: GCMP-256 for data confidentiality, HMAC-SHA384 for key derivation, and mandatory Protected Management Frames (PMF / IEEE 802.11w) with BIP-GMAC-256.
Security mandates for high-security deployment profiles require replacing 128-bit ciphers with 256-bit ciphers.
2
Compare legacy client configuration against WPA3-Enterprise 192-bit parameters.
Legacy clients attempting to associate with AES-CCMP-128 do not meet the minimum cipher requirements (GCMP-256) enforced by the WPA3-Enterprise 192-bit WLAN profile.
WLCs operating in 192-bit mode reject Robust Security Network (RSN) Capabilities IE proposals that offer lower-tier 128-bit ciphers.
3
Formulate the exact failure root cause.
The failure occurs due to mismatched cipher suites (CCMP-128 vs GCMP-256) and mandatory PMF requirements.
Both GCMP-256 and PMF enforcement are mandatory under 192-bit mode specification.

Key Concept

WPA3-Enterprise 192-bit Cryptographic Requirements and PMF Enforcement
Question 716Question →

A Cisco IOS router receives an IPv4 packet destined for 10.150.20.510.150.20.5. The routing table contains a static route `ip route 10.150.20.0 255.255.255.0 172.16.1.2` pointing to a next-hop address. Place the steps describing how the router recursively resolves the next-hop and forwards the packet in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for recursive next-hop resolution is: receiving the packet and inspecting the destination header, performing the primary routing table lookup for the destination network, executing the recursive lookup for the next-hop IP address, resolving the Layer 2 MAC address on the egress interface, and encapsulating/transmitting the frame.
When a static route is configured with a next-hop IP address rather than a directly connected exit interface, Cisco IOS must perform a recursive lookup. The router first inspects the packet header and matches the destination subnet against the routing table. Next, it identifies the next-hop IP address associated with that static route entry. Because an IP address cannot directly dictate physical egress, a second (recursive) lookup is performed to find which local connected subnet and physical interface reach that next-hop IP. Once GigabitEthernet0/1 is identified, the router checks its ARP table to map the next-hop IP to a destination MAC address, encapsulating and transmitting the frame out the resolved egress interface.

Step-by-Step Solution

1
Packet Ingress & Parsing
Destination IP 10.150.20.510.150.20.5 is extracted from the IPv4 header.
The router must inspect the destination IP address of an incoming packet to make a forwarding decision.
2
Primary Routing Lookup
Matches static route 10.150.20.0/2410.150.20.0/24 with next-hop IP 172.16.1.2172.16.1.2.
The routing table is searched using Longest Prefix Match (LPM) logic.
3
Recursive Lookup
Resolves next-hop IP 172.16.1.2172.16.1.2 to connected interface GigabitEthernet0/1.
When a static route specifies only a next-hop IP address, Cisco IOS requires a secondary lookup to resolve that IP address to a local exit interface.
4
Layer 2 Address Resolution
ARP table is queried/resolved for next-hop 172.16.1.2172.16.1.2 MAC address.
Ethernet interfaces require a destination MAC address to build the Layer 2 frame header.
5
Frame Encapsulation & Egress
Packet is sent out GigabitEthernet0/1 toward the next-hop router.
The router rewrites the Layer 2 source and destination MAC addresses and pushes the frame out the physical interface.

Key Concept

IPv4 Static Route Recursive Lookup & Packet Forwarding Logic
Question 717Question →

A network administrator needs to configure a backup floating static route on router R1 to reach the internal subnetwork 172.16.50.0/24172.16.50.0/24. The primary route to this destination is learned via OSPF, which operates with its default administrative distance. Which command must be configured on R1 so that the static route remains inactive until the primary OSPF path fails?

Show answer & explanation

Answer: ip route 172.16.50.0 255.255.255.0 192.168.12.2 120

Answer

ip route 172.16.50.0 255.255.255.0 192.168.12.2 120
OSPF routes have a default administrative distance of 110. A floating static route acts as a backup path by specifying an administrative distance higher than the primary path (in this case, 120). Cisco IOS uses the format 'ip route destination mask next-hop distance', making 'ip route 172.16.50.0 255.255.255.0 192.168.12.2 120' correct.

Step-by-Step Solution

1
Determine the administrative distance (AD) of the primary routing protocol
OSPF has a default administrative distance of 110.
Floating static routes rely on administrative distance values to determine path selection priority.
2
Select an administrative distance value for the backup static route
The backup static route must have an AD greater than 110 (such as 120).
Routers prefer routes with lower administrative distance values. The static route will only be installed into the routing table if the lower-AD OSPF route becomes unavailable.
3
Verify Cisco IOS static route command syntax
The correct command syntax is 'ip route <destination-prefix> <subnet-mask> <next-hop-ip> [distance]'.
Subnet masks must be entered in standard dotted-decimal format rather than wildcard mask notation.

Key Concept

Floating Static Route Administrative Distance Configuration
Question 718Question →

A network engineer is configuring VRRPv2 on a Cisco IOS router to provide default gateway redundancy for hosts on a subnet. The physical interface GigabitEthernet0/0 is configured with the IP address 172.16.10.1/24172.16.10.1/24. The engineer then executes the interface command `vrrp 10 ip 172.16.10.1`. What is the operational effect of configuring the VRRP virtual IP address to match the physical interface IP address?

Show answer & explanation

Answer: The router accepts the command and automatically sets its VRRP priority to 255, making it the IP address owner and Master router.

Answer

The router accepts the command and automatically sets its VRRP priority to 255, making it the IP address owner and Master router.
In VRRPv2/v3, a router can use its own physical interface IP address as the group virtual IP address. When configured this way, the router becomes the IP address owner, and its VRRP priority is automatically forced to 255 (the highest possible priority), ensuring it acts as the Master router.

Step-by-Step Solution

1
Analyze protocol rules for VRRP IP address assignment.
VRRP permits the virtual IP address to be identical to the primary IP address assigned to an interface on one of the routers in the VRRP group.
This router is designated as the 'IP address owner'.
2
Determine the priority change associated with IP address ownership.
When a router is the IP address owner in VRRP, its priority automatically increases to 255.
Priority 255 is reserved exclusively for the IP address owner to guarantee it becomes the Master router during election.

Key Concept

VRRP IP Address Ownership and Priority Assignment
Question 719Question →

Match each wireless security protocol standard on the left with its defining cryptographic capability or key exchange mechanism on the right.

Click a left item, then click its matching right item

Items

WPA (Legacy)
WPA2-Personal
WPA3-Personal
WPA3-Enterprise

Matches

Show answer & explanation

Answer

WPA (Legacy) pairs with TKIP/RC4 cipher suite; WPA2-Personal pairs with AES-CCMP and PSK 4-way handshake; WPA3-Personal pairs with SAE key exchange; WPA3-Enterprise pairs with mandatory PMF and optional 192-bit security mode.
Each wireless security protocol standard corresponds directly to its cryptographic cipher suite and authentication mechanism: legacy WPA uses TKIP/RC4, WPA2-Personal uses AES-CCMP with PSK authentication, WPA3-Personal uses SAE to defend against dictionary attacks, and WPA3-Enterprise enforces Protected Management Frames (PMF) alongside an optional 192-bit encryption suite.

Step-by-Step Solution

1
Identify the legacy WPA mechanism
WPA relies on TKIP and RC4 encryption.
Original WPA was created as an interim standard to improve WEP security without replacing hardware.
2
Identify WPA2-Personal standard features
WPA2-Personal standardizes AES-CCMP encryption with PSK authentication using a 4-way handshake.
IEEE 802.11i compliance mandated AES encryption for strong baseline confidentiality.
3
Identify WPA3-Personal enhancements
WPA3-Personal uses SAE (Simultaneous Authentication of Equals) instead of PSK.
SAE provides forward secrecy and protects against passive eavesdropping and offline dictionary attacks.
4
Identify WPA3-Enterprise features
WPA3-Enterprise mandates Protected Management Frames (PMF) and supports optional 192-bit encryption.
PMF protects management traffic against spoofing, while 192-bit mode supports high-security environments.

Key Concept

Wireless Security Protocols (WPA, WPA2, WPA3)
Question 720Question →

A wireless network architect is reviewing enterprise security standards to align wireless LAN controller (WLC) profiles with IEEE 802.11 security specifications. Match each wireless security implementation on the left with its corresponding key exchange mechanism, cipher suite, or framing requirement on the right.

Click a left item, then click its matching right item

Items

WPA2-Personal Key Exchange
WPA3-Personal Key Exchange
WPA3-Enterprise 192-bit Security Mode
WPA2-Enterprise Core Architecture

Matches

Show answer & explanation

Answer

WPA2-Personal Key Exchange matches the standard 4-Way Handshake utilizing a static Pre-Shared Key (PSK); WPA3-Personal Key Exchange matches Simultaneous Authentication of Equals (SAE) via Dragonfly handshake; WPA3-Enterprise 192-bit Security Mode matches GCMP-256 with mandatory BIP-GMAC-256 Protected Management Frames; WPA2-Enterprise Core Architecture matches IEEE 802.1X framework with dynamic EAP/RADIUS authentication.
Each wireless security protocol implementation correctly pairs with its key exchange protocol, authentication framework, and cipher suite requirements according to IEEE 802.11i and 802.11ax standards.

Step-by-Step Solution

1
Analyze WPA2-Personal authentication and encryption mechanics.
Identify that WPA2-Personal relies on a Pre-Shared Key (PSK) converted via PBKDF2 into a static PMK, which undergoes a 4-Way Handshake to establish the PTK.
Understanding the vulnerability of WPA2-Personal to passive capture and offline dictionary cracking helps distinguish it from SAE.
2
Analyze WPA3-Personal key exchange enhancements over WPA2.
Identify that WPA3-Personal introduces Simultaneous Authentication of Equals (SAE) using the Dragonfly key exchange protocol.
SAE prevents dictionary attacks by requiring interactive proof of password knowledge without transmitting password derivatives directly usable in offline calculation.
3
Evaluate WPA3-Enterprise 192-bit mode cryptographic primitives.
Confirm requirement of 256-bit symmetric encryption using GCMP-256 and BIP-GMAC-256 for management frame protection.
192-bit mode aligns with NSA Commercial National Security Algorithm (CNSA) suite specifications, upgrading from CCMP-128.
4
Differentiate Enterprise authentication models from Personal authentication models.
Associate 802.1X, EAP types (PEAP, EAP-TLS, EAP-FAST), and RADIUS integration with enterprise mode.
Enterprise implementations utilize centralized identity stores and dynamic key generation rather than shared static credentials.

Key Concept

Wireless Security Protocols, Authentication Frameworks, and Cipher Suites (WPA2/WPA3 Personal vs Enterprise)
PreviousPage 36 / 100Next
All practice questions — Cisco CCNA | Examkin