Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 821Question →

Under the Cisco Split-MAC architecture, a Lightweight Access Point (LAP) operates in Local mode. Which task is handled directly by the access point rather than being offloaded to the Wireless LAN Controller (WLC)?

Show answer & explanation

Answer: Transmitting 802.11 beacon frames and responding to probe requests

Answer

Transmitting 802.11 beacon frames and responding to probe requests is performed locally by the Lightweight Access Point.
Transmitting 802.11 beacon frames and responding to probe requests are time-sensitive real-time MAC functions handled locally by the access point hardware in Split-MAC architecture.

Step-by-Step Solution

1
Identify the role of Split-MAC architecture
Split-MAC divides 802.11 protocol functions between real-time MAC functions on the AP and management MAC functions on the WLC.
Real-time duties requiring immediate time-sensitive transmission are assigned directly to the AP hardware.
2
Differentiate AP duties from WLC duties
Beacons, probe responses, and frame acknowledgment occur on the AP, whereas authentication, association, and frame bridging occur on the WLC.
This allows central management of security and policy while offloading high-frequency time-critical RF duties to the AP.

Key Concept

Split-MAC Architecture and Real-Time vs Management MAC Duties
Question 822Question →

A network administrator is reconfiguring interface GigabitEthernet0/2 on a Cisco Catalyst switch. The interface is currently connected to a trunking partner device and is actively operating as an 802.1Q trunk port via Dynamic Trunking Protocol (DTP). The administrator enters the following interface configuration command:

Switch(config-if)# switchport access vlan 50

VLAN 50 does not currently exist in the switch VLAN database. Assuming all other configuration settings remain at default, what is the resulting operational state of interface GigabitEthernet0/2 and VLAN 50?

Show answer & explanation

Answer: VLAN 50 is automatically created in the VLAN database, but interface GigabitEthernet0/2 continues to operate as an active trunk port.

Answer

VLAN 50 is automatically created in the switch VLAN database, but interface GigabitEthernet0/2 continues to operate as a trunk port.
When configuring 'switchport access vlan 50' on a Cisco Catalyst interface, Cisco IOS automatically creates VLAN 50 in the VLAN database if it does not already exist. However, configuring the access VLAN value only affects traffic when the interface operates in access mode. Since the port was dynamically negotiating as an 802.1Q trunk and no explicit 'switchport mode access' command was issued, the interface remains in trunking operational mode.

Step-by-Step Solution

1
Analyze the effect of the command on the VLAN database
VLAN 50 is created automatically
When assigning an interface to a non-existent VLAN using 'switchport access vlan <vlan-id>', Cisco IOS dynamically creates the VLAN in the VLAN database.
2
Evaluate the administrative vs. operational mode of the interface
The interface operational mode remains trunk
The command 'switchport access vlan 50' modifies the access VLAN parameter for when the port operates in access mode. Because 'switchport mode access' was not executed, the existing dynamic/trunking operational state remains unchanged.

Key Concept

Separation of Access VLAN Configuration and Interface Operational Mode in Cisco IOS
Estimated Time:1m 30s
Question 823Question →

An enterprise network deployment hosts multiple business-critical server workloads on a bare-metal Type 1 hypervisor. The hypervisor is connected via a dual-homed physical 10GbE uplink to an upstream Layer 3 switch. Inside the hypervisor, a internal virtual switch (vSwitch) connects multiple virtual machines (VMs) assigned to VLAN 10. If a virtual machine on VLAN 10 emits an Ethernet broadcast frame (destination MAC FF:FF:FF:FF:FF:FF) during an ARP resolution request, how do these virtual and physical infrastructure components process and scope the broadcast traffic?

Show answer & explanation

Answer: The virtual switch forwards the broadcast frame to all other VM virtual interfaces assigned to VLAN 10 on that host and out the physical uplink to the Layer 3 switch, where the switch processes the frame at Layer 2 across VLAN 10 ports but does not forward it across routed Layer 3 boundaries.

Answer

The virtual switch forwards the broadcast frame to all other virtual machine interfaces in VLAN 10 and out the physical uplink to the Layer 3 switch, which confines the broadcast within VLAN 10 and does not forward it across Layer 3 routed boundaries.
A Layer 2 virtual switch integrated into a Type 1 bare-metal hypervisor operates as a standard bridge. When a VM issues a broadcast frame, the vSwitch floods it to all vNICs in the same VLAN and out the physical network interface card (pNIC) uplink. Upon reaching the physical Layer 3 switch, the frame is flooded only across ports belonging to VLAN 10. The Layer 3 boundaries on the switch terminate the broadcast, preventing it from reaching other VLANs or subnets.

Step-by-Step Solution

1
Analyze the role and operation of the internal virtual switch (vSwitch) in a Type 1 hypervisor.
The vSwitch acts as a software-based Layer 2 switch operating directly on bare-metal hardware. It maintains a MAC address table per VLAN and floods Layer 2 broadcast frames (FF:FF:FF:FF:FF:FF) to all local vNIC ports in the same VLAN and out physical uplinks.
Virtual switches follow standard IEEE Layer 2 bridging behaviors within configured VLAN boundaries.
2
Evaluate the forwarding behavior of the physical Layer 3 switch upon receiving the broadcast frame over the physical uplink.
The Layer 3 switch floods the broadcast frame to all physical ports participating in VLAN 10 within that Layer 2 broadcast domain, but terminates the broadcast at its Layer 3 switch virtual interface (SVI) or routed interfaces.
Layer 3 boundaries (routers/SVIs) isolate broadcast domains and prevent Layer 2 broadcasts from traversing into other subnets.

Key Concept

Layer 2 Broadcast Domain Scoping in Virtual and Physical Network Components
Question 824Question →

An enterprise router is configured with the following extended IPv4 access control list applied inbound on interface GigabitEthernet0/0/0:

text ip access-list extended SECURE_APP permit tcp 172.16.5.0 0.0.0.255 host 10.0.1.20 eq 80 permit ip host 172.16.5.10 host 10.0.1.20

Host A (IP address 172.16.5.15) attempts to establish an HTTPS connection (TCP port 443) to the application server at 10.0.1.20. Which statement accurately describes how the router processes this traffic?

Show answer & explanation

Answer: The router drops the packet because it fails to match the TCP destination port in the first line and does not match the source host in the second line, causing it to fall through to the implicit deny.

Answer

The router drops the traffic because it fails to match both explicit permit rules and consequently hits the unwritten implicit deny clause at the end of the access list.
The correct response identifies that extended access control lists process rules top-down, checking source address, destination address, and protocol port numbers. For host 172.16.5.15 using HTTPS (port 443), line 1 fails because the destination port is 443 instead of 80. Line 2 fails because the source host address 172.16.5.15 does not match host 172.16.5.10. Consequently, the packet reaches the default implicit deny clause at the end of the list and is dropped.

Step-by-Step Solution

1
Evaluate the packet against the first access-list entry (`permit tcp 172.16.5.0 0.0.0.255 host 10.0.1.20 eq 80`).
The packet source IP 172.16.5.15 matches `172.16.5.0 0.0.0.255` and destination IP `10.0.1.20` matches `host 10.0.1.20`. However, the destination port is 443 (HTTPS), which does not equal port 80 (HTTP). Line 1 does not match.
Extended ACLs process criteria sequentially and require all specified Layer 3 and Layer 4 fields to match.
2
Evaluate the packet against the second access-list entry (`permit ip host 172.16.5.10 host 10.0.1.20`).
The packet source IP is 172.16.5.15, which does not match `host 172.16.5.10`. Line 2 does not match.
The `host` keyword strictly matches only the specific IP address designated.
3
Evaluate the packet against the end of the ACL structure.
Having failed all preceding explicit permit statements, the packet encounters the default implicit `deny ip any any` statement.
Cisco IOS automatically appends an invisible implicit deny statement to the end of every IPv4 access control list.

Key Concept

Extended Access Control List Sequential Matching and Implicit Deny Behavior
Question 825Question →

Refer to the following Cisco IOS CLI output from switch Switch-A:

text
Switch-A# show interfaces fastEthernet 0/1
FastEthernet0/1 is up, line protocol is up (connected)
Hardware is Fast Ethernet, address is 0007.ebaa.1101
Full-duplex, 100Mb/s, media type is 100BASE-TX
...
12540 input errors, 12538 CRC, 0 frame, 0 overrun, 0 ignored
0 output errors, 0 collisions, 0 late collisions, 0 deferred

Switch-A connects directly to Switch-B over a 10-meter Category 5e UTP cable. Switch-B reports high counts of late collisions on its corresponding interface. Which condition is the root cause of these interface symptoms?

Show answer & explanation

Answer: A duplex mismatch where Switch-A is operating in full-duplex mode and Switch-B is operating in half-duplex mode.

Answer

The root cause is a duplex mismatch where Switch-A is set to full-duplex and Switch-B is set to half-duplex.
A duplex mismatch occurs when one end of an Ethernet link operates in full-duplex mode while the opposite end operates in half-duplex mode. Because the full-duplex device (Switch-A) transmits data without performing carrier sensing, it frequently sends frames while the half-duplex device (Switch-B) is actively transmitting. This causes Switch-B to detect collisions after sending the initial 64 bytes of a frame (late collisions), while Switch-A receives aborted frame fragments from Switch-B, registering them as CRC and FCS input errors.

Step-by-Step Solution

1
Analyze the CLI output on Switch-A
The interface is operating in full-duplex mode with a high number of input errors dominated by CRC errors, while output errors and collisions remain at zero.
An interface configured for full-duplex never checks for carrier sensing or collisions, so its collision counters will always remain zero.
2
Analyze the reported symptoms on Switch-B
Switch-B reports high counts of late collisions.
Late collisions occur on half-duplex interfaces when another device transmits after the 64-byte slot time window has passed.
3
Correlate symptoms across both devices
Full-duplex on Switch-A + Half-duplex on Switch-B explains both CRC errors on Switch-A and late collisions on Switch-B.
Switch-A transmits whenever it has data without listening. When Switch-B is transmitting, Switch-A's concurrent transmission collides with Switch-B's frames, causing Switch-B to record late collisions and Switch-A to receive truncated/corrupted frame fragments resulting in CRC errors.

Key Concept

Duplex Mismatch Symptom Analysis
Estimated Time:2m 0s
Question 826Question →

An organization is designing its enterprise edge network architecture. The design places a Layer 3 switch in the distribution layer to route traffic between local VLANs and places a Next-Generation Firewall (NGFW) at the WAN/Internet perimeter. Which statement correctly distinguishes the operational role of the Next-Generation Firewall from that of the Layer 3 switch in this deployment?

Show answer & explanation

Answer: The Next-Generation Firewall performs deep packet inspection up to Layer 7 for application awareness and threat prevention, whereas the Layer 3 switch primarily performs high-speed packet forwarding based on Layer 3 IP routing headers.

Answer

The Next-Generation Firewall performs deep packet inspection up to Layer 7 for application awareness and threat prevention, whereas the Layer 3 switch primarily performs high-speed packet forwarding based on Layer 3 IP routing headers.
Next-Generation Firewalls operate at perimeter boundaries to provide stateful inspection and Layer 7 application awareness, ensuring robust security enforcement. In contrast, Layer 3 switches are optimized for high-speed inter-VLAN routing and packet forwarding using Layer 3 IP header information.

Step-by-Step Solution

1
Identify the primary operational role of a Layer 3 switch.
Layer 3 switches combine Layer 2 switching capabilities with hardware-accelerated Layer 3 routing (IP packet forwarding across subnets/VLANs).
Layer 3 switches focus on wire-speed intra-campus and inter-VLAN routing.
2
Identify the primary operational role of a Next-Generation Firewall (NGFW).
NGFWs provide stateful packet inspection, application-layer control (Layer 7), intrusion prevention systems (IPS), and threat protection at security boundaries.
NGFWs focus on security enforcement and deep packet analysis at edge or boundary locations.
3
Compare the distinct roles to select the correct functional distinction.
The firewall inspects up to Layer 7 for security threats, while the Layer 3 switch routes traffic based on Layer 3 IP headers.
This captures the fundamental functional separation between core routing hardware and perimeter security components.

Key Concept

Distinct Roles of Network Components (Layer 3 Switches vs. Next-Generation Firewalls)
Question 827Question →

Router R3 has OSPFv2 configured and active. When the OSPF process initialized, the operational statuses of its interfaces were as follows:

- GigabitEthernet0/0 (IP: 192.168.10.1/24): Up / Line Protocol: Up
- GigabitEthernet0/1 (IP: 10.254.254.1/24): Up / Line Protocol: Up
- Loopback10 (IP: 172.16.1.1/24): Up / Line Protocol: Down
- Loopback20 (IP: 172.16.2.1/24): Up / Line Protocol: Up
- Loopback30 (IP: 172.16.3.1/24): Administratively Down / Line Protocol: Down

Shortly after initialization, a network administrator configured the command `router-id 1.1.1.1` under `router ospf 1`. No additional commands or resets were executed on the router.

What is the active OSPFv2 Router ID currently used by Router R3?

Show answer & explanation

Answer: 172.16.2.1

Answer

172.16.2.1
The active OSPF Router ID is 172.16.2.1. OSPF selects a Router ID during process initialization using the following tie-breaker order: (1) an explicitly configured `router-id` command, (2) the highest IP address of any operationally active (Up/Up) loopback interface, and (3) the highest IP address of any operationally active physical interface. At initialization, Loopback20 (172.16.2.1) was the only up/up loopback interface. Although `router-id 1.1.1.1` was subsequently configured, OSPF Router ID updates are non-preemptive and require executing `clear ip ospf process` to take effect.

Step-by-Step Solution

1
Evaluate interface operational states for OSPF Router ID candidacy.
Only interfaces in an 'Up / Line Protocol: Up' state are eligible. Loopback10 (line protocol down) and Loopback20 (up/up) are evaluated. Loopback20 is the only active loopback interface.
OSPF requires an interface to be operationally active to use its IP address as a Router ID.
2
Determine the initial active OSPF Router ID during process startup.
Because no explicit `router-id` command was configured at startup, OSPF selected the highest IP address among active loopback interfaces, which is 172.16.2.1 (Loopback20).
Active loopbacks take precedence over physical interfaces regardless of IP address values.
3
Evaluate the effect of configuring `router-id 1.1.1.1` after process initialization.
The active OSPF Router ID remains 172.16.2.1.
OSPF Router ID election is non-preemptive. Changing the `router-id` CLI setting takes effect only after reloading the device or resetting the OSPF process using the `clear ip ospf process` command.

Key Concept

OSPFv2 Router ID Election Order and Non-Preemptive Behavior
Question 828Question →

Five Cisco routers—R1, R2, R3, R4, and R5—are connected to a single Layer 2 Ethernet switch on the 10.1.1.0/24 multiaccess network segment running OSPFv2 in Area 0.

The initial boot sequence and interface configurations are as follows:
- R1 boots first with interface OSPF priority 1 and Router ID 1.1.1.1.
- R2 boots second with interface OSPF priority 1 and Router ID 2.2.2.2.
- Once R1 and R2 finish establishing adjacencies, R3 (priority 2, Router ID 3.3.3.3), R4 (priority 0, Router ID 4.4.4.4), and R5 (priority 255, Router ID 5.5.5.5) are booted simultaneously.

After all adjacencies reach the FULL state across the segment, R1 suffers a power failure and goes offline. Assuming no OSPF processes were reset manually prior to the failure, which router will be promoted to DR and which router will be elected as the new BDR?

Show answer & explanation

Answer: R2 becomes the DR, and R5 becomes the new BDR.

Answer

R2 becomes the designated router (DR), and R5 becomes the backup designated router (BDR).
In OSPF multiaccess networks, elections are strictly non-preemptive. R1 and R2 initially take the DR and BDR roles. When R3, R4, and R5 boot later, they remain DROTHERs. When R1 fails, the active BDR (R2) is automatically promoted to DR. A new election for BDR is then conducted among the remaining DROTHERs (R3, R4, and R5). R4 is ineligible because its priority is set to 0. Between R3 (priority 2) and R5 (priority 255), R5 wins the BDR election due to having the highest interface priority.

Step-by-Step Solution

1
Determine initial DR and BDR assignments during boot sequence.
R1 boots first and becomes DR. R2 boots second and becomes BDR. R3, R4, and R5 join later and become DROTHERs despite having higher priorities because OSPF elections are non-preemptive.
OSPF DR/BDR election occurs as routers come online. Once DR and BDR are elected, newly attached routers with higher priorities will not displace existing DR/BDR roles.
2
Analyze what happens to the DR role when R1 (DR) fails.
R2 (the existing BDR) is immediately promoted to DR.
Upon DR failure, the existing BDR always steps up to become the new DR to prevent election delays and instability.
3
Evaluate the new BDR election among remaining routers (R3, R4, R5).
R4 has priority 0 and is ineligible. Between R3 (priority 2) and R5 (priority 255), R5 has the highest priority and is elected as the new BDR.
An interface priority of 0 (ip ospf priority 0) disqualifies a router from DR/BDR election. Among eligible routers, highest priority wins.

Key Concept

OSPF Non-Preemptive DR/BDR Election Mechanics and Priority Rules
Estimated Time:2m 0s
Question 829Question →

A network engineer connects a Cisco Lightweight Access Point (AP) to an 802.1Q trunk interface on a Layer 2 access switch. The AP is intended to join a Wireless LAN Controller (WLC) via its management interface using untagged CAPWAP control traffic. The switch port is configured with switchport mode trunkswitchport\ mode\ trunk and switchport trunk native vlan 50switchport\ trunk\ native\ vlan\ 50. However, the AP fails to establish a CAPWAP tunnel, and syslog messages on the switch indicate native VLAN mismatch errors. CDP neighbor outputs confirm that the switch expects tagged traffic on VLAN 1 while transmitting native frames on VLAN 50. Which switchport configuration change correctly resolves the AP's management access failure while allowing untagged CAPWAP discovery traffic?

Show answer & explanation

Answer: Reconfigure the switchport native VLAN to match the untagged subnet VLAN assigned for AP management access.

Answer

Reconfiguring the switchport native VLAN to match the untagged subnet VLAN assigned for AP management access correctly resolves the management connectivity failure.
Lightweight Cisco APs transmit untagged packets for CAPWAP management discovery by default. If the switchport connected to the AP is an 802.1Q trunk, untagged traffic is placed into the trunk's configured native VLAN. When the native VLAN on the switch port does not match the actual IP subnet dedicated to AP management, the AP cannot communicate with the gateway or reach the WLC management interface. Reconfiguring the switch port's native VLAN to match the AP management subnet resolves the tagging mismatch and restores CAPWAP connectivity.

Step-by-Step Solution

1
Identify the cause of the CAPWAP discovery and management access failure.
Lightweight APs send untagged management/CAPWAP frames by default during initial discovery unless explicitly configured with a management VLAN tag.
When the connected switch port uses a native VLAN (VLAN 50) that differs from the subnet broadcast domain expecting untagged AP traffic (VLAN 1), 802.1Q native VLAN mismatch occurs and traffic drops.
2
Evaluate the switchport 802.1Q trunking behavior.
Changing the switchport native VLAN setting (switchport trunk native vlan <vlan−id>switchport\ trunk\ native\ vlan\ <vlan-id>) to match the AP's untagged management network allows untagged CAPWAP packets to enter the correct Layer 2 domain.
Matching the native VLAN on both ends of an 802.1Q trunk allows untagged AP control frames to reach the default gateway and route to the WLC management interface.

Key Concept

AP and WLC Management Switchport 802.1Q Native VLAN Alignment
Estimated Time:2m 0s
Question 830Question →

A network engineer on router R1 configures dynamic Network Address Translation using an IP pool containing two public addresses (203.0.113.1203.0.113.1 to 203.0.113.2203.0.113.2) to service the internal subnet 172.16.10.0/24172.16.10.0/24. Access Control List 10 permits traffic from 172.16.10.0/24172.16.10.0/24. The router configuration includes the statement `ip nat inside source list 10 pool NAT_POOL`. During peak operating hours, users report that after two simultaneous connections are established, all additional internal hosts fail to reach external destinations. Output from `show ip nat statistics` displays active translations at maximum pool capacity with zero port translation entries. Which configuration change will allow all internal hosts to share the public addresses concurrently?

Show answer & explanation

Answer: Append the `overload` keyword to the `ip nat inside source list 10 pool NAT_POOL` command.

Answer

Append the `overload` keyword to the `ip nat inside source list 10 pool NAT_POOL` command to enable Port Address Translation (PAT).
The command `ip nat inside source list 10 pool NAT_POOL` without the `overload` keyword performs dynamic 1-to-1 NAT mapping. With only two IP addresses in the pool, only the first two internal hosts receive translations; all subsequent translation attempts fail once the pool is exhausted. Appending the `overload` keyword activates Port Address Translation (PAT), allowing thousands of connections from internal hosts to share the pool IP addresses by tracking unique L4 transport port numbers.

Step-by-Step Solution

1
Analyze the existing NAT configuration and symptoms.
The statement `ip nat inside source list 10 pool NAT_POOL` configures standard dynamic 1-to-1 NAT. Since the pool contains only two public IP addresses (203.0.113.1203.0.113.1 and 203.0.113.2203.0.113.2), only two internal hosts can obtain translations concurrently.
Without port multiplexing, each host requires an entire public IP address, leading to pool exhaustion when a third host attempts to transmit.
2
Identify the required Cisco IOS keyword to allow port multiplexing.
The `overload` keyword enables PAT, mapping multiple private IP addresses to the same public IP address using distinct source port numbers.
Adding `overload` allows hundreds of simultaneous internal sessions to share the two pool IP addresses.

Key Concept

Port Address Translation (PAT) vs. Dynamic 1-to-1 NAT
Question 831Question →

Router R1 learns the destination prefix 172.16.10.0/24172.16.10.0/24 dynamically via OSPF with a default Administrative Distance of 110. A network administrator needs to implement a floating static route to 172.16.10.0/24172.16.10.0/24 via next-hop IP 192.168.12.2192.168.12.2 to serve as a backup path.

Which TWO statements correctly describe the configuration requirements and routing table behavior for this floating static route? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The floating static route must be configured with an Administrative Distance greater than 110 (such as 120).; The floating static route remains in R1's running configuration but is excluded from the active routing table while the primary OSPF route is active.

Answer

The floating static route must be configured with an Administrative Distance higher than the primary routing protocol (greater than 110 for OSPF), and it will remain stored in the router configuration without appearing in the routing table until the primary route fails.
A floating static route acts as a backup path and is created by manually configuring a static route with an Administrative Distance higher than that of the primary routing protocol. Since the primary route is OSPF with an AD of 110, setting the static route AD higher (e.g., 120) prevents it from being installed in the active routing table under normal operating conditions. It remains stored in the router configuration and is installed into the routing table only if the primary OSPF route disappears.

Step-by-Step Solution

1
Identify the Administrative Distance (AD) of the primary path protocol.
OSPF has a default Administrative Distance of 110.
Administrative Distance indicates the trustworthiness of the route source. Lower AD values are preferred.
2
Determine the AD required for a floating static backup route.
The AD must be set to a value strictly greater than 110 (e.g., 120 or 130).
Setting the AD higher ensures the static route is less preferred than OSPF during normal network operations.
3
Analyze how Cisco IOS processes inactive floating static routes.
The backup static route is maintained in the running configuration but omitted from the active IP routing table.
The routing table only installs the route with the lowest AD for any given destination network prefix.

Key Concept

Floating Static Route Administrative Distance Requirements
Question 832Question →

An enterprise network has four routers—R1, R2, R3, and R4—connected to a shared Layer 2 Ethernet switch on the 10.10.10.0/24 subnet operating with default OSPFv2 configurations on a broadcast network type. Currently, R1 is functioning as the Designated Router (DR) with an interface priority of 1 and Router ID 1.1.1.1. R2 is functioning as the Backup Designated Router (BDR) with an interface priority of 1 and Router ID 2.2.2.2. R3 has its interface priority set to 0 and Router ID 3.3.3.3.

A network administrator brings up a fifth router, R5, on the same Ethernet segment with a Router ID of 5.5.5.5 and executes the following commands:

text
R5(config)# interface GigabitEthernet0/0
R5(config-if)# ip ospf priority 255

After R5 establishes FULL adjacencies with the existing routers, which two statements correctly describe the resulting OSPF DR/BDR election state and operation on this segment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: R1 remains the Designated Router (DR) and R2 remains the Backup Designated Router (BDR) despite R5 having a higher priority.; R5 will become the DR only if both R1 and R2 fail or have their OSPF processes restarted.

Answer

R1 remains the DR and R2 remains the BDR due to OSPF non-preemption rules, and R5 will only assume the DR role if both current DR and BDR roles are vacated.
OSPFv2 DR and BDR elections on broadcast multiaccess networks are non-preemptive. Once R1 and R2 are elected as DR and BDR respectively, introducing a new router with a higher interface priority (R5 with priority 255) will not disrupt active roles. R5 will operate as a DROTHER until a role vacancy occurs. If R1 fails, R2 is promoted to DR, and R5 would then be elected BDR. Thus, R5 can only become DR if both active DR and BDR roles are cleared.

Step-by-Step Solution

1
Evaluate the current DR/BDR roles and preemption rules in OSPFv2.
R1 is active DR and R2 is active BDR. OSPF DR/BDR elections are non-preemptive, meaning an existing DR or BDR will not be unseated by a newly introduced router even if the new router has a higher priority (such as 255).
Non-preemption prevents network instability and topology recalculations on multiaccess segments whenever a router reboots or joins.
2
Determine the effect of adding R5 with priority 255 to the segment.
R5 joins as a DROTHER initially because both DR and BDR roles are already occupied.
Elections for DR/BDR only occur when an existing DR or BDR role becomes vacant.
3
Analyze how role transition would occur upon failure of existing routers.
If R1 (DR) fails, R2 (BDR) is immediately promoted to DR. A new election occurs for BDR, which R5 will win due to its priority of 255. For R5 to become DR directly, both R1 and R2 must fail or be reset.
BDR promotion occurs before a new BDR is elected.

Key Concept

OSPFv2 DR/BDR Election Non-Preemption and Priority 0 Rules
Question 833Question →

A network administrator is implementing Layer 2 security on VLAN 30 of a Cisco Catalyst switch. The VLAN contains both dynamic DHCP clients and devices with statically configured IP addresses. DHCP Snooping is active on VLAN 30.

To allow traffic from the static IP devices that do not exist in the DHCP snooping binding database, the administrator creates an ARP Access Control List (ACL) named `STATIC_DEVICES` matching the static MAC and IP pairs, and executes the following command:

`Switch(config)# ip arp inspection filter STATIC_DEVICES vlan 30`

Immediately after applying this command, static IP hosts communicate successfully, but all dynamic DHCP clients on VLAN 30 lose connectivity because their ARP packets are dropped by Dynamic ARP Inspection (DAI).

Which configuration modification must be made to permit ARP traffic from both static IP devices and dynamic DHCP clients?

Show answer & explanation

Answer: Re-enter the command with the `static` keyword: `ip arp inspection filter STATIC_DEVICES vlan 30 static`.

Answer

Re-entering the command with the `static` keyword (`ip arp inspection filter STATIC_DEVICES vlan 30 static`) allows unlisted ARP packets to fall back to verification against the DHCP snooping binding database.
When an ARP ACL is bound to a VLAN for Dynamic ARP Inspection without the `static` keyword, the ARP ACL becomes the sole authority for ARP validation on that VLAN. Packets that do not match an explicit entry in the ARP ACL hit the implicit `deny any` and are dropped without consulting the DHCP snooping binding database. Appending the `static` keyword (`ip arp inspection filter STATIC_DEVICES vlan 30 static`) instructs DAI to check the ARP ACL first for static hosts, and if no match is found, fall back to checking the DHCP snooping binding database for dynamic clients.

Step-by-Step Solution

1
Analyze how DAI evaluates ARP ACL filters without the `static` keyword.
When `ip arp inspection filter <acl-name> vlan <vlan>` is applied without `static`, DAI checks the specified ARP ACL exclusively. If an ARP packet does not match an explicit `permit` entry, it hits the implicit `deny` at the end of the ACL and is dropped without checking the DHCP snooping binding database.
Omitting `static` makes the ARP ACL authoritative for all ARP traffic on that VLAN.
2
Determine the effect of adding the `static` keyword to the DAI filter command.
Including the `static` keyword (`ip arp inspection filter <acl-name> vlan <vlan> static`) changes the evaluation flow: DAI checks the ARP ACL first. If no match is found in the ACL, DAI falls back to evaluating the packet against the DHCP snooping binding database.
This allows static IP devices (permitted by the ARP ACL) and dynamic DHCP clients (validated via the binding database) to coexist on the same VLAN.

Key Concept

DAI ARP ACL Filtering Mechanics and the `static` Keyword Fallback
Estimated Time:2m 0s
Question 834Question →

An administrator observes intermittent data corruption and dropped frames on interface `GigabitEthernet0/1` of an enterprise switch. Executing the `show interfaces GigabitEthernet0/1` command yields the following output:

text
GigabitEthernet0/1 is up, line protocol is up (connected)
Hardware is GigabitEthernet, address is 0012.7f3e.a101
Full-duplex, 1000Mb/s, media type is 1000BaseTX
Input queue: 0/75/0/0; Total output drops: 0
5 minute input rate 12000 bits/sec, 15 packets/sec
5 minute output rate 11000 bits/sec, 14 packets/sec
124501 packets input, 15890123 bytes
0 runts, 0 giants, 0 throttles
4812 input errors, 4812 CRC, 0 frame, 0 overrun, 0 ignored
0 output errors, 0 collisions, 0 late collision

Based on the CLI output, what is the most likely root cause of the reported interface errors?

Show answer & explanation

Answer: Physical cable damage or electromagnetic interference causing signal corruption along the Ethernet run

Answer

Physical cable damage or electromagnetic interference causing signal corruption along the Ethernet run
The correct answer identifies physical cable damage or electromagnetic interference as the root cause. In Cisco IOS, Cyclic Redundancy Check (CRC) errors increment when a received frame fails its checksum verification. When CRC errors increase while collision and late collision counters remain at zero, the cause is physical layer corruption—such as defective copper wiring, faulty RJ-45 crimping, damaged cable shielding, or external electrical noise.

Step-by-Step Solution

1
Analyze the interface status and error counters in the CLI snippet.
The interface is operating in full-duplex at 1000 Mbps with `line protocol is up`. Input errors precisely match 4,812 Cyclic Redundancy Check (CRC) errors, while collision and late collision counters remain at 0.
CRC errors occur when the frame check sequence (FCS) calculated by the receiving interface does not match the FCS field attached by the sender.
2
Evaluate potential Layer 1 vs. Layer 2 failure modes.
Because late collisions are 0 and collisions are 0, duplex mismatch and excessive cable length issues are ruled out.
Duplex mismatches cause late collisions on full-duplex interfaces and collisions/runts on half-duplex interfaces.
3
Determine the physical cause of checksum failures.
Isolated CRC errors on an Ethernet interface are directly tied to physical media defects, bad shielding, loose RJ-45 connectors, or electrical noise (EMI).
Corrupted bits during transmission alter the mathematical CRC value without triggering collision detection circuits.

Key Concept

CRC errors in Cisco IOS indicate corrupt frames received over the physical link, most commonly caused by damaged cabling, improper shielding, EMI, or loose pin connections.
Question 835Question →

A host network interface is configured with the MAC address 0011.2233.4455. When the host generates a 64-bit IPv6 interface identifier using the standard EUI-64 process, which value is created?

Show answer & explanation

Answer: 0211:22FF:FE33:4455

Answer

The interface identifier created using EUI-64 is 0211:22FF:FE33:4455.
The correct answer properly demonstrates both required steps of the EUI-64 derivation: inserting the 16-bit hexadecimal sequence FFFE into the middle of the 48-bit MAC address and inverting the 7th bit (Universal/Local bit) of the first byte from 0 to 1 (changing 0x00 to 0x02).

Step-by-Step Solution

1
Split the 48-bit MAC address into two 24-bit halves.
Left half: 00-11-22, Right half: 33-44-55
EUI-64 requires inserting a 16-bit hexadecimal marker in the middle of the MAC address.
2
Insert hexadecimal FFFE into the middle between the two halves.
00-11-22-FF-FE-33-44-55
The EUI-64 standard specifies FFFE as the constant padding value to expand a 48-bit MAC address to 64 bits.
3
Invert the 7th bit (Universal/Local bit) of the first byte.
First byte 00 (00000000 in binary) becomes 02 (00000010 in binary). Combining and formatting into IPv6 hex quads produces 0211:22FF:FE33:4455.
Inverting the 7th bit changes the scope from globally unique (0) to locally managed (1) for EUI-64 derived addresses.

Key Concept

EUI-64 Interface ID Generation
Question 836Question →

A network engineer is configuring an interface on a Cisco router servicing an internal LAN segment. The interface is assigned the IPv4 address 192.168.1.37192.168.1.37 with a subnet mask of 255.255.255.240255.255.255.240 (/28/28). Which IPv4 address represents the broadcast address for this subnetwork?

Show answer & explanation

Answer: 192.168.1.47192.168.1.47

Answer

192.168.1.47192.168.1.47
The subnet mask 255.255.255.240255.255.255.240 (/28/28) provides a block size of 16 addresses per subnet. Multiples of 16 in the 4th octet yield network addresses of 192.168.1.0192.168.1.0, 192.168.1.16192.168.1.16, 192.168.1.32192.168.1.32, and 192.168.1.48192.168.1.48. The host 192.168.1.37192.168.1.37 resides in the 192.168.1.32/28192.168.1.32/28 subnet, making 192.168.1.47192.168.1.47 the broadcast address.

Step-by-Step Solution

1
Determine the block size from the subnet mask.
A subnet mask of 255.255.255.240255.255.255.240 corresponds to a /28/28 prefix, leaving 32−28=432 - 28 = 4 host bits. The block size is 24=162^4 = 16.
Calculating the block size defines the increment between subnetwork boundaries.
2
Identify the network boundary for IP address 192.168.1.37192.168.1.37.
Subnet multiples of 16 in the 4th octet are 0, 16, 32, 48. Since 37 falls between 32 and 47, the subnetwork ID is 192.168.1.32192.168.1.32.
The network address is the lowest boundary address for the subnet.
3
Calculate the broadcast address for the subnet.
The broadcast address is one less than the next network address (192.168.1.48−1=192.168.1.47192.168.1.48 - 1 = 192.168.1.47).
The broadcast address is the highest address in the block with all host bits set to 1.

Key Concept

IPv4 Subnet Masking and Broadcast Address Calculation
Estimated Time:1m 0s
Question 837Question →

Network administrators use Layer 2 discovery protocols to discover adjacent network hardware and verify topology details. Match each Layer 2 discovery protocol attribute on the left with its corresponding protocol characteristic or default value on the right.

Click a left item, then click its matching right item

Items

IEEE 802.1AB
Cisco Proprietary Discovery Protocol
Default CDP Holdtime
Default LLDP Holdtime

Matches

Show answer & explanation

Answer

IEEE 802.1AB matches Open vendor-neutral standard for Link Layer Discovery Protocol (LLDP); Cisco Proprietary Discovery Protocol matches Cisco Discovery Protocol (CDP); Default CDP Holdtime matches 180 seconds; Default LLDP Holdtime matches 120 seconds.
IEEE 802.1AB is the formal standard specification for LLDP. CDP is Cisco's proprietary discovery protocol. CDP defaults to an update timer of 60 seconds and a holdtime of 180 seconds, while LLDP defaults to a transmit timer of 30 seconds and a holdtime of 120 seconds.

Step-by-Step Solution

1
Identify the standard governing LLDP.
LLDP is defined under IEEE 802.1AB.
IEEE 802.1AB provides an open standard for neighbor discovery across multi-vendor equipment.
2
Identify the ownership model of CDP.
CDP is Cisco proprietary.
CDP was created by Cisco to allow Cisco switches, routers, and devices to discover each other.
3
Calculate or recall the default CDP holdtime.
The CDP holdtime defaults to 180 seconds.
CDP transmits messages every 60 seconds, and the default holdtime is set to 3 update intervals (180 seconds).
4
Calculate or recall the default LLDP holdtime.
The LLDP holdtime defaults to 120 seconds.
LLDP uses a default transmit timer of 30 seconds with a default holdtime multiplier of 4, producing a 120-second holdtime.

Key Concept

Distinguishing characteristics, standards, and default timers of CDP and LLDP.
Question 838Question →

An administrator is configuring a trunk link between Switch-1 and Switch-2. On Switch-1 interface GigabitEthernet0/1, the engineer executes the following configuration commands:

Switch-1(config-if)# switchport mode trunk
Switch-1(config-if)# switchport trunk native vlan 20
Switch-1(config-if)# switchport trunk allowed vlan 10,30,40

Assuming Switch-2 has default 802.1Q trunk configurations with native VLAN 20 allowed, how will Switch-1 process frame forwarding for VLAN 20 traffic egressing interface GigabitEthernet0/1?

Show answer & explanation

Answer: Switch-1 drops frames originating from VLAN 20 because VLAN 20 is not included in the interface allowed VLAN list.

Answer

Switch-1 drops frames originating from VLAN 20 because VLAN 20 is explicitly excluded from the trunk's allowed VLAN list.
The correct answer identifies that Switch-1 drops frames originating from VLAN 20. When the command 'switchport trunk allowed vlan' is used with an explicit parameter list, only traffic for the listed VLANs (10, 30, 40) is permitted across the trunk link. Because VLAN 20 is not in this list, its traffic is pruned and dropped at ingress/egress, even though it is configured as the native VLAN.

Step-by-Step Solution

1
Analyze the configuration command 'switchport trunk allowed vlan 10,30,40'.
The allowed VLAN list for interface GigabitEthernet0/1 is set exclusively to VLANs 10, 30, and 40.
Explicitly specifying allowed VLAN numbers replaces the default 'all' list with only the specified VLAN IDs.
2
Evaluate the status of native VLAN 20 against the allowed VLAN list.
VLAN 20 is configured as native, but it is absent from the allowed list (10, 30, 40).
For a native VLAN's traffic to transit an 802.1Q trunk link, it must be included in the port's allowed VLAN list.
3
Determine the forwarding behavior for egress VLAN 20 frames on Switch-1.
Switch-1 drops egress frames belonging to VLAN 20.
Trunk interfaces filter out (prune) any frames belonging to VLANs not present in the allowed list, regardless of native VLAN designation.

Key Concept

802.1Q Trunk Allowed VLAN Filtering Logic
Question 839Question →

During an operational review of network infrastructure policies across an enterprise gateway router, a network specialist is defining classification parameters for transport layer protocols. Which two statements accurately describe the architectural characteristics and operational mechanics of the User Datagram Protocol (UDP) compared to Transmission Control Protocol (TCP)? (Select two.)

Select all that apply

Show answer & explanation

Answer: UDP operates as a connectionless protocol that avoids state maintenance and establishment handshakes prior to transmitting data.; UDP utilizes a fixed 8-byte header field structure that lacks sequence numbering and receiver window fields.

Answer

The correct statements are that UDP operates as a connectionless protocol without maintaining connection state, and that UDP utilizes a compact fixed 8-byte header that excludes sequence numbers and windowing controls.
The statements confirming UDP's connectionless operation and its fixed 8-byte header without sequence or window fields are correct. UDP avoids pre-transmission handshakes to reduce latency and maintains minimal protocol overhead by using an 8-byte header consisting solely of Source Port, Destination Port, Length, and Checksum.

Step-by-Step Solution

1
Analyze transport layer connection initialization characteristics for UDP.
UDP is connectionless, requiring no initial three-way handshake (SYN, SYN-ACK, ACK) or state table allocation on network interfaces.
Connecting endpoints can immediately send datagrams without setup delay.
2
Examine the transport header structure of UDP versus TCP.
A standard UDP header consists of 4 fields (Source Port, Destination Port, Length, Checksum) totaling 8 bytes, whereas TCP headers are at least 20 bytes long and include Sequence Number, Acknowledgment Number, Window Size, and Control Flags.
Lacking sequence numbers and windowing fields keeps the UDP header minimal.
3
Evaluate transport-layer reliability and flow control features in UDP.
UDP offers best-effort delivery without built-in segment retransmission, sequencing, or windowing flow control mechanisms.
Protocol mechanisms like retransmission and dynamic sliding windows belong to TCP.

Key Concept

UDP vs TCP Transport Protocol Characteristics and Header Comparison
Question 840Question →

A network administrator is assigning a private IPv4 host address within the 172.16.0.0/12172.16.0.0/12 range for a branch office subnet defined as 172.30.50.16/28172.30.50.16/28. Which IPv4 address is a valid usable host address for a device in this subnet?

Show answer & explanation

Answer: 172.30.50.25172.30.50.25

Answer

The address 172.30.50.25172.30.50.25 is a valid usable host IPv4 address within the 172.30.50.16/28172.30.50.16/28 subnet.
The subnet 172.30.50.16/28172.30.50.16/28 has a block size of 1616 addresses (242^4), covering 172.30.50.16172.30.50.16 through 172.30.50.31172.30.50.31. Subtracting the network address (172.30.50.16172.30.50.16) and broadcast address (172.30.50.31172.30.50.31) leaves a usable host range of 172.30.50.17172.30.50.17 to 172.30.50.30172.30.50.30. The address 172.30.50.25172.30.50.25 lies within this valid host range and is within the RFC 1918 private block (172.16.0.0/12172.16.0.0/12).

Step-by-Step Solution

1
Determine the network properties for 172.30.50.16/28172.30.50.16/28.
A /28/28 subnet mask has 32−28=432 - 28 = 4 host bits, yielding a block size of 24=162^4 = 16.
The block size dictates the increment between subnets.
2
Identify the network address, broadcast address, and usable host range.
Network Address: 172.30.50.16172.30.50.16; Broadcast Address: 172.30.50.31172.30.50.31; Usable Host Range: 172.30.50.17172.30.50.17 to 172.30.50.30172.30.50.30.
The network address is the first address in the block, and the broadcast address is the last address in the block.
3
Verify RFC 1918 private address range compliance and match against options.
The range 172.16.0.0/12172.16.0.0/12 spans 172.16.0.0172.16.0.0 to 172.31.255.255172.31.255.255. The address 172.30.50.25172.30.50.25 is both within the RFC 1918 block and within the usable host range 172.30.50.17172.30.50.17 - 172.30.50.30172.30.50.30.
Only valid usable host addresses within the private range can be assigned to host interfaces.

Key Concept

IPv4 Subnet Boundaries and RFC 1918 Private Addressing
PreviousPage 42 / 100Next
All practice questions — Cisco CCNA | Examkin