Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 861Question →

A network technician observes high counts of late collisions and Frame Check Sequence (FCS) errors on a switch interface connected to a server. A CLI check shows the interface output below:

text
FastEthernet0/1 is up, line protocol is up (connected)
Full-duplex, 100Mb/s, media type is 100BaseTX
542 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
1243 output errors, 891 late collisions

Which physical or data-link issue is the most likely cause of these interface error statistics?

Show answer & explanation

Answer: A duplex mismatch between the switch interface and the connected device

Answer

A duplex mismatch between the switch interface and the connected device is the primary cause of late collisions and FCS errors.
A duplex mismatch occurs when one end of an Ethernet link operates in full-duplex while the opposite end operates in half-duplex. The full-duplex device transmits data whenever ready without checking for carrier activity. When the half-duplex device is transmitting and receives data from the full-duplex device after sending its initial 64 bytes, it records a late collision.

Step-by-Step Solution

1
Analyze the interface error counters in the CLI output.
Identified high late collisions and output errors on an operational (up/up) link.
Late collisions occur when a collision is detected after the first 64 bytes (512 bits) of a frame have been transmitted.
2
Correlate late collision symptoms with duplex settings.
Determined that one end is operating in full-duplex while the remote end is operating in half-duplex.
The full-duplex end sends traffic without listening for carrier sense, causing the half-duplex end to transmit simultaneously and register late collisions.

Key Concept

Duplex Mismatch Symptoms and Interface Error Counters
Question 862Question →

An administrator is configuring an interswitch trunk link between Switch-A and Switch-B using GigabitEthernet0/1 on both switches. The current running configurations are as follows:

Switch-A:
text
interface GigabitEthernet0/1
switchport mode dynamic desirable
switchport trunk native vlan 20
switchport trunk allowed vlan 10,20,30

Switch-B:
text
interface GigabitEthernet0/1
switchport mode dynamic auto
switchport trunk native vlan 10
switchport trunk allowed vlan 10,20,30

Based on these configuration state parameters, which operational behavior will occur on this interswitch connection?

Show answer & explanation

Answer: The link successfully negotiates 802.1Q trunking, but CDP reports a native VLAN mismatch and untagged frame traffic from Switch-A VLAN 20 is processed on Switch-B in VLAN 10.

Answer

The link successfully negotiates 802.1Q trunking, but CDP reports a native VLAN mismatch and untagged frame traffic from Switch-A VLAN 20 is processed on Switch-B in VLAN 10.
The combination of 'dynamic desirable' on Switch-A and 'dynamic auto' on Switch-B allows DTP to successfully form an 802.1Q trunk link. Because Switch-A has configured native VLAN 20 and Switch-B has configured native VLAN 10, untagged traffic transmitted by Switch-A for VLAN 20 is interpreted as VLAN 10 by Switch-B upon arrival. CDP routinely verifies native VLAN settings via TLVs and generates continuous native VLAN mismatch alert messages in the console system log.

Step-by-Step Solution

1
Analyze Dynamic Trunking Protocol (DTP) negotiation mode compatibility.
Switch-A uses 'dynamic desirable' (actively attempts to negotiate a trunk) and Switch-B uses 'dynamic auto' (responds to trunk negotiation requests). The operational state of the link becomes an 802.1Q trunk.
Matching dynamic desirable with dynamic auto results in successful trunk establishment.
2
Evaluate native VLAN tagging behavior and traffic path across the trunk.
Switch-A sends VLAN 20 frames untagged over the 802.1Q trunk. Switch-B receives these untagged frames and assigns them to its configured native VLAN, which is VLAN 10.
802.1Q native VLAN traffic is transmitted without a VLAN header tag. The receiving switch places all untagged traffic into its configured native VLAN.
3
Determine Layer 2 discovery protocol and management alert impacts.
Cisco Discovery Protocol (CDP) exchanges neighbor capabilities and detects configured native VLAN 20 on Switch-A versus native VLAN 10 on Switch-B, triggering `%CDP-4-NATIVE_VLAN_MISMATCH` console error messages.
CDP carries native VLAN TLVs to detect trunk configuration inconsistencies across directly connected neighbors.

Key Concept

802.1Q Interswitch Trunking Negotiation and Native VLAN Mismatch Dynamics
Estimated Time:2m 30s
Question 863Question →

An engineer is troubleshooting severe frame corruption and packet drops on a GigabitEthernet connection between a Catalyst switch and an enterprise router. Both interfaces are explicitly configured for 1000Mb/s Full-duplex. The CLI output from the switch is shown below:

text
GigabitEthernet0/1 is up, line protocol is up
Hardware is Gigabit Ethernet, address is 5006.ab12.cd34 (bia 5006.ab12.cd34)
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
5 minute input rate 452000 bits/sec, 510 packets/sec
5 minute output rate 489000 bits/sec, 540 packets/sec
1245012 packets input, 1084201948 bytes, 0 no buffer
0 runts, 0 giants, 0 throttles
14205 input errors, 14205 CRC, 0 frame, 0 overrun, 0 ignored
1589022 packets output, 1482910244 bytes, 0 underruns
0 output errors, 0 collisions, 0 interface resets

Physical inspection reveals that a custom UTP patch cable was wired using non-standard pin pairings where pins 3 and 6 were split across different wire pairs instead of sharing a single twisted pair. Which physical or data link issue is directly responsible for the high number of CRC errors observed on this full-duplex interface?

Show answer & explanation

Answer: Severe near-end crosstalk (NEXT) and electromagnetic interference caused by the split-pair Ethernet cable pinout mismatch.

Answer

Severe near-end crosstalk (NEXT) and electromagnetic interference caused by the split-pair Ethernet cable pinout mismatch.
The correct answer identifies signal degradation and crosstalk resulting from split-pair cabling as the root cause of the CRC errors. Twisted-pair Ethernet (such as 1000BASE-T) relies on differential signaling across twisted pairs to neutralize electromagnetic interference. Splitting pins 3 and 6 across separate pairs destroys signal cancellation, producing high rates of Near-End Crosstalk (NEXT). When frames arrive corrupted, the receiving NIC's Frame Check Sequence (FCS) calculation fails, incrementing the CRC input error counter while collision counters remain zero due to full-duplex operation.

Step-by-Step Solution

1
Analyze the interface statistics from the 'show interfaces' CLI snippet.
The interface is operating in Full-duplex at 1000Mb/s with line protocol up. There are 14,205 input errors, all of which are specifically CRC errors, while collision counts are 0.
Full-duplex interfaces disable collision detection mechanisms because transmission and reception occur over separate dedicated pairs. Therefore, collisions are not expected.
2
Evaluate the physical cabling scenario described in the stem.
The custom cable has split pairs across pins 3 and 6 (transmitting signals over wires from different twisted pairs).
Twisted pair cabling relies on balanced differential signaling to cancel out noise and crosstalk. When a pair is split, differential cancellation fails, creating massive Near-End Crosstalk (NEXT).
3
Correlate physical layer noise with interface error counters.
NEXT corrupts electrical signals during transit, causing the receiving interface to compute a Frame Check Sequence (FCS) that does not match the trailer, generating CRC errors.
CRC errors without collisions or late collisions on a full-duplex link are a classic sign of Layer 1 physical medium defects, such as cable damage or pinout/twist errors.

Key Concept

Twisted Pair Cable Pinout Mechanics & Interface Error Counter Diagnosis
Estimated Time:2m 0s
Question 864Question →

A network administrator is troubleshooting poor network performance on a switch interface connected to an end host. Executing the `show interfaces GigabitEthernet0/1` command produces the following output:

text
GigabitEthernet0/1 is up, line protocol is up
Hardware is Gigabit Ethernet, address is 0011.bb22.c334 (bia 0011.bb22.c334)
MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Half-duplex, 100Mb/s, media type is 10/100/1000BaseTX
input flow-control is off, output flow-control is off
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:02, output 00:00:00, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
5 minute input rate 32000 bits/sec, 24 packets/sec
5 minute output rate 98000 bits/sec, 65 packets/sec
521405 packets input, 68102948 bytes, 0 no buffer
Received 410 broadcasts (0 IP multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 0 multicast, 0 pause input
841920 packets output, 110482012 bytes, 0 underruns
2415 output errors, 2415 collisions, 582 late collisions, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output

Based on the CLI output, which of the following is the most likely cause of the interface performance degradation?

Show answer & explanation

Answer: A duplex mismatch between the switch port operating in half-duplex and the connected host operating in full-duplex.

Answer

A duplex mismatch between the switch interface operating in half-duplex and the connected end host operating in full-duplex is the primary cause of the late collisions and output errors.
Late collisions occur when a collision is detected after an interface has transmitted the first 64 bytes of a frame. In Ethernet networks, late collisions are most commonly caused by a duplex mismatch (where the local side is set to half-duplex and the remote side is set to full-duplex) or by cable length exceeding standard IEEE specifications. Because the remote full-duplex side does not listen before transmitting, it can send frames while the half-duplex side is mid-transmission, resulting in late collisions on the half-duplex interface.

Step-by-Step Solution

1
Analyze the operational status and duplex setting from the show interfaces output.
The interface is operating in 'up/up' state at 100Mb/s Half-duplex.
Verifies physical connectivity and operational mode of the local switch interface.
2
Examine the interface error counters.
Output error counters show 2415 output errors, 2415 collisions, and 582 late collisions.
Identifies specific Layer 1/2 error metrics that indicate frame transmission anomalies.
3
Correlate late collision counters with network operational characteristics.
Late collisions occur when a collision is detected after the first 64 bytes (512 bits) of a frame have been transmitted.
Standard collisions are expected in normal half-duplex operation within the slot time, but late collisions strongly indicate a duplex mismatch where one end is configured for full-duplex and sends data regardless of carrier sense.

Key Concept

Duplex Mismatch Troubleshooting and Collision Counters
Estimated Time:1m 30s
Question 865Question →

A network engineer is conducting an IP addressing audit for an enterprise network. The organization requires all internal hosts to utilize private IPv4 addresses specified in RFC 1918 to ensure proper isolated routing and avoid packet delivery issues across the public Internet. Which IPv4 address assignment contains a globally routable public IPv4 address rather than a valid RFC 1918 private address?

Show answer & explanation

Answer: 172.32.15.1/24 assigned to an internal host interface

Answer

172.32.15.1/24 assigned to an internal host interface is a globally routable public address because it falls outside the RFC 1918 Class B allocation (172.16.0.0 - 172.31.255.255).
The address starting with 172.32.15.1 is a public IPv4 address because the RFC 1918 Class B private address allocation only spans from 172.16.0.0 to 172.31.255.255 (a /12 prefix). Any address with a first octet of 172 and a second octet greater than 31 or less than 16 is a public, globally routable IP address.

Step-by-Step Solution

1
Recall the three designated RFC 1918 private IPv4 address ranges.
The reserved private ranges are: 10.0.0.0/8 (10.0.0.0 – 10.255.255.255), 172.16.0.0/12 (172.16.0.0 – 172.31.255.255), and 192.168.0.0/16 (192.168.0.0 – 192.168.255.255).
Establishing accurate address boundaries is mandatory to distinguish non-routable private IPs from public IPs.
2
Evaluate the second octet of the Class B address candidate 172.32.15.1.
The second octet is 32, which exceeds the upper bound of 31 for the 172.16.0.0/12 private prefix block.
The /12 prefix length covers second octet values from 16 to 31 inclusive (binary 00010000 to 00011111).
3
Verify that all other candidate addresses fall strictly within RFC 1918 boundaries.
172.31.255.254 is within 172.16.0.0/12; 192.168.254.1 is within 192.168.0.0/16; 10.255.1.1 is within 10.0.0.0/8.
Confirming the validity of remaining options isolates the public address misconfiguration.

Key Concept

RFC 1918 Private IPv4 Address Space Boundaries
Question 866Question →

An enterprise network administrator is deploying Cisco Lightweight Access Points (LAPs) across various branch offices and corporate facilities. Match each Cisco AP operational mode on the left with its correct functional description on the right.

Click a left item, then click its matching right item

Items

Monitor Mode
Sniffer Mode
Rogue Detector Mode
FlexConnect Mode

Matches

Show answer & explanation

Answer

Monitor Mode pairs with the description detailing dedicated RF scanning for rogues, CleanAir, and IDS without client associations. Sniffer Mode pairs with capturing raw 802.11 frames on a specified channel for forwarding to a packet analyzer. Rogue Detector Mode pairs with listening to wired ARP traffic to correlate MAC addresses against rogue lists. FlexConnect Mode pairs with local traffic switching for remote branch APs.
Each access point operational mode serves a targeted operational purpose within Cisco wireless architecture: Monitor mode focuses purely on RF scanning and security metrics without serving clients; Sniffer mode performs targeted 802.11 packet capture; Rogue Detector operates on the wired network to validate rogue device connections; and FlexConnect facilitates local switching for remote site deployment efficiency.

Step-by-Step Solution

1
Analyze non-client-serving specialized scanning modes
Identify that Monitor mode dedicates its radios to RF environment scanning, CleanAir, and security detection without accepting client connections.
Monitor mode APs do not transmit SSIDs or process client associations.
2
Differentiate packet capture functionality
Map Sniffer mode to over-the-air packet capture sent directly to an external analyzer tool.
Sniffer mode requires setting a target channel and destination IP address for packet stream monitoring.
3
Identify wired-side rogue mitigation roles
Associate Rogue Detector mode with monitoring wired ARP broadcasts.
Rogue Detector APs turn off their wireless radios and connect directly to switch trunk ports to monitor layer 2 broadcasts.
4
Evaluate branch architecture survivability mode
Match FlexConnect mode with local data switching capabilities.
FlexConnect allows client traffic to bypass the CAPWAP data tunnel across the WAN while maintaining central controller management.

Key Concept

Cisco Lightweight Access Point Operational Modes
Question 867Question →

Match each RFC 1918 private IPv4 address range to its defined default CIDR block and maximum number of usable host addresses.

Click a left item, then click its matching right item

Items

10.0.0.0 to 10.255.255.255
172.16.0.0 to 172.31.255.255
192.168.0.0 to 192.168.255.255

Matches

Show answer & explanation

Answer

10.0.0.0 to 10.255.255.255 matches the /8 CIDR block (16,777,21416,777,214 usable hosts); 172.16.0.0 to 172.31.255.255 matches the /12 CIDR block (1,048,5741,048,574 usable hosts); 192.168.0.0 to 192.168.255.255 matches the /16 CIDR block (65,53465,534 usable hosts).
Under RFC 1918, the three private IPv4 address allocations have distinct prefix masks and sizes: 10.0.0.0/8 provides a single large block with 24 host bits (16,777,21416,777,214 usable hosts); 172.16.0.0/12 encompasses 16 Class B ranges spanning 172.16.0.0 through 172.31.255.255 with 20 host bits (1,048,5741,048,574 usable hosts); and 192.168.0.0/16 encompasses 256 Class C ranges spanning 192.168.0.0 through 192.168.255.255 with 16 host bits (65,53465,534 usable hosts).

Step-by-Step Solution

1
Analyze the 10.0.0.0/8 Class A private block
The range 10.0.0.0 to 10.255.255.255 reserves 24 host bits (32−8=2432 - 8 = 24).
Calculating usable host count yields 224−2=16,777,2142^{24} - 2 = 16,777,214 addresses.
2
Analyze the 172.16.0.0/12 Class B private block
The range 172.16.0.0 to 172.31.255.255 spans from second octet 16 to 31, reserving 20 host bits (32−12=2032 - 12 = 20).
Calculating usable host count yields 220−2=1,048,5742^{20} - 2 = 1,048,574 addresses.
3
Analyze the 192.168.0.0/16 Class C private block
The range 192.168.0.0 to 192.168.255.255 reserves 16 host bits (32−16=1632 - 16 = 16).
Calculating usable host count yields 216−2=65,5342^{16} - 2 = 65,534 addresses.

Key Concept

RFC 1918 Private IPv4 Address Allocation and CIDR Prefix Boundaries
Question 868Question →

In an IEEE 802.1Q trunk link between two Cisco switches, how is traffic belonging to the native VLAN transmitted across the link by default?

Show answer & explanation

Answer: It is transmitted as untagged frames without an 802.1Q header.

Answer

Traffic belonging to the native VLAN is transmitted as untagged frames without an 802.1Q header by default.
By default, IEEE 802.1Q trunking transmits frames belonging to the native VLAN across the link without inserting an 802.1Q VLAN header tag. When the receiving switch accepts untagged frames on a trunk port, it automatically places them into its configured native VLAN.

Step-by-Step Solution

1
Identify the standard frame handling behavior of IEEE 802.1Q trunking.
IEEE 802.1Q inserts a 4-byte tag field into Ethernet frames for standard tagged VLANs to preserve VLAN identification across switch interconnects.
Tagging allows switches to multiplex multiple VLANs over a single physical link.
2
Apply the native VLAN exception rule.
Frames associated with the native VLAN are sent across the trunk link completely untagged without modifying the original frame header.
This behavior maintains backward compatibility with legacy devices or unmanaged switches that do not process 802.1Q tags.

Key Concept

802.1Q Native VLAN Untagged Behavior
Estimated Time:45s
Question 869Question →

A network engineer needs to deploy a security device at the enterprise perimeter that inspects packet headers and payloads, maintains connection state tables, and enforces security policies to permit or deny traffic. Which network component fulfills this specific role?

Show answer & explanation

Answer: Stateful Firewall

Answer

Stateful Firewall
A stateful firewall is specifically designed to enforce perimeter security by monitoring active connection states and comparing incoming and outgoing traffic against access rules.

Step-by-Step Solution

1
Identify the primary requirement in the scenario
The scenario calls for inspecting traffic, maintaining connection state tables, and enforcing security policies.
Security policies and state tracking are defining characteristics of network security devices.
2
Match the functional requirements to network component roles
A stateful firewall continuously tracks session states (such as TCP handshakes) and applies security rules to filter traffic at the network edge.
Switches, hypervisors, and discovery protocols perform forwarding, virtualization, and management neighbor identification respectively, rather than stateful security enforcement.

Key Concept

Network Component Roles - Firewall Functionality
Estimated Time:45s
Question 870Question →

Match each enterprise infrastructure network component on the left with its primary operational function on the right.

Click a left item, then click its matching right item

Items

Next-Generation Firewall (NGFW)
Wireless LAN Controller (WLC)
Layer 3 Switch
Type 1 Hypervisor

Matches

Show answer & explanation

Answer

Next-Generation Firewall matches stateful packet inspection, application-level filtering, and threat prevention; Wireless LAN Controller matches centralized access point provisioning, RF management, and wireless security policies; Layer 3 Switch matches hardware-based inter-VLAN routing using ASICs alongside L2 switching; Type 1 Hypervisor matches direct bare-metal hardware abstraction for virtual machines.
Each network component is matched accurately based on its structural plane and operational responsibility in modern enterprise architectures: NGFWs enforce security policies and application filtering, WLCs centralize wireless infrastructure control, Layer 3 switches provide ASIC-driven inter-VLAN routing, and Type 1 hypervisors provide bare-metal compute virtualization.

Step-by-Step Solution

1
Analyze the primary role of Next-Generation Firewalls (NGFW).
Identify that NGFWs operate at boundary points to enforce application-aware filtering, intrusion prevention, and stateful security inspection.
NGFWs extend classic firewall capabilities by inspecting traffic through Layer 7 application control and integrated security features.
2
Analyze the primary role of Wireless LAN Controllers (WLC).
Identify that WLCs handle centralized control-plane tasks for wireless access points across an enterprise campus.
WLCs aggregate AP management, radio resource management (RRM), and wireless security policy enforcement into a single architecture.
3
Analyze the primary role of Layer 3 Switches.
Identify that Layer 3 switches bridge VLANs and forward traffic between IP subnets using specialized Application-Specific Integrated Circuits (ASICs).
Layer 3 switches perform high-performance inter-VLAN routing in hardware while maintaining standard Layer 2 MAC table forwarding.
4
Analyze the primary role of Type 1 Hypervisors.
Identify that Type 1 hypervisors execute bare-metal virtualization directly on the host hardware platform.
Unlike Type 2 hypervisors which run on top of an existing OS, Type 1 hypervisors interface directly with physical server resources to host guest VMs.

Key Concept

Enterprise Network Component Roles and Functions
Question 871Question →

Match each RFC 1918 private IPv4 address block to its designated default CIDR prefix length.

Click a left item, then click its matching right item

Items

10.0.0.0 to 10.255.255.255
172.16.0.0 to 172.31.255.255
192.168.0.0 to 192.168.255.255

Matches

Show answer & explanation

Answer

10.0.0.0 to 10.255.255.255 matches /8, 172.16.0.0 to 172.31.255.255 matches /12, and 192.168.0.0 to 192.168.255.255 matches /16.
RFC 1918 specifies three private address blocks for enterprise networks: 10.0.0.0/8 (10.0.0.0 – 10.255.255.255), 172.16.0.0/12 (172.16.0.0 – 172.31.255.255), and 192.168.0.0/16 (192.168.0.0 – 192.168.255.255).

Step-by-Step Solution

1
Identify the prefix length for the 10.0.0.0/8 address block.
The range 10.0.0.0 – 10.255.255.255 uses a /8 prefix length.
RFC 1918 defines the 10.0.0.0 network as a single Class A range with 8 network bits.
2
Identify the prefix length for the 172.16.0.0 address block.
The range 172.16.0.0 – 172.31.255.255 uses a /12 prefix length.
RFC 1918 allocates a set of 16 Class B networks from 172.16.0.0 through 172.31.255.255, aggregating to a /12 prefix length.
3
Identify the prefix length for the 192.168.0.0 address block.
The range 192.168.0.0 – 192.168.255.255 uses a /16 prefix length.
RFC 1918 allocates a set of 256 Class C networks from 192.168.0.0 through 192.168.255.255, aggregating to a /16 prefix length.

Key Concept

RFC 1918 Private IPv4 Address Ranges
Question 872Question →

In a Cisco Wireless LAN Controller (WLC) architecture, Access Points (APs) can be configured in distinct operational modes to fulfill specialized roles. Match each AP operational mode on the left with its corresponding functional behavior on the right.

Click a left item, then click its matching right item

Items

Monitor Mode
FlexConnect Mode
Sniffer Mode
Rogue Detector Mode

Matches

Show answer & explanation

Answer

Monitor Mode matches dedicated WIPS scanning and location tracking without client servicing; FlexConnect Mode matches local traffic switching and WAN fault tolerance for branch sites; Sniffer Mode matches raw 802.11 frame capture streaming for packet analysis; Rogue Detector Mode matches correlating airborne rogue MACs with wired infrastructure tables.
Each access point operational mode is matched directly to its primary role: Monitor mode provides non-client-serving WIPS scanning and location tracking; FlexConnect mode provides branch-office WAN fault tolerance and local traffic bridging; Sniffer mode provides remote 802.11 raw packet capture to a workstation; Rogue Detector mode links wireless rogue observations to wired network MAC tables.

Step-by-Step Solution

1
Identify the primary function of Monitor Mode.
Monitor mode APs refrain from serving wireless clients and focus exclusively on security scanning, rogue detection, and location tracking.
Monitor mode is tailored for continuous over-the-air environmental sensing.
2
Determine the operational characteristics of FlexConnect Mode.
FlexConnect allows local bridging of client traffic and local authentication fallback during WAN disruptions.
FlexConnect optimizes branch office deployments by preventing client data from requiring central CAPWAP encapsulation over limited WAN bandwidth.
3
Examine Sniffer Mode functionality.
Sniffer mode functions as a remote wireless packet probe, redirecting channel frame captures to a Wireshark workstation.
This allows deep-packet inspection on targeted RF channels without requiring specialized physical sniffer hardware on site.
4
Analyze Rogue Detector Mode.
Rogue Detector mode checks whether a rogue wireless device seen over the air is physically connected to the internal wired switch network.
It compares learned wired layer-2 MAC address tables with over-the-air rogue MAC lists.

Key Concept

Cisco Access Point Operational Modes
Estimated Time:2m 0s
Question 873Question →

A network security architect is auditing perimeter firewalls and IP addressing schemes across a enterprise topology. Match each IPv4 address specification to its corresponding RFC 1918 compliance status and public Internet routing behavior.

Click a left item, then click its matching right item

Items

172.31.255.254/28172.31.255.254/28
172.32.0.1/16172.32.0.1/16
192.168.255.254/31192.168.255.254/31
192.169.1.1/24192.169.1.1/24

Matches

Show answer & explanation

Answer

The correct pairings match 172.31.255.254/28172.31.255.254/28 to the private 172.16.0.0/12172.16.0.0/12 scope description, 172.32.0.1/16172.32.0.1/16 to the public space directly above 172.31.255.255172.31.255.255, 192.168.255.254/31192.168.255.254/31 to the private 192.168.0.0/16192.168.0.0/16 point-to-point scope description, and 192.169.1.1/24192.169.1.1/24 to the public space directly above 192.168.255.255192.168.255.255.
Each IP address is accurately mapped according to RFC 1918 boundaries: 172.31.255.254172.31.255.254 is private (172.16.0.0/12172.16.0.0/12), 172.32.0.1172.32.0.1 is public space immediately above 172.31.255.255172.31.255.255, 192.168.255.254192.168.255.254 is private (192.168.0.0/16192.168.0.0/16), and 192.169.1.1192.169.1.1 is public space immediately above 192.168.255.255192.168.255.255.

Step-by-Step Solution

1
Evaluate RFC 1918 address ranges and boundary limits.
The three RFC 1918 private address ranges are 10.0.0.0/810.0.0.0/8 (10.0.0.0−10.255.255.25510.0.0.0 - 10.255.255.255), 172.16.0.0/12172.16.0.0/12 (172.16.0.0−172.31.255.255172.16.0.0 - 172.31.255.255), and 192.168.0.0/16192.168.0.0/16 (192.168.0.0−192.168.255.255192.168.0.0 - 192.168.255.255).
Establishing accurate lower and upper boundary IP addresses is necessary to distinguish private from public IPv4 space.
2
Analyze 172.31.255.254/28172.31.255.254/28 and 172.32.0.1/16172.32.0.1/16.
172.31.255.254172.31.255.254 is the second-to-last address within 172.16.0.0/12172.16.0.0/12, making it private and non-routable. 172.32.0.1172.32.0.1 exceeds 172.31.255.255172.31.255.255, making it a public IP address.
Common misidentifications mistake 172.32.0.0/16172.32.0.0/16 for private space by assuming all 172.x.x.x172.x.x.x addresses are private, whereas only 172.16.0.0172.16.0.0 through 172.31.255.255172.31.255.255 are reserved by RFC 1918.
3
Analyze 192.168.255.254/31192.168.255.254/31 and 192.169.1.1/24192.169.1.1/24.
192.168.255.254192.168.255.254 falls inside 192.168.0.0/16192.168.0.0/16 and is private regardless of prefix length (/31/31). 192.169.1.1192.169.1.1 exceeds 192.168.255.255192.168.255.255, making it public.
The 192.168.0.0/16192.168.0.0/16 block ends at 192.168.255.255192.168.255.255. Addresses starting with 192.169.x.x192.169.x.x are public addresses.

Key Concept

RFC 1918 Private IPv4 Address Ranges and Boundary Verification
Question 874Question →

A network engineer connects two Cisco Catalyst switches. SwitchA interface GigabitEthernet0/1 is configured with 'switchport mode dynamic desirable', and SwitchB interface GigabitEthernet0/1 is configured with 'switchport mode dynamic auto'. Both switches use default native VLAN 1 configurations. Place the following operational events in the correct sequential order from the initiation of link negotiation to the transmission of native VLAN traffic.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with SwitchA sending active DTP frames, followed by SwitchB acknowledging the proposal from dynamic auto mode, both interfaces transitioning to operational 802.1Q trunking, SwitchA receiving ingress VLAN 1 traffic, and SwitchA forwarding that native VLAN traffic untagged across the trunk.
Dynamic desirable ports actively initiate DTP negotiation, causing dynamic auto ports to respond and agree. Once operational, data traffic matching the default native VLAN (VLAN 1) is forwarded across the 802.1Q trunk untagged.

Step-by-Step Solution

1
Initiate DTP Proposal
SwitchA sends DTP frames via Gi0/1.
'switchport mode dynamic desirable' actively initiates negotiation with the neighbor.
2
Respond to Negotiation
SwitchB receives DTP and responds positively.
'switchport mode dynamic auto' will not originate DTP proposals but willingly converts to a trunk if requested by a neighbor.
3
Establish Operational Trunk
Both Gi0/1 interfaces enter the trunking operational state using 802.1Q encapsulation.
A desirable-to-auto dynamic DTP pairing successfully negotiates a trunk.
4
Process Ingress Frame
SwitchA accepts an ingress frame belonging to VLAN 1 (native VLAN).
Data plane forwarding occurs after control plane negotiation is established.
5
Forward Across Trunk
SwitchA sends the frame across Gi0/1 untagged.
By default under 802.1Q, native VLAN traffic is transmitted without adding a 4-byte VLAN tag.

Key Concept

802.1Q Trunking DTP Negotiation Sequence and Native VLAN Tagging Mechanics
Question 875Question →

An engineer executes the command `show interfaces gigabitethernet 0/1 switchport` on a Cisco Catalyst switch and receives the following output:

text
Name: Gi0/1
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 10 (VLAN0010)
Administrative Native VLAN tagging: enabled
Trunking VLANs Enabled: 10, 20, 30

How will the switch handle an outgoing frame belonging to VLAN 10 as it egresses interface GigabitEthernet0/1?

Show answer & explanation

Answer: The frame will be transmitted with an explicit 802.1Q VLAN tag containing VLAN ID 10 because global native VLAN tagging is enabled.

Answer

The switch will transmit the frame with an explicit 802.1Q tag for VLAN 10 because global native VLAN tagging is active on the switch.
Standard IEEE 802.1Q trunking sends frames belonging to the native VLAN without a VLAN tag. However, when native VLAN tagging is enabled globally (`vlan dot1q tag native`), the switch appends an 802.1Q tag header (VLAN ID 10) to all outgoing native VLAN frames across 802.1Q trunks.

Step-by-Step Solution

1
Analyze the operational parameters in the CLI output.
The interface is operating as an 802.1Q trunk ('Operational Mode: trunk', 'Operational Trunking Encapsulation: dot1q') with VLAN 10 configured as the native VLAN ('Trunking Native Mode VLAN: 10').
Understanding the interface trunk encapsulation and native VLAN assignment sets the baseline for frame processing.
2
Evaluate the native VLAN tagging state.
The output states 'Administrative Native VLAN tagging: enabled', indicating that the global command 'vlan dot1q tag native' is in effect.
By default, 802.1Q native VLAN frames are transmitted untagged, but enabling global native VLAN tagging forces all native VLAN egress frames to be explicitly tagged.

Key Concept

802.1Q Native VLAN Tagging Behavior
Question 876Question →

During a security compliance audit of internal corporate subnets, a network engineer is asked to verify that host interfaces use IPv4 addresses from the Class B private space defined in RFC 1918. Which of the following IPv4 addresses falls strictly within the valid RFC 1918 Class B private address range?

Show answer & explanation

Answer: 172.31.200.15

Answer

The address 172.31.200.15 is the only valid RFC 1918 Class B private IPv4 address among the choices.
The IPv4 address 172.31.200.15 resides within the 172.16.0.0/12 block reserved by RFC 1918, which spans from 172.16.0.0 through 172.31.255.255.

Step-by-Step Solution

1
Recall the RFC 1918 private IPv4 address ranges.
Class A: 10.0.0.0 to 10.255.255.255 (10.0.0.0/8); Class B: 172.16.0.0 to 172.31.255.255 (172.16.0.0/12); Class C: 192.168.0.0 to 192.168.255.255 (192.168.0.0/16).
Identifying the official range boundaries is necessary to differentiate private space from public space.
2
Evaluate each provided option against the Class B RFC 1918 boundaries.
172.31.200.15 is between 172.16.0.0 and 172.31.255.255, making it a private RFC 1918 address.
The second octet of 31 is the upper boundary of the /12 block.

Key Concept

RFC 1918 Private IPv4 Address Ranges
Estimated Time:1m 0s
Question 877Question →

During a wireless site survey in a multi-story office building, a network engineer observes that 2.4 GHz signals penetrate drywall and cubicle partitions with significantly less attenuation than 5 GHz signals, resulting in severe co-channel interference (CCI) from access points located on adjacent floors using channel 6. Which radio frequency (RF) principle explains why the 2.4 GHz frequency band exhibits greater obstacle penetration and longer range than the 5 GHz frequency band?

Show answer & explanation

Answer: Lower frequency RF waves have longer wavelengths, which experience less attenuation when passing through solid physical barriers compared to higher frequency waves.

Answer

Lower frequency RF waves have longer wavelengths, which experience less attenuation when passing through solid physical barriers compared to higher frequency waves.
The 2.4 GHz band operates at a lower frequency than the 5 GHz band, giving it a longer wavelength. Longer wavelengths attenuate less when passing through physical obstacles such as walls and floors, enabling the signal to travel greater distances through building structures and leading to co-channel interference if floor-to-floor channel separation is not properly managed.

Step-by-Step Solution

1
Analyze the physical relationship between RF wave frequency, wavelength, and attenuation.
Frequency (ff) and wavelength (λ\lambda) are inversely proportional (c=f⋅λc = f \cdot \lambda). Lower frequencies have longer wavelengths.
Understanding fundamental wave properties clarifies signal propagation characteristics.
2
Evaluate propagation behavior through physical barriers.
Longer wavelengths (2.4 GHz) pass through materials like drywall and wood with lower attenuation compared to shorter wavelengths (5 GHz).
Shorter wavelengths are more easily absorbed and scattered by physical structures.
3
Correlate RF behavior to the observed network issue.
The lower attenuation of 2.4 GHz signals allows them to travel farther through floors and walls, causing unintended co-channel interference across adjacent floors.
This explains why careful channel and power planning is essential in 2.4 GHz deployments.

Key Concept

RF Attenuation and Wavelength vs. Frequency Principles
Question 878Question →

An administrator is configuring an internal workstation and needs to manually assign an IPv4 address that belongs to an RFC 1918 private network block. Which IPv4 address is valid for this requirement?

Show answer & explanation

Answer: 172.25.100.50

Answer

172.25.100.50 is a valid RFC 1918 private IPv4 address.
The address 172.25.100.50 is correct because RFC 1918 specifies 172.16.0.0/12 (covering 172.16.0.0 through 172.31.255.255) as a private IPv4 block. Because 25 is between 16 and 31 in the second octet, 172.25.100.50 is a valid private IPv4 address.

Step-by-Step Solution

1
Identify the designated RFC 1918 private IPv4 address ranges.
The defined private ranges are 10.0.0.0/8 (10.0.0.0 - 10.255.255.255), 172.16.0.0/12 (172.16.0.0 - 172.31.255.255), and 192.168.0.0/16 (192.168.0.0 - 192.168.255.255).
RFC 1918 reserves specific IP address blocks for private internal networks that are not routable on the public Internet.
2
Evaluate the given address options against the RFC 1918 ranges.
172.25.100.50 falls between 172.16.0.0 and 172.31.255.255, making it a valid private address. The addresses starting with 172.33, 192.169, and 11 are public addresses.
Only IP addresses within the exact start and end boundaries of RFC 1918 blocks are reserved for private use.

Key Concept

RFC 1918 Private IPv4 Address Ranges
Question 879Question →

An edge security gateway is configured to drop any outgoing packet to the public Internet if its source IP address belongs to an RFC 1918 private address space. During a security audit of un-translated egress traffic logs, four source IPv4 addresses were recorded. Which source IPv4 address is globally routable on the public Internet and will be permitted through the firewall filter?

Show answer & explanation

Answer: 172.32.10.55

Answer

172.32.10.55 is a public IPv4 address because it falls outside the RFC 1918 Class B private address allocation (172.16.0.0/12).
RFC 1918 allocates three specific ranges for private networks: 10.0.0.0/8 (10.0.0.0 - 10.255.255.255), 172.16.0.0/12 (172.16.0.0 - 172.31.255.255), and 192.168.0.0/16 (192.168.0.0 - 192.168.255.255). The address 172.32.10.55 begins with 172.32, which is higher than the upper boundary of 172.31.255.255, making it a globally routable public address that passes the RFC 1918 egress filter.

Step-by-Step Solution

1
Recall the RFC 1918 private IPv4 address allocations.
Class A: 10.0.0.0 to 10.255.255.255 (10.0.0.0/8), Class B: 172.16.0.0 to 172.31.255.255 (172.16.0.0/12), Class C: 192.168.0.0 to 192.168.255.255 (192.168.0.0/16).
Establishing accurate range boundaries is necessary to differentiate private non-routable addresses from public addresses.
2
Compare each given address against the RFC 1918 boundaries.
10.255.254.1 is inside 10.0.0.0/8; 192.168.100.255 is inside 192.168.0.0/16; 172.30.100.1 is inside 172.16.0.0/12. However, 172.32.10.55 exceeds 172.31.255.255.
Any IP starting with 172.32.x.x is part of public IP address space, not RFC 1918.
3
Determine which address is permitted through the egress filter.
172.32.10.55 is a public IP address and will pass through the RFC 1918 filter.
The filter only drops packets originating from RFC 1918 private ranges.

Key Concept

RFC 1918 Private IPv4 Address Space Boundaries
Estimated Time:1m 0s
Question 880Question →

Two legacy FastEthernet switches are connected directly to each other using an Ethernet cable. The interface configuration on both ends explicitly has `no mdix auto` applied. Upon connecting the devices, execution of `show interfaces fastEthernet 0/12` reports that `FastEthernet0/12 is down, line protocol is down`. What physical cabling condition is the root cause of this interface status?

Show answer & explanation

Answer: A standard Category 5e straight-through cable is connected between the two like switch devices.

Answer

A standard Category 5e straight-through cable is connected between the two like switch devices.
When connecting two switches directly without Auto-MDIX enabled, a crossover cable must be used to cross the transmit pairs of one switch to the receive pairs of the other. Connecting them with a straight-through cable connects transmit pins to transmit pins and receive pins to receive pins, which prevents physical link negotiation and causes the interface status and line protocol to remain down.

Step-by-Step Solution

1
Analyze the interface status and line protocol state.
Both interface status and line protocol report 'down', indicating a Layer 1 (Physical layer) connectivity failure.
When an interface reports down/down, the device is not receiving physical signals or link pulses from the connected endpoint.
2
Evaluate the configuration context and device roles.
Two like devices (switch to switch) are connected, and automatic medium-dependent interface crossover (`no mdix auto`) is disabled.
Like devices transmit and receive on the exact same pin pairs (pins 1,2 for Tx and pins 3,6 for Rx on 10/100 Ethernet).
3
Determine the required cabling type.
A crossover cable must be used so that Transmit (Tx) pins on one switch connect to Receive (Rx) pins on the opposite switch.
If a straight-through cable is used without Auto-MDIX enabled, Tx connects to Tx and Rx connects to Rx, preventing physical link establishment.

Key Concept

Ethernet Cable Pinouts and Auto-MDIX Requirements
PreviousPage 44 / 100Next
All practice questions — Cisco CCNA | Examkin