Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 881Question →

An engineer is troubleshooting a Layer 2 connectivity issue between Switch-1 and Switch-2 connected via GigabitEthernet0/1. A host in VLAN 10 connected to Switch-1 is unable to reach a host in VLAN 10 on Switch-2. A partial CLI output from Switch-1 is shown below:

text
Switch-1# show interfaces gigabitethernet 0/1 switchport
Name: Gi0/1
Administrative Mode: dynamic auto
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 10
Administrative Native VLAN tagging: disabled
Trunking VLANs Enabled: 10,20,30

Switch-2's GigabitEthernet0/1 interface is configured as an 802.1Q trunk with `switchport trunk native vlan 20` and allows VLANs 10, 20, and 30. CDP logs on both switches generate regular native VLAN mismatch warnings.

Assuming global native VLAN tagging (`vlan dot1q tag native`) is disabled on both switches, how will Switch-2 process an untagged ARP request broadcast generated by the host in VLAN 10 on Switch-1 when it arrives at Switch-2's GigabitEthernet0/1 interface?

Show answer & explanation

Answer: Switch-2 will accept the untagged frame and forward it internally into VLAN 20, preventing VLAN 10 hosts on Switch-2 from receiving the ARP request.

Answer

Switch-2 will accept the untagged frame and forward it internally into VLAN 20, preventing VLAN 10 hosts on Switch-2 from receiving the ARP request.
Under standard 802.1Q operation without global native VLAN tagging, frames originating on the native VLAN of an egress trunk interface are sent untagged. Switch-1's native VLAN is 10, so VLAN 10 traffic is transmitted without an 802.1Q header. When Switch-2 receives an untagged frame on a trunk port, it automatically maps that frame to its own configured native VLAN, which is VLAN 20. As a result, the ARP broadcast leaks into VLAN 20 on Switch-2, failing to reach hosts on VLAN 10.

Step-by-Step Solution

1
Analyze Switch-1 trunk egress behavior for VLAN 10 traffic.
Switch-1 has native VLAN configured as VLAN 10 without global native VLAN tagging enabled. Therefore, frames belonging to VLAN 10 are transmitted across the 802.1Q trunk link without an 802.1Q VLAN tag.
By default in 802.1Q trunking, traffic belonging to the configured native VLAN is sent untagged.
2
Analyze Switch-2 trunk ingress behavior for untagged frames.
Switch-2 receives an untagged frame on GigabitEthernet0/1. According to 802.1Q standard operations, any untagged frame received on a trunk interface is automatically mapped to that interface's configured native VLAN.
Switch-2's configured native VLAN is VLAN 20.
3
Determine internal forwarding destination and traffic impact.
The untagged ARP request from VLAN 10 on Switch-1 is forwarded internally into VLAN 20 on Switch-2. Hosts on VLAN 10 attached to Switch-2 never receive the broadcast ARP frame.
Native VLAN mismatch causes cross-VLAN traffic leaking into the receiving switch's native VLAN rather than maintaining isolation or reaching the intended source VLAN.

Key Concept

802.1Q Native VLAN Untagged Ingress Forwarding and Mismatch Mechanics
Estimated Time:2m 0s
Question 882Question →

When designing an enterprise Wi-Fi deployment, a network technician must decide between utilizing the 2.4 GHz and 5 GHz radio frequency bands. Which characteristic represents an advantage of using the 2.4 GHz band compared to the 5 GHz band?

Show answer & explanation

Answer: Longer propagation distance and superior signal penetration through physical barriers

Answer

The 2.4 GHz band provides longer propagation distance and superior signal penetration through physical barriers.
Lower frequency radio waves (2.4 GHz) have longer wavelengths. This physical property allows 2.4 GHz wireless signals to cover greater distances and pass through solid obstructions (such as drywall, wood, and concrete) with less signal loss compared to higher frequency 5 GHz waves.

Step-by-Step Solution

1
Analyze RF wave propagation characteristics
Lower RF frequencies have longer wavelengths, which travel further and experience less attenuation through solid objects.
RF physics dictates an inverse relationship between frequency and wave propagation distance.
2
Compare 2.4 GHz and 5 GHz characteristics
2.4 GHz signals travel longer distances and penetrate walls better, while 5 GHz signals provide higher speed over shorter distances.
Lower frequency (2.4 GHz) trades raw speed and channel availability for increased coverage area.

Key Concept

Wireless Frequency Bands and RF Propagation Characteristics
Question 883Question →

Which TWO statements accurately describe standard IEEE 802.1Q trunking behavior on Ethernet switch interfaces? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: By default, traffic belonging to the native VLAN is transmitted across the trunk link without an added 802.1Q VLAN tag.; An 802.1Q tag header inserts a 4-byte field containing a VLAN Identifier (VID) into the Ethernet frame header for non-native VLAN traffic.

Answer

The correct statements are that native VLAN frames are transmitted untagged by default across an 802.1Q trunk link, and that 802.1Q encapsulation inserts a 4-byte header containing the VLAN ID into non-native VLAN frames.
Under IEEE 802.1Q trunking, traffic belonging to the native VLAN is sent untagged by default without an added header. For all other VLANs traversing the trunk, the switch inserts a 4-byte tag header into the original Ethernet frame containing the VLAN ID.

Step-by-Step Solution

1
Analyze frame tagging behavior for 802.1Q trunking
Recognize that 802.1Q inserts a 4-byte VLAN tag into Ethernet frames for tagged VLANs, but leaves native VLAN frames untagged by default.
This dual behavior allows legacy untagged devices and native traffic to traverse trunk links.
2
Evaluate native VLAN configuration requirements across trunk links
Confirm that native VLAN IDs must match on both ends of the interswitch trunk.
Mismatched native VLAN IDs cause frames originating in one VLAN to exit into a different VLAN on the receiving switch.
3
Evaluate Spanning Tree Protocol (STP) PortFast application
Confirm that PortFast is intended strictly for edge access ports connected to end-user devices.
Enabling PortFast on switch-to-switch interconnect trunks can lead to catastrophic bridging loops during topology changes.

Key Concept

IEEE 802.1Q Trunk Header Mechanics and Native VLAN Operation
Estimated Time:1m 0s
Question 884Question →

A network engineer is auditing perimeter firewall logs on an enterprise WAN edge router. The firewall security policy is configured to drop any outbound packet whose source IP address falls within the RFC 1918 private IPv4 address space unless it has undergone Network Address Translation (NAT). During a routine inspection, the log records outbound packets from four host IP addresses: 11.10.5.1, 172.28.140.22, 172.33.10.1, and 192.169.50.4. Which source IP address will be dropped by the firewall policy for utilizing an RFC 1918 private IPv4 address?

Show answer & explanation

Answer: 172.28.140.22

Answer

172.28.140.22 is the RFC 1918 private IPv4 address and will be dropped by the firewall.
The IP address 172.28.140.22 falls directly within the RFC 1918 Class B private address space of 172.16.0.0 to 172.31.255.255 (a /12 prefix block). Because it is an un-translated private address destined for an outbound WAN connection, the firewall policy correctly drops the traffic.

Step-by-Step Solution

1
Recall the defined RFC 1918 private IPv4 address ranges.
Class A: 10.0.0.0 to 10.255.255.255 (10.0.0.0/8)
Class B: 172.16.0.0 to 172.31.255.255 (172.16.0.0/12)
Class C: 192.168.0.0 to 192.168.255.255 (192.168.0.0/16)
These three blocks are set aside by IANA and RFC 1918 for internal network use and are non-routable over the public Internet without NAT.
2
Evaluate host 172.28.140.22 against the Class B RFC 1918 range.
The second octet is 28, which falls inclusively between 16 and 31.
Because 16 <= 28 <= 31, 172.28.140.22 is a valid private IPv4 address.
3
Verify the remaining candidate IP addresses to confirm public vs private classification.
11.10.5.1 is outside 10.0.0.0/8; 172.33.10.1 is above 172.31.255.255; 192.169.50.4 is outside 192.168.0.0/16.
All three remaining options are public IPv4 addresses.

Key Concept

RFC 1918 Private IPv4 Address Space Boundaries
Question 885Question →

A network administrator executes the 'show interfaces gigabitethernet 0/1' command on a Cisco switch connected to a workstation. The output indicates that GigabitEthernet0/1 is up and the line protocol is up, but the error statistics show a high number of late collisions and FCS errors. Which two underlying physical or data-link conditions are the most probable causes of these error counters?

Select all that apply

Show answer & explanation

Answer: A duplex mismatch between the switch port and the connected workstation; A damaged or degraded Ethernet cable causing signal corruption

Answer

The most probable causes are a duplex mismatch between the connected devices and a damaged or degraded Ethernet cable.
Late collisions are the classic symptom of a speed/duplex mismatch where one end of the link is configured for half-duplex and the other for full-duplex. FCS errors indicate that frames arrived corrupted, which is commonly caused by poor physical cabling, damaged copper conductors, or bad connectors.

Step-by-Step Solution

1
Analyze the late collisions symptom.
Late collisions occur when a device detects a collision after transmitting the first 64 bytes of a frame. This typically occurs when one side operates in half-duplex while the opposing side operates in full-duplex.
Full-duplex transmits without checking for collisions, causing the half-duplex side to detect collisions mid-transmission.
2
Analyze the FCS errors symptom.
Frame Check Sequence (FCS) errors occur when the calculated checksum at the receiving end does not match the checksum in the trailer of the received frame.
This indicates physical Layer 1 corruption caused by faulty cabling, improper grounding, or interference.
3
Evaluate the incorrect choices.
Native VLAN mismatches affect VLAN tagging/log warnings, and cable pinout mismatches without Auto-MDIX cause the link state to remain completely down.
Neither native VLAN mismatch nor pinout mismatches produce late collisions or FCS errors on an operational up/up interface.

Key Concept

Identifying interface error symptoms and corresponding physical/data-link Layer 1 and Layer 2 root causes
Question 886Question →

An enterprise network team is implementing a hyper-converged rack architecture containing Type 1 bare-metal hypervisors, Layer 3 access switches, and Next-Generation Firewalls (NGFWs). Which two statements accurately describe the operational roles and traffic-handling boundaries of these components? (Select two.)

Select all that apply

Show answer & explanation

Answer: The Type 1 hypervisor executes directly on physical server hardware to manage virtual machine resources and provision virtual switches without relying on an underlying host operating system.; Layer 3 switches separate Layer 2 broadcast domains by routing traffic between VLANs, whereas the NGFW tracks connection state to perform deep packet inspection and enforce security policies.

Answer

The statement stating that Type 1 hypervisors execute directly on physical hardware without a host OS and the statement that Layer 3 switches terminate broadcast domains while NGFWs perform stateful connection inspection are both correct.
Type 1 hypervisors run bare-metal without an underlying host operating system, direct-managing hardware and internal virtual switching. Additionally, Layer 3 switches isolate broadcast domains by establishing routing boundaries between VLANs, while NGFWs perform stateful inspection and deep packet security enforcement across network zones.

Step-by-Step Solution

1
Analyze the architecture of Type 1 hypervisors relative to virtual switching.
Type 1 hypervisors run directly on bare metal without a host OS, providing hardware virtualization and integrated L2 virtual switching for hosted virtual machines.
Differentiating Type 1 (bare-metal) from Type 2 (hosted) hypervisors is critical when assigning infrastructure management responsibilities.
2
Evaluate the switching domain properties of virtual and physical switches.
Switches separate collision domains per switch port, but a VLAN defines a single Layer 2 broadcast domain across both physical and virtual switch ports.
Broadcast frames flood across all ports assigned to the same VLAN regardless of whether the switch is physical or virtual.
3
Compare Layer 3 switch routing capabilities with Next-Generation Firewall functional roles.
Layer 3 switches terminate Layer 2 broadcast boundaries at VLAN SVIs and handle high-speed inter-VLAN routing, whereas NGFWs maintain connection state tables and inspect payload contents up to Layer 7.
Network component roles must be distinctly allocated between Layer 3 throughput forwarding and stateful security boundary enforcement.

Key Concept

Operational roles and functional boundaries of Type 1 hypervisors, Layer 3 switches, and Next-Generation Firewalls
Estimated Time:2m 0s
Question 887Question →

An enterprise deployment uses Cisco Lightweight Access Points (LAPs) operating in a Centralized Split-MAC architecture with a central Wireless LAN Controller (WLC). Which two real-time MAC layer functions are performed directly by the Access Point rather than the WLC? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Transmission of 802.11 beacon and probe response frames; Real-time 802.11 frame encryption and decryption

Answer

In a Cisco Split-MAC architecture, the Access Point handles real-time frame transmission (beacons/probe responses) and hardware layer encryption/decryption, while management and control functions are handled by the WLC.
In a Split-MAC architecture, real-time RF tasks that demand precise timing (such as generating 802.11 beacons, responding to probe requests, and performing hardware-level frame encryption/decryption) are processed directly by the AP hardware.

Step-by-Step Solution

1
Analyze the functional division in Cisco Split-MAC architecture
Split-MAC divides duties based on real-time sensitivity vs. centralized management.
Tasks requiring microsecond-level timing are offloaded to the AP radio hardware.
2
Identify AP real-time MAC functions
Beacon generation, probe responses, MAC-layer frame buffering, and hardware encryption/decryption are AP duties.
Latency-sensitive radio tasks cannot tolerate the round-trip delay of a CAPWAP tunnel to the controller.
3
Identify central WLC management functions
Client authentication/association, 802.11 to 802.3 frame translation, and roaming coordination belong to the WLC.
Centralizing management ensures consistent policy enforcement and seamless mobility.

Key Concept

Split-MAC Architecture Division of Responsibilities
Question 888Question →

An administrator connects two Cisco switches, Switch-1 and Switch-2, using interface GigabitEthernet0/1. Switch-1 is configured with `switchport mode dynamic desirable`, `switchport trunk native vlan 20`, and `switchport trunk allowed vlan 10,20,30`. Switch-2 is configured with `switchport mode dynamic auto`, `switchport trunk native vlan 20`, and `switchport trunk allowed vlan 10,30`. Which statement correctly describes the operational status and traffic behavior across this interswitch link?

Show answer & explanation

Answer: An 802.1Q trunk link forms successfully via DTP negotiation, but Switch-2 drops all ingress traffic for VLAN 20 because VLAN 20 is not included in its allowed VLAN list.

Answer

An 802.1Q trunk link forms successfully via DTP negotiation, but Switch-2 drops all ingress traffic for VLAN 20 because VLAN 20 is not included in its allowed VLAN list.
DTP successfully negotiates trunking between dynamic desirable and dynamic auto operational modes. However, trunk interface allowed VLAN lists filter traffic independently on each switch. Because Switch-2 has configured `switchport trunk allowed vlan 10,30`, VLAN 20 is explicitly pruned from Switch-2's trunk interface. Untagged traffic for native VLAN 20 arriving on Switch-2 will be mapped to VLAN 20 and subsequently dropped because VLAN 20 is not permitted on the trunk.

Step-by-Step Solution

1
Analyze the Dynamic Trunking Protocol (DTP) mode negotiation between Switch-1 and Switch-2.
Switch-1 (dynamic desirable) actively sends DTP frames, while Switch-2 (dynamic auto) responds. A operational 802.1Q trunk link is established.
Matching allowed VLAN lists are not required for DTP to successfully negotiate a trunk link.
2
Evaluate the native VLAN frame tagging mechanics for Switch-1.
Switch-1 transmits frames for VLAN 20 without an 802.1Q tag across the trunk.
By default in 802.1Q trunking, traffic belonging to the native VLAN is sent untagged.
3
Evaluate Switch-2 ingress processing and allowed VLAN pruning logic.
Switch-2 receives untagged frames, associates them with native VLAN 20, but drops them because VLAN 20 is not present in `switchport trunk allowed vlan 10,30`.
The `switchport trunk allowed vlan` command acts as an ingress and egress filter on trunk interfaces.

Key Concept

802.1Q Trunking DTP Negotiation and Allowed VLAN Pruning Mechanics
Estimated Time:1m 30s
Question 889Question →

An enterprise network administrator is deploying a centralized Cisco Wireless LAN Controller (WLC) architecture utilizing CAPWAP tunnels for Lightweight Access Point (LAP) management and traffic transport. Which two statements correctly describe the transport layer protocols and security characteristics used by CAPWAP? (Choose two.)

Select all that apply

Show answer & explanation

Answer: CAPWAP Control traffic uses UDP port 5246 and is encrypted by default using Datagram Transport Layer Security (DTLS).; CAPWAP Data traffic uses UDP port 5247 and is unencrypted by default, though optional DTLS payload encryption can be enabled.

Answer

The correct statements are that CAPWAP Control traffic operates over UDP port 5246 with mandatory DTLS encryption, while CAPWAP Data traffic operates over UDP port 5247 and is unencrypted by default (with optional DTLS encryption support).
CAPWAP (Control and Provisioning of Wireless Access Points) protocol specifies UDP port 5246 for Control messages, which are encrypted using DTLS by default to secure WLC-to-AP management traffic. CAPWAP Data frames are transported over UDP port 5247, which defaults to unencrypted operational state to maximize throughput, while allowing optional DTLS payload encryption.

Step-by-Step Solution

1
Analyze CAPWAP transport protocol selection.
CAPWAP uses UDP (User Datagram Protocol) rather than TCP for both Control and Data channels to eliminate head-of-line blocking and TCP sliding-window overhead over wireless medium links.
Lightweight access points and controllers handle reliability through CAPWAP retransmission timers and DTLS instead of TCP transport features.
2
Identify CAPWAP port assignments for Control and Data planes.
Control traffic communicates over UDP port 5246, while Data traffic communicates over UDP port 5247.
Separating Control and Data onto distinct UDP destination ports allows routers and firewalls to apply targeted QoS and security policies.
3
Evaluate encryption requirements for CAPWAP channels.
CAPWAP Control traffic requires DTLS encryption by default to safeguard configuration and management exchanges. CAPWAP Data traffic travels unencrypted by default to preserve throughput, though DTLS can be enabled if desired.
Default unencrypted data tunneling avoids severe performance penalties on hardware while protecting controller management transactions.

Key Concept

CAPWAP Protocol Architecture and UDP Port Operations
Question 890Question →

A network manager is reviewing host IP allocation requests for internal database servers. To ensure non-routable communication over the public Internet according to RFC 1918 standards, the network team must identify valid private host IPv4 addresses. Which of the following IPv4 addresses belong to the RFC 1918 private address space and can be assigned to internal hosts? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: 10.200.150.75; 172.29.45.12

Answer

The addresses 10.200.150.75 and 172.29.45.12 belong to the RFC 1918 private IPv4 address space.
The IP addresses 10.200.150.75 and 172.29.45.12 fall directly within the RFC 1918 private IPv4 blocks. 10.200.150.75 is inside the 10.0.0.0/8 block, and 172.29.45.12 is inside the 172.16.0.0/12 block.

Step-by-Step Solution

1
Recall the RFC 1918 reserved private IPv4 address ranges.
Class A: 10.0.0.0 to 10.255.255.255 (10.0.0.0/8); Class B: 172.16.0.0 to 172.31.255.255 (172.16.0.0/12); Class C: 192.168.0.0 to 192.168.255.255 (192.168.0.0/16).
These specific ranges are reserved by IANA for private enterprise networking and are non-routable over the public Internet.
2
Evaluate candidate address 10.200.150.75.
10.200.150.75 falls between 10.0.0.0 and 10.255.255.255.
It matches the 10.0.0.0/8 private address prefix.
3
Evaluate candidate address 172.29.45.12.
172.29.45.12 falls between 172.16.0.0 and 172.31.255.255.
The second octet 29 is within the range 16 through 31 reserved for RFC 1918 Class B space.
4
Evaluate candidate addresses 172.35.10.20 and 192.169.100.1.
172.35.10.20 (second octet 35 > 31) and 192.169.100.1 (second octet 169 != 168) are outside RFC 1918 boundaries.
Both are globally routable public IPv4 addresses.

Key Concept

RFC 1918 Private IPv4 Address Ranges
Estimated Time:1m 30s
Question 891Question →

Two Cisco Catalyst switches, Switch-A and Switch-B, are connected via their GigabitEthernet0/1 interfaces. Switch-A has its interface configured with the command `switchport mode dynamic desirable`, while Switch-B operates using the default Cisco Catalyst DTP configuration (`switchport mode dynamic auto`). Both switches retain all default VLAN parameters. Which of the following statements regarding the operational behavior of this interswitch connection are true? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The interface link successfully negotiates an operational 802.1Q trunking state via Dynamic Trunking Protocol (DTP).; Traffic belonging to VLAN 1 is transmitted across the trunk link without an added 802.1Q VLAN header tag.

Answer

The connection successfully negotiates an operational 802.1Q trunk link via DTP, and frames belonging to the default native VLAN (VLAN 1) are transmitted across the trunk untagged.
When combining `switchport mode dynamic desirable` on one end and `switchport mode dynamic auto` on the other, DTP successfully negotiates an operational trunk. Furthermore, because default settings maintain VLAN 1 as the native VLAN, frames associated with VLAN 1 are forwarded across the trunk without receiving a 4-byte 802.1Q VLAN header tag.

Step-by-Step Solution

1
Analyze the Dynamic Trunking Protocol (DTP) mode combination between Switch-A and Switch-B.
Switch-A (`dynamic desirable`) actively sends DTP negotiation frames. Switch-B (`dynamic auto`) listens and agrees to form a trunk upon receiving DTP requests from a desirable port.
DTP operational state rules dictate that desirable + auto results in an operational trunk.
2
Evaluate the 802.1Q native VLAN framing mechanics for default VLAN configuration.
VLAN 1 is the default native VLAN on both switches. Under IEEE 802.1Q standards, frames belonging to the designated native VLAN cross the trunk link untagged.
802.1Q tagging adds a 4-byte header only to non-native VLAN traffic to ensure backward compatibility and minimal processing overhead for native subnet traffic.

Key Concept

802.1Q Trunking and Dynamic Trunking Protocol (DTP) Negotiation
Estimated Time:1m 30s
Question 892Question →

A network administrator is allocating IPv4 addresses for internal workstations on an enterprise LAN. Which of the following IPv4 addresses are reserved for private network use under RFC 1918? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: 10.200.15.1; 172.28.45.10

Answer

The addresses 10.200.15.1 and 172.28.45.10 are reserved private IPv4 addresses under RFC 1918.
The IPv4 address 10.200.15.1 belongs to the 10.0.0.0/8 private address block, and 172.28.45.10 belongs to the 172.16.0.0/12 private address block (which ranges from 172.16.0.0 to 172.31.255.255). Both are valid RFC 1918 private IPv4 addresses.

Step-by-Step Solution

1
Identify the three RFC 1918 private address ranges
Class A: 10.0.0.0/8 (10.0.0.0 - 10.255.255.255), Class B: 172.16.0.0/12 (172.16.0.0 - 172.31.255.255), Class C: 192.168.0.0/16 (192.168.0.0 - 192.168.255.255).
RFC 1918 explicitly defines these three address blocks for private, unroutable network use.
2
Evaluate each candidate address against the RFC 1918 blocks
10.200.15.1 is inside 10.0.0.0/8. 172.28.45.10 is inside 172.16.0.0/12. 172.35.10.50 is outside 172.16.0.0/12 (35 > 31). 192.170.10.1 is outside 192.168.0.0/16 (170 != 168).
Comparing second octets ensures correct boundary verification for Class B and Class C private ranges.

Key Concept

RFC 1918 Private IPv4 Address Ranges
Question 893Question →

A network auditing tool generates a report listing IPv4 addresses detected on internal branch office node interfaces. Which of the following IPv4 addresses are compliant with RFC 1918 private IP addressing standards? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: 10.254.1.50; 172.29.40.10

Answer

The IPv4 addresses 10.254.1.50 and 172.29.40.10 are valid RFC 1918 private IPv4 addresses.
The addresses 10.254.1.50 and 172.29.40.10 fit directly inside the RFC 1918 standard private ranges: 10.0.0.0/8 (10.0.0.0 to 10.255.255.255) and 172.16.0.0/12 (172.16.0.0 to 172.31.255.255) respectively.

Step-by-Step Solution

1
Recall the three designated RFC 1918 private IPv4 address ranges.
Class A: 10.0.0.0/8 (10.0.0.0 – 10.255.255.255), Class B: 172.16.0.0/12 (172.16.0.0 – 172.31.255.255), Class C: 192.168.0.0/16 (192.168.0.0 – 192.168.255.255).
Establishing accurate range boundaries is necessary to differentiate private non-routable IPs from public IPs.
2
Evaluate candidate address 10.254.1.50 against the RFC 1918 specifications.
10.254.1.50 begins with 10 in the first octet, making it a valid member of the 10.0.0.0/8 block.
Any IP starting with 10.x.x.x is private under RFC 1918.
3
Evaluate candidate address 172.29.40.10 against the RFC 1918 specifications.
172.29.40.10 has a second octet of 29, which lies within the inclusive 16–31 range for the 172.16.0.0/12 block.
Addresses from 172.16.0.0 through 172.31.255.255 are valid private addresses.
4
Evaluate invalid candidate addresses 172.33.1.1 and 192.169.50.25.
172.33.1.1 falls outside the 172.16–172.31 range, and 192.169.50.25 falls outside the 192.168.0.0/16 range.
Both 172.33.x.x and 192.169.x.x are public IPv4 addresses assigned on the Internet.

Key Concept

RFC 1918 Private IPv4 Address Scope
Question 894Question →

A network engineer is analyzing application traffic across an enterprise WAN link between a real-time voice streaming service and a critical transactional database connection. Which two operational characteristics accurately distinguish User Datagram Protocol (UDP) from Transmission Control Protocol (TCP) in this scenario? (Select two.)

Select all that apply

Show answer & explanation

Answer: UDP operates with a fixed 8-byte header structure and omits delivery acknowledgments, minimizing processing latency for real-time traffic.; TCP maintains stateful connection tracking using a baseline 20-byte header that incorporates sequence numbers, acknowledgment numbers, and dynamic windowing controls.

Answer

UDP provides a low-overhead, connectionless service with an 8-byte header without acknowledgments, whereas TCP provides a stateful, connection-oriented service with a 20-byte baseline header supporting sequence tracking, acknowledgments, and flow control.
The correct statements correctly identify that UDP utilizes a streamlined 8-byte header without delivery acknowledgments to minimize real-time latency, whereas TCP utilizes a 20-byte baseline header containing sequence numbers, acknowledgment numbers, and dynamic windowing to ensure connection-oriented reliability and flow control.

Step-by-Step Solution

1
Analyze Transport Layer header overhead for each protocol.
UDP uses a streamlined 8-byte header consisting of 4 fields (Source Port, Destination Port, Length, Checksum), while TCP requires at least a 20-byte header to accommodate stateful connection controls.
Header size directly impacts per-packet transport overhead and throughput latency.
2
Evaluate reliability and flow control mechanics.
TCP provides flow control via dynamic windowing and reliable delivery via sequence and acknowledgment numbers. UDP provides no native flow control, sequencing, or retransmission mechanisms.
Distinguishing stateful connection-oriented mechanics from stateless connectionless operation is essential for application protocol selection.

Key Concept

TCP vs UDP Header Fields and Operational Characteristics
Question 895Question →

A network administrator is troubleshooting a router interface that fails to forward traffic. The administrator issues the command `show interfaces gigabitethernet 0/1` and observes the following output status line:

`GigabitEthernet0/1 is administratively down, line protocol is down`

Which action must be taken to enable this interface?

Show answer & explanation

Answer: Execute the `no shutdown` command in interface configuration mode.

Answer

Execute the `no shutdown` command in interface configuration mode.
The state 'administratively down' always indicates that the administrator disabled the interface via configuration (`shutdown`). Executing `no shutdown` in interface configuration mode is the direct fix required to enable the port.

Step-by-Step Solution

1
Analyze the output of `show interfaces gigabitethernet 0/1`.
The physical layer status reports 'administratively down'.
In Cisco IOS, 'administratively down' explicitly indicates an administrative configuration state where the `shutdown` command is present under the interface.
2
Determine the required CLI command to change the administrative state.
Navigating to interface configuration mode (`config-if`) and entering `no shutdown` removes the shutdown state.
The `no shutdown` command administratively enables the interface, allowing it to transition to an operational status.

Key Concept

Interface Administrative Status vs. Physical/Line Protocol States
Estimated Time:45s
Question 896Question →

A system administrator is setting up an internal application server and needs to assign an IPv4 address from the RFC 1918 Class B private address space. Which of the following IPv4 addresses is a valid private IP address within this Class B block?

Show answer & explanation

Answer: 172.20.15.5

Answer

172.20.15.5 is a valid RFC 1918 Class B private IPv4 address.
RFC 1918 defines the Class B private IPv4 space as 172.16.0.0 to 172.31.255.255 (172.16.0.0/12). The address 172.20.15.5 falls directly inside this range because its second octet (20) is within the 16–31 boundary.

Step-by-Step Solution

1
Identify the RFC 1918 Class B private IPv4 address block boundaries.
The Class B private address range is 172.16.0.0 to 172.31.255.255 (with a /12 prefix length).
RFC 1918 reserves specific IPv4 address spaces for internal, non-globally routable enterprise networks.
2
Evaluate the candidate IPv4 addresses against the Class B boundary range.
172.20.15.5 has a second octet value of 20, which lies inclusively between 16 and 31.
Any IP address starting with 172.16.x.x through 172.31.x.x is part of the RFC 1918 Class B private allocation.

Key Concept

RFC 1918 Private IPv4 Addressing
Question 897Question →

A network administrator is troubleshooting poor throughput on a switch port connected to a server. Running the show interfaces command reveals a rapidly incrementing counter for cyclic redundancy check (CRC) errors alongside late collisions. Which TWO issues are the most likely root causes of these interface statistics? (Select two.)

Select all that apply

Show answer & explanation

Answer: A duplex mismatch between the switch port and the connected server interface.; Physical layer noise or damage on the copper Ethernet cable connection.

Answer

The most likely root causes are a duplex mismatch between the switch port and the connected device, and physical layer noise or damage on the Ethernet cable connection.
Late collisions typically indicate a duplex mismatch where one end operates in full-duplex mode while the other operates in half-duplex mode. CRC errors indicate corrupted frames resulting from electrical interference, loose connectors, bad cable shielding, or damaged media.

Step-by-Step Solution

1
Analyze the reported interface error counters (CRC errors and late collisions).
Identify that late collisions occur when collisions are detected after the first 64 bytes of a frame have been transmitted, while CRC errors indicate frame corruption during transit.
Understanding what layer these counters operate on isolates the issue to Layer 1 (physical) and Layer 2 (data link speed/duplex negotiation).
2
Evaluate potential causes for late collisions.
A duplex mismatch (one side set to full-duplex and the other to half-duplex) causes the half-duplex side to transmit while receiving data, generating late collisions.
Late collisions are classic symptoms of duplex mismatches or excessive cable lengths exceeding maximum Ethernet distance standards.
3
Evaluate potential causes for CRC (Cyclic Redundancy Check) errors.
CRC errors occur when the checksum computed by the receiving interface does not match the checksum frame check sequence (FCS) sent by the transmitter, typical of faulty cabling or bad connectors.
Physical medium flaws cause electrical noise and flipped bits during frame transmission.

Key Concept

Interface Error Statistics & Duplex Mismatches
Question 898Question →

Which TWO 802.11 frame sub-types are categorized as Management frames in a Wi-Fi network? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Beacon; Authentication

Answer

Beacon and Authentication frames are classified as 802.11 Management frames.
Beacon and Authentication frames are 802.11 Management frames. Beacon frames broadcast BSSID and network capabilities to discovery clients, while Authentication frames initiate client joining procedures.

Step-by-Step Solution

1
Categorize 802.11 frame types into Management, Control, and Data.
Management frames handle join/leave functions (Beacon, Probe, Authentication, Association). Control frames assist in data delivery (RTS, CTS, ACK).
802.11 defines three primary frame classes to govern media access and network membership.
2
Identify the Management frames from the listed options.
Beacon and Authentication are Management frames, whereas RTS, CTS, and ACK are Control frames.
Beacon frames advertise WLAN parameters, while Authentication frames handle client access validation.

Key Concept

802.11 Wireless Frame Types (Management vs Control vs Data)
Question 899Question →

A network engineer connects two Cisco Catalyst switches using interface GigabitEthernet0/12. The interfaces are configured with the following parameters:

Switch_Alpha (GigabitEthernet0/12):
- DTP Mode: `dynamic desirable`
- Trunking Encapsulation: `dot1q`
- Native VLAN: `20`
- Allowed VLANs: `10, 20, 30`

Switch_Beta (GigabitEthernet0/12):
- DTP Mode: `dynamic auto`
- Trunking Encapsulation: `dot1q`
- Native VLAN: `1`
- Allowed VLANs: `10, 30, 40`

Which two operational outcomes will occur on this interconnect link? (Select two.)

Select all that apply

Show answer & explanation

Answer: The link will successfully negotiate an operational 802.1Q trunk state.; Cisco Discovery Protocol (CDP) will generate error messages warning of a native VLAN mismatch.

Answer

The link will successfully negotiate an operational 802.1Q trunk state, and Cisco Discovery Protocol (CDP) will generate error messages warning of a native VLAN mismatch.
DTP mode 'dynamic desirable' actively negotiates trunking with 'dynamic auto', resulting in an operational trunk link. Additionally, because the two switches have conflicting native VLAN configurations (VLAN 20 vs VLAN 1), CDP exchange mechanisms detect the PVID mismatch and generate warning log alerts.

Step-by-Step Solution

1
Analyze DTP negotiation state between the two switches
Dynamic desirable initiates trunk negotiation while dynamic auto responds to requests. The combination successfully forms an operational 802.1Q trunk link.
DTP requires at least one side to be in desirable or trunk mode to actively negotiate a trunk.
2
Evaluate the native VLAN configuration on both interface endpoints
Switch_Alpha treats VLAN 20 as native, while Switch_Beta treats VLAN 1 as native.
Mismatched native VLAN definitions do not prevent DTP state completion, but cause CDP to detect PVID mismatches and log critical warning messages.
3
Verify allowed VLAN filtering rules and frame tagging behavior
Allowed VLAN lists do not restrict DTP state negotiation, and native VLAN frames remain untagged by default on 802.1Q trunks unless global native VLAN tagging is enabled.
802.1Q trunking sends frames belonging to the configured local native VLAN across the link without adding a 4-byte 802.1Q VLAN header.

Key Concept

802.1Q Trunking DTP Negotiation and Native VLAN Mismatch Behaviors
Question 900Question →

An enterprise network architect is reviewing packet forwarding behaviors and isolation boundaries across a hybrid campus and data center environment containing bare-metal hypervisors, Layer 3 distribution switches, Next-Generation Firewalls (NGFWs), and centralized Wireless LAN Controllers (WLCs). Which TWO operational characteristics accurately describe the roles and functions of these network components? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A virtual switch embedded within a Type 1 hypervisor forwards Layer 2 frames between co-located virtual machines on the same physical host without sending traffic out through physical network interface cards.; A Next-Generation Firewall operates as a stateful security gateway that maintains flow state tables to inspect both initial connection establishment packets and subsequent session traffic across trust zones.

Answer

The correct operational characteristics are that virtual switches in Type 1 hypervisors process frame switching locally between co-located virtual machines, and Next-Generation Firewalls maintain stateful connection tables to evaluate session flows across network security boundaries.
The statements describing local VM frame forwarding inside a Type 1 hypervisor virtual switch and stateful session tracking by Next-Generation Firewalls are correct. Virtual switches handle intra-host Layer 2 communication in memory without sending frames out through physical network interface cards. Next-Generation Firewalls maintain state tables for connected sessions to inspect both initial handshakes and subsequent payload data.

Step-by-Step Solution

1
Analyze the operational role of Type 1 hypervisor virtual switches.
Recognize that internal vSwitches handle Layer 2 switching between VMs residing on the same physical hardware within memory, avoiding unnecessary physical interface overhead.
Hypervisor architectures include software-based Layer 2 forwarding constructs to optimize intra-host communication.
2
Evaluate the stateful inspection mechanism of NGFW security components.
Confirm that stateful firewalls track protocol session states across interfaces, allowing return traffic automatically while enforcing policy rules on deep packet payloads.
Firewalls function beyond basic Layer 3/4 filtering by keeping state tables for active connections.
3
Examine common misconceptions regarding broadcast domain boundaries and WLC operating modes.
Identify that unmanaged Layer 2 switches do not break broadcast domains, and Local mode APs tunnel client traffic centrally to WLCs rather than utilizing Type 2 hypervisors.
Routers and VLAN boundaries separate broadcast domains, while Local mode APs rely on centralized CAPWAP datapath encapsulation.

Key Concept

Operational roles of virtual switches, NGFWs, Layer 2 boundaries, and centralized WLCs in enterprise architectures
Estimated Time:2m 0s
PreviousPage 45 / 100Next
All practice questions — Cisco CCNA | Examkin