Examkin

All practice questions

1987 questions

All types1,987Multiple choice1,020Multiple select452Numeric18Matching229Ordering203Fill in the blank22Short answer43
Question 1221Question →

A network administrator needs to configure a static route on a Cisco router for the destination network 2001:DB8:5::/642001:\text{DB8}:5::/64 using the next-hop router's link-local address FE80::2\text{FE80}::2 reachable via interface GigabitEthernet0/0/1. Which Cisco IOS command correctly configures this route?

Show answer & explanation

Answer: ipv6 route 2001:db8:5::/64 GigabitEthernet0/0/1 fe80::2

Answer

The command 'ipv6 route 2001:db8:5::/64 GigabitEthernet0/0/1 fe80::2' correctly configures the static route.
The command specifying 'ipv6 route 2001:db8:5::/64 GigabitEthernet0/0/1 fe80::2' follows the correct Cisco IOS syntax. When using a link-local address as a next hop, specifying the local exit interface before the link-local address is mandatory because link-local addresses are ambiguous across multiple physical links.

Step-by-Step Solution

1
Identify the proper command keyword for IPv6 static routes.
Use 'ipv6 route' rather than 'ip route'.
IPv6 routing configurations require the 'ipv6' keyword prefix in Cisco IOS.
2
Specify destination prefix, local exit interface, and link-local next-hop address in order.
Format as 'ipv6 route 2001:db8:5::/64 GigabitEthernet0/0/1 fe80::2'.
Because link-local addresses (FE80::/10) are reused across multiple interfaces, the router cannot determine which exit interface to use unless specified in the command before the next-hop link-local address.

Key Concept

IPv6 Static Routing with Link-Local Next-Hop
Question 1222Question →

A network engineer is optimizing IPv4 static routing on a Cisco IOS router connected to multiple broadcast Ethernet segments. The router currently learns internal prefix 10.10.10.0/24 via OSPFv2 (Administrative Distance 110). Which TWO statements accurately describe the forwarding and configuration behavior of static routes applied to this router? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configuring 'ip route 10.10.10.0 255.255.255.0 GigabitEthernet0/1 120' creates a floating static route relative to OSPF, but specifying only an Ethernet exit interface forces the router to rely on Proxy ARP from the next-hop device to resolve destination MAC addresses.; Traffic destined to 10.10.10.130 will be forwarded via next-hop 192.168.13.2 when both 'ip route 10.10.10.0 255.255.255.0 192.168.12.2' (AD 1) and 'ip route 10.10.10.128 255.255.255.192 192.168.13.2 130' are in the routing table, because longest prefix match evaluation precedes Administrative Distance comparison.

Answer

The correct options are the statement regarding Proxy ARP dependency when using an Ethernet exit interface for a floating static route with Administrative Distance 120, and the statement confirming that longest prefix match (/26 over /24) dictates path selection over Administrative Distance during packet forwarding.
The option describing a floating static route with AD 120 is correct because floating backup routes must have a higher AD than the primary protocol (OSPF = 110), and specifying an Ethernet interface without a next-hop IP requires Proxy ARP to discover destination MAC addresses. The option addressing destination 10.10.10.130 is also correct because the router prioritizes the most specific prefix match (/26 over /24) during forwarding lookup regardless of the AD of the installed static routes.

Step-by-Step Solution

1
Evaluate floating static route behavior and exit interface considerations.
OSPF has a default AD of 110. A static route configured with AD 120 has a higher distance, floating out of the routing table until OSPF fails. On broadcast Ethernet interfaces, omitting the next-hop IP forces ARP queries for individual target IPs, requiring Proxy ARP on adjacent devices.
Floating routes require AD > primary protocol AD. Broadcast interfaces need explicit next-hop IPs to prevent per-destination ARP lookups.
2
Analyze routing decision hierarchy (Longest Prefix Match vs Administrative Distance).
Administrative distance determines which routes are installed into the routing table. Once installed, packet forwarding decisions rely strictly on the Longest Prefix Match (/26 mask matches 10.10.10.130 more specifically than /24).
Prefix length (/26 > /24) takes absolute priority during active packet forwarding lookup.
3
Identify misconceptions in backup static route AD configuration and default route exit interface usage.
Configuring AD 90 makes the static route primary over OSPF (AD 110), failing the floating backup requirement. Pointing a static route (or default route) solely to an Ethernet exit interface causes severe ARP table expansion.
Lower AD wins installation; broadcast interfaces treat all destinations as local when no next-hop IP is provided.

Key Concept

IPv4 Static Route Selection, Administrative Distance, and Exit Interface Dynamics
Estimated Time:3m 0s
Question 1223Question →

Switch SW2 receives an ingress Ethernet frame on interface GigabitEthernet0/5 configured as an access port in VLAN 20. The frame contains a source MAC address of 0010.ab12.3456 and a destination MAC address of 0010.ab99.8877. A review of SW2's MAC address table reveals that neither MAC address currently exists in the table for VLAN 20. Which two actions does the switch take upon processing this frame? (Select two.)

Select all that apply

Show answer & explanation

Answer: Records MAC address 0010.ab12.3456 associated with interface GigabitEthernet0/5 in the VLAN 20 MAC address table.; Floods the frame out all active interfaces assigned to VLAN 20, excluding interface GigabitEthernet0/5.

Answer

The switch records the source MAC address 0010.ab12.3456 dynamically under GigabitEthernet0/5 in VLAN 20, and floods the unknown unicast frame out all active ports in VLAN 20 except the ingress port GigabitEthernet0/5.
When a switch receives a frame, it performs two distinct steps: learning and forwarding. First, it reads the incoming frame's source MAC address and associates it with the receiving port and VLAN in its MAC address table. Second, it checks the destination MAC address. Because the destination is not in the table, it treats the frame as unknown unicast and floods it out all active ports in the same VLAN except the receiving port.

Step-by-Step Solution

1
Inspect the source MAC address of the ingress frame.
The source MAC address 0010.ab12.3456 is learned on port GigabitEthernet0/5 for VLAN 20 and added/updated in the MAC address table.
Switches build and refresh their Layer 2 forwarding table using incoming source MAC addresses.
2
Inspect the destination MAC address of the ingress frame.
The destination MAC address 0010.ab99.8877 is not found in VLAN 20's MAC address table, classifying it as unknown unicast.
A lookup in the MAC table determines whether known unicast forwarding or unknown unicast flooding is required.
3
Forward the unknown unicast frame according to Layer 2 rules.
The frame is flooded to all active ports belonging to VLAN 20, except GigabitEthernet0/5.
Flooding ensures delivery to the unknown destination while avoiding sending traffic back out the receiving interface.

Key Concept

Layer 2 Switch Learning and Unknown Unicast Flooding
Estimated Time:1m 30s
Question 1224Question →

Refer to the following partial output from the `show ip route` command on a Cisco router:

text
Gateway of last resort is 10.0.0.1 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 10.0.0.1, GigabitEthernet0/0
S 172.20.0.0/16 [1/0] via 10.1.1.1, GigabitEthernet0/1
O 172.20.12.0/24 [110/30] via 10.2.2.2, GigabitEthernet0/2
D 172.20.12.64/27 [90/3072] via 10.3.3.3, GigabitEthernet0/3
S 172.20.12.64/30 [1/0] via 10.4.4.4, GigabitEthernet0/4

The router receives an IP packet destined for 172.20.12.70172.20.12.70. Which TWO statements correctly describe how the router processes and forwards this packet?

Select all that apply

Show answer & explanation

Answer: The router forwards the packet out interface GigabitEthernet0/3 toward next-hop IP 10.3.3.3.; The route 172.20.12.64/27 is selected over 172.20.0.0/16 because Longest Prefix Match takes precedence over Administrative Distance.

Answer

The router forwards the packet out interface GigabitEthernet0/3 toward next-hop IP 10.3.3.3, and the route 172.20.12.64/27 is selected over 172.20.0.0/16 because Longest Prefix Match takes precedence over Administrative Distance.
When a router receives a packet, it compares the destination IP address against all entries in its routing table. The matching route with the longest prefix length (most specific mask) is selected. Here, 172.20.12.70 matches 0.0.0.0/0 (/0), 172.20.0.0/16 (/16), 172.20.12.0/24 (/24), and 172.20.12.64/27 (/27). The /27 route is the longest match, so traffic is sent via next-hop 10.3.3.3 out GigabitEthernet0/3. Administrative Distance is ignored because prefix lengths differ.

Step-by-Step Solution

1
Determine subnet boundaries for all matching route entries against destination IP 172.20.12.70
0.0.0.0/0 matches (/0); 172.20.0.0/16 matches (/16); 172.20.12.0/24 matches (/24); 172.20.12.64/27 covers 172.20.12.64 - 172.20.12.95 and matches (/27); 172.20.12.64/30 covers 172.20.12.64 - 172.20.12.67 and DOES NOT match.
Only routes whose network range actually encompasses the destination IP address can be considered for packet forwarding.
2
Compare prefix lengths among all valid candidate matching routes
Candidate prefix lengths are /0, /16, /24, and /27. The longest prefix match is 172.20.12.64/27.
Cisco forwarding decision logic strictly prefers the route with the most specific (longest) subnet mask regardless of routing protocol origin or Administrative Distance.
3
Identify the egress interface and next-hop address for the winning route 172.20.12.64/27
Next-hop IP is 10.3.3.3 via egress interface GigabitEthernet0/3.
The routing table entry `D 172.20.12.64/27 [90/3072] via 10.3.3.3, GigabitEthernet0/3` directly specifies these parameters.

Key Concept

Router Forwarding Decision Logic and Longest Prefix Match (LPM) Precedence
Question 1225Question →

Match each Cisco Lightweight Access Point (AP) operational mode to its precise operational characteristics and traffic handling behavior within an enterprise deployment.

Click a left item, then click its matching right item

Items

Local Mode
FlexConnect Mode
Rogue Detector Mode
SE-Connect Mode

Matches

Show answer & explanation

Answer

Local Mode pairs with centralized CAPWAP encapsulation of data traffic; FlexConnect Mode pairs with local traffic switching and remote control plane communication; Rogue Detector Mode pairs with disabling radios to monitor wired trunk ARP/MAC tables for rogue correlation; SE-Connect Mode pairs with dedicating radios to raw RF spectrum data collection for external tools.
Each AP operational mode serves a distinct network role: Local mode tunnels all data to the WLC; FlexConnect mode allows local data switching at remote sites; Rogue Detector mode operates on the wired network without transmitting on wireless radios to spot rogue MACs on the switch topology; SE-Connect streams detailed raw RF spectrum diagnostics to dedicated diagnostic software.

Step-by-Step Solution

1
Analyze the operational traffic forwarding mechanics of default AP deployments.
Identify Local mode as requiring centralized CAPWAP data tunneling to the WLC.
In default Local mode, the AP does not switch data locally; all 802.11 traffic is encapsulated into CAPWAP data tunnels.
2
Examine remote branch deployment models where WAN link conservation is required.
Identify FlexConnect mode as enabling local data switching at the branch while maintaining remote WLC management.
FlexConnect segregates data switching to the local VLAN while maintaining CAPWAP control signaling with the controller.
3
Determine which AP mode specializes in wired network security cross-referencing.
Identify Rogue Detector mode as disabling radios and sniffing wired trunk port ARP traffic.
Rogue Detector APs correlate wired MAC/ARP broadcasts with rogue MAC addresses reported by active wireless APs to identify unauthorized wired connections.
4
Evaluate specialized RF troubleshooting modes.
Identify SE-Connect mode as streaming raw physical layer RF spectrum data to diagnostic software.
SE-Connect mode connects directly to Cisco Spectrum Expert for advanced non-Wi-Fi interference analysis.

Key Concept

Cisco Wireless Lightweight Access Point Modes and Traffic Forwarding Architectures
Question 1226Question →

A network technician is installing a new Cisco Lightweight Access Point (LAP) that will operate in default Local mode. The access point connects directly to an access-layer Catalyst switch port and will tunnel all user traffic back to the central Wireless LAN Controller (WLC) via CAPWAP. Which switch port configuration is required to properly support this access point connection?

Show answer & explanation

Answer: An access port assigned to the dedicated VLAN used for AP management traffic.

Answer

An access port assigned to the dedicated VLAN used for AP management traffic.
When a Cisco Access Point operates in standard Local mode, all client traffic is encapsulated within CAPWAP tunnels and sent directly to the Wireless LAN Controller (WLC). The AP itself only requires an IP address on the management network to build the CAPWAP control and data tunnels. Therefore, the connected switch port should be configured as a standard access port assigned to the AP management VLAN.

Step-by-Step Solution

1
Identify the operating mode of the Cisco Lightweight Access Point.
The AP operates in Local mode.
Local mode APs encapsulate all wireless client data inside CAPWAP tunnels back to the WLC.
2
Determine the physical infrastructure switch port requirements for a Local mode AP.
The AP only sends and receives untagged management traffic to establish its CAPWAP tunnel.
Because client VLANs are not locally bridged at the access layer switch, an 802.1Q trunk is unnecessary.
3
Select the correct switch port configuration mode.
Configure the switch interface as an access port in the AP management VLAN.
This provides IP reachability for the AP to discover and join the WLC.

Key Concept

Switch port configuration requirements for Local mode lightweight AP infrastructure connections
Estimated Time:45s
Question 1227Question →

An engineer is diagnosing network initialization delays for point-of-sale terminals connected to a switch. Output from the switch CLI reveals the following interface status:

Switch# show spanning-tree interface gigabitEthernet 1/0/5

Vlan Role Sts Cost Prio.Nbr Type
------------------- ---- --- --------- -------- --------------------------------
VLAN0020 Desg LRN 4 128.5 P2p

Which primary operational benefit is provided by enabling Cisco PortFast on this access port?

Show answer & explanation

Answer: It allows the port to immediately transition from Blocking to Forwarding, avoiding the standard delays associated with Listening and Learning states.

Answer

Enabling PortFast allows an access port connected to an end device to bypass the 802.1D Listening (15s) and Learning (15s) states, transitioning directly from Blocking to Forwarding upon link activation.
In standard 802.1D Spanning Tree Protocol, an interface transitions through Listening (15 seconds) and Learning (15 seconds) states before reaching Forwarding. The CLI output shows the port in the Learning ('LRN') state. Enabling Cisco PortFast on edge ports connected to single end-user devices allows the port to immediately enter the Forwarding state upon linkup, preventing boot and network assignment timeouts.

Step-by-Step Solution

1
Analyze the CLI output for interface status
The interface status code 'LRN' indicates the port is currently in the 802.1D STP Learning state.
Standard 802.1D STP transitions ports through Blocking (20s max age), Listening (15s forward delay), and Learning (15s forward delay) before reaching Forwarding.
2
Determine the impact of PortFast on port state transitions
PortFast immediately places access ports into the Forwarding state upon link up, bypassing Listening and Learning.
End-user devices do not create Layer 2 loops, so waiting 30 seconds for Listening and Learning causes application timeouts (such as DHCP or POS terminal boot routines).

Key Concept

STP Port States and PortFast Benefits
Estimated Time:1m 30s
Question 1228Question →

A network administrator configures a dynamic interface named 'GUEST_DATA' on VLAN 30 on a Cisco Wireless LAN Controller (WLC). The administrator attempts to initiate an SSH session to the IP address assigned to the 'GUEST_DATA' interface for administrative tasks, but the connection is refused. However, SSH access to the WLC Management Interface IP address on VLAN 10 functions properly from the same administrative workstation. Which condition explains why administrative SSH access to the dynamic interface IP address is failing?

Show answer & explanation

Answer: By default, administrative management protocols like SSH are permitted only on the Management Interface and Service Port, whereas dynamic interfaces are restricted to payload traffic for wireless client VLANs.

Answer

By default, administrative management protocols like SSH are permitted only on the Management Interface and Service Port, whereas dynamic interfaces are restricted to payload traffic for wireless client VLANs.
On Cisco Wireless LAN Controllers, administrative access protocols (such as SSH, HTTPS, Telnet, and SNMP) are restricted by default to the Management Interface and the out-of-band Service Port. Dynamic interfaces are created to connect wireless client WLANs to specific wired VLANs, and by default, management traffic directed to dynamic interface IP addresses is ignored/refused for security reasons.

Step-by-Step Solution

1
Identify the functions and roles of WLC logical interfaces (Management Interface, Service Port, and Dynamic Interfaces).
The Management Interface is the primary in-band interface used for controller management and AP CAPWAP tunnels. Dynamic interfaces function like VLAN interfaces for carrying user client traffic.
Understanding interface segregation on Cisco WLCs helps determine where administrative services (SSH/HTTPS) are listening.
2
Analyze default access control rules for management protocols on Cisco WLC interfaces.
Management access over dynamic interfaces is disabled by default to prevent wireless clients on guest or data VLANs from reaching management daemons on the WLC.
Restricting management connections strictly to dedicated management paths maintains security hygiene across wireless segments.

Key Concept

WLC Management Interface Access vs Dynamic Interface Roles
Question 1229Question →

A network administrator is designing a two-tier Spine-Leaf (Clos) topology for a data center expansion. Which two physical interconnection rules must be strictly followed in this architectural model? (Select two.)

Select all that apply

Show answer & explanation

Answer: Spine switches must not connect directly to other spine switches.; Every leaf switch must connect directly to every spine switch in the fabric.

Answer

In a standard two-tier Spine-Leaf topology, spine switches must never connect directly to other spine switches, and every leaf switch must connect directly to every spine switch in the fabric.
In a standard Spine-Leaf architecture, every leaf switch connects to every spine switch in a full mesh, while spine switches never connect directly to one another and leaf switches do not connect directly to other leaf switches. This ensures deterministic two-hop forwarding between any hosts connected to the leaf layer.

Step-by-Step Solution

1
Identify the defining structural rules of a two-tier Spine-Leaf (Clos) network topology.
In Spine-Leaf designs, the architecture is a bipartite graph where leaf nodes connect to spine nodes, but nodes within the same tier do not interconnect.
This guarantees equal distance (two hops) between any two leaf-connected endpoints.
2
Evaluate the requirement regarding spine-to-spine connections.
Direct spine-to-spine links violate Clos topology principles.
Spine switches strictly serve as a high-speed forwarding mesh between leaf switches.
3
Evaluate the requirement regarding leaf-to-spine full-mesh connections.
Each leaf switch connects directly to every spine switch.
This structure enables efficient Equal-Cost Multi-Path (ECMP) forwarding across all available upstream links.

Key Concept

Spine-Leaf (Clos) Interconnection Rules
Estimated Time:1m 30s
Question 1230Question →

An administrator executes the `show ip route` command on a Cisco router and receives the following partial routing table output:

text
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

Gateway of last resort is 10.5.5.5 to network 0.0.0.0

S 172.16.0.0/16 [1/0] via 10.1.1.1, GigabitEthernet0/0
D 172.16.24.0/22 [90/2170112] via 10.2.2.2, GigabitEthernet0/1
O 172.16.25.0/25 [110/20] via 10.3.3.3, GigabitEthernet0/2
D 172.16.25.96/28 [90/307200] via 10.4.4.4, GigabitEthernet0/3
S* 0.0.0.0/0 [1/0] via 10.5.5.5, GigabitEthernet0/4

When a frame containing an IPv4 packet destined for 172.16.25.100172.16.25.100 arrives at this router, which next-hop IP address and egress interface will be selected to forward the packet?

Show answer & explanation

Answer: 10.4.4.4 via GigabitEthernet0/3

Answer

10.4.4.4 via GigabitEthernet0/3
When a router makes a forwarding decision, it evaluates all matching entries in the routing table according to the Longest Prefix Match rule. Subnet 172.16.25.96/28 covers IP addresses from 172.16.25.96 to 172.16.25.111, including 172.16.25.100. Because /28 is the longest (most specific) prefix matching this destination, the router selects next-hop 10.4.4.4 via GigabitEthernet0/3 regardless of lower administrative distances on less specific routes.

Step-by-Step Solution

1
Identify all candidate routes matching destination IP 172.16.25.100172.16.25.100
Candidate routes are 172.16.0.0/16, 172.16.24.0/22, 172.16.25.0/25, 172.16.25.96/28, and default route 0.0.0.0/0.
Before comparing administrative distance or metrics, the router finds all routing table entries that cover the destination address.
2
Determine the host range of the subnet 172.16.25.96/28
The subnet range for 172.16.25.96/28 spans from 172.16.25.96 to 172.16.25.111.
A prefix length of /28 yields a block size of 2(32−28)=162^{(32-28)} = 16 IP addresses. Destination 172.16.25.100172.16.25.100 falls within 172.16.25.96−172.16.25.111172.16.25.96 - 172.16.25.111.
3
Apply the Longest Prefix Match (LPM) rule
Compare subnet mask lengths: /28 > /25 > /22 > /16 > /0. The route for 172.16.25.96/28 has the longest prefix match.
Longest prefix match is the primary criterion in router forwarding logic, overriding Administrative Distance and routing protocol metrics.
4
Determine next-hop IP and egress interface
Next-hop 10.4.4.4 via GigabitEthernet0/3.
The matching /28 entry specifies next-hop IP 10.4.4.4 out interface GigabitEthernet0/3.

Key Concept

Longest Prefix Match (LPM) Rule in Forwarding Logic
Estimated Time:2m 0s
Question 1231Question →

Refer to the following routing table output from a Cisco router:

text
Gateway of last resort is 10.0.0.1 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 10.0.0.1
S 192.168.0.0/16 [1/0] via 10.1.1.1
O 192.168.10.0/24 [110/20] via 10.2.2.2, 00:05:12, GigabitEthernet0/1
D 192.168.10.32/28 [90/2170112] via 10.3.3.3, 00:12:45, GigabitEthernet0/2

When a packet destined for 192.168.10.45192.168.10.45 arrives at the router, which next-hop IP address will be selected to forward the packet?

Show answer & explanation

Answer: 10.3.3.3

Answer

10.3.3.3
When forwarding an IP packet, a router first checks all entries in its routing table to find routes that match the destination IP address. If multiple matching routes exist, the router always selects the route with the longest prefix mask (most specific match). The destination 192.168.10.45 falls into the range 192.168.10.32 through 192.168.10.47 provided by the /28 route. Because /28 is longer than /24, /16, and /0, the next-hop IP 10.3.3.3 is chosen.

Step-by-Step Solution

1
Identify all matching routes for destination IP 192.168.10.45
Matching routes are 0.0.0.0/0, 192.168.0.0/16, 192.168.10.0/24, and 192.168.10.32/28.
The destination IP address falls within the network range of all four route entries.
2
Apply the Longest Prefix Match (LPM) rule to compare prefix lengths
Prefix lengths are /0, /16, /24, and /28. The /28 prefix is the longest (most specific).
Routers always evaluate prefix length first before comparing Administrative Distance or Metric.
3
Determine the next-hop IP associated with the longest prefix match route
The route 192.168.10.32/28 specifies next-hop IP 10.3.3.3.
The packet is forwarded to the next-hop IP associated with the winning prefix route.

Key Concept

Longest Prefix Match (LPM) rule in router forwarding decision logic
Question 1232Question →

A network engineer is tasked with deploying a new WPA2-Enterprise wireless network on a Cisco Wireless LAN Controller (WLC) using the web GUI. The WLAN must enforce 802.1X authentication via an external RADIUS server and support dynamic VLAN assignment using AAA override. What is the correct chronological sequence of steps to configure this WLAN on the WLC GUI from initial creation to feature enablement?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for configuring a WPA2-Enterprise WLAN with AAA Override on a Cisco WLC GUI is: 1) Create New WLAN (define Profile Name/SSID), 2) Set Interface and Enable Status under General tab, 3) Set WPA2-AES and 802.1X under Security > Layer 2 tab, 4) Select RADIUS Server under Security > AAA Servers tab, and 5) Enable Allow AAA Override under Advanced tab.
The correct procedural order follows standard Cisco WLC administration logic: First, create the WLAN instance with its Profile Name and SSID. Next, configure fundamental interface mapping and admin status on the General tab. Then, configure Layer 2 security for WPA2-Enterprise (802.1X AKM) on the Security > Layer 2 tab. Fourth, link the global RADIUS server under the Security > AAA Servers tab. Finally, navigate to the Advanced tab to enable 'Allow AAA Override' for dynamic VLAN steering.

Step-by-Step Solution

1
Initiate WLAN creation in WLC GUI
WLAN ID is allocated and initial Profile Name and SSID parameters are bound to the controller database.
You cannot configure specific WLAN sub-tabs until the WLAN instance is created via WLANs > Create New.
2
Configure General tab settings
The WLAN is associated with a distribution interface/interface group and marked administratively enabled.
Binding to an interface provides network pathing for client traffic.
3
Configure Layer 2 Security parameters
Layer 2 security policy is set to WPA2 with AES cipher and 802.1X key management.
Specifying 802.1X key management is a prerequisite for utilizing RADIUS EAP-based client authentication.
4
Bind RADIUS Server under AAA Servers tab
The WLAN targets the specific external RADIUS server for client EAP authentication transactions.
Without selecting an active RADIUS server under AAA Servers, 802.1X authentication requests will fail.
5
Enable AAA Override on Advanced tab
The controller honors RADIUS-returned VLAN attributes (IETF 64, 65, 81) to override the default WLAN interface assignment per user.
AAA Override functionality is disabled by default and resides specifically under the WLAN Advanced settings tab.

Key Concept

WLC GUI WLAN Configuration Workflow and Feature Navigation
Estimated Time:2m 30s
Question 1233Question →

Refer to the following routing table snippet from a Cisco router:

text
Codes: C - connected, S - static, R - RIP, B - BGP, O - OSPF, D - EIGRP
Gateway of last resort is 10.0.0.1 to network 0.0.0.0

D 172.16.0.0/16 [90/2172416] via 10.10.10.2, GigabitEthernet0/0/1
O 172.16.32.0/19 [110/30] via 10.20.20.2, GigabitEthernet0/0/2
S 172.16.32.0/21 [1/0] via 10.30.30.2, GigabitEthernet0/0/3
O 172.16.36.0/24 [110/10] via 10.40.40.2, GigabitEthernet0/0/4
S* 0.0.0.0/0 [1/0] via 10.0.0.1, GigabitEthernet0/0/0

Which two statements correctly describe how the router forwards traffic based on this routing table? (Select two.)

Select all that apply

Show answer & explanation

Answer: A packet destined for 172.16.36.50 is forwarded out GigabitEthernet0/0/4 because 172.16.36.0/24 provides the longest prefix match.; A packet destined for 172.16.40.1 is forwarded out GigabitEthernet0/0/2 because 172.16.32.0/19 is a more specific match than 172.16.0.0/16.

Answer

The router forwards traffic destined for 172.16.36.50 out GigabitEthernet0/0/4 based on the /24 longest prefix match, and forwards traffic destined for 172.16.40.1 out GigabitEthernet0/0/2 based on the /19 longest prefix match.
When a router performs a destination lookup, it selects the route with the most specific match (longest prefix length, or highest subnet mask number). The administrative distance and routing metric are ignored during this lookup phase because the candidate routes represent different destination network ranges. Therefore, 172.16.36.50 matches the /24 route out GigabitEthernet0/0/4, while 172.16.40.1 falls within the 172.16.32.0/19 subnet (range 172.16.32.0 to 172.16.63.255) and matches /19 over /16.

Step-by-Step Solution

1
Evaluate subnet membership for destination 172.16.36.50.
Matches 172.16.0.0/16, 172.16.32.0/19, 172.16.32.0/21, and 172.16.36.0/24.
Determining all eligible route entries in the routing table for the destination IP.
2
Apply the Longest Prefix Match rule to selection for 172.16.36.50.
Select 172.16.36.0/24 (via 10.40.40.2 on GigabitEthernet0/0/4).
Prefix length /24 has the most matching high-order bits (24 bits), overriding Administrative Distance.
3
Evaluate subnet membership for destination 172.16.40.1.
Matches 172.16.0.0/16 and 172.16.32.0/19 (range 172.16.32.0 to 172.16.63.255). Does not match 172.16.32.0/21 (range 172.16.32.0 to 172.16.39.255) or 172.16.36.0/24.
Calculating subnet boundary limits for /19 and /21.
4
Apply the Longest Prefix Match rule to selection for 172.16.40.1.
Select 172.16.32.0/19 (via 10.20.20.2 on GigabitEthernet0/0/2).
/19 is a longer prefix match than /16.

Key Concept

Router Forwarding Decision Logic (Longest Prefix Match Rule)
Estimated Time:2m 0s
Question 1234Question →

Refer to the following partial IPv4 routing table output from a Cisco router:

Codes: C - connected, S - static, O - OSPF, D - EIGRP

Gateway of last resort is not set

172.16.0.0/16 is subnetted, 3 subnets
S 172.16.0.0/16 [1/0] via 10.1.1.1
O 172.16.32.0/24 [110/20] via 10.2.2.2
D 172.16.32.32/27 [90/307200] via 10.3.3.3

If the router receives an IP packet destined for 172.16.32.45172.16.32.45, to which next-hop IP address will the packet be forwarded?

Show answer & explanation

Answer: 10.3.3.3

Answer

The router will forward the packet to next-hop IP address 10.3.3.3 because 172.16.32.32/27 is the longest matching prefix for destination IP 172.16.32.45.
When a router performs a forwarding lookup for destination IP address 172.16.32.45, it checks all matching entries in its routing table. The destination address 172.16.32.45 matches 172.16.0.0/16, 172.16.32.0/24, and 172.16.32.32/27 (which covers host IP addresses from 172.16.32.33 through 172.16.32.62). The /27 route matches 27 continuous network bits, which is the longest prefix match compared to /24 or /16. Therefore, the router forwards the packet to 10.3.3.3.

Step-by-Step Solution

1
Evaluate all routes in the routing table against destination IP 172.16.32.45
Three routes match: 172.16.0.0/16, 172.16.32.0/24, and 172.16.32.32/27 (since range .32 to .63 contains .45).
Routing decision logic requires identifying all candidate routes that encompass the destination IP.
2
Compare subnet mask lengths to determine the Longest Prefix Match (LPM)
The prefix length /27 (27 bits) is greater than /24 (24 bits) and /16 (16 bits).
The router always prefers the most specific route (longest subnet mask / highest number of matching network bits) regardless of Administrative Distance or metric.
3
Identify the next-hop address associated with the longest matching route
The route 172.16.32.32/27 specifies next-hop 10.3.3.3.
Packet forwarding uses the next-hop associated with the route selected by LPM.

Key Concept

Router Forwarding Decision Logic & Longest Prefix Match (LPM)
Question 1235Question →

A Cisco router receives an IPv4 packet on an ingress interface that must be forwarded to a remote destination. Place the router forwarding decision and processing steps in the correct chronological order from packet arrival to egress transmission.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of router forwarding decision steps is: 1. Extract the destination IPv4 address from the incoming packet header. 2. Search the routing table for matching entries and select the route with the longest prefix mask. 3. Identify the designated exit interface and next-hop IPv4 address from the winning route entry. 4. Query the ARP cache to resolve the Layer 2 MAC address associated with the next-hop IPv4 address. 5. Decrement the IPv4 Time-to-Live (TTL) value, recalculate the header checksum, and encapsulate the packet into a new Layer 2 frame for egress.
When an IPv4 packet arrives on a router interface, the router first parses the IP header to extract the destination IP address. Next, it consults the routing table to find matching network prefixes, selecting the route entry with the longest prefix mask (most specific match). From this winning entry, the router extracts the designated exit interface and next-hop IP. It then queries its ARP cache to discover the destination MAC address corresponding to that next-hop IP. Finally, the router modifies the IP header by decrementing the TTL and recalculating the checksum, encapsulates the packet in a fresh Layer 2 frame with new source/destination MAC addresses, and transmits it out the exit interface.

Step-by-Step Solution

1
Packet Ingress and IP Parsing
The router receives the Layer 2 frame, verifies the checksum, and extracts the target IPv4 destination address.
The router cannot perform routing table lookups until the destination IP address is identified.
2
Routing Table Lookup via Longest Prefix Match
The router compares the destination IP against entries in the routing table and selects the prefix with the greatest number of matching subnet bits.
Longest Prefix Match (LPM) is the fundamental rule governing packet forwarding lookup in IP routing tables.
3
Forwarding Information Extraction
The winning route entry reveals the egress interface and the next-hop gateway address.
The next-hop address and exit interface are required to prepare the outgoing data link layer frame.
4
Layer 2 Address Resolution
The router looks up the next-hop IPv4 address in its ARP table to find its corresponding MAC address.
Ethernet encapsulation requires a valid destination MAC address for the next-hop device on the multi-access segment.
5
Header Modification and Egress Encapsulation
The router decrements TTL, updates the IP checksum, wraps the packet in a new Layer 2 frame with local source MAC and next-hop destination MAC, and transmits it.
This completes the Layer 3 forwarding operation and sends the packet toward its final destination.

Key Concept

Router Forwarding Decision Logic and Packet Lifecycle
Question 1236Question →

A network administrator is optimizing a Cisco Catalyst switch that connects desktop computers and IP phones across access ports. The administrator enables Cisco STP PortFast on these access interfaces. Which two operational behaviors or benefits occur on a PortFast-enabled access interface when a device connects to it? (Select two.)

Select all that apply

Show answer & explanation

Answer: The interface transitions immediately from the Blocking state to the Forwarding state, bypassing the Listening and Learning states.; The switch suppresses Spanning Tree Topology Change Notification (TCN) messages when the interface state changes.

Answer

PortFast immediately transitions an access port to the Forwarding state by bypassing the Listening and Learning states, and it prevents the switch from issuing Topology Change Notifications (TCNs) when edge interfaces flap.
Enabling Cisco STP PortFast on edge ports provides two primary operational behaviors: first, it bypasses the 802.1D Listening and Learning states so the port enters the Forwarding state immediately upon link up. Second, it prevents the switch from generating Topology Change Notifications (TCNs) when the link toggles, protecting the network from frequent, unnecessary MAC table flushes.

Step-by-Step Solution

1
Analyze the function of STP PortFast on edge ports.
PortFast is intended for edge ports connected to end hosts, allowing immediate transition to Forwarding.
By skipping the 15-second Listening and 15-second Learning timer delays (30 seconds total convergence delay in 802.1D STP), end devices avoid DHCP and application initialization timeouts.
2
Evaluate the impact of PortFast on switch topology updates.
No TCN BPDUs are generated when a PortFast-enabled interface changes link state.
Link state changes on user workstations occur frequently and should not cause the rest of the network to flush MAC address tables.

Key Concept

STP PortFast Benefits and Operational Behavior
Question 1237Question →

An enterprise network engineer is designing a network topology for a multi-story office campus. The design requires a designated functional layer to handle inter-VLAN routing, access control list (ACL) filtering, broadcast domain boundaries, and policy-based traffic control before passing traffic to the high-speed campus backbone. Which tier of the standard Cisco three-tier hierarchical model is specifically responsible for performing these functions?

Show answer & explanation

Answer: Distribution layer

Answer

The Distribution layer is the functional tier responsible for inter-VLAN routing, security policies, and broadcast boundaries in a three-tier campus architecture.
In the standard Cisco three-tier enterprise campus design, the distribution layer acts as the aggregation point for access layer switches and serves as the Layer 3 routing boundary. It is specifically designed to handle inter-VLAN routing, policy enforcement (such as ACL filtering and QoS marking), address summarization, and boundary isolation for broadcast domains.

Step-by-Step Solution

1
Analyze the functional requirements stated in the scenario
Identified requirements: inter-VLAN routing, ACL security filtering, broadcast domain boundary enforcement, and traffic policy control.
Determining which architectural layer aligns with these policy and routing responsibilities is key to solving the problem.
2
Map requirements to the Cisco three-tier campus model layers
Access layer handles end-host connectivity; Core layer handles high-speed packet transport; Distribution layer aggregates access switches and enforces routing/security policies.
Each hierarchical layer has isolated responsibilities to preserve scalability, predictability, and fault tolerance.
3
Select the layer that performs aggregation and control boundary functions
The Distribution layer matches all required capabilities.
It acts as the Layer 3 boundary between Layer 2 access switches and the Layer 3 core backbone.

Key Concept

Cisco Three-Tier Hierarchical Campus Model - Distribution Layer Responsibilities
Estimated Time:1m 15s
Question 1238Question →

An engineer evaluates an operational Cisco router process handling an incoming packet addressed to target host 172.16.35.45. The active IPv4 routing database displays the following entries:

S 172.16.32.0/20 [1/0] via 10.1.1.1
D 172.16.32.0/21 [90/307200] via 10.3.3.3
O 172.16.35.0/26 [110/65] via 10.2.2.2
B 172.16.0.0/16 [20/0] via 10.4.4.4

Which next-hop IP address will be utilized to transmit this traffic?

Show answer & explanation

Answer: 10.2.2.2

Answer

10.2.2.2 is selected because the OSPF route 172.16.35.0/26 provides the longest prefix match (/26) for the destination IP address 172.16.35.45.
When a router performs a forwarding lookup for a destination IP address (172.16.35.45), it evaluates all matching prefix entries in the IPv4 routing table. In this case, 172.16.35.45 falls into the network ranges of all four listed prefixes (/16, /20, /21, and /26). According to the Longest Prefix Match principle, the router selects the entry with the highest mask length (/26). Therefore, the packet is forwarded to next-hop 10.2.2.2 associated with 172.16.35.0/26.

Step-by-Step Solution

1
Determine subnet boundaries for all routing table entries relative to destination 172.16.35.45
172.16.0.0/16 covers 172.16.0.0 - 172.16.255.255 (Match length /16).
172.16.32.0/20 covers 172.16.32.0 - 172.16.47.255 (Match length /20).
172.16.32.0/21 covers 172.16.32.0 - 172.16.39.255 (Match length /21).
172.16.35.0/26 covers 172.16.35.0 - 172.16.35.63 (Match length /26).
All four entries contain the destination IP address 172.16.35.45.
2
Apply the Longest Prefix Match (LPM) rule to select the forwarding entry
The route with subnet mask /26 (172.16.35.0/26) has the greatest number of matching network bits (26 bits).
Cisco routers always evaluate the most specific route (longest subnet mask) first during packet forwarding decisions, prior to administrative distance or metric comparisons.
3
Identify the next-hop address associated with the chosen /26 route
The route O 172.16.35.0/26 is reachable via next-hop 10.2.2.2.
The next-hop address specified in the routing table for the /26 network is 10.2.2.2.

Key Concept

Longest Prefix Match Rule
Estimated Time:1m 30s
Question 1239Question →

A network engineer is configuring a static route on a Cisco router to reach remote network 2001:db8:3c4d:10::/642001:\text{db8}:3\text{c}4\text{d}:10::/64. The adjacent router's interface uses the link-local IPv6 address fe80::1\text{fe80}::1 and is directly attached to local interface GigabitEthernet0/0/1\text{GigabitEthernet0/0/1}. Which Cisco IOS command correctly establishes this static route?

Show answer & explanation

Answer: ipv6 route 2001:db8:3c4d:10::/64 GigabitEthernet0/0/1 fe80::1

Answer

The command 'ipv6 route 2001:db8:3c4d:10::/64 GigabitEthernet0/0/1 fe80::1' correctly configures the fully specified static route.
When configuring an IPv6 static route using a link-local next-hop address, Cisco IOS requires a fully specified static route that includes both the local exit interface and the link-local next-hop IPv6 address. This is required because link-local IPv6 addresses are only unique on a single link and could be used on multiple interfaces simultaneously.

Step-by-Step Solution

1
Identify the target IPv6 static routing command keyword and prefix syntax.
IPv6 static routes must begin with 'ipv6 route' followed by the target destination prefix and prefix length (2001:db8:3c4d:10::/642001:\text{db8}:3\text{c}4\text{d}:10::/64).
Cisco IOS requires the explicit 'ipv6 route' keyword for IPv6 routing entries.
2
Determine the requirement for using link-local next-hop addresses.
Because link-local addresses (FE80::/10) are link-specific and can exist on multiple interfaces of the same router, Cisco IOS cannot resolve the exit interface implicitly.
Specifying both the local interface and the link-local next-hop address (fully specified static route) eliminates exit interface ambiguity.

Key Concept

IPv6 Fully Specified Static Route with Link-Local Next-Hop
Question 1240Question →

A network administrator needs to configure an IPv6 static route on a Cisco IOS router for the destination network 2001:db8:acad:10::/642001:\text{db8}:\text{acad}:10::/64. The next-hop router's link-local IPv6 address is fe80::1\text{fe80}::1, and the local exit interface is GigabitEthernet0/0/1. Which Cisco IOS command correctly configures this static route?

Show answer & explanation

Answer: ipv6 route 2001:db8:acad:10::/64 GigabitEthernet0/0/1 fe80::1

Answer

The command 'ipv6 route 2001:db8:acad:10::/64 GigabitEthernet0/0/1 fe80::1' correctly configures the static route.
When pointing an IPv6 static route to a link-local next-hop address, Cisco IOS requires both the outbound exit interface and the next-hop IPv6 address to be specified. The syntax 'ipv6 route <destination-prefix> <exit-interface> <link-local-address>' satisfies this requirement.

Step-by-Step Solution

1
Identify the destination prefix and mask
The target network is 2001:db8:acad:10::/64.
Static routes in Cisco IOS require the destination network prefix first.
2
Evaluate the requirements for using a link-local next-hop address
Link-local addresses (fe80::/10) are ambiguous because they exist on every interface.
Cisco IOS requires specifying the exit interface along with the link-local next-hop address.
3
Construct the exact Cisco IOS IPv6 static route command syntax
ipv6 route 2001:db8:acad:10::/64 GigabitEthernet0/0/1 fe80::1
The correct format is 'ipv6 route <prefix/length> <exit-interface> <next-hop-address>'.

Key Concept

IPv6 Static Route Link-Local Next-Hop Configuration
PreviousPage 62 / 100Next
All practice questions — Cisco CCNA | Examkin