All practice questions

229 questions

Question 121Question

In an enterprise network infrastructure, AAA services and security protocols provide identity verification, access control, and activity tracking for administrative sessions. Match each operational requirement or behavioral characteristic on the left with its corresponding AAA framework pillar or security protocol on the right.

Click a left item, then click its matching right item

Items

Determining whether an authenticated network engineer has permission to execute specific configuration commands on a switch.
Tracking and logging the start time, duration, and commands executed during an active CLI maintenance session.
Encrypting only the user password within the Access-Request packet payload while operating over UDP transport.
Encrypting the entire payload body of every communication packet exchanged over TCP port 49.

Matches

Show answer & explanation

Answer

The items correctly match as follows: Authorization corresponds to controlling command execution rights; Accounting corresponds to session duration and command execution logging; RADIUS protocol corresponds to password-only encryption over UDP; TACACS+ protocol corresponds to full packet payload encryption over TCP port 49.
Authorization handles user permissions and command execution rights, while Accounting handles session auditing and activity logs. From a protocol standpoint, RADIUS encrypts only the password using UDP, whereas TACACS+ encrypts the entire payload using TCP port 49.

Step-by-Step Solution

1
Analyze the access control requirement for command execution.
Matches Authorization.
Authorization defines what actions, services, or commands an authenticated entity is permitted to perform.
2
Analyze the logging and reporting requirement for CLI activity.
Matches Accounting.
Accounting records session usage data, timestamping, and user activities for audit trails.
3
Analyze protocol transport and encryption behavior for partial payload protection.
Matches RADIUS protocol.
RADIUS relies on UDP transport and limits its encryption to the user password field.
4
Analyze protocol transport and encryption behavior for full payload protection.
Matches TACACS+ protocol.
TACACS+ uses reliable TCP transport on port 49 and encrypts all packet payloads.

Key Concept

AAA Pillars and AAA Protocol Mechanics (TACACS+ vs RADIUS)
Question 122Question

Match each AAA framework component or protocol characteristic on the left with its correct functional description on the right.

Click a left item, then click its matching right item

Items

Authentication
Authorization
Accounting
TACACS+ Payload Security

Matches

Show answer & explanation

Answer

Authentication matches identity verification; Authorization matches permission control for commands and resources; Accounting matches activity logging and tracking; TACACS+ Payload Security matches encrypting the entire packet body.
Authentication verifies identity, Authorization controls access permissions and allowed CLI commands, Accounting logs user activity for security compliance, and TACACS+ encrypts the entire packet payload.

Step-by-Step Solution

1
Identify the primary function of Authentication within the AAA framework.
Authentication answers 'Who are you?' by verifying user credentials such as usernames and passwords.
It acts as the initial control point to validate user identity prior to granting system entry.
2
Identify the primary function of Authorization.
Authorization answers 'What can you do?' by determining privilege levels and permitted commands.
Once identity is established, privilege boundaries dictate accessible resources.
3
Identify the primary function of Accounting.
Accounting answers 'What did you do?' by collecting statistics, command history, and session durations.
Security compliance mandates keeping track of active sessions and administrative actions.
4
Analyze TACACS+ encryption behavior.
TACACS+ encrypts the entire payload body of each frame sent over TCP port 49.
This provides end-to-end payload confidentiality, contrasting with RADIUS which encrypts only the password field.

Key Concept

AAA Framework Pillars and TACACS+ vs RADIUS Security Mechanics
Question 123Question

A network security administrator is configuring centralized access control services across enterprise switches and routers. Match each operational capability or requirement on the left with the correct AAA framework element or protocol specification on the right.

Click a left item, then click its matching right item

Items

Per-command administrative authorization during active CLI management sessions
Payload encryption that obfuscates the entire packet body following the header
Authentication and authorization coupled together within single request/response pairs
Tracking user session duration, login timestamps, and commands executed for audit compliance

Matches

Show answer & explanation

Answer

Per-command CLI authorization matches TACACS+ architecture leveraging TCP port 49 and decoupled AAA functions. Full payload body encryption matches TACACS+ transport security mechanism providing full-body packet protection. Coupled authentication and authorization matches RADIUS protocol operation leveraging UDP ports 1812 and 1813. Session tracking and audit logging matches the Accounting component of the AAA framework.
TACACS+ uses TCP port 49 and decouples AAA functions to permit per-command authorization and full packet payload encryption. RADIUS operates over UDP ports 1812 (Authentication/Authorization) and 1813 (Accounting), combining authentication and authorization in a single transaction while only encrypting passwords. Accounting tracks user session metrics and activity logs.

Step-by-Step Solution

1
Analyze protocol modularity for per-command authorization.
Identified TACACS+ as the protocol that decouples AAA services, allowing individual command authorization over TCP port 49.
RADIUS binds authentication and authorization together, making fine-grained CLI command authorization impossible.
2
Evaluate packet encryption methods between AAA protocols.
Matched full body encryption to TACACS+, which encrypts the entire payload after the 12-byte header.
RADIUS only encrypts the password field in Access-Request packets, leaving the rest of the packet body in cleartext.
3
Identify protocol binding for combined authentication/authorization.
Matched combined authentication and authorization to RADIUS over UDP ports 1812/1813.
RADIUS returns authorization attributes directly inside the Access-Accept response during authentication.
4
Determine the functional role of audit logging in AAA.
Matched session duration and command execution tracking to the Accounting framework pillar.
Accounting logs user activities and resource usage after authentication and authorization occur.

Key Concept

AAA Protocol Mechanics & Functional Separation (TACACS+ vs RADIUS)
Estimated Time:1m 30s
Question 124Question

Match each wireless security protocol or mode with its primary key exchange mechanism or encryption characteristic.

Click a left item, then click its matching right item

Items

WPA2-Personal
WPA3-Personal
WPA3-Enterprise (192-bit mode)
Opportunistic Wireless Encryption (OWE)

Matches

Show answer & explanation

Answer

WPA2-Personal pairs with CCMP (AES-128) and PSK 4-way handshake; WPA3-Personal pairs with Simultaneous Authentication of Equals (SAE); WPA3-Enterprise (192-bit mode) pairs with GCMP-256, EAP-TLS, and PMF; OWE pairs with unauthenticated encryption on open networks using Diffie-Hellman key exchange.
Each wireless security protocol uses distinct key exchange mechanisms and encryption ciphers: WPA2-Personal relies on PSK with CCMP (AES-128); WPA3-Personal introduces SAE to mitigate dictionary attacks; WPA3-Enterprise 192-bit mode mandates GCMP-256 and EAP-TLS; OWE delivers unauthenticated encryption over open networks using Diffie-Hellman key exchanges.

Step-by-Step Solution

1
Identify the authentication and encryption suite for legacy WPA2-Personal.
WPA2-Personal uses PSK authentication with a 4-way handshake and CCMP (AES-128) encryption.
This is the baseline IEEE 802.11i implementation for pre-shared key deployments.
2
Identify the key exchange enhancement in WPA3-Personal.
WPA3-Personal mandates Simultaneous Authentication of Equals (SAE).
SAE prevents password guessing attacks by validating authentication without exposing pre-shared secrets.
3
Identify the high-security requirements of WPA3-Enterprise 192-bit mode.
It specifies GCMP-256 cipher suite along with EAP-TLS and mandatory PMF.
Enterprise 192-bit mode enforces top-tier cryptographic standards for sensitive deployments.
4
Identify the role of Opportunistic Wireless Encryption (OWE).
OWE encrypts traffic over open wireless networks using Diffie-Hellman key negotiation.
OWE allows open hotspots to encrypt wireless transmission without requiring user passphrases.

Key Concept

Wireless Security Protocols (WPA, WPA2, WPA3, OWE)
Estimated Time:1m 30s
Question 125Question

Match each wireless security protocol or feature to its defining operational characteristic.

Click a left item, then click its matching right item

Items

Protected Management Frames (PMF)
Temporal Key Integrity Protocol (TKIP)
Opportunistic Wireless Encryption (OWE)
Simultaneous Authentication of Equals (SAE)

Matches

Show answer & explanation

Answer

Protected Management Frames (PMF) matches securing unicast/multicast management frames; TKIP matches legacy RC4 encapsulation with key mixing; OWE matches unauthenticated encryption on open networks; SAE matches prevention of offline dictionary attacks via Dragonfly key exchange.
Each protocol or mechanism serves a distinct function within wireless security architectures: PMF protects management action frames from forgery, TKIP relies on RC4 for legacy WPA security, OWE provides unauthenticated encryption for open access, and SAE uses Dragonfly key exchange to secure pre-shared key establishment in WPA3-Personal.

Step-by-Step Solution

1
Identify the primary role of Protected Management Frames (PMF)
PMF (IEEE 802.11w) protects management frames (such as deauth packets) against spoofing and eavesdropping; it is mandatory in WPA3.
Security standards mandate PMF to prevent common Wireless Denial of Service (DoS) attacks.
2
Identify the encryption characteristics of Temporal Key Integrity Protocol (TKIP)
TKIP uses RC4 stream cipher with dynamic temporal key mixing as an upgrade path from WEP.
TKIP was designed to run on legacy WEP hardware while fixing key reuse flaws.
3
Identify the operation of Opportunistic Wireless Encryption (OWE)
OWE uses Diffie-Hellman key exchange to encrypt open Wi-Fi networks without requiring client authentication.
Enhanced Open (OWE) provides opportunistic privacy for guest networks without passphrase configuration.
4
Identify the authentication protocol used in Simultaneous Authentication of Equals (SAE)
SAE utilizes the Dragonfly handshake algorithm to negotiate shared keys securely and neutralize offline dictionary attacks.
SAE replaces the traditional 4-way handshake PSK model in WPA3-Personal.

Key Concept

Wireless Security Protocols and Cipher Mechanics
Question 126Question

Match each wireless security framework or protocol with its primary key exchange or encryption mechanism.

Click a left item, then click its matching right item

Items

WPA3-Personal
WPA2-Enterprise
Enhanced Open (OWE)
WPA-Personal (Legacy)

Matches

Show answer & explanation

Answer

WPA3-Personal matches with SAE key exchange. WPA2-Enterprise matches with 802.1X/RADIUS authentication. Enhanced Open (OWE) matches with unauthenticated Diffie-Hellman encryption. WPA-Personal matches with deprecated TKIP/RC4 encryption.
Each wireless protocol maps to its distinct standard implementation: WPA3-Personal uses SAE for Dragonfly key exchange, WPA2-Enterprise mandates 802.1X/EAP with RADIUS, Enhanced Open provides OWE encryption for unauthenticated networks, and legacy WPA uses TKIP.

Step-by-Step Solution

1
Identify key characteristics of WPA3-Personal.
WPA3-Personal introduces SAE (Simultaneous Authentication of Equals) to eliminate offline brute-force attacks.
SAE is the hallmark replacement for PSK in WPA3.
2
Identify key characteristics of WPA2-Enterprise.
Enterprise modes specifically demand 802.1X with EAP and RADIUS servers.
Personal modes use pre-shared keys, whereas Enterprise modes use centralized AAA architecture.
3
Identify key characteristics of Enhanced Open (OWE).
Enhanced Open uses OWE (Diffie-Hellman key exchange) to encrypt traffic on open networks without password entry.
OWE protects public Wi-Fi eavesdropping without authentication.
4
Identify key characteristics of WPA-Personal (Legacy).
Legacy WPA relied on TKIP/RC4 prior to the introduction of CCMP/AES in WPA2.
TKIP was designed as an interim migration path from WEP.

Key Concept

Wireless Security Protocols and Authentication/Encryption Mechanisms
Question 127Question

Network administrators use Layer 2 discovery protocols to discover adjacent network hardware and verify topology details. Match each Layer 2 discovery protocol attribute on the left with its corresponding protocol characteristic or default value on the right.

Click a left item, then click its matching right item

Items

IEEE 802.1AB
Cisco Proprietary Discovery Protocol
Default CDP Holdtime
Default LLDP Holdtime

Matches

Show answer & explanation

Answer

IEEE 802.1AB matches Open vendor-neutral standard for Link Layer Discovery Protocol (LLDP); Cisco Proprietary Discovery Protocol matches Cisco Discovery Protocol (CDP); Default CDP Holdtime matches 180 seconds; Default LLDP Holdtime matches 120 seconds.
IEEE 802.1AB is the formal standard specification for LLDP. CDP is Cisco's proprietary discovery protocol. CDP defaults to an update timer of 60 seconds and a holdtime of 180 seconds, while LLDP defaults to a transmit timer of 30 seconds and a holdtime of 120 seconds.

Step-by-Step Solution

1
Identify the standard governing LLDP.
LLDP is defined under IEEE 802.1AB.
IEEE 802.1AB provides an open standard for neighbor discovery across multi-vendor equipment.
2
Identify the ownership model of CDP.
CDP is Cisco proprietary.
CDP was created by Cisco to allow Cisco switches, routers, and devices to discover each other.
3
Calculate or recall the default CDP holdtime.
The CDP holdtime defaults to 180 seconds.
CDP transmits messages every 60 seconds, and the default holdtime is set to 3 update intervals (180 seconds).
4
Calculate or recall the default LLDP holdtime.
The LLDP holdtime defaults to 120 seconds.
LLDP uses a default transmit timer of 30 seconds with a default holdtime multiplier of 4, producing a 120-second holdtime.

Key Concept

Distinguishing characteristics, standards, and default timers of CDP and LLDP.
Question 128Question

An enterprise network administrator is deploying Cisco Lightweight Access Points (LAPs) across various branch offices and corporate facilities. Match each Cisco AP operational mode on the left with its correct functional description on the right.

Click a left item, then click its matching right item

Items

Monitor Mode
Sniffer Mode
Rogue Detector Mode
FlexConnect Mode

Matches

Show answer & explanation

Answer

Monitor Mode pairs with the description detailing dedicated RF scanning for rogues, CleanAir, and IDS without client associations. Sniffer Mode pairs with capturing raw 802.11 frames on a specified channel for forwarding to a packet analyzer. Rogue Detector Mode pairs with listening to wired ARP traffic to correlate MAC addresses against rogue lists. FlexConnect Mode pairs with local traffic switching for remote branch APs.
Each access point operational mode serves a targeted operational purpose within Cisco wireless architecture: Monitor mode focuses purely on RF scanning and security metrics without serving clients; Sniffer mode performs targeted 802.11 packet capture; Rogue Detector operates on the wired network to validate rogue device connections; and FlexConnect facilitates local switching for remote site deployment efficiency.

Step-by-Step Solution

1
Analyze non-client-serving specialized scanning modes
Identify that Monitor mode dedicates its radios to RF environment scanning, CleanAir, and security detection without accepting client connections.
Monitor mode APs do not transmit SSIDs or process client associations.
2
Differentiate packet capture functionality
Map Sniffer mode to over-the-air packet capture sent directly to an external analyzer tool.
Sniffer mode requires setting a target channel and destination IP address for packet stream monitoring.
3
Identify wired-side rogue mitigation roles
Associate Rogue Detector mode with monitoring wired ARP broadcasts.
Rogue Detector APs turn off their wireless radios and connect directly to switch trunk ports to monitor layer 2 broadcasts.
4
Evaluate branch architecture survivability mode
Match FlexConnect mode with local data switching capabilities.
FlexConnect allows client traffic to bypass the CAPWAP data tunnel across the WAN while maintaining central controller management.

Key Concept

Cisco Lightweight Access Point Operational Modes
Question 129Question

Match each RFC 1918 private IPv4 address range to its defined default CIDR block and maximum number of usable host addresses.

Click a left item, then click its matching right item

Items

10.0.0.0 to 10.255.255.255
172.16.0.0 to 172.31.255.255
192.168.0.0 to 192.168.255.255

Matches

Show answer & explanation

Answer

10.0.0.0 to 10.255.255.255 matches the /8 CIDR block (16,777,21416,777,214 usable hosts); 172.16.0.0 to 172.31.255.255 matches the /12 CIDR block (1,048,5741,048,574 usable hosts); 192.168.0.0 to 192.168.255.255 matches the /16 CIDR block (65,53465,534 usable hosts).
Under RFC 1918, the three private IPv4 address allocations have distinct prefix masks and sizes: 10.0.0.0/8 provides a single large block with 24 host bits (16,777,21416,777,214 usable hosts); 172.16.0.0/12 encompasses 16 Class B ranges spanning 172.16.0.0 through 172.31.255.255 with 20 host bits (1,048,5741,048,574 usable hosts); and 192.168.0.0/16 encompasses 256 Class C ranges spanning 192.168.0.0 through 192.168.255.255 with 16 host bits (65,53465,534 usable hosts).

Step-by-Step Solution

1
Analyze the 10.0.0.0/8 Class A private block
The range 10.0.0.0 to 10.255.255.255 reserves 24 host bits (328=2432 - 8 = 24).
Calculating usable host count yields 2242=16,777,2142^{24} - 2 = 16,777,214 addresses.
2
Analyze the 172.16.0.0/12 Class B private block
The range 172.16.0.0 to 172.31.255.255 spans from second octet 16 to 31, reserving 20 host bits (3212=2032 - 12 = 20).
Calculating usable host count yields 2202=1,048,5742^{20} - 2 = 1,048,574 addresses.
3
Analyze the 192.168.0.0/16 Class C private block
The range 192.168.0.0 to 192.168.255.255 reserves 16 host bits (3216=1632 - 16 = 16).
Calculating usable host count yields 2162=65,5342^{16} - 2 = 65,534 addresses.

Key Concept

RFC 1918 Private IPv4 Address Allocation and CIDR Prefix Boundaries
Question 130Question

Match each enterprise infrastructure network component on the left with its primary operational function on the right.

Click a left item, then click its matching right item

Items

Next-Generation Firewall (NGFW)
Wireless LAN Controller (WLC)
Layer 3 Switch
Type 1 Hypervisor

Matches

Show answer & explanation

Answer

Next-Generation Firewall matches stateful packet inspection, application-level filtering, and threat prevention; Wireless LAN Controller matches centralized access point provisioning, RF management, and wireless security policies; Layer 3 Switch matches hardware-based inter-VLAN routing using ASICs alongside L2 switching; Type 1 Hypervisor matches direct bare-metal hardware abstraction for virtual machines.
Each network component is matched accurately based on its structural plane and operational responsibility in modern enterprise architectures: NGFWs enforce security policies and application filtering, WLCs centralize wireless infrastructure control, Layer 3 switches provide ASIC-driven inter-VLAN routing, and Type 1 hypervisors provide bare-metal compute virtualization.

Step-by-Step Solution

1
Analyze the primary role of Next-Generation Firewalls (NGFW).
Identify that NGFWs operate at boundary points to enforce application-aware filtering, intrusion prevention, and stateful security inspection.
NGFWs extend classic firewall capabilities by inspecting traffic through Layer 7 application control and integrated security features.
2
Analyze the primary role of Wireless LAN Controllers (WLC).
Identify that WLCs handle centralized control-plane tasks for wireless access points across an enterprise campus.
WLCs aggregate AP management, radio resource management (RRM), and wireless security policy enforcement into a single architecture.
3
Analyze the primary role of Layer 3 Switches.
Identify that Layer 3 switches bridge VLANs and forward traffic between IP subnets using specialized Application-Specific Integrated Circuits (ASICs).
Layer 3 switches perform high-performance inter-VLAN routing in hardware while maintaining standard Layer 2 MAC table forwarding.
4
Analyze the primary role of Type 1 Hypervisors.
Identify that Type 1 hypervisors execute bare-metal virtualization directly on the host hardware platform.
Unlike Type 2 hypervisors which run on top of an existing OS, Type 1 hypervisors interface directly with physical server resources to host guest VMs.

Key Concept

Enterprise Network Component Roles and Functions
Question 131Question

Match each RFC 1918 private IPv4 address block to its designated default CIDR prefix length.

Click a left item, then click its matching right item

Items

10.0.0.0 to 10.255.255.255
172.16.0.0 to 172.31.255.255
192.168.0.0 to 192.168.255.255

Matches

Show answer & explanation

Answer

10.0.0.0 to 10.255.255.255 matches /8, 172.16.0.0 to 172.31.255.255 matches /12, and 192.168.0.0 to 192.168.255.255 matches /16.
RFC 1918 specifies three private address blocks for enterprise networks: 10.0.0.0/8 (10.0.0.0 – 10.255.255.255), 172.16.0.0/12 (172.16.0.0 – 172.31.255.255), and 192.168.0.0/16 (192.168.0.0 – 192.168.255.255).

Step-by-Step Solution

1
Identify the prefix length for the 10.0.0.0/8 address block.
The range 10.0.0.0 – 10.255.255.255 uses a /8 prefix length.
RFC 1918 defines the 10.0.0.0 network as a single Class A range with 8 network bits.
2
Identify the prefix length for the 172.16.0.0 address block.
The range 172.16.0.0 – 172.31.255.255 uses a /12 prefix length.
RFC 1918 allocates a set of 16 Class B networks from 172.16.0.0 through 172.31.255.255, aggregating to a /12 prefix length.
3
Identify the prefix length for the 192.168.0.0 address block.
The range 192.168.0.0 – 192.168.255.255 uses a /16 prefix length.
RFC 1918 allocates a set of 256 Class C networks from 192.168.0.0 through 192.168.255.255, aggregating to a /16 prefix length.

Key Concept

RFC 1918 Private IPv4 Address Ranges
Question 132Question

In a Cisco Wireless LAN Controller (WLC) architecture, Access Points (APs) can be configured in distinct operational modes to fulfill specialized roles. Match each AP operational mode on the left with its corresponding functional behavior on the right.

Click a left item, then click its matching right item

Items

Monitor Mode
FlexConnect Mode
Sniffer Mode
Rogue Detector Mode

Matches

Show answer & explanation

Answer

Monitor Mode matches dedicated WIPS scanning and location tracking without client servicing; FlexConnect Mode matches local traffic switching and WAN fault tolerance for branch sites; Sniffer Mode matches raw 802.11 frame capture streaming for packet analysis; Rogue Detector Mode matches correlating airborne rogue MACs with wired infrastructure tables.
Each access point operational mode is matched directly to its primary role: Monitor mode provides non-client-serving WIPS scanning and location tracking; FlexConnect mode provides branch-office WAN fault tolerance and local traffic bridging; Sniffer mode provides remote 802.11 raw packet capture to a workstation; Rogue Detector mode links wireless rogue observations to wired network MAC tables.

Step-by-Step Solution

1
Identify the primary function of Monitor Mode.
Monitor mode APs refrain from serving wireless clients and focus exclusively on security scanning, rogue detection, and location tracking.
Monitor mode is tailored for continuous over-the-air environmental sensing.
2
Determine the operational characteristics of FlexConnect Mode.
FlexConnect allows local bridging of client traffic and local authentication fallback during WAN disruptions.
FlexConnect optimizes branch office deployments by preventing client data from requiring central CAPWAP encapsulation over limited WAN bandwidth.
3
Examine Sniffer Mode functionality.
Sniffer mode functions as a remote wireless packet probe, redirecting channel frame captures to a Wireshark workstation.
This allows deep-packet inspection on targeted RF channels without requiring specialized physical sniffer hardware on site.
4
Analyze Rogue Detector Mode.
Rogue Detector mode checks whether a rogue wireless device seen over the air is physically connected to the internal wired switch network.
It compares learned wired layer-2 MAC address tables with over-the-air rogue MAC lists.

Key Concept

Cisco Access Point Operational Modes
Estimated Time:2m 0s
Question 133Question

A network security architect is auditing perimeter firewalls and IP addressing schemes across a enterprise topology. Match each IPv4 address specification to its corresponding RFC 1918 compliance status and public Internet routing behavior.

Click a left item, then click its matching right item

Items

172.31.255.254/28172.31.255.254/28
172.32.0.1/16172.32.0.1/16
192.168.255.254/31192.168.255.254/31
192.169.1.1/24192.169.1.1/24

Matches

Show answer & explanation

Answer

The correct pairings match 172.31.255.254/28172.31.255.254/28 to the private 172.16.0.0/12172.16.0.0/12 scope description, 172.32.0.1/16172.32.0.1/16 to the public space directly above 172.31.255.255172.31.255.255, 192.168.255.254/31192.168.255.254/31 to the private 192.168.0.0/16192.168.0.0/16 point-to-point scope description, and 192.169.1.1/24192.169.1.1/24 to the public space directly above 192.168.255.255192.168.255.255.
Each IP address is accurately mapped according to RFC 1918 boundaries: 172.31.255.254172.31.255.254 is private (172.16.0.0/12172.16.0.0/12), 172.32.0.1172.32.0.1 is public space immediately above 172.31.255.255172.31.255.255, 192.168.255.254192.168.255.254 is private (192.168.0.0/16192.168.0.0/16), and 192.169.1.1192.169.1.1 is public space immediately above 192.168.255.255192.168.255.255.

Step-by-Step Solution

1
Evaluate RFC 1918 address ranges and boundary limits.
The three RFC 1918 private address ranges are 10.0.0.0/810.0.0.0/8 (10.0.0.010.255.255.25510.0.0.0 - 10.255.255.255), 172.16.0.0/12172.16.0.0/12 (172.16.0.0172.31.255.255172.16.0.0 - 172.31.255.255), and 192.168.0.0/16192.168.0.0/16 (192.168.0.0192.168.255.255192.168.0.0 - 192.168.255.255).
Establishing accurate lower and upper boundary IP addresses is necessary to distinguish private from public IPv4 space.
2
Analyze 172.31.255.254/28172.31.255.254/28 and 172.32.0.1/16172.32.0.1/16.
172.31.255.254172.31.255.254 is the second-to-last address within 172.16.0.0/12172.16.0.0/12, making it private and non-routable. 172.32.0.1172.32.0.1 exceeds 172.31.255.255172.31.255.255, making it a public IP address.
Common misidentifications mistake 172.32.0.0/16172.32.0.0/16 for private space by assuming all 172.x.x.x172.x.x.x addresses are private, whereas only 172.16.0.0172.16.0.0 through 172.31.255.255172.31.255.255 are reserved by RFC 1918.
3
Analyze 192.168.255.254/31192.168.255.254/31 and 192.169.1.1/24192.169.1.1/24.
192.168.255.254192.168.255.254 falls inside 192.168.0.0/16192.168.0.0/16 and is private regardless of prefix length (/31/31). 192.169.1.1192.169.1.1 exceeds 192.168.255.255192.168.255.255, making it public.
The 192.168.0.0/16192.168.0.0/16 block ends at 192.168.255.255192.168.255.255. Addresses starting with 192.169.x.x192.169.x.x are public addresses.

Key Concept

RFC 1918 Private IPv4 Address Ranges and Boundary Verification
Question 134Question

Match each enterprise network infrastructure component on the left with its primary operational role on the right.

Click a left item, then click its matching right item

Items

Router
Layer 2 Switch
Next-Generation Firewall (NGFW)
Wireless LAN Controller (WLC)

Matches

Show answer & explanation

Answer

Router connects distinct IP subnets using routing tables; Layer 2 Switch forwards local frames based on MAC addresses; Next-Generation Firewall performs deep packet inspection up to Layer 7; Wireless LAN Controller centrally manages lightweight access points.
Each network device performs a specialized role within an enterprise architecture: Routers route IP packets across subnets, Layer 2 Switches switch local Ethernet frames using MAC addresses, Next-Generation Firewalls inspect application payload data for security, and Wireless LAN Controllers centralize management for lightweight APs.

Step-by-Step Solution

1
Identify the primary role of a Router.
Routers operate at Layer 3 and forward packets between different IP networks and subnets based on destination IP address routing decisions.
Connecting separate networks and determining path selection is the fundamental function of a router.
2
Identify the primary role of a Layer 2 Switch.
Layer 2 switches maintain a MAC address table to switch frames within a single local network/VLAN.
Layer 2 switches isolate collision domains but operate entirely within one broadcast domain.
3
Identify the primary role of a Next-Generation Firewall (NGFW).
NGFWs analyze traffic context and application content from Layer 4 up through Layer 7 to enforce security controls.
Deep packet inspection and application awareness distinguish NGFWs from standard stateful firewalls.
4
Identify the primary role of a Wireless LAN Controller (WLC).
WLCs act as the centralized intelligence hub to manage configuration, security policies, and radio frequencies for lightweight APs.
Split-MAC architectures offload management tasks from APs to the controller.

Key Concept

Primary operational roles of core network components
Question 135Question

A network engineer is analyzing physical radio frequency (RF) propagation behaviors in an enterprise campus facility. Match each RF propagation phenomenon on the left with its corresponding physical behavior or operational impact on the right.

Click a left item, then click its matching right item

Items

Absorption
Reflection
Refraction
Diffraction

Matches

Show answer & explanation

Answer

Absorption pairs with RF energy conversion into heat within dense materials; Reflection pairs with signal bouncing off smooth conductive surfaces; Refraction pairs with wave bending across changing media densities; Diffraction pairs with wave bending around sharp edges of solid obstacles.
Each RF propagation phenomenon describes a distinct physical interaction between wireless signals and environmental structures. Absorption dissipates signal power as heat through materials; Reflection bounces waves off smooth conductive barriers; Refraction bends light and radio waves across atmospheric or density gradients; Diffraction curves waves around sharp obstacle borders.

Step-by-Step Solution

1
Identify the characteristic of RF Absorption.
Absorption relates directly to energy loss converted into heat within dense physical obstacles like walls.
Dense matter absorbs RF energy, causing direct attenuation.
2
Identify the characteristic of RF Reflection.
Reflection involves RF signals bouncing off large, smooth metallic surfaces.
Conductive surfaces reflect electromagnetic waves, leading to multipath signal paths.
3
Identify the characteristic of RF Refraction.
Refraction describes signal bending caused by variations in propagation media density.
Velocity changes across media boundaries shift the phase and angle of the wave.
4
Identify the characteristic of RF Diffraction.
Diffraction describes signal bending around sharp physical corners or through small openings.
Obstacle edges split and distort the wavefront, creating shadow areas behind the obstacle.

Key Concept

RF Propagation Phenomena and Signal Impairments
Question 136Question

An enterprise network architecture incorporates multiple specialized physical and virtual components across campus, data center, and edge segments. Match each network component on the left to its primary operational function and forwarding behavior on the right.

Click a left item, then click its matching right item

Items

Next-Generation Firewall (NGFW)
Type 1 Bare-Metal Hypervisor
Wireless LAN Controller (WLC)
Layer 3 Switch

Matches

Show answer & explanation

Answer

Next-Generation Firewall (NGFW) matches deep packet inspection up to Layer 7 stateful security enforcement. Type 1 Bare-Metal Hypervisor matches direct hardware execution for managing virtual machines and vSwitches. Wireless LAN Controller (WLC) matches centralized control-plane and dynamic RF management for lightweight APs. Layer 3 Switch matches ASIC-driven, wire-speed inter-VLAN hardware routing.
Each component is accurately paired with its architectural plane and operational behavior: Next-Generation Firewalls handle stateful Layer 7 security inspection; Type 1 Hypervisors execute on bare metal to manage compute virtualization and vSwitches; Wireless LAN Controllers centralize control-plane RF and policy administration for APs; and Layer 3 Switches perform ASIC-accelerated inter-VLAN packet routing at line rate.

Step-by-Step Solution

1
Analyze the functional boundaries of security appliances.
Identify that Next-Generation Firewalls perform stateful inspection and Layer 7 application inspection rather than basic packet switching.
Security components operate on security zone boundaries to filter traffic based on application signature and state.
2
Distinguish host virtualization architecture from traditional operating systems.
Map the Type 1 hypervisor directly to bare hardware management and internal vSwitch forwarding.
Type 1 hypervisors execute without an underlying host OS, managing compute and virtual network resources directly.
3
Examine wireless centralized control architecture.
Associate the Wireless LAN Controller with centralized control plane tasks, dynamic RF management, and provisioning for lightweight APs.
Split-MAC architecture delegates real-time frame handling to lightweight APs while offloading management and control functions to the WLC.
4
Evaluate LAN routing hardware mechanics.
Connect the Layer 3 switch with ASIC-accelerated inter-VLAN routing.
Layer 3 switches utilize hardware ASICs to route packets between VLANs at line rate with significantly lower latency than software-based routers.

Key Concept

Enterprise Network Component Roles and Functional Boundaries
Question 137Question

Match each Cisco Split-MAC architecture component or CAPWAP feature on the left with its primary function or operational characteristic on the right.

Click a left item, then click its matching right item

Items

Lightweight Access Point (LAP)
Wireless LAN Controller (WLC)
CAPWAP Control Tunnel
CAPWAP Data Tunnel

Matches

Show answer & explanation

Answer

Lightweight Access Point (LAP) matches with handling real-time MAC functions like beacons and probe responses. Wireless LAN Controller (WLC) matches with handling management MAC functions like client authentication and association. CAPWAP Control Tunnel matches with exchanging encrypted management messages over UDP port 5246. CAPWAP Data Tunnel matches with carrying client data traffic over UDP port 5247.
Each component correctly pairs with its role in Cisco centralized wireless deployment: LAPs handle real-time RF MAC duties locally; WLCs handle management MAC functions centrally; CAPWAP Control operates on UDP port 5246 with DTLS encryption; and CAPWAP Data carries client payload packets over UDP port 5247.

Step-by-Step Solution

1
Identify the responsibilities assigned to the Lightweight Access Point (LAP) under Cisco Split-MAC architecture.
Real-time operations directly affecting radio hardware (such as beaconing, probe responses, and MAC layer encryption/decryption) are processed locally by the LAP.
Real-time MAC tasks require microsecond latency, making transmission across a WAN or LAN to a central WLC impractical.
2
Identify the responsibilities assigned to the Wireless LAN Controller (WLC).
Management and control plane tasks (such as 802.11 authentication, association handling, frame translation, and quality of service policy enforcement) are processed centrally by the WLC.
Centralizing management MAC tasks simplifies policy enforcement and wireless network administration across multiple APs.
3
Differentiate between CAPWAP Control and CAPWAP Data transport characteristics.
Control traffic uses UDP port 5246 (secured with DTLS), while Data traffic uses UDP port 5247.
Separating control and data plane transport protocols allows independent security, QoS, and routing mechanisms for management versus client payload traffic.

Key Concept

Cisco Split-MAC Architecture and CAPWAP Protocols
Estimated Time:1m 30s
Question 138Question

Match each IPv6 address, prefix, or protocol scenario on the left with its corresponding IPv6 address representation or reserved prefix range on the right.

Click a left item, then click its matching right item

Items

The dynamically generated IPv6 link-local address for an interface with MAC address `00:1A:2B:3C:4D:5E` using EUI-64
The IPv6 prefix block defined by RFC 4193 for locally assigned Unique Local Addresses (ULA) using a 40-bit random Global ID
The link-local IPv6 multicast address used exclusively to send OSPFv3 packets to Designated Routers (DR) and Backup Designated Routers (BDR)
The IPv6 prefix representation used in routing tables to designate the default route

Matches

Show answer & explanation

Answer

The SLAAC EUI-64 calculation matches `fe80::21a:2bff:fe3c:4d5e`; the locally assigned ULA prefix matches `fd00::/8`; the OSPFv3 DR/BDR multicast address matches `ff02::6`; and the default route matches `::/0`.
Each item accurately maps to its IPv6 address representation: EUI-64 requires inserting FFFE and flipping the 7th bit (`fe80::21a:2bff:fe3c:4d5e`); RFC 4193 local ULA uses `fd00::/8`; OSPFv3 DR/BDR communication uses `ff02::6`; and the default route is `::/0`.

Step-by-Step Solution

1
Calculate the SLAAC EUI-64 link-local address
`fe80::21a:2bff:fe3c:4d5e`
Split MAC `00:1A:2B:3C:4D:5E`, insert `FF:FE` to form `001A:2BFF:FE3C:4D5E`, flip the 7th bit of byte 1 (`00` to `02`), and prepend `fe80::`.
2
Identify the RFC 4193 locally assigned ULA prefix
`fd00::/8`
Bit 8 of the `fc00::/7` block is set to 1 for locally generated 40-bit random Global IDs, fixing the prefix to `fd00::/8`.
3
Determine the OSPFv3 DR/BDR multicast address
`ff02::6`
`ff02::5` is sent to All OSPF Routers, whereas `ff02::6` targets All OSPF Designated Routers.
4
Identify the default route IPv6 prefix
`::/0`
`::/0` signifies all zeros address and zero prefix length, serving as the default match in IPv6 routing.

Key Concept

IPv6 Addressing Scopes, EUI-64 Conversion Rules, and Multicast / Routing Prefixes
Question 139Question

Match each RFC 1918 private IPv4 address prefix block to its corresponding scope and address range definition.

Click a left item, then click its matching right item

Items

10.0.0.0/8
172.16.0.0/12
192.168.0.0/16

Matches

Show answer & explanation

Answer

10.0.0.0/8 matches a single Class A network block (10.0.0.0 - 10.255.255.255); 172.16.0.0/12 matches 16 contiguous Class B network blocks (172.16.0.0 - 172.31.255.255); 192.168.0.0/16 matches 256 contiguous Class C network blocks (192.168.0.0 - 192.168.255.255).
RFC 1918 explicitly defines three private address blocks: one Class A block (10.0.0.0/8), 16 contiguous Class B blocks (172.16.0.0/12, spanning 172.16.0.0 to 172.31.255.255), and 256 contiguous Class C blocks (192.168.0.0/16, spanning 192.168.0.0 to 192.168.255.255).

Step-by-Step Solution

1
Identify the RFC 1918 range and structure for Class A private addressing.
10.0.0.0/8 covers addresses from 10.0.0.0 through 10.255.255.255, representing a single Class A block.
RFC 1918 allocates one /8 block for Class A private networks.
2
Identify the RFC 1918 range and structure for Class B private addressing.
172.16.0.0/12 covers addresses from 172.16.0.0 through 172.31.255.255, forming 16 contiguous Class B (/16) blocks.
RFC 1918 allocates 16 contiguous /16 blocks starting at 172.16.0.0 up to 172.31.255.255.
3
Identify the RFC 1918 range and structure for Class C private addressing.
192.168.0.0/16 covers addresses from 192.168.0.0 through 192.168.255.255, forming 256 contiguous Class C (/24) blocks.
RFC 1918 allocates 256 contiguous /24 blocks starting at 192.168.0.0 up to 192.168.255.255.

Key Concept

RFC 1918 Private IPv4 Address Space Allocation
Question 140Question

Match each network architecture layer or topology design model on the left to its correct functional responsibility or operational trait on the right.

Click a left item, then click its matching right item

Items

Spine Layer (Data Center Spine-Leaf)
Leaf Layer (Data Center Spine-Leaf)
Distribution Layer (Traditional 3-Tier Campus)
Collapsed Core Layer (2-Tier Campus)

Matches

Show answer & explanation

Answer

Spine Layer matches high-speed L3 ECMP backbone forwarding; Leaf Layer matches endpoint attachment and VTEP encapsulation; Distribution Layer matches inter-VLAN routing, ACL filtering, and policy enforcement; Collapsed Core matches combining Core transport and Distribution policy into a single switch tier.
The pairings correctly align each tier with its defining design attributes: Spine switches provide non-blocking ECMP L3 transport; Leaf switches act as endpoint connection points and VTEPs; Distribution switches manage L2/L3 policy, ACLs, and routing boundaries; Collapsed Core switches combine Core and Distribution capabilities into one physical tier.

Step-by-Step Solution

1
Analyze Spine Layer responsibilities in Data Center Spine-Leaf (Clos) design.
Spine switches strictly interconnect Leaf switches, run L3 routing protocols, and provide equal-cost multipath transport without inter-spine links.
Spine nodes form the high-speed backbone core of the Clos fabric.
2
Analyze Leaf Layer responsibilities in Spine-Leaf design.
Leaf switches connect to servers, storage, and firewalls, serving as the edge access and VTEP overlay encapsulation boundary.
Endpoints attach exclusively to Leaf nodes in modern fabric architectures.
3
Analyze Distribution Layer responsibilities in traditional 3-Tier Campus design.
Distribution switches aggregate Access switches, perform inter-VLAN routing, and enforce security ACLs and QoS policies.
The Distribution tier isolates the Access tier from the Core tier and manages network policies.
4
Analyze Collapsed Core (2-Tier) campus design characteristics.
Collapsed Core integrates Distribution policy routing and Core high-speed switching into one combined physical tier.
It simplifies deployment for smaller networks that do not require separate core and distribution switch chassis.

Key Concept

Enterprise Campus (3-Tier & Collapsed Core) vs. Data Center (Spine-Leaf) Architectural Layers
PreviousPage 7 / 12Next
All practice questions — Cisco CCNA | Examkin