All practice questions

203 questions

All types1,987 Multiple choice1,020 Multiple select452 Numeric18 Matching229 Ordering203 Fill in the blank22 Short answer43

Question 1Question →

A network engineer needs to configure a static IEEE 802.1Q trunk link on Cisco switch interface GigabitEthernet0/1, disable Dynamic Trunking Protocol (DTP) negotiation, and configure VLAN 99 as the untagged native VLAN. Place the following CLI configuration commands in the correct logical execution sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct execution order is: interface GigabitEthernet0/1, switchport trunk encapsulation dot1q, switchport mode trunk, switchport nonegotiate, and switchport trunk native vlan 99.

The CLI commands follow strict Cisco IOS configuration order dependencies. First, access the interface mode with 'interface GigabitEthernet0/1'. Second, set encapsulation using 'switchport trunk encapsulation dot1q'. Third, enable static trunking with 'switchport mode trunk'. Fourth, disable DTP frames using 'switchport nonegotiate' (which fails if the port is in dynamic DTP mode). Finally, assign untagged traffic processing using 'switchport trunk native vlan 99'.

Step-by-Step Solution

Enter interface configuration mode

Context changes to Switch(config-if)# for GigabitEthernet0/1

CLI commands affecting a specific port require entering that interface context first.

Set trunk encapsulation to IEEE 802.1Q

Interface protocol encapsulation set to dot1q

Cisco IOS platforms supporting both ISL and 802.1Q require explicit encapsulation specification before changing mode to trunk.

Configure operational mode to static trunk

Interface changes state to unconditional trunking mode

Establishes trunk operational state.

Disable Dynamic Trunking Protocol negotiation

DTP frame transmission is stopped on the interface

The 'switchport nonegotiate' command is rejected by Cisco IOS if the interface remains in dynamic auto or dynamic desirable mode.

Modify the native VLAN identifier

VLAN 99 becomes the untagged VLAN for IEEE 802.1Q traffic

Applies non-default native VLAN parameter to prevent native VLAN mismatch security issues.

Key Concept

IEEE 802.1Q Trunk Configuration and DTP Suppression Sequence

Estimated Time:1m 30s

Question 2Question →

A network engineer needs to manually configure VLAN 30 named Engineering on a Cisco Catalyst switch and assign interface GigabitEthernet0/1 as an explicit static access port belonging to VLAN 30. Place the Cisco IOS CLI configuration steps in the correct chronological order required to accomplish this configuration starting from Privileged EXEC mode.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with entering global configuration mode ('configure terminal'), creating and naming VLAN 30 ('vlan 30' and 'name Engineering'), navigating to interface configuration mode ('interface gigabitethernet0/1'), enforcing access mode ('switchport mode access'), and assigning the port to VLAN 30 ('switchport access vlan 30').

The CLI hierarchy in Cisco IOS demands starting in Privileged EXEC mode, moving to global configuration mode, defining the VLAN object and its name, entering the target interface configuration context, defining the port mode as access, and lastly binding the port to the intended VLAN ID.

Step-by-Step Solution

Execute 'configure terminal' at the Privileged EXEC prompt (Switch#).

Transitions the CLI prompt to global configuration mode (Switch(config)#).

CLI commands for creating VLANs and accessing interfaces require global configuration privileges.

Execute 'vlan 30', followed by 'name Engineering' and 'exit'.

Creates VLAN 30 in the VLAN database and assigns the alphanumeric label 'Engineering'.

Defining the VLAN explicitly in global configuration mode ensures proper Layer 2 broadcast domain setup and labeling.

Execute 'interface gigabitethernet0/1'.

Transitions the CLI prompt to interface configuration mode (Switch(config-if)#).

Interface parameters can only be altered when inside the specific interface configuration context.

Execute 'switchport mode access'.

Statically sets the port mode to access, disabling DTP trunk negotiation.

Best security and operational practices dictate explicit configuration of access ports rather than relying on dynamic negotiation defaults.

Execute 'switchport access vlan 30'.

Associates interface GigabitEthernet0/1 with VLAN 30 for untagged frame traffic.

Assigns the access interface to forward untagged traffic on VLAN 30.

Key Concept

Cisco IOS CLI Hierarchy for VLAN Creation and Static Access Port Configuration

Question 3Question →

Place the steps of IEEE 802.1Q frame processing in sequential order, starting from when a host sends traffic on VLAN 20 until it is delivered to a host on another switch across an 802.1Q trunk link.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The sequence starts when the ingress switch receives an untagged frame from a host on a VLAN 20 access port, inserts a 4-byte 802.1Q tag into the frame header, transmits the tagged frame over the trunk link, the egress switch reads the VLAN ID from the tag, removes the 802.1Q header, and delivers the untagged frame out the access port to the destination host.

When a frame traverses an IEEE 802.1Q trunk link, the ingress switch inserts a 4-byte tag into the frame header to identify the originating VLAN (unless it is the native VLAN). The frame travels across the physical trunk link carrying this tag. Upon reaching the remote switch, the egress switch inspects the tag to determine the VLAN association, strips the 4-byte tag header, and delivers the original untagged Ethernet frame to the destination device connected to an access port in that VLAN.

Step-by-Step Solution

Receive untagged frame at ingress switch.

The ingress switch accepts the standard frame from the host on a port configured as an access port in VLAN 20.

Host end devices transmit standard untagged Ethernet frames.

Encapsulate frame with 802.1Q tag.

The switch inserts a 4-byte 802.1Q header between the Source MAC address and Length/Type fields.

IEEE 802.1Q tagging allows multiplexing multiple VLANs over a single interswitch trunk.

Send frame across trunk link.

The tagged frame is transmitted over the trunk interface toward the neighboring switch.

The tag remains intact during transmission across the trunk.

Process tag at egress switch.

The egress switch receives the frame and reads the 12-bit VLAN ID (VID) field in the 802.1Q header.

The receiving switch uses the VLAN ID to associate the frame with internal VLAN 20.

Decapsulate (strip) 802.1Q header.

The 4-byte 802.1Q tag is removed from the frame header.

End-user devices do not expect 802.1Q tags on access port connections.

Forward untagged frame to destination host.

The frame is sent out the matching VLAN 20 access port to the end device.

This completes the end-to-end Layer 2 delivery across switches.

Key Concept

IEEE 802.1Q Frame Encapsulation, Tagging, and Decapsulation Mechanics

Question 4Question →

When a router processes an incoming IP packet to make a forwarding decision, it evaluates matching candidate routes using a deterministic precedence hierarchy. Place the following routing decision criteria in the correct order of evaluation from first (1st) to last (4th).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for router forwarding decision logic is: 1) Longest prefix match, 2) Administrative distance, 3) Metric, and 4) Equal-cost load balancing.

A router evaluates forwarding decisions using a strict hierarchy: first, it determines the longest prefix match (most specific subnet mask matching the destination IP). If multiple routes have the exact same prefix length, it evaluates Administrative Distance to select the route from the most trustworthy source. If multiple routes come from the same routing source with identical prefix lengths, it compares the Metric to pick the path with the lowest cost. Finally, if prefix length, Administrative Distance, and Metric are all equal, the router performs equal-cost load balancing.

Step-by-Step Solution

Evaluate subnet mask specificity for candidate routes matching the destination IP.

Longest prefix match is evaluated first.

The router always prefers the most specific route (longest prefix length) regardless of protocol or AD.

Compare routing sources when matching routes have identical prefix lengths.

Administrative Distance (AD) is evaluated second.

Lower AD indicates a more believable/trustworthy routing source (e.g., Static route AD 1 vs OSPF AD 110).

Compare route metrics for paths learned via the same routing protocol with identical prefix lengths.

Metric is evaluated third.

Within a single routing protocol, lower metric indicates a lower-cost, more efficient network path.

Handle remaining candidate routes where prefix length, AD, and metric are all identical.

Equal-cost load balancing is applied fourth.

When all criteria are tied, the router installs multiple next-hops into the forwarding table for traffic sharing.

Key Concept

Router Forwarding Precedence Hierarchy

Question 5Question →

A network engineer connects a new point-to-point link between Switch-1 and Switch-2 in an enterprise network running Rapid PVST+. Place the steps of the RSTP Proposal/Agreement fast convergence mechanism in the correct chronological order from link initialization to the Designated Port entering the Forwarding state.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for the Rapid PVST+ Proposal/Agreement handshake is: 1) Switch-1 sends a BPDU with the Proposal bit set on its Designated Port (in Discarding state) toward Switch-2. 2) Switch-2 receives the superior BPDU, selects the receiving port as its new Root Port, and enters the synchronization phase. 3) Switch-2 blocks all of its non-edge Designated Ports by placing them into the Discarding state. 4) Switch-2 transmits an Agreement BPDU back to Switch-1 out of its newly selected Root Port. 5) Switch-1 receives the Agreement BPDU and immediately transitions its Designated Port to the Forwarding state.

In Rapid PVST+ (IEEE 802.1w), fast convergence on point-to-point links relies on an explicit proposal/agreement handshake. When a link initializes, the upstream switch sends a BPDU with the Proposal bit set while its Designated Port is in the Discarding state. The downstream switch evaluates the BPDU, adopts the interface as its new Root Port, and enters the sync phase by blocking (placing in Discarding) all non-edge Designated Ports to eliminate loop potential. Once synchronized, the downstream switch sends an Agreement BPDU back out its Root Port. Upon receiving the Agreement BPDU, the upstream switch immediately transitions its Designated Port into the Forwarding state without waiting for traditional 802.1D timers.

Step-by-Step Solution

Initiate the handshake proposal

Switch-1 sends a BPDU with the Proposal bit set while its port is in the Discarding state.

Rapid PVST+ relies on active proposal/agreement handshake frames across point-to-point links rather than passive timer delays.

Process the proposal on the receiving switch

Switch-2 identifies the interface as its new Root Port upon evaluating the superior BPDU.

Accepting a superior BPDU triggers Switch-2 to sync its topology before confirming agreement.

Synchronize downstream ports to prevent loops

Switch-2 forces all non-edge Designated Ports into the Discarding state (sync process).

Isolating local non-edge ports guarantees that no active switching loop can form while transitioning the new Root Port.

Send agreement confirmation

Switch-2 transmits an Agreement BPDU back to Switch-1.

The Agreement BPDU explicitly informs Switch-1 that Switch-2 has safely synchronized its downstream ports.

Complete rapid transition to Forwarding

Switch-1 transitions its Designated Port directly into the Forwarding state.

Because Switch-2 confirmed loop safety via the Agreement BPDU, Switch-1 can bypass legacy 802.1D listening and learning timers.

Key Concept

Rapid PVST+ Proposal/Agreement Handshake Mechanism

Question 6Question →

An administrator needs to create a new WPA2-Personal WLAN using the Cisco Wireless LAN Controller (WLC) GUI. Place the steps in the correct chronological order to complete this configuration.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts by selecting 'Create New' on the WLANs page, defining the Profile Name and SSID, enabling the WLAN and mapping the interface under the General tab, and finally configuring PSK under the Layer 2 Security tab.

The correct order follows standard WLC GUI workflow: first initiating creation via the drop-down menu on the WLANs page, defining the WLAN identity (Profile Name and SSID), enabling the WLAN and selecting its interface under the General tab, and finally defining authentication parameters under the Layer 2 Security tab.

Step-by-Step Solution

Initiate WLAN creation

Access the creation interface by choosing 'Create New' on the WLANs menu.

The controller requires starting a new instance from the main WLAN management page.

Define WLAN identification

Specify the Profile Name, broadcast SSID, and numerical WLAN ID.

Applying these parameters creates the WLAN entry and opens the WLAN Edit configuration sub-menus.

Configure General settings

Map the WLAN to its target interface/VLAN and set the WLAN Status to Enabled.

Clients cannot connect unless the WLAN is bound to an active interface and enabled.

Configure Security settings

Set Layer 2 Security to WPA2/WPA3, select PSK under Auth Key Management, and set the password.

This establishes the WPA2-Personal authentication requirements for connecting clients.

Key Concept

WLC GUI WLAN Configuration Sequence

Question 7Question →

A Cisco router receives an IP packet and initiates a route lookup process to select the optimal path. Arrange the router forwarding decision logic steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for router forwarding decision logic is: 1) Identify matching routing table entries, 2) Select the route with the Longest Prefix Match, 3) Break ties using Administrative Distance for different sources, 4) Break ties using Metric for identical sources, and 5) Forward the packet using the selected next-hop/exit interface.

The router forwarding process strictly follows a hierarchical evaluation sequence: First, the router checks for matching network entries in the routing table. Second, if multiple matching routes exist, it selects the route with the Longest Prefix Match (LPM), which represents the most specific path. Third, if multiple routes have the exact same prefix length but come from different sources, the router uses Administrative Distance (AD) to select the most reliable source. Fourth, if the prefix length and routing source are the same, the router uses the protocol's Metric to choose the optimal path. Finally, the packet is forwarded out the resulting egress interface to the next-hop IP.

Step-by-Step Solution

Scan routing table for matching prefix entries

Candidate routes matching the destination IP address are identified

The router performs a bitwise AND operation on the destination IP with subnet masks in the table to find matches.

Apply Longest Prefix Match (LPM) rule

The candidate route with the longest mask length is prioritized above all others

LPM takes precedence over Administrative Distance and Metric regardless of the routing protocol source.

Compare Administrative Distance (AD)

Ties between identical prefix lengths from different routing protocols are broken

Lower AD indicates a more believable/trustworthy route source (e.g., Connected=0, Static=1, OSPF=110).

Compare Metric values

Ties between identical prefix lengths from the same routing protocol are broken

Protocol-specific metrics (cost, hop count, bandwidth) determine the best path within that specific protocol.

Execute packet forwarding

The packet is encapsulated and sent via the designated exit interface or next-hop IP

The decision path concludes with Layer 2 rewrite and transmission.

Key Concept

Cisco Router Forwarding Decision Hierarchy (LPM -> AD -> Metric)

Question 8Question →

An administrator is configuring client connectivity for a new wireless network using the Cisco Wireless LAN Controller (WLC) web interface. The WLAN must use WPA2-Personal (PSK) authentication and be mapped to a dedicated dynamic interface. Arrange the GUI configuration steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of configuration steps is: 1) Select Create New and click Go on the WLANs page; 2) Define the Profile Name and SSID, then click Apply; 3) Map the dynamic interface under the General tab; 4) Configure WPA2-Personal (PSK) under Security > Layer 2; 5) Check the Status Enabled box on the General tab and click Apply.

Configuring a WLAN via the Cisco WLC GUI follows a defined procedural sequence. First, the administrator must navigate to WLANs > WLANs, select 'Create New', and click 'Go'. Second, the Profile Name and SSID are specified, followed by clicking 'Apply' to generate the profile entry. Third, under the General tab, the administrator maps the WLAN to the designated dynamic interface. Fourth, under Security > Layer 2, WPA2 Policy is enabled alongside PSK key management and the pre-shared key value. Fifth, the administrator returns to the General tab to check the Status checkbox to Enabled, clicking Apply to operationalize the WLAN.

Step-by-Step Solution

Initiate WLAN Creation

Navigating to WLANs > WLANs, selecting 'Create New' from the drop-down menu, and clicking 'Go' opens the initial setup page.

You must create a new profile instance before configuring parameters.

Define Profile Name and SSID

Entering the Profile Name and SSID and clicking 'Apply' instantiates the WLAN entry in the controller configuration.

The WLC requires an established Profile Name and SSID identifier before opening the full edit menu.

Bind Dynamic Interface

Selecting the dynamic interface on the General tab binds wireless client traffic to the appropriate VLAN.

Interface mapping determines client IP address assignment and network access.

Configure Layer 2 Security

Selecting WPA+WPA2, enabling WPA2 Policy, enabling PSK, and entering the pre-shared key secures client connections.

Layer 2 security options must be configured under Security > Layer 2 rather than Layer 3 or AAA tabs.

Enable and Save WLAN

Checking the 'Status: Enabled' box on the General tab and clicking 'Apply' activates the SSID across associated APs.

WLAN profiles are disabled by default during creation and must be explicitly enabled after all configurations are set.

Key Concept

Cisco WLC GUI WLAN Configuration Sequence

Estimated Time:1m 15s

Question 9Question →

A network administrator is using Software Image Management (SWIM) within Cisco DNA Center to upgrade a Catalyst switch. Place the steps of the standard SWIM deployment workflow in the correct operational sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence for Software Image Management (SWIM) in Cisco DNA Center is: 1) Import or discover the target software image into the Cisco DNA Center image repository, 2) Designate the software image as the 'Golden Image' for the corresponding device family and role, 3) Perform pre-upgrade readiness checks to verify storage capacity, hardware compatibility, and device health, 4) Distribute the software image file from Cisco DNA Center to the local storage of the target device, and 5) Activate the software image on the device and initiate a system reboot to complete the upgrade.

The Cisco DNA Center Software Image Management (SWIM) process follows a logical zero-downtime staging sequence: ingesting the image file into the central controller, tagging it as the Golden Image standard for device role compliance, running automated pre-upgrade checks to validate disk space and device health, distributing the image file to local device flash storage, and finally activating the software image through a boot configuration change and system restart.

Step-by-Step Solution

Import the target software image into the Cisco DNA Center repository.

The operating system image binary is ingested and stored centrally.

Cisco DNA Center cannot manage, verify, or push image files until they exist in its software image repository.

Designate the imported software image as a Golden Image.

Cisco DNA Center marks device models lacking this software version as non-compliant.

Establishing a Golden Image defines the software standard for a specific physical device model and site function.

Run pre-upgrade readiness checks on the target device.

Flash storage capacity, hardware platform compatibility, and network stability are confirmed.

Pre-checks prevent distribution failures caused by missing prerequisites or insufficient disk space.

Distribute the image file to the network device.

The image file is staged in the target switch's flash memory.

Transferring the image staged in device flash separates file transfer from the maintenance window reboot.

Activate the image and initiate a device reboot.

The device modifies its boot statement and reboots into the new operating system.

Activation finalizes the software upgrade process by applying the newly staged image to operational memory upon reboot.

Key Concept

Cisco DNA Center Software Image Management (SWIM) Workflow Sequence

Question 10Question →

A network administrator is onboarding a brand-new Cisco Catalyst switch into an enterprise network using Cisco Catalyst Center (formerly Cisco DNA Center) Network Plug and Play (PnP). Place the steps of the Day-0 PnP device discovery and provisioning process into the correct operational sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with the switch extracting the controller address from DHCP Option 43, establishing a secure TLS connection to transmit its serial number, matching the serial number to claim the device in Cisco Catalyst Center, provisioning the Golden software image and Day-0 configuration template, and finally rebooting to establish full Assurance telemetry integration.

The standard Network Plug and Play (PnP) zero-touch onboarding workflow follows a strict deterministic sequence: 1) The unconfigured device boots and uses DHCP Option 43 to obtain the Cisco Catalyst Center IP. 2) It opens a TLS connection to the controller and reports its serial number and Product ID (PID). 3) Cisco Catalyst Center matches the serial number, claims the device, and assigns it to a site hierarchy. 4) The controller pushes the designated Golden software image (SWIM) and Day-0 configuration template. 5) The switch reboots with the new image/config and registers for telemetry/Assurance monitoring.

Step-by-Step Solution

Identify initial network discovery

The device receives network settings and decodes vendor-specific DHCP Option 43 containing the controller IP.

Factory-default switches require an automated mechanism (DHCP Option 43 or Cloud PnP Redirect) to locate Cisco Catalyst Center without local console intervention.

Establish control channel and device identification

The device initiates a secure TLS session to Cisco Catalyst Center and sends identity parameters (serial number and PID).

The controller requires cryptographic session establishment and device identification before executing any management operations.

Claim device and map site policy

Cisco Catalyst Center claims the serial number and maps it to a designated network site.

Site assignment dictates which software image policies (SWIM) and Day-0 configuration templates apply to the device.

Deploy image and template configuration

Cisco Catalyst Center transfers the Golden IOS XE image and provisions the Day-0 configuration.

Provisioning software compliance and base network configuration must occur prior to operational activation.

Finalize activation and assurance telemetry registration

The switch reloads into the new image, applies the configuration, and syncs telemetry with Assurance.

Applying the golden image and configuration requires a system reload, completing the zero-touch onboarding lifecycle.

Key Concept

Cisco Catalyst Center Network Plug and Play (PnP) Day-0 Device Onboarding Workflow

Question 11Question →

A network administrator needs to configure an extended IPv4 access control list (ACL) to implement a specific traffic policy on a Cisco router interface. Arrange the following ACL statements and actions in the correct top-down evaluation order to ensure that host 10.1.1.15 is allowed SSH access to server 172.16.0.5, all other SSH traffic from subnet 10.1.1.0/24 to server 172.16.0.5 is blocked, all other IP traffic from subnet 10.1.1.0/24 is permitted, and unmatched traffic is dropped by default.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence places specific permit statements first (permit tcp host 10.1.1.15 host 172.16.0.5 eq 22), followed by broader subnet restrictions (deny tcp 10.1.1.0 0.0.0.255 host 172.16.0.5 eq 22), then general subnet permits (permit ip 10.1.1.0 0.0.0.255 any), and concludes with the automatic implicit deny rule.

Cisco IOS IPv4 access control lists process entries in strict sequential top-down order, stopping processing as soon as a packet matches an Access Control Entry (ACE). Therefore, specific host exceptions must be placed above broader subnet rules. The permit statement for host 10.1.1.15 must be evaluated first so it is not dropped by the subnet-wide SSH deny rule. Placing general subnet permit traffic third allows other protocols from the subnet, and any packet not matching these three lines falls into the automatic implicit deny rule at the bottom.

Step-by-Step Solution

Identify specific host exception rules

Position the permit rule for host 10.1.1.15 SSH traffic at line 1.

Cisco IOS processes ACLs top-down sequentially; specific host permissions must precede subnet-wide blocks to prevent false matches.

Identify broader subnet restriction rules

Position the deny rule for SSH traffic from subnet 10.1.1.0/24 to server 172.16.0.5 at line 2.

This blocks all other hosts in 10.1.1.0/24 from SSH access to 172.16.0.5 after the allowed host exception is processed.

Identify general permit rules for remaining subnet traffic

Position the permit IP rule for 10.1.1.0/24 to any destination at line 3.

This allows non-SSH traffic from 10.1.1.0/24 to pass after specific SSH security checks have been evaluated.

Account for default ACL termination behavior

Acknowledge the implicit deny ip any any statement at the end of the evaluation list.

Cisco IOS appends an unseen implicit deny statement to the end of every ACL, dropping any packet that does not match preceding lines.

Key Concept

Cisco IPv4 ACL sequential top-down evaluation logic and implicit deny enforcement

Question 12Question →

A network engineer is configuring a named extended IPv4 Access Control List (ACL) on a Cisco IOS router to implement a multi-tier security policy. The ACL must process rules top-down to meet the following requirements:
1. Permit SSH access ( $TCP$ port 22) from the specific management host $192.168.100.50$ to the core server interface $10.1.1.1$ .
2. Deny all other IP traffic originating from the Management subnet ( $192.168.100.0/24$ ) destined for the Server Farm subnet ( $10.1.0.0/16$ ).
3. Permit ICMP echo traffic from the Operations subnet ( $172.16.20.0/24$ ) to any destination.
4. Permit all remaining IPv4 traffic across all subnets.

In what order should the access-list statements be configured from top (first statement executed) to bottom (last statement executed) to ensure proper sequential traffic processing without unintended dropping of packets?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of ACL statements from top to bottom is: 1) permit tcp host 192.168.100.50 host 10.1.1.1 eq 22, 2) deny ip 192.168.100.0 0.0.0.255 10.1.0.0 0.0.255.255, 3) permit icmp 172.16.20.0 0.0.0.255 any echo, 4) permit ip any any.

Cisco Access Control Lists evaluate matching statements in a strict top-down sequential order. Once a packet matches an Access Control Entry (ACE), processing stops for that packet. Therefore, more specific rules (such as permitting TCP port 22 from host

192.168.100.50

to host

10.1.1.1

) must appear before broader rules (such as denying

192.168.100.0/24

10.1.0.0/16

). Finally, 'permit ip any any' must be placed at the end to prevent unmentioned traffic from being dropped by the implicit deny rule.

Step-by-Step Solution

Identify specific host permit exception

Recognize that 'permit tcp host 192.168.100.50 host 10.1.1.1 eq 22' is a specific exception to a broader subnet blocking rule.

Cisco ACLs process rules sequentially from top to bottom and stop at the first match. Specific host rules must always precede general subnet rules that overlap with them.

Place broader subnet deny rule

Position 'deny ip 192.168.100.0 0.0.0.255 10.1.0.0 0.0.255.255' immediately after the specific permit rule.

This blocks all other hosts in

192.168.100.0/24

from accessing any hosts in

10.1.0.0/16

Add specific subnet feature permits

Add 'permit icmp 172.16.20.0 0.0.0.255 any echo' to allow Operations ICMP traffic.

Matches the requirement for ICMP echo traffic from

172.16.20.0/24

Add explicit catch-all permit rule

Append 'permit ip any any' at the very bottom.

Without this rule, Cisco IOS ACLs end with an implicit 'deny ip any any' clause, which would drop all other traffic across the network.

Key Concept

Cisco IPv4 Extended ACL sequential top-down evaluation and implicit deny override.

Question 13Question →

A network engineer is configuring an IPv4 extended Access Control List (ACL 105) on a Cisco IOS router. Place the following ACL entries in the correct top-down execution sequence (from top/first line to bottom/last line) to ensure that SSH traffic from management host 192.168.1.10 to server 10.1.1.50 is allowed, HTTP traffic from subnet 192.168.1.0/24 to server 10.1.1.50 is allowed, and all remaining IPv4 traffic to server 10.1.1.50 is denied.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order from top to bottom is: first, the specific host SSH permit statement ('access-list 105 permit tcp host 192.168.1.10 host 10.1.1.50 eq 22'); second, the subnet HTTP permit statement ('access-list 105 permit tcp 192.168.1.0 0.0.0.255 host 10.1.1.50 eq 80'); and third, the explicit deny statement ('access-list 105 deny ip any host 10.1.1.50').

Cisco IOS Access Control Lists evaluate statements sequentially from top to bottom until a matching rule is found. To function correctly, specific rules (single host 192.168.1.10 on port 22) must come first, followed by broader rules (subnet 192.168.1.0/24 on port 80), and finally any explicit deny statement intended to block remaining traffic to host 10.1.1.50.

Step-by-Step Solution

Identify the most specific traffic requirement.

SSH traffic (TCP port 22) from single host 192.168.1.10 to server 10.1.1.50 is identified.

Cisco ACLs process sequentially from top to bottom, stopping at the first match. More specific entries must be positioned above general ones.

Identify the broader permitted traffic requirement.

HTTP traffic (TCP port 80) from the entire 192.168.1.0/24 subnet to server 10.1.1.50 is placed next.

This permits web traffic for the broader subnet while allowing host 192.168.1.10 to have already matched its SSH permit entry on line 1.

Place the specific deny statement for remaining traffic destined to the server.

The entry 'access-list 105 deny ip any host 10.1.1.50' is placed after all permit entries.

Placing a deny rule above any permit rules would cause matching traffic to be dropped prematurely.

Key Concept

Cisco IPv4 ACL Top-Down Sequential Evaluation

Question 14Question →

A network engineer must construct an IPv4 extended Access Control List (ACL) on a Cisco IOS router to enforce the following security policy requirements for traffic originating from subnet $10.20.1.0/24$ destined for the server subnet $172.16.10.0/24$ :

1. Host $10.20.1.5$ must be permitted to access SSH (TCP port 22) on the server subnet.
2. Host $10.20.1.5$ must be denied all other TCP traffic to the server subnet.
3. All other hosts on subnet $10.20.1.0/24$ must be permitted HTTP (TCP port 80) access to the server subnet.
4. All remaining IPv4 traffic from subnet $10.20.1.0/24$ to the server subnet must be dropped.

Arrange the ACL statements in the correct top-down sequence (from top/sequence 10 to bottom/sequence 40) to properly enforce this security policy.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of ACL statements from top to bottom is: permit tcp host 10.20.1.5 172.16.10.0 0.0.0.255 eq 22, followed by deny tcp host 10.20.1.5 172.16.10.0 0.0.0.255, followed by permit tcp 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 80, and finally deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255.

Cisco IPv4 Access Control Lists evaluate statements sequentially from top to bottom until a first match occurs. To enforce host-specific exceptions within a larger subnet, more specific rules (host 10.20.1.5 permits and denies) must precede general rules (subnet 10.20.1.0/24 permits and denies). Placing the SSH permit for host 10.20.1.5 first guarantees SSH functionality. Placing the TCP deny for host 10.20.1.5 second prevents host 10.20.1.5 from matching the subnet HTTP permit rule placed third. Finally, the subnet-wide IP deny statement catches all other traffic from the subnet.

Step-by-Step Solution

Identify the most specific exception rule for host 10.20.1.5.

The permit statement for SSH (TCP port 22) for host 10.20.1.5 must be evaluated first.

Cisco ACLs process statements top-down until a match occurs. Placing host 10.20.1.5's SSH permit rule at the top ensures SSH traffic is not dropped by subsequent deny rules.

Block all remaining TCP traffic for host 10.20.1.5.

Place 'deny tcp host 10.20.1.5 172.16.10.0 0.0.0.255' second.

Host 10.20.1.5 belongs to the

10.20.1.0/24

subnet. If the general HTTP permit rule for the subnet were placed above this statement, host 10.20.1.5 would accidentally be permitted HTTP access.

Permit HTTP traffic for the rest of the

10.20.1.0/24

subnet.

Place 'permit tcp 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255 eq 80' third.

Since host 10.20.1.5 has already matched earlier statements for its allowed/denied TCP traffic, remaining hosts in

10.20.1.0/24

reach this step and are permitted HTTP access.

Catch all remaining IPv4 traffic from the source subnet.

Place 'deny ip 10.20.1.0 0.0.0.255 172.16.10.0 0.0.0.255' last.

This explicitly drops any non-HTTP traffic from

10.20.1.0/24

172.16.10.0/24

before reaching the implicit deny any clause.

Key Concept

Top-Down Sequential Processing and Specific-to-General Ordering in IPv4 Extended ACLs

Question 15Question →

A network administrator needs to manually configure a static IEEE 802.1Q trunk on a Cisco Catalyst switch interface (GigabitEthernet0/1), set the native VLAN to VLAN 50, and disable Dynamic Trunking Protocol (DTP) frame transmission. What is the correct sequence of Cisco IOS configuration commands to accomplish this task?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with entering interface configuration mode (`interface GigabitEthernet0/1`), explicitly setting the switchport mode to static trunk (`switchport mode trunk`), specifying the untagged native VLAN (`switchport trunk native vlan 50`), and finally disabling DTP frame negotiation (`switchport nonegotiate`).

To properly configure an 802.1Q trunk link with a custom native VLAN and suppressed DTP, an engineer must first enter interface configuration mode (`interface GigabitEthernet0/1`). Next, the port operational mode must be set to static trunking (`switchport mode trunk`). Once the port is in static trunk mode, the native VLAN can be configured (`switchport trunk native vlan 50`), followed by disabling DTP negotiations (`switchport nonegotiate`).

Step-by-Step Solution

Enter interface configuration mode

Prompt changes to Switch(config-if)# for GigabitEthernet0/1

Cisco IOS requires navigating to the specific interface context before executing port configuration commands.

Set interface mode to trunk

Interface transitions to static trunk operational mode

Static trunking must be active before setting trunk-specific parameters or disabling dynamic DTP negotiation.

Specify custom native VLAN

VLAN 50 is assigned as the native VLAN for untagged ingress and egress frames

Overrides the default native VLAN 1 setting on the trunk link.

Disable DTP negotiation

Switch stops sending DTP negotiation frames out GigabitEthernet0/1

The switchport nonegotiate command is only valid on interfaces configured in static access or static trunk mode.

Key Concept

Static IEEE 802.1Q trunk configuration and DTP negotiation suppression on Cisco IOS switchports

Question 16Question →

A network engineer needs to build a functional Layer 3 LACP EtherChannel (Port-channel 10) between two Cisco Catalyst switches using interfaces GigabitEthernet1/0/1 and GigabitEthernet1/0/2. Place the required Cisco IOS CLI configuration steps in the correct order from start to finish.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for configuring a Layer 3 LACP EtherChannel is: first select the physical interface range (`interface range GigabitEthernet1/0/1 - 2`), disable Layer 2 switching on the physical ports (`no switchport`), create/assign the LACP active group (`channel-group 10 mode active`), enter the logical port-channel interface (`interface Port-channel 10`), and finally assign the IPv4 address (`ip address 192.168.10.1 255.255.255.252`).

To successfully configure a Layer 3 EtherChannel, physical member links must first be selected and converted into routed ports via the `no switchport` command. Next, the LACP dynamic protocol mode (`mode active`) is applied to bind the physical interfaces into channel-group 10. Finally, the network administrator enters the logical `interface Port-channel 10` configuration mode and assigns the IP address to the aggregate interface.

Step-by-Step Solution

Select physical range

Enters range configuration mode `(config-if-range)` for member ports.

Allows simultaneous configuration of physical interfaces GigabitEthernet1/0/1 and GigabitEthernet1/0/2.

Execute `no switchport` on physical links

Member interfaces become routed ports.

Physical ports must be routed interfaces before being grouped into a Layer 3 EtherChannel.

Execute `channel-group 10 mode active`

Creates logical interface Port-channel 10 and binds member links using LACP.

The `active` keyword initiates LACP negotiation.

Enter `interface Port-channel 10`

Enters interface configuration mode `(config-if)` for the logical bundle.

Layer 3 parameters must be configured on the aggregate port-channel interface.

Assign IP address with `ip address 192.168.10.1 255.255.255.252`

Port-channel 10 is configured with a unicast IP address.

Completes Layer 3 routed EtherChannel setup.

Key Concept

Layer 3 EtherChannel Configuration Sequence

Question 17Question →

A network administrator needs to aggregate physical interfaces GigabitEthernet0/1 and GigabitEthernet0/2 into a Layer 3 LACP EtherChannel (Port-channel 1) and assign an IP address of 10.1.1.1/30 to the logical interface. Place the configuration steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct configuration order is: 1) Select physical member ports (interface range GigabitEthernet0/1 - 2), 2) Disable Layer 2 switching (no switchport), 3) Associate ports with LACP channel-group (channel-group 1 mode active), 4) Enter logical port-channel mode (interface Port-channel 1), and 5) Assign the IP address (ip address 10.1.1.1 255.255.255.252).

To successfully configure a Layer 3 EtherChannel using LACP, physical member interfaces must first be selected (`interface range`), converted to routed ports (`no switchport`), and joined to an active LACP channel group (`channel-group 1 mode active`). Afterwards, the logical interface context must be accessed (`interface Port-channel 1`) to assign the designated IP address (`ip address 10.1.1.1 255.255.255.252`).

Step-by-Step Solution

Select target physical interfaces

System enters interface range configuration mode prompt switch(config-if-range)#

Configuration commands must target both physical member interfaces simultaneously.

Execute 'no switchport' on physical member interfaces

Physical ports are converted from Layer 2 switch ports to Layer 3 routed ports

Layer 3 EtherChannels require member interfaces to operate in routed mode.

Execute 'channel-group 1 mode active'

Physical interfaces are added to EtherChannel group 1 using LACP active negotiation, creating Port-channel 1

The 'active' keyword enables dynamic IEEE 802.3ad LACP protocol negotiation.

Execute 'interface Port-channel 1'

System enters interface configuration mode for the logical port-channel switch(config-if)#

Layer 3 IP attributes must be applied directly to the logical bundled interface.

Execute 'ip address 10.1.1.1 255.255.255.252'

Logical interface Port-channel 1 receives the specified IP address and subnet mask

This enables routing over the aggregated logical EtherChannel link.

Key Concept

Layer 3 EtherChannel Configuration with LACP

Question 18Question →

A Cisco router receives an IPv4 packet destined for a remote network. Place the router forwarding decision and packet processing steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of router forwarding decision logic begins with inspecting the destination IP header, evaluating the routing table using Longest Prefix Match, resolving equal prefix length ties using Administrative Distance and metric, identifying the next-hop IP and exit interface, and performing Layer 2 header rewriting along with TTL decrement prior to frame transmission.

Router forwarding logic follows a deterministic sequence: packet IP inspection -> Longest Prefix Match evaluation -> Administrative Distance/metric tie-breaking for equal prefixes -> next-hop and exit interface resolution -> Layer 2 MAC resolution, TTL decrement, and frame forwarding.

Step-by-Step Solution

Examine packet header

Destination IPv4 address is extracted from the incoming packet.

The router requires the destination address to initiate a routing table lookup.

Apply Longest Prefix Match rule

The routing table entry with the longest subnet mask matching the destination IP is chosen.

LPM is the primary criterion in Cisco IPv4 forwarding decision logic.

Compare Administrative Distance and metric

Ties between identical prefix lengths from different routing sources are resolved.

Administrative Distance ranks route trustworthiness when prefix lengths are equal.

Retrieve egress forwarding details

The next-hop IPv4 address and outbound interface are identified.

Forwarding requires knowing where to encapsulate and send the packet next.

Execute Layer 2 rewrite and transmission

TTL is decremented by 1, IP header checksum updated, next-hop MAC resolved via ARP, and frame sent.

Layer 2 encapsulation is link-local and must be rewritten for each hop along the path.

Key Concept

Router Forwarding Decision Logic

Question 19Question →

A network administrator needs to create a new VLAN named ENGINEERING (VLAN 40) on a Cisco Catalyst switch and assign interface FastEthernet 0/12 to this VLAN as an access port. Place the following Cisco IOS command sequence in the correct execution order from global configuration entry to final interface VLAN assignment.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of commands begins with entering global configuration mode (configure terminal), creating the VLAN (vlan 40), naming the VLAN (name ENGINEERING), navigating to the target interface (interface fastethernet 0/12), defining the interface as an access port (switchport mode access), and finally binding the interface to the specified VLAN (switchport access vlan 40).

The sequence follows the standard Cisco IOS configuration hierarchy. Global configuration mode must be established first to define the Layer 2 broadcast domain (vlan 40) and assign its optional descriptive name (name ENGINEERING). Next, configuration context shifts to the specific physical layer interface (interface fastethernet 0/12), where the operational mode is defined (switchport mode access) before binding the interface to the created access VLAN (switchport access vlan 40).

Step-by-Step Solution

Enter global configuration mode.

The prompt changes to switch(config)#.

Global configuration mode is required to create VLAN definitions and navigate to interface configurations.

Execute 'vlan 40'.

The prompt changes to switch(config-vlan)#.

Creates VLAN 40 in the VLAN database and opens VLAN configuration sub-mode.

Execute 'name ENGINEERING'.

VLAN 40 is named ENGINEERING.

VLAN names must be configured while inside the config-vlan sub-mode.

Execute 'interface fastethernet 0/12'.

The prompt changes to switch(config-if)#.

Navigates directly to the specific interface configuration sub-mode for FastEthernet 0/12.

Execute 'switchport mode access'.

Interface FastEthernet 0/12 is statically configured as an access port.

Configuring access mode explicitly disables Dynamic Trunking Protocol (DTP) negotiation for trunking.

Execute 'switchport access vlan 40'.

Interface FastEthernet 0/12 is associated with VLAN 40.

Assigns untagged traffic on this access port to the target broadcast domain (VLAN 40).

Key Concept

Cisco IOS VLAN creation and interface access port configuration hierarchy

Question 20Question →

A Cisco Catalyst switch interface configured as an 802.1Q trunk receives an incoming frame. Place the internal operational steps executed by the switch to process this frame into the correct chronological order from frame arrival to egress forwarding.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for 802.1Q ingress frame processing is: 1) Inspect header for TPID (0x8100), 2) Extract tagged VLAN ID or assign configured Native VLAN ID if untagged, 3) Verify VLAN against the allowed VLAN list (ingress filtering), 4) Update MAC address table for the VLAN domain, 5) Forward or flood the frame to egress ports in that VLAN.

The correct operational sequence begins when an ingress frame arrives on an 802.1Q trunk. The switch ASIC first checks for the 802.1Q TPID (0x8100). Next, it extracts the 12-bit VLAN ID from tagged frames or assigns the configured native VLAN ID to untagged frames. After determining the VLAN, the switch applies ingress filtering to verify if that VLAN ID is on the trunk's allowed VLAN list. If permitted, it updates its MAC address table associating the source MAC with that VLAN and ingress port, and finally makes the egress forwarding or flooding decision within that VLAN context.

Step-by-Step Solution

Inspect the Ethernet header for 802.1Q encapsulation

Identifies if the frame contains a 4-byte 802.1Q header with EtherType 0x8100.

The switch must determine whether the frame is tagged before interpreting VLAN fields.

Derive the internal VLAN context

Extracts the 12-bit VID from the tag header, or maps untagged traffic to the native VLAN.

802.1Q rules dictate that untagged frames belong to the native VLAN, while tagged frames belong to their explicit VID.

Execute ingress VLAN pruning check (allowed list filtering)

Checks if the derived VLAN is permitted by the 'switchport trunk allowed vlan' configuration.

If the VLAN is pruned/disallowed, the switch drops the frame immediately prior to MAC table processing.

Learn source MAC address

Adds or updates the source MAC address entry in the CAM table for the derived VLAN context.

Dynamic MAC learning occurs per-VLAN after verifying ingress permission.

Perform egress forwarding decision

Forwards frame to egress destination interface(s) in the matching VLAN domain.

Layer 2 forwarding logic constrains broadcast and unicast traffic strictly within the matched VLAN boundary.

Key Concept

802.1Q Trunk Ingress Frame Processing Pipeline

Estimated Time:2m 0s

Page 1 / 11Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept