Network Fundamentals

398 questions

All types398 Multiple choice205 Multiple select92 Numeric18 Matching68 Ordering7 Short answer8

A network engineer deploys lightweight access points (LAPs) at a remote branch office connected over a WAN to a centralized Wireless LAN Controller (WLC). During a WAN outage, clients connected to APs in Local mode lose network connectivity, while clients connected to APs configured in FlexConnect mode with local switching retain local network access. Which operational characteristic of Local mode APs accounts for this behavior?

Local mode APs encapsulate all client data traffic within CAPWAP data tunnels to be switched centrally by the WLC.

Local mode APs automatically convert into autonomous APs during WLC outages but drop client frames until manually rebooted.

Local mode APs function as Layer 3 routers that drop all incoming broadcast domains when controller heartbeats fail.

Local mode APs enforce traffic policing that buffers client packets until the CAPWAP control tunnel is restored.

Show answer & explanation

Answer: Local mode APs encapsulate all client data traffic within CAPWAP data tunnels to be switched centrally by the WLC.

Answer

Local mode APs encapsulate all client data traffic within CAPWAP data tunnels to be switched centrally by the WLC.

In Cisco Centralized WLAN architectures, APs operating in Local mode encapsulate all client user traffic within CAPWAP data tunnels and forward it to the Wireless LAN Controller (WLC) for centralized processing and 802.3 Ethernet conversion. Consequently, if WAN connectivity to the central WLC is lost, Local mode APs cannot process or forward client traffic. In contrast, FlexConnect mode with local switching allows the AP to perform frame translation and switch client traffic directly onto the local branch switch, keeping local resources accessible during a WLC outage.

Step-by-Step Solution

Analyze the operational behavior of Local mode in a Cisco Centralized WLAN architecture.

Local mode lightweight APs send both CAPWAP control and CAPWAP data packets back to the central WLC.

Centralized switching requires all 802.11 frames to be encapsulated in CAPWAP and sent to the WLC, where 802.11 to 802.3 frame conversion occurs.

Evaluate the impact of WAN failure and loss of WLC reachability on Local mode APs.

Since data switching depends on reaching the WLC, losing WLC connectivity prevents Local mode APs from forwarding client traffic.

Local mode APs cannot locally bridge client traffic to the branch switch infrastructure.

Compare with FlexConnect mode configured for local switching.

FlexConnect APs perform 802.11 to 802.3 frame translation locally at the branch level, allowing traffic to continue flowing locally even when WLC connectivity is lost.

FlexConnect separates local data path switching from centralized controller management.

Key Concept

Cisco Lightweight Access Point Modes (Local vs. FlexConnect) and CAPWAP Data Tunneling

Question 222Question →

A system architect is migrating a software-defined branch office infrastructure from hosted hypervisors (Type 2) to bare-metal hypervisors (Type 1). During performance baseline testing, the team observes significantly reduced network frame handling latency and lower host CPU overhead on the bare-metal architecture. Which architectural characteristic of Type 1 hypervisors accounts for this performance improvement?

The hypervisor manages physical hardware resources directly without passing kernel calls through a host operating system layer.

The hypervisor relies on the host operating system kernel to schedule CPU time and translate hardware I/O requests for virtual interfaces.

The virtual switch in a Type 1 hypervisor operates as a Layer 3 router by default, bypassing MAC address processing for intra-host VM traffic.

Type 1 hypervisors automatically encapsulate all virtual interface frames into GRE tunnels before transmitting them to the physical network interface.

Show answer & explanation

Answer: The hypervisor manages physical hardware resources directly without passing kernel calls through a host operating system layer.

Answer

The hypervisor manages physical hardware resources directly without passing kernel calls through a host operating system layer.

Type 1 (bare-metal) hypervisors run directly on the host server hardware with direct access to hardware resources such as CPU, memory, and physical NICs. Because there is no general-purpose host operating system running underneath, virtual machine I/O operations and virtual switch frame handling do not suffer from extra OS kernel translation steps or scheduler contention, resulting in significantly lower latency and CPU overhead.

Step-by-Step Solution

Analyze the architecture of Type 1 (bare-metal) vs. Type 2 (hosted) hypervisors.

Type 1 hypervisors sit directly on physical server hardware, whereas Type 2 hypervisors execute on top of an existing host operating system.

Understanding the hardware interface boundary is critical for determining performance overhead.

Evaluate the impact of host OS elimination on packet processing and resource scheduling.

By eliminating the host OS layer, Type 1 hypervisors gain direct control over physical NIC drivers and CPU scheduling, reducing I/O latency and CPU context-switching overhead.

Direct hardware interaction removes intermediate kernel context switches and resource competition.

Match the observed performance efficiency to the underlying architectural mechanism.

Direct management of hardware resources without a host OS translation layer explains the lower latency and reduced CPU utilization.

This direct hardware access is the primary architectural differentiator of bare-metal virtualization.

Key Concept

Type 1 vs Type 2 Hypervisor Architecture

Question 223Question →

Match each IPv6 address type on the left with its corresponding reserved prefix range on the right. Which pairs correctly match each IPv6 address scope to its standard IPv6 prefix?

Click a left item, then click its matching right item

Show answer & explanation

Answer

Global Unicast Address pairs with 2000::/3, Link-Local Address pairs with fe80::/10, Unique Local Address pairs with fc00::/7, and Multicast Address pairs with ff00::/8.

Each standard IPv6 address scope is assigned a dedicated prefix block by IANA and RFC 4291: Global Unicast uses 2000::/3 for public Internet traffic, Link-Local uses fe80::/10 for interface communication on the same link, Unique Local uses fc00::/7 for internal site routing, and Multicast uses ff00::/8 for group delivery.

Step-by-Step Solution

Identify the reserved prefix block for IPv6 Global Unicast addresses.

Global Unicast Address maps to 2000::/3.

Global Unicast IPv6 addresses are defined by RFC 4291 as starting in the 2000::/3 prefix range (2000:: through 3FFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF:FFFF).

Identify the reserved prefix block for IPv6 Link-Local addresses.

Link-Local Address maps to fe80::/10.

IPv6 link-local addresses use the prefix fe80::/10, which covers fe80:: through febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff.

Identify the reserved prefix block for IPv6 Unique Local addresses (ULA).

Unique Local Address maps to fc00::/7.

Unique Local IPv6 addresses are analogous to IPv4 private addresses and start with the fc00::/7 block (fc00:: through fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff).

Identify the reserved prefix block for IPv6 Multicast addresses.

Multicast Address maps to ff00::/8.

All IPv6 multicast addresses begin with the prefix byte ff00::/8.

Key Concept

IPv6 Address Types and Reserved Prefixes

Question 224Question →

An administrator is auditing a dual-stack network segment where hosts use Stateless Address Autoconfiguration (SLAAC) with EUI-64 to derive their 64-bit interface identifiers. A workstation with the Burned-In MAC address `34-E6-D7-89-0A-1B` sends a Router Solicitation message. What is the correctly formatted IPv6 Link-Local address generated by this interface?

FE80::36E6:D7FF:FE89:0A1B

FE80::34E6:D7FF:FE89:0A1B

FE80::36E6:D7FF:FF89:0A1B

FE80::32E6:D7FF:FE89:0A1B

Show answer & explanation

Answer: FE80::36E6:D7FF:FE89:0A1B

Answer

The correct IPv6 Link-Local address is FE80::36E6:D7FF:FE89:0A1B.

To construct an IPv6 EUI-64 interface identifier from a 48-bit MAC address (34-E6-D7-89-0A-1B), the 7th bit (Universal/Local bit) of the first byte must be inverted, and the 16-bit hex value FFFE must be inserted between the third and fourth bytes. The first byte 0x34 is 0011 0100 in binary; flipping the 7th bit produces 0011 0110 (0x36). Inserting FFFE into 36-E6-D7 and 89-0A-1B yields the interface ID 36E6:D7FF:FE89:0A1B. Appending this to the FE80:: link-local prefix forms FE80::36E6:D7FF:FE89:0A1B.

Step-by-Step Solution

Identify the IPv6 Link-Local prefix.

Link-Local addresses begin with FE80::/10 (typically formatted as FE80::/64 for host interfaces).

SLAAC link-local autoconfiguration uses FE80::/64 as the default prefix network segment.

Convert the first byte of the MAC address to binary and invert the 7th bit (Universal/Local bit).

The first byte 0x34 in binary is 0011 0100. Inverting the 7th bit (the 2nd least significant bit) changes 0011 0100 to 0011 0110, which is 0x36 in hexadecimal.

IEEE EUI-64 specification requires flipping the U/L bit to indicate a universally administered address modified for EUI-64 usage.

Split the modified MAC address into two 24-bit halves and insert FFFE in the middle.

The modified MAC `36-E6-D7-89-0A-1B` becomes `36-E6-D7` and `89-0A-1B`. Inserting `FF-FE` yields `36E6:D7FF:FE89:0A1B` in standard IPv6 hexadecimal notation.

Expanding a 48-bit MAC address into a 64-bit EUI-64 interface identifier requires inserting the 16-bit value FFFE at the center.

Combine the link-local prefix with the derived 64-bit EUI-64 interface identifier.

FE80:: + 36E6:D7FF:FE89:0A1B = FE80::36E6:D7FF:FE89:0A1B.

The complete 128-bit link-local address consists of the 64-bit FE80:: prefix and the 64-bit interface ID.

Key Concept

EUI-64 Interface Identifier Derivation for IPv6 Link-Local Addresses

Estimated Time:1m 30s

Question 225Question →

A network administrator is allocated the IPv6 prefix block $2001:\text{db8}:5678:\text{a000}::/52$ for an enterprise deployment. Which two IPv6 addresses belong to valid subnets within this assigned prefix block? (Select two.)

Select all that apply

2001:db8:5678:a4f0:1::1/64

2001:db8:5678:ab00::1/64

2001:db8:5678:b000::1/64

2001:db8:5678:a00::1/64

Show answer & explanation

Answer: 2001:db8:5678:a4f0:1::1/64; 2001:db8:5678:ab00::1/64

Answer

The correct IPv6 addresses are 2001:db8:5678:a4f0:1::1/64 and 2001:db8:5678:ab00::1/64 because their fourth hextet values (a4f0 and ab00) lie within the range a000 to afff specified by the /52 prefix boundary.

The correct options are the addresses featuring 'a4f0' and 'ab00' as their fourth hextet. A /52 prefix locks the first 52 bits of the IPv6 address. The first three 16-bit hextets supply 48 bits, leaving 4 bits to lock the first hex digit of the fourth hextet. Since 'a' represents binary 1010 across bits 49–52, any valid address under this prefix must have a fourth hextet starting with 'a' (ranging from a000 to afff).

Step-by-Step Solution

Analyze the assigned IPv6 prefix length and identify hex nibble boundaries.

The prefix

2001:\text{db8}:5678:\text{a000}::/52

has

52

fixed network bits. Each hex character (nibble) represents

4

bits. The first three hextets (

2001:\text{db8}:5678

) account for

48

bits (

3 \times 16

). The remaining

4

network bits (

52 - 48 = 4

) lock the first nibble of the fourth hextet.

Determining where the prefix boundary falls inside the fourth hextet allows precise identification of valid subnet ranges.

Calculate the valid range of values for the fourth hextet.

The hex character

\text{'a'}

corresponds to binary

1010

. Since the first

4

bits of the fourth hextet must remain

1010

, the fourth hextet can range from

\text{a000}

(

1010\ 0000\ 0000\ 0000_2

) to

\text{afff}

(

1010\ 1111\ 1111\ 1111_2

Any valid subnet address must have a fourth hextet between a000 and afff.

Evaluate each candidate address against the calculated fourth hextet range.

The addresses containing 'a4f0' and 'ab00' in their fourth hextet are within the range a000-afff. The address with 'b000' starts the next block (

2001:\text{db8}:5678:\text{b000}::/52

), and 'a00' expands to '0a00', which falls below 'a000'.

Only addresses matching the leading nibble 'a' in the fourth hextet belong to the designated /52 block.

Key Concept

IPv6 Prefix Length Boundaries and Hexadecimal Subnet Range Calculation

Question 226Question →

A network administrator is designing the transport transport layer profile for an enterprise network management system. The system requires a stateless transport mechanism for high-frequency, low-latency telemetry collection where occasional packet loss is tolerable, alongside a stateful transport mechanism for secure interactive router configuration sessions. Which two characteristics accurately describe the transport layer protocols selected for these respective roles? (Select two.)

Select all that apply

User Datagram Protocol (UDP) utilizes a fixed 8-byte header to minimize processing overhead for rapid telemetry collection.

Transmission Control Protocol (TCP) incorporates a dynamic window size field within its baseline 20-byte header to perform flow control during configuration sessions.

User Datagram Protocol (UDP) relies on sequence numbers within its header to identify lost telemetry packets and trigger selective retransmissions.

Transmission Control Protocol (TCP) avoids connection setup latency by transmitting user payload data prior to completing session establishment.

Show answer & explanation

Answer: User Datagram Protocol (UDP) utilizes a fixed 8-byte header to minimize processing overhead for rapid telemetry collection.; Transmission Control Protocol (TCP) incorporates a dynamic window size field within its baseline 20-byte header to perform flow control during configuration sessions.

Answer

UDP employs a streamlined 8-byte header to eliminate protocol overhead for real-time telemetry, while TCP utilizes a 20-byte baseline header with a dynamic Window Size field to manage flow control for interactive administrative sessions.

The selection of UDP for telemetry is supported by its minimal 8-byte fixed header length, which reduces processing and bandwidth overhead. The selection of TCP for interactive router management is supported by its standard 20-byte header containing the Window Size field, enabling dynamic sliding-window flow control to prevent receiver buffer exhaustion.

Step-by-Step Solution

Analyze transport protocol requirements for low-latency telemetry data.

UDP is chosen because it is connectionless and introduces minimal overhead.

The 8-byte UDP header contains only four fields, avoiding state maintenance and handshake delays.

Analyze transport protocol requirements for interactive administrative sessions.

TCP is chosen to guarantee reliable, ordered delivery and flow control.

The baseline 20-byte TCP header contains fields for sequencing, acknowledgments, and window size adjustment.

Evaluate the option choices against protocol header structures and operational behavior.

The statements describing the 8-byte UDP header and the TCP 20-byte header with window size flow control are accurate, whereas claims of UDP sequence tracking and handshake-free TCP data delivery are false.

UDP lacks sequence fields in its header, and TCP mandates session initialization via a three-way handshake prior to payload transfer.

Key Concept

TCP and UDP Header Structure and Operational Mechanics

Question 227Question →

Match each virtualization component on the left with its corresponding primary function or definition on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Hypervisor matches with the software layer managing host hardware resources; Virtual Switch matches with the software entity performing Layer 2 frame forwarding; Virtual Network Interface Card matches with the software-based network adapter presented to a guest OS; Virtual Machine matches with the isolated software container executing a guest OS.

Each virtualized component serves a distinct role in network and hardware virtualization: the hypervisor manages underlying hardware allocation, the vSwitch handles software-based Layer 2 frame forwarding, the vNIC functions as the software network adapter for guest OS connection, and the VM is the hosted guest compute instance.

Step-by-Step Solution

Identify the role of the Hypervisor

The hypervisor controls and allocates physical hardware resources (CPU, RAM, storage) to virtual environments.

It acts as the core virtualization engine enabling multi-tenancy on physical hardware.

Identify the role of the Virtual Switch (vSwitch)

The vSwitch manages Layer 2 forwarding within the hypervisor host.

It connects virtual interfaces to each other and bridges virtual network traffic to physical network interface cards (pNICs).

Identify the role of the Virtual Network Interface Card (vNIC)

The vNIC acts as the guest system's virtual Ethernet interface.

It binds to a VM and plugs virtually into a port on a vSwitch.

Identify the role of the Virtual Machine (VM)

The VM is the virtualized compute instance.

It operates as an independent operating system container hosted by the hypervisor.

Key Concept

Virtualization Abstraction Components and Functions

Question 228Question →

Match each network topology architecture model or functional layer on the left to its corresponding design trait and operational responsibility on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Collapsed Core Architecture Layer matches the description combining core transport and policy enforcement into a single switch pair. Three-Tier Core Layer matches the description providing high-speed transport without CPU-intensive packet inspection or ACL filtering. Three-Tier Distribution Layer matches the description aggregating Access switches, acting as the L2/L3 boundary, and enforcing security policies. Data Center Spine Layer matches the description functioning as a high-bandwidth IP fabric backbone with predictable single-hop latency.

Each architecture layer is uniquely optimized for its operational domain: Collapsed Core combines distribution and core functions for smaller networks; Three-Tier Core optimizes raw forwarding speed without packet filtering; Three-Tier Distribution acts as the control boundary for VLANs, security policies, and routing aggregation; Spine-Leaf Spine nodes provide predictable, non-blocking single-hop transport between all leaf switches.

Step-by-Step Solution

Analyze the functional responsibilities of campus network layers.

Identify that the Core layer focuses exclusively on transport speed, while the Distribution layer handles routing boundaries, ACLs, and policy enforcement.

Separation of duties in campus designs prevents performance bottlenecks on the core backbone.

Evaluate the Collapsed Core model.

Recognize that Collapsed Core integrates core switching and distribution policies into one physical tier, suited for medium enterprise designs.

Combining layers lowers equipment cost while retaining high availability.

Examine data center Spine-Leaf (Clos) architectural dynamics.

Distinguish that Spine switches form a full mesh fabric with Leaf switches to optimize east-west server traffic with deterministic latency.

Spine switches do not connect to each other; they strictly interconnect leaf nodes across a non-blocking Layer 3 fabric.

Key Concept

Network Architectural Layer Functional Responsibilities and Design Trade-offs

Question 229Question →

A network administrator is reviewing bandwidth efficiency for application traffic traversing a low-bandwidth WAN link. Which statement accurately compares the baseline header size overhead between Transmission Control Protocol (TCP) and User Datagram Protocol (UDP)?

TCP requires a 20-byte minimum header to accommodate reliability tracking fields, whereas UDP uses an 8-byte header to minimize transmission overhead.

UDP requires a 20-byte header to manage packet sequencing and retransmissions, whereas TCP uses an 8-byte fixed header.

Both TCP and UDP utilize an identical 20-byte baseline header structure to maintain standardized Layer 4 port multiplexing.

TCP maintains an 8-byte header because dynamic windowing eliminates the need for header-based flow control fields.

Show answer & explanation

Answer: TCP requires a 20-byte minimum header to accommodate reliability tracking fields, whereas UDP uses an 8-byte header to minimize transmission overhead.

Answer

TCP requires a 20-byte minimum header to accommodate reliability tracking fields, whereas UDP uses an 8-byte header to minimize transmission overhead.

The option identifying TCP's 20-byte minimum header and UDP's 8-byte fixed header is correct because TCP must carry fields for flow control, error recovery, and sequencing, whereas UDP only carries basic addressing, length, and checksum information.

Step-by-Step Solution

Analyze TCP header requirements

TCP is a connection-oriented, reliable protocol that requires fields for Source/Destination Ports, Sequence Number, Acknowledgment Number, Data Offset, Control Flags, Window Size, Checksum, and Urgent Pointer, consuming 20 bytes minimum.

Reliability mechanisms demand additional header fields.

Analyze UDP header requirements

UDP is a connectionless, best-effort protocol containing only Source Port, Destination Port, Length, and Checksum fields, totaling 8 bytes.

Absence of sequencing and flow control allows for minimal header overhead.

Compare protocol header sizes

TCP headers are at least 20 bytes, while UDP headers are fixed at 8 bytes.

This structural difference directly reflects their performance and reliability tradeoffs.

Key Concept

TCP vs UDP Header Size and Overhead Comparison

Question 230Question →

A network engineer is deploying new infrastructure across a multi-site enterprise network. Match each network component on the left to its primary operational function on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Router matches with evaluating Layer 3 IP headers to forward packets between subnets. Next-Generation Firewall (NGFW) matches with stateful packet filtering, deep packet inspection, and threat prevention. Wireless LAN Controller (WLC) matches with centralizing radio resource management, AP provisioning, and mobility. Layer 2 Switch matches with forwarding frames within the same local network segment based on destination MAC addresses.

Each component is mapped to its core operational role: Routers perform Layer 3 path determination between distinct IP subnets; Next-Generation Firewalls conduct stateful security filtering and deep packet inspection; Wireless LAN Controllers manage and provision lightweight access points centrally; and Layer 2 Switches perform MAC address-based frame switching within a local broadcast domain.

Step-by-Step Solution

Identify the primary operating OSI layer and function of a Router.

Routers operate at Layer 3 (Network layer), making forwarding decisions using IP addresses to route packets between different networks.

Routing across subnet boundaries requires network layer addressing and broadcast domain separation.

Identify the distinct security enforcement capabilities of an NGFW.

NGFWs inspect traffic statefully across multiple OSI layers, enforcing security policies, IPS, and application awareness.

Firewalls protect network perimeters by filtering unauthorized or malicious traffic.

Determine the management role of a Wireless LAN Controller (WLC).

WLCs provide centralized management for lightweight access points, handling RF configuration, roaming, and security policies.

Split-MAC wireless architectures centralize control-plane functions on the WLC.

Determine the forwarding behavior of a Layer 2 Switch.

Layer 2 switches inspect Ethernet frames and use the MAC address table to forward traffic within a single broadcast domain.

Switches handle local network frame switching at Layer 2 without modifying IP headers.

Key Concept

Network Components Roles and Functions

Question 231Question →

A network engineer is configuring a Cisco router interface with the command `ipv6 address 2001:db8:cafe:100::/64 eui-64`. The burn-in MAC address of the interface is `1866.DA12.3456`. Based on the IEEE EUI-64 process, which IPv6 global unicast address will be dynamically assigned to this interface?

2001:db8:cafe:100:1a66:daff:fe12:3456

2001:db8:cafe:100:1866:daff:fe12:3456

2001:db8:cafe:100:1a66:dafe:ff12:3456

2001:db8:cafe:100:1a66:daff:fe12:3457

Show answer & explanation

Answer: 2001:db8:cafe:100:1a66:daff:fe12:3456

Answer

The dynamically generated IPv6 address assigned to the interface is 2001:db8:cafe:100:1a66:daff:fe12:3456.

The EUI-64 creation process takes the 48-bit MAC address (1866.DA12.3456), splits it into two 24-bit pieces, inserts FFFE in the middle (1866:DAFF:FE12:3456), and flips the 7th bit of the first byte (0x18 = 0001 1000 becomes 0x1A = 0001 1010). Appending this 64-bit interface ID to the specified 2001:db8:cafe:100::/64 prefix yields 2001:db8:cafe:100:1a66:daff:fe12:3456.

Step-by-Step Solution

Split MAC address into two equal 24-bit halves

Left half: 18-66-DA, Right half: 12-34-56

EUI-64 requires inserting a 16-bit hex value (FFFE) into the center of the 48-bit MAC address.

Insert FFFE between the two 24-bit halves

1866:DAFF:FE12:3456

This expands the 48-bit MAC address to a 64-bit interface identifier structure.

Invert the 7th bit (Universal/Local bit) of the first byte

First byte 0x18 (0001 1000 in binary) becomes 0x1A (0001 1010 in binary), making the interface ID 1a66:daff:fe12:3456

The IEEE EUI-64 standard specifies flipping the U/L bit (7th bit from left) to indicate whether the address is universally or locally administered.

Combine the /64 IPv6 prefix with the modified 64-bit interface ID

2001:db8:cafe:100:1a66:daff:fe12:3456

Concatenating the prefix 2001:db8:cafe:100::/64 with the EUI-64 interface ID creates the full 128-bit IPv6 global unicast address.

Key Concept

EUI-64 Interface Identifier Generation

Estimated Time:1m 30s

Question 232Question →

A network administrator is analyzing Cisco IOS switch interface outputs to resolve network degradation. Match each interface status combination or error counter condition on the left to its corresponding primary root cause on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

FastEthernet0/1 up/down matches Layer 2 encapsulation mismatch, keepalive failure, or missing framing. FastEthernet0/2 administratively down matches interface manually disabled via the shutdown command. High count of late collisions matches a duplex mismatch with local full-duplex and remote half-duplex. Increasing runts with CRC errors matches physical cable noise, EMI, or collision fragments creating sub-64 byte frames.

Each interface state and counter statistic accurately aligns with its underlying physical or data-link layer cause: 'up/down' denotes Layer 2 framing/keepalive failure, 'administratively down' represents a software shutdown command, late collisions stem from a duplex mismatch between full-duplex and half-duplex endpoints, and runts with CRC errors signify frame corruption under 64 bytes due to physical noise or collisions.

Step-by-Step Solution

Analyze interface operational states for Layer 1 vs Layer 2 status

Determine that 'up, line protocol down' indicates physical carrier presence with data-link failure, whereas 'administratively down' represents a software-disabled port.

Cisco IOS separates physical layer link carrier status from data-link protocol keepalive and framing verification.

Evaluate CLI error counter symptoms

Associate late collisions with a duplex mismatch scenario and runts paired with CRC errors with physical noise or truncated collision fragments.

Late collisions indicate transmission collisions occurring past the first 64 bytes due to full-duplex ignoring carrier sense, while runts reflect corrupted frame fragments below the minimum Ethernet frame length.

Key Concept

Cisco IOS interface status states and error counter interpretation

Question 233Question →

A network architect is implementing Variable Length Subnet Masking (VLSM) for an enterprise branch using the assigned summary prefix $172.20.0.0/19$ . Four subnets must be allocated sequentially from the lowest available IP address of the block to support the following minimum host requirements:

- Location A: 1,000 usable hosts
- Location B: 480 usable hosts
- Location C: 250 usable hosts
- Location D: 120 usable hosts

Each subnet must be sized using the smallest possible prefix length to satisfy its host requirement. After completing these four allocations in order (Location A, then B, then C, then D), what is the maximum number of usable host IPv4 addresses that can be accommodated in the single largest contiguous unallocated subnet block remaining in the $172.20.0.0/19$ summary range?

Show answer & explanation

Answer: 4094

Answer

The maximum number of usable host addresses in the single largest contiguous unallocated subnet block remaining is 4094.

The base block

172.20.0.0/19

contains

2^{13} = 8192

total IP addresses (ranging from

172.20.0.0

172.20.31.255

). Allocating for Locations A (

/22

, 1024 IPs), B (

/23

, 512 IPs), C (

/24

, 256 IPs), and D (

/25

, 128 IPs) uses addresses

172.20.0.0

through

172.20.7.127

. The remaining space (

172.20.7.128

172.20.31.255

) decomposes into three valid CIDR subnets:

172.20.7.128/25

(128 IPs),

172.20.8.0/21

(2048 IPs), and

172.20.16.0/20

(4096 IPs). The largest single contiguous subnet is

172.20.16.0/20

, which accommodates

2^{12} - 2 = 4094

usable host addresses.

Step-by-Step Solution

Calculate required prefix lengths and allocated address ranges for each location sequentially starting at 172.20.0.0

Location A (1000 hosts) requires /22 (1024 total IPs: 172.20.0.0 - 172.20.3.255). Location B (480 hosts) requires /23 (512 total IPs: 172.20.4.0 - 172.20.5.255). Location C (250 hosts) requires /24 (256 total IPs: 172.20.6.0 - 172.20.6.255). Location D (120 hosts) requires /25 (128 total IPs: 172.20.7.0 - 172.20.7.127).

Each subnet host capacity is calculated using 2^h - 2, where h is the host bits. Minimum prefix blocks must align on natural network boundaries.

Analyze the remaining unallocated address range within the 172.20.0.0/19 block

The total /19 block spans 172.20.0.0 to 172.20.31.255 (8192 total IPs). Address space used so far is 172.20.0.0 through 172.20.7.127 (1920 IPs). Unallocated range is 172.20.7.128 to 172.20.31.255.

Subtracting allocated IP space from the base summary block isolates the remaining contiguous unassigned addresses.

Partition remaining unallocated space into standard summary subnets and find the largest block

Remaining space partitions into 172.20.7.128/25 (128 IPs), 172.20.8.0/21 (2048 IPs), and 172.20.16.0/20 (4096 IPs). The largest block is 172.20.16.0/20.

Subnets must align on binary bit boundaries corresponding to their prefix lengths.

Calculate usable hosts for the largest unallocated block (172.20.16.0/20)

2^12 - 2 = 4096 - 2 = 4094 usable host IPv4 addresses.

Subtracting the network ID and broadcast address from total block addresses gives usable host count.

Key Concept

VLSM block allocation, binary boundary alignment, and unallocated subnet summarization

Estimated Time:3m 0s

Question 234Question →

A network technician is reviewing the physical and logical layout of a small branch office network that uses a 2-Tier (Collapsed Core) campus topology. Which two statements accurately describe key characteristics of this topology architecture? (Select TWO.)

Select all that apply

The core layer and distribution layer functions are combined into a single set of switches.

Access switches connect directly to the collapsed core/distribution devices.

Access switches are used to isolate broadcast domains by default without requiring VLAN configurations.

Trunk links between the collapsed core switches must have PortFast enabled to ensure rapid convergence.

Show answer & explanation

Answer: The core layer and distribution layer functions are combined into a single set of switches.; Access switches connect directly to the collapsed core/distribution devices.

Answer

The two correct traits of a 2-Tier (Collapsed Core) campus topology are that core and distribution layer functions are combined into unified switches, and access switches connect directly to these collapsed core/distribution devices.

In a 2-Tier (Collapsed Core) architecture, the traditional core and distribution layers are combined into a single switch tier, allowing access switches to connect directly to the collapsed core. This minimizes cost and maintenance while providing essential Layer 2/Layer 3 redundancy and connectivity.

Step-by-Step Solution

Identify the defining structural characteristic of a 2-Tier campus architecture.

The core layer and distribution layer are merged (collapsed) into a single functional layer.

This reduces hardware cost, management overhead, and cabling complexity for smaller networks.

Determine how access layer devices connect within this architecture.

Access switches uplink directly into the collapsed core switches.

Since there is no standalone distribution tier, the access switches connect straight to the combined core/distribution layer.

Key Concept

2-Tier (Collapsed Core) Network Topology Architecture

Question 235Question →

A Cisco Catalyst switch contains the following entry in its MAC address table for VLAN 10:

VLAN	MAC Address	Type	Port
10	000a.1111.2222	Dynamic	GigabitEthernet0/1
10	000b.3333.4444	Dynamic	GigabitEthernet0/2

A network technician disconnects the host with MAC address 000a.1111.2222 from port GigabitEthernet0/1 and reconnects it to port GigabitEthernet0/3. The host immediately transmits an Ethernet frame destined for MAC address 000b.3333.4444 into port GigabitEthernet0/3 on VLAN 10. How will the switch handle MAC address learning and frame forwarding for this ingress traffic?

It updates the MAC address table entry for 000a.1111.2222 to associate with GigabitEthernet0/3 and forwards the frame exclusively out GigabitEthernet0/2.

It drops the frame because the source MAC address is already dynamically mapped to a different physical interface.

It forwards the frame out GigabitEthernet0/2 while simultaneously flooding an ARP request out all active VLAN 10 interfaces to clear the old port binding.

It floods the frame out all active interfaces assigned to VLAN 10 except GigabitEthernet0/3 to locate the new path to 000b.3333.4444.

Show answer & explanation

Answer: It updates the MAC address table entry for 000a.1111.2222 to associate with GigabitEthernet0/3 and forwards the frame exclusively out GigabitEthernet0/2.

Answer

The switch updates the MAC address table entry for 000a.1111.2222 to point to GigabitEthernet0/3 and forwards the frame directly out GigabitEthernet0/2.

When an Ethernet frame arrives on port GigabitEthernet0/3, the switch reads the source MAC address 000a.1111.2222. Recognizing that this address was previously assigned to GigabitEthernet0/1, it performs a station move update by rewriting the MAC table entry to GigabitEthernet0/3. Next, the switch looks up the destination MAC address 000b.3333.4444. Since an entry already exists pointing to GigabitEthernet0/2, the switch forwards the frame as a known unicast transmission exclusively out GigabitEthernet0/2.

Step-by-Step Solution

Inspect the ingress frame's source MAC address and ingress port.

Source MAC 000a.1111.2222 is received on GigabitEthernet0/3.

Layer 2 switches perform MAC learning by examining the source MAC address of every incoming frame.

Update the MAC address table for station movement.

The dynamic entry for 000a.1111.2222 is updated from GigabitEthernet0/1 to GigabitEthernet0/3.

When a source MAC address is seen on a new interface, the switch updates the existing table mapping immediately.

Lookup the destination MAC address 000b.3333.4444 in the MAC address table.

Destination MAC 000b.3333.4444 is matched to egress port GigabitEthernet0/2.

Known unicast destination addresses result in point-to-point forwarding to the registered port.

Forward the Ethernet frame.

The frame is forwarded solely out GigabitEthernet0/2.

Because the destination port is known and distinct from the ingress port, no flooding or dropping occurs.

Key Concept

L2 Switching Station Movement and Known Unicast Forwarding

Question 236Question →

A remote branch office requires a dedicated network device to route traffic between local department subnets, isolate broadcast domains, and establish an encrypted site-to-site IPsec tunnel to the main corporate data center. Which network component is designed to perform these combined operational functions?

An enterprise router

An unsegmented Layer 2 switch

A hosted Type 2 hypervisor

A Lightweight Access Point in Local mode

Show answer & explanation

Answer: An enterprise router

Answer

An enterprise router is designed to route traffic across distinct IP subnets, separate broadcast domains, and terminate site-to-site IPsec VPN connections.

The option specifying an enterprise router correctly identifies the device operating at Layer 3 capable of making forwarding decisions based on IP addresses, isolating broadcast domains on each interface, and providing WAN capabilities such as site-to-site IPsec VPN encryption.

Step-by-Step Solution

Analyze the operational requirements stated in the scenario.

The device must perform inter-VLAN IP routing, separate broadcast domains, and terminate site-to-site IPsec VPN tunnels.

Identifying the required OSI layer operations (Layer 3 IP routing and security encapsulation) narrows down the appropriate hardware component.

Evaluate candidate network components against these requirements.

Routers operate at Layer 3, separating broadcast domains at each interface and routing IP packets while supporting WAN services like VPNs.

Layer 2 switches operate within a single broadcast domain per VLAN, Type 2 hypervisors manage VMs on top of an OS, and Local mode LAPs encapsulate wireless frames for a centralized WLC.

Key Concept

Network Component Roles (Routers vs Switches vs Access Points vs Hypervisors)

Estimated Time:1m 0s

Question 237Question →

In a standard two-tier Spine-Leaf data center architecture, to which switches does every leaf switch directly connect?

To every spine switch in the network fabric

To adjacent leaf switches to break up broadcast domains

To host servers running Type 1 hypervisors to handle inter-spine forwarding

To inter-switch trunks configured with STP PortFast across all leaf nodes

Show answer & explanation

Answer: To every spine switch in the network fabric

Answer

Every leaf switch connects directly to every spine switch in the network fabric.

In a Spine-Leaf (Clos) architecture, every leaf switch connects to every spine switch in a full mesh layout between tiers. Leaf switches do not connect to each other, nor do spine switches connect to each other. This design provides consistent latency and maximum redundancy.

Step-by-Step Solution

Identify the structural rule of a two-tier Spine-Leaf (Clos) data center topology.

In a two-tier Spine-Leaf architecture, every leaf switch must connect to every spine switch in the fabric.

This guarantees equal path distance (predictable latency) and maximum bandwidth between any two leaf switches.

Verify inter-switch connection rules within the leaf and spine layers.

Leaf switches do not connect directly to other leaf switches, and spine switches do not connect directly to other spine switches.

Maintaining strict bipartite connectivity ensures efficient Equal-Cost Multi-Path (ECMP) routing across all available paths.

Key Concept

Spine-Leaf Architecture Bipartite Connectivity

Estimated Time:45s

Question 238Question →

A network administrator executes the `show interfaces GigabitEthernet0/2` command on a Cisco IOS switch to investigate frame loss on a point-to-point connection. The command output displays the following status:

text
GigabitEthernet0/2 is up, line protocol is up
Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
14205 input errors, 14205 CRC, 0 frame, 0 overrun, 0 ignored
0 output errors, 0 collisions, 0 interface resets

Based on the CLI output, which condition is the most likely cause of the observed interface statistics?

Damaged copper cabling or high levels of electromagnetic interference along the cable path

An incorrect Ethernet pinout selection between legacy network devices with Auto-MDIX disabled

A native VLAN configuration mismatch between trunk interfaces at opposite ends of the link

A misinterpretation of incoming CDP or LLDP discovery protocol Type-Length-Value fields

Show answer & explanation

Answer: Damaged copper cabling or high levels of electromagnetic interference along the cable path

Answer

Damaged copper cabling or high levels of electromagnetic interference along the cable path is the most likely cause of the CRC errors.

CRC errors occur when the receiving switch interface calculates a Frame Check Sequence (FCS) that does not match the FCS attached to the incoming frame. On a link with zero collisions and correctly operating full-duplex negotiation, high CRC error counts are almost exclusively caused by physical layer media degradation, such as a damaged twisted-pair cable, loose RJ-45 connectors, bad patch panel terminations, or electromagnetic interference (EMI).

Step-by-Step Solution

Analyze the interface status and duplex settings in the CLI output.

The interface status is 'up/up' and operating in Full-duplex at 1000Mb/s.

Verifies that Layer 1 physical link and Layer 2 line protocol are active, ruling out complete link loss caused by cabling mismatch.

Examine the error counters in the interface statistics.

Input errors equal 14,205, with all 14,205 registered specifically as CRC errors, while collisions remain 0.

A CRC error occurs when a frame's calculated Frame Check Sequence (FCS) does not match the checksum value sent by the transmitting node.

Correlate CRC errors with potential root causes.

Since duplex is matched and no collisions exist, frame corruption during transit points directly to physical Layer 1 media degradation (faulty cables, bad punch-downs, or external EMI noise).

Late collisions would indicate a duplex mismatch, whereas CRC errors with zero collisions indicate corruption of bits while crossing the physical medium.

Key Concept

Interface CRC and Input Errors Troubleshooting

Question 239Question →

A network administrator is selecting a transport layer protocol for a real-time voice streaming service where low transmission latency is required and dropped packets should not be retransmitted. Which characteristic of User Datagram Protocol (UDP) makes it better suited than Transmission Control Protocol (TCP) for this application?

UDP operates with a lightweight fixed 8-byte header and no connection setup overhead.

UDP ensures zero packet loss by utilizing dynamic windowing and automatic sequence number tracking.

UDP incorporates a variable 20-to-60 byte header to dynamically alter transmission rates based on network congestion.

UDP establishes low-latency virtual circuits prior to data transfer by performing a abbreviated two-way handshake.

Show answer & explanation

Answer: UDP operates with a lightweight fixed 8-byte header and no connection setup overhead.

Answer

UDP operates with a lightweight fixed 8-byte header and no connection setup overhead.

The choice highlighting UDP's lightweight fixed 8-byte header and lack of connection setup overhead is correct because UDP is a stateless, connectionless protocol designed for low-latency delivery where packet retransmission is undesirable.

Step-by-Step Solution

Analyze application requirements

Real-time voice traffic requires minimal delay and does not benefit from retransmitting delayed packets.

Retransmitted voice packets arrive too late to be useful in a live conversation.

Evaluate transport layer protocols

UDP is connectionless and has a minimal 8-byte header size compared to TCP's 20-byte minimum header and mandatory 3-way handshake.

UDP avoids the latency overhead associated with session establishment, sequencing, and flow control.

Key Concept

UDP vs TCP Header and Connection Mechanics

Estimated Time:45s

Question 240Question →

Match each network application operational requirement or protocol scenario on the left with its corresponding transport layer protocol implementation characteristic on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Real-time VoIP pairs with UDP 8-byte low-latency transport; BGP peering pairs with TCP port 179 stateful reliable transport; TFTP image download pairs with UDP port 69 and application-layer ACKs; SNMP polling pairs with UDP port 161 stateless request-response.

Real-time VoIP demands UDP for minimal latency and an 8-byte header; BGP requires TCP on port 179 for reliable ordered routing updates; TFTP uses UDP port 69 and handles reliability at the application layer; SNMP polling uses UDP port 161 for lightweight stateless data collection.

Step-by-Step Solution

Analyze transport latency and retransmission requirements for voice traffic

Real-time VoIP requires low latency and predictable delivery without retransmitting dropped packets, matching UDP's 8-byte header fixed structure.

Retransmitted voice packets arrive too late to be decoded into meaningful audio.

Analyze reliability requirements for control plane routing protocols

BGP demands strict sequence ordering and guaranteed arrival of routing table updates, matching TCP port 179 stateful behavior.

BGP does not implement its own transport retransmission mechanism.

Evaluate bootloader file transfer architecture

TFTP uses UDP port 69 while handling stop-and-wait acknowledgments at the application layer.

Simple boot ROMs require minimal transport stack overhead while still needing basic delivery validation.

Evaluate high-frequency network monitoring polling overhead

SNMP polling uses UDP port 161 for stateless queries to prevent memory exhaustion on monitoring hosts.

Establishing TCP three-way handshakes for thousands of recurring metric requests adds unnecessary processing and state overhead.

Key Concept

TCP vs UDP Transport Characteristics and Application Protocol Mapping

PreviousPage 12 / 20Next

Network Fundamentals

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept