Network Fundamentals Practice Questions — Cisco CCNA — Page 17

Question 321Question →

During a network link congestion event, a network administrator notices that file transfer sessions automatically reduce their sending rate to prevent buffer overflows, while a concurrent real-time voice stream continues transmitting at a constant rate despite dropping packets. Which transport layer characteristic accounts for this difference in behavior?

TCP utilizes sliding window mechanisms and acknowledgement tracking for dynamic flow control, whereas UDP lacks native flow and congestion control mechanisms.

UDP relies on Layer 3 IP flags within its 8-byte header to perform rate limiting, whereas TCP uses Layer 2 Ethernet pause frames to signal congestion to the sender.

TCP relies on a smaller fixed 8-byte header that embeds explicit bandwidth regulation bits, whereas UDP uses a variable 20-byte header that omits timing control fields.

UDP buffers unacknowledged packets at the transport layer until missing sequence numbers arrive, whereas TCP drops corrupted packets without signaling retransmission.

Show answer & explanation

Answer: TCP utilizes sliding window mechanisms and acknowledgement tracking for dynamic flow control, whereas UDP lacks native flow and congestion control mechanisms.

Answer

TCP provides dynamic flow control and reliability through sliding windowing and acknowledgement tracking, whereas UDP is connectionless and lacks built-in flow or congestion control.

TCP is a stateful, connection-oriented protocol that features dynamic flow control mechanisms such as sliding windows and window size scaling. When network congestion occurs and packet loss is detected, TCP throttles its transmission window to adapt to path capacity. UDP is stateless and connectionless, possessing no mechanism for tracking delivered data or modifying sending rates in response to network congestion.

Step-by-Step Solution

1

Analyze the observed protocol behaviors described in the scenario.

One application dynamically scales back its transmission rate upon encountering packet loss, whereas the other maintains a constant rate regardless of network drop rates.

This contrasts stateful, feedback-driven transport mechanisms with stateless, fire-and-forget transport mechanisms.

2

Compare TCP and UDP transport layer mechanics regarding flow and congestion control.

TCP uses sequence numbers, ACKs, and window size adjustments (sliding windowing) to regulate data delivery based on receiver capability and network path congestion. UDP has no windowing, acknowledgement system, or flow control capabilities.

Identifying protocol mechanisms confirms why TCP throttles during congestion while UDP continues sending uninterrupted.

Key Concept

TCP Connection-Oriented Flow Control vs UDP Connectionless Operation

Question 322Question →

A network engineer is provisioning subnets from the enterprise address block $10.150.16.0/20$ . The engineering requirement specifies creating a new subnet that supports a minimum of 115 usable host addresses while minimizing unused IP space. Previously, the block $10.150.16.0/25$ was allocated to VLAN 10, and $10.150.16.128/26$ was allocated to VLAN 20. Following sequential allocation and proper subnet boundary alignment rules, what is the broadcast address of the next valid subnet that fulfills the target host requirement?

10.150.17.127

10.150.16.255

10.150.16.191

10.150.17.255

Show answer & explanation

Answer: $10.150.17.127$

Answer

The broadcast address of the next valid subnet meeting the host requirement is

10.150.17.127

.

To accommodate 115 hosts, a

/25

subnet is required (

2^7 - 2 = 126

usable hosts). A

/25

subnet has a block size of 128 and must start at either

.0

or

.128

in the fourth octet. Since

10.150.16.0/25

occupies

.0 - .127

and

10.150.16.128/26

occupies

.128 - .191

, the

.128

block in the

10.150.16.0

third octet is partially used and unavailable. Moving to the next binary-aligned

/25

boundary yields

10.150.17.0/25

, which has a broadcast address of

10.150.17.127

.

Step-by-Step Solution

1

Determine required prefix length for host sizing.

7 host bits needed (

2^7 - 2 = 126 \ge 115

), yielding a prefix of

/25

(

32 - 7 = 25

).

A

/26

only yields 62 hosts (insufficient), while

/25

provides 126 usable host addresses.

2

Identify boundary alignment rules for a

/25

prefix.

Subnet block size is 128 (

2^7

). Valid

/25

network boundaries in any octet must end on multiples of 128 (

0

or

128

).

Subnet masks require binary boundaries;

/25

subnets can only start at

.0

or

.128

in the fourth octet.

3

Evaluate existing allocations for address overlap.

10.150.16.0/25

consumes

10.150.16.0 - 10.150.16.127

.

10.150.16.128/26

consumes

10.150.16.128 - 10.150.16.191

.

The candidate block

10.150.16.128/25

(

10.150.16.128 - 10.150.16.255

) cannot be used because its first half is partially occupied by

10.150.16.128/26

.

4

Find the next available aligned

/25

network address and calculate its broadcast address.

Next valid boundary is

10.150.17.0/25

. Network:

10.150.17.0

, Broadcast:

10.150.17.127

.

Incrementing to the next

/25

boundary gives

10.150.17.0/25

, whose broadcast address is

10.150.17.127

.

Key Concept

VLSM Subnet Sizing and Boundary Alignment

Estimated Time:2m 0s

Question 323Question →

Match each network architectural layer from Cisco 3-Tier Campus and Data Center Spine-Leaf design models to its primary operational responsibility.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Core Layer matches dedicated high-speed switching backbone without filtering; Distribution Layer matches policy-based routing, ACLs, and inter-VLAN boundaries; Access Layer matches end-user endpoint connectivity and PoE; Spine Layer matches high-bandwidth interconnect fabric enabling ECMP; Leaf Layer matches end-host server attachment point connecting to all spine nodes.

In Cisco network designs, every architectural layer performs a specialized function: the Core layer provides uninhibited high-speed packet transport; the Distribution layer handles routing policies, security boundaries, and aggregation; the Access layer provides user device attachment and port security; the Spine layer forms an ECMP-routed backbone in data centers; and the Leaf layer serves as the endpoint attachment interface connecting to all spine switches.

Step-by-Step Solution

1

Analyze campus 3-tier architectural responsibilities

Core delivers fast transport without inspection, Distribution enforces policy boundaries and routing, and Access connects edge endpoints.

Campus designs enforce modular separation between edge attachment, policy enforcement, and backbone forwarding.

2

Analyze data center spine-leaf architectural responsibilities

Spine switches form the non-blocking interconnect matrix for ECMP routing, while Leaf switches host server attachments and uplink to every spine switch.

Spine-leaf architectures optimize predictable East-West traffic latency across cloud workloads.

3

Map each architectural layer to its corresponding operational profile

All 5 architectural layers are accurately paired with their functional definitions.

Aligns strictly with Cisco design fundamentals.

Key Concept

Cisco 3-Tier Campus and Data Center Spine-Leaf Functional Layer Responsibilities

Estimated Time:1m 30s

Question 324Question →

Match each transport layer operational characteristic or application scenario on the left with its corresponding transport protocol classification on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The 20-byte base header with sequence numbers matches TCP Operational Characteristic. The 8-byte fixed header matches UDP Operational Characteristic. DHCP on ports 67/68 matches UDP-Based Application Protocol. HTTPS on port 443 matches TCP-Based Application Protocol.

TCP provides connection-oriented, reliable transmission using a 20-byte base header equipped with sequence numbers, which web applications like HTTPS (port 443) depend on. UDP provides connectionless, unacknowledged delivery using an 8-byte header, making it optimal for bootstrap protocols like DHCP (ports 67/68).

Step-by-Step Solution

1

Evaluate transport layer header structures and connection state tracking.

Recognize that a 20-byte base header with sequence and acknowledgment fields belongs to TCP, whereas an 8-byte fixed header with minimal overhead belongs to UDP.

TCP requires additional fields for state tracking and error recovery, whereas UDP omits connection tracking fields to reduce latency.

2

Classify upper-layer protocols by transport requirements and port assignments.

Associate DHCP (ports 67/68) with UDP due to its reliance on unacknowledged local network broadcasts, and associate HTTPS (port 443) with TCP due to its requirement for reliable stream delivery during TLS sessions.

Application protocols requiring high efficiency or initial broadcast bootstrap use UDP, while those requiring complete, ordered data delivery use TCP.

Key Concept

TCP vs UDP header structure, operational statefulness, and well-known application mapping

Question 325Question →

A network administrator is allocating subnets from the enterprise address block $172.16.0.0/12$ to provision a new datacenter VLAN that must support at least $500$ usable host interfaces. The design requires using the most efficient subnet mask possible to conserve IP address space, while ensuring all assigned host addresses strictly adhere to RFC 1918 private IPv4 specifications. Which statements regarding this subnetting design are correct? (Select TWO.)

Select all that apply

The most efficient subnet mask to accommodate the host requirement is

255.255.254.0

(

/23

).

The IP address

172.31.255.250

is a valid private IPv4 host address within the allocated

172.16.0.0/12

address space.

A subnet mask of

255.255.255.0

(

/24

) provides

512

total host addresses, satisfying the requirement with minimal wasted addresses.

The IP address

172.32.10.15

is a valid private IPv4 host address within the

172.16.0.0/12

block.

Show answer & explanation

Answer: The most efficient subnet mask to accommodate the host requirement is $255.255.254.0$ ( $/23$ ).; The IP address $172.31.255.250$ is a valid private IPv4 host address within the allocated $172.16.0.0/12$ address space.

Answer

The correct answers are the statement identifying 255.255.254.0 (/23) as the most efficient subnet mask and the statement confirming that 172.31.255.250 is a valid private IPv4 address within the 172.16.0.0/12 range.

The subnetting calculation requires 9 host bits (

2^9 - 2 = 510

) to support 500 hosts, making

/23

(

255.255.254.0

) the most efficient choice. Additionally, RFC 1918 defines Class B private space as

172.16.0.0

to

172.31.255.255

, which includes

172.31.255.250

.

Step-by-Step Solution

1

Calculate the host bits required for 500 usable host interfaces.

Using the formula

2^h - 2 \ge 500

,

h = 9

host bits are needed because

2^9 - 2 = 510

usable addresses (

2^8 - 2 = 254

is insufficient).

Two addresses in every subnet are reserved for network identity and subnet broadcast.

2

Determine prefix length and dotted-decimal subnet mask.

Prefix length

= 32 - 9 = /23

. In dotted-decimal format, /23 translates to

255.255.254.0

.

A 23-bit network prefix leaves 9 bits for host addressing.

3

Verify RFC 1918 private IPv4 range boundaries for Class B.

The RFC 1918 Class B private address space spans

172.16.0.0

to

172.31.255.255

(

172.16.0.0/12

).

Address

172.31.255.250

falls inside this range, whereas

172.32.10.15

is in public IP space.

Key Concept

Subnet Host Calculation and RFC 1918 Private Addressing

Question 326Question →

An enterprise Catalyst switch has recently rebooted, and its MAC address table is entirely empty. Host Workstation-1 is connected to port FastEthernet0/12 in VLAN 10 and sends a unicast frame addressed to Server-1 (MAC address 0050.56a1.1a02). The frame enters FastEthernet0/12 carrying a source MAC address of 0050.56a1.1a01. How will the switch process this incoming Ethernet frame?

The switch records MAC address 0050.56a1.1a01 mapped to port FastEthernet0/12 in VLAN 10, and floods the frame out all operational ports assigned to VLAN 10 except FastEthernet0/12.

The switch drops the frame immediately because the destination MAC address 0050.56a1.1a02 does not exist in the MAC address table.

The switch populates its MAC address table with both the source MAC on FastEthernet0/12 and the destination MAC on its expected egress interface.

The switch updates its MAC address table with the source MAC address and floods the frame out all operational ports across all VLANs on the switch, including FastEthernet0/12.

Show answer & explanation

Answer: The switch records MAC address 0050.56a1.1a01 mapped to port FastEthernet0/12 in VLAN 10, and floods the frame out all operational ports assigned to VLAN 10 except FastEthernet0/12.

Answer

The switch records MAC address 0050.56a1.1a01 mapped to port FastEthernet0/12 in VLAN 10, and floods the frame out all operational ports assigned to VLAN 10 except FastEthernet0/12.

When a Layer 2 switch receives an Ethernet frame, it first inspects the source MAC address and associates it with the ingress port and VLAN in its MAC address table. Next, it looks up the destination MAC address. Because the MAC table is empty, the destination MAC is unknown. The switch performs unknown unicast flooding by forwarding the frame out every active port assigned to the same VLAN, excluding the port on which the frame arrived.

Step-by-Step Solution

1

Examine the ingress frame's source MAC address and ingress port.

The source MAC address is 0050.56a1.1a01 on ingress port FastEthernet0/12 (VLAN 10).

Layer 2 switches dynamically build their MAC address table by inspecting the source MAC address of every incoming Ethernet frame.

2

Update the MAC address table entry for VLAN 10.

An entry mapping 0050.56a1.1a01 to FastEthernet0/12 in VLAN 10 is added or refreshed.

Learning source MAC addresses ensures future frames destined for Workstation-1 can be forwarded directly via unicast.

3

Lookup the destination MAC address 0050.56a1.1a02 in the MAC address table.

The destination MAC address is not found (unknown unicast).

The switch MAC address table was cleared after reboot and has not yet observed traffic originating from Server-1.

4

Determine the forwarding action for the unknown unicast frame.

The frame is flooded out all active switch ports belonging to VLAN 10, except the ingress port FastEthernet0/12.

Flooding guarantees delivery to the destination host while restricting traffic within the VLAN boundary and preventing hairpinning back out the ingress port.

Key Concept

L2 Switching Concepts and MAC Table Operation

Question 327Question →

An enterprise network team is upgrading a data center environment to host high-density microservices workloads. The target design requires consistent, low-latency East-West traffic flows where any leaf node is exactly two hops away from any other leaf node, while eliminating Spanning Tree Protocol (STP) blocked ports across inter-switch links. Which network topology architecture best satisfies these operational requirements?

A Spine-Leaf topology where every leaf switch connects to every spine switch in a bipartite layout using active Layer 3 routed links.

A 3-tier campus architecture that relies on Layer 2 switches at the distribution layer to eliminate broadcast domains between core devices.

A collapsed core architecture where Type 2 hypervisors on compute hosts perform physical inter-switch forwarding and topology path optimization.

A traditional campus topology that enables STP PortFast on all inter-switch trunk links to bypass link blocking and maximize throughput.

Show answer & explanation

Answer: A Spine-Leaf topology where every leaf switch connects to every spine switch in a bipartite layout using active Layer 3 routed links.

Answer

A Spine-Leaf topology where every leaf switch connects to every spine switch in a bipartite layout using active Layer 3 routed links.

The correct answer describes a Spine-Leaf (Clos) architecture. In this design, every leaf switch is directly connected to every spine switch, establishing a bipartite graph. Because spine switches do not connect to each other and leaf switches do not connect to each other directly, any inter-leaf path requires exactly two hops (leaf to spine to leaf). Utilizing Layer 3 routing across these links allows Equal-Cost Multi-Pathing (ECMP) to forward traffic across all physical connections simultaneously without triggering Spanning Tree Protocol link blocking.

Step-by-Step Solution

1

Analyze the workload requirement for East-West traffic, predictable two-hop path latency, and non-blocking inter-switch links.

Identified the need for a bipartite data center fabric where endpoints connect to leaf switches, and leaf switches interconnect via a full mesh of active links to spine switches.

Traditional multi-tier topologies introduce variable hop counts and rely on STP to block redundant paths, leading to bandwidth bottlenecks.

2

Evaluate Spine-Leaf architectural traits against Layer 3 forwarding benefits.

Confirm that Spine-Leaf designs use Layer 3 routing (ECMP) across all links, allowing simultaneous active forwarding across all paths without STP blocking.

This guarantees deterministic latency and maximum bandwidth utilization for East-West data center workloads.

Key Concept

Spine-Leaf (Clos) Data Center Topology and Operational Traits

Question 328Question →

A network engineer is optimizing a time-sensitive financial market data broadcast application where minimizing packet processing delay is critical. The development team decides to transport the data feeds using UDP rather than TCP. Which statement accurately compares the Layer 4 header overhead and operational behavior of UDP relative to TCP?

UDP uses a fixed 8-byte header and operates statelessly without connection establishment, whereas TCP uses a minimum 20-byte header and maintains stateful connection tracking.

UDP uses a 20-byte header but achieves lower latency by omitting sequence numbers, whereas TCP header size dynamically scales down to 8 bytes when window scaling is disabled.

UDP reduces header overhead to 8 bytes by moving flow control mechanisms directly into the Layer 3 IP header flags.

UDP maintains a fixed 8-byte header by utilizing negative acknowledgments (NAKs) sent from the destination to report lost datagrams.

Show answer & explanation

Answer: UDP uses a fixed 8-byte header and operates statelessly without connection establishment, whereas TCP uses a minimum 20-byte header and maintains stateful connection tracking.

Answer

UDP utilizes a fixed 8-byte header and operates statelessly without connection setup, while TCP uses a minimum 20-byte header and maintains stateful tracking.

The correct answer accurately states that UDP has a streamlined fixed 8-byte header containing only source port, destination port, length, and checksum fields, and operates without establishing connection state. TCP, by contrast, requires at least 20 bytes of header space for fields such as sequence numbers, acknowledgments, control bits, and window size, maintaining active state tracking across the session.

Step-by-Step Solution

1

Analyze UDP Layer 4 header structure.

UDP headers contain Source Port (2 bytes), Destination Port (2 bytes), Length (2 bytes), and Checksum (2 bytes), resulting in a fixed 8-byte overhead.

Determining the exact byte overhead of UDP.

2

Analyze TCP Layer 4 header structure and state management.

TCP base headers require 20 bytes to accommodate fields for sequence numbers, acknowledgment numbers, flags, window size, and checksum. TCP also requires connection state tracking (handshake, sequence numbering, ACK tracking).

Comparing UDP header size and operational state to TCP.

3

Evaluate the choices to find the statement that accurately reflects these protocol properties.

The statement identifying UDP's fixed 8-byte stateless operation versus TCP's minimum 20-byte stateful tracking is correct.

Matching protocol features to Layer 4 standard specifications.

Key Concept

TCP vs UDP Header Overhead and Connection State

Estimated Time:1m 0s

Question 329Question →

A network engineer is subnetting the parent address block $192.168.45.0/24$ to provision subnets for a regional office. Each subnet must support a minimum of $50$ usable host interfaces while minimizing address wastage. If subnets are assigned sequentially starting from the lowest network address, what is the broadcast address of the third subnet?

192.168.45.191

192.168.45.190

192.168.45.127

192.168.45.95

Show answer & explanation

Answer: $192.168.45.191$

Answer

The broadcast address of the third usable subnet is

192.168.45.191

.

To support 50 host interfaces, 6 host bits (

2^6 - 2 = 62

usable addresses) are necessary, yielding a

/26

mask (block size of 64). The sequential subnets are

192.168.45.0/26

(Subnet 1),

192.168.45.64/26

(Subnet 2), and

192.168.45.128/26

(Subnet 3). The broadcast address of Subnet 3 is the highest address in its range,

192.168.45.191

.

Step-by-Step Solution

1

Determine the required host bits and prefix length.

Using the formula

2^n - 2 \ge 50

,

n = 6

host bits are needed because

2^6 - 2 = 62 \ge 50

. The prefix length is

32 - 6 = /26

.

Choosing 5 host bits (

/27

) yields only

2^5 - 2 = 30

usable hosts, which is insufficient.

2

Calculate the subnet block size (increment).

The block size is

2^6 = 64

addresses.

A

/26

prefix leaves 6 host bits in the fourth octet, causing subnet boundaries to increment by 64.

3

List sequential subnet ranges to identify the third subnet.

Subnet 1:

192.168.45.0/26

(

192.168.45.0

-

192.168.45.63

)
Subnet 2:

192.168.45.64/26

(

192.168.45.64

-

192.168.45.127

)
Subnet 3:

192.168.45.128/26

(

192.168.45.128

-

192.168.45.191

)

Subnets are allocated sequentially starting from

192.168.45.0

.

4

Identify the broadcast address of the third subnet.

The network address is

192.168.45.128

, and the broadcast address (the last address in the block) is

192.168.45.191

.

The broadcast address precedes the next subnet's network address (

192.168.45.192 - 1 = 192.168.45.191

).

Key Concept

IPv4 VLSM Subnetting and Broadcast Address Calculation

Question 330Question →

A network administrator configures an interface on a Cisco router with the IPv6 address `2001:db8:3c4d:15::1/64`. Which of the following IPv6 addresses resides within the exact same `/64` subnet prefix as this interface?

2001:db8:3c4d:15:a::1

2001:db8:3c4d:1500::1

2001:db8:3c4d:15::1::a

2001:db8:3c4d:1::1

Show answer & explanation

Answer: 2001:db8:3c4d:15:a::1

Answer

The address 2001:db8:3c4d:15:a::1 resides in the 2001:db8:3c4d:15::/64 subnet prefix.

The configured interface address 2001:db8:3c4d:15::1/64 uses the network prefix 2001:db8:3c4d:15::/64 (fully expanded as 2001:0db8:3c4d:0015::/64). The address 2001:db8:3c4d:15:a::1 expands to 2001:0db8:3c4d:0015:000a:0000:0000:0001, sharing the exact same 64-bit network prefix.

Step-by-Step Solution

1

Determine the network prefix of the configured IPv6 address

The configured address 2001:db8:3c4d:15::1/64 has a prefix length of /64. Expanding leading zeros gives 2001:0db8:3c4d:0015::1/64. The first 64 bits (4 hextets) represent the network prefix: 2001:0db8:3c4d:0015::/64 (or 2001:db8:3c4d:15::/64).

The prefix length /64 specifies that the first 64 bits determine subnet membership.

2

Expand and evaluate the candidate IPv6 options

Expanding 2001:db8:3c4d:15:a::1 yields 2001:0db8:3c4d:0015:000a:0000:0000:0001. The first 64 bits match 2001:0db8:3c4d:0015 exactly.

IPv6 address compression rules allow leading zeros to be omitted in hextets and contiguous zero hextets to be replaced with :: once.

Key Concept

IPv6 Address Representation and Subnet Prefix Matching

Estimated Time:1m 0s

Question 331Question →

An organization is assigned the IPv4 address block $172.28.0.0/19$ to provision subnetting for a multi-building campus network. The system architecture mandates dividing this entire block into equal-sized subnets where each subnet must support at least $120$ usable host IP addresses. What is the maximum number of such equal-sized subnets that can be created from this $/19$ prefix?

Show answer & explanation

Answer: 64

Answer

64 subnets can be created.

To host at least 120 usable IP addresses, 7 host bits are required (

2^7 - 2 = 126

usable hosts). A block with 7 host bits corresponds to a

/25

prefix. Subnetting a

/19

block into

/25

subnets borrows

25 - 19 = 6

bits, resulting in

2^6 = 64

subnets.

Step-by-Step Solution

1

Determine the required host bits

7 host bits (

h = 7

)

The formula for usable IPv4 hosts per subnet is

2^h - 2

. For 120 hosts,

2^h - 2 \ge 120 \implies 2^h \ge 122

. The smallest power of two satisfying this is

2^7 = 128

(

128 - 2 = 126

usable host addresses).

2

Determine the required subnet prefix length

/25 prefix length

Subtracting 7 host bits from total 32 bits (

32 - 7 = 25

) gives a subnet mask of

/25

(

255.255.255.128

).

3

Calculate the number of subnets derived from the parent prefix

64 subnets

The parent prefix is

/19

and the subnet prefix is

/25

. The number of borrowed subnet bits is

25 - 19 = 6

bits. The total number of subnets created is

2^6 = 64

.

Key Concept

VLSM and Subnet Sizing Calculation

Question 332Question →

An engineer captures traffic from an enterprise workstation streaming live voice communication. The capture shows small datagrams arriving without connection establishment frames, sequence numbers, or acknowledgment requests, allowing out-of-order delivery without triggering retransmissions. Which transport protocol is transmitting this traffic, and what is its baseline header size?

UDP, which uses a fixed 8-byte header containing only source port, destination port, length, and checksum fields.

TCP, which uses a reduced 8-byte header when sequencing and acknowledgment options are disabled for real-time media streams.

UDP, which uses a baseline 20-byte header to maintain port addressing while relying on IP for sequencing.

TCP, which uses a fixed 20-byte header but automatically suppresses retransmissions when payload buffers detect UDP-like data.

Show answer & explanation

Answer: UDP, which uses a fixed 8-byte header containing only source port, destination port, length, and checksum fields.

Answer

UDP, which uses a fixed 8-byte header containing only source port, destination port, length, and checksum fields.

The captured traffic demonstrates connectionless, unreliable delivery suited for real-time voice streaming. User Datagram Protocol (UDP) provides this lightweight transport mechanism using a fixed header of 8 bytes (comprising 2 bytes each for Source Port, Destination Port, Length, and Checksum).

Step-by-Step Solution

1

Analyze packet capture characteristics

Identified connectionless behavior without sequence numbers, ACKs, or handshakes.

Real-time voice traffic prioritizes minimal latency and jitter over reliable delivery.

2

Map operational characteristics to Transport layer protocols

UDP (User Datagram Protocol) is connectionless, whereas TCP is connection-oriented.

UDP does not track sequence numbers or mandate packet retransmission.

3

Determine the exact header size

UDP uses a fixed 8-byte header (Source Port, Destination Port, Length, Checksum), compared to TCP's 20-byte minimum header.

Lower header overhead reduces bandwidth consumption and processing overhead for small real-time datagrams.

Key Concept

TCP vs UDP Header Overhead and Protocol Mechanics

Question 333Question →

An engineer is troubleshooting traffic flow on switch SW-BuildingA. A connected device sends an Ethernet frame that arrives on interface GigabitEthernet0/4. The frame has a source MAC address of 0050.56a1.1a2b and a destination MAC address of 0050.56b2.2c3d. When the switch performs a lookup for the destination MAC address in its MAC address table, it identifies an existing dynamic entry mapping 0050.56b2.2c3d to GigabitEthernet0/4. Which action will the switch perform for this frame?

Learns or updates the source MAC address entry on GigabitEthernet0/4 and filters (drops) the frame.

Floods the frame out all active interfaces assigned to the VLAN except GigabitEthernet0/4.

Forwards the frame back out interface GigabitEthernet0/4 to reach the destination host.

Generates a Layer 2 ICMP redirect frame back to the sender host and drops the original frame.

Show answer & explanation

Answer: Learns or updates the source MAC address entry on GigabitEthernet0/4 and filters (drops) the frame.

Answer

The switch updates or records the source MAC address entry on the ingress port (GigabitEthernet0/4) and filters (drops) the frame without forwarding it.

When a Layer 2 switch receives a frame, it reads the source MAC address to update its MAC address table. Next, it looks up the destination MAC address. If the destination MAC address maps to the exact same port on which the frame arrived, the switch filters (drops) the frame because the destination node is already on that local segment and does not need switch forwarding.

Step-by-Step Solution

1

Examine the ingress interface and source MAC address of the incoming Ethernet frame.

The switch records or updates the MAC address 0050.56a1.1a2b associated with interface GigabitEthernet0/4 in the MAC address table.

Layer 2 switches constantly learn and refresh source MAC address table bindings upon receiving incoming frames.

2

Perform a destination MAC address table lookup for 0050.56b2.2c3d.

The lookup matches an existing dynamic entry pointing to interface GigabitEthernet0/4.

The switch needs to determine which egress port corresponds to the destination host.

3

Compare the egress interface identified in the MAC table lookup with the ingress interface of the frame.

The egress interface (GigabitEthernet0/4) matches the ingress interface (GigabitEthernet0/4).

When ingress and egress ports match, the frame is already present on that physical network segment.

4

Apply frame forwarding/filtering rules based on matching ports.

The switch filters (drops) the frame.

Forwarding the frame back out the ingress port is unnecessary and would cause duplicate frames on a shared Layer 2 segment.

Key Concept

Frame Filtering and MAC Address Table Lookup Rules

Question 334Question →

A network engineer executes the command `ipv6 address 2001:db8:abcd:1000::/64 eui-64` on a Cisco IOS router interface. The interface has a MAC address of `cc01.1a2b.3c4d`. Which IPv6 global unicast address will be assigned to this interface?

2001:db8:abcd:1000:ce01:1aff:fe2b:3c4d

2001:db8:abcd:1000:cc01:1aff:fe2b:3c4d

2001:db8:abcd:1000:ce01:1aff:ffff:3c4d

2001:db8:abcd:1000:cd01:1aff:fe2b:3c4d

Show answer & explanation

Answer: 2001:db8:abcd:1000:ce01:1aff:fe2b:3c4d

Answer

The address 2001:db8:abcd:1000:ce01:1aff:fe2b:3c4d will be assigned to the interface.

The IPv6 address ending in ce01:1aff:fe2b:3c4d correctly applies both EUI-64 modifications: inserting FFFE into the middle of the 48-bit MAC address and inverting the 7th bit of the first byte (0xCC becomes 0xCE).

Step-by-Step Solution

1

Split the 48-bit MAC address into two 24-bit halves.

First half: cc:01:1a, Second half: 2b:3c:4d

EUI-64 generation requires splitting the MAC address at its midpoint to insert a 16-bit delimiter.

2

Invert the 7th bit (Universal/Local bit) of the first byte (0xCC).

0xCC (1100 1100 in binary) becomes 0xCE (1100 1110 in binary).

IEEE EUI-64 specifications require flipping the U/L bit (7th bit from the left) to indicate universal scope.

3

Insert hexadecimal FFFE between the two halves and format as IPv6 quads.

Interface ID: ce01:1aff:fe2b:3c4d

The 16-bit FFFE padding converts the 48-bit MAC address into a 64-bit interface identifier.

4

Combine the 64-bit prefix with the generated 64-bit interface ID.

2001:db8:abcd:1000:ce01:1aff:fe2b:3c4d

Appending the interface ID to the prefix produces the complete 128-bit IPv6 address.

Key Concept

EUI-64 Interface Identifier Derivation

Estimated Time:1m 15s

Question 335Question →

A network engineer configures a Cisco router interface with the command `ipv6 address 2001:db8:cafe:40::/64 eui-64`. The physical MAC address of the interface is `7081.05e1.a2b3`. Which two statements accurately describe the resulting IPv6 addressing state on this interface? (Select two.)

Select all that apply

The dynamically generated Global Unicast Address on the interface is 2001:db8:cafe:40:7281:5ff:fee1:a2b3.

The interface automatically derives a Link-Local address with the prefix fe80::/10 using the same modified EUI-64 interface identifier.

The generated interface identifier is 7081:05ff:fee1:a2b3 because the 7th bit of the MAC address is maintained without inversion for global unicast traffic.

The available host count for this prefix is reduced by two to reserve the network address and broadcast address within the /64 subnet.

Show answer & explanation

Answer: The dynamically generated Global Unicast Address on the interface is 2001:db8:cafe:40:7281:5ff:fee1:a2b3.; The interface automatically derives a Link-Local address with the prefix fe80::/10 using the same modified EUI-64 interface identifier.

Answer

The dynamically generated Global Unicast Address is 2001:db8:cafe:40:7281:5ff:fee1:a2b3, and the interface automatically derives a Link-Local address with the prefix fe80::/10 using the same EUI-64 interface identifier.

The EUI-64 algorithm flips the 7th bit of the first MAC byte (0x70 to 0x72) and inserts FFFE into the middle, yielding the interface ID 7281:05ff:fee1:a2b3. Adding this to the prefix 2001:db8:cafe:40::/64 gives 2001:db8:cafe:40:7281:5ff:fee1:a2b3. Additionally, any IPv6-enabled interface automatically configures a Link-Local address under the fe80::/10 prefix using this same interface ID.

Step-by-Step Solution

1

Convert the MAC address to EUI-64 interface identifier form

MAC 7081.05e1.a2b3 splits into 70-81-05 and e1-a2-b3. Inverting the 7th bit of 0x70 (0011 0000 -> 0011 0010 = 0x72) yields 7281:05. Inserting FFFE between the halves yields 7281:05ff:fee1:a2b3.

EUI-64 requires flipping the U/L bit (7th bit) and placing FFFE in the middle of the 48-bit MAC address to form a 64-bit interface ID.

2

Combine the prefix with the EUI-64 interface identifier

Combining 2001:db8:cafe:40::/64 with 7281:05ff:fee1:a2b3 produces 2001:db8:cafe:40:7281:5ff:fee1:a2b3.

The prefix replaces the upper 64 bits and the EUI-64 identifier populates the lower 64 bits.

3

Evaluate link-local address generation

The router creates a link-local address within fe80::/10 using the interface ID 7281:5ff:fee1:a2b3.

IPv6 interfaces automatically assign a link-local address upon enabling IPv6 processing.

Key Concept

EUI-64 Interface Identifier Generation and IPv6 Address Scopes

Question 336Question →

An organization is upgrading its campus network architecture. The network engineering team needs to design an access-to-distribution layer interconnect that provides active-active path utilization across all uplinks, sub-second routing convergence, and complete elimination of Spanning Tree Protocol (STP) blocked ports. Which network topology design best satisfies these requirements?

Extending Layer 3 routing to the access layer to establish a Routed Access architecture.

Enabling STP PortFast on the inter-switch trunk links connecting access switches to distribution switches.

Deploying Type 2 hypervisors on access switches to manage Layer 2 frame forwarding and loop prevention.

Installing Layer 2 switches at the distribution tier to divide single network segments into separate broadcast domains.

Show answer & explanation

Answer: Extending Layer 3 routing to the access layer to establish a Routed Access architecture.

Answer

Extending Layer 3 routing to the access layer to establish a Routed Access architecture.

In a Routed Access architecture, Layer 3 routing functions are extended down to the access layer switches. By making the access-to-distribution uplinks Layer 3 routed interfaces, Spanning Tree Protocol is eliminated on those connections. Traffic can be load-balanced using Equal-Cost Multi-Path (ECMP), and routing protocols provide fast convergence without blocked links.

Step-by-Step Solution

1

Analyze the requirements for active-active uplinks, fast convergence, and STP elimination.

Traditional Layer 2 access-to-distribution designs require STP to block redundant links, preventing active-active forwarding and resulting in slower convergence.

Layer 2 topologies with redundant paths must block ports via STP to avoid loops.

2

Evaluate the impact of shifting the Layer 2/Layer 3 boundary to access layer switches.

Running Layer 3 routing on access switches converts uplinks to point-to-point IP links.

Routed links utilize routing protocols (such as OSPF or EIGRP) for path selection, permitting ECMP load balancing and eliminating Layer 2 loops and STP entirely.

Key Concept

Routed Access Layer Campus Architecture

Estimated Time:1m 30s

Question 337Question →

A Cisco Catalyst switch receives an Ethernet frame on interface GigabitEthernet0/3 configured in VLAN 15. The frame contains a source MAC address of 0050.56a1.1a01 and a destination MAC address of 0050.56a1.2b02. Upon reviewing its MAC address table, the switch finds that destination 0050.56a1.2b02 is already dynamic mapping to interface GigabitEthernet0/3 in VLAN 15, but there is no entry for source MAC address 0050.56a1.1a01. Which action will the switch perform upon receiving this frame?

The switch records the source MAC address 0050.56a1.1a01 on interface GigabitEthernet0/3 in VLAN 15 and filters (drops) the frame.

The switch floods the frame out all active interfaces in VLAN 15 except GigabitEthernet0/3 because switches treat same-interface traffic as broadcast domain boundary failures.

The switch forwards the frame back out interface GigabitEthernet0/3 toward the destination device after encapsulating it with a discovery protocol TLV.

The switch drops the frame without updating its MAC address table because the source and destination addresses originate from the same collision domain.

Show answer & explanation

Answer: The switch records the source MAC address 0050.56a1.1a01 on interface GigabitEthernet0/3 in VLAN 15 and filters (drops) the frame.

Answer

The switch records the source MAC address 0050.56a1.1a01 on interface GigabitEthernet0/3 in VLAN 15 and filters (drops) the frame.

When an Ethernet frame reaches a switch port, the switch always performs MAC address learning first by inspecting the frame's source MAC address and updating its MAC address table with the ingress port and VLAN. Next, the switch looks up the destination MAC address to make a forwarding decision. If the destination MAC address is located on the exact same port where the frame entered, the switch determines that the destination host is already on the local collision domain/segment and filters (drops) the frame to avoid sending redundant traffic.

Step-by-Step Solution

1

Examine ingress frame header and process source MAC address learning

The switch inspects the source MAC address (0050.56a1.1a01) and adds an entry mapping 0050.56a1.1a01 to interface GigabitEthernet0/3 in VLAN 15 in its MAC address table.

Layer 2 switches learn source MAC addresses from all incoming Ethernet frames on the port they arrive on.

2

Lookup destination MAC address in the MAC address table

The destination MAC address (0050.56a1.2b02) is found in the MAC address table and is mapped to interface GigabitEthernet0/3 in VLAN 15.

Switch lookup determines which egress port should be used to reach the target destination.

3

Compare ingress port with target egress port and apply forwarding/filtering logic

Since the target egress port (GigabitEthernet0/3) matches the ingress port (GigabitEthernet0/3), the frame is filtered (dropped).

Devices connected through a hub or shared segment on GigabitEthernet0/3 receive local traffic directly; retransmitting the frame out the same port would create unnecessary collision and traffic overhead.

Key Concept

Layer 2 Frame Filtering and MAC Address Table Operation

Question 338Question →

A network administrator is designing a VLSM addressing scheme for a branch office using the parent IPv4 block $172.31.96.0/21$ . The subnets must be allocated contiguously starting from the lowest available address in the block, ordered by host requirements from largest to smallest:

- VLAN 10 requires at least 130 usable host IP addresses
- VLAN 20 requires at least 60 usable host IP addresses
- VLAN 30 requires at least 28 usable host IP addresses

What is the last usable IPv4 host address allocated to VLAN 30?

172.31.97.94

172.31.97.95

172.32.97.94

172.31.97.62

Show answer & explanation

Answer: $172.31.97.94$

Answer

The last usable IPv4 host address allocated to VLAN 30 is

172.31.97.94

.

Allocating subnets using VLSM in descending order gives VLAN 10 the block

172.31.96.0/24

(range

172.31.96.0

–

172.31.96.255

) and VLAN 20 the block

172.31.97.0/26

(range

172.31.97.0

–

172.31.97.63

). VLAN 30 receives the next available block

172.31.97.64/27

. The broadcast address of this block is

172.31.97.95

, making the last usable host address

172.31.97.94

.

Step-by-Step Solution

1

Calculate the prefix size and subnet range for VLAN 10 (130 hosts).

To support 130 hosts,

2^8 - 2 = 254

usable hosts are required, requiring 8 host bits (/24 mask). Starting at

172.31.96.0

, the subnet is

172.31.96.0/24

, covering

172.31.96.0

through

172.31.96.255

.

VLSM allocations must satisfy

2^h - 2 \ge \text{required hosts}

and align on bit boundaries.

2

Calculate the prefix size and subnet range for VLAN 20 (60 hosts).

To support 60 hosts,

2^6 - 2 = 62

usable hosts are required, requiring 6 host bits (/26 mask). The next available address is

172.31.97.0

. The subnet is

172.31.97.0/26

, covering

172.31.97.0

through

172.31.97.63

.

Subnets must be assigned sequentially starting immediately after the preceding subnet's broadcast address.

3

Calculate the prefix size and subnet range for VLAN 30 (28 hosts).

To support 28 hosts,

2^5 - 2 = 30

usable hosts are required, requiring 5 host bits (/27 mask). The next available address is

172.31.97.64

. The subnet is

172.31.97.64/27

, covering network ID

172.31.97.64

to broadcast

172.31.97.95

.

A /27 block provides 32 total addresses (

2^5

), yielding a broadcast address of

172.31.97.64 + 31 = 172.31.97.95

.

4

Determine the last usable host IP address for VLAN 30.

The broadcast address is

172.31.97.95

, so the last usable host address is

172.31.97.95 - 1 = 172.31.97.94

.

The usable host range excludes the network ID and the broadcast address.

Key Concept

Variable Length Subnet Masking (VLSM) and Usable Host Range Derivation

Question 339Question →

Host-X sends an Ethernet frame destined for Host-Y through a Cisco Catalyst switch. The switch receives the frame on interface FastEthernet0/2. At the time of arrival, Host-X's source MAC address is not present in the switch MAC address table, while Host-Y's destination MAC address is already mapped to FastEthernet0/8. Place the internal processing steps performed by the Layer 2 switch in the correct chronological sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence begins with receiving the frame on FastEthernet0/2, followed by learning the source MAC address (MAC-X), performing a table lookup for the destination MAC address (MAC-Y), matching MAC-Y to FastEthernet0/8, and finally forwarding the frame solely out interface FastEthernet0/8.

The correct order follows standard Cisco Layer 2 switching logic: 1) Ingress frame reception on interface FastEthernet0/2; 2) Source MAC address inspection and MAC table entry creation for FastEthernet0/2; 3) Destination MAC address table lookup; 4) Identification of egress port FastEthernet0/8; 5) Unicast transmission out FastEthernet0/8.

Step-by-Step Solution

1

Receive Ingress Frame

The switch physical port FastEthernet0/2 accepts the frame header containing source MAC-X and destination MAC-Y.

Layer 2 processing requires the physical frame to enter an ingress interface first.

2

Source MAC Learning

Source MAC-X is mapped to FastEthernet0/2 in the switch MAC address table.

Switches update or populate their CAM/MAC table based on ingress source MAC addresses.

3

Destination MAC Lookup

The switch queries the MAC address table for destination MAC-Y.

The switch needs to decide whether to flood or unicast-forward the ingress frame based on destination MAC state.

4

Match Egress Port

The lookup resolves MAC-Y to interface FastEthernet0/8.

A matching entry prevents unknown unicast flooding.

5

Unicast Frame Forwarding

The frame is transmitted directly out FastEthernet0/8.

Known unicast destination entries result in single-port forwarding.

Key Concept

Layer 2 Ethernet Switching Process and MAC Address Table Learning and Forwarding Logic

Question 340Question →

Match each network topology architecture or deployment model to its defining structural trait or primary operational characteristic.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Spine-Leaf matches the bipartite topology with two-hop latency and ECMP; Cisco 3-Tier Campus matches the distinct Core, Distribution, and Access layer structure; Collapsed Core matches the combination of core and distribution functions into a single tier; SOHO Topology matches the integrated multifunctional single-device deployment.

Each architecture is mapped accurately to its fundamental design pattern: Spine-Leaf provides non-blocking east-west fabric with ECMP; 3-Tier segregates Core, Distribution, and Access duties; Collapsed Core combines Core and Distribution duties for cost savings; SOHO utilizes an all-in-one appliance.

Step-by-Step Solution

1

Analyze the operational requirements of Spine-Leaf (Clos) architecture.

Identify that Spine-Leaf relies on a two-tier fabric where every leaf connects to every spine, using ECMP to route east-west traffic with fixed two-hop latency.

Data center workloads require predictable performance and bandwidth between server racks.

2

Differentiate between 3-Tier and Collapsed Core campus architectures.

Recognize that 3-Tier uses separate Access, Distribution, and Core layers, whereas Collapsed Core combines the Distribution and Core functions onto the same physical switch hardware.

Collapsed Core reduces capital cost for smaller campus sites while retaining boundary control.

3

Identify the defining hardware characteristic of a SOHO topology.

Select the option describing an integrated single-chassis device providing multi-role network services for a small site.

SOHO designs prioritize low cost and simplicity by consolidating routing, switching, AP, and firewall functions.

Key Concept

Network Topology Architectures and Layer Functions

Network Fundamentals

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept