Network Fundamentals Practice Questions — Cisco CCNA — Page 2

Question 21Question →

A network engineer is configuring a static IPv4 address for a server residing on a network segment assigned the network ID $172.24.16.0/22$ . Which IPv4 address represents a valid usable host address that can be assigned to this server?

172.24.19.254

172.24.19.255

172.24.20.1

172.32.16.5

Show answer & explanation

Answer: $172.24.19.254$

Answer

172.24.19.254

is a valid usable host address within the

172.24.16.0/22

subnet.

The IP address

172.24.19.254

is the last valid usable host IP address in the

172.24.16.0/22

subnet range, which spans from

172.24.16.1

to

172.24.19.254

.

Step-by-Step Solution

1

Determine the subnet mask and block size

A prefix of

/22

corresponds to a subnet mask of

255.255.252.0

. The block size in the third octet is

256 - 252 = 4

.

Calculating the block size identifies how the subnets increment across the third octet.

2

Identify the network boundary and next subnet

The network address is

172.24.16.0

. Adding the block size of

4

to the third octet gives the next subnet network address of

172.24.20.0

.

The next subnet boundary defines the upper limit of the current subnet.

3

Calculate the broadcast address and usable host range

The broadcast address is

172.24.19.255

(one IP before

172.24.20.0

). The usable host range spans from

172.24.16.1

through

172.24.19.254

.

Usable host addresses lie strictly between the network ID and the broadcast ID.

Key Concept

IPv4 Subnet Boundaries and Usable Host Identification

Question 22Question →

Match each Cisco IOS interface status or error counter symptom to its corresponding physical or data-link troubleshooting root cause.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Late collisions match duplex mismatch; CRC errors match physical cable corruption or noise; Interface up / line protocol down matches Layer 2 encapsulation mismatch; Interface administratively down matches the interface being disabled with the shutdown command.

Matching interface symptoms correctly pairs late collisions with duplex mismatches, CRC error increments with physical cabling damage or electrical noise, 'up/down' status with Layer 2 framing/encapsulation issues, and 'administratively down' status with the interface shutdown configuration command.

Step-by-Step Solution

1

Examine the Layer 1 physical symptoms and Cisco IOS interface counters.

Differentiate between physical layer errors (CRC, late collisions), interface operational states (up/down), and administrative states (administratively down).

Each Cisco IOS interface statistic isolates specific Layer 1 or Layer 2 network faults.

2

Map each interface symptom to its underlying root cause.

Pair late collisions with duplex mismatch, CRC errors with cable/interference issues, up/down line protocol with encapsulation/keepalive failures, and administratively down with the shutdown command.

Accurate pairing ensures effective troubleshooting of physical and data link layer issues.

Key Concept

Cisco IOS Interface Troubleshooting and Diagnostics

Question 23Question →

Match each enterprise network infrastructure component on the left with its primary operational function and architectural role on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Next-Generation Firewall matches deep packet inspection up to Layer 7; Wireless LAN Controller matches centralized access point provisioning and RF management; Type 1 Hypervisor Virtual Switch matches bridging vNICs to physical network interfaces on bare metal; Layer 3 Access Switch matches hardware-based ASIC inter-VLAN packet forwarding.

Each network component is correctly paired with its defining enterprise function: Next-Generation Firewalls perform deep packet inspection up to Layer 7; Wireless LAN Controllers manage centralized AP configurations, radio frequencies, and roaming; Type 1 Hypervisor Virtual Switches bridge virtual machine vNICs directly on bare-metal hardware; and Layer 3 Access Switches utilize dedicated ASICs for wire-speed inter-VLAN packet routing.

Step-by-Step Solution

1

Identify the primary operational scope of enterprise security appliances.

Determine that Next-Generation Firewalls (NGFW) inspect packet payloads through Layer 7 to provide application identification, IPS functionality, and threat prevention.

Traditional firewalls evaluate only Layer 3 and Layer 4 headers, whereas NGFWs integrate deep packet inspection at Layer 7.

2

Analyze centralized management functions for campus wireless networks.

Recognize that Wireless LAN Controllers (WLC) serve as central control points for Lightweight Access Points (LAPs), handling channel management, transmit power, and client roaming coordination.

Cisco split-MAC architecture places real-time MAC functions on the LAP and management/control functions on the WLC.

3

Evaluate hypervisor types and virtual networking architectures.

Determine that a Type 1 Hypervisor operates natively on physical hardware without a host OS, using embedded virtual switches to interconnect vNICs to physical NIC uplinks.

Type 1 bare-metal hypervisors bypass consumer operating system overhead, presenting direct hardware interfaces to virtual switches.

4

Examine high-speed LAN switching and routing mechanisms.

Identify that Layer 3 switches use Application-Specific Integrated Circuits (ASICs) to forward IP packets between VLANs at line rate.

Layer 3 switches combine traditional switch port density with dedicated routing ASICs to remove software routing bottlenecks.

Key Concept

Roles, operational layers, and architectural responsibilities of primary enterprise network components.

Question 24Question →

Match each Cisco IOS interface status or error symptom on the left to its most probable underlying root cause on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Interface down/down matches physical Layer 1 failure; Interface up/down matches Layer 2 encapsulation or keepalive failure; Interface administratively down matches manual shutdown command; Interface up/up with late collisions matches duplex mismatch.

Interface diagnostic states directly correlate with specific OSI layers and configurations: physical cable disconnects cause 'down/down'; Layer 2 framing errors cause 'up/down'; the 'shutdown' command displays 'administratively down'; and late collisions on an active link indicate a duplex mismatch.

Step-by-Step Solution

1

Analyze 'Interface is down, line protocol is down'.

Identified physical Layer 1 signal loss.

When electrical/optical carrier signal is missing due to a disconnected or broken cable, both status and line protocol report down.

2

Analyze 'Interface is up, line protocol is down'.

Identified Layer 2 protocol/framing failure.

Physical carrier (Layer 1) is detected, but Data Link layer communication failed due to mismatched encapsulation or lost keepalives.

3

Analyze 'Interface is administratively down, line protocol is down'.

Identified manual administrative disablement.

This explicit status string appears only when an administrator applies the 'shutdown' configuration command.

4

Analyze 'Interface is up, line protocol is up (with rapidly incrementing late collisions)'.

Identified duplex mismatch error pattern.

Late collisions occur when an interface set to half-duplex transmits while a full-duplex remote end transmits without checking for collisions past the slot time window.

Key Concept

Cisco IOS Interface Status Diagnostics and Troubleshooting

Question 25Question →

A system engineer is configuring a static IPv4 address for a database server located on a segment designated with a network ID of $172.30.100.0$ and a subnet mask of $255.255.254.0$ . Company security policy requires that the configured address must be a valid usable host address within the assigned subnet and must also belong to the RFC 1918 private IPv4 address space. Which IPv4 address is a valid host address for this server?

172.30.101.250

172.30.101.255

172.32.100.50

172.30.102.1

Show answer & explanation

Answer: $172.30.101.250$

Answer

172.30.101.250

The subnet mask

255.255.254.0

creates subnets with a block size of

2

in the third octet. For the network ID

172.30.100.0

, the subnet encompasses

172.30.100.0

through

172.30.101.255

, giving a usable host range of

172.30.100.1

to

172.30.101.254

. The IP address

172.30.101.250

falls cleanly inside this usable host range and is also a valid RFC 1918 private address (within

172.16.0.0/12

).

Step-by-Step Solution

1

Determine the CIDR prefix and block size for subnet mask 255.255.254.0.

The subnet mask 255.255.254.0 corresponds to a /23 prefix length. The block size in the third octet is calculated as 256 - 254 = 2.

Calculating the block size identifies how the subnets increment across octets.

2

Calculate the network ID, broadcast address, and usable host range for the 172.30.100.0/23 subnet.

The network address is 172.30.100.0, the broadcast address is 172.30.101.255, and the range of valid usable host IPs is 172.30.100.1 through 172.30.101.254.

Host IP addresses cannot use the subnet network ID (first IP) or broadcast address (last IP).

3

Verify compliance with RFC 1918 private IPv4 address boundaries.

RFC 1918 specifies the Class B private IP range as 172.16.0.0 to 172.31.255.255 (172.16.0.0/12 block). The address 172.30.101.250 falls inside this range.

Addresses starting with 172.32.x.x fall outside RFC 1918 limits and are public addresses.

Key Concept

IPv4 Subnet Mask Calculation and RFC 1918 Private Address Boundaries

Question 26Question →

A Layer 2 switch receives an Ethernet frame with a unicast destination MAC address that does not currently exist in its MAC address table. Which two actions does the switch take upon receiving this frame?

Select all that apply

It floods the frame out all active interfaces in the VLAN except the ingress port.

It examines the source MAC address of the frame and updates its MAC address table if the entry is missing.

It drops the frame immediately because the destination MAC address is unresolvable.

It forwards the frame to the default gateway router for MAC address resolution.

It sends a Layer 2 discovery protocol message to discover which port owns the destination MAC address.

Show answer & explanation

Answer: It floods the frame out all active interfaces in the VLAN except the ingress port.; It examines the source MAC address of the frame and updates its MAC address table if the entry is missing.

Answer

The switch populates its MAC address table using the ingress frame's source MAC address and floods the frame out all active switch ports within the VLAN, excluding the port on which the frame arrived.

When a Layer 2 switch receives a frame, it always inspects the source MAC address to learn or update its location in the MAC address table. If the destination MAC address is unknown, the switch performs an unknown unicast flood by forwarding the frame to all active interfaces in the VLAN, except the port on which the frame was received.

Step-by-Step Solution

1

Inspect the incoming Ethernet frame header.

The switch identifies the frame's source MAC address and destination MAC address.

Learning and forwarding decisions are based on Layer 2 MAC addresses.

2

Process the source MAC address for learning.

The source MAC address is mapped to the ingress switch port in the MAC address table.

The MAC address table populates dynamically from incoming traffic source addresses.

3

Determine forwarding action based on destination MAC address lookup.

Since the destination MAC address is not found in the table, the frame is classified as unknown unicast and flooded out all ports except the receiving port.

Flooding ensures the frame reaches its intended destination even if its switch port location is currently unknown.

Key Concept

Switch learning mechanics and unknown unicast flooding

Question 27Question →

An Ethernet frame with a destination MAC address of FFFF.FFFF.FFFF arrives on switch port FastEthernet0/5. The switch MAC address table currently contains no entry for the source MAC address of the frame. Which dual action will the switch perform upon receiving this frame?

Record the source MAC address mapped to FastEthernet0/5 in the MAC table, and flood the frame out all active switch ports except FastEthernet0/5.

Drop the frame immediately because FFFF.FFFF.FFFF is a reserved broadcast address that cannot be processed by Layer 2 switches.

Flood the frame out all active switch ports, including FastEthernet0/5, without updating the MAC address table.

Forward the frame directly to the default gateway router to resolve the destination broadcast address.

Show answer & explanation

Answer: Record the source MAC address mapped to FastEthernet0/5 in the MAC table, and flood the frame out all active switch ports except FastEthernet0/5.

Answer

Record the source MAC address mapped to FastEthernet0/5 in the MAC table, and flood the frame out all active switch ports except FastEthernet0/5.

When a Layer 2 switch receives an Ethernet frame, it first inspects the source MAC address. If the source MAC is not present in the MAC table, the switch creates a new entry mapping that source MAC address to the receiving port (FastEthernet0/5). Next, it inspects the destination MAC address. Because FFFF.FFFF.FFFF is the Layer 2 broadcast address, the switch floods the frame out every active interface in the VLAN except the interface on which the frame arrived.

Step-by-Step Solution

1

Examine the incoming frame's source MAC address and ingress port.

The switch notes that the source MAC address is not currently in the MAC address table.

Layer 2 switches perform MAC learning by recording the incoming source MAC address associated with the ingress interface (FastEthernet0/5).

2

Examine the incoming frame's destination MAC address.

The destination MAC address is identified as FFFF.FFFF.FFFF (Layer 2 broadcast).

Broadcast frames are intended for all devices within the broadcast domain.

3

Execute frame forwarding.

The frame is flooded out all operational ports belonging to the same VLAN, excluding the receiving port (FastEthernet0/5).

Flooding ensures all hosts receive the broadcast, while excluding the ingress port prevents frame loops.

Key Concept

Layer 2 MAC Address Table Learning and Broadcast Frame Flooding Logic

Question 28Question →

An organization is assigned the IPv6 address block $2001:\text{db8}:1111:2000::/52$ . A network engineer needs to configure a router interface within a new /64 subnet that has a 12-bit subnet ID extension of $0x\text{A40}$ added to the base /52 prefix. The router interface uses EUI-64 to generate its interface identifier automatically based on its MAC address `0200.4C12.3456`. Which IPv6 Global Unicast Address will be dynamically configured on this interface?

2001:db8:1111:2a40::4cff:fe12:3456

2001:db8:1111:2a40:200:4cff:fe12:3456

2001:db8:1111:a40::4cff:fe12:3456

2001:db8:1111:2a40:400:4cff:fe12:3456

Show answer & explanation

Answer: 2001:db8:1111:2a40::4cff:fe12:3456

Answer

2001:db8:1111:2a40::4cff:fe12:3456

The subnet prefix is derived by adding the subnet ID extension

0x\text{A40}

to the base prefix 4th hextet (

2000

), producing

2\text{A}40

. For EUI-64 generation from MAC `0200.4C12.3456`, `FFFE` is inserted into the middle (`0200.4CFF.FE12.3456`), and the 7th bit of the first byte (`0x02` = `0000 0010`) is inverted to `0` (`0x00` = `0000 0000`), yielding `0000:4cff:fe12:3456`. Combining these results in `2001:db8:1111:2a40::4cff:fe12:3456`.

Step-by-Step Solution

1

Calculate the /64 subnet prefix from the assigned /52 block and subnet offset

Subnet prefix is 2001:db8:1111:2a40::/64

The base /52 prefix ends at the 4th hex digit of the 4th hextet (

2000

). Adding the 12-bit hex extension

0x\text{A40}

yields

2000 + \text{A40} = 2\text{A}40

in hexadecimal for the 4th hextet.

2

Split the MAC address 0200.4C12.3456 into two 24-bit halves and insert FFFE

Intermediate identifier is 0200:4CFF:FE12:3456

EUI-64 requires inserting the hex value FFFE into the middle of the 48-bit MAC address.

3

Invert the 7th bit (Universal/Local bit) of the first byte

First byte 0x02 (binary 0000 0010) becomes 0x00 (binary 0000 0000)

In EUI-64 generation, flipping the 7th bit changes a 1 to a 0 (or 0 to 1), transforming 0200:4CFF:FE12:3456 into 0000:4CFF:FE12:3456 (compressed as ::4cff:fe12:3456).

4

Combine the /64 prefix with the EUI-64 interface identifier

2001:db8:1111:2a40::4cff:fe12:3456

Merging 2001:db8:1111:2a40::/64 and 0000:4cff:fe12:3456 gives the final global unicast address.

Key Concept

IPv6 EUI-64 Interface Identifier Generation and Subnet Prefix Calculation

Question 29Question →

A network technician is configuring static IPv4 addresses for new network monitoring probes on a subnetwork assigned the address block $192.168.50.144/28$ . Which of the following IP addresses are valid usable host addresses on this subnet? (Select two.)

Select all that apply

192.168.50.146

192.168.50.157

192.168.50.144

192.168.50.159

Show answer & explanation

Answer: $192.168.50.146$ ; $192.168.50.157$

Answer

The addresses

192.168.50.146

and

192.168.50.157

are valid usable host addresses on the

192.168.50.144/28

subnet.

For the network block

192.168.50.144/28

, the

/28

prefix yields a block size of 16 (

256 - 240

). The subnet boundaries are defined by the network ID

192.168.50.144

and the broadcast address

192.168.50.159

. Therefore, valid host IP addresses must fall strictly between

192.168.50.145

and

192.168.50.158

. The addresses

192.168.50.146

and

192.168.50.157

fall within this range.

Step-by-Step Solution

1

Determine the subnet mask and block size from the CIDR prefix.

A

/28

prefix corresponds to a subnet mask of

255.255.255.240

. The block size (increment) per subnet is

256 - 240 = 16

.

Calculating the block size identifies the boundary and increment for the subnet range.

2

Identify the network ID and broadcast address for the subnet.

The network ID is

192.168.50.144

. The next subnet starts at

144 + 16 = 160

, making the broadcast address

192.168.50.159

.

Network ID and broadcast address delineate the extreme boundaries of the subnet.

3

Calculate the usable host address range.

The first usable host address is

192.168.50.145

and the last usable host address is

192.168.50.158

.

Usable host addresses exclude the network ID and broadcast address (

2^n - 2

).

4

Evaluate the candidate options against the usable host range.

192.168.50.146

and

192.168.50.157

lie strictly within the range

192.168.50.145

–

192.168.50.158

, while

192.168.50.144

is the network ID and

192.168.50.159

is the broadcast address.

Only IP addresses within the usable host range can be statically configured on end-device interfaces.

Key Concept

IPv4 Usable Host Address Range Calculation

Question 30Question →

An engineer is troubleshooting a degraded Ethernet connection on switch interface `FastEthernet0/8` connected to an end host. The interface output reveals high numbers of `late collisions` and `deferred` frames, while `input errors` remain at zero:

text
FastEthernet0/8 is up, line protocol is up (connected)
Hardware is Fast Ethernet, address is 000c.ce6b.a108
Full-duplex, 100Mb/s, media type is 100BaseTX
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 buffer
3842 late collisions, 1045 deferred, 0 lost carrier

Which TWO physical or data-link conditions are the most probable causes of these output statistics? (Select TWO.)

Select all that apply

A duplex mismatch where the switch port is forced to full-duplex and the connected device is operating in half-duplex

The copper cable segment length exceeds the maximum 100-meter limit defined by Ethernet standards

A native VLAN identifier mismatch between the switch port and the connected end-user host

An incorrect cable pinout selection (straight-through instead of crossover) between legacy switch ports without Auto-MDIX

Show answer & explanation

Answer: A duplex mismatch where the switch port is forced to full-duplex and the connected device is operating in half-duplex; The copper cable segment length exceeds the maximum 100-meter limit defined by Ethernet standards

Answer

The most probable causes are a duplex mismatch where one side operates in full-duplex while the other operates in half-duplex, and an Ethernet copper cable run that exceeds the 100-meter maximum length specification.

Late collisions occur when a device detects a collision after transmitting the first 64 bytes of an Ethernet frame. The two primary causes are a duplex mismatch (where one end operates in full-duplex while the other operates in half-duplex, causing the half-duplex end to detect late collisions) and an over-length cable run (where cable propagation delay exceeds the slot time of 512 bit times).

Step-by-Step Solution

1

Analyze the interface statistics provided in the CLI output

Identified high numbers of late collisions (3842) and deferred frames (1045), with zero CRC or input errors.

Late collisions occur when a collision is detected after the first 64 bytes (512 bits) of a frame have been transmitted.

2

Evaluate potential causes of late collisions on Ethernet links

Duplex mismatches (full-duplex on switch, half-duplex on host) cause the half-duplex host to detect full-duplex transmissions as late collisions. Excessively long cable runs (>100m) delay collision detection past the 64-byte window.

Late collisions are exclusively associated with timing issues on half-duplex collision domains or duplex mismatches.

3

Eliminate invalid options based on Layer 1/Layer 2 symptom profiles

Native VLAN mismatches affect traffic routing/tagging across trunks rather than interface collision counters. Cable pinout mismatches without Auto-MDIX cause the link status to remain down/down.

Physical cabling pinout errors prevent link layer synchronization entirely.

Key Concept

Late Collision and Duplex Mismatch Troubleshooting

Question 31Question →

A network administrator is assigned the IPv6 prefix block `2001:db8:cafe:a000::/56` for a branch office. The administrator must divide this allocation into multiple `/64` subnets for individual client VLANs. Which prefix represents the last `/64` subnet available within this assigned block?

2001:db8:cafe:a0ff::/64

2001:db8:cafe:a0fe::/64

2001:db8:cafe:a00f::/64

2001:db8:cafe:a100::/64

Show answer & explanation

Answer: 2001:db8:cafe:a0ff::/64

Answer

The prefix 2001:db8:cafe:a0ff::/64 represents the last /64 subnet available within the assigned /56 block.

The prefix 2001:db8:cafe:a0ff::/64 correctly identifies the last /64 subnet within the 2001:db8:cafe:a000::/56 assignment. A /56 prefix allocates 8 bits (bits 57 through 64) for creating /64 subnets, which correspond to the last two hexadecimal digits of the fourth hextet. The range of the fourth hextet for these subnets is from a000 to a0ff.

Step-by-Step Solution

1

Determine the number of subnet bits available between the assigned prefix length (/56) and the target prefix length (/64).

64 - 56 = 8 subnet bits, which equal 2 hexadecimal digits.

Each hexadecimal character in an IPv6 address represents 4 bits (1 nibble).

2

Identify which hextet and bit positions contain these subnet bits.

The first 48 bits cover the first three hextets (2001:db8:cafe:). The assigned /56 prefix includes the first 8 bits of the fourth hextet ('a0'). The subnet bits occupy the remaining 8 bits of the fourth hextet.

The fourth hextet spans bits 49 through 64.

3

Calculate the maximum value for the 8 subnet bits.

8 bits of all binary 1s equal hex 'ff'. The fourth hextet ranges from 'a000' (first subnet) to 'a0ff' (last subnet).

Hexadecimal 'a0' followed by 'ff' forms the last valid /64 prefix.

Key Concept

IPv6 Subnetting and Prefix Length Calculations

Question 32Question →

A network architect is designing an enterprise branch network that requires high-speed inter-VLAN routing for internal communication between local subnets, alongside deep packet inspection, stateful traffic monitoring, and intrusion prevention for all internet-bound traffic. Which deployment strategy correctly assigns these operational roles to the appropriate network components to maximize performance and security?

Perform local inter-VLAN packet forwarding on a Layer 3 switch using ASIC-based routing, and forward external traffic to a Next-Generation Firewall (NGFW) for application-layer inspection and security enforcement.

Perform local inter-VLAN routing on an unmanaged Layer 2 switch to break up broadcast domains, and rely on client endpoint NICs to inspect application-layer payloads for external traffic.

Install a Type 2 hypervisor directly on bare-metal hardware at the network boundary to handle line-rate inter-VLAN routing and hardware-level packet switching without an OS host.

Configure Layer 2 discovery protocols (CDP/LLDP) on access switches to perform stateful security filtering and inspect TCP application payloads between subnets.

Show answer & explanation

Answer: Perform local inter-VLAN packet forwarding on a Layer 3 switch using ASIC-based routing, and forward external traffic to a Next-Generation Firewall (NGFW) for application-layer inspection and security enforcement.

Answer

Local inter-VLAN routing should be performed on a Layer 3 switch using ASIC-based forwarding, while edge traffic should be directed through a Next-Generation Firewall (NGFW) for stateful application-layer inspection.

In enterprise architecture, assigning Layer 3 switches to handle inter-VLAN routing leverages ASIC hardware for high-bandwidth, low-latency internal traffic forwarding. Positioning a Next-Generation Firewall (NGFW) at the network perimeter provides dedicated stateful packet inspection, application recognition, and security policy enforcement for external traffic.

Step-by-Step Solution

1

Analyze the requirements for internal inter-VLAN routing.

Layer 3 switches use dedicated hardware Application-Specific Integrated Circuits (ASICs) to route traffic between local VLANs at wire speed with minimal latency.

Routing internal subnets at Layer 3 on switch hardware offloads throughput demands from security edge devices.

2

Analyze the requirements for external internet-bound security enforcement.

Next-Generation Firewalls (NGFWs) perform stateful packet inspection, deep packet inspection (DPI), and application-level security policy enforcement.

Standard Layer 3 switches lack advanced threat prevention, deep packet inspection, and stateful application control features.

3

Evaluate component assignments.

Combining Layer 3 switches for internal forwarding with an NGFW at the internet perimeter fulfills both high throughput and robust security requirements.

This functional division adheres to Cisco enterprise architectural best practices.

Key Concept

Operational roles and functional differentiation of Layer 3 switches and Next-Generation Firewalls (NGFWs) in enterprise design.

Estimated Time:2m 0s

Question 33Question →

An enterprise infrastructure deployment utilizes a physical server running a bare-metal Type 1 hypervisor. Two virtual machines, VM1 and VM2, reside on this physical host and are attached to the same virtual switch (vSwitch) configured on VLAN 50. The host's physical Network Interface Card (pNIC) connects to an external physical Layer 2 switch port configured for VLAN 50. When VM1 transmits an Ethernet broadcast frame, which statement correctly describes the component roles and frame forwarding behavior across this environment?

The internal vSwitch switches the broadcast frame directly to VM2 and forwards a copy out through the pNIC to the physical switch, while the bare-metal Type 1 hypervisor directly manages physical hardware resource allocation.

The physical Layer 2 switch must receive the broadcast frame first via the pNIC, update its MAC address table, and then transmit the frame back down the same physical link to reach VM2.

The hosted Type 2 hypervisor relies on a underlying client operating system to pass the broadcast frame to the host's networking stack for forwarding between VM1 and VM2.

The physical Layer 2 switch inspects CDP/LLDP TLV information attached to the broadcast frame to terminate the broadcast domain at the pNIC interface boundary.

Show answer & explanation

Answer: The internal vSwitch switches the broadcast frame directly to VM2 and forwards a copy out through the pNIC to the physical switch, while the bare-metal Type 1 hypervisor directly manages physical hardware resource allocation.

Answer

The internal vSwitch switches the broadcast frame directly to VM2 and forwards a copy out through the pNIC to the physical switch, while the bare-metal Type 1 hypervisor directly manages physical hardware resource allocation.

In a virtualized environment with a bare-metal Type 1 hypervisor, the embedded virtual switch (vSwitch) operates as a standard Layer 2 switch for connected virtual interfaces. When a VM sends a broadcast frame, the vSwitch floods the frame to all local virtual ports belonging to that VLAN (delivering it directly to VM2) and transmits a copy through the physical host NIC (pNIC) uplink to the external physical switch. The Type 1 hypervisor directly controls hardware resources without requiring an intermediate host operating system.

Step-by-Step Solution

1

Analyze the hypervisor architecture type and role.

A Type 1 hypervisor runs directly on the bare-metal host hardware (without a host OS) and manages hardware resources for virtual machines directly.

Understanding the hypervisor architecture establishes how hardware interactions and virtual networking components operate.

2

Determine the local frame forwarding behavior on the virtual switch (vSwitch).

The vSwitch acts as a software-based Layer 2 switch inside the hypervisor. When VM1 generates a broadcast frame on VLAN 50, the vSwitch floods it to all local ports in VLAN 50 (reaching VM2).

Local intra-host switching occurs within the hypervisor software without requiring packets to exit to the physical network first.

3

Determine the egress frame forwarding behavior to the physical network.

The vSwitch also forwards the broadcast frame out of the uplink interface (pNIC) to the external physical Layer 2 switch so that other physical devices in VLAN 50 receive the broadcast.

Broadcast domains extend across both virtual and connected physical switch ports configured on the same VLAN.

Key Concept

Virtual Switch (vSwitch) and Type 1 Hypervisor Operational Roles

Estimated Time:2m 0s

Question 34Question →

Match each transport layer protocol characteristic on the left to its corresponding protocol on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

TCP corresponds to connection establishment via a 3-way handshake and dynamic flow control via windowing. UDP corresponds to low overhead with an 8-byte header and stateless best-effort delivery for latency-sensitive applications.

TCP provides stateful session establishment, reliable delivery, and flow control mechanisms, making it suitable for applications requiring guaranteed data delivery. UDP maintains no connection state, operates with an 8-byte header, and prioritizes rapid transmission for traffic where timeliness matters more than missing packet retransmission.

Step-by-Step Solution

1

Analyze connection-oriented and reliability features

The 3-way handshake and dynamic windowing/acknowledgments belong to TCP.

TCP provides reliable, ordered, and flow-controlled communication.

2

Analyze connectionless and overhead features

The 8-byte fixed header and stateless delivery for real-time applications belong to UDP.

UDP trades error recovery and sequencing for maximum speed and minimal overhead.

Key Concept

Transport layer protocol comparison: TCP connection-oriented reliability vs. UDP connectionless efficiency

Estimated Time:1m 0s

Question 35Question →

An enterprise network engineer is designing a wireless deployment using a Centralized Wireless LAN Controller (WLC) architecture based on the Split-MAC protocol structure. To ensure low latency for time-sensitive radio frequency operations, certain MAC layer operations must occur on the physical Access Point (AP). Which function is executed directly by the Lightweight Access Point (LAP) hardware rather than being handled by the Centralized WLC?

Transmission of beacon frames and immediate 802.11 layer acknowledgments

Client 802.1X EAP authentication state management and key exchange processing

Radio Resource Management (RRM) calculations for global channel allocation

Translation between 802.11 wireless frames and 802.3 Ethernet frames across all client traffic

Show answer & explanation

Answer: Transmission of beacon frames and immediate 802.11 layer acknowledgments

Answer

Transmission of beacon frames and immediate 802.11 layer acknowledgments

Under the Cisco Split-MAC architecture (CAPWAP model), functions are divided based on timing requirements. Real-time 802.11 MAC operations—such as sending beacon frames, responding to probe requests, handling frame acknowledgments (ACKs), and executing MAC-layer encryption/decryption—must occur directly on the Lightweight Access Point (LAP) hardware to satisfy strict 802.11 timing constraints.

Step-by-Step Solution

1

Analyze the Split-MAC architecture division of responsibilities between LAPs and WLCs.

Identify that functions requiring microsecond-level timing must be processed locally at the AP radio level.

CAPWAP tunnel latency to the WLC would introduce unacceptable delays for real-time RF MAC operations.

2

Categorize real-time MAC functions versus non-real-time control/management functions.

Beacon frame generation, probe responses, frame queuing/prioritization, and 802.11 layer ACK responses belong to real-time MAC functions performed by the LAP.

These tasks must occur immediately in response to RF signals.

3

Evaluate the management and control functions offloaded to the WLC.

802.1X/EAP authentication, association requests, RRM channel selection, and centralized 802.11 to 802.3 frame translation are handled by the controller.

Centralizing these non-real-time operations allows uniform policy enforcement and global RF optimization across the enterprise network.

Key Concept

Split-MAC Architecture Division of Responsibilities

Question 36Question →

An enterprise network engineer is implementing a centralized wireless network architecture utilizing Cisco Lightweight Access Points (LAPs) and a centralized Wireless LAN Controller (WLC) operating in Split-MAC mode. Which operational responsibility is handled directly by the Wireless LAN Controller rather than being processed locally by the Lightweight Access Point?

Transmitting 802.11 beacon frames and handling real-time probe responses for nearby wireless clients

Processing 802.1X client authentication requests and managing centralized wireless client associations

Encrypting and decrypting 802.11 frame payloads in real time for connected wireless endpoints

Generating local Layer 2 discovery advertisements to advertise link status over LLDP to the access switch

Show answer & explanation

Answer: Processing 802.1X client authentication requests and managing centralized wireless client associations

Answer

Processing 802.1X client authentication requests and managing centralized wireless client associations

In Cisco Split-MAC wireless architecture, the Wireless LAN Controller (WLC) is responsible for centralizing management and control plane operations. This includes processing 802.1X client authentication, managing client association states, enforcing security policies, and orchestrating Radio Resource Management (RRM). Real-time operations, such as beaconing, probe responses, and frame encryption, remain on the Lightweight Access Point (LAP).

Step-by-Step Solution

1

Analyze the Split-MAC architecture responsibilities between Lightweight Access Points (LAPs) and Wireless LAN Controllers (WLCs).

Split-MAC divides 802.11 protocol handling into real-time MAC tasks (handled by the LAP) and non-real-time management tasks (handled by the WLC).

This division optimizes latency-sensitive frame transmissions while keeping network-wide security and RF policy control centralized.

2

Identify real-time functions assigned to the LAP.

Real-time duties include beacon transmission, probe responses, packet acknowledgments (ACKs), and 802.11 frame encryption/decryption.

These tasks require microsecond-level timing and must occur directly at the physical radio interface.

3

Identify non-real-time functions assigned to the WLC.

Non-real-time duties include 802.1X security authentication processing, client association tracking, roaming coordination, and Radio Resource Management (RRM).

Centralizing these tasks allows the WLC to maintain consistent security policies and system-wide visibility across all access points.

Key Concept

Split-MAC Architecture and WLC vs. LAP Functional Roles

Question 37Question →

A network engineer is designing a 10 Gbps backbone link between two switches located in separate campus buildings that are 450 meters apart. The campus conduit contains both multi-mode optical fiber (OM2 and OM3) and single-mode optical fiber (OS2). The link must achieve maximum throughput without signal degradation. Which optic transceiver and cabling combination must be selected to fulfill this requirement?

10GBASE-LR SFP+ transceiver over single-mode fiber (OS2)

10GBASE-SR SFP+ transceiver over OM3 multi-mode fiber

10GBASE-T SFP+ transceiver over Category 6A unshielded twisted-pair copper cable

10GBASE-CR Direct Attach Copper (DAC) crossover cable with Auto-MDIX enabled

Show answer & explanation

Answer: 10GBASE-LR SFP+ transceiver over single-mode fiber (OS2)

Answer

10GBASE-LR SFP+ transceiver over single-mode fiber (OS2)

The 10GBASE-LR standard uses long-wavelength optics (1310 nm) over single-mode fiber (SMF/OS2), which easily supports a distance of 450 meters (up to a 10 km maximum limit).

Step-by-Step Solution

1

Analyze required distance and speed parameters

The requirement specifies a 10 Gbps Ethernet connection across a distance of 450 meters.

Different Ethernet physical layer standards (transceivers and cable types) have strict maximum reach limits.

2

Evaluate multi-mode fiber (MMF) standard limits for 10GBASE-SR

10GBASE-SR over OM2 reaches up to 82 meters; over OM3 reaches up to 300 meters; over OM4 reaches up to 400 meters. None of the available MMF options reach 450 meters.

Short-wavelength (850 nm) lasers on multi-mode fiber suffer from modal dispersion over long distances.

3

Evaluate copper cabling options

10GBASE-T UTP twisted-pair cable max distance is 100 meters; Direct Attach Copper (DAC) cables max distance is 7–10 meters.

Electrical signal attenuation limits copper cabling for high-speed long-distance links.

4

Evaluate single-mode fiber (SMF/OS2) options

10GBASE-LR operates using long-wavelength (1310 nm) lasers over single-mode optical fiber and supports distances up to 10 kilometers (10,000 meters).

Single-mode fiber avoids modal dispersion, making it the ideal choice for distances exceeding 400 meters.

Key Concept

Ethernet optical transceiver standards, distance limitations, and fiber cable types (10GBASE-SR vs 10GBASE-LR)

Question 38Question →

An enterprise network engineer is deploying a centralized wireless architecture using Cisco Lightweight Access Points (LAPs) and a Wireless LAN Controller (WLC) configured for Split-MAC operation. Which function is performed locally by the Lightweight Access Point during normal operation?

Transmission of 802.11 beacon frames and handling of probe responses

Processing of 802.11 client association and reassociation requests

Execution of 802.1X EAP client authentication and security key management

Translation of 802.11 wireless frames into 802.3 Ethernet frames

Show answer & explanation

Answer: Transmission of 802.11 beacon frames and handling of probe responses

Answer

Transmission of 802.11 beacon frames and handling of probe responses

Under Cisco's Split-MAC architecture, real-time 802.11 PHY and MAC functions—such as generating 802.11 beacon frames, responding to client probe requests, packet buffering for power-save mode, and layer 1/2 frame acknowledgments—are handled directly by the Lightweight Access Point (LAP). Because these operations demand tight, real-time execution, processing them locally prevents latency issues that would occur if traffic had to travel back and forth over a CAPWAP tunnel to the WLC.

Step-by-Step Solution

1

Analyze the Split-MAC architecture model used in Cisco centralized wireless networks.

Identify that functions are split between real-time MAC functions (AP) and management/non-real-time MAC functions (WLC).

Split-MAC optimizes processing by keeping delay-sensitive RF tasks on the AP while centralizing policy and control on the WLC.

2

Categorize the AP responsibilities under real-time MAC operations.

Real-time MAC tasks include sending 802.11 beacons, responding to probe requests, frame handshakes (ACKs), and packet buffering for power-save clients.

These tasks require microsecond-level timing and cannot tolerate latency introduced by traversing a CAPWAP tunnel to the controller.

3

Categorize WLC responsibilities under management and security functions.

Non-real-time functions include 802.11 authentication/association, 802.1X/EAP processing, security key distribution, and 802.11-to-802.3 frame conversion.

These functions control network access policies and data forwarding centrally.

Key Concept

Split-MAC Architecture Division of Responsibilities

Estimated Time:1m 0s

Question 39Question →

A network administrator configures a router interface to automatically generate a global unicast IPv6 address using EUI-64 based on the network prefix $2001:\text{db8}:\text{acad}:1::/64$ . Given that the interface burned-in hardware MAC address is $1060.4\text{b}22.3344$ , which IPv6 address is dynamically assigned to the interface?

2001:db8:acad:1:1260:4bff:fe22:3344

2001:db8:acad:1:1060:4bff:fe22:3344

2001:db8:acad:1:1260:4bff:ffff:3344

2001:db8:acad:1:0260:4bff:fe22:3344

Show answer & explanation

Answer: 2001:db8:acad:1:1260:4bff:fe22:3344

Answer

The dynamically assigned IPv6 global unicast address is 2001:db8:acad:1:1260:4bff:fe22:3344.

The correct answer correctly applies both steps of EUI-64 interface identifier construction: inserting 0xFFFE into the middle of the MAC address (between 10-60-4B and 22-33-44) and inverting the 7th bit of the first byte (converting 0x10 binary 00010000 to 0x12 binary 00010010), yielding the interface ID 1260:4bff:fe22:3344 concatenated with prefix 2001:db8:acad:1::/64.

Step-by-Step Solution

1

Split the 48-bit MAC address into two 24-bit halves.

Left half is 1060.4b, right half is 22.3344.

EUI-64 generation requires dividing the MAC address to insert a 16-bit hex delimiter in the middle.

2

Insert the hex string FFFE between the two halves.

1060.4bff:fe22.3344.

Inserting FFFE expands the 48-bit MAC address into a 64-bit interface identifier.

3

Invert the 7th bit (Universal/Local bit) of the first byte.

First byte 0x10 (00010000 in binary) becomes 0x12 (00010010 in binary), making the interface ID 1260:4bff:fe22:3344.

IEEE EUI-64 format requires inverting the 7th bit to signify a universally administered address.

4

Combine the /64 network prefix with the generated 64-bit interface ID.

2001:db8:acad:1:1260:4bff:fe22:3344.

Concatenating the prefix 2001:db8:acad:1::/64 with the interface ID forms the complete IPv6 Global Unicast Address.

Key Concept

EUI-64 Interface Identifier Derivation

Question 40Question →

A network administrator is auditing enterprise IP addressing schemas across multiple branch office subnets to ensure full compliance with RFC 1918 private addressing standards. During the audit, the administrator observes four host interface configurations:

- Device A: $10.255.250.1/8$
- Device B: $172.31.255.1/12$
- Device C: $172.32.10.1/16$
- Device D: $192.168.255.1/16$

Which host is configured with a globally routable public IPv4 address rather than a valid RFC 1918 private IPv4 address?

Device C (

172.32.10.1/16

)

Device B (

172.31.255.1/12

)

Device A (

10.255.250.1/8

)

Device D (

192.168.255.1/16

)

Show answer & explanation

Answer: Device C ( $172.32.10.1/16$ )

Answer

Device C (

172.32.10.1/16

) is configured with a public IPv4 address because RFC 1918 defines the Class B private IPv4 allocation strictly as

172.16.0.0

to

172.31.255.255

(

172.16.0.0/12

).

The RFC 1918 standard reserves three specific IPv4 address blocks for private internal network use:

10.0.0.0/8

(

10.0.0.0

–

10.255.255.255

),

172.16.0.0/12

(

172.16.0.0

–

172.31.255.255

), and

192.168.0.0/16

(

192.168.0.0

–

192.168.255.255

). The address assigned to Device C (

172.32.10.1/16

) falls outside the

172.16.0.0/12

boundary because its second octet (

32

) is greater than

31

. Therefore, it is a globally routable public address.

Step-by-Step Solution

1

Identify the three defined RFC 1918 private IPv4 address blocks and their prefix boundaries.

Class A:

10.0.0.0/8

(

10.0.0.0

–

10.255.255.255

); Class B:

172.16.0.0/12

(

172.16.0.0

–

172.31.255.255

); Class C:

192.168.0.0/16

(

192.168.0.0

–

192.168.255.255

).

RFC 1918 reserves specific IPv4 address ranges exclusively for private enterprise networks.

2

Evaluate each given IP address against the defined RFC 1918 boundaries.

10.255.250.1

is within

10.0.0.0/8

;

172.31.255.1

is within

172.16.0.0/12

;

192.168.255.1

is within

192.168.0.0/16

;

172.32.10.1

exceeds the upper limit (

172.31.255.255

) of the Class B range.

Addresses beyond

172.31.255.255

, such as

172.32.0.0/11

, are allocated as public IP space by IANA.

3

Determine which device uses a public, globally routable IPv4 address.

Device C (

172.32.10.1/16

) uses a public address.

Because

172.32.10.1

is outside the RFC 1918 private boundary, it requires direct public Internet routing or dynamic translation.

Key Concept

RFC 1918 Private IPv4 Address Ranges

Network Fundamentals

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept