All practice questions

2237 questions

All types2,237 Multiple choice1,150 Multiple select488 Numeric30 Matching350 Ordering201 Short answer18

A network administrator is configuring an enterprise edge firewall to allow 150 internal hosts on a private subnet ( $192.168.1.0/24$ ) to simultaneously access external resources on the Internet. The Internet Service Provider (ISP) has allocated only one public IPv4 address to the company. Which translation method should the administrator implement to meet this requirement?

Port Address Translation (PAT), because it maps internal IP addresses and unique Layer 4 source ports to a single public IP address.

Static NAT, because it creates a permanent one-to-one mapping between each internal private IP address and the single public IP address.

Dynamic NAT, because it translates Layer 3 IP headers from an internal address pool without examining or modifying Layer 4 port information.

Destination NAT, because it rewrites the destination service port on incoming packets to route traffic back to the originating internal host.

Show answer & explanation

Answer: Port Address Translation (PAT), because it maps internal IP addresses and unique Layer 4 source ports to a single public IP address.

Answer

Port Address Translation (PAT) should be implemented because it multiplexes multiple private IP addresses onto a single public IP address by tracking unique Layer 4 transport ports.

Port Address Translation (PAT), also known as NAT Overload, assigns a unique source port number to each internal host's outbound session. This allows up to thousands of concurrent outbound connections from multiple private hosts to share one single public IPv4 address.

Step-by-Step Solution

Analyze the business and technical constraints

150 internal hosts require simultaneous outbound internet access, but only 1 public IP address is available.

Determines whether a one-to-one (Static/Dynamic NAT) or many-to-one (PAT/Overload) translation technique is necessary.

Evaluate NAT/PAT operational mechanisms

Static NAT and standard Dynamic NAT require a 1:1 ratio of private to public IP addresses while active. PAT uses Layer 4 port numbers to multiplex multiple sessions over a single Layer 3 public IP address.

Only PAT (NAT Overload) can support multiple private hosts sharing a single public IPv4 address simultaneously.

Key Concept

Port Address Translation (PAT / NAT Overload)

Question 222Question →

Match each IP addressing service or protocol feature on the left with its core function within network operations on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Network Time Protocol (NTP) matches clock synchronization; IP Address Management (IPAM) matches centralized address space tracking; DHCP Snooping matches filtering rogue DHCP server responses; Dynamic DNS (DDNS) matches updating DNS records dynamically.

Each IP service performs a specialized function in enterprise operations: NTP handles time synchronization for log correlation; IPAM offers centralized management and tracking of address space; DHCP Snooping provides switch port security against unauthorized DHCP servers; DDNS provides automated dynamic update capabilities for DNS records.

Step-by-Step Solution

Identify the primary function of NTP.

NTP synchronizes time across network devices for consistent logging.

Accurate timestamps are required for system log alignment and security analysis.

Identify the primary function of IPAM.

IPAM plans, tracks, and manages IP address allocations across subnets.

Enterprise networks require unified management to prevent address exhaustion and IP conflicts.

Identify the primary security function of DHCP Snooping.

DHCP Snooping blocks rogue DHCP servers at the switch interface level.

Untrusted ports are restricted from sending DHCP Offer and ACK messages.

Identify the primary function of DDNS.

DDNS automatically modifies DNS records when IP addresses change dynamically.

Hostnames remain resolvable even when client IP addresses change frequently via DHCP.

Key Concept

Core functions of enterprise IP addressing and supporting network services

Question 223Question →

A network administrator is configuring IEEE 802.1Q trunk links across enterprise switch interfaces. Match each trunking frame condition or interface operational scenario on the left with the corresponding switch processing or frame tagging behavior on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The untagged ingress frame maps to VLAN 40; the native VLAN egress frame is transmitted untagged; the non-native allowed VLAN egress frame is transmitted with an 802.1Q tag; and the non-allowed tagged ingress frame is dropped.

Each matching pair accurately reflects standard IEEE 802.1Q behavior: untagged ingress frames map to the native VLAN, egress native VLAN traffic stays untagged, egress traffic for other allowed VLANs receives a 4-byte 802.1Q header, and traffic for VLANs omitted from the allowed list is dropped at the port.

Step-by-Step Solution

Analyze native VLAN ingress processing for untagged frames.

Untagged frames arriving on an 802.1Q trunk interface are classified into the configured native VLAN (VLAN 40).

The 802.1Q standard dictates that untagged traffic is implicitly associated with the native VLAN ID assigned to the receiving port.

Determine egress tagging behavior for native VLAN traffic.

Frames belonging to the native VLAN (VLAN 10) are transmitted untagged across the trunk link.

By default, 802.1Q trunks strip or do not prepend a VLAN header tag for frames matching the link's native VLAN.

Determine egress tagging behavior for non-native allowed VLAN traffic.

Traffic for VLAN 20 is encapsulated with a standard 4-byte 802.1Q header containing the VLAN 20 tag.

All non-native VLAN traffic explicitly allowed on a trunk must be tagged so the downstream switch can maintain VLAN separation.

Evaluate filtering rules for non-allowed VLAN traffic.

The ingress frame for VLAN 99 is dropped because VLAN 99 is missing from the trunk's allowed VLAN list.

Trunk allowed VLAN lists restrict incoming and outgoing frame forwarding exclusively to permitted VLAN IDs.

Key Concept

802.1Q Trunk Tagging and Native VLAN Frame Handling

Question 224Question →

A network security appliance running a Syslog service generates an alert log message that must be sent to a remote monitoring server over UDP port 514. In what chronological order does the local host network stack encapsulate the log data from creation to transmission onto the wire?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of encapsulation begins with Application payload creation, followed by Transport layer UDP datagram encapsulation, Network layer IP packet creation, Data Link layer Ethernet framing with MAC addresses and FCS, and finally Physical layer bit conversion to electrical signals.

Outbound encapsulation follows the OSI model from top to bottom (Layer 7 down to Layer 1). The process begins when the Syslog process creates the application payload. Next, the Transport layer adds UDP port headers to create a datagram. Then, the Network layer appends IP addresses to form a packet. After that, the Data Link layer appends MAC addresses and an FCS trailer to construct an Ethernet frame. Finally, the Physical layer encodes the frame into physical signals to send across the network wire.

Step-by-Step Solution

Identify the top-layer application data creation.

The Syslog service generates the raw application data.

Encapsulation starts at the top of the OSI stack (Application layer) when user or system data is created.

Encapsulate at Layer 4 (Transport).

UDP headers (source and destination ports) are added to form a datagram.

The transport layer provides process-to-process addressing using port numbers.

Encapsulate at Layer 3 (Network).

IP headers (source and destination IP addresses) are added to form a packet.

The network layer handles logical network routing and IP addressing across subnets.

Encapsulate at Layer 2 (Data Link).

Ethernet header (MAC addresses) and trailer (FCS) are added to form a frame.

The data link layer provides hop-by-hop physical addressing and error detection.

Transmit at Layer 1 (Physical).

The binary frame is converted into electrical signals for transmission.

The physical layer transmits raw bitstreams across the physical copper cabling medium.

Key Concept

Top-down OSI model outbound data encapsulation sequence (Data -> Datagram/Segment -> Packet -> Frame -> Bits).

Question 225Question →

An enterprise layer 2 network topology consists of four switches (Switch-1, Switch-2, Switch-3, and Switch-4) connected in a full mesh loop redundancy layout running IEEE 802.1D Spanning Tree Protocol (STP). The switches have the following Bridge ID configurations:

- Switch-1: Priority `32768`, MAC `00-0A-00-00-00-01`
- Switch-2: Priority `8192`, MAC `00-0B-00-00-00-01`
- Switch-3: Priority `32768`, MAC `00-0C-00-00-00-01`
- Switch-4: Priority `4096`, MAC `00-0D-00-00-00-01`

Link speeds and path costs between the switches are established as follows:
- Switch-4 to Switch-1: 1 Gbps link (Cost = $4$ )
- Switch-4 to Switch-2: 10 Gbps link (Cost = $2$ )
- Switch-2 to Switch-3: 10 Gbps link (Cost = $2$ )
- Switch-1 to Switch-3: 1 Gbps link (Cost = $4$ )
- Switch-1 to Switch-2: 1 Gbps link (Cost = $4$ )

Based on STP operational rules after convergence, which of the following statements are correct regarding root bridge election and port role calculations? (Select TWO.)

Select all that apply

Switch-4 is elected as the STP Root Bridge for the topology because it possesses the lowest numerical Bridge Priority value.

The interface on Switch-3 connected directly to Switch-1 will transition to the Blocking state.

Switch-2 is elected as the Root Bridge because it has the highest bandwidth link (10 Gbps) directly attached to the network backbone.

Switch-3 selects its interface toward Switch-1 as its Root Port because Switch-1 has a lower MAC address than Switch-2.

Native VLAN traffic on trunk links will bypass STP port state restrictions and remain forwarding on all paths.

Show answer & explanation

Answer: Switch-4 is elected as the STP Root Bridge for the topology because it possesses the lowest numerical Bridge Priority value.; The interface on Switch-3 connected directly to Switch-1 will transition to the Blocking state.

Answer

The two correct statements are: Switch-4 is elected as the STP Root Bridge due to having the lowest numerical Bridge Priority (4096), and Switch-3's port connected to Switch-1 enters the Blocking state after path cost and Designated Bridge calculations.

Switch-4 wins the root election because its priority value of 4096 is strictly lower than any other switch on the network. Furthermore, Switch-3 calculates a lower cost path to the root through Switch-2 (cost of 4) than through Switch-1 (cost of 8). On the link between Switch-1 and Switch-3, both switches have an equal root path cost of 4. Switch-1 breaks the tie because of its lower MAC address (00-0A... vs 00-0C...), claiming the Designated Port role and placing Switch-3's connected port into the Blocking state.

Step-by-Step Solution

Determine the Root Bridge

Switch-4 has Priority 4096, Switch-2 has 8192, Switch-1 and Switch-3 have 32768. The lowest Bridge Priority wins.

STP elects the switch with the lowest Bridge ID (Priority concatenated with MAC address) as the Root Bridge.

Calculate Root Path Costs for each switch

Switch-2 path to Root = Cost 2 (Direct 10 Gbps link). Switch-1 path to Root = Cost 4 (Direct 1 Gbps link). Switch-3 path via Switch-2 = Cost 2 + 2 = 4; path via Switch-1 = Cost 4 + 4 = 8. Switch-3 chooses interface toward Switch-2 as its Root Port.

Switches select the path with the lowest cumulative cost to reach the Root Bridge.

Determine Designated and Blocking ports on the Switch-1 to Switch-3 segment

Switch-1 Root Cost = 4. Switch-3 Root Cost = 4. Cost is tied. Switch-1 Bridge ID (32768:00-0A...) is lower than Switch-3 Bridge ID (32768:00-0C...). Switch-1 port becomes Designated (Forwarding), and Switch-3 port becomes Non-Designated (Blocking).

When Root Path Cost on a shared segment is tied, the switch with the lower Bridge ID wins the Designated Port role, forcing the opposite end into Blocking.

Key Concept

STP Root Bridge Election and Port Role Determinism

Question 226Question →

A network security administrator investigates an issue where client devices on VLAN 30 ( $172.16.30.0/24$ ) fail to obtain IP leases from a centralized DHCP server located in the management subnet ( $172.16.100.0/24$ ). Packet captures at the DHCP server reveal that incoming unicast DHCPDISCOVER packets correctly feature the Layer 3 switch interface address ( $172.16.30.1$ ) in the `giaddr` (Gateway IP Address) field; however, the server silently drops the requests due to a policy requiring switch port and VLAN attachment metadata for scope allocation. Which feature must be configured on the relaying Layer 3 switch to resolve this issue?

Enable DHCP Option 82 (Relay Agent Information Option) insertion on the switch to attach circuit-id and remote-id metadata to client requests.

Configure the `ip helper-address` on the destination interface connected directly to the centralized DHCP server rather than on the client VLAN 30 interface.

Change the destination protocol port mapping on the relay agent from UDP port 67 to TCP port 67 to support encrypted policy header transmission.

Remove VLAN 30 from the switch trunk ports to allow Layer 2 broadcast frames from client workstations to cross router boundaries directly.

Show answer & explanation

Answer: Enable DHCP Option 82 (Relay Agent Information Option) insertion on the switch to attach circuit-id and remote-id metadata to client requests.

Answer

Enable DHCP Option 82 (Relay Agent Information Option) insertion on the switch to attach circuit-id and remote-id metadata to client requests.

DHCP Option 82 (Relay Agent Information Option) allows a Layer 3 relay switch to insert specific location information (such as the incoming switch port number, VLAN ID, or module identifier) into client DHCP requests before relaying them to a centralized DHCP server. When enterprise DHCP servers enforce policies based on physical switch port locations, Option 82 must be enabled on the relay agent so the server can evaluate these sub-options and allocate the appropriate IP lease.

Step-by-Step Solution

Analyze the reported issue and packet capture evidence.

DHCPDISCOVER packets arrive at the DHCP server via unicast with `giaddr` set to

172.16.30.1

, confirming basic relay forwarding functions, but are dropped due to missing port/VLAN metadata required by server policy.

The basic `ip helper-address` populates `giaddr`, but advanced scope selection or access policies on centralized DHCP servers often demand physical client binding information.

Identify the protocol extension responsible for appending switch port and VLAN metadata.

DHCP Option 82 (Relay Agent Information Option) inserts sub-options such as Circuit ID (VLAN/interface) and Remote ID (MAC/switch identifier).

Option 82 allows the relay agent to inject context about where the client is physically attached into the DHCP request payload before forwarding it to the server.

Evaluate required configuration changes on the Layer 3 switch.

Enabling Option 82 insertion on the relay switch ensures metadata is appended without requiring changes to client-facing IP helper placement or transport protocols.

This satisfies the server policy requirement and resolves the scope allocation failure.

Key Concept

DHCP Option 82 (Relay Agent Information Option)

Question 227Question →

Client computers on a user VLAN are unable to receive dynamic IP addresses because the network's DHCP server resides on a different IP subnet across a Layer 3 boundary. Which feature must be configured on the client gateway interface to forward broadcast DHCP requests to the central DHCP server as unicast traffic?

DHCP Relay Agent

TCP Port Forwarder on port 67

DNS Forwarding Service

Spanning Tree Protocol PortFast

Show answer & explanation

Answer: DHCP Relay Agent

Answer

DHCP Relay Agent

The correct answer identifies the DHCP Relay Agent. Because routers do not forward Layer 2 broadcast messages, a DHCP relay agent configured on the default gateway interface intercepts the local DHCP broadcast requests (UDP port 67) and forwards them as unicast packets to the central DHCP server.

Step-by-Step Solution

Identify the boundary restriction for DHCP broadcast messages.

Routers block Layer 2 broadcast packets (255.255.255.255) by default, preventing DHCP Discover messages from reaching remote subnets.

DHCP clients initially communicate using broadcast traffic on their local subnet.

Determine the required router mechanism to bridge DHCP requests across subnets.

Configuring a DHCP relay agent (e.g., `ip helper-address`) transforms client broadcast requests into unicast IP packets directed to the DHCP server address.

Unicast packets can be routed across Layer 3 networks to reach a central DHCP server.

Key Concept

DHCP Relay Agent functionality across Layer 3 boundaries

Estimated Time:45s

Question 228Question →

A network engineer is configuring an internal routing domain using the assigned IP address block $10.88.0.0/18$ . The network architecture requires dividing this entire $/18$ block into equal-sized subnets such that each subnet can accommodate at least $180$ usable host IP addresses while maximizing the number of subnets created. How many total subnets can be created from the original block using this optimal subnet mask?

Show answer & explanation

Answer: 64

Answer

64 subnets can be created from the original block.

To support at least 180 usable hosts per subnet, each subnet requires 8 host bits because

2^8 - 2 = 254

usable IP addresses (

2^7 - 2 = 126

is insufficient). An 8-host-bit subnet corresponds to a

/24

prefix (

32 - 8 = 24

). Dividing a

/18

network block into

/24

subnets yields

2^{24 - 18} = 2^6 = 64

equal-sized subnets.

Step-by-Step Solution

Calculate the minimum number of host bits required per subnet

8 host bits (

h = 8

)

Usable hosts formula is

2^h - 2

. For

180

hosts,

2^h - 2 \ge 180 \implies 2^h \ge 182

. Since

2^7 = 128

is insufficient,

2^8 = 256

is required, providing

254

usable host IP addresses.

Determine the optimal CIDR subnet mask prefix length

/24 prefix length (

255.255.255.0

)

Subtracting the

8

required host bits from

32

total IPv4 address bits yields

32 - 8 = 24

network/subnet bits.

Calculate the total number of subnets derived from the original /18 block

64 subnets

The number of borrowed subnet bits is

24 - 18 = 6

bits. The total number of available subnets is

2^6 = 64

Key Concept

Equal-length IPv4 Subnetting and Host Requirement Calculation

Question 229Question →

A network administrator is allocating an IPv4 subnet for a new IP telephony pool that requires host IP addresses for $58$ VoIP phones and $2$ dedicated administrative consoles. What is the maximum number of usable host IP addresses available in the smallest standard subnet prefix that satisfies this requirement?

62

64

126

30

Show answer & explanation

Answer: $62$

Answer

62

usable host IP addresses

The scenario requires addressing for 60 total host devices (

58 + 2 = 60

). The smallest standard IPv4 subnet block that can accommodate this requirement is a

/26

network prefix, which allocates

6

host bits (

32 - 26 = 6

). A 6-bit host portion provides

2^6 = 64

total IP addresses. Subtracting

2

reserved addresses for the network ID and broadcast address gives

64 - 2 = 62

usable host IP addresses.

Step-by-Step Solution

Calculate the total number of host IP addresses required.

58 \text{ (phones)} + 2 \text{ (consoles)} = 60 \text{ total host IP addresses required}

Both phones and administrative consoles require valid, assignable IPv4 addresses.

Determine the smallest power of 2 that accommodates at least the required usable host count.

The smallest power of

2

greater than or equal to

60 + 2 = 62

2^6 = 64

. This corresponds to a

/26

prefix length.

Subnet blocks are allocated in powers of 2 (

2^n

), where

n

is the number of host bits.

Calculate usable host IP addresses by applying the formula

2^n - 2

2^6 - 2 = 64 - 2 = 62 \text{ usable host IP addresses}

The first address in the block is reserved as the Network ID, and the final address is reserved as the Network Broadcast address.

Key Concept

Usable IPv4 Host Address Calculation

Estimated Time:1m 30s

Question 230Question →

A client workstation on VLAN 30 ( $10.30.0.0/24$ ) boots up and requires an IP address assignment from a centralized DHCP server ( $192.168.100.10$ ) located across a routed core network. The local Layer 3 switch interface serving VLAN 30 ( $10.30.0.1$ ) is configured with a DHCP relay service (`ip helper-address 192.168.100.10`). Arrange the following steps in the correct chronological sequence representing the packet processing flow from the client's initial broadcast request through the relay agent's delivery of the DHCP Offer back to the host subnet.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: 1) Host workstation broadcasts DHCPDISCOVER on VLAN 30. 2) Relay agent populates giaddr with 10.30.0.1 and unicasts request to server 192.168.100.10. 3) Server evaluates giaddr, allocates IP from 10.30.0.0/24 scope, and unicasts DHCPOFFER to 10.30.0.1. 4) Relay agent receives reply and delivers DHCPOFFER onto VLAN 30 to port 68.

The sequence follows the standardized DHCP relay mechanism. First, the unconfigured client broadcasts a DHCPDISCOVER on UDP port 67 within its local VLAN. Second, the Layer 3 switch acting as the relay agent intercepts the broadcast, inserts its ingress interface IP address (10.30.0.1) into the giaddr header field, and unicasts the packet to the central DHCP server IP address (192.168.100.10) on UDP port 67. Third, the central server uses the giaddr field to identify that the client resides on the 10.30.0.0/24 subnet, picks an available IP address from that pool, and responds with a unicast DHCPOFFER directed back to the relay agent's interface IP (10.30.0.1). Finally, the relay agent receives the offer, strips any relay-specific options, and transmits the DHCPOFFER to the host on VLAN 30 on UDP port 68.

Step-by-Step Solution

Identify client initiation step

The host generates a local broadcast DHCPDISCOVER frame (0.0.0.0:68 -> 255.255.255.255:67) because it lacks an IP configuration.

DHCP clients start the DORA process by broadcasting to discover local or relayed DHCP services.

Analyze Relay Agent modification and forwarding

The L3 switch interface (10.30.0.1) receives the broadcast, inserts 10.30.0.1 into the giaddr header field, and converts the packet into a unicast frame sent to 192.168.100.10 on UDP port 67.

Routers drop limited broadcasts by default; relay agents bridge subnet boundaries by converting broadcasts to targeted unicasts with source subnetwork metadata (giaddr).

Determine server scope selection and response

The central server inspects giaddr (10.30.0.1), matches it to the 10.30.0.0/24 IP pool, and sends a unicast DHCPOFFER back to 10.30.0.1:67.

DHCP servers determine which address pool to lease from by examining the relay agent's giaddr field rather than the IP source header of the relay router.

Trace client-side delivery of the offer

The relay agent receives DHCPOFFER on UDP 67, references the client MAC (chaddr), and sends the DHCPOFFER onto VLAN 30 targeting UDP port 68.

The relay agent completes the return leg by delivering the server's offer back to the client's broadcast domain.

Key Concept

DHCP Relay Architecture and GIADDR Subnet Identification

Question 231Question →

A network engineer is configuring a core router interface and needs to enter an IPv6 address adhering strictly to RFC 5952 standard text representation rules. The uncompressed IPv6 address is 2001:0db8:0000:0000:000a:0000:0000:0001. According to RFC 5952 zero-compression and leading-zero suppression standards (including the rule for handling equal-length contiguous zero blocks), what is the correctly compressed IPv6 address string (excluding any prefix length)?

Show answer & explanation

Answer: 2001:db8::a:0:0:1

Answer

2001:db8::a:0:0:1

Applying standard RFC 5952 rules requires three main operations: suppressing all leading zeros in each 16-bit block (0db8 -> db8, 000a -> a, 0001 -> 1), identifying contiguous zero blocks (fields 3–4 and fields 6–7, both of length 2), and applying the tie-breaking rule. Under RFC 5952 Section 4.2.3, when two zero sequences are of equal length, the first sequence must be compressed with '::'. This results in the final canonical address 2001:db8::a:0:0:1.

Step-by-Step Solution

Suppress leading zeros in all 16-bit hex fields

2001:db8:0:0:a:0:0:1

RFC 5952 Section 4.2.1 mandates that leading zeros in individual 16-bit fields must be omitted.

Identify contiguous sequences of zero blocks

Sequence 1 is '0:0' at fields 3–4 (length 2). Sequence 2 is '0:0' at fields 6–7 (length 2).

Double-colon '::' compression applies to contiguous 16-bit zero fields.

Apply the tie-breaking rule for equal-length zero sequences

Compress Sequence 1 ('0:0') to '::' while keeping Sequence 2 expanded as '0:0'.

RFC 5952 Section 4.2.3 requires that when multiple zero sequences of equal maximum length exist, the first sequence must be compressed.

Assemble the final compressed RFC 5952 address using lowercase characters

2001:db8::a:0:0:1

Combining zero suppression, first-sequence zero compression, and lowercase formatting yields the canonical RFC 5952 representation.

Key Concept

RFC 5952 IPv6 Address Compression Rules

Question 232Question →

A network administrator is provisioning static IP addresses for a cluster of application servers located in the subnet $172.20.100.128/26$ . Which of the following IPv4 addresses are valid usable host addresses within this designated subnet? (Select TWO.)

Select all that apply

172.20.100.128

172.20.100.130

172.20.100.189

172.20.100.191

Show answer & explanation

Answer: $172.20.100.130$ ; $172.20.100.189$

Answer

The valid usable host addresses are

172.20.100.130

and

172.20.100.189

For the subnet

172.20.100.128/26

, the block size is 64 addresses. The network address is

172.20.100.128

and the broadcast address is

172.20.100.191

. Consequently, the assignable host addresses range from

172.20.100.129

172.20.100.190

. Both

172.20.100.130

and

172.20.100.189

lie within this range.

Step-by-Step Solution

Determine the block size and network boundaries for the CIDR prefix

/26

/26

prefix leaves 6 host bits (

32 - 26 = 6

). The total address block size is

2^6 = 64

Calculating block size establishes the start and end boundaries of the IP subnet.

Identify the network ID and broadcast address for

172.20.100.128/26

The network ID is

172.20.100.128

. The broadcast address is

172.20.100.128 + 64 - 1 = 172.20.100.191

The first address in the block is reserved for the network ID, and the last address in the block is reserved for the broadcast address.

Calculate the usable host IP range.

The first usable IP address is

172.20.100.129

and the last usable IP address is

172.20.100.190

Usable host IP addresses lie strictly between the network ID and the broadcast address.

Evaluate the choices against the usable host range (

172.20.100.129

172.20.100.190

172.20.100.130

and

172.20.100.189

are within the usable range, whereas

172.20.100.128

(network ID) and

172.20.100.191

(broadcast address) are unusable host addresses.

Assigning network or broadcast addresses directly to hosts results in invalid IP configurations.

Key Concept

IPv4 Subnet Boundaries and Usable Host Range Calculation

Question 233Question →

A Layer 3 router receives an IP packet and has multiple matching entries in its routing table for the destination address. Arrange the steps of the router's path selection process in the correct order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps for the router path selection process is: 1) Filter candidate routes by evaluating the longest prefix match for the destination IP address, 2) Compare the administrative distance among routes with identical prefix lengths, 3) Compare protocol-specific metric values among routes with equal administrative distance, and 4) Install the optimal path into the active routing table for packet forwarding.

When an IP packet arrives, the router first identifies routes with the longest prefix match. If multiple routes share the exact same prefix length, the router compares their administrative distance to determine which protocol source is most believable. If routes share both equal prefix lengths and equal administrative distance (coming from the same protocol), the router compares protocol metrics to find the path with the lowest cost. Finally, the selected route is installed into the active forwarding table.

Step-by-Step Solution

Evaluate subnet mask specificity

Candidate routes are narrowed down to those matching the highest number of continuous network bits.

Longest prefix match takes precedence over all other criteria, including administrative distance.

Evaluate route source trustworthiness

The route originating from the source with the lower administrative distance value is preferred.

Administrative distance distinguishes between different protocol sources (e.g., EIGRP vs OSPF) when prefix specificity is equal.

Evaluate intra-protocol path cost

The path with the lowest metric value (e.g., OSPF cost) is selected.

Metrics are only directly comparable when candidate routes originate from the same routing protocol.

Commit route selection

The winning route entry is placed in the active Routing Information Base (RIB) / Forwarding Information Base (FIB).

Only the single best route (or tied equal-cost paths for load balancing) is actively used to forward traffic.

Key Concept

Router Path Selection Hierarchy (Longest Prefix Match -> Administrative Distance -> Protocol Metric)

Question 234Question →

Match each IEEE 802.11 wireless standard on the left with its correct maximum theoretical throughput and operating frequency band characteristics on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

802.11b matches with 11 Mbps (2.4 GHz); 802.11g matches with 54 Mbps (2.4 GHz); 802.11a matches with 54 Mbps (5 GHz); 802.11ac matches with Multi-Gbps (5 GHz).

Each standard is matched according to its specification in the IEEE 802.11 taxonomy. 802.11b operates in 2.4 GHz at 11 Mbps; 802.11g operates in 2.4 GHz at 54 Mbps; 802.11a operates in 5 GHz at 54 Mbps; and 802.11ac operates exclusively in 5 GHz to deliver multi-gigabit throughput.

Step-by-Step Solution

Identify the frequency band and speed limitations of legacy 2.4 GHz standards.

802.11b supports up to 11 Mbps in 2.4 GHz, whereas 802.11g supports up to 54 Mbps in 2.4 GHz.

DSSS modulation limits 802.11b to 11 Mbps, while 802.11g introduced OFDM to 2.4 GHz for 54 Mbps.

Differentiate between early 5 GHz standard (802.11a) and modern high-throughput standard (802.11ac).

802.11a provides up to 54 Mbps in 5 GHz, while 802.11ac operates in 5 GHz with multi-gigabit theoretical capabilities.

802.11ac introduced wider channels and MU-MIMO to scale speeds far beyond legacy 54 Mbps limit.

Key Concept

Legacy and modern Wi-Fi standard specifications regarding operating frequency bands and maximum theoretical bandwidth capabilities.

Question 235Question →

A Layer 3 core router receives an IP packet addressed to a remote destination host. Place the sequential evaluation and forwarding steps the router performs in the correct order from FIRST to LAST.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for route evaluation and packet forwarding is: 1) Filter candidate routes by Longest Prefix Match (LPM), 2) Compare Administrative Distance (AD) for identical prefix lengths, 3) Evaluate internal routing metrics for tied protocols, 4) Install the optimal route into the Forwarding Information Base (FIB), and 5) Perform Layer 2 ARP resolution and frame encapsulation for transmission.

When a router processes a destination IP address, it follows a strict hierarchical order. First, it applies the Longest Prefix Match (LPM) rule, identifying routes with the most specific subnet mask. Next, if multiple candidate routes share the exact same prefix mask, it evaluates Administrative Distance (AD) to select the route from the most trustworthy routing source. If the tied candidate routes originate from the same routing protocol (having identical AD), the router compares their internal protocol metrics to select the path with the lowest cost. Once the best path is chosen, it is installed into the Forwarding Information Base (FIB) to map the next-hop IP and outbound interface. Finally, the router uses ARP or Neighbor Discovery to resolve the next-hop MAC address, rewrites the Layer 2 Ethernet frame header, and transmits the frame.

Step-by-Step Solution

Evaluate prefix mask length across all RIB routes.

The route entry with the most specific matching prefix mask is selected.

Prefix length specificity always overrides administrative distance and metric during IP lookup.

Compare Administrative Distance (AD) for remaining tied paths.

The path learned from the routing source with the lowest AD value is selected.

AD measures source trustworthiness and resolves ties when prefix lengths match.

Compare routing metric among paths from the same protocol.

The candidate path with the lowest numerical metric is selected.

Metrics are protocol-specific cost values used for path selection within the same routing protocol.

Populate the Forwarding Information Base (FIB).

The destination prefix is associated with the selected outbound interface and next-hop address.

The FIB holds active forwarding decisions optimized for rapid hardware lookup.

Perform Layer 2 encapsulation and physical transmission.

ARP resolves the next-hop MAC address, the frame header is constructed, and the packet is forwarded.

Final packet delivery requires Layer 2 Ethernet framing using the next-hop MAC address.

Key Concept

Routing Decision Hierarchy and Forwarding Pipeline

Question 236Question →

A network technician is configuring an isolated network segment with an IPv4 subnet prefix of $/29$ . What is the maximum number of usable host IPv4 addresses that can be assigned to devices on this subnet?

6

8

14

4

Show answer & explanation

Answer: $6$

Answer

The maximum number of usable host IPv4 addresses on a

/29

subnet is

6

For a CIDR prefix of

/29

, there are

32 - 29 = 3

bits available for host addressing. The formula for usable hosts is

2^h - 2

, where

h

is the number of host bits. Therefore,

2^3 - 2 = 8 - 2 = 6

usable addresses.

Step-by-Step Solution

Calculate the number of host bits available.

An IPv4 address has

32

bits. For a

/29

prefix, the host portion is

32 - 29 = 3

bits.

The prefix length specifies the network portion, leaving the remaining bits for host addressing.

Calculate total IP addresses in the subnet block.

2^3 = 8

total IP addresses.

The total number of addresses supported by

n

host bits is given by the formula

2^n

Subtract reserved network and broadcast addresses.

8 - 2 = 6

usable host IP addresses.

The first address in the block is the network identifier and the last address is the broadcast address; neither can be assigned to host interfaces.

Key Concept

IPv4 Subnet Usable Host Calculation

Estimated Time:45s

Question 237Question →

A network engineer is provisioning subnets within a corporate network allocation of $172.16.96.0/21$ . The engineer must create subnets that each accommodate at least $200$ usable host IP addresses while minimizing wasted address space. If these subnets are assigned sequentially starting from the beginning of the block, what is the broadcast address of the second subnet?

172.16.97.255

172.16.96.255

172.16.97.254

172.16.99.255

Show answer & explanation

Answer: $172.16.97.255$

Answer

The broadcast address of the second subnet is 172.16.97.255.

To host at least

200

usable devices,

8

host bits (

2^8 - 2 = 254

usable IPs) are required, resulting in a

/24

prefix (subnet mask

255.255.255.0

). Starting from

172.16.96.0

, the first

/24

subnet spans

172.16.96.0

172.16.96.255

. The second

/24

subnet spans

172.16.97.0

172.16.97.255

. The broadcast address of this second subnet is

172.16.97.255

Step-by-Step Solution

Determine the required host bits and subnet mask prefix.

Using the formula

2^n - 2 \ge 200

n = 8

bits are needed for host addressing (

2^8 - 2 = 254

usable hosts). The prefix length is

32 - 8 = /24

Choosing 8 host bits minimizes address waste while meeting the requirement of at least 200 usable host IPs.

Identify the block boundaries of the subnets.

/24

subnet increments by

1

in the third octet. The first subnet is

172.16.96.0/24

(

172.16.96.0

172.16.96.255

). The second sequential subnet is

172.16.97.0/24

(

172.16.97.0

172.16.97.255

Subnetting starts sequentially at the beginning of the

172.16.96.0/21

parent block.

Determine the broadcast address of the second subnet.

The highest address in the

172.16.97.0/24

range is

172.16.97.255

The broadcast address is the last IP address in the subnet block.

Key Concept

Subnet sizing with CIDR and sequential block allocation

Question 238Question →

A host workstation on VLAN 10 requires an IP address assignment from a centralized DHCP server located across a Layer 3 router boundary. Place the operational steps of the cross-subnet DHCP relay process in the correct sequential order from initial client discovery to final lease confirmation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with the host workstation broadcasting a DHCPDISCOVER packet on VLAN 10. The relay agent then populates the giaddr field with its own interface IP address and unicasts the packet to the central DHCP server. Next, the DHCP server evaluates the giaddr field, selects an IP from the matching scope, and unicasts a DHCPOFFER back to the relay agent. The relay agent forwards the DHCPOFFER onto VLAN 10 to the host workstation. Finally, the host sends a DHCPREQUEST, which the relay agent forwards to the server to receive the final DHCPACK confirmation.

The correct operational sequence follows the standard four-way DHCP process (DORA) modified by a Layer 3 relay agent: (1) The host workstation broadcasts a DHCPDISCOVER packet on VLAN 10. (2) The relay agent populates the giaddr header field with its interface IP address and unicasts the packet to the central DHCP server. (3) The DHCP server inspects the giaddr value, selects an IP from the corresponding subnet pool, and returns a unicast DHCPOFFER to the relay agent. (4) The relay agent delivers the DHCPOFFER onto VLAN 10. (5) The host transmits a DHCPREQUEST to select the offered parameters, which the relay agent forwards to elicit the final DHCPACK confirmation from the server.

Step-by-Step Solution

Identify client discovery initiation

The host workstation broadcasts a DHCPDISCOVER frame onto local VLAN 10.

An unconfigured client lacks an assigned IP address and must broadcast to discover available DHCP resources.

Trace relay agent header modification and unicast forwarding

The relay agent inserts its local ingress interface IP into the giaddr header field and unicasts the DHCPDISCOVER packet to the remote DHCP server.

Layer 3 boundaries block broadcast traffic by default; embedding the giaddr allows the central server to identify the client's subnet and route replies.

Determine server lease allocation and reply

The central DHCP server reads the giaddr value, selects an available address from the matching subnet pool, and unicasts a DHCPOFFER to the relay agent.

The server relies on giaddr to select the appropriate scope rather than the physical interface on which the unicast packet arrived.

Trace relay agent response forwarding to client

The relay agent receives the unicast DHCPOFFER and delivers it onto VLAN 10.

The relay agent translates the remote unicast server reply for delivery on the local client network segment.

Complete the request and acknowledgement exchange

The host client transmits a DHCPREQUEST packet, which is relayed to the server to trigger the final DHCPACK confirmation.

This completes the standard four-step DORA exchange conducted across a Layer 3 relay agent.

Key Concept

DHCP Relay Agent Packet Processing and Gateway IP Address (giaddr) Forwarding Sequence

Question 239Question →

A network administrator is deploying a new centralized AAA server to manage administrative authentication for enterprise network switches. The deployment requires using TACACS+ to separate authentication, authorization, and accounting functions while encrypting the entire payload. However, authentication requests from the switches are currently being blocked by an intervening network firewall. Which port and transport layer protocol combination must be permitted on the firewall to allow TACACS+ traffic?

TCP port 49

UDP port 1812

UDP port 49

TCP port 389

Show answer & explanation

Answer: TCP port 49

Answer

TCP port 49 is required for TACACS+ communications.

TACACS+ operates over TCP port 49 by default. It utilizes TCP at the transport layer to provide reliable delivery and connection management while combining authentication, authorization, and accounting over a single port with full payload encryption.

Step-by-Step Solution

Identify the protocol specified in the requirement.

The scenario specifies TACACS+ (Terminal Access Controller Access-Control System Plus) for centralized network administrator AAA functionality.

Determining the target application protocol is the first step in matching port and transport requirements.

Determine the transport layer protocol used by TACACS+.

TACACS+ uses Transmission Control Protocol (TCP) because it requires connection-oriented reliability for AAA transactions.

Unlike RADIUS which relies on UDP, TACACS+ uses TCP at Layer 4.

Identify the default well-known port number for TACACS+.

The IANA standard port for TACACS+ is port 49.

Permitting TCP port 49 on the network firewall ensures TACACS+ traffic flows correctly between network switches and the AAA server.

Key Concept

Standard AAA protocols and default port mappings (TACACS+ vs RADIUS)

Estimated Time:1m 0s

Question 240Question →

Match each Network Address Translation (NAT) implementation type on the left with its corresponding address mapping behavior on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Static NAT maps to the permanent 1:1 translation; Dynamic NAT maps to translation using an available pool of public IP addresses; Port Address Translation (PAT) maps to translation using unique Layer 4 port numbers on a single public IP address.

Static NAT assigns a permanent 1:1 mapping between a private and public IP. Dynamic NAT dynamically allocates a public IP address from an IP pool to a private IP host. Port Address Translation (PAT) allows multiple private IP devices to share a single public IP address by assigning unique Layer 4 source port numbers to distinct connections.

Step-by-Step Solution

Analyze Static NAT requirements.

Static NAT provides a constant 1:1 mapping between one private IP and one public IP.

This is used when an internal host, such as a web server, must always be reachable at a fixed public IP address.

Analyze Dynamic NAT requirements.

Dynamic NAT selects an unused public IP address from a defined pool for outbound traffic.

The mapping exists only while the session is active and requires as many public IPs in the pool as concurrent outbound users.

Analyze PAT (NAT Overload) requirements.

PAT appends source port numbers to differentiate traffic from multiple internal private IPs sharing a single public IP address.

Using source ports allows thousands of internal hosts to access external networks using a single public IPv4 address.

Key Concept

NAT and PAT Types and Translation Behaviors

PreviousPage 12 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept