Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 381Question →

A network technician is installing a new edge router to interconnect two separate corporate subnets. At which OSI model layer do routers operate to forward packets using logical IP addressing?

Show answer & explanation

Answer: Network Layer (Layer 3)

Answer

Network Layer (Layer 3)
Routers operate primarily at the Network Layer (Layer 3) of the OSI model. At Layer 3, network traffic is packaged into packets containing source and destination logical IP addresses, allowing routers to determine path choices and forward data across multiple subnets.

Step-by-Step Solution

1
Identify the primary network device and addressing scheme mentioned in the scenario.
The device is a router and the addressing mechanism uses logical IP addresses.
Determining device capability and address type helps place the operation in the correct OSI layer.
2
Map router operations and logical IP packet forwarding to the OSI model hierarchy.
Logical IP routing between subnets is handled specifically by Layer 3 (Network Layer).
Routers inspect Layer 3 IP headers to determine optimal paths across interconnected networks.

Key Concept

OSI Model Layer 3 (Network Layer) Devices and Functions
Question 382Question →

An enterprise architecture team is designing a multi-tier connectivity infrastructure for a financial firm with the following requirements:

1. Inside the primary data center, high-density server racks require predictable, non-blocking east-west traffic handling with Layer 3 Equal-Cost Multi-Pathing (ECMP) routing rather than traditional Layer 2 loop-prevention protocols.
2. The link connecting the primary data center to a hot disaster recovery facility located 35 miles (56 km) away utilizes leased optical fiber spanning the metropolitan region.
3. Dynamic site-to-site VPN tunnels link 50 regional branch offices, enabling direct spoke-to-spoke encrypted communications across public internet connections on demand without hairpinning through the core data center.

Which combination of physical network topologies and network scope classifications correctly identifies the internal data center topology, the inter-site interconnect type, and the branch overlay WAN topology?

Show answer & explanation

Answer: Data Center: Spine-Leaf physical topology (LAN); Inter-site Link: Metropolitan Area Network (MAN); Branch Network: Dynamic full-mesh logical overlay (WAN)

Answer

The combination specifying Spine-Leaf physical topology for the data center LAN, Metropolitan Area Network (MAN) for the 35-mile inter-site link, and Dynamic full-mesh logical overlay for the branch WAN.
Spine-Leaf (Clos) physical topology provides deterministic non-blocking Layer 3 ECMP routing for east-west server traffic in modern data centers. A 35-mile connection across a city falls into the Metropolitan Area Network (MAN) geographical footprint. Dynamic, on-demand spoke-to-spoke VPN links establish a logical full-mesh overlay over the physical WAN.

Step-by-Step Solution

1
Analyze Data Center East-West Traffic Requirements
Identified Spine-Leaf (Clos) topology operating at Layer 3 with ECMP.
Traditional three-tier star topologies with Spanning Tree Protocol (STP) block redundant paths, limiting bandwidth. Spine-Leaf ensures every leaf switch connects to every spine switch, offering predictable two-hop latency and full utilization of parallel Layer 3 links.
2
Determine Geographical Scope of Inter-site Facility Link
Categorized 35-mile fiber link as a Metropolitan Area Network (MAN).
LANs are confined to a single building or immediate local site (< 1 km). WANs span broad national/global boundaries. A 35-mile link spanning a single metropolitan region fits the precise definition of a MAN.
3
Evaluate Branch Site-to-Site VPN Overlay Topology
Identified dynamic spoke-to-spoke tunnel mesh as a logical full-mesh WAN overlay.
Direct spoke-to-spoke communication without backhauling (hairpinning) through a central hub switch/router forms a logical full-mesh network, regardless of the underlying physical internet transport.

Key Concept

Physical vs. Logical Topologies and Geographical Network Scope Classifications
Estimated Time:2m 30s
Question 383Question →

A network technician is setting up a office layout where eight client computers connect directly to a central network switch via individual Ethernet cables. If one cable breaks, only the device connected to that specific cable loses network access. Which physical network topology is implemented in this scenario?

Show answer & explanation

Answer: Star topology

Answer

Star topology
In a physical star topology, all network endpoints connect directly to a central network hub or switch. This arrangement isolates link failures so that a broken cable affects only the connected workstation.

Step-by-Step Solution

1
Analyze the physical cabling configuration described in the scenario.
Each workstation connects directly to a central network switch via individual point-to-point links.
Centralized node connection is the defining physical characteristic of a star topology.
2
Evaluate the impact of a single link failure.
A single damaged cable affects only the host attached to it, leaving all other devices connected to the switch unaffected.
Star topologies isolate point-to-point cable faults to individual endpoints.

Key Concept

Physical Star Topology Isolation and Structure
Estimated Time:45s
Question 384Question →

A network engineer captures network traffic using a packet analyzer at two points along a multi-hop path: at an ingress interface of an intermediate router and directly at the destination server's network adapter. The captured traffic consists of standard TCP-based application data traversing distinct IPv4 subnets. Which of the following statements accurately describe how encapsulation and de-encapsulation operate across these processing points? (Select TWO)

Select all that apply

Show answer & explanation

Answer: The intermediate router strips the incoming Layer 2 frame header and trailer, inspects the Layer 3 IP header for forwarding decisions, and prepends a new Layer 2 frame header and trailer containing updated source and destination MAC addresses.; At the destination server, the network interface card processes and strips the Layer 2 frame header and trailer before passing the enclosed Layer 3 packet up to the operating system's protocol stack for Layer 3 IP header processing.

Answer

The correct statements are: (1) The intermediate router strips the incoming Layer 2 header/trailer, inspects the Layer 3 IP header, and prepends a new Layer 2 header/trailer with updated MAC addresses; and (2) At the destination server, the network interface card processes and strips the Layer 2 header/trailer before passing the Layer 3 packet to the OS protocol stack.
Encapsulation and de-encapsulation follow specific boundaries at intermediate devices and destination endpoints. An intermediate router operates at Layer 3: it receives a Layer 2 frame, strips the frame header and trailer, checks the Layer 3 IP header to determine the outbound interface/next-hop, and encapsulates the IP packet into a new Layer 2 frame with updated source and destination MAC addresses. At the receiving host, de-encapsulation moves up the stack sequentially: the network interface card verifies the Frame Check Sequence and strips the Layer 2 header before handing the payload (the IP packet) to the operating system network stack for Layer 3 and Layer 4 de-encapsulation.

Step-by-Step Solution

1
Analyze intermediate router PDU processing during traversal
Identified that routers perform hop-by-hop Layer 2 decapsulation and re-encapsulation while preserving the Layer 3 IP packet header unchanged.
Routers operate at Layer 3. They discard the incoming Data Link frame header/trailer after verification, look up the destination IP address in the routing table, and create a brand-new Data Link frame header/trailer for the next hop.
2
Analyze host de-encapsulation workflow upon PDU reception
Verified layer-by-layer de-encapsulation handoff from hardware NIC to operating system software stack.
The Physical/Data Link hardware (NIC) strips the Layer 2 Ethernet header after checking the Frame Check Sequence (FCS), then passes the encapsulated IP packet up to the OS kernel stack to process Layer 3 IP headers and Layer 4 TCP headers.
3
Evaluate distractor claims regarding header removal and hardware capabilities
Rejected claims suggesting routers strip Layer 3 IP headers or that NIC hardware strips Layer 3/4 headers.
Routers do not regenerate Layer 3 IP headers unless NAT is active, and NIC hardware does not process upper-layer protocol boundaries such as TCP segments.

Key Concept

Hop-by-hop Layer 2 re-encapsulation vs bottom-up host de-encapsulation
Question 385Question →

A lead network architect is designing the infrastructure for a medical research center comprising six high-throughput data processing nodes located within a single campus facility. To ensure zero single points of failure during real-time genomic data synchronization, the design calls for a physical full-mesh topology across all six nodes, while offloading high-capacity storage traffic to a dedicated Storage Area Network (SAN). Which of the following statements accurately describe the operational and structural characteristics of this proposed deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Interconnecting all six processing nodes in a physical full-mesh topology requires exactly 15 dedicated point-to-point network links.; The Storage Area Network (SAN) provides block-level storage access over a dedicated high-speed network isolated from standard local area network traffic.

Answer

The correct statements are that interconnecting all six processing nodes in a physical full-mesh topology requires exactly 15 dedicated point-to-point network links, and that the Storage Area Network (SAN) provides block-level storage access over a dedicated high-speed network isolated from standard local area network traffic.
The statement specifying 15 links is correct because a complete mesh of 6 nodes requires N=6(6−1)2=15N = \frac{6(6-1)}{2} = 15 physical connections. The statement regarding SANs is correct because SANs operate at the block level over a dedicated storage network isolated from general LAN traffic.

Step-by-Step Solution

1
Calculate the required number of physical links for a full-mesh topology with 6 nodes.
Using N=n(n−1)2N = \frac{n(n-1)}{2} where n=6n = 6, N=6×52=15N = \frac{6 \times 5}{2} = 15 dedicated links.
Full-mesh topologies require every host to connect directly to every other host, requiring n−1n-1 connections per host.
2
Evaluate the architectural purpose and access protocol type of a Storage Area Network (SAN).
SANs deliver high-performance, block-level data access over dedicated storage fabrics (such as Fibre Channel or iSCSI) separate from local area network (LAN) user traffic.
Isolating block-level storage traffic prevents network congestion on the primary user LAN and optimizes storage throughput.
3
Evaluate the invalid statements regarding VLAN routing and bus topology resilience.
VLANs strictly segment Layer 2 broadcast domains and mandate Layer 3 routing for inter-VLAN communications. A physical bus topology has a single point of failure (the backbone coax run) and lower fault tolerance than mesh.
Identifies common misconceptions regarding broadcast domain isolation and physical topology fault propagation.

Key Concept

Full-Mesh Topology Link Formula and SAN Characteristics
Question 386Question →

A network technician is organizing the core IP addressing services used within an enterprise network. Match each network service on the left with its primary operational function on the right.

Click a left item, then click its matching right item

Items

DHCP
DNS
NTP
IPAM

Matches

Show answer & explanation

Answer

DHCP pairs with dynamic IP configuration distribution; DNS pairs with domain name translation to IP addresses; NTP pairs with system clock synchronization; IPAM pairs with IP address inventory management.
Each IP addressing service performs a distinct function: DHCP automates client IP configuration, DNS translates domain names to IP addresses, NTP maintains synchronized device clocks, and IPAM tracks and manages IP address allocation inventory.

Step-by-Step Solution

1
Identify the role of DHCP in network addressing.
DHCP dynamically allocates IP addresses and parameters to hosts on a network.
Automating host addressing eliminates manual configuration errors.
2
Identify the role of DNS in host identification.
DNS resolves human-friendly domain names into machine-routable IP addresses.
Name resolution allows network hosts to be accessed by domain names.
3
Identify the role of NTP in time management.
NTP synchronizes clock timestamps among interconnected devices.
Consistent timestamps are vital for security audits, logging, and troubleshooting.
4
Identify the role of IPAM in network administration.
IPAM tracks usage and manages IP subnet allocations across enterprise infrastructure.
Centralized IP monitoring prevents subnet conflicts and address depletion.

Key Concept

IP Addressing Services
Question 387Question →

An enterprise network administrator is configuring firewall rules for a newly deployed subnet containing critical infrastructure servers. The servers must synchronize their system clocks against an internal stratum 1 time authority and allow the central network management system (NMS) to regularly poll system operational metrics via Simple Network Management Protocol (SNMP). Which TWO protocol and transport layer port combinations must be permitted through the firewall to support these services?

Select all that apply

Show answer & explanation

Answer: UDP port 123 for Network Time Protocol (NTP) clock synchronization; UDP port 161 for SNMP manager-to-agent metric polling queries

Answer

UDP port 123 for Network Time Protocol (NTP) clock synchronization and UDP port 161 for SNMP manager-to-agent metric polling queries.
The scenario requires configuring firewall rules for clock synchronization and SNMP metric polling. Network Time Protocol (NTP) operates on UDP port 123 to synchronize clocks with minimal latency. Simple Network Management Protocol (SNMP) manager-to-agent requests and polling operate over UDP port 161. Permitting both UDP 123 and UDP 161 satisfies both operational requirements.

Step-by-Step Solution

1
Identify the required network service for system clock synchronization and its default port/protocol.
Network Time Protocol (NTP) operates over UDP port 123.
NTP requires light connectionless overhead to accurately calculate offset and round-trip delay.
2
Identify the required network service for polling device metrics from a central Network Management System (NMS).
SNMP polling queries from manager to agent operate over UDP port 161.
SNMP uses UDP port 161 for request/response messages (GetRequest, SetRequest) sent by management consoles to managed agents.
3
Evaluate candidate options to select the matching UDP port assignments.
Select UDP port 123 and UDP port 161.
Both NTP and SNMP polling utilize UDP as their transport protocol rather than TCP or alternative service ports.

Key Concept

Standard UDP Port Assignments for Management and Infrastructure Services (NTP and SNMP)
Estimated Time:1m 30s
Question 388Question →

A network security team is establishing strict edge firewall ACL rules for four specialized enterprise network services. Match each network service requirement on the left with its corresponding default transport layer protocol and destination port number on the right.

Click a left item, then click its matching right item

Items

Secure Directory Services Authentication & Queries (LDAPS)
Unsolicited Agent Event Notifications to Management Station (SNMP Trap)
Encrypted System Log Forwarding (Syslog over TLS)
Client Message Submission to Mail Transfer Agent with Explicit TLS (SMTP Submission)

Matches

Show answer & explanation

Answer

Secure Directory Services Authentication & Queries (LDAPS) matches TCP Port 636; Unsolicited Agent Event Notifications to Management Station (SNMP Trap) matches UDP Port 162; Encrypted System Log Forwarding (Syslog over TLS) matches TCP Port 6514; Client Message Submission to Mail Transfer Agent with Explicit TLS (SMTP Submission) matches TCP Port 587.
Each service requirement strictly aligns with its IANA default transport protocol and port assignment: LDAPS requires TCP 636 for directory security; SNMP Traps use UDP 162 for agent notification forwarding; Syslog over TLS utilizes TCP 6514 for secure transport; and SMTP Submission uses TCP 587 for authenticated client mail delivery.

Step-by-Step Solution

1
Identify the protocol and transport requirements for directory services over TLS.
LDAPS secures LDAP traffic using SSL/TLS, operating over TCP port 636.
Standard unencrypted LDAP uses TCP 389, while encrypted LDAPS defaults to TCP 636.
2
Determine the transport protocol and port for asynchronous network monitoring alerts.
SNMP Traps are sent autonomously from network agents to the NMS on UDP port 162.
Standard SNMP queries use UDP 161, whereas unsolicited trap notifications use UDP 162.
3
Identify the standardized port for secure remote syslog delivery.
Syslog over TLS requires a connection-oriented transport and uses TCP port 6514.
Standard unencrypted Syslog uses UDP port 514, whereas secure TLS-wrapped syslog uses TCP port 6514.
4
Analyze mail submission protocol ports.
Modern client-to-server mail submission (SMTP Submission) uses TCP port 587.
Traditional server-to-server SMTP relay uses TCP port 25, while mail submission agents use TCP port 587.

Key Concept

Standard default port numbers and transport layer protocols for secure network operations and network management services.
Question 389Question →

An IT technician is deploying a local network for a small office using a physical star topology where all workstation nodes connect to a central Ethernet switch. Which of the following statements correctly describe the fundamental characteristics of this topology? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A failure of the central switch breaks network communication for all connected devices on that segment.; Adding or disconnecting an individual host cable does not disrupt traffic between the other active hosts.

Answer

A physical star topology is characterized by a central device acting as a single point of failure for the segment, and individual point-to-point cable runs that allow adding or removing nodes without disrupting remaining network traffic.
A star topology connects each host directly to a central node (such as a switch). Consequently, failure of that central node halts all traffic on the segment, while individual cable connections can be connected or disconnected without disrupting other hosts.

Step-by-Step Solution

1
Identify the core structural component of a star topology.
All host devices connect independently to a central device such as a network switch.
This establishes point-to-point connections between endpoints and the central node.
2
Evaluate the impact of central device failure versus individual link failure.
Failure of the central node impacts the whole segment, but single link disconnects only affect the corresponding endpoint.
Each endpoint uses an isolated physical link to the central device.

Key Concept

Physical Star Topology Characteristics
Question 390Question →

An enterprise network administrator is assigned the IPv4 network block 192.168.16.0/22192.168.16.0/22 to provision subnets for a new regional office. Using Variable Length Subnet Masking (VLSM) to minimize address waste, subnets are created for the following minimum usable host requirements:

- Department A: 250250 usable host IPs
- Department B: 120120 usable host IPs
- Department C: 6060 usable host IPs
- Department D: 2525 usable host IPs

What is the total number of unallocated IP addresses (including network and broadcast addresses) remaining in the original 192.168.16.0/22192.168.16.0/22 block after these subnets are assigned?

Show answer & explanation

Answer: 544

Answer

544 unallocated IP addresses remain in the original /22 block.
A /22 block provides 10241024 total addresses. By sizing each subnet to the smallest power of 2 that accommodates host requirements plus network and broadcast overhead, the allocations consume 256256 (/24), 128128 (/25), 6464 (/26), and 3232 (/27) addresses, totaling 480480 addresses. Subtracting 480480 from 10241024 leaves 544544 unallocated addresses.

Step-by-Step Solution

1
Determine total capacity of the assigned prefix
A /22 subnet contains 210=10242^{10} = 1024 total IP addresses.
The prefix length of /22 leaves 32−22=1032 - 22 = 10 host bits.
2
Calculate required CIDR subnet block size for each department using VLSM rules
Dept A needs 256 IPs (/24); Dept B needs 128 IPs (/25); Dept C needs 64 IPs (/26); Dept D needs 32 IPs (/27).
Each subnet must accommodate the usable hosts plus 2 overhead addresses (network ID and broadcast address), rounded up to the smallest power of 2.
3
Sum total allocated IP addresses
256+128+64+32=480256 + 128 + 64 + 32 = 480 IP addresses allocated.
Combining block sizes yields the total addresses consumed across all four departmental subnets.
4
Calculate remaining unallocated IP addresses
1024−480=5441024 - 480 = 544 unallocated IP addresses.
Subtracting allocated addresses from the total block size leaves the unassigned address space.

Key Concept

VLSM Subnet Block Size Calculation & Host Address Allocation
Question 391Question →

A network technician needs to configure firewall rules to permit traffic for secure web browsing and secure remote command-line administration. Which TWO of the following protocol and default port combinations should be allowed?

Select all that apply

Show answer & explanation

Answer: SSH operating over TCP port 22; HTTPS operating over TCP port 443

Answer

The correct selections are SSH operating over TCP port 22 and HTTPS operating over TCP port 443.
SSH (TCP port 22) and HTTPS (TCP port 443) are standard secure protocols designed to encrypt command-line management and web traffic, respectively.

Step-by-Step Solution

1
Identify the protocol and port required for secure command-line administration.
SSH uses TCP port 22 to provide encrypted remote management.
SSH is the standard encrypted alternative to unencrypted Telnet.
2
Identify the protocol and port required for secure web traffic.
HTTPS uses TCP port 443 to secure web communications via TLS/SSL encryption.
HTTPS operates over TCP port 443, whereas unencrypted HTTP operates over TCP port 80.

Key Concept

Standard default port and transport protocol assignments for secure network services.
Question 392Question →

Match each Layer 2 switching mechanism on the left with its corresponding operational behavior or frame processing rule on the right.

Click a left item, then click its matching right item

Items

802.1Q Native VLAN Trunking
Unknown Unicast Flooding
STP Topology Change Notification (TCN)
Port Security Restrict Mode

Matches

Show answer & explanation

Answer

The concepts match their operational behaviors as follows: 802.1Q Native VLAN Trunking maps untagged traffic to the native VLAN and transmits it without 802.1Q headers; Unknown Unicast Flooding replicates frames with unknown destination MACs out all ports within the same VLAN except the receiving port; STP Topology Change Notification (TCN) reduces the CAM aging timer to the forward delay setting to purge invalid paths; Port Security Restrict Mode drops unauthorized frames and logs violations while keeping the interface active.
Each Layer 2 operational concept is matched to its exact specification: 802.1Q Native VLAN handles untagged trunk traffic without headers; Unknown Unicast Flooding distributes unmapped destination unicast frames within the VLAN domain; STP TCN reduces the MAC address table aging duration to force fast re-learning; Port Security Restrict Mode drops non-permitted MAC traffic and generates violation logs while keeping the port up.

Step-by-Step Solution

1
Analyze 802.1Q trunking behavior regarding untagged frame processing.
Identify that the Native VLAN feature handles untagged ingress frames and strips 802.1Q headers on egress for that specific VLAN.
The 802.1Q standard relies on native VLAN designations for backward compatibility with non-tagging switch ports and control traffic.
2
Examine switch forwarding logic when a destination MAC address is absent from the CAM table.
Associate unknown unicast traffic with flooding across all active ports within the frame's ingress VLAN except the receiving port.
Switches must deliver unicast frames even when host port locations have not yet been learned, while maintaining strict VLAN isolation.
3
Evaluate CAM table management during Spanning Tree Protocol (STP) topology convergence.
Match STP TCN frame processing with shortening the CAM aging timer from 300 seconds down to the forward delay parameter (e.g., 15 seconds).
Reducing the aging timer rapidly purges outdated MAC mappings caused by link changes without forcing an immediate full table clear.
4
Differentiate between switch port security violation modes (Protect, Restrict, and Shutdown).
Connect Restrict mode to dropping non-permitted traffic, logging Syslog/SNMP notifications, and keeping the port online.
Restrict mode actively logs security events while maintaining interface availability, distinguishing it from Protect (silent drop) and Shutdown (err-disable interface).

Key Concept

Layer 2 Switch Forwarding Logic, VLAN Control Operations, and Port Security Behavior
Estimated Time:2m 30s
Question 393Question →

A network technician is deploying a real-time IP surveillance camera system on a local network. The video application requires immediate frame delivery for live monitoring and can tolerate minor frame loss, but cannot tolerate latency or buffering caused by frame retransmissions. Which transport layer protocol best satisfies these application requirements, and why?

Show answer & explanation

Answer: UDP, because it is a connectionless protocol that transmits datagrams without establishing a session or waiting for acknowledgments, reducing delivery latency.

Answer

UDP should be selected because it is a connectionless protocol that transmits datagrams without session setup or retransmission delay, fulfilling the low-latency requirement of real-time video streaming.
UDP (User Datagram Protocol) is a connectionless transport protocol that sends data without establishing a formal connection or tracking packet delivery. Because it omits handshakes, flow control, and packet retransmissions, it achieves the minimal latency necessary for live, real-time video streaming applications.

Step-by-Step Solution

1
Analyze the application requirements from the scenario.
The application needs low latency and live delivery, prioritizing speed over absolute reliability, where dropped data should not be retransmitted.
Real-time feeds suffer from buffering lag if packets are held back for retransmission.
2
Compare transport layer protocols (TCP vs. UDP) against these requirements.
TCP is connection-oriented and enforces reliability via acknowledgments and retransmissions. UDP is connectionless and unacknowledged, providing minimal overhead and minimal delay.
Connectionless datagram delivery meets the requirement for latency-intolerant, loss-tolerant streams.

Key Concept

Connection-Oriented vs Connectionless Transport Protocols
Question 394Question →

A network engineer captures traffic from a client-server application and observes that after the underlying connection is established, the application exchanges control tokens to coordinate half-duplex communication rules, insert synchronization checkpoints within long data transfers, and handle reconnection dialog states following momentary dropouts. At which layer of the OSI model do these dialogue control and session maintenance functions operate?

Show answer & explanation

Answer: Layer 5, which manages dialogue control, synchronization checkpoints, and connection restoration between endpoints

Answer

Layer 5, which manages dialogue control, synchronization checkpoints, and connection restoration between endpoints
The correct answer identifies Layer 5 as responsible for establishing, managing, and terminating communications sessions. Specific functions of Layer 5 include dialogue control (determining which side transmits and when), inserting synchronization points into data streams for recovery, and managing session reconnect states.

Step-by-Step Solution

1
Analyze the functional requirements in the scenario
Identified dialogue control token exchange, synchronization checkpoints, and session restoration as the key capabilities described.
Determining the exact duties performed in the packet capture is required to map them to the correct OSI layer.
2
Map the identified capabilities to OSI model layer roles
Dialogue control (simplex/half-duplex/full-duplex management) and checkpoints for session state recovery are defined explicitly at Layer 5.
Layer 5 establishes, maintains, synchronizes, and terminates session interactions between applications.
3
Differentiate Layer 5 responsibilities from adjacent layers (Layer 4, Layer 6, Layer 7)
Layer 4 handles host-to-host segment transport, Layer 6 handles data formatting/encryption, and Layer 7 provides user-facing protocol interfaces.
Distinguishing protocol data delivery from session dialogue state management avoids common layer mapping errors.

Key Concept

OSI Layer 5 (Session) Dialogue Control and Synchronization
Question 395Question →

A network switch receives an Ethernet frame on port 3 destined for a specific host. However, the destination MAC address is not currently stored in the switch's MAC address table. How will the switch handle this incoming frame?

Show answer & explanation

Answer: It floods the frame out all active switch ports assigned to the receiving port's VLAN, except port 3.

Answer

The switch floods the frame out all active ports belonging to the same VLAN as the ingress port, excluding the ingress port itself.
When a Layer 2 switch receives a unicast frame destined for a hardware address not currently listed in its MAC address table, it performs unknown unicast flooding. To guarantee delivery while maintaining security and segmentation, the switch forwards the frame to every active port assigned to the same VLAN, excluding the ingress port on which the frame arrived.

Step-by-Step Solution

1
Examine the destination MAC address in the incoming frame header.
The destination address is evaluated against the switch's internal Content Addressable Memory (CAM) / MAC address table.
Layer 2 switches make forwarding decisions based on source and destination MAC addresses.
2
Determine the lookup result when the MAC address is absent.
The frame is categorized as unknown unicast traffic.
Because the MAC address table lacks an entry associating the destination address with a specific egress port, the switch cannot perform targeted unicast forwarding.
3
Apply the unknown unicast forwarding rule within the ingress port's VLAN.
The frame is duplicated and transmitted out all operational switch ports in the same VLAN, except the receiving port.
Flooding ensures the intended destination device receives the frame and can reply, allowing the switch to learn its MAC address position for future frames while respecting VLAN isolation.

Key Concept

Unknown Unicast Flooding
Estimated Time:45s
Question 396Question →

During a technical audit of a heterogeneous enterprise application stack, a network analyst is reviewing how data payloads are prepared for secure transmission across dissimilar host architectures. The specification requires data syntax normalization, character encoding conversion, and payload encryption prior to session establishment. Which of the following operational functions are performed strictly at Layer 6 (Presentation Layer) of the OSI model? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Converting character encodings between incompatible formats, such as translating EBCDIC to ASCII or UTF-8; Performing cryptographic data encryption and decryption, as well as application payload compression

Answer

The Presentation Layer (Layer 6) is responsible for data translation (such as character set conversion between EBCDIC and ASCII/UTF-8) and data formatting operations including encryption/decryption and compression.
The Presentation Layer (Layer 6) serves as the syntax translator for the OSI model. Its core responsibilities include character code translation (such as ASCII to EBCDIC or UTF-8), data structure formatting (such as XML/JSON syntax normalization), data compression, and cryptographic encryption/decryption of application data.

Step-by-Step Solution

1
Identify the specific OSI layer requested in the scenario
The scenario focuses on Layer 6 (Presentation Layer) functions.
Layer 6 acts as the syntax translator of the network stack, ensuring data sent from the application layer of one system can be read by the application layer of another.
2
Evaluate the options against Layer 6 duties
Character set translation (EBCDIC to ASCII/UTF-8) and payload encryption/compression belong to Layer 6.
These tasks handle the format, structure, and representation of data.
3
Differentiate adjacent OSI layer duties
Dialogue control checkpoints belong to Layer 5 (Session), and port socket multiplexing belongs to Layer 4 (Transport).
Layer 5 manages active session state and synchronization, while Layer 4 manages end-to-end transport and process addressing.

Key Concept

OSI Layer 6 (Presentation Layer) Data Formatting and Encryption Functions
Estimated Time:2m 0s
Question 397Question →

A network administrator connects two Layer 2 switches, SwitchA and SwitchB, using an IEEE 802.1Q trunk link on port GigabitEthernet 0/1. SwitchA is configured with native VLAN 20 on its trunk interface, whereas SwitchB is configured with native VLAN 10 on its trunk interface. Host A, connected to an access port on SwitchA assigned to VLAN 20, sends an untagged ARP request broadcast frame. Assuming port security and VLAN filtering do not drop the traffic, what will happen when this broadcast frame arrives at SwitchB?

Show answer & explanation

Answer: SwitchB accepts the untagged frame and floods it out all active access ports assigned to VLAN 10, resulting in unexpected cross-VLAN traffic leaking.

Answer

SwitchB accepts the untagged frame and floods it out all active access ports assigned to VLAN 10, resulting in unexpected cross-VLAN traffic leaking.
Under IEEE 802.1Q, frames belonging to a trunk's native VLAN are sent without an explicit 802.1Q VLAN header tag. SwitchA transmits Host A's VLAN 20 broadcast frame untagged because VLAN 20 is configured as SwitchA's native VLAN. When SwitchB receives this untagged frame on its trunk interface, it tags/associates the frame internally with its own locally configured native VLAN (VLAN 10). Consequently, SwitchB floods the broadcast frame to all ports in VLAN 10, creating a cross-VLAN security and operational issue known as native VLAN leakage.

Step-by-Step Solution

1
Analyze frame egress at SwitchA
Host A sends a broadcast frame in VLAN 20. SwitchA forwards it across the trunk. Since VLAN 20 matches SwitchA's native VLAN on the trunk port, SwitchA strips/omits the 802.1Q VLAN tag.
IEEE 802.1Q standard specifies that frames belonging to the configured native VLAN are transmitted untagged over a trunk link.
2
Analyze frame ingress at SwitchB
SwitchB receives an untagged Ethernet frame on its trunk port GigabitEthernet 0/1.
The trunk link physically delivers the untagged frame to SwitchB's receiving port.
3
Apply SwitchB local native VLAN rules
SwitchB associates the untagged incoming frame with its local native VLAN, which is VLAN 10.
By definition, any untagged frame arriving on an 802.1Q trunk port is implicitly assigned to the native VLAN configured on the receiving switch interface.
4
Determine forwarding behavior for broadcast traffic
SwitchB floods the broadcast frame to all active access ports belonging to VLAN 10.
Broadcast frames are flooded throughout the local broadcast domain (VLAN 10), causing cross-VLAN traffic leakage.

Key Concept

802.1Q Native VLAN Ingress/Egress Tagging & Mismatch Behavior
Estimated Time:2m 0s
Question 398Question →

A network administrator is documenting interface configurations across a newly deployed IPv6 subnet. An engineer needs to record a valid shorthand representation of the uncompressed address `fd00:0000:0000:07b3:0000:0000:0000:0002`. Which of the following options represents a syntactically valid shorthand form of this IPv6 address?

Show answer & explanation

Answer: fd00:0:0:7b3::2

Answer

The syntactically valid shorthand form is fd00:0:0:7b3::2.
The shorthand string fd00:0:0:7b3::2 follows IPv6 compression rules by stripping leading zeros in individual hextets (converting 0000 to 0 and 07b3 to 7b3) and using a single double-colon (::) to represent the three consecutive zero blocks before the final hextet.

Step-by-Step Solution

1
Remove leading zeros from each 16-bit hextet.
fd00:0000:0000:07b3:0000:0000:0000:0002 becomes fd00:0:0:7b3:0:0:0:2.
Leading zeros within any 16-bit hexadecimal block are redundant and can be safely omitted.
2
Identify contiguous sequences of zero hextets and apply the double-colon (::) compression rule.
Compressing the three contiguous trailing zero blocks (hextets 5 through 7) yields fd00:0:0:7b3::2.
The double-colon (::) can replace a contiguous run of zero hextets, but it can only be used ONCE per address to prevent ambiguity.

Key Concept

IPv6 Address Compression Rules (RFC 5952)
Question 399Question →

A logistics enterprise is deploying network infrastructure to interconnect eight distribution centers distributed across a single metropolitan metropolitan region to a primary data center hub. The network requires low-latency Ethernet connectivity across the city footprint. Furthermore, the physical network design must maintain full node connectivity if any single point-to-point link between adjacent sites is severed, while minimizing physical cabling costs by avoiding dedicated links between every pair of facilities. Which network type and physical topology combination best satisfies these design requirements?

Show answer & explanation

Answer: Metropolitan Area Network (MAN) deployed in a ring topology

Answer

Metropolitan Area Network (MAN) deployed in a ring topology
A Metropolitan Area Network (MAN) covers a city-wide geographic scope, matching the metropolitan distribution center locations. A ring topology provides redundant counter-rotating or fault-tolerant paths, allowing traffic to be rerouted in the opposite direction if a single physical fiber link breaks, satisfying both fault-tolerance and cost constraints without requiring a full mesh.

Step-by-Step Solution

1
Analyze the geographic scope requirements
The scenario specifies interconnecting facilities spread across a single metropolitan area, which corresponds to a Metropolitan Area Network (MAN).
Geographic scope determines the network classification (LAN vs CAN vs MAN vs WAN).
2
Analyze the physical redundancy and efficiency requirements
The design must withstand a single link cut without using dedicated point-to-point links between every node pair.
A full mesh topology provides link redundancy but requires n(n−1)/2n(n-1)/2 links, whereas a dual-ring topology provides single-fault tolerance efficiently across a geographic ring path.
3
Synthesize the correct network classification and physical layout
Combining MAN classification with a ring topology fulfills both the geographic footprint and fault-tolerance constraints.
A MAN ring topology provides city-wide reach and resilient traffic rerouting during a link disruption.

Key Concept

Geographic Network Classifications and Physical Topologies
Question 400Question →

A network security administrator is configuring firewall rules between two corporate sites connected via an IPsec VPN tunnel. Client machines on the remote site can successfully resolve domain names using UDP queries to the primary DNS server. However, automated secondary DNS server zone transfers (AXFR) across the VPN continuously time out and fail to synchronize database records. Which transport protocol and port combination must be permitted through the firewall to allow these zone transfers to succeed?

Show answer & explanation

Answer: TCP port 53

Answer

TCP port 53
DNS relies on both UDP and TCP on port 53 depending on the nature of the request. Standard client name lookups use UDP port 53 because of low overhead and small packet sizes. However, zone transfers between primary and secondary DNS servers transmit significant volumes of record data that exceed UDP buffer limits and require guaranteed, ordered delivery. Therefore, TCP port 53 must be explicitly permitted through firewalls for secondary server synchronization.

Step-by-Step Solution

1
Analyze the service requirements for standard DNS queries versus DNS zone transfers.
Standard DNS lookups use UDP port 53 for speed, whereas DNS zone replication (AXFR/IXFR) transfers entire database structures requiring reliability and larger data sizes.
Traditional UDP DNS responses are limited to 512 bytes (without EDNS0 extensions). Database synchronization payloads exceed this limit and require TCP stream guarantees.
2
Identify the correct protocol and port for DNS zone transfers.
DNS zone replication requires TCP port 53 to be open on firewalls between authoritative name servers.
TCP handles session establishment, sequencing, and error recovery for complete directory payload transfers between primary and secondary servers.

Key Concept

DNS Protocol Transport Selection (TCP vs UDP Port 53)
Estimated Time:1m 30s
PreviousPage 20 / 112Next
All practice questions — CompTIA Network+ | Examkin