All practice questions

2237 questions

All types2,237 Multiple choice1,150 Multiple select488 Numeric30 Matching350 Ordering201 Short answer18

A network interface card (NIC) on a destination host receives an incoming Ethernet frame from the physical medium. After the NIC verifies the frame check sequence and strips off the Layer 2 header and trailer, which Protocol Data Unit (PDU) is passed up to Layer 3 for processing?

Packet

Segment

Datagram

Bit stream

Show answer & explanation

Answer: Packet

Answer

The Protocol Data Unit (PDU) passed up to Layer 3 after removing the Layer 2 Ethernet header and trailer is a Packet.

During the de-encapsulation process, as data moves up the protocol stack, each layer removes its corresponding header and trailer. When Layer 2 (Data Link) removes the Ethernet frame header and frame check sequence trailer, the payload revealed is the Layer 3 (Network layer) Protocol Data Unit, which is called a Packet.

Step-by-Step Solution

Identify the current OSI layer performing de-encapsulation.

The network interface card processes the Layer 2 (Data Link layer) frame.

De-encapsulation moves up the stack from Layer 1 to Layer 7.

Determine the PDU associated with the next higher layer (Layer 3).

Stripping the Layer 2 header and trailer exposes the Layer 3 (Network layer) payload, which is an IP Packet.

Each layer strips its respective encapsulation headers to reveal the higher-layer PDU inside.

Key Concept

Protocol Data Unit (PDU) De-encapsulation Order

Estimated Time:45s

Question 522Question →

A network administrator is inspecting an 802.1Q trunk link configured between Switch-A and Switch-B. Interface GigabitEthernet0/1 on Switch-A is configured with `switchport trunk native vlan 10`. On Switch-B, interface GigabitEthernet0/1 is configured with `switchport trunk native vlan 50`. When Switch-A transmits untagged Ethernet frames across this link to Switch-B, which of the following outcomes will occur?

Switch-B will accept the untagged frames and associate them with VLAN 50.

The untagged frames will be redirected to a Layer 3 router to resolve the broadcast domain conflict.

Switch-B will automatically drop all incoming untagged frames until 802.1Q tagging is enabled for all VLANs.

Switch-B will prepend a VLAN 10 tag to the frames upon ingress based on Switch-A's trunk configuration.

Show answer & explanation

Answer: Switch-B will accept the untagged frames and associate them with VLAN 50.

Answer

Switch-B will accept the untagged frames and associate them with VLAN 50.

Under 802.1Q trunking, traffic belonging to the configured native VLAN is sent untagged across the link. Switch-A sends VLAN 10 traffic untagged because VLAN 10 is its native VLAN. Switch-B receives the untagged traffic and assigns it to its own local native VLAN, which is VLAN 50. This results in untagged frames leaking from VLAN 10 on Switch-A into VLAN 50 on Switch-B.

Step-by-Step Solution

Determine frame transmission behavior on Switch-A

Frames belonging to VLAN 10 on Switch-A match its native VLAN setting (`vlan 10`). Consequently, Switch-A transmits these frames across the 802.1Q trunk link without an explicit 4-byte 802.1Q header tag.

802.1Q trunking specifies that frames on the native VLAN are forwarded untagged.

Determine frame reception behavior on Switch-B

Switch-B receives untagged frames on interface GigabitEthernet0/1. Switch-B checks its local port configuration, identifies its native VLAN as VLAN 50, and places the incoming untagged traffic into VLAN 50.

Switches place all untagged ingress frames on an 802.1Q trunk port into the native VLAN configured on that local port.

Evaluate the net impact of the configuration

Traffic originating on VLAN 10 on Switch-A improperly leaks into VLAN 50 on Switch-B, creating a security issue and native VLAN mismatch condition.

Mismatched native VLAN IDs across a trunk link cause untagged frame cross-talk between different VLANs.

Key Concept

802.1Q Native VLAN Untagged Frame Processing and Mismatch Behavior

Question 523Question →

An enterprise network architect is designing a multi-VRF network infrastructure where clients in remote subnets must receive IP leases from a centralized DHCP server cluster while maintaining accurate physical switch-port tracking and automated domain name registration. Which TWO of the following configurations or mechanisms must be implemented to fulfill these requirements?

Select all that apply

Enable DHCP Relay (IP Helper) on the remote subnet default gateway interfaces to append Option 82 sub-options (Circuit ID and Remote ID) before forwarding requests to the central DHCP server.

Configure Client FQDN (Option 81) or secure Dynamic DNS (DDNS) updates on the DHCP server to automatically register forward (A/AAAA) and reverse (PTR) records with authoritative DNS servers.

Replace the standard A/AAAA resource records on the central DNS server with CNAME alias records that point directly to the subnet broadcast address of each remote relay agent.

Position the DHCP Relay Agent service exclusively on the centralized DHCP server host interface rather than on the remote default gateway interfaces.

Reconfigure the DHCP relay agents and central DHCP server to establish communication using TCP port 67 to encrypt packet headers across intermediate routers.

Show answer & explanation

Answer: Enable DHCP Relay (IP Helper) on the remote subnet default gateway interfaces to append Option 82 sub-options (Circuit ID and Remote ID) before forwarding requests to the central DHCP server.; Configure Client FQDN (Option 81) or secure Dynamic DNS (DDNS) updates on the DHCP server to automatically register forward (A/AAAA) and reverse (PTR) records with authoritative DNS servers.

Answer

The two correct requirements are configuring DHCP Relay on default gateway interfaces to insert Option 82 relay information, and enabling DHCP Option 81 (Client FQDN) / secure Dynamic DNS updates on the DHCP server.

Enabling DHCP Relay with Option 82 on remote subnet gateway interfaces allows the network to relay client requests across Layer 3 boundaries while attaching switch port and circuit metadata. In addition, using Option 81 (Client FQDN) / DDNS on the DHCP server ensures seamless, automated updating of A, AAAA, and PTR records in authoritative DNS zones whenever leases are granted.

Step-by-Step Solution

Analyze the requirement for tracking physical location/switch-port details across Layer 3 boundaries.

Identified that DHCP Relay Agent Information (Option 82) must be inserted at the Layer 3 boundary interface (default gateway) to provide Circuit ID and Remote ID metadata to the DHCP server.

Broadcast DHCP requests cannot cross routers without a relay agent, and Option 82 supplies switch port and agent identity to the centralized server.

Analyze the requirement for automated domain name registration across IP addressing services.

Identified DHCP Option 81 (Client FQDN) and secure Dynamic DNS (DDNS) integration between DHCP and DNS infrastructure.

Option 81 allows the DHCP server to negotiate and execute dynamic updates for forward (A/AAAA) and reverse (PTR) lookup records upon issuing an IP address lease.

Evaluate and discard distractor options based on architectural error taxonomy.

Eliminated incorrect relay placement (must be on remote gateway, not central server host), incorrect protocol/port (DHCP uses UDP 67/68, not TCP 67), and invalid DNS record usage (CNAME pointing to broadcast address).

Ensures architectural compliance with CompTIA Network+ standards for IP services.

Key Concept

DHCP Relay Architecture, Option 82 (Relay Agent Information), and Option 81 / DDNS Integration

Question 524Question →

A network engineer is provisioning subnets from the parent address block $192.168.64.0/20$ for a newly constructed facility. The primary VLAN requires capacity for at least $100$ usable host IP addresses while minimizing wasted address space. If the engineer allocates the first available valid subnet from this block that satisfies the host capacity requirement, what is the broadcast address of this allocated subnet?

192.168.64.127

192.168.64.126

192.168.64.255

192.168.64.63

Show answer & explanation

Answer: $192.168.64.127$

Answer

The broadcast address of the allocated subnet is

192.168.64.127

To host at least 100 devices with minimal address waste, 7 host bits are required (

2^7 - 2 = 126

usable hosts), which corresponds to a

/25

subnet mask. The first

/25

subnet within

192.168.64.0/20

occupies the IP block

192.168.64.0

192.168.64.127

. The final address of this block,

192.168.64.127

, serves as the broadcast address.

Step-by-Step Solution

Determine the minimum prefix length needed for 100 usable hosts.

Prefix length

/25

(7 host bits, providing

2^7 - 2 = 126

usable hosts).

/26

prefix only offers

2^6 - 2 = 62

usable host addresses, which is insufficient. A

/25

prefix provides

126

usable addresses, satisfying the requirement of at least 100 hosts while minimizing wasted space.

Identify the network boundary of the first

/25

subnet inside the

192.168.64.0/20

parent block.

Network ID:

192.168.64.0/25

Subnetting starts sequentially from the lowest network ID of the parent block.

Calculate the broadcast address of the

192.168.64.0/25

subnet.

Broadcast Address:

192.168.64.127

With a block size of

128

IP addresses (

2^7

), the subnet range spans

192.168.64.0

through

192.168.64.127

. The last IP address in the block is reserved for broadcast.

Key Concept

Subnet Masking and Broadcast Address Calculation

Question 525Question →

A network administrator is verifying the automatic IPv6 interface configuration of a host. The host network adapter has a MAC address of 00:1A:2B:3C:4D:5E. Which IPv6 link-local address is generated for this interface using the Modified EUI-64 format?

fe80::21a:2bff:fe3c:4d5e

fe80::01a:2bff:fe3c:4d5e

fe80::21a:2b00:fe3c:4d5e

fe80::001a::2bff:fe3c:4d5e

Show answer & explanation

Answer: fe80::21a:2bff:fe3c:4d5e

Answer

fe80::21a:2bff:fe3c:4d5e

To form a Modified EUI-64 interface identifier from a 48-bit MAC address, the 16-bit sequence FFFE is inserted between the OUI and NIC specific bytes, and the 7th bit of the first byte is inverted (changing 00 to 02). When prefixed with fe80::/64 and formatted with standard zero suppression, the resulting address is fe80::21a:2bff:fe3c:4d5e.

Step-by-Step Solution

Divide the 48-bit MAC address into two 24-bit halves.

Left half: 00:1A:2B, Right half: 3C:4D:5E.

Modified EUI-64 creates a 64-bit interface identifier by inserting a fixed 16-bit value between the OUI and the device's extension identifier.

Insert the 16-bit hexadecimal string FFFE between the two halves.

00:1A:2B:FF:FE:3C:4D:5E.

The standard EUI-64 expansion rule requires adding FFFE into the center of a 48-bit MAC address.

Invert the 7th bit (universal/local bit) of the first byte.

The first byte 0x00 (00000000 in binary) becomes 0x02 (00000010 in binary).

IPv6 Modified EUI-64 rules require flipping the 7th bit of the first byte to indicate universal scope.

Combine the result with the link-local prefix (fe80::/64) and apply standard zero compression.

fe80::21a:2bff:fe3c:4d5e.

Leading zeros within a 16-bit hex block (021a to 21a) are omitted according to RFC 5952 formatting standard.

Key Concept

Modified EUI-64 Link-Local Address Generation

Estimated Time:1m 30s

Question 526Question →

A network engineer is provisioning switch interface profiles across an enterprise network that includes desktop workstations, IP phones, and inter-switch links. Match each switchport configuration command on the left with its corresponding operational frame behavior on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Matching pairs: 'switchport mode access' pairs with single broadcast domain untagged handling; 'switchport trunk native vlan 50' pairs with untagged frame processing for specified ID on 802.1Q trunk; 'switchport trunk allowed vlan 10,20' pairs with restricting trunk traffic to permitted tagged VLAN IDs; 'switchport voice vlan 30' pairs with processing untagged data traffic alongside tagged IP telephony traffic.

Each switchport parameter maps directly to its 802.1Q framing specification: access ports strip headers for single VLAN endpoints, native VLAN commands dictate which trunk traffic remains untagged, allowed lists control 802.1Q tag filtering, and voice VLAN allows simultaneous tagged voice and untagged data traffic.

Step-by-Step Solution

Analyze standard access port behavior.

Identified that access ports belong to one VLAN and do not retain 802.1Q tags when delivering frames to endpoint devices.

Endpoint devices such as standard PCs expect untagged Ethernet II frames.

Analyze 802.1Q native VLAN operation.

Matched native VLAN configuration to the rule specifying untagged frame transmission/reception across an 802.1Q trunk.

By default in 802.1Q, one VLAN per trunk is designated to carry untagged frames to maintain backward compatibility.

Analyze allowed VLAN list configuration.

Associated the allowed VLAN statement with frame filtering that limits trunk traversal to explicitly permitted VLAN IDs.

Trunk pruning and security filtering restrict broadcast domains from spanning unnecessary switch links.

Analyze voice VLAN port behavior.

Linked auxiliary voice VLAN setup to multi-VLAN access port operation handling untagged PC data and tagged voice traffic.

IP phones act as mini-switches, tagging their own VoIP traffic while bridging untagged workstation frames.

Key Concept

802.1Q VLAN Frame Identification and Port Modes

Question 527Question →

A network engineer is reviewing a protocol analyzer capture during an active client-server session. The log shows explicit control checkpoints being inserted into the data stream to allow recovery and resume capabilities, as well as managing dialog control to regulate which side can transmit. Which OSI model layer is primarily responsible for managing these session synchronization points and dialog modes?

Session layer

Presentation layer

Transport layer

Data Link layer

Show answer & explanation

Answer: Session layer

Answer

Session layer

The correct answer is the Session layer because Layer 5 of the OSI model is explicitly designed to handle session setup, maintenance, tear-down, dialog control (regulating which host sends when), and insertion of synchronization checkpoints to allow recovery during long data transmissions.

Step-by-Step Solution

Analyze the operational requirements described in the stem.

Identified key requirements: managing dialog modes (simplex, half-duplex, full-duplex) and inserting synchronization checkpoints into communication streams.

Synchronization checkpoints and dialog control are functions dedicated to managing logical sessions between end systems.

Map the identified functions to the appropriate OSI model layer.

Session Layer (Layer 5) directly governs dialog control and session checkpointing.

Layer 5 establishes, manages, and terminates connections between applications at each end.

Key Concept

OSI Layer 5 (Session Layer) Functions

Estimated Time:1m 15s

Question 528Question →

Match each core IP addressing service or infrastructure component on the left with its primary operational function on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

DHCP Relay Agent matches with forwarding broadcast DHCP packets across routing boundaries; DNS PTR Record matches with mapping an IP address to an FQDN for reverse lookups; IPAM matches with centralizing IP space tracking and auditing; NTP matches with synchronizing system clocks for correlated logging.

Each service is correctly paired according to standard networking definitions: DHCP Relay forwards client discovery broadcasts across routers to a central server; DNS PTR records handle reverse IP-to-hostname lookups; IPAM centralizes network address management; and NTP maintains synchronized clock timing across network nodes.

Step-by-Step Solution

Analyze the role of DHCP Relay

DHCP Relay acts as an intermediate agent converting broadcast discovery packets into unicast traffic to traverse routers.

Routers drop layer 2 broadcast packets by default, requiring relay functionality to reach centralized DHCP services.

Analyze the function of DNS PTR records

PTR records map canonical IP addresses to FQDNs in reverse lookup zones.

Standard forward DNS uses A/AAAA records for domain-to-IP resolution, while reverse resolution requires PTR records.

Evaluate the administrative role of IPAM

IPAM integrates IP inventory tracking, subnet allocation, and capacity planning.

It prevents address collisions and simplifies management across large networks.

Identify the purpose of NTP

NTP synchronizes device clocks across network hosts.

Accurate timestamps are critical for logging, troubleshooting, and time-sensitive authentication mechanisms.

Key Concept

Core IP Addressing Services and Functions

Question 529Question →

A network technician is configuring a local subnetwork for a department that requires a $/27$ prefix length. How many usable host IPv4 addresses can be assigned to devices within this subnetwork?

Show answer & explanation

Answer: 30

Answer

There are 30 usable host IPv4 addresses in a /27 subnet.

A /27 prefix leaves 5 host bits (

32 - 27 = 5

). Calculating

2^5

gives

32

total IP addresses. Subtracting

2

reserved addresses for the network ID and broadcast address results in exactly

30

usable host IPv4 addresses.

Step-by-Step Solution

Determine the number of host bits remaining in a /27 CIDR prefix.

32 total bits - 27 network bits = 5 host bits.

An IPv4 address contains 32 bits divided between network bits and host bits.

Calculate the total capacity of IP addresses for 5 host bits.

2^5 = 32 total IP addresses.

The number of total IP addresses in a subnet is calculated using 2 raised to the power of the host bits.

Subtract the reserved network and broadcast addresses.

32 - 2 = 30 usable host addresses.

The lowest IP address represents the network ID and the highest IP address represents the broadcast address, neither of which can be assigned to host devices.

Key Concept

IPv4 Usable Host Address Calculation

Estimated Time:45s

Question 530Question →

A network technician is performing a protocol analyzer capture to inspect traffic traversing an enterprise IPv6 router interface. Which of the following statements accurately describe the characteristics of IPv6 base headers and link-local addressing? (Select TWO.)

Select all that apply

The 8-bit Hop Limit field replaces the IPv4 Time to Live (TTL) field to prevent packets from circulating indefinitely in a routing loop.

Link-local addresses utilize the fe80::/10 prefix and are automatically configured for single-segment communication without being routed across subnets.

An IPv6 link-local address can utilize double colons (::) multiple times in its shorthand notation if separated by non-zero hexadecimal fields.

The Next Header field is a 16-bit field dedicated exclusively to specifying Quality of Service (QoS) markings for voice traffic.

Show answer & explanation

Answer: The 8-bit Hop Limit field replaces the IPv4 Time to Live (TTL) field to prevent packets from circulating indefinitely in a routing loop.; Link-local addresses utilize the fe80::/10 prefix and are automatically configured for single-segment communication without being routed across subnets.

Answer

The correct statements are that the 8-bit Hop Limit field replaces the IPv4 Time to Live (TTL) field to prevent routing loops, and link-local addresses use the fe80::/10 prefix for single-segment, non-routable communication.

The Hop Limit field in the IPv6 base header serves as the direct replacement for IPv4's Time to Live (TTL) field, decrementing by one at each hop to eliminate packet loops. Furthermore, IPv6 link-local addresses fall under the fe80::/10 block (most commonly configured with fe80::/64) and are intended solely for local link communication, remaining non-routable across external networks.

Step-by-Step Solution

Analyze the Hop Limit field function in IPv6 headers.

Confirm that Hop Limit functions identically to IPv4 TTL, decrementing at each hop.

It prevents network packets from looping indefinitely on the network.

Evaluate link-local address prefixes and scope.

Identify fe80::/10 as the designated prefix scope for link-local traffic.

Link-local addresses are restricted to communication within the local broadcast/multicast domain and are discarded by routers.

Examine IPv6 shorthand address compression rules and Next Header functionality.

Reject invalid compression using multiple double colons and correct the field description of Next Header.

Using double colons more than once creates ambiguity, and Next Header identifies upper-layer protocols rather than QoS tags.

Key Concept

IPv6 Base Header Fields and Address Scope Characteristics

Question 531Question →

A network administrator is troubleshooting an issue where new IP phones on VLAN 50 ( $10.50.0.0/24$ ) successfully obtain IPv4 leased addresses and default gateway settings from a centralized DHCP server located on VLAN 10 ( $10.10.0.100$ ), but repeatedly fail to locate their TFTP provisioning server ( $10.10.0.200$ ) and fail to sync time with the corporate NTP server ( $10.10.0.10$ ). The layer 3 switch interface for VLAN 50 is configured with `ip helper-address 10.10.0.100`. Packet captures on the switch show DHCP requests are forwarded, but TFTP and NTP requests sent via broadcast during initial boot are dropped. Which configuration modification on the layer 3 switch will directly resolve the provisioning and time synchronization failure for the endpoints on VLAN 50?

Configure additional UDP forward port commands (`ip forward-protocol udp 69` and `ip forward-protocol udp 123`) or configure DHCP scope Options 66 and 42 on the central DHCP server.

Add a second `ip helper-address 10.10.0.200` entry under the VLAN 50 interface to relay DHCPDISCOVER broadcasts to the TFTP server host.

Create a canonical name (CNAME) record on the internal DNS server mapping the default hostname `tftp.local` to the IPv6 address of the provisioning server.

Reassign the centralized DHCP server service port from UDP port 67 to TCP port 68 to bypass layer 3 switch broadcast filtering policies.

Show answer & explanation

Answer: Configure additional UDP forward port commands (`ip forward-protocol udp 69` and `ip forward-protocol udp 123`) or configure DHCP scope Options 66 and 42 on the central DHCP server.

Answer

Configure additional UDP forward port commands or configure DHCP scope Options 66 and 42 on the central DHCP server.

Centralized network services across routed subnets require remote hosts to receive unicast destination information or require layer 3 devices to relay specific broadcast protocols. Configuring DHCP scope Option 66 (TFTP server) and Option 42 (NTP server) delivers unicast IPv4 addresses directly to endpoints during initial DHCP address leasing. Alternatively, ensuring `ip forward-protocol udp` rules allow UDP broadcast translation for ports 69 and 123 allows legacy broadcast discovery to reach centralized servers.

Step-by-Step Solution

Analyze client boot sequence requirements

IP phones require IP address configuration (via DHCP), TFTP server address for boot file download (Option 66), and NTP server address for time synchronization (Option 42).

Endpoints on remote subnets cannot discover centralized services via local layer 2 broadcasts across routed boundaries.

Evaluate relay behavior of `ip helper-address`

The `ip helper-address` command relays broadcast UDP traffic destined for specific ports to targeted unicast destinations.

If clients broadcast to discover TFTP (port 69) or NTP (port 123) without receiving DHCP scope options, UDP broadcast forwarding must be explicitly permitted or DHCP scope options must supply unicast addresses.

Select the correct infrastructure configuration solution

Providing DHCP Scope Options 66 and 42 ensures clients receive unicast target addresses directly, while adjusting UDP forward rules permits necessary relay traffic.

This directly satisfies the requirement for endpoints on VLAN 50 to locate and communicate with services on VLAN 10.

Key Concept

DHCP Relay (IP Helper) Operations and Service Option Configurations

Question 532Question →

A network engineer is provisioning subnets for an enterprise database cluster within the allocated block $172.22.140.0/22$ . The designated subnet for this VLAN is $172.22.142.128/25$ . Which of the following IPv4 addresses represent valid usable host addresses that can be statically assigned to database interfaces in this subnet? (Select ALL that apply.)

Select all that apply

172.22.142.128

172.22.142.129

172.22.142.200

172.22.142.255

Show answer & explanation

Answer: $172.22.142.129$ ; $172.22.142.200$

Answer

The valid usable host IPv4 addresses for the subnet are

172.22.142.129

and

172.22.142.200

For the subnet

172.22.142.128/25

, the prefix length

/25

provides 128 total IP addresses (

2^{32-25} = 128

). The network address is

172.22.142.128

and the broadcast address is

172.22.142.255

. Consequently, the valid usable host IPv4 address range extends from

172.22.142.129

up through

172.22.142.254

. Both

172.22.142.129

and

172.22.142.200

lie within this valid host range.

Step-by-Step Solution

Determine the prefix length and total block size.

/25

prefix length leaves

32 - 25 = 7

host bits, yielding

2^7 = 128

total IP addresses per subnet.

Understanding prefix length establishes the block boundary size.

Identify the network ID and broadcast address for

172.22.142.128/25

Network ID =

172.22.142.128

; Directed Broadcast Address =

172.22.142.128 + 127 = 172.22.142.255

The network address is the starting boundary and the broadcast address is the ending boundary.

Calculate the usable host IP address range.

Usable host range spans from

172.22.142.129

(Network ID + 1) to

172.22.142.254

(Broadcast Address - 1).

Network and broadcast addresses must be excluded when reserving addresses for host interfaces.

Evaluate the candidate options against the usable host range.

172.22.142.129

and

172.22.142.200

fall strictly within the usable host range, while

172.22.142.128

(Network ID) and

172.22.142.255

(Broadcast) do not.

Only IP addresses strictly within the usable host range are assignable to hosts.

Key Concept

IPv4 Subnet Boundaries and Usable Host Allocation

Question 533Question →

A system administrator is configuring a subnet for a new department containing 45 desktop computers and 3 network printers. Which of the following CIDR prefix lengths provides the minimum necessary capacity to accommodate all 48 devices while minimizing wasted IP addresses?

/26

/27

/25

/28

Show answer & explanation

Answer: /26

Answer

The prefix length /26 is the correct choice as it provides 62 usable host addresses, accommodating the required 48 devices with minimal address waste.

To support 48 host devices (45 PCs + 3 printers), a subnet must accommodate at least 48 usable addresses. A /26 subnet provides

2^6 - 2 = 62

usable IP addresses, which satisfies the host requirement while allocating the smallest possible subnet block.

Step-by-Step Solution

Calculate the total host IP addresses required.

45 workstations + 3 printers = 48 total host devices required.

Every active host interface requires a unique usable IP address on the subnet.

Determine the required host bits (h) using the formula

2^h - 2 \ge \text{required\_hosts}

For

h = 5

2^5 - 2 = 30

usable hosts (insufficient). For

h = 6

2^6 - 2 = 62

usable hosts (sufficient).

Two IP addresses in every subnet are reserved for the network ID and broadcast address.

Convert host bits (h) to CIDR prefix length.

32 total IPv4 bits - 6 host bits = /26 prefix length.

Subtracting host bits from 32 yields the network prefix length.

Key Concept

Determining minimum CIDR prefix length based on host capacity requirements

Question 534Question →

A network administrator is designing a local network topology across two switches using multiple VLANs and an 802.1Q trunk link. Which TWO of the following statements correctly describe Layer 2 switch operations and VLAN encapsulation in this environment?

Select all that apply

VLANs partition a physical switch into multiple distinct Layer 2 broadcast domains.

The switch inserts a 4-byte 802.1Q tag into the Ethernet frame header when forwarding traffic for non-native VLANs across a trunk link.

Workstations assigned to different VLANs on the same physical switch can communicate directly at Layer 2 without a Layer 3 routing device.

Untagged frames arriving at an 802.1Q trunk interface are discarded by default to prevent frame corruption.

Increasing the STP bridge priority to the maximum numerical value ensures a switch will be elected as the Spanning Tree Root Bridge.

Show answer & explanation

Answer: VLANs partition a physical switch into multiple distinct Layer 2 broadcast domains.; The switch inserts a 4-byte 802.1Q tag into the Ethernet frame header when forwarding traffic for non-native VLANs across a trunk link.

Answer

VLANs partition a physical switch into distinct Layer 2 broadcast domains, and an 802.1Q trunk inserts a 4-byte tag header into Ethernet frames for non-native VLAN traffic.

VLANs create logically separate Layer 2 broadcast domains on a physical switch, restricting broadcast traffic and isolating subnets. Across trunk connections, IEEE 802.1Q multiplexes VLAN traffic by inserting a 4-byte tag header into standard Ethernet frames for non-native VLANs.

Step-by-Step Solution

Analyze the fundamental definition and purpose of VLAN segmentation at Layer 2.

Confirm that each VLAN functions as an isolated broadcast domain within the switch infrastructure.

Traffic broadcasted within one VLAN does not cross over to ports in another VLAN without Layer 3 routing.

Examine how 802.1Q trunking multiplexes traffic from multiple VLANs across a single physical link.

Identify that 802.1Q inserts a 4-byte VLAN tag into the frame header for non-native VLAN traffic.

Tagging allows receiving switches to correctly identify the destination VLAN of incoming frames.

Evaluate the incorrect statements regarding inter-VLAN routing, native VLAN frame handling, and STP priority.

Reject statements claiming direct Layer 2 inter-VLAN communication, untagged frame dropping on trunks, and high numerical STP priority root selection.

Inter-VLAN traffic requires Layer 3 routing, native VLAN handles untagged traffic, and STP prefers lower bridge priority values.

Key Concept

VLAN Broadcast Isolation and 802.1Q Trunk Tagging

Estimated Time:1m 30s

Question 535Question →

A network administrator is reviewing a router's configuration where both a static route and an OSPF dynamic routing protocol offer paths to the exact same destination subnet. Which attribute does the router evaluate first to determine which routing source is more trustworthy and should be installed into the active routing table?

Administrative distance

Metric value

Port protocol mapping

PAT overload translation table

Show answer & explanation

Answer: Administrative distance

Answer

Administrative distance is evaluated first when comparing routes to the same destination from different routing protocols or static configuration.

Administrative distance measures the trustworthiness of a routing information source. When a router receives route information for an identical destination prefix from different sources, it selects the source with the lowest administrative distance to populate the active routing table.

Step-by-Step Solution

Identify the routing sources competing for entry in the routing table.

The router has learned paths to the same destination via both static routing and OSPF dynamic routing.

When multiple sources provide routes to identical destination networks, a selection tie-breaker mechanism is required.

Determine the primary criterion used to rate protocol trustworthiness.

Administrative Distance (AD) assigns a numerical believability rating to each routing source (e.g., Static = 1, OSPF = 110).

Lower Administrative Distance values take precedence over higher values before internal protocol metrics are considered.

Key Concept

Administrative Distance vs. Metric in Route Selection

Estimated Time:45s

Question 536Question →

A network technician is configuring an email client to retrieve user messages securely from a remote mail server using implicit TLS encryption. Which default port number should be configured for the Internet Message Access Protocol Secure (IMAPS)?

143

993

995

110

Show answer & explanation

Answer: 993

Answer

Port 993 is the default TCP port used for secure Internet Message Access Protocol (IMAPS).

Port 993 is the industry-standard well-known port designated for IMAP over SSL/TLS (IMAPS), providing encrypted email access between client and server.

Step-by-Step Solution

Identify the required protocol and security mode specified in the scenario.

The scenario requires configuring encrypted email retrieval using IMAP over TLS/SSL (IMAPS).

Email applications distinguish between unencrypted and encrypted retrieval protocols by using different well-known TCP ports.

Map IMAPS to its standard well-known port number.

IMAPS operates on TCP port 993 by default.

Standard network conventions assign TCP port 143 to unencrypted IMAP and TCP port 993 to implicit SSL/TLS encrypted IMAPS.

Key Concept

Common Ports and Protocols for Secure Mail Retrieval

Question 537Question →

A network administrator needs to connect two routers across a redundant network infrastructure. The administrator wants the routers to automatically exchange reachability information and update their routing tables dynamically whenever a network path fails. Which of the following options should be configured to meet this requirement?

Dynamic interior gateway protocol (such as OSPF)

Static default gateway route on both router interfaces

Virtual Router Redundancy Protocol (VRRP) virtual IP assignment

Layer 2 VLAN tagging on 802.1Q trunk links

Show answer & explanation

Answer: Dynamic interior gateway protocol (such as OSPF)

Answer

Dynamic interior gateway protocol (such as OSPF)

Dynamic interior gateway protocols (such as OSPF, EIGRP, or RIP) allow routers to automatically discover neighboring routers, exchange network routes, and dynamically update path selections when topology changes or link failures occur.

Step-by-Step Solution

Analyze the operational requirements

Identified the need for automatic reachability exchange and dynamic topology convergence during link failures.

The scenario highlights that routing tables must automatically update without manual administrator intervention when network changes occur.

Evaluate routing mechanism options

Dynamic routing protocols dynamically adapt to link changes, whereas static routes require manual reconfiguration.

Interior Gateway Protocols (IGPs) like OSPF periodically or event-driven exchange routing messages to discover paths automatically.

Key Concept

Dynamic Routing Protocol Functionality

Question 538Question →

A network engineer intends to establish a redundant path to a remote office subnet $10.45.0.0/16$ . The primary path learns the route dynamically via eBGP (administrative distance of $20$ ). The engineer attempts to configure a backup floating static route through an IPsec tunnel interface, intended to activate only if the primary eBGP session fails. However, the engineer enters the configuration command: `ip route 10.45.0.0 255.255.0.0 172.16.1.2 15`. Under normal operating conditions with both connections active, which path will the router install into the routing table for traffic destined to $10.45.12.30$ , and why?

The router will install the static route via next-hop 172.16.1.2 because lower administrative distance values are prioritized over higher values, causing the static route (AD 15) to override the eBGP route (AD 20).

The router will install the eBGP route because dynamic routing protocol metrics automatically take precedence over static route administrative distance values.

The router will install the eBGP route because exterior gateway protocols maintain absolute priority in the routing control plane over locally configured static routes.

The router will load-balance packets across both paths because both routes match the destination prefix length identically.

Show answer & explanation

Answer: The router will install the static route via next-hop 172.16.1.2 because lower administrative distance values are prioritized over higher values, causing the static route (AD 15) to override the eBGP route (AD 20).

Answer

The router will select the static route via next-hop 172.16.1.2 because an administrative distance of 15 is numerically lower and therefore more preferred than eBGP's administrative distance of 20.

When a router receives multiple routes for the exact same destination prefix length from different routing protocols or administrative sources, it uses Administrative Distance (AD) to decide which route to populate into the routing table. Lower AD values represent higher preference. Because eBGP has a default AD of 20 and the misconfigured static route was given an AD of 15, the router prefers 15 over 20, causing the intended 'backup' static route to be active during normal operation.

Step-by-Step Solution

Analyze prefix lengths for incoming traffic

Both the eBGP route and the static route match the target IP address 10.45.12.30 with an identical prefix mask of /16 (10.45.0.0/16).

Longest Prefix Match (LPM) is evaluated first. Since both masks are identical (/16), the router moves to comparing Administrative Distance.

Compare Administrative Distance (AD) values of competing routing sources

The static route has an AD of 15 (explicitly configured), while eBGP has a default AD of 20.

Administrative distance measures route trustworthiness across different protocol sources, where lower numerical values indicate higher trustworthiness.

Determine the active route installed into the Routing Information Base (RIB)

Because 15 is lower than 20, the router selects the static route via next-hop 172.16.1.2 instead of the dynamic eBGP route.

To create a true floating backup static route for eBGP (AD 20), the engineer should have configured an AD greater than 20 (e.g., AD 25 or 200).

Key Concept

Administrative Distance vs Floating Static Route Configuration

Question 539Question →

Match each core IP addressing service component to its corresponding primary functional role within an enterprise network architecture.

Click a left item, then click its matching right item

Show answer & explanation

Answer

DHCP Option 82 matches with appending switch port and device MAC metadata to lease requests. Dynamic DNS matches with automatically registering forward and reverse name resolution entries. IP Address Management (IPAM) matches with centralized tracking, scope utilization monitoring, and cross-platform synchronization of network address space. Stratum 1 NTP Server matches with synchronizing system clocks directly from an attached hardware reference source such as GPS.

Each service component is matched accurately based on its core networking role: DHCP Option 82 provides relay metadata insertion (Circuit ID/Remote ID); Dynamic DNS maintains dynamic host-to-IP resource records (A/AAAA/PTR); IPAM delivers centralized governance over address spaces and scope metrics; and Stratum 1 NTP servers link directly to hardware time sources like GPS receivers.

Step-by-Step Solution

Analyze DHCP Option 82 functional purpose

Identified that Option 82 is the Relay Agent Information Option used by network switches/routers to attach Circuit ID and Remote ID details.

Relay agents add geographic or topological metadata to aid DHCP server assignment policies.

Analyze Dynamic DNS (DDNS / Option 81) operations

Identified that DDNS updates forward (A/AAAA) and reverse (PTR) DNS records dynamically upon lease events.

Prevents stale host resolution data when IP leases are dynamically assigned via DHCP.

Analyze IP Address Management (IPAM) features

Identified that IPAM offers consolidated discovery, tracking, and scope utilization monitoring across infrastructure DNS/DHCP deployments.

Eliminates spreadsheet management by centralizing IP space management across active network services.

Analyze NTP Stratum hierarchy definitions

Identified that Stratum 1 servers connect directly to Stratum 0 time sources (GPS, atomic clocks).

Stratum level indicates distance from the reference clock, where Stratum 1 represents direct attachment.

Key Concept

IP Addressing Services and Enterprise Supporting Infrastructure

Estimated Time:2m 0s

Question 540Question →

An enterprise network engineer is provisioning a switch interface connecting switch SW-Floor3 to the distribution switch SW-Dist1. The link carries traffic for VLAN 10 (Corporate Data), VLAN 20 (Guest Wi-Fi), and VLAN 50 (VoIP Telephony). IP phones connected to SW-Floor3 fail to register with the central call manager on VLAN 50, although workstations on VLAN 10 communicate across the link normally.

The engineer views the trunk configuration on interface GigabitEthernet1/0/48:
text
interface GigabitEthernet1/0/48
switchport trunk encapsulation dot1q
switchport mode trunk
switchport trunk native vlan 10
switchport trunk allowed vlan 10,20,30

Which of the following identifies the root cause of the VoIP communication failure?

The allowed VLAN pruning list on the trunk interface omits VLAN 50, preventing traffic belonging to the voice network from traversing the link.

Configuring VLAN 10 as the native VLAN causes all VLAN 50 tagged frames to be automatically re-tagged as VLAN 10 before transmission.

VLAN 10 and VLAN 50 belong to different broadcast domains and cannot both traverse an 802.1Q trunk link without a Layer 3 router on the interface.

The 802.1Q encapsulation command disables voice VLAN tagging, converting all voice frames into untagged traffic that gets dropped by the remote switch.

Show answer & explanation

Answer: The allowed VLAN pruning list on the trunk interface omits VLAN 50, preventing traffic belonging to the voice network from traversing the link.

Answer

The allowed VLAN pruning list on the trunk interface omits VLAN 50, preventing traffic belonging to the voice network from traversing the link.

The configuration command 'switchport trunk allowed vlan 10,20,30' creates an explicit permit list for trunking. Because VLAN 50 is not included in this allowed list, the switch prunes VLAN 50 traffic, dropping all ingress and egress 802.1Q tagged frames associated with the voice network on this port.

Step-by-Step Solution

Analyze the reported symptom and requirements.

Workstations on VLAN 10 work normally across the trunk, but IP phones on VLAN 50 cannot communicate with the call manager.

This indicates a selective VLAN transmission issue over the physical trunk link GigabitEthernet1/0/48.

Examine the interface CLI configuration snippet.

The command 'switchport trunk allowed vlan 10,20,30' restricts traffic on GigabitEthernet1/0/48 exclusively to VLANs 10, 20, and 30.

By explicitly specifying an allowed VLAN list without including VLAN 50, any frames carrying an 802.1Q tag for VLAN 50 are dropped at the interface.

Determine the necessary remediation.

VLAN 50 must be appended to the allowed VLAN list on the trunk interface.

Adding VLAN 50 enables 802.1Q tagged frames for the voice network to traverse the trunk link between switches.

Key Concept

802.1Q Trunk Allowed VLAN Filtering

PreviousPage 27 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept