All practice questions

2237 questions

All types2,237 Multiple choice1,150 Multiple select488 Numeric30 Matching350 Ordering201 Short answer18

Match each remote management protocol or access method on the left to its correct primary characteristic on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

SSH matches with encrypted command-line access; Telnet matches with unencrypted cleartext access; Cellular Out-of-Band Modem matches with alternative connectivity during primary connection failure; RDP matches with graphical user interface sessions.

Each management solution is paired directly with its core operational distinction: SSH offers encrypted command-line sessions, Telnet provides unencrypted command-line sessions, Cellular Out-of-Band modems deliver secondary connectivity during primary network failures, and RDP supplies graphical desktop interface sessions.

Step-by-Step Solution

Identify the primary encrypted command-line remote access method.

SSH provides secure, encrypted terminal access over network connections.

SSH encrypts session communications to protect against eavesdropping.

Identify the legacy unencrypted terminal access protocol.

Telnet transmits command-line traffic in unencrypted plain text.

Telnet lacks native encryption capabilities.

Identify the alternative access mechanism used during primary network outage.

Cellular Out-of-Band Modem provides backup network access independent of standard WAN links.

Out-of-band cellular connections bypass local infrastructure failures.

Identify the graphical desktop remote access protocol.

RDP enables full graphical user interface remote management.

RDP streams the graphical desktop environment to remote administrators.

Key Concept

Remote Access Protocols and Out-of-Band Management Methods

Question 582Question →

A network administrator installs a passive Network Intrusion Detection System (NIDS) connected to a switch SPAN port to monitor application traffic for web servers. All incoming web application traffic is encrypted end-to-end using TLS on TCP port 443. During a penetration test, simulated cross-site scripting (XSS) attacks sent inside HTTPS payloads pass through the network undetected by the NIDS. Which of the following best explains why the NIDS failed to generate an alert?

The passive NIDS cannot decrypt packet payloads in transit, preventing signature matching against the encrypted application-layer attack strings.

The NIDS operates exclusively at Layer 2 of the OSI model and is structurally incapable of analyzing TCP port headers or IP packet structures.

The switch SPAN port automatically filters out encrypted TCP port 443 traffic because port mirroring is reserved strictly for unencrypted UDP protocols.

Network-based detection systems automatically drop packets with TCP destination port 443 because TLS packets lack standard IP header checksums.

Show answer & explanation

Answer: The passive NIDS cannot decrypt packet payloads in transit, preventing signature matching against the encrypted application-layer attack strings.

Answer

The passive NIDS failed to detect the attack because it cannot inspect packet payloads encrypted by TLS without access to session decryption mechanisms.

Network Intrusion Detection Systems (NIDS) rely on deep packet inspection (DPI) to match known attack signatures against application-layer payloads. When web application traffic is protected by TLS encryption, the HTTP payload containing the attack string (such as an XSS payload) is converted into ciphertext. A passive out-of-band NIDS connected to a SPAN port receives duplicate raw encrypted frames and lacks the cryptographic keys and inline decryption capability required to inspect the underlying payload.

Step-by-Step Solution

Analyze the traffic type and deployment mode described in the scenario.

The traffic uses TLS encryption on TCP port 443, and the sensor is a passive out-of-band NIDS connected via SPAN port.

Understanding where the sensor sits and what data it receives determines its visibility limits.

Evaluate the impact of end-to-end TLS encryption on network-based inspection.

TLS encrypts the application layer payload (HTTP request containing XSS vectors) before transmission across the wire.

Signature-based NIDS inspects unencrypted payload strings; when traffic is encrypted, the payload appears as uninterpretable ciphertext to the passive network sensor.

Identify the correct technical limitation causing the detection failure.

Without SSL/TLS decryption offloading or a host-based agent (HIDS/HIPS), the NIDS cannot perform deep packet inspection on encrypted payloads.

This highlights the trade-off of passive out-of-band NIDS deployments when facing modern encrypted transport protocols.

Key Concept

Impact of Payload Encryption on Network Intrusion Detection Systems

Question 583Question →

A system administrator is configuring a secure remote access solution using an SSL/TLS VPN to allow telecommuters to access internal network applications. Which transport layer protocol and default port number are used by an SSL/TLS VPN connection?

TCP port 443

UDP port 500

TCP port 22

UDP port 1701

Show answer & explanation

Answer: TCP port 443

Answer

TCP port 443 is the standard protocol and port used for SSL/TLS VPN connections.

SSL/TLS remote access VPNs utilize Transport Layer Security, which operates over TCP port 443 by default. Because TCP port 443 is also used for standard encrypted web browsing (HTTPS), it easily traverses firewalls and Network Address Translation (NAT) devices.

Step-by-Step Solution

Identify the VPN technology specified in the scenario.

The scenario specifies an SSL/TLS-based remote access VPN.

Determining the underlying protocol suite identifies the required transport protocol and port assignment.

Associate SSL/TLS with its standard transport layer port number.

SSL/TLS uses TCP port 443.

Port 443 is the established standard port for Transport Layer Security (TLS) traffic.

Key Concept

SSL/TLS VPN Transport Port Characteristics

Estimated Time:45s

Question 584Question →

A network operations team is updating telemetry rules and syslog configurations for enterprise core routers and firewalls. Match each network logging mechanism or Syslog severity level on the left with its corresponding operational description on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Syslog Severity Level 0 (Emergency) matches with 'Signals a complete system panic or failure, indicating that the device is unusable.' Syslog Severity Level 3 (Error) matches with 'Reports non-fatal operating error conditions, such as interface module failure or connection timeouts.' Syslog Severity Level 6 (Informational) matches with 'Captures normal operational state events, such as link state transitions or user authentication success logs.' SNMPv3 authPriv Mode matches with 'Provides HMAC packet authentication using SHA/MD5 along with payload encryption using AES/DES.'

Each item correctly aligns standard network administration auditing protocols and severity scales. Syslog severity 0 represents system panic/unusable conditions, severity 3 represents error conditions, severity 6 represents informational status updates, and SNMPv3 authPriv provides both authentication and privacy/encryption.

Step-by-Step Solution

Analyze Syslog numeric severity levels (0 through 7).

Identify Level 0 as Emergency/Panic (system unusable), Level 3 as Error (non-fatal error conditions), and Level 6 as Informational (normal operation state messages).

Standard RFC 5424 Syslog severity ratings assign lower numerical values to higher severity events.

Evaluate SNMPv3 security levels (noAuthNoPriv, authNoPriv, authPriv).

Match authPriv to the requirement for both hashing/authentication and encryption/privacy.

The 'auth' portion ensures message source validation and integrity, while 'priv' adds symmetric payload encryption.

Map each term to its exact operational definition.

Pair Level 0 with panic/unusable, Level 3 with non-fatal errors, Level 6 with operational state logs, and SNMPv3 authPriv with SHA/MD5 authentication plus AES encryption.

Aligns device logging mechanisms and management security models with enterprise auditing standards.

Key Concept

Syslog Severity Levels and SNMP Security Models

Question 585Question →

A network administrator needs to update access control list rules to permit network file transfer services. Which of the following default transport protocols and port numbers are correctly matched with their protocol? (Select TWO.)

Select all that apply

TFTP using UDP port 69

SFTP using TCP port 22

FTP using UDP port 21

HTTPS using TCP port 80

Show answer & explanation

Answer: TFTP using UDP port 69; SFTP using TCP port 22

Answer

The correct choices are 'TFTP using UDP port 69' and 'SFTP using TCP port 22'.

Trivial File Transfer Protocol (TFTP) operates on UDP port 69 to perform unauthenticated, low-overhead file transfers. Secure File Transfer Protocol (SFTP) operates over SSH, which uses TCP port 22 to encrypt authentication and data transfer.

Step-by-Step Solution

Identify the transport protocol and default port for TFTP.

Trivial File Transfer Protocol (TFTP) uses UDP at port 69.

TFTP relies on connectionless UDP to minimize protocol overhead during simple file transfers.

Identify the transport protocol and default port for SFTP.

Secure File Transfer Protocol (SFTP) uses TCP at port 22.

SFTP runs inside an SSH tunnel, inheriting SSH's reliance on TCP port 22.

Evaluate the remaining options.

FTP uses TCP (not UDP), and HTTPS uses port 443 (not port 80).

Standard FTP requires reliable TCP state management, and HTTPS defaults to port 443.

Key Concept

Common Network Ports and Transport Protocols for File Transfer

Question 586Question →

A network technician is configuring an isolated IPv4 subnet for a small cluster of servers using the subnet mask $255.255.255.248$ ( $/29$ ). What is the maximum number of usable host IP addresses available on this subnet?

6

8

7

4

Show answer & explanation

Answer: $6$

Answer

The maximum number of usable host IP addresses on a

255.255.255.248

(

/29

) subnet is

6

A subnet mask of

255.255.255.248

corresponds to a

/29

CIDR prefix. This leaves 3 host bits (

32 - 29 = 3

). The total number of IP addresses is

2^3 = 8

. Subtracting 2 (one for the network address and one for the broadcast address) leaves

6

usable host IP addresses.

Step-by-Step Solution

Determine the number of host bits in the

/29

subnet mask.

There are

32 - 29 = 3

host bits.

An IPv4 address has 32 total bits. Subtracting the network prefix bits leaves the bits reserved for hosts.

Calculate the total number of IP addresses in the subnet block.

2^3 = 8

total IP addresses.

The total number of IP addresses in a subnet is calculated using the formula

2^{\text{host bits}}

Subtract the reserved network and broadcast addresses to find usable host IP addresses.

8 - 2 = 6

usable host IP addresses.

The first address is reserved as the network address and the last address is reserved as the broadcast address, neither of which can be assigned to host devices.

Key Concept

IPv4 Subnet Usable Host Calculation

Question 587Question →

A network technician is configuring an interface on a router for a subnet assigned the $/28$ CIDR prefix. Which of the following statements regarding this subnet prefix are correct? (Select TWO.)

Select all that apply

The subnet mask in dotted-decimal notation is

255.255.255.240

The total number of usable host IP addresses available on the subnet is 14.

The total number of usable host IP addresses available on the subnet is 16.

The subnet mask in dotted-decimal notation is

255.255.255.224

Show answer & explanation

Answer: The subnet mask in dotted-decimal notation is $255.255.255.240$ .; The total number of usable host IP addresses available on the subnet is 14.

Answer

The statement that the subnet mask in dotted-decimal notation is 255.255.255.240 and the statement that the total number of usable host IP addresses is 14 are correct.

For a

/28

prefix,

28

bits belong to the network identifier, leaving

4

host bits (

32 - 28 = 4

). In dotted-decimal notation, 28 mask bits translate to

255.255.255.240

because

128 + 64 + 32 + 16 = 240

. The usable host capacity is calculated using the formula

2^h - 2 = 2^4 - 2 = 14

Step-by-Step Solution

Calculate the subnet mask in dotted-decimal notation.

Prefix length

/28

means 28 network bits and

32 - 28 = 4

host bits. The binary mask is `11111111.11111111.11111111.11110000`, which translates to

255.255.255.240

Converting CIDR prefix length to octets yields the dotted-decimal subnet mask.

Calculate the number of usable host IP addresses.

Total IP addresses =

2^4 = 16

. Usable host addresses =

2^4 - 2 = 14

The network address (all host bits 0) and the broadcast address (all host bits 1) cannot be assigned to individual hosts.

Key Concept

Subnet Mask Dotted-Decimal Conversion and Usable Host IP Calculation

Question 588Question →

A network administrator is evaluating protocol functions within an enterprise network infrastructure. Which of the following operations take place specifically at the Network Layer (Layer 3) of the OSI model? (Select TWO.)

Select all that apply

Determining optimal path selection for data delivery across interconnected subnets using routing algorithms

Formatting data units into IP packets and applying logical source and destination addresses

Performing physical hardware addressing and framing using Media Access Control (MAC) addresses

Managing end-to-end segment sequencing, flow control, and port-based process multiplexing

Show answer & explanation

Answer: Determining optimal path selection for data delivery across interconnected subnets using routing algorithms; Formatting data units into IP packets and applying logical source and destination addresses

Answer

Determining optimal path selection for data delivery across interconnected subnets using routing algorithms, and formatting data units into IP packets and applying logical source and destination addresses.

The Network Layer (Layer 3) is responsible for end-to-end logical host addressing and path determination (routing) across interconnected subnets. Consequently, encapsulating data into packets with logical IP addresses and routing those packets across networks are the correct Layer 3 operations.

Step-by-Step Solution

Identify the primary scope of the Network Layer (Layer 3) in the OSI model.

Layer 3 handles logical addressing and path determination across multi-segment networks.

The core purpose of Layer 3 is to enable inter-network host communication beyond local broadcast domains.

Analyze each proposed function against OSI layer boundaries.

Routing paths and IP packet addressing belong to Layer 3. MAC addressing belongs to Layer 2, while TCP/UDP port multiplexing and flow control belong to Layer 4.

Differentiating physical hardware addresses, logical network addresses, and transport ports clarifies proper layer assignment.

Key Concept

OSI Model Layer 3 (Network Layer) Responsibilities

Question 589Question →

An enterprise enterprise router has learned routes to the destination network 172.16.10.0/24 from multiple dynamic routing sources and static configurations. The routing table currently evaluates path determination during active traffic forwarding. Which of the following operational behaviors correctly describe how the router selects and processes these routes? (Select TWO).

Select all that apply

The router compares Administrative Distance (AD) first when multiple routing protocols advertise the exact same destination prefix, selecting the route with the lowest AD to populate the routing table.

When forwarding a packet, the router evaluates Longest Prefix Match (LPM) prior to Administrative Distance, preferring a /26 route over a /24 route regardless of protocol trust rating.

If two identical prefixes are learned via OSPF (AD 110) and EIGRP (AD 90), the router places both in the active forwarding table and load-balances using metric calculations.

Static routes with an assigned Administrative Distance of 1 are overridden by dynamic OSPF routes whenever the physical link metric for OSPF drops to 0.

Show answer & explanation

Answer: The router compares Administrative Distance (AD) first when multiple routing protocols advertise the exact same destination prefix, selecting the route with the lowest AD to populate the routing table.; When forwarding a packet, the router evaluates Longest Prefix Match (LPM) prior to Administrative Distance, preferring a /26 route over a /24 route regardless of protocol trust rating.

Answer

The correct selections are the statements regarding Administrative Distance selection for identical prefixes and Longest Prefix Match precedence during packet forwarding.

Administrative Distance is used to choose the most reliable protocol path when identical prefixes are advertised by different protocols. However, during packet forwarding, Longest Prefix Match takes absolute precedence, meaning a more specific prefix (/26) will always be chosen over a less specific one (/24) regardless of how the route was learned.

Step-by-Step Solution

Analyze route selection hierarchy for identical prefixes learned via different sources.

Administrative Distance (AD) determines which protocol's route is populated into the routing table when identical destination subnets exist.

Lower AD values indicate higher protocol trustworthiness.

Analyze packet forwarding decision logic for populated routes of varying prefix lengths.

The router applies Longest Prefix Match (LPM) to select the most specific subnet mask.

LPM supersedes AD because AD only determines entry into the routing table, whereas LPM rules active packet forwarding across all table entries.

Key Concept

Route Selection Precedence (Longest Prefix Match vs Administrative Distance vs Metric)

Question 590Question →

A network administrator is deploying core IP addressing services in a multi-subnet corporate office. Workstations are located on VLAN 10 ( $10.10.10.0/24$ ), while the centralized DHCP server resides on VLAN 50 ( $10.10.50.0/24$ ). Users on VLAN 10 report that their systems are failing to receive dynamic IP address assignments. Upon reviewing the configuration on the Layer 3 switch bridging these subnets, the administrator discovers that the command `ip helper-address 10.10.50.5` was placed exclusively under the VLAN 50 interface rather than the VLAN 10 Switch Virtual Interface (SVI). Which of the following best explains why clients on VLAN 10 are unable to obtain IP addresses?

The Layer 3 switch does not intercept client DHCP broadcast requests unless the relay command is enabled on the client-facing gateway interface.

The DHCP server requires a corresponding DNS PTR record on VLAN 50 before issuing IP lease configurations to remote subnets.

DHCPDISCOVER broadcast traffic is dropped because IP helper functions process relay requests over TCP port 67 instead of UDP port 67.

DHCP relay agents must be positioned on the server-side interface to strip Layer 2 MAC headers before forwarding frames across subnets.

Show answer & explanation

Answer: The Layer 3 switch does not intercept client DHCP broadcast requests unless the relay command is enabled on the client-facing gateway interface.

Answer

The Layer 3 switch does not intercept client DHCP broadcast requests unless the relay command is enabled on the client-facing gateway interface.

DHCP clients broadcast their initial lease requests (DHCPDISCOVER) onto their local subnet (VLAN 10). Because Layer 3 routers do not forward broadcasts, a DHCP relay agent (`ip helper-address`) must be configured on the ingress interface facing the clients (VLAN 10 SVI). The relay agent converts the broadcast into a unicast packet addressed directly to the DHCP server (

10.10.50.5

). When configured only on VLAN 50, the router never intercepts the broadcasts generated by hosts on VLAN 10.

Step-by-Step Solution

Analyze how DHCP discovery messages travel across Layer 3 boundaries.

Workstations send DHCPDISCOVER packets as local Layer 2/3 broadcasts (

255.255.255.255

). Routers block broadcast traffic by default.

Broadcast traffic cannot cross subnets without an intermediary service.

Identify where the DHCP relay agent must listen.

The `ip helper-address` directive configures the router interface to listen for incoming UDP port 67 broadcasts on that specific interface.

Because the broadcast originates on VLAN 10, the configuration must exist on the VLAN 10 interface to catch incoming client requests.

Evaluate the current configuration placement.

Placing `ip helper-address` on VLAN 50 only listens for broadcasts originating on VLAN 50, leaving VLAN 10 broadcasts unhandled and dropped at the gateway.

Relaying requires listening on the ingress interface facing the requesting clients.

Key Concept

DHCP Relay / IP Helper Address Interface Placement

Estimated Time:2m 0s

Question 591Question →

A network engineer is analyzing an 802.1Q trunk connection established between `SW-Access-01` and `SW-Core-01` on interface `GigabitEthernet0/1`. Interface configurations are as follows:

SW-Access-01:
text
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk native vlan 1
switchport trunk allowed vlan 10,20,30

SW-Core-01:
text
interface GigabitEthernet0/1
switchport mode trunk
switchport trunk native vlan 10
switchport trunk allowed vlan 10,20,30

Assuming both switches are active and exchanging data, which TWO of the following statements accurately describe how untagged and tagged frames are processed across this link? (Select TWO)

Select all that apply

Untagged frames transmitted from VLAN 1 on SW-Access-01 will be forwarded into VLAN 10 upon arriving at SW-Core-01.

Frames originating from VLAN 10 on SW-Access-01 will egress the trunk untagged and be dropped by SW-Core-01.

VLAN 10 traffic sent from SW-Core-01 will egress untagged and be assigned to VLAN 1 when received by SW-Access-01.

SW-Core-01 will drop all incoming VLAN 10 frames transmitted by SW-Access-01 because a Layer 3 router is required to translate trunk tags.

Show answer & explanation

Answer: Untagged frames transmitted from VLAN 1 on SW-Access-01 will be forwarded into VLAN 10 upon arriving at SW-Core-01.; VLAN 10 traffic sent from SW-Core-01 will egress untagged and be assigned to VLAN 1 when received by SW-Access-01.

Answer

Untagged frames transmitted from VLAN 1 on SW-Access-01 will be forwarded into VLAN 10 upon arriving at SW-Core-01, and VLAN 10 traffic sent from SW-Core-01 will egress untagged and be assigned to VLAN 1 when received by SW-Access-01.

On an 802.1Q trunk link, frames belonging to the configured native VLAN are transmitted without an 802.1Q tag, while frames from all other allowed VLANs are tagged. When a native VLAN mismatch exists between two switches, untagged frames sent by one switch are received and placed into the receiving switch's configured native VLAN. Specifically, untagged frames from VLAN 1 on the access switch arrive at the core switch and are assigned to VLAN 10. Conversely, VLAN 10 frames originating on the core switch are sent untagged because VLAN 10 is native on that switch; upon arrival at the access switch, these untagged frames are placed into VLAN 1.

Step-by-Step Solution

Analyze frame encapsulation on SW-Access-01 for VLAN 1 and VLAN 10

Native VLAN on SW-Access-01 is VLAN 1. Therefore, VLAN 1 traffic is sent untagged, while VLAN 10 traffic is encapsulated with an 802.1Q tag bearing VLAN ID 10.

802.1Q trunks strip tags for traffic belonging to the local native VLAN and add tags for all other allowed VLANs.

Analyze ingress frame processing on SW-Core-01

Native VLAN on SW-Core-01 is VLAN 10. Any untagged frame arriving at SW-Core-01 is implicitly assigned to VLAN 10. Tagged frames with VLAN ID 10 are placed directly into VLAN 10.

Switches assign incoming untagged frames to whichever native VLAN is configured on the receiving trunk port.

Analyze egress frame processing from SW-Core-01 towards SW-Access-01

VLAN 10 frames leaving SW-Core-01 are stripped of tags because VLAN 10 is native on SW-Core-01. SW-Access-01 receives untagged frames and places them into its native VLAN 1.

Native VLAN mismatch causes asymmetrical traffic leakage between the two configured native VLANs across opposing switch ports.

Key Concept

802.1Q Native VLAN Processing & Tagging Behavior

Question 592Question →

A network administrator is auditing 802.1Q trunking and access port behavior on enterprise switches. Match each switchport operational scenario on the left with its corresponding 802.1Q frame processing or tagging outcome on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Each scenario matches as follows: Access port receiving untagged traffic maps to internal VLAN 20 processing; Trunk port receiving untagged traffic implicitly maps to native VLAN 50; Trunk port transmitting native VLAN 50 egresses untagged without an 802.1Q header; Trunk port receiving VLAN 30 on an allowed list of 10,20 drops the frame due to VLAN filtering.

The pairings correctly demonstrate fundamental 802.1Q trunking and access port behavior: access ports map untagged ingress frames to their access VLAN, trunk ports map untagged ingress frames to their native VLAN, native VLAN egress traffic is transmitted without an 802.1Q tag header, and frames tagged with VLANs outside the trunk allowed list are dropped at ingress.

Step-by-Step Solution

Analyze access port frame ingestion behavior.

Untagged ingress frames on an access port configured for VLAN 20 are logically mapped to VLAN 20.

Access ports only accept untagged frames (or frames with the matching access VLAN if voice VLAN is configured) and place them into the assigned access VLAN.

Analyze trunk port native VLAN ingress processing.

Untagged frames arriving on an 802.1Q trunk link are implicitly assigned to the native VLAN (VLAN 50).

IEEE 802.1Q design mandates that any untagged ingress frame arriving on a trunk interface belongs to the native VLAN configured on that interface.

Analyze trunk port native VLAN egress header tagging.

Frames assigned to VLAN 50 exit the trunk port untagged.

To maintain backward compatibility with non-802.1Q aware devices, 802.1Q trunks strip the 4-byte VLAN tag field for any frames belonging to the native VLAN prior to transmission.

Analyze trunk allowed VLAN list filtering rules.

A frame tagged with VLAN 30 arriving on a trunk restricted to VLANs 10 and 20 is dropped at ingress.

The 'switchport trunk allowed vlan' command defines the allowed list; any tagged frame carrying a VLAN ID not present in the allowed list is pruned/dropped by switch hardware.

Key Concept

802.1Q Frame Tagging, Native VLAN Ingress/Egress Rules, and Trunk Allowed List Pruning

Question 593Question →

Match each physical or logical network layout description to its corresponding topology classification.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Full Mesh Topology pairs with the description of dedicated point-to-point connections between every node. Star Topology pairs with peripheral devices connected directly to a central intermediate device. Ring Topology pairs with devices connected in a continuous closed loop passing traffic sequentially. Bus Topology pairs with devices sharing a single central trunk line requiring terminators.

Each description accurately reflects the physical characteristics of its respective topology: full mesh provides complete point-to-point links between all nodes, star connects nodes to a central hub/switch, ring passes traffic sequentially in a circular arrangement, and bus uses a shared single trunk with terminators.

Step-by-Step Solution

Identify the topology providing complete point-to-point redundancy across all nodes.

Full Mesh Topology matched.

Full mesh networks connect every host directly to every other host.

Identify the topology centered around a central network switch or hub.

Star Topology matched.

Star architecture routes all traffic from peripheral endpoints through a central device.

Identify the topology operating in a sequential circular loop.

Ring Topology matched.

Ring networks transmit packets/tokens sequentially from host to host around a circle.

Identify the topology using a single terminated trunk line.

Bus Topology matched.

Bus networks connect all endpoints to a single shared cable terminated at both ends to prevent signal reflection.

Key Concept

Physical Network Topologies

Estimated Time:1m 30s

Question 594Question →

A network administrator needs to connect an enterprise network to two different Internet Service Providers (ISPs) located in separate Autonomous Systems (AS). Which dynamic routing protocol should be implemented to exchange routing information between these distinct Autonomous Systems?

Border Gateway Protocol (BGP)

Open Shortest Path First (OSPF)

Port Address Translation (PAT)

Automatic Private IP Addressing (APIPA)

Show answer & explanation

Answer: Border Gateway Protocol (BGP)

Answer

Border Gateway Protocol (BGP) is an Exterior Gateway Protocol (EGP) designed specifically to exchange prefix routing information between different Autonomous Systems across the internet.

Border Gateway Protocol (BGP) is the standardized Exterior Gateway Protocol (EGP) created to manage routing decisions and exchange reachability information between distinct Autonomous Systems across the global internet.

Step-by-Step Solution

Identify the scenario requirement

Routing must occur between two different organizations/ISPs operating in distinct Autonomous Systems (AS).

Routing protocols are classified as either Interior Gateway Protocols (IGP) for intra-domain routing or Exterior Gateway Protocols (EGP) for inter-domain routing.

Evaluate protocol categories

Border Gateway Protocol (BGP) is the primary Exterior Gateway Protocol used for routing between separate Autonomous Systems.

Protocols like OSPF and EIGRP operate inside a single AS, whereas BGP manages policy-based routing between different Autonomous Systems across the internet core.

Key Concept

Exterior Gateway Protocol (EGP) vs. Interior Gateway Protocol (IGP)

Question 595Question →

A network engineer is provisioning subnets from the assigned address block $10.150.48.0/22$ for a branch deployment. The primary VLAN requires capacity for up to $115$ IP phones. The engineer allocates the smallest valid CIDR subnet block that satisfies this requirement starting at $10.150.48.0$ . What is the broadcast address of the second subnet of the exact same prefix length immediately following the primary VLAN's subnet?

10.150.48.127

10.150.48.254

10.150.48.255

10.150.49.255

Show answer & explanation

Answer: $10.150.48.255$

Answer

The broadcast address of the second

/25

subnet is

10.150.48.255

The primary VLAN requires 115 hosts. Factoring in the network and broadcast addresses (

115 + 2 = 117

), the smallest accommodating block size is 128 addresses, which corresponds to a

/25

subnet mask. The first

/25

subnet occupies

10.150.48.0

10.150.48.127

. The second

/25

subnet occupies

10.150.48.128

10.150.48.255

. The last address in this second block (

10.150.48.255

) is its broadcast address.

Step-by-Step Solution

Determine the required IP address capacity.

115 IP phones require at least

115 + 2 = 117

total IP addresses (accounting for network and broadcast IDs).

Each subnet reserves the first IP address as the network ID and the last IP address as the broadcast ID.

Select the smallest matching CIDR prefix length.

The smallest power of 2 greater than or equal to 117 is

2^7 = 128

. A block size of 128 corresponds to a

/25

mask (

32 - 7 = 25

Using a

/25

subnet provides 126 usable host IP addresses, which satisfies the 115 host requirement without wasting space.

Calculate the IP range of the first subnet block.

Subnet 1 spans from

10.150.48.0

10.150.48.127

, with

10.150.48.127

as its broadcast address.

Adding 128 IP addresses starting at

10.150.48.0

covers

0

through

127

in the fourth octet.

Identify the IP range and broadcast address of the second subnet block.

Subnet 2 begins immediately after Subnet 1 at

10.150.48.128/25

and ends at

10.150.48.255

. The broadcast address is

10.150.48.255

The second block of 128 IP addresses spans

128

through

255

in the fourth octet.

Key Concept

Subnet Block Sizing and Broadcast Address Calculation

Question 596Question →

A network administrator is configuring internal perimeter firewall rules between two subnets. Hosts on Subnet A can successfully resolve domain names using the primary DNS server on Subnet B via standard queries. However, a secondary DNS server on Subnet A fails to perform complete zone database transfers (AXFR) from the primary server. Which transport protocol and destination port combination must be permitted on the firewall to allow secondary DNS zone transfers to succeed?

TCP port 53

UDP port 53

TCP port 853

UDP port 67

Show answer & explanation

Answer: TCP port 53

Answer

TCP port 53 must be permitted on the firewall to enable DNS zone replication between primary and secondary servers.

Standard client DNS queries rely on UDP port 53 for fast, lightweight name resolution. However, zone transfers (AXFR/IXFR) involve replicating entire DNS database records between servers, which demands the connection reliability, error checking, and data framing provided by TCP port 53.

Step-by-Step Solution

Differentiate between client DNS resolution and DNS zone transfers.

Client resolution requests use small Datagram PDU traffic, whereas zone transfers (AXFR) transmit complete resource record databases.

Small lookup requests fit within standard UDP packet size limits, while database sync requires guaranteed packet delivery.

Determine transport protocol requirements for bulk zone data.

Transmission Control Protocol (TCP) ensures in-order delivery and retransmission of lost packets during database replication.

Connectionless UDP cannot guarantee integrity for large, multi-packet zone file syncs.

Identify the required port and protocol pair.

DNS uses port 53 for both transport protocols; zone transfers specifically operate over TCP port 53.

Permitting TCP port 53 through the firewall resolves the secondary DNS server synchronization failure.

Key Concept

DNS Transport Protocol Selection (UDP 53 vs TCP 53)

Question 597Question →

A system engineer is configuring a network firewall rule to allow remote desktop management connections to a centralized Windows server host. Which of the following port and transport protocol combinations must be permitted through the firewall?

TCP port 3389

UDP port 3389

TCP port 22

TCP port 23

Show answer & explanation

Answer: TCP port 3389

Answer

TCP port 3389 is the default transport protocol and port used by Remote Desktop Protocol (RDP).

Remote Desktop Protocol (RDP) utilizes TCP port 3389 by default to establish connection-oriented graphical administration sessions to Windows systems.

Step-by-Step Solution

Identify the target network service required by the scenario

The scenario requires permitting Remote Desktop Protocol (RDP) traffic.

Firewall rules must correspond to the specific protocol and port assigned to remote desktop management.

Identify the default port number and transport layer protocol for RDP

RDP uses TCP port 3389 by default.

Standard network specifications assign TCP port 3389 for reliable graphical remote management.

Key Concept

Common Ports and Protocols - Remote Desktop Protocol (RDP)

Question 598Question →

A network administrator allocates the IPv4 network block $192.168.10.0/27$ to a remote branch office subnet. What is the maximum number of usable host IP addresses that can be assigned to host devices on this subnet?

30 usable host addresses

32 usable host addresses

62 usable host addresses

14 usable host addresses

Show answer & explanation

Answer: 30 usable host addresses

Answer

The maximum number of usable host IP addresses on a /27 subnet is 30.

A CIDR prefix of /27 leaves 5 bits for host addresses (

32 - 27 = 5

). Calculating

2^5

gives 32 total IP addresses in the subnet block. Subtracting 2 for the Network ID and Broadcast address (

32 - 2

) gives 30 usable host IP addresses.

Step-by-Step Solution

Calculate the number of available host bits from the CIDR prefix.

Host bits =

32 - 27 = 5

bits.

An IPv4 address consists of 32 total bits. Subtracting the 27 network bits yields the remaining host bits.

Calculate the total number of IP addresses in the block.

Total addresses =

2^5 = 32

addresses.

The total capacity of a subnet is equal to 2 raised to the power of the number of host bits.

Subtract the reserved network and broadcast addresses to determine assignable host IPs.

Usable addresses =

32 - 2 = 30

host addresses.

The first address serves as the Network ID and the final address serves as the Subnet Broadcast Address; neither can be assigned to individual host network interfaces.

Key Concept

Calculating usable host IP addresses using CIDR subnet notation

Estimated Time:45s

Question 599Question →

A network technician provisions an IEEE 802.1Q trunk link on switch `SW-Floor2` interface `GigabitEthernet0/48` to connect to `SW-Core1`. Workstations on VLAN 10 (Finance) immediately lose connectivity to remote resources on the same VLAN, while devices on VLAN 20 (IT) continue communicating normally. The running configuration for interface `GigabitEthernet0/48` displays the following output:

text
interface GigabitEthernet0/48
switchport mode trunk
switchport trunk native vlan 1
switchport trunk allowed vlan 20,30

Which of the following statements accurately identify the cause of the connectivity loss and specify the correct corrective action? (Select TWO.)

Select all that apply

VLAN 10 frames are dropped at the trunk port because VLAN 10 is omitted from the allowed VLAN pruning list on interface GigabitEthernet0/48.

VLAN 10 traffic is automatically forwarded untagged over the trunk link because unlisted VLANs default to native VLAN handling.

The administrator must execute `switchport trunk allowed vlan add 10` on interface GigabitEthernet0/48 to permit VLAN 10 traffic across the link.

A Layer 3 router must be installed between SW-Floor2 and SW-Core1 to route VLAN 10 frames across the switchport trunk interface.

Show answer & explanation

Answer: VLAN 10 frames are dropped at the trunk port because VLAN 10 is omitted from the allowed VLAN pruning list on interface GigabitEthernet0/48.; The administrator must execute `switchport trunk allowed vlan add 10` on interface GigabitEthernet0/48 to permit VLAN 10 traffic across the link.

Answer

The outage is caused by VLAN 10 being excluded from the trunk port's explicit allowed list. The issue is resolved by running `switchport trunk allowed vlan add 10` on the trunk interface.

On an 802.1Q trunk, configuring `switchport trunk allowed vlan` creates an explicit permit list. Because VLAN 10 was not listed, its frames were filtered at the trunk boundary. Executing `switchport trunk allowed vlan add 10` appends VLAN 10 to the allowed list, enabling frame transmission across switches for that broadcast domain.

Step-by-Step Solution

Analyze the trunk configuration snippet on interface GigabitEthernet0/48.

The line `switchport trunk allowed vlan 20,30` limits trunking strictly to VLANs 20 and 30.

VLAN 10 is omitted from the allowed list, which causes the switch port to prune and drop all ingress and egress 802.1Q frames belonging to VLAN 10.

Determine the CLI command required to modify the allowed list safely.

Applying `switchport trunk allowed vlan add 10` updates the allowed list to 10,20,30.

Using the `add` parameter prevents overwriting existing allowed VLANs, ensuring VLAN 20 and VLAN 30 remain operational while restoring VLAN 10.

Key Concept

802.1Q Trunk Allowed VLAN Filtering

Question 600Question →

A network engineer is configuring a point-to-point serial link between two routers and assigns the IPv4 subnet prefix $/30$ . What is the maximum number of usable host IPv4 addresses available on this subnet?

Show answer & explanation

Answer: 2

Answer

The maximum number of usable host IPv4 addresses on a

/30

subnet is 2.

/30

CIDR prefix leaves 2 bits for host addressing (

32 - 30 = 2

). Calculating total addresses yields

2^2 = 4

. Subtracting 2 for the unassignable network and broadcast addresses results in exactly 2 usable host IP addresses, making

/30

subnets standard for point-to-point links.

Step-by-Step Solution

Determine the number of host bits.

Host bits =

32 - 30 = 2

An IPv4 address consists of 32 bits. Subtracting the prefix length gives the remaining bits dedicated to host addressing.

Calculate the total number of IP addresses in the subnet.

Total IP addresses =

2^2 = 4

The total capacity of a subnet is

2^h

, where

h

is the number of host bits.

Calculate usable host addresses by subtracting reserved addresses.

Usable host addresses =

4 - 2 = 2

The first address is the network identifier and the last address is the broadcast address; neither can be assigned to host interfaces.

Key Concept

Calculating usable host count for a given CIDR prefix

PreviousPage 30 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept