Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 121Question →

A network administrator configures interface GigabitEthernet0/2 on switch SW-CORE-01 as an 802.1Q trunk with the following commands:

text
interface GigabitEthernet0/2
switchport mode trunk
switchport trunk native vlan 50
switchport trunk allowed vlan 10,20,30

Which of the following describes how switch SW-CORE-01 will handle an incoming untagged Ethernet frame received on interface GigabitEthernet0/2?

Show answer & explanation

Answer: The switch drops the incoming untagged frame because native VLAN 50 is not present in the trunk's allowed VLAN list.

Answer

The switch drops the incoming untagged frame because native VLAN 50 is not present in the trunk's allowed VLAN list.
On an IEEE 802.1Q trunk link, any untagged Ethernet frame received by a switchport is associated with the native VLAN configured on that port (in this case, VLAN 50). However, the `switchport trunk allowed vlan` command acts as a strict VLAN filter on both ingress and egress. Because VLAN 50 is omitted from the allowed VLAN list (`10,20,30`), the switch filters out VLAN 50 traffic, causing the incoming untagged frame to be dropped immediately.

Step-by-Step Solution

1
Identify how untagged frames are classified on an 802.1Q trunk.
The frame is mapped to the port's configured native VLAN, which is VLAN 50.
IEEE 802.1Q trunking assigns untagged incoming frames to the native VLAN designated on that switchport.
2
Evaluate the allowed VLAN list configured on the interface.
The allowed list is explicitly constrained to VLANs 10, 20, and 30.
The command `switchport trunk allowed vlan 10,20,30` restricts ingress and egress traffic on the trunk to only those specified VLANs.
3
Determine the switch processing decision for VLAN 50 traffic.
The frame is dropped at the ingress interface.
If the native VLAN is excluded from the allowed VLAN pruning list, ingress untagged frames assigned to that native VLAN cannot traverse the trunk and are discarded.

Key Concept

802.1Q Native VLAN Ingress Filtering & Allowed VLAN Interaction
Question 122Question →

A software developer and a network technician are configuring a bulk database migration utility across an enterprise link. The application establishes communication channels between two servers, maintains dialog control between the endpoints, and places synchronization checkpoints within the data stream so that interrupted file transfers can resume from the last saved state without starting over. Which layer of the OSI model is directly responsible for managing these dialog control and checkpoint synchronization functions?

Show answer & explanation

Answer: Session Layer

Answer

Session Layer
The Session Layer (Layer 5) of the OSI model is dedicated to establishing, maintaining, synchronizing, and terminating communication sessions between applications. Key duties include dialog control (determining half-duplex or full-duplex communication modes) and inserting checkpoints into data streams to facilitate recovery from communication failures.

Step-by-Step Solution

1
Analyze the core requirements in the scenario
Identified session management, dialog control, and checkpoint insertion as the key functional requirements.
The question asks to identify which OSI layer handles these specific services.
2
Map requirements to OSI layer responsibilities
Layer 5 (Session Layer) explicitly defines dialog control (managing which side transmits and when) and session synchronization (setting checkpoints for failure recovery).
Other layers handle syntax translation (Presentation), transport reliability (Transport), or packet routing (Network).

Key Concept

OSI Model Session Layer (Layer 5) Functions
Estimated Time:1m 0s
Question 123Question →

A network engineer is configuring a Layer 3 gateway router to forward broadcast DHCP discovery messages from client devices in VLAN 40 (192.168.40.0/24) to a centralized DHCP server located at 10.200.10.50. On which interface must the helper address command (`ip helper-address 10.200.10.50`) be applied for the router to intercept client broadcasts and forward them as unicast packets?

Show answer & explanation

Answer: The inbound Layer 3 interface (SVI or subinterface) serving as the default gateway for VLAN 40

Answer

The helper address must be configured on the inbound Layer 3 interface (SVI or subinterface) serving as the default gateway for VLAN 40.
DHCP client requests (DISCOVER and REQUEST) are sent as Layer 2 broadcast frames to the local default gateway. To relay these messages across router boundaries to a centralized server, the DHCP relay command (such as `ip helper-address`) must be placed directly on the client-facing Layer 3 interface (SVI or router subinterface). When configured here, the gateway intercepts the broadcast, inserts its own interface IP into the gateway IP address (giaddr) field, and unicasts the request to the central server.

Step-by-Step Solution

1
Identify the ingress gateway interface for client broadcast traffic
DHCP Discover packets originate on VLAN 40 as local Layer 2 broadcasts targeting UDP port 67.
Routers drop broadcast packets by default unless a relay agent is configured on the client-facing gateway interface.
2
Configure the DHCP relay agent on the client-facing Layer 3 interface
The router intercepts local DHCP broadcasts on VLAN 40 and encapsulates them into unicast IP packets addressed to 10.200.10.50.
The gateway interface injects its own IP address into the relay agent IP address (giaddr) field of the DHCP packet header so the DHCP server knows which scope to allocate from.

Key Concept

DHCP Relay Agent Interface Placement and Broadcast-to-Unicast Forwarding
Estimated Time:1m 30s
Question 124Question →

A network engineer is analyzing the convergence behavior of a core enterprise router running Open Shortest Path First (OSPF). An active link on an adjacent network interface suddenly fails, triggering a topology update across the area. Place the operational steps in the correct sequential order from initial failure detection to final packet forwarding updates.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for OSPF link-state convergence is: 1) Generate LSA upon failure detection, 2) Flood LSA to neighbors, 3) Update local LSDB with new information, 4) Run SPF algorithm on updated LSDB, and 5) Populate the IP routing table with recalculated optimal paths.
OSPF is a link-state routing protocol operating in distinct sequential phases during topology changes. When a link fails, the detecting router immediately originates a new Link-State Advertisement (LSA). This LSA is flooded out active interfaces to ensure area-wide synchronization. Upon receiving the LSA, neighboring routers insert it into their Link-State Database (LSDB). Once the LSDB reflects the true network state, each router executes Dijkstra's Shortest Path First (SPF) algorithm to calculate the new shortest path tree. Finally, the newly derived best paths are installed into the router's IP routing table for packet forwarding.

Step-by-Step Solution

1
Identify event detection and LSA origination
The local router detects physical/logical link failure and creates an updated LSA.
Routing convergence begins at the source router where the topology change occurs.
2
Identify LSA propagation
The originating router floods the LSA across the OSPF area using multicast.
Link-state protocols require all routers in an area to maintain identical database records.
3
Identify LSDB synchronization
Neighboring routers update their local LSDBs with the received LSA.
The database must reflect the updated network map before path selection can take place.
4
Identify path recalculation
Dijkstra's SPF algorithm computes shortest paths based on the new LSDB state.
SPF uses the synchronized topology map to find optimal cost paths to every destination subnet.
5
Identify Routing Information Base (RIB) modification
The router installs the newly derived shortest paths into the active IP routing table.
Packet forwarding decisions rely directly on the active routing table entries derived from SPF calculation.

Key Concept

OSPF Link-State Convergence and SPF Calculation Sequence
Estimated Time:2m 0s
Question 125Question →

A network administrator is reviewing IPv6 deployment standards and packet headers for an enterprise network redesign. Which of the following statements accurately describe valid IPv6 address representation rules or IPv6 header characteristics? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The double-colon shorthand (::) can be applied only once within an IPv6 address to compress consecutive zero fields.; The Hop Limit field in the IPv6 base header serves the same loop-prevention purpose as the Time to Live (TTL) field in IPv4.

Answer

The double-colon shorthand (::) can be applied only once within an IPv6 address to compress consecutive zero fields, and the Hop Limit field in the IPv6 base header serves the same loop-prevention purpose as the Time to Live (TTL) field in IPv4.
The statement specifying that the double-colon shorthand (::) can be used only once is correct because multiple instances prevent deterministic expansion of the 128-bit address. The statement noting that the Hop Limit field replaces the IPv4 Time to Live (TTL) field is also correct, as both fields serve to drop packets that exceed maximum hop counts to prevent routing loops.

Step-by-Step Solution

1
Analyze IPv6 address compression rules.
Confirm that RFC 5952 restricts double-colon (::) contiguous zero compression to a single occurrence per address to maintain deterministic 128-bit reconstruction.
If multiple double colons were permitted, a receiver could not calculate how many 16-bit zero blocks belong to each double colon.
2
Analyze IPv6 base header fields.
Identify that the Hop Limit field replaces IPv4's Time to Live (TTL) field, and the base header is fixed at 40 bytes with Extension Headers replacing variable IPv4 options.
A fixed header size improves routing processing efficiency by removing the need for a Header Length field.

Key Concept

IPv6 Address Compression Rules and Base Header Architecture
Question 126Question →

Match each IP addressing service or protocol component to its primary administrative function within network operations.

Click a left item, then click its matching right item

Items

IPAM (IP Address Management)
mDNS (Multicast DNS)
DHCP Option 82
NTP Stratum 1

Matches

Show answer & explanation

Answer

IPAM matches with centralized tracking of IP address spaces; mDNS matches with local name resolution without a dedicated DNS server; DHCP Option 82 matches with inserting circuit/remote ID metadata into request packets; NTP Stratum 1 matches with synchronizing system clocks directly from a reference atomic or GPS clock.
Each IP addressing service fulfills a distinct core infrastructure function: IPAM centralizes address governance, mDNS handles zero-configuration local name resolution, DHCP Option 82 injects physical location metadata into DHCP requests, and NTP Stratum 1 synchronizes directly to primary reference clocks.

Step-by-Step Solution

1
Identify the primary role of IPAM.
IPAM provides centralized management and monitoring of subnets, DNS records, and DHCP pools.
IPAM is designed for centralized visibility across network addressing services.
2
Identify the role of mDNS (Multicast DNS).
mDNS resolves hostnames locally using multicast without reliance on a unicast DNS infrastructure.
mDNS facilitates zero-configuration local service discovery.
3
Analyze the function of DHCP Option 82.
DHCP Option 82 adds relay agent information, such as physical port and switch ID, to DHCP request packets.
This allows administrators to apply policy based on the requester's physical network point of connection.
4
Determine the accuracy specification for NTP Stratum levels.
Stratum 1 NTP servers attach directly to Stratum 0 physical time sources (GPS, Cesium clocks).
Stratum numbering defines hierarchy and proximity to authoritative time sources.

Key Concept

Core IP addressing services (IPAM, mDNS, DHCP Relay Options, NTP) provide essential support for dynamic allocation, resolution, security context, and time synchronization across network topologies.
Question 127Question →

A network administrator is configuring an IEEE 802.1Q trunk link between two switches in an enterprise building. Which of the following statements correctly describe the standard operational behavior of 802.1Q trunking and native VLANs on this interconnect? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: 802.1Q trunking inserts a 4-byte tag into the Ethernet frame header to identify traffic belonging to non-native VLANs.; Untagged Ethernet frames received on an 802.1Q trunk port are implicitly assigned to the native VLAN configured on that port.

Answer

802.1Q trunking inserts a 4-byte tag into non-native VLAN Ethernet headers, and untagged frames arriving on a trunk port are implicitly assigned to the configured native VLAN.
IEEE 802.1Q defines trunking behavior by tagging frames with a 4-byte header for non-native VLANs while sending native VLAN frames without tags, allowing the receiving switch port to map untagged ingress frames to its local native VLAN.

Step-by-Step Solution

1
Analyze frame tagging mechanisms under IEEE 802.1Q.
IEEE 802.1Q adds a 4-byte field containing Tag Protocol Identifier (TPID) and Tag Control Information (TCI) to preserve VLAN identity across trunk links for non-native VLANs.
This tag allows switches on both ends of the trunk link to multiplex multiple VLANs over a single physical link.
2
Analyze native VLAN default processing behavior.
Native VLAN frames travel across the trunk link untagged. The receiving trunk port automatically assigns untagged frames to its configured native VLAN.
This behavior maintains backward compatibility with non-VLAN-aware legacy equipment.
3
Evaluate distractor claims against Layer 2 isolation and native VLAN mismatch symptoms.
VLANs strictly isolate Layer 2 broadcast domains, requiring a Layer 3 router for inter-VLAN forwarding. Furthermore, native VLAN mismatches cause traffic leakage into the mismatched VLAN rather than dropping tagged traffic.
Correctly identifying Layer 2 boundaries and trunk mismatch behaviors confirms the valid options.

Key Concept

802.1Q Frame Tagging and Native VLAN Processing
Question 128Question →

Match each VLAN configuration concept or 802.1Q trunking parameter on the left with its corresponding operational behavior or frame-handling mechanism on the right.

Click a left item, then click its matching right item

Items

Native VLAN Configuration
802.1Q Header Tagging
Trunk Allowed VLAN List
Voice VLAN Feature

Matches

Show answer & explanation

Answer

Native VLAN Configuration corresponds to designating the VLAN context used for untagged traffic. 802.1Q Header Tagging corresponds to inserting a 4-byte field containing a 12-bit VLAN Identifier (VID). Trunk Allowed VLAN List corresponds to restricting traffic forwarding exclusively to explicitly permitted VLAN IDs. Voice VLAN Feature corresponds to allowing an interface to carry tagged VoIP traffic while maintaining untagged data traffic.
Each trunking concept is correctly matched to its defined network behavior: Native VLAN manages untagged trunk traffic, 802.1Q header tagging adds the 4-byte frame modifier with 12-bit VID, the trunk allowed list filters permitted VLAN IDs across links, and Voice VLAN enables dual tagged/untagged traffic handling on access ports.

Step-by-Step Solution

1
Analyze Native VLAN functionality on 802.1Q trunks
Identified that native VLAN handles untagged frame transmission across trunks.
By default in 802.1Q, frames belonging to the native VLAN are sent across trunk links without adding an 802.1Q header tag.
2
Analyze 802.1Q tagging structure
Identified the 4-byte insertion containing the 12-bit VID.
IEEE 802.1Q modifies the Ethernet frame by inserting a 4-byte tag field between the Source MAC Address and EtherType fields.
3
Analyze allowed VLAN list configuration
Identified trunk filtering behavior based on permitted VLAN IDs.
By default, trunks permit VLANs 1-4094; configuring an allowed list explicitly restricts which VLAN broadcast domains extend across the link.
4
Analyze Voice VLAN operational model
Identified dual-VLAN behavior on access ports supporting IP phones.
Voice VLAN allows single physical access ports to separate real-time tagged voice traffic from untagged desktop data traffic.

Key Concept

802.1Q Trunking Protocols and Port Characteristics
Question 129Question →

An enterprise network engineer is troubleshooting an issue where hosts on a private subnet (10.10.0.0/2410.10.0.0/24) experience intermittent outbound connection failures when accessing external cloud resources. The perimeter firewall is configured to perform Port Address Translation (PAT) using a single public IP address (203.0.113.5203.0.113.5). Diagnostic logs indicate that while active web sessions function normally, new outbound TCP connections fail during peak traffic periods because all available high-numbered ephemeral source ports on the gateway's public address are fully allocated. Which configuration change should the engineer implement on the firewall to resolve this session scaling issue while preserving private internal IP addressing?

Show answer & explanation

Answer: Configure a PAT address pool containing multiple public IP addresses to expand the available Layer 4 source port capacity.

Answer

Configure a PAT address pool containing multiple public IP addresses to expand the available Layer 4 source port capacity.
Port Address Translation (PAT) enables multiple private IP addresses to share public IP space by overloading unique Layer 4 source port numbers. When high connection volume exhausts all available ephemeral ports on a single public IP address, introducing a pool of public IP addresses allows PAT to dynamically distribute outbound sessions across multiple public IPs, successfully multiplying session capacity.

Step-by-Step Solution

1
Analyze the diagnostic log output to identify the root cause of connection failures.
The firewall is experiencing PAT port exhaustion (all ~64,512 high-numbered ephemeral source ports on public IP 203.0.113.5 are in use).
PAT tracks concurrent sessions by pairing private sockets (IP + source port) with public sockets (Public IP + assigned public source port).
2
Select a translation design strategy that expands translation capacity while maintaining private internal IP addressing.
Configuring an IP address pool for PAT allows the NAT device to allocate source ports across multiple public IP addresses (overload pool).
Each additional public IP added to the PAT pool increases total concurrent connection capacity by approximately 65,000 port mappings.

Key Concept

PAT Port Exhaustion & IP Pool Expansion
Question 130Question →

An enterprise network administrator is auditing an organization's authoritative external DNS server configuration following a security compliance review. The audit requires configuring zone replication securely, ensuring proper transport protocol handling for large DNSSEC-signed payloads, and maintaining compliant email sender verification. During diagnostic testing, the administrator executes the following `dig` commands against the primary authoritative name server:

text
$ dig @ns1.example.com example.com AXFR
;; communications error to 192.0.2.10#53: end of file

$ dig @ns1.example.com example.com +dnssec +bufsize=4096
;; Truncation flag (TC) set; retrying over TCP...
;; Query time: 14 msec
;; SERVER: 192.0.2.10#53(192.0.2.10) (TCP)
;; MSG SIZE rcvd: 2840

Based on the diagnostic output and DNS architectural standards, which TWO of the following statements correctly identify the underlying transport requirements and resource record implementations for this environment?

Select all that apply

Show answer & explanation

Answer: Full zone transfers (AXFR) and DNS queries whose responses exceed payload size limits require open TCP port 53 communications through firewalls between involved name servers and clients.; Sender Policy Framework (SPF) records must be published as standard TXT records, as the dedicated SPF record type (Type 99) was deprecated by RFC 7208.

Answer

The two correct statements are: 1) Full zone transfers (AXFR) and DNS responses exceeding payload size limits require open TCP port 53 communications through firewalls, and 2) Sender Policy Framework (SPF) records must be published as standard TXT records due to the deprecation of the dedicated SPF record type.
The correct options accurately state DNS transport requirements and resource record standards. First, DNS uses TCP port 53 both for authoritative zone transfers (AXFR/IXFR) and as a fallback mechanism whenever a response exceeds payload size thresholds (indicated by the TC bit). Second, Sender Policy Framework (SPF) data must be configured within TXT resource records, as the standalone SPF record type (type 99) was officially deprecated.

Step-by-Step Solution

1
Analyze the transport protocol behavior shown in the dig command outputs.
The first dig output demonstrates an attempted AXFR (zone transfer). Zone transfers depend on TCP port 53 to guarantee reliable transmission of the complete zone file. The second dig output highlights the Truncation flag (TC) being set on a large DNSSEC payload, prompting an automatic fallback from UDP to TCP port 53.
Understanding when DNS transitions from UDP to TCP is critical for firewall rule configuration and troubleshooting DNSSEC/zone replication.
2
Evaluate record type specifications for email security standards (SPF and MX).
Sender Policy Framework (SPF) legacy RR type 99 was deprecated under RFC 7208; SPF policies must now reside within standard TXT records. Additionally, MX records must point strictly to canonical host address records (A/AAAA) rather than CNAME aliases.
Proper record creation ensures compliant mail flow and validation without breaking RFC standards.

Key Concept

DNS Transport Protocols (UDP vs TCP 53), Zone Transfers (AXFR/IXFR), and Resource Record Specifications (TXT/SPF, MX, CNAME)
Question 131Question →

A network technician needs to configure a router so that multiple workstations on an internal private network can access external web resources simultaneously using a single public IP address assigned by the ISP. Which address translation technology accomplishes this by assigning unique Layer 4 port numbers to each session?

Show answer & explanation

Answer: Port Address Translation (PAT)

Answer

Port Address Translation (PAT)
Port Address Translation (PAT), often referred to as NAT Overload, enables multiple hosts on a private network to share a single public IP address simultaneously by translating both the IP address and Layer 4 port numbers for outbound connections.

Step-by-Step Solution

1
Analyze the operational requirement
Multiple internal workstations with private addresses need internet access sharing one public IP address.
The ISP has supplied only a single public IP address for all outbound host connections.
2
Identify the tracking mechanism used at Layer 4
Unique source port numbers are combined with the single public IP address.
Translating Layer 4 port numbers allows the router to keep track of individual host sessions on a single IP address.
3
Select the correct NAT implementation
Port Address Translation (PAT) / NAT Overload is selected.
PAT specifically translates private IP addresses and source port numbers to a shared public IP address.

Key Concept

Port Address Translation (PAT) / NAT Overload
Estimated Time:45s
Question 132Question →

Match each authentication and access control protocol with its corresponding transport and security characteristics.

Click a left item, then click its matching right item

Items

RADIUS
TACACS+
Kerberos
802.1X

Matches

Show answer & explanation

Answer

RADIUS pairs with UDP transport and password-only encryption; TACACS+ pairs with TCP port 49 and full payload encryption; Kerberos pairs with port 88 and time-stamped ticketing; 802.1X pairs with EAPOL port-based framework encapsulation.
Each protocol maps directly to its specific network characteristics: RADIUS relies on UDP with password-only encryption; TACACS+ uses TCP port 49 with full payload encryption; Kerberos relies on time-stamped ticket granting over port 88; and 802.1X provides Layer 2 port-based access control via EAPOL encapsulation.

Step-by-Step Solution

1
Analyze transport and payload encryption features of RADIUS.
RADIUS operates on UDP ports 1812/1813 and encrypts only the password field within packets.
RADIUS was designed as a lightweight client/server network access protocol that combines authentication and authorization.
2
Analyze TACACS+ specifications.
TACACS+ operates over TCP port 49, encrypts the full payload, and separates AAA functions for granular command accounting and authorization.
TACACS+ provides high security for administrative access to network infrastructure.
3
Identify ticket-based single sign-on protocol characteristics.
Kerberos utilizes TCP/UDP port 88 and relies on Key Distribution Center (KDC) ticket granting and timestamp validation.
Kerberos avoids sending secrets over the network by issuing cryptographically signed tickets.
4
Identify port-based access control framework characteristics.
802.1X encapsulates Extensible Authentication Protocol over LAN (EAPOL) to authenticate endpoints at Layer 2.
802.1X regulates physical or wireless port connectivity before network privileges are granted.

Key Concept

AAA Framework Protocol and Transport Matrix Characteristics
Question 133Question →

An engineer is troubleshooting a newly configured IEEE 802.1Q trunk link on interface `GigabitEthernet 0/2` connecting two switches, `SW-DIST-01` and `SW-ACCESS-01`. Users connected to VLAN 50 report a total loss of inter-switch connectivity, whereas users on VLAN 10 and VLAN 20 experience normal operations across the trunk. The interface configuration on `SW-DIST-01` is shown below:

text
interface GigabitEthernet0/2
switchport mode trunk
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,99

Which configuration command should the engineer execute on `SW-DIST-01` to restore inter-switch connectivity for VLAN 50?

Show answer & explanation

Answer: switchport trunk allowed vlan add 50

Answer

Execute `switchport trunk allowed vlan add 50` on interface `GigabitEthernet 0/2` to permit VLAN 50 traffic while preserving existing trunked VLANs.
The command `switchport trunk allowed vlan add 50` appends VLAN 50 to the active trunk filter list. Because the current interface explicitly restricts allowed VLANs to 10, 20, and 99, VLAN 50 traffic is dropped until it is explicitly appended to the permitted list.

Step-by-Step Solution

1
Analyze the existing running configuration snippet
The `switchport trunk allowed vlan 10,20,99` line restricts frame transmission across the trunk to only VLANs 10, 20, and 99.
By default, an 802.1Q trunk allows all VLANs (1-4094) unless an allowed VLAN list filter is configured.
2
Identify the cause of traffic dropping for VLAN 50
Frames tagged with VLAN ID 50 arriving at or departing from interface `GigabitEthernet 0/2` are filtered and discarded due to missing authorization in the allowed list.
VLAN 50 is omitted from the current allowed VLAN list.
3
Determine the appropriate CLI syntax modification
Using `switchport trunk allowed vlan add 50` appends VLAN 50 to the existing list (10,20,50,99).
Omitting the `add` keyword would overwrite the entire allowed list and cause outages for VLANs 10 and 20.

Key Concept

802.1Q Trunk Allowed VLAN Filtering
Estimated Time:1m 30s
Question 134Question →

Match each remote access or out-of-band management technology on the left with the enterprise scenario on the right for which it is the most appropriate management solution.

Click a left item, then click its matching right item

Items

Cellular Out-of-Band (OOB) Modem connected to a Terminal Server
IP-KVM Switch with Virtual Media capabilities
Baseboard Management Controller (BMC) via IPMI / lights-out management
Switched Smart Power Distribution Unit (PDU)
In-Band SSH over IPsec Remote Access VPN

Matches

Show answer & explanation

Answer

The technology items correctly align with their deployment scenarios based on whether access relies on the production network path (in-band) or dedicated non-production hardware paths (out-of-band serial, power, or lights-out management interfaces).
Each management technology addresses specific operational conditions: Cellular OOB modems with terminal servers restore console access during primary link loss; IP-KVM switches enable keyboard/video/mouse control and remote ISO mounting without an OS; IPMI/BMC provides low-level system health metrics directly from the motherboard micro-controller; switched PDUs enable remote AC outlet power cycling when device control planes lock up; and SSH over IPsec VPN provides secure, encrypted in-band CLI access over operational networks.

Step-by-Step Solution

1
Analyze primary network availability constraints for each scenario.
Identified scenarios requiring alternative network access (WAN outage requiring cellular OOB) versus production network access (routine maintenance requiring SSH over VPN).
Out-of-band solutions bypass primary network infrastructure failures.
2
Evaluate hardware control level requirements.
Differentiated between OS-level installation needs (IP-KVM virtual media), motherboard/sensor hardware access (IPMI/BMC), and physical AC power cycle needs (Smart PDU).
Different failure states require intervention at distinct layers of the hardware stack.
3
Pair each management method to its optimal operational requirement.
Matched cellular terminal server to WAN outage console access, IP-KVM to OS mounting, IPMI to thermal/power diagnostics, Smart PDU to switch hard resets, and SSH/VPN to routine in-band administrative tasks.
Ensures minimal downtime and secure, targeted remote administrative access.

Key Concept

Remote Access and Out-of-Band Management Methods
Question 135Question →

A network engineer connects two enterprise switches, `SW-BuildingA` and `SW-BuildingB`, over interface `GigabitEthernet0/12`. The switchport configurations are as follows:

SW-BuildingA (Gi0/12):
text
switchport mode trunk
switchport trunk native vlan 50
switchport trunk allowed vlan 10,20,50

SW-BuildingB (Gi0/12):
text
switchport mode trunk
switchport trunk native vlan 10
switchport trunk allowed vlan 10,20,30

A host connected to an access port in VLAN 50 on `SW-BuildingA` transmits an untagged broadcast frame destined for its local subnet. Which of the following best describes the processing and flow of this frame as it travels to `SW-BuildingB`?

Show answer & explanation

Answer: SW-BuildingA transmits the frame untagged across the trunk link; SW-BuildingB receives it untagged, classifies it into VLAN 10, and forwards it to VLAN 10 ports.

Answer

SW-BuildingA transmits the frame untagged across the trunk link; SW-BuildingB receives it untagged, classifies it into VLAN 10, and forwards it to VLAN 10 ports.
Under IEEE 802.1Q trunking specifications, frames belonging to the trunk's configured native VLAN are egressed without a VLAN tag header. SW-BuildingA has native VLAN 50 configured, so it transmits the VLAN 50 broadcast frame untagged. Upon receiving an untagged frame on trunk port Gi0/12, SW-BuildingB associates the frame with its own local native VLAN configuration (VLAN 10). Because VLAN 10 is in SW-BuildingB's allowed VLAN list, the frame is accepted and forwarded into VLAN 10, resulting in cross-VLAN traffic leakage.

Step-by-Step Solution

1
Analyze frame egress at SW-BuildingA
The originating host sends an untagged broadcast frame in VLAN 50. Port Gi0/12 on SW-BuildingA has native VLAN set to 50. Under standard IEEE 802.1Q trunking, traffic belonging to the native VLAN is egressed without an 802.1Q VLAN header (untagged).
802.1Q trunking rules dictate that frames matching the interface's native VLAN are sent untagged across the link.
2
Analyze frame ingress at SW-BuildingB
The untagged frame travels across the physical link and arrives at SW-BuildingB interface Gi0/12.
No tag was added by SW-BuildingA during egress.
3
Determine ingress VLAN assignment on SW-BuildingB
SW-BuildingB inspects the incoming frame, sees no 802.1Q tag, and maps the untagged frame to its own configured native VLAN for interface Gi0/12, which is VLAN 10.
When an 802.1Q trunk port receives an untagged frame, it automatically assigns that frame to its local native VLAN.
4
Verify VLAN allowed list processing
VLAN 10 is listed in SW-BuildingB's allowed list (`allowed vlan 10,20,30`), so SW-BuildingB processes the frame and floods it to all active access ports in VLAN 10.
Because VLAN 10 is allowed on SW-BuildingB's trunk, the frame is accepted and forwarded into VLAN 10, leaking traffic between VLAN 50 (Building A) and VLAN 10 (Building B).

Key Concept

IEEE 802.1Q Native VLAN Tagging Behavior and Native VLAN Mismatch Security Risks
Estimated Time:2m 0s
Question 136Question →

An enterprise border router maintains multiple dynamic routing protocols alongside static routes to reach remote subnets. When an incoming IPv4 packet arrives at an ingress interface, the router's decision process evaluates several criteria to select the winning route entry. In what sequential order does the router evaluate these routing criteria to select the path for packet forwarding?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of route selection evaluation is: 1) Filter for matching candidate routes, 2) Apply Longest Prefix Match, 3) Compare Administrative Distance for equal-length prefixes, and 4) Compare protocol metric values for ties within the same protocol.
Router decision engines process route selection in a strict hierarchy: First, candidate routes matching the destination IP are gathered. Next, Longest Prefix Match (LPM) selects the route with the most specific prefix length. If candidate routes have identical prefix lengths from different routing sources, Administrative Distance (AD) determines trustworthiness. Finally, if routes have equal prefix lengths and originate from the same routing protocol, the protocol's internal metric determines the best path.

Step-by-Step Solution

1
Identify matching destinations
Candidate routes matching the destination IP address are identified.
Routing decisions begin by checking which routing table entries match the target IP address.
2
Apply Longest Prefix Match (LPM)
The route with the longest subnet mask is prioritized.
LPM is the primary rule of IP routing; a more specific route (/28) always wins over a less specific route (/24).
3
Evaluate Administrative Distance (AD)
The route from the most trustworthy source is chosen if prefix lengths match.
If equal prefix lengths exist from different sources (e.g., OSPF AD 110 vs EIGRP AD 90), the lower AD wins.
4
Evaluate Protocol Metric
The path with the lowest metric cost is chosen if sources and prefix lengths are identical.
When competing routes come from the same protocol with the same prefix length, metric serves as the final tiebreaker.

Key Concept

Routing Table Selection Hierarchy (Longest Prefix Match -> Administrative Distance -> Metric)
Question 137Question →

A network administrator is assigning subnets for small remote branch offices. Each office requires an IPv4 subnet that can support at least 3030 usable host IP addresses. What is the minimum CIDR prefix length (enter the integer prefix number, such as 24 for a /24/24 subnet) that satisfies this requirement?

Show answer & explanation

Answer: 27

Answer

The minimum CIDR prefix length required to support 30 usable hosts is 27.
To host 30 usable devices, a subnet must provide at least 32 total IP addresses (3030 usable +2+ 2 reserved for network and broadcast). Using the formula 2h≥322^h \ge 32, we find h=5h = 5 host bits are needed. Subtracting 55 host bits from the total 3232 bits in an IPv4 address yields a prefix length of 2727 (a /27/27 subnet).

Step-by-Step Solution

1
Calculate the total number of IP addresses required per subnet including overhead.
30 usable hosts+1 network ID+1 broadcast ID=32 total IP addresses30\text{ usable hosts} + 1\text{ network ID} + 1\text{ broadcast ID} = 32\text{ total IP addresses}.
Every IPv4 subnet requires two reserved IP addresses: one for the network ID and one for the broadcast address.
2
Determine the required host bits (hh).
2h=32  ⟹  h=52^h = 32 \implies h = 5 host bits.
Five host bits provide 25=322^5 = 32 total IP addresses.
3
Calculate the prefix length by subtracting host bits from the total bits in an IPv4 address.
32−5=2732 - 5 = 27.
The prefix length represents the network portion of the address, calculated as 32−h32 - h.

Key Concept

Calculating CIDR Subnet Prefix Length for Host Requirements
Question 138Question →

A network engineer is provisioning an IP subnet for a server pool that requires static assignment for exactly 255255 usable host IP addresses. Which Classless Inter-Domain Routing (CIDR) prefix represents the most space-efficient subnet mask that accommodates all required host addresses?

Show answer & explanation

Answer: /23

Answer

The prefix /23 is the most space-efficient CIDR mask.
To determine the required CIDR prefix, calculate the number of host bits nn such that 2n−2≥2552^n - 2 \ge 255. With 8 host bits (/24 prefix), the usable host capacity is 28−2=2542^8 - 2 = 254, which falls short by 1 host address. Therefore, 9 host bits are required (32−9=/2332 - 9 = /23), providing 29−2=5102^9 - 2 = 510 usable host IP addresses. This is the smallest prefix length (most space-efficient) that satisfies the requirement.

Step-by-Step Solution

1
Determine the required host count formula.
Usable hosts per subnet = 2n−22^n - 2, where nn is the number of host bits.
Two IP addresses in every IPv4 subnet are reserved for the network ID and broadcast address.
2
Evaluate the capacity of a /24 subnet mask.
For /24, host bits n=32−24=8n = 32 - 24 = 8. Usable hosts = 28−2=256−2=2542^8 - 2 = 256 - 2 = 254.
Since 254 usable hosts is less than the required 255, a /24 prefix is insufficient.
3
Evaluate the capacity of a /23 subnet mask.
For /23, host bits n=32−23=9n = 32 - 23 = 9. Usable hosts = 29−2=512−2=5102^9 - 2 = 512 - 2 = 510.
Since 510 usable hosts is greater than or equal to 255, a /23 prefix fulfills the requirement with minimal wasted address space.

Key Concept

IPv4 CIDR Subnetting and Usable Host Calculation
Estimated Time:1m 15s
Question 139Question →

A network security administrator is configuring egress filtering rules on a perimeter firewall for a multi-tenant application server. The server must authenticate external network access requests using centralized RADIUS authentication services and transmit secure transactional alert messages via encrypted email submission using STARTTLS. Which TWO of the following transport protocol and port combinations must be permitted outbound on the firewall to meet these operational requirements?

Select all that apply

Show answer & explanation

Answer: UDP port 1812; TCP port 587

Answer

The firewall rules must permit UDP port 1812 for RADIUS authentication and TCP port 587 for secure SMTP submission via STARTTLS.
The requirement for centralized RADIUS authentication requires opening UDP port 1812 outbound, as RADIUS uses UDP for authentication datagrams. The requirement for encrypted email submission via STARTTLS requires opening TCP port 587, which is the standardized port for client-to-server mail submission with TLS encryption.

Step-by-Step Solution

1
Identify the standard protocol and transport layer requirements for RADIUS AAA authentication.
RADIUS authentication uses UDP as its transport protocol on standard port 1812 (with accounting on UDP port 1813).
RADIUS relies on connectionless UDP transport for low-overhead authentication datagram exchange.
2
Identify the standard protocol and transport layer requirements for secure email submission.
Encrypted client-to-server mail submission using STARTTLS standardizes on TCP port 587.
TCP port 587 is designated for mail user agents submitting mail to a mail transfer agent with opportunistic TLS security.
3
Evaluate the incorrect options against protocol specifications.
TCP port 1812 misidentifies RADIUS as connection-oriented TCP, while TCP port 25 refers to unencrypted legacy server-to-server SMTP relay.
Matching transport protocol types (TCP vs UDP) and specific service ports is required for precise firewall ACL definition.

Key Concept

Standard default port numbers and transport layer protocols for RADIUS authentication and secure SMTP mail submission
Estimated Time:2m 0s
Question 140Question →

A network security analyst is monitoring how a workstation handles an incoming encrypted session response starting from raw physical signal reception up to payload presentation. Place the following decapsulation actions in the correct sequential order, from the initial action occurring at the lowest OSI layer to the final action occurring at the higher OSI layer.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of decapsulation processing from the lowest to highest OSI layer is: 1) Converting physical voltage signals on the media into a raw bitstream (Layer 1), 2) Verifying the target MAC address and validating the Frame Check Sequence (Layer 2), 3) Inspecting the destination IP address and evaluating header checksums (Layer 3), 4) Reassembling segment sequence numbers and mapping target port numbers to an active socket (Layer 4), and 5) Decrypting TLS payloads and formatting character encodings (Layer 6).
During decapsulation of an incoming transmission, data flows upward through the OSI model: Layer 1 (Physical) handles bit signal conversion; Layer 2 (Data Link) processes MAC addresses and checks the Frame Check Sequence; Layer 3 (Network) inspects logical IP addressing; Layer 4 (Transport) handles segment sequence numbers and port sockets; and Layer 6 (Presentation) decrypts TLS payloads and formats character syntax.

Step-by-Step Solution

1
Identify the OSI layer responsible for signal conversion and bit synchronization
Converting physical signals into raw binary bitstreams occurs at Layer 1 (Physical Layer). This must happen first upon signal reception.
Physical media signals must be synchronized into bits before any protocol data unit headers can be parsed.
2
Identify the OSI layer responsible for MAC addressing and CRC error detection
Verifying destination MAC addresses and checking the Frame Check Sequence (FCS) occurs at Layer 2 (Data Link Layer).
Frame headers encapsulate packet headers and are stripped at Layer 2 after error validation.
3
Identify the OSI layer responsible for IP address inspection and packet routing
Processing destination IP addresses and IP checksums occurs at Layer 3 (Network Layer).
Once the Ethernet frame header is stripped, the host inspects the underlying IP packet header.
4
Identify the OSI layer responsible for port numbers, TCP sequencing, and socket mapping
Reassembling segment numbers and assigning traffic to target application ports occurs at Layer 4 (Transport Layer).
Transport protocols (TCP/UDP) manage segment reassembly and process communication endpoints (ports).
5
Identify the OSI layer responsible for TLS decryption and character set formatting
Decrypting TLS payloads and formatting character syntax occurs at Layer 6 (Presentation Layer).
The Presentation Layer handles data formatting, syntax translation, and cryptographic operations before handing data to the application.

Key Concept

OSI Model Decapsulation Order and Layer Functions
PreviousPage 7 / 112Next
All practice questions — CompTIA Network+ | Examkin