Network Implementation

424 questions

Question 241Question

A network engineer is configuring a static host entry on a datacenter firewall for a server deployed on the IPv6 subnet 2001:db8:cafe:10::/642001:\text{db8}:\text{cafe}:10::/64. The server interface uses the MAC address 00:50:56:A1:B2:C300:50:56:\text{A1}:\text{B2}:\text{C3} and generates its host portion automatically via the IEEE EUI-64 mechanism. Which of the following represents the fully compliant RFC 5952 IPv6 global unicast address for this server?

Show answer & explanation

Answer: 2001:db8:cafe:10:250:56ff:fea1:b2c3

Answer

The correct IPv6 address is 2001:db8:cafe:10:250:56ff:fea1:b2c3.
To construct an EUI-64 IPv6 interface identifier from a MAC address (00:50:56:A1:B2:C3), insert FF:FE into the middle (00:50:56:FF:FE:A1:B2:C3) and invert the 7th bit of the first byte (0x00 becomes 0x02). Grouping into 16-bit hextets yields 0250:56ff:fea1:b2c3. Appending this to the subnet prefix 2001:db8:cafe:10::/64 gives 2001:0db8:cafe:0010:0250:56ff:fea1:b2c3. Applying RFC 5952 rules suppresses leading zeros in each hextet (0db8 -> db8, 0010 -> 10, 0250 -> 250), producing 2001:db8:cafe:10:250:56ff:fea1:b2c3.

Step-by-Step Solution

1
Split the MAC address into two 24-bit halves and insert the hex value FF:FE in the middle.
The MAC address 00:50:56:A1:B2:C3 becomes 00:50:56:FF:FE:A1:B2:C3.
EUI-64 requires expanding a 48-bit MAC address into a 64-bit interface identifier by inserting 16 specific bits (FF:FE).
2
Invert the 7th bit (Universal/Local bit) of the first byte.
The first byte 0x00 (binary 00000000) becomes 0x02 (binary 00000010). The expanded address becomes 0250:56ff:fea1:b2c3.
IEEE EUI-64 specifies that the Universal/Local bit must be inverted (0 for universally administered MAC addresses changed to 1 for local scope representation).
3
Combine the network prefix 2001:db8:cafe:10::/64 with the calculated 64-bit interface ID.
Uncompressed full address: 2001:0db8:cafe:0010:0250:56ff:fea1:b2c3.
The first 64 bits represent the network prefix and subnet, and the last 64 bits represent the host interface identifier.
4
Apply RFC 5952 address compression rules.
2001:db8:cafe:10:250:56ff:fea1:b2c3.
Leading zeros in each hextet must be suppressed (0db8 -> db8, 0010 -> 10, 0250 -> 250). The double colon (::) is not used when no hextet consists entirely of zeros.

Key Concept

EUI-64 Interface Identifier Generation and RFC 5952 Address Compression
Estimated Time:2m 0s
Question 242Question

A network administrator is publishing DNS records for a newly deployed corporate service. The domain requires web clients to resolve `www.example.com` to the IPv4 address `192.0.2.50`, and incoming domain email must be routed to `mail.example.com`.

Which TWO of the following DNS resource record types must be configured to achieve this functionality?

Select all that apply

Show answer & explanation

Answer: An A record pointing www.example.com to 192.0.2.50; An MX record specifying mail.example.com as the mail exchanger

Answer

The configuration requires an A record to map the website hostname to its IPv4 address and an MX record to specify the mail gateway handling domain email.
An Address (A) record is required to map the web server hostname to its 32-bit IPv4 address. A Mail Exchanger (MX) record is required to specify the mail server responsible for accepting incoming email on behalf of the domain.

Step-by-Step Solution

1
Identify the IPv4 address mapping requirement for the web server hostname.
Recognize that mapping a hostname (`www.example.com`) to a 32-bit IPv4 address (`192.0.2.50`) requires an Address (A) record.
Standard forward IPv4 resolution in DNS uses A records.
2
Identify the email routing requirement for the domain.
Recognize that designating a mail server (`mail.example.com`) to receive email for the domain requires a Mail Exchanger (MX) record.
Simple Mail Transfer Protocol (SMTP) servers query MX records to determine destination mail handlers.

Key Concept

DNS Host (A) and Mail Exchanger (MX) Record Functions
Estimated Time:1m 0s
Question 243Question

A network administrator is evaluating dynamic routing protocol behaviors for a campus network infrastructure. Which of the following operational features specifically characterize Open Shortest Path First (OSPF) as a link-state routing protocol? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: It constructs a complete topological database of the network area by flooding Link-State Advertisements (LSAs).; It executes Dijkstra's Shortest Path First (SPF) algorithm to calculate the shortest path tree to destination networks.

Answer

The correct characteristics of OSPF as a link-state routing protocol are constructing a complete topological database via Link-State Advertisements (LSAs) and executing Dijkstra's Shortest Path First (SPF) algorithm to determine optimal paths.
The correct options accurately describe how link-state routing protocols function. OSPF routers flood Link-State Advertisements (LSAs) to build a synchronized topological map (LSDB) of the area, and each router independently runs Dijkstra's Shortest Path First (SPF) algorithm on this map to identify the shortest path to each destination network.

Step-by-Step Solution

1
Identify the fundamental mechanics of link-state routing protocols.
Link-state protocols require routers to advertise the state of their directly connected links to all routers within an area.
Flooding LSAs enables every router in the area to maintain an identical Link-State Database (LSDB).
2
Determine how link-state protocols compute optimal routes from the topology map.
Each router independently runs Dijkstra's SPF algorithm using the LSDB as the topology map.
This builds a shortest-path tree rooted at the local router to compute loop-free routes to every network prefix.
3
Evaluate and discard distractor statements that misattribute OSI layer operations or NAT mechanisms.
Discard the statements regarding Layer 2 frame encapsulation and IP address/port translation.
OSPF relies on IP Layer 3 encapsulation (protocol 89), and IP/port translation is an edge NAT feature rather than a dynamic routing mechanism.

Key Concept

Link-State Routing Protocol Mechanics (OSPF LSDB and SPF Algorithm)
Question 244Question

A network technician is troubleshooting an inter-switch connectivity issue. Host PC-A (IP address 192.168.10.15/24) connected to switch SW-EDGE-01 in VLAN 10 cannot communicate with Host PC-B (IP address 192.168.10.25/24) connected to switch SW-EDGE-02 in VLAN 10. The two switches are interconnected via an 802.1Q trunk link on interface GigabitEthernet0/24.

Upon inspecting interface GigabitEthernet0/24 on SW-EDGE-01, the technician reviews the following command output:

SW-EDGE-01# show interfaces gigabitethernet0/24 switchport
Name: Gi0/24
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: disabled
Voice VLAN: none
Administrative Mode VLANs Allowed: 1-9,11-4094

Which of the following configuration commands on interface GigabitEthernet0/24 of SW-EDGE-01 will resolve the communication failure between PC-A and PC-B?

Show answer & explanation

Answer: `switchport trunk allowed vlan add 10`

Answer

Executing `switchport trunk allowed vlan add 10` on interface GigabitEthernet0/24 appends VLAN 10 to the allowed list, enabling VLAN 10 traffic to traverse the trunk link.
The output demonstrates that interface GigabitEthernet0/24 has an administrative allowed VLAN list of `1-9,11-4094`. Because VLAN 10 is excluded from this list, switch SW-EDGE-01 prunes all ingress and egress frames belonging to VLAN 10 on this trunk interface. Executing the command `switchport trunk allowed vlan add 10` explicitly appends VLAN 10 to the permitted range, allowing traffic between PC-A and PC-B to pass across the switch link.

Step-by-Step Solution

1
Analyze the output of `show interfaces gigabitethernet0/24 switchport`.
The parameter `Administrative Mode VLANs Allowed` is set to `1-9,11-4094`.
VLAN 10 is omitted from the allowed range, causing the switch to drop all tagged frames for VLAN 10 arriving at or departing from interface GigabitEthernet0/24.
2
Determine the corrective Cisco IOS switchport configuration command.
Using `switchport trunk allowed vlan add 10` modifies the trunk filter to permit VLAN 10 frames.
Using the `add` keyword ensures that VLAN 10 is appended to the current list of allowed VLANs without replacing the existing list.

Key Concept

802.1Q Trunk Allowed VLAN List Pruning and Configuration
Estimated Time:1m 15s
Question 245Question

An enterprise network contains multiple subnets connected through a core Layer 3 switch. Hosts on VLAN 50 (10.50.0.0/2310.50.0.0/23) fail to acquire IPv4 address leases from the centralized DHCP server located on VLAN 10 (192.168.1.100192.168.1.100). A network technician verifies that the DHCP server is operational and reachable via ICMP from the core switch. Where must the `ip helper-address 192.168.1.100` command be configured on the Layer 3 switch to enable DHCP relay functionality for the client hosts?

Show answer & explanation

Answer: On the Switch Virtual Interface (SVI) for VLAN 50

Answer

The helper address command must be configured on the Switch Virtual Interface (SVI) for VLAN 50.
DHCP relay agents must be configured on the ingress Layer 3 interface (default gateway) of the subnet where client hosts reside. In this scenario, hosts on VLAN 50 send broadcast DHCP requests to their gateway (VLAN 50 SVI). Placing `ip helper-address 192.168.1.100` on the VLAN 50 SVI instructs the switch to convert those broadcast UDP port 67 packets into unicast traffic directed to the remote DHCP server at 192.168.1.100192.168.1.100.

Step-by-Step Solution

1
Identify the ingress layer 3 boundary for client broadcast traffic.
Client hosts on VLAN 50 transmit DHCPDISCOVER packets as layer 2 broadcasts (255.255.255.255255.255.255.255), which are restricted to VLAN 50.
Layer 3 boundaries block broadcast traffic by default.
2
Determine the interface requiring DHCP relay agent capabilities.
The gateway interface for VLAN 50 (SVI for VLAN 50) must receive the broadcast and convert it to a unicast DHCPDISCOVER packet sent to 192.168.1.100192.168.1.100.
The IP helper address must be enabled on the specific interface receiving the client's local broadcast.
3
Verify protocol and port operation.
The relay agent listens for UDP port 67 client requests on VLAN 50 SVI and populates the `giaddr` field with 10.50.0.110.50.0.1 before unicasting the packet to the server.
The server uses `giaddr` to assign an IP address from the correct pool (10.50.0.0/2310.50.0.0/23).

Key Concept

DHCP Relay Agent Interface Placement
Estimated Time:1m 30s
Question 246Question

An organization is configuring a core router that has multiple active routing protocols running simultaneously. The router receives two competing routes for the destination network 192.168.50.0/24. The first route is learned via OSPF with a metric of 45. The second route is learned via EIGRP (Internal) with a metric of 156800. Assuming default administrative distance values are used, which path will the router select for traffic destined to 192.168.50.0/24?

Show answer & explanation

Answer: The route learned via EIGRP, because internal EIGRP has a lower administrative distance than OSPF.

Answer

The router will select the route learned via EIGRP because its default Administrative Distance (90) is lower than OSPF's default Administrative Distance (110).
When a router receives identical network destination prefixes from two different dynamic routing protocols, it compares their Administrative Distance (AD) values. Default AD for internal EIGRP is 90, and for OSPF it is 110. Because lower AD indicates higher trustworthiness, the router selects the EIGRP path regardless of raw metric values.

Step-by-Step Solution

1
Identify the destination prefixes and compare their subnet mask lengths.
Both protocols report the identical network prefix length (192.168.50.0/24), so longest prefix match does not eliminate either route.
Longest prefix match is always the first evaluation criteria when choosing between routes.
2
Compare the Administrative Distance (AD) of the competing dynamic routing protocols.
Internal EIGRP has a default AD of 90, while OSPF has a default AD of 110.
When different routing protocols advertise the exact same network prefix, the router uses Administrative Distance to determine source trustworthiness before comparing metrics.
3
Select the preferred route based on the lower Administrative Distance.
The EIGRP route (AD 90) is selected and placed into the IP routing table.
A lower Administrative Distance indicates a more trustworthy routing source.

Key Concept

Administrative Distance vs. Routing Metric in Route Selection
Question 247Question

A network administrator is deploying a Voice over IP (VoIP) system across an enterprise network. The administrator needs to configure a DNS record that allows client IP phones to dynamically discover the hostname and specific port number of the Session Initiation Protocol (SIP) server. Which DNS resource record type should the administrator create to fulfill this requirement?

Show answer & explanation

Answer: An SRV record

Answer

An SRV record is the correct DNS record type for specifying service hostnames and port numbers.
SRV (Service Location) records enable clients to discover hostnames and designated port numbers for specific services and protocols (such as SIP or LDAP).

Step-by-Step Solution

1
Identify the technical requirements of the scenario.
The requirement is to map a network service (SIP for VoIP) to its hostname, priority, weight, and port number in DNS.
Client applications need both server identification and destination port information for service auto-discovery.
2
Evaluate standard DNS record capabilities.
SRV records are designed specifically to provide service location data including port numbers and protocols.
Standard host records (like A or CNAME) only provide IP addresses or aliases without port details.

Key Concept

DNS Service Location (SRV) Records
Estimated Time:45s
Question 248Question

A network administrator is allocating IP addresses for a newly created VoIP segment assigned the IPv4 subnet block 172.31.80.0/21172.31.80.0/21. What is the broadcast address of this subnet?

Show answer & explanation

Answer: 172.31.87.255

Answer

172.31.87.255
For the subnet 172.31.80.0/21172.31.80.0/21, the subnet mask is 255.255.248.0255.255.248.0. The block size in the third octet is 8. The network range extends from 172.31.80.0172.31.80.0 to 172.31.87.255172.31.87.255, making 172.31.87.255172.31.87.255 the broadcast address.

Step-by-Step Solution

1
Determine the subnet mask and block size for a /21 prefix.
A /21 prefix corresponds to a subnet mask of 255.255.248.0255.255.248.0. The block size in the third octet is 256248=8256 - 248 = 8.
Prefix length /21 leaves 3 subnet bits in the third octet (23=82^3 = 8 block size).
2
Calculate the next subnet network address.
Adding the block size of 8 to the third octet of 172.31.80.0172.31.80.0 yields the next network address: 172.31.88.0172.31.88.0.
The next subnet boundary defines the end of the current subnet range.
3
Subtract 1 from the next network address to find the broadcast address.
172.31.88.01=172.31.87.255172.31.88.0 - 1 = 172.31.87.255.
The broadcast address is the highest address within the subnet range where all host bits are set to 1.

Key Concept

Subnet Boundary and Broadcast Address Calculation
Estimated Time:1m 0s
Question 249Question

A network administrator is troubleshooting an authentication service failure where an internal enterprise application requires reverse DNS verification before granting access to incoming clients. The administrator runs the command `dig -x 192.168.50.25` and receives the following output:

text
;; QUESTION SECTION:
;25.50.168.192.in-addr.arpa. IN PTR

;; AUTHORITY SECTION:
50.168.192.in-addr.arpa. 3600 IN SOA ns1.corp.internal. hostmaster.corp.internal. 2026072701 7200 3600 1209600 3600

Which resource record configuration must be added to the authoritative zone to resolve the hostname verification failure?

Show answer & explanation

Answer: A PTR record mapping 25.50.168.192.in-addr.arpa. to the client host's fully qualified domain name

Answer

A PTR record mapping 25.50.168.192.in-addr.arpa. to the host's fully qualified domain name must be created in the reverse lookup zone.
The output of `dig -x` demonstrates a query for a PTR record (`25.50.168.192.in-addr.arpa. IN PTR`). The absence of an ANSWER section confirms that no PTR record currently exists for IP 192.168.50.25. Adding a valid PTR record mapping the reverse address to the host's FQDN in the authoritative zone resolves the reverse lookup request.

Step-by-Step Solution

1
Analyze the command and output
The `dig -x` command issues a reverse lookup query for `25.50.168.192.in-addr.arpa.` expecting a PTR record. The output lacks an ANSWER section.
An missing ANSWER section with an AUTHORITY section indicates the reverse lookup zone exists, but no specific pointer record is configured for IP address 192.168.50.25.
2
Identify the required record type for reverse name resolution
Pointer (PTR) records map reverse IP domain paths (in-addr.arpa) to fully qualified domain names (FQDNs).
Applications performing reverse DNS security checks query PTR records to verify that an IP address maps back to an expected hostname.
3
Determine the correct administrative remediation
Add a PTR record for host 25 in the `50.168.192.in-addr.arpa.` zone pointing to the client's FQDN.
Creating this record populated the ANSWER section in subsequent queries, completing reverse hostname verification.

Key Concept

DNS Reverse Lookup and PTR Record Configuration
Question 250Question

A network engineer is investigating why enterprise client endpoints fail to locate a local software update repository server. According to system documentation, client agents perform a DNS query to discover service location details, including the designated port number, priority, and weight for load balancing.

The engineer executes the following command during troubleshooting:

text
$ dig +noall +answer _update._tcp.corp.example.com
_update._tcp.corp.example.com. 3600 IN CNAME repo1.corp.example.com.

Based on the diagnostic output, which of the following actions must the administrator take on the authoritative DNS server to resolve the discovery issue?

Show answer & explanation

Answer: Replace the CNAME record with an SRV record that specifies the target hostname, port number, priority, and weight for the service.

Answer

Replace the CNAME record with an SRV record that specifies the target hostname, port number, priority, and weight for the service.
The correct answer is to replace the CNAME record with an SRV record. SRV records use the standard format `_service._proto.name` (e.g., `_update._tcp.corp.example.com`) and return priority, weight, port number, and target hostname. CNAME records only provide a domain alias and lack port and load-balancing parameters.

Step-by-Step Solution

1
Analyze the client requirement and command output.
The client queries for `_update._tcp.corp.example.com` expecting service discovery parameters (port, weight, priority, target host). The `dig` output shows a CNAME record mapping to `repo1.corp.example.com`.
A CNAME record only provides an alias pointing to another domain name; it cannot supply port numbers, priorities, or weights.
2
Identify the proper DNS record type required for service location discovery.
An SRV (Service) record follows the standard naming convention `_service._proto.name` and contains symbolic fields for Priority, Weight, Port, and Target hostname.
Applications relying on automatic service discovery require SRV records to determine which port and server to connect to.
3
Select the correct administrative remediation step.
Creating an SRV record with the proper parameters allows clients querying `_update._tcp.corp.example.com` to resolve both the target server and port.
Replacing the invalid CNAME configuration with an SRV record directly fulfills the technical requirement.

Key Concept

DNS SRV (Service Location) Record Configuration
Question 251Question

An organization hosts an internal web server at private IP address 192.168.1.50192.168.1.50 that must be accessible to external clients on the internet using the public IP address 203.0.113.10203.0.113.10. Inbound requests from the internet to destination port 8080 must consistently map to this internal server. Which network address translation technique should the network administrator implement on the edge firewall?

Show answer & explanation

Answer: Static Network Address Translation (Static NAT)

Answer

Static Network Address Translation (Static NAT) should be configured on the edge firewall.
Static NAT establishes a persistent, 1-to-1 mapping between a specific internal private IP address and an external public IP address. This enables external internet clients to consistently locate and initiate inbound traffic to an internal web server.

Step-by-Step Solution

1
Identify the traffic pattern and connectivity requirements
An internal host with a private IP address needs to accept unsolicited inbound requests originating from external clients on the internet via a fixed public IP address.
Public servers located behind a firewall require a persistent, predictable mapping between their private IP address and a public IP address.
2
Evaluate candidate NAT implementation methods
Static NAT provides a persistent 1-to-1 bidirectional mapping between a single private IP address and a single public IP address.
Dynamic NAT allocates public IP addresses temporarily from a pool, and PAT multiplexes outbound traffic using Layer 4 ports; neither guarantees a static inbound translation for external connections.

Key Concept

Static NAT Implementation for Inbound Services
Question 252Question

When an enterprise router receives an IP packet, it executes a standardized path selection hierarchy to determine the optimal route for packet forwarding. Place the following route evaluation steps in the correct sequential order from first decision criteria to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for router path selection is: 1) Filter matching routing table entries, 2) Select the longest prefix match, 3) Select the route with the lowest Administrative Distance, 4) Select the route with the lowest metric, and 5) Install equal-cost paths for Equal-Cost Multi-Path (ECMP) load balancing.
The correct order follows the standard IP routing decision tree: the router first filters candidate routes, selects the route with the Longest Prefix Match (LPM), breaks ties between different protocols using Administrative Distance (AD), breaks ties within the same protocol using metric cost, and finally utilizes Equal-Cost Multi-Path (ECMP) if all parameters are completely identical.

Step-by-Step Solution

1
Identify all matching prefixes
Candidate routes matching the packet destination IP address are filtered.
Routing lookup requires identifying all valid target subnets first.
2
Apply Longest Prefix Match (LPM)
The route with the highest number of matching network bits is selected.
Prefix specificity always overrides protocol believability (AD) or metric.
3
Evaluate Administrative Distance (AD)
The route from the protocol with the lowest AD is selected when prefix lengths are equal.
AD measures protocol trustworthiness across distinct routing sources.
4
Evaluate Routing Protocol Metric
The path with the lowest metric cost within the selected protocol is chosen.
Metric measures relative path desirability within a single routing protocol.
5
Apply Equal-Cost Multi-Path (ECMP)
Multiple matching routes are installed for simultaneous packet forwarding.
When prefix, AD, and metric tie completely, ECMP balances traffic across paths.

Key Concept

Router Path Selection Hierarchy (LPM -> AD -> Metric -> ECMP)
Question 253Question

A client workstation needs to connect to an external server via FQDN. The workstation's local DNS cache is empty. Sequence the complete recursive and iterative DNS resolution steps in the exact order they occur, from the client's initial request to the receipt and caching of the final IP address response.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with the stub resolver sending a recursive query to the local recursive resolver, followed by iterative queries up the DNS hierarchy (Root server referral to TLD server, TLD server referral to Authoritative server, Authoritative server response), ending with the response returned to the stub resolver and cached locally.
The correct order follows the standard DNS resolution model: a client stub resolver initiates a recursive query to its local resolver. The local resolver then performs iterative lookups descending the hierarchy starting at the Root server, moving to the TLD server, and finally contacting the Authoritative server. Once the authoritative answer is retrieved, it is returned to the client and cached by both the local resolver and the client stub resolver.

Step-by-Step Solution

1
Initiate query from client
The client stub resolver sends a recursive query to the designated local recursive resolver.
The client operating system delegates full resolution responsibility to the recursive resolver.
2
Query Root Name Server
The local recursive resolver sends an iterative query to a Root DNS server.
With an empty cache, the recursive resolver must start at the DNS root.
3
Receive TLD Referral
The Root DNS server responds with NS and glue records pointing to the TLD servers.
Root servers only provide referrals to TLD servers rather than final IP mapping.
4
Query TLD Name Server
The local recursive resolver queries the TLD server and receives NS records for the authoritative server.
TLD servers maintain records pointing to the authoritative servers for registered domain names.
5
Query Authoritative Name Server
The local recursive resolver queries the authoritative server and receives the final resource record (A/AAAA).
Authoritative servers host the actual DNS zone data and supply definitive answers.
6
Return Response & Cache
The recursive resolver delivers the IP address to the stub resolver, and the entry is cached.
Caching prevents repetitive full tree traversal for subsequent requests during the TTL period.

Key Concept

DNS Resolution Hierarchy & Iterative vs Recursive Query Flow
Question 254Question

A network administrator needs to configure a floating static route to serve as an automatic failover backup path for an internal network segment currently learned dynamically via OSPF (192.168.10.0/24192.168.10.0/24, Administrative Distance of 110110). Which of the following route configurations will ensure the backup static route remains inactive in the routing table until the primary OSPF route fails?

Show answer & explanation

Answer: Configure a static route to 192.168.10.0/24192.168.10.0/24 with an Administrative Distance value set higher than 110110, such as 130130.

Answer

Configure a static route for the target destination network with an Administrative Distance configured higher than the primary dynamic routing protocol's Administrative Distance (for example, setting AD to 130 when OSPF uses 110).
A floating static route is designed for backup redundancy by assigning it a higher Administrative Distance (AD) than the primary routing source. Since OSPF has an AD of 110, setting the static route's AD to a value like 130 keeps it out of the active forwarding table until the OSPF route disappears.

Step-by-Step Solution

1
Identify the Administrative Distance (AD) of the primary dynamic routing protocol.
The primary OSPF route for network 192.168.10.0/24192.168.10.0/24 has a default AD of 110110.
Administrative Distance indicates the trustworthiness of a routing source; lower values are preferred.
2
Determine the required Administrative Distance for the backup floating static route.
The static route must be configured with an AD strictly greater than 110110 (e.g., 130130).
Setting a higher AD ensures the static route is untrusted while OSPF is functional and will not be installed into the active routing table.
3
Verify failover mechanics.
When the primary OSPF neighbor or link fails, the OSPF route is removed from the routing table, allowing the floating static route (AD=130AD = 130) to be installed and forward traffic.
Routers select the active route based on Administrative Distance when prefix lengths are identical.

Key Concept

Floating Static Routes and Administrative Distance
Question 255Question

An organization is deploying a new VoIP phone deployment on VLAN 30 (192.168.30.0/24192.168.30.0/24). While existing desktop computers on VLAN 10 (192.168.10.0/24192.168.10.0/24) successfully acquire dynamic IPv4 addresses from a centralized DHCP server at 10.1.1.5010.1.1.50, the newly installed VoIP phones on VLAN 30 fail to receive an IP address lease. Both VLANs terminate on a central Layer 3 core switch. Which of the following configuration changes on the Layer 3 core switch will resolve the IP addressing issue for the phones on VLAN 30?

Show answer & explanation

Answer: Configure `ip helper-address 10.1.1.50` under the VLAN 30 switch virtual interface (SVI).

Answer

Configure `ip helper-address 10.1.1.50` under the VLAN 30 switch virtual interface (SVI).
The correct action is to configure `ip helper-address 10.1.1.50` under the VLAN 30 SVI. DHCP client discovery packets are sent as local Layer 2 broadcasts. Because routers and Layer 3 switch interfaces drop broadcast packets by default, a DHCP relay agent (configured via `ip helper-address` in Cisco-style syntax) must be enabled on the interface directly connected to the client subnet. This allows the switch to intercept incoming broadcast DHCPDISCOVER traffic on UDP port 67, encapsulate it as a unicast packet with the gateway IP address (`giaddr`) set to the VLAN 30 interface address, and send it to the DHCP server at 10.1.1.5010.1.1.50.

Step-by-Step Solution

1
Analyze why clients on VLAN 30 fail to acquire IPv4 address leases from the remote DHCP server.
Initial DHCPDISCOVER messages are Layer 2 broadcasts (255.255.255.255255.255.255.255) that cannot traverse Layer 3 boundaries (routers/SVIs) by default.
Without a relay mechanism, broadcast requests from VLAN 30 are dropped at the SVI boundary.
2
Identify the proper location and command to enable DHCP relay functionality.
Apply `ip helper-address 10.1.1.50` on the ingress Layer 3 interface facing the client broadcast domain (VLAN 30 SVI).
The relay agent intercepts client broadcasts on port 67, adds its own IP address to the `giaddr` field, and forwards the request as a unicast packet to the target server.

Key Concept

DHCP Relay Agent Placement and Operation
Question 256Question

A network administrator is configuring a dedicated VLAN for a new branch office security system. The system requires static IPv4 addresses for 12 IP cameras, 2 Network Video Recorders (NVRs), and 1 router default gateway interface. Which of the following CIDR subnet masks is the smallest mask that accommodates all required host IP addresses while minimizing wasted address space?

Show answer & explanation

Answer: /27

Answer

The subnet mask /27 is the smallest CIDR prefix that accommodates all 15 required host IP addresses.
The correct option is /27. The scenario requires 15 usable IPv4 addresses (12 cameras + 2 NVRs + 1 default gateway). A /27 subnet uses 5 host bits, yielding 2^5 - 2 = 30 usable host addresses. This is the smallest prefix length (most specific mask) that accommodates all 15 hosts without shortage.

Step-by-Step Solution

1
Calculate total host IP addresses required
12 (cameras) + 2 (NVRs) + 1 (default gateway) = 15 required host IP addresses.
Every active host and gateway interface on the subnet requires a unique usable IP address.
2
Determine the required number of host bits using the formula 2^h - 2 >= required hosts
For 4 host bits (h=4): 2^4 - 2 = 14 usable host IPs (insufficient for 15 hosts). For 5 host bits (h=5): 2^5 - 2 = 30 usable host IPs (sufficient for 15 hosts).
Two addresses in every subnet are reserved for the network ID and broadcast address.
3
Calculate the CIDR prefix length
32 total IPv4 bits - 5 host bits = /27 prefix length.
Subtracting host bits from 32 gives the prefix length for the network portion.

Key Concept

IPv4 Subnet Masking and Host Allocation
Estimated Time:1m 30s
Question 257Question

A systems engineer is configuring an edge router for a secondary data center. The site has 50 internal servers on the private IP range 10.20.0.0/2610.20.0.0/26 that require outbound Internet access to update external software repositories using a single public IP address (203.0.113.10203.0.113.10). Additionally, external administrators must be able to initiate inbound SSH connections directly to a dedicated internal management server at 10.20.0.510.20.0.5. Which combination of address translation implementations should the engineer configure on the edge router?

Show answer & explanation

Answer: Configure Port Address Translation (PAT / Overload) using public IP address 203.0.113.10203.0.113.10 for the 10.20.0.0/2610.20.0.0/26 subnet, and configure a static port translation rule mapping inbound TCP port 22 on 203.0.113.10203.0.113.10 to 10.20.0.510.20.0.5.

Answer

Port Address Translation (PAT / Overload) should be configured for outbound host access sharing the public IP, along with a static port translation (port forwarding) mapping rule for inbound SSH access to the management server.
Port Address Translation (PAT / Overload) uses unique source port numbers at Layer 4 to allow multiple internal private IP addresses to share a single public IP address for outbound traffic. For inbound connections to internal resources, a static translation entry (such as port forwarding TCP port 22) must be created so the router knows which internal host should receive traffic initiated from external networks.

Step-by-Step Solution

1
Analyze outbound requirement for internal subnet
50 internal hosts on 10.20.0.0/2610.20.0.0/26 must share a single public IP (203.0.113.10203.0.113.10).
Because only one public IP address is available for 50 hosts, Layer 4 Port Address Translation (PAT / NAT Overload) is required to track separate connections by source port.
2
Analyze inbound requirement for internal management server
External clients must initiate SSH connections to 10.20.0.510.20.0.5 through 203.0.113.10203.0.113.10.
Inbound connections initiated from the outside require a static, predictable mapping. Static NAT or Static PAT (Port Forwarding on TCP port 22) routes incoming traffic on the public IP directly to the internal server's private address.
3
Combine translation methods on edge router
PAT handles outbound dynamic sessions; Static NAT/PAT handles inbound SSH sessions.
This dual implementation permits outbound internet browsing for all internal hosts while maintaining targeted inbound service accessibility.

Key Concept

Combining Port Address Translation (PAT/Overload) for outbound host multiplexing with Static NAT/Port Forwarding for inbound server availability.
Question 258Question

A network engineer is troubleshooting an outbound connectivity issue at a branch office where 500 workstations on the 10.50.0.0/2210.50.0.0/22 internal network access external services through a router configured with Port Address Translation (PAT) on a single public IP address (198.51.100.1198.51.100.1). Users report that while standard web traffic functions without issue, a legacy proprietary monitoring application that transmits raw IP packets (using custom IP protocol 99 without TCP/UDP transport headers or unique layer-4 session identifiers) allows only one internal host at a time to communicate with a remote server. Which of the following best explains why PAT fails to multiplex multiple simultaneous connections for this application?

Show answer & explanation

Answer: PAT relies on Layer 4 transport headers or protocol-specific multiplexing identifiers to track distinct flows over a single public IP address, which raw IP protocol 99 traffic lacks.

Answer

PAT relies on Layer 4 transport headers or protocol-specific multiplexing identifiers to track distinct flows over a single public IP address, which raw IP protocol 99 traffic lacks.
Port Address Translation (PAT) requires Layer 4 information—specifically TCP or UDP port numbers—to track and differentiate multiple internal hosts sharing a single public IP address. Protocols that run directly over IP without TCP/UDP transport headers or built-in session identifiers (such as ICMP Query IDs) cannot be multiplexed by PAT across multiple internal hosts targeting the same external destination server.

Step-by-Step Solution

1
Analyze how Port Address Translation (PAT / NAT Overload) disambiguates connections.
PAT maps multiple private 10.50.0.0/2210.50.0.0/22 addresses to a single public IP address 198.51.100.1198.51.100.1 by assigning unique Layer 4 source port numbers (TCP/UDP) to each outbound flow.
Tracking transport layer source ports allows the router to route incoming return packets back to the exact internal host IP and internal port.
2
Evaluate the traffic characteristics of the legacy proprietary application.
The application sends raw IP packets using IP protocol number 99, bypassing Layer 4 TCP and UDP headers entirely.
Without TCP/UDP source/destination port fields or protocol-specific identification fields (such as ICMP Identifier fields), PAT has no Layer 4 data to modify or track in its state table.
3
Determine why only a single session functions at a time.
The translation table can only map the IP protocol 99 tuple (Inside Local IP \rightarrow Outside Global IP) once without port fields.
Subsequent internal hosts attempting to send IP protocol 99 traffic to the same destination remote server collide with the existing translation entry because the router cannot differentiate the flows.

Key Concept

PAT Layer 4 Multiplexing Requirements and Transport Protocol Translation Limits
Estimated Time:2m 0s
Question 259Question

Match each enterprise address translation requirement or descriptor on the left with the corresponding Network Address Translation (NAT) implementation type or address classification on the right.

Click a left item, then click its matching right item

Items

Providing permanent, bi-directional inbound accessibility to an internal server residing on a private subnet using a fixed one-to-one IP mapping.
Allowing hundreds of internal workstations to establish outbound internet connections simultaneously over a single public IP by tracking unique ephemeral Layer 4 source ports.
Assigning an internal host a temporary public IP address from a pre-configured, bounded address pool on a first-come, first-served basis for the duration of its session.
The public IPv4 address assigned to represent an internal private host to external entities on the public internet.

Matches

Show answer & explanation

Answer

The correct matches are: 1. Permanent bi-directional inbound accessibility matches Static NAT; 2. Multiple workstations sharing a single public IP via Layer 4 source ports matches Port Address Translation (PAT / NAT Overload); 3. Assigning a temporary public IP from a pre-configured pool matches Dynamic NAT; 4. The public IPv4 address assigned to represent an internal host externally matches Inside Global Address.
Each NAT mechanism serves specific architectural requirements: Static NAT maintains a 1-to-1 static mapping for inbound services; PAT (Overload) multiplexes multiple private IPs across one public IP by translating Layer 4 source ports; Dynamic NAT allocates public IPs dynamically from a pool on a 1-to-1 basis; and Inside Global refers specifically to the translated public address representing an inside device to the outside world.

Step-by-Step Solution

1
Analyze requirement 1 (permanent bi-directional inbound access).
Identified as requiring a static, invariant 1-to-1 mapping.
Static NAT ensures outside clients can consistently initiate connections to an internal server.
2
Analyze requirement 2 (hundreds of workstations sharing one public IP via source ports).
Identified as Port Address Translation (PAT).
PAT uses Layer 4 TCP/UDP port mapping (Overload) to multiplex many internal private addresses over a single public address.
3
Analyze requirement 3 (temporary IP assignment from a bounded pool).
Identified as Dynamic NAT.
Dynamic NAT creates temporary 1-to-1 translations on demand from an available address pool.
4
Analyze requirement 4 (naming convention for the public representation of an internal host).
Identified as Inside Global Address.
CompTIA/Cisco terminology defines Inside Global as the translated address of an inside device as viewed by external networks.

Key Concept

NAT/PAT Implementation Types and CompTIA Network Address Classifications
Question 260Question

Match each DNS resource record type to its corresponding technical description or administrative function within an enterprise DNS infrastructure.

Click a left item, then click its matching right item

Items

SRV Record
SOA Record
RRSIG Record
CNAME Record

Matches

Show answer & explanation

Answer

SRV Record matches the description detailing service name, protocol, port number, priority, and weight. SOA Record matches the description detailing zone administration parameters, primary master name server, contact email, and zone timers. RRSIG Record matches the description specifying DNSSEC digital signatures for RRsets. CNAME Record matches the description defining an alias mapping to a canonical hostname requiring secondary resolution.
Each DNS record type serves a distinct technical role: SRV handles service and port discovery; SOA contains zone-wide administrative metadata and replication timers; RRSIG provides DNSSEC cryptographic signatures over record sets; and CNAME acts as a domain alias pointing to a canonical domain name.

Step-by-Step Solution

1
Analyze SRV Record requirements
Identify that SRV records uniquely incorporate service/protocol specification along with priority, weight, and port fields for service location discovery.
Used in protocols like LDAP, Kerberos, and VoIP for dynamic service locator resolution.
2
Analyze SOA Record parameters
Identify that SOA records define zone-level metadata including serial numbers, refresh, retry, expire intervals, and administrative email address.
Crucial for primary/secondary DNS replication synchronization and authoritative zone parameters.
3
Analyze RRSIG Record functionality
Identify that RRSIG is a key component of DNSSEC containing public key cryptography signatures over DNS record sets.
Prevents cache poisoning and spoofing by enabling cryptographic validation of response data.
4
Analyze CNAME Record functionality
Identify that CNAME acts as an alias to a canonical name, forcing recursive resolvers to initiate a secondary lookup cycle.
Simplifies domain management when multiple service names point to a single host entity.

Key Concept

DNS Infrastructure Record Types and Technical Functions
PreviousPage 13 / 22Next
Network Implementation Practice Questions — CompTIA Network+ — Page 13 | Examkin