Network Implementation

424 questions

All types424 Multiple choice220 Multiple select80 Numeric11 Matching53 Ordering42 Short answer18

A network administrator needs to assign an IPv4 subnet for a database cluster requiring static IP addresses for $110$ physical node interfaces, $2$ virtual load balancer IP addresses, and $2$ redundant default gateway interfaces. Which CIDR prefix length represents the smallest subnet mask that will accommodate all required host addresses?

/25

/26

/24

/27

Show answer & explanation

Answer: /25

Answer

The smallest subnet mask in CIDR notation that accommodates all required addresses is /25.

The scenario requires allocating 114 usable IP addresses (

110 + 2 + 2 = 114

). A /25 subnet allocates 7 host bits, giving

2^7 = 128

total IP addresses. Subtracting 2 for the network ID and broadcast address results in 126 usable host IP addresses. This satisfies the 114 required addresses while using the smallest possible subnet block.

Step-by-Step Solution

Calculate total host IP addresses required

110 \text{ physical interfaces} + 2 \text{ load balancer virtual IPs} + 2 \text{ gateway interfaces} = 114 \text{ host IP addresses}

Every active physical interface, redundant gateway, and virtual IP assigned on the local subnet requires a unique usable IPv4 host address.

Determine required host bits (n) using formula 2^n - 2 >= required usable hosts

For

n = 6

2^6 - 2 = 62

usable host IPs (insufficient). For

n = 7

2^7 - 2 = 126

usable host IPs (sufficient for 114).

Subnet calculations must subtract 2 addresses (the Network ID and the Broadcast address) from the total pool of

2^n

addresses.

Calculate the CIDR prefix length

32 \text{ total IPv4 bits} - 7 \text{ host bits} = /25 \text{ prefix length}

Subtracting the number of host bits from the 32-bit total IPv4 address space yields the subnet prefix length.

Key Concept

Calculating usable IPv4 host capacity and determining optimal CIDR subnet mask allocation.

Estimated Time:1m 30s

Question 402Question →

A client host connected to a remote VLAN requires an IPv4 address lease from a centralized DHCP server located across a Layer 3 boundary router configured with a DHCP relay agent (ip helper-address). Arrange the packet forwarding, header modifications, and protocol processing steps of the initial DHCP lease negotiation in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order of the cross-VLAN DHCP discovery and lease offer process is: (1) Host broadcasts a DHCPDISCOVER frame on UDP port 67 locally -> (2) Relay agent intercepts the broadcast, populates the giaddr header field with its interface IP, and unicasts the packet to the DHCP server on UDP port 67 -> (3) DHCP server inspects the giaddr value to select the matching scope pool and unicasts a DHCPOFFER back to the relay agent -> (4) Relay agent forwards the DHCPOFFER on UDP port 68 to the client host -> (5) Host broadcasts a DHCPREQUEST frame on UDP port 67 to accept the offer.

The cross-VLAN DHCP process follows a strict sequence: First, the host broadcasts a DHCPDISCOVER packet on UDP port 67 into its local subnet. Next, the Layer 3 relay agent intercepts this broadcast, writes its ingress interface IP address into the giaddr header field, and unicasts the modified packet across the routed network to the DHCP server on UDP port 67. Upon receipt, the DHCP server evaluates the giaddr value to select the correct IP scope pool and unicasts a DHCPOFFER back to the relay agent's IP. The relay agent then forwards this DHCPOFFER to the local client subnet on UDP port 68. Finally, the client host broadcasts a DHCPREQUEST on UDP port 67 to formally confirm its intent to lease the offered IP configuration.

Step-by-Step Solution

Identify the initial packet transmission generated by the unconfigured client host.

The host broadcasts a DHCPDISCOVER packet locally (destination 255.255.255.255) using UDP destination port 67.

Because the host lacks an IP address, it must use a local broadcast to discover listening DHCP services on its segment.

Determine how the Layer 3 router's relay agent processes the incoming local broadcast.

The relay agent captures the broadcast, sets the giaddr (Gateway IP Address) field to its ingress interface IP, and unicasts the packet to the remote DHCP server on UDP port 67.

Routers drop Layer 2/3 broadcasts by default; the relay agent turns the broadcast into a routable unicast packet while embedding the subnet context via giaddr.

Analyze how the centralized DHCP server handles the relayed unicast packet and constructs its response.

The DHCP server matches the giaddr field to its configured address pools, allocates an available IP from that specific scope, and sends a unicast DHCPOFFER back to the relay agent's IP.

The server uses giaddr rather than the source IP of the relay agent packet to determine which network scope to lease an address from.

Trace the delivery of the lease offer from the relay agent back to the target host.

The relay agent forwards the DHCPOFFER frame onto the local client VLAN targeting UDP destination port 68.

The relay agent translates the unicast server reply back to the local client segment, directing it to client port 68.

Identify the client host's action upon receiving and accepting the offer.

The client host broadcasts a DHCPREQUEST message on UDP port 67.

Broadcasting the request notifies all DHCP servers that an offer was accepted, allowing other servers to release any implicitly reserved leases.

Key Concept

DHCP Relay Operation, Header Modification (giaddr), and DORA Packet Traversal

Question 403Question →

An enterprise network administrator deploys a new segment of 250 internal workstations that require simultaneous outbound internet access. The edge firewall is configured with dynamic NAT using a public IP pool consisting of a single $/28$ prefix (14 usable public IPv4 addresses). During peak operational hours, only the first 14 hosts can establish outbound sessions, while all remaining workstations experience connection timeouts when reaching external web servers. Which of the following configuration modifications will resolve the connectivity issue without acquiring additional public IP addresses?

Reconfigure the network address translation policy to enable overload (PAT) on the dynamic IP pool.

Change the NAT configuration to 1:1 Static NAT assignments for each workstation using the existing public IP pool.

Force all outbound session translations on the firewall to use UDP transport ports instead of TCP ports.

Reconfigure the internal workstation network adapters to encapsulate outbound traffic strictly at Layer 2 to bypass firewall translation.

Show answer & explanation

Answer: Reconfigure the network address translation policy to enable overload (PAT) on the dynamic IP pool.

Answer

Reconfiguring the network address translation policy to enable overload (PAT) on the existing pool will allow up to thousands of concurrent outbound connections across the available public addresses.

Standard Dynamic NAT maps internal private IP addresses to external public IP addresses on a one-to-one basis without modifying Layer 4 port numbers. Because the pool contains only 14 public IP addresses (

/28

prefix has 16 addresses minus network and broadcast), only 14 hosts can communicate externally at any given time. Enabling Port Address Translation (PAT / NAT Overload) allows the firewall to map multiple internal private IP addresses to a single public IP address by assigning a unique ephemeral source port number to each outbound session, enabling all 250 hosts to communicate simultaneously over the existing pool.

Step-by-Step Solution

Analyze the reported symptom and environment constraints.

Dynamic NAT without port mapping (1:1 dynamic binding) limits concurrent external sessions strictly to the number of available public IP addresses (14 addresses for 250 hosts).

Once all 14 public pool addresses are assigned to active host connections, the pool is exhausted and subsequent translation requests are dropped.

Evaluate the technical requirement.

All 250 internal hosts need outbound access simultaneously without purchasing additional public IPv4 space.

Port Address Translation (PAT / Overload) tracks outbound traffic streams using source port numbers in addition to IP addresses, allowing thousands of sessions to share a single public IP address.

Select the appropriate NAT implementation strategy.

Enabling PAT (NAT overload) on the existing pool configuration resolves the session exhaustion issue.

PAT scales concurrent connectivity exponentially by multiplexing Layer 4 port numbers.

Key Concept

Port Address Translation (PAT / Overload) vs Dynamic NAT Pool Exhaustion

Question 404Question →

A workstation on a remote branch subnet requests an IPv4 address from a centralized DHCP server located across a routed WAN link via a local Layer 3 DHCP relay agent. Arrange the steps of the initial DHCP discovery and offer phase in the correct chronological order from start to finish.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: 1) Workstation broadcasts DHCPDISCOVER locally, 2) Relay agent populates giaddr and unicasts DHCPDISCOVER to the server, 3) DHCP server selects scope via giaddr and unicasts DHCPOFFER to relay agent, 4) Relay agent forwards DHCPOFFER to the local subnet, 5) Workstation broadcasts DHCPREQUEST.

The standard DHCP relay packet flow begins when an unconfigured host broadcasts a DHCPDISCOVER packet locally on UDP port 67. The local router acting as a relay agent receives this broadcast, stamps its own interface address into the Gateway IP Address (giaddr) field, and unicasts the packet to the centralized DHCP server on UDP port 67. Upon receiving the packet, the DHCP server inspects giaddr to identify the appropriate IP pool, picks an available IP address, and unicasts a DHCPOFFER back to the relay agent on UDP port 68. The relay agent then forwards the DHCPOFFER onto the local subnet to the host on UDP port 68. Finally, the host processes the offer and broadcasts a DHCPREQUEST to formally select the offered address.

Step-by-Step Solution

Identify the initial client transmission

Workstation broadcasts a DHCPDISCOVER frame locally on UDP port 67.

Clients lacking an IP address must broadcast locally to find a server or relay agent.

Trace the relay agent behavior upon packet ingress

Relay agent modifies packet with giaddr field and unicasts it to the server.

Layer 3 boundaries block broadcast frames; the relay converts broadcast to unicast so routing works.

Determine central server processing and egress response

Server uses giaddr to select the correct IP scope and unicasts DHCPOFFER to the relay agent.

The server must know which subnet the client belongs to, which is indicated by the giaddr field.

Trace relay agent forwarding back to client

Relay agent receives DHCPOFFER unicast and forwards it onto the client's local subnet.

The relay agent bridges communication between the remote server and local host.

Identify client response to complete the offer acceptance phase

Workstation broadcasts a DHCPREQUEST accepting the IP lease.

In the standard DORA sequence, DISCOVER is followed by OFFER, then REQUEST.

Key Concept

DHCP Relay Agent Operational Packet Flow (DORA across L3 boundaries)

Question 405Question →

A network administrator is provisioning a dedicated IPv4 subnet for a web server cluster that requires static IP address assignments for $28$ physical web servers, $2$ firewall gateway interfaces, and $1$ floating virtual IP (VIP) address. Assuming the administrator assigns the smallest standard CIDR subnet block that accommodates all required endpoints, how many additional usable host IP addresses will remain available for future expansion?

31

33

1

95

Show answer & explanation

Answer: $31$

Answer

The smallest CIDR subnet that accommodates the requirement leaves 31 additional usable host IP addresses available.

The scenario requires

31

static IP assignments (

28

servers +

2

gateways +

1

VIP). A

/27

subnet block contains

32

total IP addresses, but only

2^5 - 2 = 30

are usable, which falls short by one address. Consequently, the administrator must step up to a

/26

subnet block (

64

total addresses), which yields

2^6 - 2 = 62

usable host IPs. Subtracting the

31

assigned addresses from the

62

usable addresses leaves exactly

31

usable host IP addresses available for future expansion.

Step-by-Step Solution

Calculate the total number of required host IP endpoints.

28\text{ servers} + 2\text{ gateway interfaces} + 1\text{ VIP} = 31\text{ required IP addresses}

Every active host interface, physical gateway, and virtual redundancy IP requires a distinct usable IP address.

Determine the smallest subnet prefix that supports at least 31 usable IP addresses.

/27

prefix yields

2^5 - 2 = 30

usable addresses (insufficient). A

/26

prefix yields

2^6 - 2 = 62

usable addresses (sufficient).

Usable host capacity formula is

2^h - 2

, where

h

is the number of host bits remaining (

32 - \text{prefix}

Calculate the remaining available usable IP addresses in the

/26

subnet.

62\text{ usable addresses} - 31\text{ assigned addresses} = 31\text{ available addresses}

Subtracting the required IP addresses from the maximum usable host capacity gives the remaining expansion capacity.

Key Concept

Usable IPv4 Host Calculation & Subnet Sizing

Estimated Time:1m 30s

Question 406Question →

A network engineer is configuring a redundant centralized DHCP infrastructure with primary and secondary DHCP servers located on a dedicated management subnet ( $10.50.100.0/24$ ). Multiple client subnets, including VLAN 12 ( $172.16.12.0/24$ ) and VLAN 24 ( $172.16.24.0/24$ ), must be able to receive lease offers from both servers. Which of the following configuration steps must be implemented on the Layer 3 interface for each client subnet to ensure redundant DHCP relay service? (Select TWO.)

Select all that apply

Configure an `ip helper-address` statement specifying the unicast IPv4 address of the primary DHCP server.

Configure an additional `ip helper-address` statement specifying the unicast IPv4 address of the secondary DHCP server.

Configure ACL rules on the client Layer 3 interfaces to permit inbound TCP port 67 and outbound TCP port 68 traffic.

Configure a single `ip helper-address` entry using the directed subnet broadcast address

10.50.100.255

Show answer & explanation

Answer: Configure an `ip helper-address` statement specifying the unicast IPv4 address of the primary DHCP server.; Configure an additional `ip helper-address` statement specifying the unicast IPv4 address of the secondary DHCP server.

Answer

The correct steps are to configure an ip helper-address specifying the primary DHCP server's unicast IP address and a second ip helper-address specifying the secondary DHCP server's unicast IP address on each client subnet's Layer 3 boundary interface.

To support redundant DHCP servers across a Layer 3 boundary, the relay agent (router or Layer 3 switch interface) must be configured with an explicit unicast `ip helper-address` for each server. When multiple `ip helper-address` commands are configured on the same interface, the device replicates incoming client DHCP broadcasts into individual unicast packets sent to each specified DHCP server IP address.

Step-by-Step Solution

Identify how Layer 3 relay agents handle DHCP broadcast requests from clients.

The router intercepts Layer 2/3 local broadcasts (UDP port 67) on the client SVI/subinterface.

DHCP Discover and Request packets are broadcasts and cannot cross Layer 3 boundaries without relay assistance.

Apply unicast helper address entries for both primary and secondary servers on the client-facing Layer 3 interface.

Multiple `ip helper-address <IP>` commands populate the relay destination table for that interface.

When multiple helper addresses are configured on an interface, the router duplicates the client's broadcast packet and forwards unicast copies to each configured server address.

Verify transport layer protocol requirements for DHCP relay forwarding.

DHCP traffic utilizes UDP ports 67 (server listening port) and 68 (client listening port).

TCP is not used during the DORA process or relay agent forwarding.

Key Concept

DHCP Relay Agent Multi-Server Redundancy

Question 407Question →

A network administrator is configuring an edge router for a branch office. The office contains 100 internal workstations using private IP addresses on the $192.168.10.0/24$ network that require simultaneous outbound internet connectivity. In addition, an internal web server at $192.168.10.50$ must accept inbound connections from external clients via a dedicated public IP address ( $203.0.113.10$ ). Which of the following implementation steps correctly satisfy these network requirements? (Select TWO.)

Select all that apply

Configure Static NAT for the internal web server to create a persistent one-to-one mapping between

192.168.10.50

and

203.0.113.10

Configure Static NAT for the 100 internal workstations to assign each device a permanent unique public IP address from a single shared address pool.

Configure Port Address Translation (PAT / NAT Overload) for the internal workstations to allow multiple private IP addresses to share a single public IP address using unique source port numbers.

Configure Port Address Translation (PAT) to operate purely at Layer 3 by modifying source IPv4 addresses while preserving original Layer 3 protocol headers without examining TCP or UDP ports.

Show answer & explanation

Answer: Configure Static NAT for the internal web server to create a persistent one-to-one mapping between $192.168.10.50$ and $203.0.113.10$ .; Configure Port Address Translation (PAT / NAT Overload) for the internal workstations to allow multiple private IP addresses to share a single public IP address using unique source port numbers.

Answer

Static NAT must be configured for the internal web server to provide a permanent one-to-one public-to-private mapping, while Port Address Translation (PAT / NAT Overload) must be configured for the internal workstations to multiplex outbound traffic over a shared public IP using unique Layer 4 source ports.

Static NAT provides a static 1:1 mapping between an internal private IP address and an external public IP address, which allows external devices to initiate connections to internal resources such as web servers. PAT (NAT Overload) allows multiple internal devices with private IP addresses to share a single public IP address by assigning a unique Layer 4 source port number to each connection session.

Step-by-Step Solution

Identify the inbound server access requirement

Recognize that external clients must consistently initiate connections to an internal IP address.

Static NAT is required because it maintains a fixed bidirectional mapping between a single internal private IP address and a public IP address.

Identify the outbound host connectivity requirement

Recognize that 100 internal host PCs require outbound internet access simultaneously using minimal public IP space.

Port Address Translation (PAT/Overload) allows multiple internal hosts to share a single public IP address by mapping internal IP addresses and source ports to unique external source port numbers.

Key Concept

Selecting and combining Static NAT (for persistent inbound server access) and PAT/Overload (for many-to-one outbound client access).

Question 408Question →

An organization is upgrading its wireless network to support high-throughput applications in a conference room. The network administrator decides to deploy access points supporting the IEEE 802.11ac (Wi-Fi 5) standard. Which operating frequency band is exclusively utilized by the IEEE 802.11ac standard for wireless data transmission?

5 GHz band

2.4 GHz band

6 GHz band

900 MHz band

Show answer & explanation

Answer: 5 GHz band

Answer

The IEEE 802.11ac standard exclusively utilizes the 5 GHz frequency band.

The IEEE 802.11ac (Wi-Fi 5) standard was designed specifically for high-throughput local wireless networks by operating exclusively in the 5 GHz spectrum. This allows for wider channel bonding (up to 80 MHz or 160 MHz) and less signal congestion compared to the crowded 2.4 GHz spectrum.

Step-by-Step Solution

Identify the wireless standard specified in the question

The target standard is IEEE 802.11ac (Wi-Fi 5).

Different Wi-Fi standards are defined by the IEEE to operate on specific radio frequency bands.

Determine the operating frequency band for 802.11ac

IEEE 802.11ac is defined strictly to operate within the 5 GHz spectrum.

By focusing solely on 5 GHz, 802.11ac supports mandatory wider channel bonding (such as 80 MHz and optional 160 MHz channels) and higher density modulation.

Key Concept

IEEE 802.11 Wireless Standards Operating Frequencies

Question 409Question →

A network architect is designing a high-density wireless LAN for a enterprise campus using 802.11ac Wave 2 access points (APs). To achieve maximum throughput per client, the architect intends to configure wide 80 MHz channels in the 5 GHz spectrum. However, a post-installation site survey reveals that radar equipment is actively operating in the UNII-2 and UNII-2 Extended frequency ranges (channels 52 through 144). If Dynamic Frequency Selection (DFS) events are frequently triggered across these bands, which of the following operational impacts will most significantly compromise the wireless design?

The APs will be forced to vacate the DFS channels upon detecting radar, reducing the available non-overlapping 80 MHz channels to as few as two in UNII-1 and UNII-3, which dramatically increases co-channel interference.

The APs will automatically fall back to using adjacent 2.4 GHz channels 2, 3, and 4 to sustain 80 MHz channel bonding without experiencing radar disruption.

The wireless controller will disable 802.1Q VLAN trunking and strip 802.1p class of service tags on switch interfaces whenever radar pulses are logged.

The access points will force all associated clients to re-authenticate using WPA3-Personal pre-shared keys to bypass mandatory channel availability check timers.

Show answer & explanation

Answer: The APs will be forced to vacate the DFS channels upon detecting radar, reducing the available non-overlapping 80 MHz channels to as few as two in UNII-1 and UNII-3, which dramatically increases co-channel interference.

Answer

In the 5 GHz band, configuring 80 MHz channel bonding consumes four 20 MHz channels per bonded group. There are only 6 non-overlapping 80 MHz channels available across the entire 5 GHz spectrum. When radar activity triggers Dynamic Frequency Selection (DFS) in the UNII-2 and UNII-2 Extended bands (which contain 4 of those 6 bonded channels), the access points are forced to evacuate those bands. This leaves only two 80 MHz channels available (one in UNII-1 and one in UNII-3) for the entire enterprise deployment, resulting in severe co-channel interference (CCI) across adjacent access points.

Step-by-Step Solution

Analyze the available 5 GHz channel spectrum and 80 MHz channel bonding requirements.

The 5 GHz spectrum contains 24 non-overlapping 20 MHz channels. Bonding four adjacent 20 MHz channels into an 80 MHz channel yields 6 total available 80 MHz channels across UNII-1, UNII-2, UNII-2E, and UNII-3.

Calculating total channel availability determines how density and channel width interact.

Evaluate the impact of active radar signals on UNII-2 and UNII-2 Extended channels.

FCC and ETSI regulatory rules require APs to employ Dynamic Frequency Selection (DFS). When radar is detected in UNII-2 (channels 52-64) and UNII-2E (channels 100-144), APs must immediately cease transmission and change channels.

DFS compliance forces APs out of the middle 5 GHz bands when radar bursts are detected.

Assess the resulting channel capacity and co-channel interference (CCI) in non-DFS channels.

Excluding UNII-2 and UNII-2E leaves only UNII-1 (channels 36, 40, 44, 48 -> one 80 MHz block) and UNII-3 (channels 149, 153, 157, 161 -> one 80 MHz block). Deploying a multi-AP campus on only two 80 MHz channels causes extensive co-channel interference.

Re-using only two 80 MHz channels across multiple enterprise access points causes severe channel overlap and performance degradation.

Key Concept

5 GHz Channel Bonding and DFS Radar Constraints

Question 410Question →

An enterprise router receives dynamic routing updates from multiple protocols for the exact same destination network prefix. Place the processing steps in the correct order that the router follows to evaluate these updates and install the optimal path into the Forwarding Information Base (FIB).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with receiving the routing updates, followed by evaluating Administrative Distance across different protocols, comparing metrics within the winning protocol, and finally installing the selected route into the Forwarding Information Base.

When a router learns multiple routes to the exact same prefix, it first receives all update advertisements. It then uses Administrative Distance (AD) to evaluate protocol trustworthiness. If the preferred protocol advertises multiple candidate paths, the router uses the protocol metric to break the tie. Finally, the chosen route is moved into the Forwarding Information Base (FIB) for rapid data plane forwarding.

Step-by-Step Solution

Ingest incoming routing protocol updates.

The router places candidates for the destination prefix into the control plane buffer.

Updates must be received before path selection decision logic can run.

Filter incoming routes based on Administrative Distance (AD).

The protocol with the lowest AD value (e.g., OSPF at 110 vs RIP at 120) is chosen.

Metrics are incompatible across different protocols, so AD is used first to select the most reliable routing source.

Compare metrics among candidate paths from the winning protocol.

The path with the lowest metric (lowest cost) within that specific protocol is chosen.

When multiple paths are advertised by the same protocol, metric comparison resolves path preference.

Commit the best path to the Forwarding Information Base (FIB).

The FIB is updated with the next-hop IP and outgoing interface.

The FIB handles hardware-accelerated packet forwarding based on the control plane's selection.

Key Concept

Route Selection Hierarchy (Administrative Distance vs Metric and FIB Programming)

Question 411Question →

Match each advanced wireless deployment technology or regulatory mechanism on the left with its corresponding operational requirement or physical layer behavior on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Dynamic Frequency Selection (DFS) pairs with radar detection and channel switching on U-NII-2 bands. BSS Coloring pairs with appending 6-bit PHY header tags to mitigate co-channel interference contention in 802.11ax. OFDMA pairs with dividing channels into Resource Units (RUs) for parallel multi-user traffic. Maximum Ratio Combining (MRC) pairs with combining phase/gain signals across receiver antennas at the AP to boost uplink SNR.

Dynamic Frequency Selection (DFS) enforces active radar signal monitoring on U-NII-2 5 GHz channels. BSS Coloring uses a 6-bit identifier in 802.11ax PHY headers to differentiate overlapping service sets and optimize clear channel assessment. OFDMA partitions channels into Resource Units (RUs) for simultaneous multi-user transmissions. Maximum Ratio Combining (MRC) is a receive-side diversity mechanism that combines signal inputs across multiple antennas to boost uplink SNR.

Step-by-Step Solution

Analyze regulatory frequency requirements for DFS.

DFS is strictly required in the 5 GHz U-NII-2/2E bands to prevent interference with radar systems, forcing APs to listen and change channels dynamically.

Regulatory compliance mandates non-interference with priority radar signals.

Evaluate high-density spatial reuse features in 802.11ax for BSS Coloring.

BSS Coloring uses a 6-bit field in the PHY header to mark distinct BSS cells, allowing stations to adjust clear channel assessment (CCA) thresholds.

This reduces medium contention overhead caused by overlapping basic service sets (OBSS).

Examine multi-user channel access methods in modern Wi-Fi standards for OFDMA.

OFDMA divides a 20/40/80 MHz channel into smaller sub-carriers called Resource Units (RUs), enabling simultaneous multi-client scheduling.

Unlike OFDM which serves one user per time slot, OFDMA allows multi-user concurrent subchannel access.

Identify receiver diversity techniques for Maximum Ratio Combining (MRC).

MRC processes signals from multiple receive antennas at the AP level, combining them constructively based on phase alignment.

It improves receiver sensitivity and compensates for low transmit power from mobile client devices.

Key Concept

Advanced Enterprise Wireless Deployment Technologies & Spectrum Regulations

Estimated Time:2m 0s

Question 412Question →

An administrator interconnects three switches—Switch- Alpha, Switch-Beta, and Switch-Gamma—in a redundant triangular loop topology using standard IEEE 802.1D Spanning Tree Protocol (STP). All switches use their factory default configuration settings except for bridge priorities, which are assigned as follows:

• Switch-Alpha: Bridge Priority = 32768, MAC Address = 0011.2233.4455
• Switch-Beta: Bridge Priority = 28672, MAC Address = 0055.4433.2211
• Switch-Gamma: Bridge Priority = 40960, MAC Address = 0000.1111.2222

Which switch will be elected as the STP Root Bridge for the topology?

Switch-Beta, because it has the lowest numerical Bridge Priority value.

Switch-Gamma, because it has the highest numerical Bridge Priority value.

Switch-Gamma, because it possesses the lowest numerical MAC address in the network topology.

Switch-Alpha, because it uses the default Bridge Priority value of 32768.

Show answer & explanation

Answer: Switch-Beta, because it has the lowest numerical Bridge Priority value.

Answer

Switch-Beta will be elected as the Root Bridge because it possesses the lowest overall Bridge ID, determined primarily by having the lowest numerical Bridge Priority value (28672).

In 802.1D Spanning Tree Protocol, the Root Bridge election compares the Bridge ID (BID) of each switch in the network. The BID is composed of Bridge Priority and MAC Address. The switch with the lowest overall numerical BID becomes the Root Bridge. Priority is evaluated first; because Switch-Beta is configured with a priority of 28672—which is numerically lower than 32768 (Switch-Alpha) and 40960 (Switch-Gamma)—it wins the election immediately.

Step-by-Step Solution

Examine the components of the Spanning Tree Protocol Bridge ID (BID).

The BID consists of a 2-byte Bridge Priority concatenated with a 6-byte MAC Address (Bridge ID = Priority + MAC Address).

STP uses the total BID value to elect the Root Bridge, where the lowest numerical value wins.

Compare the configured Bridge Priority values across all switches.

Switch-Alpha has a priority of 32768, Switch-Beta has a priority of 28672, and Switch-Gamma has a priority of 40960.

Bridge Priority is evaluated first before checking MAC addresses.

Identify the switch with the lowest numerical Bridge Priority.

Switch-Beta has the lowest priority (28672 < 32768 < 40960) and is elected Root Bridge without needing a MAC address tiebreaker.

Lower numerical values represent higher priority in standard 802.1D STP root bridge elections.

Key Concept

STP Root Bridge Election Mechanics

Question 413Question →

A senior network engineer is designing a high-density enterprise WLAN deployment supporting diverse legacy and high-performance real-time applications across multiple frequency bands. Match each IEEE wireless standard or deployment mechanism on the left with its precise operational constraint or physical layer (PHY) capability on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

802.11ax OFDMA matches channel division into Resource Units across 2.4 GHz and 5 GHz bands. 802.11ac Wave 2 MU-MIMO matches downlink-only multi-user streams operating exclusively in 5 GHz. 802.11n Greenfield mode matches eliminating legacy preambles to optimize throughput without backward compatibility. 802.11a legacy PHY matches 5 GHz OFDM operation across 20 MHz channels achieving up to 54 Mbps.

The correct matches accurately differentiate between frequency spectrum constraints, multi-user transmission mechanisms (OFDMA vs MU-MIMO), frame preamble modes (Greenfield), and legacy OFDM channel characteristics across IEEE 802.11 wireless deployment standards.

Step-by-Step Solution

Analyze 802.11ax (Wi-Fi 6) key physical layer mechanisms

Identify that 802.11ax introduces OFDMA, which allocates subcarriers into Resource Units (RUs) for parallel bi-directional transmission across 2.4 GHz and 5 GHz spectrums.

OFDMA is the hallmark channelization technique of 802.11ax for multi-user efficiency.

Evaluate 802.11ac Wave 2 capabilities and constraints

Confirm 802.11ac operates exclusively in 5 GHz and introduces downlink-only MU-MIMO capability.

802.11ac does not support 2.4 GHz operation nor uplink MU-MIMO (which was added later in 802.11ax).

Examine 802.11n Greenfield preamble framing

Recognize that Greenfield mode strips out legacy 802.11a/b/g headers to eliminate frame overhead at the cost of legacy station compatibility.

High-Throughput (HT) Greenfield mode assumes zero legacy devices exist on the wireless cell.

Verify 802.11a legacy operational specifications

Match 802.11a to its native 5 GHz OFDM specification using 20 MHz wide channels up to 54 Mbps.

802.11a was the first 5 GHz OFDM implementation operating with 20 MHz channel widths.

Key Concept

Wireless Standards and Physical Layer (PHY) Capabilities

Question 414Question →

A network engineer is setting up an edge router for a small office with only a single public IPv4 address assigned to its WAN interface. The office contains 40 internal hosts on the $192.168.1.0/24$ subnet that require outbound internet connectivity. Simultaneously, an internal web server at $192.168.1.50$ must be reachable from external clients on HTTPS port $443$ . Which of the following address translation strategies correctly satisfies both requirements using the single WAN IPv4 address?

Implement Port Address Translation (PAT) for the internal host subnet while configuring a static port redirection (Port Forwarding) entry for port

443

to target internal address

192.168.1.50

Assign a 1:1 Static NAT mapping to the internal web server and configure Dynamic NAT without overload for the remaining 40 internal workstations.

Configure Layer 2 MAC Address Translation to bridge the internal web server to the WAN interface while running Static NAT on destination port

80

for workstation internet access.

Deploy Port Address Translation (PAT) restricted strictly to Layer 3 IP headers, translating destination port

22

to direct external HTTPS connections to the internal server.

Show answer & explanation

Answer: Implement Port Address Translation (PAT) for the internal host subnet while configuring a static port redirection (Port Forwarding) entry for port $443$ to target internal address $192.168.1.50$ .

Answer

Implement Port Address Translation (PAT) for the internal subnet alongside static port forwarding for port 443 to host 192.168.1.50.

Port Address Translation (PAT), also known as NAT Overload, enables multiple private IP hosts to share a single public IPv4 address by mapping outbound connections to distinct Layer 4 source ports. To allow external traffic to initiate a connection inward to a specific internal server using that same shared public IP, static port forwarding must be configured for the specific service port (HTTPS port 443).

Step-by-Step Solution

Analyze public IP address constraints

Only one public IPv4 address is available on the WAN interface.

Because multiple internal hosts need internet access using a single public IP address, Port Address Translation (PAT / NAT Overload) must be used to multiplex outbound sessions using unique source port numbers.

Determine inbound access requirements for the web server

Inbound HTTPS traffic target port is 443 assigned to internal IP 192.168.1.50.

To allow external clients to initiate connections to an internal server sharing a single public IP, a static PAT entry (port forwarding) must be configured to direct incoming traffic arriving on destination port 443 to the internal IP.

Combine translation rules into a unified implementation

Dynamic PAT handles outbound host traffic while Static PAT handles inbound HTTPS traffic.

This combination successfully meets both requirements without requiring additional public IPv4 addresses.

Key Concept

Port Address Translation (PAT) and Static Port Forwarding

Estimated Time:1m 15s

Question 415Question →

A network systems administrator is troubleshooting name resolution issues after enabling DNSSEC on an enterprise authoritative DNS server. Internal client stub resolvers successfully resolve standard small $A$ record queries, but fail with $SERVFAIL$ errors when querying domain names that return large responses containing multiple $RRSIG$ and $DNSKEY$ records. A diagnostic check with `dig +dnssec +ignore` succeeds over UDP, but standard `dig +dnssec` fails when payload size exceeds the 512-byte limit and truncation occurs.

An audit of the network firewall logs reveals the following blocked log entries:

`DROP OUTBOUND SRC=192.168.10.25 DST=198.51.100.53 PROTO=TCP SPT=49152 DPT=53`

Which of the following actions should the administrator take to permanently resolve this name resolution failure?

Configure the network firewall to permit outbound traffic from the internal DNS server to external authoritative servers on TCP port 53.

Reconfigure the internal DNS resolvers to forward all DNSSEC validation requests to port 853 using DNS over TLS (DoT).

Modify the zone file records to replace all DNSKEY records with standard CNAME aliases to reduce packet payload size below 512 bytes.

Disable EDNS0 on the DNS server so that all truncated packets are automatically converted into UDP broadcast frames.

Show answer & explanation

Answer: Configure the network firewall to permit outbound traffic from the internal DNS server to external authoritative servers on TCP port 53.

Answer

The administrator must update firewall rules to allow outbound TCP port 53 traffic from the internal DNS server to remote DNS servers.

DNS uses UDP port 53 for normal queries under 512 bytes. However, when responses (such as those carrying DNSSEC records like

RRSIG

and

DNSKEY

) exceed the maximum buffer size, the DNS server sets the TC (Truncation) bit. The client or recursive resolver must immediately retry the query over TCP port 53. Because the firewall was dropping outbound TCP port 53 packets, truncated DNSSEC queries timed out and caused

SERVFAIL

errors.

Step-by-Step Solution

Analyze the diagnostic command behavior and firewall log output.

Standard UDP DNS traffic succeeds, but truncated DNSSEC responses requiring fallback fail because TCP port 53 outbound packets are dropped by the firewall.

DNS relies primarily on UDP port 53 for standard queries under 512 bytes (or up to EDNS0 buffer limits), but automatically requires TCP port 53 when the response payload has the Truncation (TC) bit set.

Evaluate protocol requirements for DNSSEC payload delivery.

DNSSEC responses containing cryptographic signatures (

RRSIG

) frequently exceed 512 bytes and require TCP fallback to transmit complete data streams reliably.

Without TCP port 53 permitted through stateful firewalls, any truncated DNS query fails, producing

SERVFAIL

on validating resolvers.

Select the appropriate resolution step.

Allowing TCP port 53 outbound on the network firewall enables resolvers to establish TCP sessions for truncated DNSSEC queries.

This maintains complete compliance with RFC 5966 and restores normal DNSSEC resolution functionality.

Key Concept

DNS Transport Layer Mechanics (UDP vs TCP Port 53)

Estimated Time:2m 0s

Question 416Question →

A network engineer is provisioning a high-availability database cluster across a single network segment. The segment is assigned the IPv4 address block $10.250.32.0/20$ . How many total usable host IPv4 addresses are available for assignable endpoints in this subnet?

Show answer & explanation

Answer: 4094

Answer

4094 usable host IPv4 addresses

For a /20 prefix length, there are 12 host bits available (32 - 20 = 12). The total number of IP addresses is 2^12 = 4096. Subtracting 2 for the reserved network ID and broadcast address gives 4094 usable host IP addresses.

Step-by-Step Solution

Calculate the number of host bits in the CIDR prefix /20

12 host bits (32 - 20 = 12)

An IPv4 address consists of 32 total bits; subtracting the prefix length yields the bits allocated for host addressing.

Calculate the total size of the address block

4096 total addresses (2^12 = 4096)

The number of total addresses in a subnet is calculated using 2 raised to the power of the host bits.

Subtract the non-assignable network and broadcast addresses

4094 usable host addresses (4096 - 2 = 4094)

The first address (network ID) and the last address (directed broadcast) are reserved and cannot be assigned to host interfaces.

Key Concept

Calculating usable IPv4 host addresses from a CIDR prefix length

Question 417Question →

A network administrator is evaluating the converged state of an enterprise network running standard IEEE 802.1D Spanning Tree Protocol (STP) across multiple interconnected switches. Which of the following statements correctly describe port roles and operational behavior in a fully converged 802.1D STP topology? (Select TWO.)

Select all that apply

Every non-root switch elects exactly one Root Port, which is the local port providing the lowest cumulative path cost to the Root Bridge.

During root bridge election, switches select the device with the highest numerical Bridge Priority value as the Root Bridge.

Each active network segment selects one Designated Port, which forwards traffic downstream away from the Root Bridge.

Trunk links with native VLAN mismatches bypass standard STP timer states to immediately isolate broadcast loops.

If two switches share the default Bridge Priority value, the switch with the higher MAC address wins the Root Bridge election.

Show answer & explanation

Answer: Every non-root switch elects exactly one Root Port, which is the local port providing the lowest cumulative path cost to the Root Bridge.; Each active network segment selects one Designated Port, which forwards traffic downstream away from the Root Bridge.

Answer

The correct statements are that every non-root switch elects exactly one Root Port offering the lowest cumulative path cost to the Root Bridge, and that each active network segment selects one Designated Port to forward traffic downstream.

In standard 802.1D STP, every non-root switch must select exactly one Root Port based on the lowest cumulative root path cost. Additionally, every active network segment between switches must select one Designated Port to handle forwarding for that segment without creating loops.

Step-by-Step Solution

Analyze Root Port selection criteria in standard STP.

Confirm that each non-root switch designates exactly one interface facing the Root Bridge with the minimum cumulative path cost as its Root Port.

Root Ports establish the single active path from non-root switches back to the Root Bridge.

Analyze Designated Port selection across network segments.

Confirm that each network segment (link) has exactly one Designated Port placed in the Forwarding state.

Designated Ports handle frame transmission away from the Root Bridge onto individual LAN segments.

Evaluate root bridge election tiebreaker and priority logic to rule out incorrect options.

STP always prefers lower numerical values for both Bridge Priority and MAC address.

Higher numerical priority values or MAC addresses lose the Root Bridge election.

Key Concept

Spanning Tree Protocol Port Roles and Election Logic

Question 418Question →

A network administrator is designing an enterprise wireless network to mitigate co-channel interference, satisfy regulatory spectrum requirements, and optimize airtime efficiency in high-density environments. Match each wireless deployment mechanism on the left with its primary function or operational requirement on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Dynamic Frequency Selection (DFS) matches with monitoring 5 GHz channels for radar signals; BSS Coloring matches with adding numerical identifiers to frames to differentiate overlapping service sets; OFDMA matches with subdividing channels into Resource Units for simultaneous transmissions; and Transmit Power Control (TPC) matches with adjusting access point output wattage to prevent co-channel interference.

Dynamic Frequency Selection (DFS) is designed specifically for radar detection and channel switching in the 5 GHz band. BSS Coloring marks frame headers with identifiers to mitigate co-channel contention in high-density deployments. OFDMA splits frequency channels into sub-channels (Resource Units) for parallel client transmissions. Transmit Power Control (TPC) regulates AP output power to shrink or expand cell boundaries, mitigating signal overlap.

Step-by-Step Solution

Analyze regulatory frequency control mechanisms.

Identify that Dynamic Frequency Selection (DFS) is mandatory on specific 5 GHz channels to prevent interference with radar systems.

DFS continuously monitors for radar pulses and shifts the access point to an alternative channel if radar activity is detected.

Analyze high-density spatial reuse technologies introduced in Wi-Fi 6.

Connect BSS Coloring to adding spatial tags/colors to frame headers.

BSS Coloring allows access points operating on identical frequencies to recognize frames from neighboring networks as foreign, allowing them to adjust carrier sense thresholds and transmit without waiting unnecessarily.

Examine multi-user channel access methods.

Match OFDMA to sub-channel division into Resource Units (RUs).

OFDMA enables multi-user communication by allocating discrete subcarriers within a channel to different client devices simultaneously.

Evaluate cell sizing and power management techniques.

Link Transmit Power Control (TPC) to access point power output adjustments.

TPC regulates radio transmission power to keep coverage cells tightly bounded, avoiding signal bleed into adjacent access point cells operating on the same channel.

Key Concept

Enterprise Wireless Deployment Mechanisms and Channel Management Techniques

Question 419Question →

A network administrator is troubleshooting an issue where internal workstation clients can resolve standard internal hostnames, but fail when attempting to query external DNSSEC-signed domains that return large response payloads exceeding 512 bytes. Packet captures reveal that the external DNS server sends a response with the TrunCation (TC) flag set over UDP port $53$ , after which the client's automated follow-up attempt fails completely. Which firewall configuration issue is most likely causing this name resolution failure?

Outbound and inbound TCP traffic on port 53 is blocked by the firewall.

Outbound and inbound UDP traffic on port 53 is blocked by the firewall.

UDP port 5353 traffic is blocked, preventing Multicast DNS (mDNS) fallback resolution.

The external domain host is missing an AAAA record required for large packet handling.

Show answer & explanation

Answer: Outbound and inbound TCP traffic on port 53 is blocked by the firewall.

Answer

The firewall is blocking outbound and inbound TCP traffic on port 53, preventing the client from falling back to TCP after receiving a truncated UDP DNS response.

Standard DNS operations use UDP port 53 for fast, stateless queries. However, when a DNS answer exceeds the standard byte limit (512 bytes without EDNS0 extensions, common with DNSSEC records), the server sets the TC (TrunCation) flag bit in the DNS response header. This instructs the client stub resolver to establish a TCP connection over port 53 to re-issue the query and receive the full answer. If a security firewall allows UDP port 53 but blocks TCP port 53, the client receives the truncated UDP response but fails to complete the subsequent TCP lookup.

Step-by-Step Solution

Analyze the observed behavior in the packet capture.

The DNS server sets the TC (TrunCation) header bit in the UDP port 53 response.

The response payload (such as DNSSEC keys/signatures) exceeds the single UDP packet payload threshold.

Determine the standard DNS protocol behavior upon receiving a truncated response.

The client resolver must switch from UDP port 53 to TCP port 53 to establish a reliable stream for the complete DNS answer.

TCP supports payload segmentation and reliable delivery without arbitrary size limits inherent to basic UDP DNS frames.

Identify why the follow-up request fails.

The firewall blocks TCP port 53 traffic, interrupting the TCP three-way handshake required to complete the query.

DNS relies on both UDP port 53 for standard queries and TCP port 53 for truncated responses and zone transfers.

Key Concept

DNS Protocol Selection (UDP vs TCP Port 53) and Truncation (TC Bit)

Question 420Question →

Match each enterprise wireless deployment scenario on the left with its corresponding deployment methodology or architectural standard on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Connecting separate buildings over 800m matches Point-to-Point (PTP) Wireless Bridge; CAPWAP frame handling matches Split-MAC Architecture; blueprint attenuation modeling matches Predictive Wireless Site Survey; 802.11ax BSS Coloring/OFDMA matches High-Density Spatial Reuse and Frequency Division.

Each enterprise scenario aligns directly with its technical deployment standard: PTP bridging solves inter-building link constraints without cabling, Split-MAC separates real-time and control MAC functions across LAPs and central controllers, predictive surveys simulate RF coverage on CAD floor plans prior to installation, and 802.11ax spatial reuse features (BSS Coloring and OFDMA) optimize channel efficiency in high-density environments.

Step-by-Step Solution

Analyze the requirement for linking two separate physical structures across 800 meters of public space.

Identified Point-to-Point (PTP) wireless bridging as the required technology.

Connecting distinct facilities without trenching fiber cabling requires a point-to-point wireless bridge fitted with narrow-beam directional antennas.

Evaluate the separation of real-time MAC functions from centralized WLC control functions via CAPWAP tunnels.

Identified the Split-MAC architectural model.

Split-MAC decouples real-time wireless frame handling (performed by lightweight APs) from centralized management, authentication, and policy enforcement (handled by the controller).

Examine pre-installation signal propagation modeling using CAD blueprints and attenuation values.

Identified the predictive site survey methodology.

Predictive modeling uses software algorithms to simulate RF attenuation across walls and obstacles prior to physical equipment mounting.

Assess high-density 802.11ax enhancements (BSS Coloring and OFDMA).

Identified spatial reuse and frequency division techniques.

802.11ax utilizes BSS Coloring to override legacy co-channel clear channel assessment thresholds and OFDMA to segment channel bandwidth into discrete subcarriers for multi-user throughput.

Key Concept

Wireless Network Architecture, Site Survey Methodologies, and 802.11 High-Density Deployment Standards

PreviousPage 21 / 22Next

Network Implementation

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept