Examkin

Network Implementation

424 questions

All types424Multiple choice220Multiple select80Numeric11Matching53Ordering42Short answer18
Question 41Question →

A network engineer is troubleshooting high latency and packet retransmissions in a densely populated multi-tenant office building. A site survey reveals that four adjacent enterprise access points (APs) in the 5 GHz spectrum were all configured with 80 MHz channel bonding using channels 36, 40, 44, and 48 (UNII-1 band). Because these four 20 MHz sub-channels comprise a single 80 MHz bonded channel, all four access points are competing for the exact same frequency space. Which of the following channel management strategies should the engineer implement to eliminate co-channel interference while maintaining distinct, non-overlapping channels for each access point?

Show answer & explanation

Answer: Reduce the channel width of each access point from 80 MHz to 20 MHz and assign distinct channels 36, 40, 44, and 48 across the four access points.

Answer

Reduce the channel width of each access point from 80 MHz to 20 MHz and assign distinct channels 36, 40, 44, and 48 across the four access points.
Reducing the channel width from 80 MHz to 20 MHz separates the single wide channel into four independent, non-overlapping 20 MHz channels (36, 40, 44, and 48). Assigning one distinct 20 MHz channel to each access point completely eliminates co-channel interference (CCI) and resolves contention issues.

Step-by-Step Solution

1
Analyze the existing channel allocation and spectrum usage.
The four access points are operating on an 80 MHz channel width that spans channels 36, 40, 44, and 48 simultaneously, forcing all four APs into the same collision domain.
When channels are bonded into an 80 MHz width, the individual 20 MHz sub-channels no longer function independently.
2
Evaluate channel width modification to create non-overlapping frequency spaces.
Reducing the channel width to 20 MHz yields four individual, non-overlapping channels (36, 40, 44, and 48) in the 5 GHz UNII-1 band.
Operating each AP on a dedicated 20 MHz channel eliminates co-channel contention and allows simultaneous transmissions.

Key Concept

5 GHz Channel Bonding and Co-Channel Interference Mitigation
Question 42Question →

During a routine wireless inspection, a technician discovers that an access point positioned between two existing access points operating on channels 1 and 6 has been configured to use channel 4, resulting in severe adjacent-channel interference. Which channel should be assigned to this access point to ensure all three access points use non-overlapping channels in the 2.4 GHz band?

Show answer & explanation

Answer: Channel 11

Answer

Channel 11 is the correct choice because channels 1, 6, and 11 are the standard non-overlapping channels in the 2.4 GHz wireless spectrum for North America.
In the 2.4 GHz Wi-Fi spectrum, channels 1, 6, and 11 are the standard non-overlapping channels available in North America. Because the neighboring access points are already deployed on channels 1 and 6, configuring the intermediate access point to channel 11 eliminates adjacent-channel interference.

Step-by-Step Solution

1
Identify the standard non-overlapping 2.4 GHz channels in North America.
The primary non-overlapping channels are channels 1, 6, and 11.
Each standard 2.4 GHz Wi-Fi channel occupies 22 MHz of bandwidth with 5 MHz spacing between channel centers, requiring a minimum gap of 5 channels to avoid spectral overlap.
2
Determine which non-overlapping channel remains unused among the three access points.
With access points already operating on channels 1 and 6, channel 11 is the only remaining non-overlapping option.
Selecting channel 11 isolates the access point's frequency band from channels 1 and 6, resolving adjacent-channel interference.

Key Concept

2.4 GHz Wireless Non-Overlapping Channel Assignment
Estimated Time:45s
Question 43Question →

A network engineer is configuring address translation policies on an enterprise edge firewall. Match each specific technical mapping requirement on the left with its corresponding address translation implementation type on the right.

Click a left item, then click its matching right item

Items

Providing a permanent, one-to-one mapping between a private IP address of an internal web server (10.1.10.5010.1.10.50) and a dedicated public IP address (203.0.113.50203.0.113.50).
Allowing 200 internal workstations on a private subnet (192.168.1.0/24192.168.1.0/24) to access external resources simultaneously using a single public IP address (203.0.113.1203.0.113.1).
Mapping internal hosts on demand to available external IP addresses from a pre-allocated public address pool (203.0.113.100−203.0.113.110203.0.113.100 - 203.0.113.110) without port modification.
Redirecting inbound traffic sent to an external public IP on port 8080 (203.0.113.20:8080203.0.113.20:8080) to an internal database management interface (10.1.10.20:8010.1.10.20:80).

Matches

Show answer & explanation

Answer

Static NAT pairs with permanent 1-to-1 server mapping; Port Address Translation (PAT / NAT Overload) pairs with many workstations sharing a single public IP address; Dynamic NAT pairs with mapping hosts to a pool of public IP addresses on demand; Port Forwarding (Static PAT) pairs with redirecting a specific external port to an internal IP address and port.
Each NAT implementation serves a distinct networking use case: Static NAT provides a fixed 1-to-1 mapping for external server accessibility; PAT multiplexes multiple private IP addresses onto one public IP using Layer 4 port tracking; Dynamic NAT draws 1-to-1 public IP mappings temporarily from a pool; and Port Forwarding directs specific inbound external port traffic to an internal target host.

Step-by-Step Solution

1
Analyze the requirement for a permanent 1-to-1 server mapping
Identified Static NAT as the fixed one-to-one mapping mechanism required for public inbound access.
Static NAT maintains a persistent mapping between one private IP and one public IP.
2
Analyze the requirement for multiple workstations sharing a single public IP
Identified PAT (Port Address Translation / NAT Overload) as the solution.
PAT differentiates connections from multiple internal hosts sharing one IP by assigning unique Layer 4 source ports.
3
Analyze the requirement for on-demand allocation from a public IP pool without port translation
Identified Dynamic NAT as the matching translation mechanism.
Dynamic NAT allocates a public IP address from a defined pool to an internal host for the active session length.
4
Analyze the requirement for redirecting inbound traffic on a specific port to an internal IP and port
Identified Port Forwarding (Static PAT) as the solution.
Port Forwarding routes specific incoming public socket requests (IP:Port) to an internal host's designated socket.

Key Concept

NAT and PAT Implementation Types and Selection Criteria
Estimated Time:1m 30s
Question 44Question →

During a security compliance audit of network documentation, a systems engineer needs to standardize an abridged IPv6 address into its complete 128-bit explicit form.

What is the fully expanded, uncompressed representation of the IPv6 address 2001:db8:40::ae0:12?

Show answer & explanation

Answer: 2001:0db8:0040:0000:0000:0000:0ae0:0012; 2001:0DB8:0040:0000:0000:0000:0AE0:0012

Answer

2001:0db8:0040:0000:0000:0000:0ae0:0012
Expanding a compressed IPv6 address requires expanding each block to four hexadecimal digits by restoring omitted leading zeros and replacing the double colon (::) with the required number of 0000 blocks to reach a total of 8 blocks. The address 2001:db8:40::ae0:12 contains 5 explicit blocks (2001, 0db8, 0040, 0ae0, 0012), meaning the double colon represents 3 contiguous zero blocks (0000:0000:0000), producing 2001:0db8:0040:0000:0000:0000:0ae0:0012.

Step-by-Step Solution

1
Count the explicit 16-bit fields present in the compressed address.
There are 5 explicit fields specified: '2001', 'db8', '40', 'ae0', and '12'.
An IPv6 address always consists of 8 total 16-bit fields.
2
Determine the number of missing zero fields represented by the double colon (::).
8 total fields - 5 explicit fields = 3 missing consecutive zero fields (0000:0000:0000).
The double colon symbol expands to fill all omitted 16-bit zero blocks so the address reaches exactly 8 fields.
3
Pad each explicit field with leading zeros to complete 4 hexadecimal digits per field.
'2001' remains '2001', 'db8' becomes '0db8', '40' becomes '0040', 'ae0' becomes '0ae0', and '12' becomes '0012'.
RFC 5952 zero-suppression removes leading zeros within a block, which must be restored during full expansion.
4
Assemble all 8 expanded fields separated by colons.
2001:0db8:0040:0000:0000:0000:0ae0:0012
Combining the padded explicit blocks and the expanded zero blocks yields the full 39-character 128-bit uncompressed IPv6 address.

Key Concept

IPv6 Address Uncompression and Structure Standards
Question 45Question →

A network administrator configures interface GigabitEthernet0/2 on switch SW-CORE-01 as an 802.1Q trunk with the following commands:

text
interface GigabitEthernet0/2
switchport mode trunk
switchport trunk native vlan 50
switchport trunk allowed vlan 10,20,30

Which of the following describes how switch SW-CORE-01 will handle an incoming untagged Ethernet frame received on interface GigabitEthernet0/2?

Show answer & explanation

Answer: The switch drops the incoming untagged frame because native VLAN 50 is not present in the trunk's allowed VLAN list.

Answer

The switch drops the incoming untagged frame because native VLAN 50 is not present in the trunk's allowed VLAN list.
On an IEEE 802.1Q trunk link, any untagged Ethernet frame received by a switchport is associated with the native VLAN configured on that port (in this case, VLAN 50). However, the `switchport trunk allowed vlan` command acts as a strict VLAN filter on both ingress and egress. Because VLAN 50 is omitted from the allowed VLAN list (`10,20,30`), the switch filters out VLAN 50 traffic, causing the incoming untagged frame to be dropped immediately.

Step-by-Step Solution

1
Identify how untagged frames are classified on an 802.1Q trunk.
The frame is mapped to the port's configured native VLAN, which is VLAN 50.
IEEE 802.1Q trunking assigns untagged incoming frames to the native VLAN designated on that switchport.
2
Evaluate the allowed VLAN list configured on the interface.
The allowed list is explicitly constrained to VLANs 10, 20, and 30.
The command `switchport trunk allowed vlan 10,20,30` restricts ingress and egress traffic on the trunk to only those specified VLANs.
3
Determine the switch processing decision for VLAN 50 traffic.
The frame is dropped at the ingress interface.
If the native VLAN is excluded from the allowed VLAN pruning list, ingress untagged frames assigned to that native VLAN cannot traverse the trunk and are discarded.

Key Concept

802.1Q Native VLAN Ingress Filtering & Allowed VLAN Interaction
Question 46Question →

A network engineer is configuring a Layer 3 gateway router to forward broadcast DHCP discovery messages from client devices in VLAN 40 (192.168.40.0/24) to a centralized DHCP server located at 10.200.10.50. On which interface must the helper address command (`ip helper-address 10.200.10.50`) be applied for the router to intercept client broadcasts and forward them as unicast packets?

Show answer & explanation

Answer: The inbound Layer 3 interface (SVI or subinterface) serving as the default gateway for VLAN 40

Answer

The helper address must be configured on the inbound Layer 3 interface (SVI or subinterface) serving as the default gateway for VLAN 40.
DHCP client requests (DISCOVER and REQUEST) are sent as Layer 2 broadcast frames to the local default gateway. To relay these messages across router boundaries to a centralized server, the DHCP relay command (such as `ip helper-address`) must be placed directly on the client-facing Layer 3 interface (SVI or router subinterface). When configured here, the gateway intercepts the broadcast, inserts its own interface IP into the gateway IP address (giaddr) field, and unicasts the request to the central server.

Step-by-Step Solution

1
Identify the ingress gateway interface for client broadcast traffic
DHCP Discover packets originate on VLAN 40 as local Layer 2 broadcasts targeting UDP port 67.
Routers drop broadcast packets by default unless a relay agent is configured on the client-facing gateway interface.
2
Configure the DHCP relay agent on the client-facing Layer 3 interface
The router intercepts local DHCP broadcasts on VLAN 40 and encapsulates them into unicast IP packets addressed to 10.200.10.50.
The gateway interface injects its own IP address into the relay agent IP address (giaddr) field of the DHCP packet header so the DHCP server knows which scope to allocate from.

Key Concept

DHCP Relay Agent Interface Placement and Broadcast-to-Unicast Forwarding
Estimated Time:1m 30s
Question 47Question →

A network administrator is configuring an IEEE 802.1Q trunk link between two switches in an enterprise building. Which of the following statements correctly describe the standard operational behavior of 802.1Q trunking and native VLANs on this interconnect? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: 802.1Q trunking inserts a 4-byte tag into the Ethernet frame header to identify traffic belonging to non-native VLANs.; Untagged Ethernet frames received on an 802.1Q trunk port are implicitly assigned to the native VLAN configured on that port.

Answer

802.1Q trunking inserts a 4-byte tag into non-native VLAN Ethernet headers, and untagged frames arriving on a trunk port are implicitly assigned to the configured native VLAN.
IEEE 802.1Q defines trunking behavior by tagging frames with a 4-byte header for non-native VLANs while sending native VLAN frames without tags, allowing the receiving switch port to map untagged ingress frames to its local native VLAN.

Step-by-Step Solution

1
Analyze frame tagging mechanisms under IEEE 802.1Q.
IEEE 802.1Q adds a 4-byte field containing Tag Protocol Identifier (TPID) and Tag Control Information (TCI) to preserve VLAN identity across trunk links for non-native VLANs.
This tag allows switches on both ends of the trunk link to multiplex multiple VLANs over a single physical link.
2
Analyze native VLAN default processing behavior.
Native VLAN frames travel across the trunk link untagged. The receiving trunk port automatically assigns untagged frames to its configured native VLAN.
This behavior maintains backward compatibility with non-VLAN-aware legacy equipment.
3
Evaluate distractor claims against Layer 2 isolation and native VLAN mismatch symptoms.
VLANs strictly isolate Layer 2 broadcast domains, requiring a Layer 3 router for inter-VLAN forwarding. Furthermore, native VLAN mismatches cause traffic leakage into the mismatched VLAN rather than dropping tagged traffic.
Correctly identifying Layer 2 boundaries and trunk mismatch behaviors confirms the valid options.

Key Concept

802.1Q Frame Tagging and Native VLAN Processing
Question 48Question →

Match each VLAN configuration concept or 802.1Q trunking parameter on the left with its corresponding operational behavior or frame-handling mechanism on the right.

Click a left item, then click its matching right item

Items

Native VLAN Configuration
802.1Q Header Tagging
Trunk Allowed VLAN List
Voice VLAN Feature

Matches

Show answer & explanation

Answer

Native VLAN Configuration corresponds to designating the VLAN context used for untagged traffic. 802.1Q Header Tagging corresponds to inserting a 4-byte field containing a 12-bit VLAN Identifier (VID). Trunk Allowed VLAN List corresponds to restricting traffic forwarding exclusively to explicitly permitted VLAN IDs. Voice VLAN Feature corresponds to allowing an interface to carry tagged VoIP traffic while maintaining untagged data traffic.
Each trunking concept is correctly matched to its defined network behavior: Native VLAN manages untagged trunk traffic, 802.1Q header tagging adds the 4-byte frame modifier with 12-bit VID, the trunk allowed list filters permitted VLAN IDs across links, and Voice VLAN enables dual tagged/untagged traffic handling on access ports.

Step-by-Step Solution

1
Analyze Native VLAN functionality on 802.1Q trunks
Identified that native VLAN handles untagged frame transmission across trunks.
By default in 802.1Q, frames belonging to the native VLAN are sent across trunk links without adding an 802.1Q header tag.
2
Analyze 802.1Q tagging structure
Identified the 4-byte insertion containing the 12-bit VID.
IEEE 802.1Q modifies the Ethernet frame by inserting a 4-byte tag field between the Source MAC Address and EtherType fields.
3
Analyze allowed VLAN list configuration
Identified trunk filtering behavior based on permitted VLAN IDs.
By default, trunks permit VLANs 1-4094; configuring an allowed list explicitly restricts which VLAN broadcast domains extend across the link.
4
Analyze Voice VLAN operational model
Identified dual-VLAN behavior on access ports supporting IP phones.
Voice VLAN allows single physical access ports to separate real-time tagged voice traffic from untagged desktop data traffic.

Key Concept

802.1Q Trunking Protocols and Port Characteristics
Question 49Question →

An enterprise network engineer is troubleshooting an issue where hosts on a private subnet (10.10.0.0/2410.10.0.0/24) experience intermittent outbound connection failures when accessing external cloud resources. The perimeter firewall is configured to perform Port Address Translation (PAT) using a single public IP address (203.0.113.5203.0.113.5). Diagnostic logs indicate that while active web sessions function normally, new outbound TCP connections fail during peak traffic periods because all available high-numbered ephemeral source ports on the gateway's public address are fully allocated. Which configuration change should the engineer implement on the firewall to resolve this session scaling issue while preserving private internal IP addressing?

Show answer & explanation

Answer: Configure a PAT address pool containing multiple public IP addresses to expand the available Layer 4 source port capacity.

Answer

Configure a PAT address pool containing multiple public IP addresses to expand the available Layer 4 source port capacity.
Port Address Translation (PAT) enables multiple private IP addresses to share public IP space by overloading unique Layer 4 source port numbers. When high connection volume exhausts all available ephemeral ports on a single public IP address, introducing a pool of public IP addresses allows PAT to dynamically distribute outbound sessions across multiple public IPs, successfully multiplying session capacity.

Step-by-Step Solution

1
Analyze the diagnostic log output to identify the root cause of connection failures.
The firewall is experiencing PAT port exhaustion (all ~64,512 high-numbered ephemeral source ports on public IP 203.0.113.5 are in use).
PAT tracks concurrent sessions by pairing private sockets (IP + source port) with public sockets (Public IP + assigned public source port).
2
Select a translation design strategy that expands translation capacity while maintaining private internal IP addressing.
Configuring an IP address pool for PAT allows the NAT device to allocate source ports across multiple public IP addresses (overload pool).
Each additional public IP added to the PAT pool increases total concurrent connection capacity by approximately 65,000 port mappings.

Key Concept

PAT Port Exhaustion & IP Pool Expansion
Question 50Question →

An enterprise network administrator is auditing an organization's authoritative external DNS server configuration following a security compliance review. The audit requires configuring zone replication securely, ensuring proper transport protocol handling for large DNSSEC-signed payloads, and maintaining compliant email sender verification. During diagnostic testing, the administrator executes the following `dig` commands against the primary authoritative name server:

text
$ dig @ns1.example.com example.com AXFR
;; communications error to 192.0.2.10#53: end of file

$ dig @ns1.example.com example.com +dnssec +bufsize=4096
;; Truncation flag (TC) set; retrying over TCP...
;; Query time: 14 msec
;; SERVER: 192.0.2.10#53(192.0.2.10) (TCP)
;; MSG SIZE rcvd: 2840

Based on the diagnostic output and DNS architectural standards, which TWO of the following statements correctly identify the underlying transport requirements and resource record implementations for this environment?

Select all that apply

Show answer & explanation

Answer: Full zone transfers (AXFR) and DNS queries whose responses exceed payload size limits require open TCP port 53 communications through firewalls between involved name servers and clients.; Sender Policy Framework (SPF) records must be published as standard TXT records, as the dedicated SPF record type (Type 99) was deprecated by RFC 7208.

Answer

The two correct statements are: 1) Full zone transfers (AXFR) and DNS responses exceeding payload size limits require open TCP port 53 communications through firewalls, and 2) Sender Policy Framework (SPF) records must be published as standard TXT records due to the deprecation of the dedicated SPF record type.
The correct options accurately state DNS transport requirements and resource record standards. First, DNS uses TCP port 53 both for authoritative zone transfers (AXFR/IXFR) and as a fallback mechanism whenever a response exceeds payload size thresholds (indicated by the TC bit). Second, Sender Policy Framework (SPF) data must be configured within TXT resource records, as the standalone SPF record type (type 99) was officially deprecated.

Step-by-Step Solution

1
Analyze the transport protocol behavior shown in the dig command outputs.
The first dig output demonstrates an attempted AXFR (zone transfer). Zone transfers depend on TCP port 53 to guarantee reliable transmission of the complete zone file. The second dig output highlights the Truncation flag (TC) being set on a large DNSSEC payload, prompting an automatic fallback from UDP to TCP port 53.
Understanding when DNS transitions from UDP to TCP is critical for firewall rule configuration and troubleshooting DNSSEC/zone replication.
2
Evaluate record type specifications for email security standards (SPF and MX).
Sender Policy Framework (SPF) legacy RR type 99 was deprecated under RFC 7208; SPF policies must now reside within standard TXT records. Additionally, MX records must point strictly to canonical host address records (A/AAAA) rather than CNAME aliases.
Proper record creation ensures compliant mail flow and validation without breaking RFC standards.

Key Concept

DNS Transport Protocols (UDP vs TCP 53), Zone Transfers (AXFR/IXFR), and Resource Record Specifications (TXT/SPF, MX, CNAME)
Question 51Question →

A network technician needs to configure a router so that multiple workstations on an internal private network can access external web resources simultaneously using a single public IP address assigned by the ISP. Which address translation technology accomplishes this by assigning unique Layer 4 port numbers to each session?

Show answer & explanation

Answer: Port Address Translation (PAT)

Answer

Port Address Translation (PAT)
Port Address Translation (PAT), often referred to as NAT Overload, enables multiple hosts on a private network to share a single public IP address simultaneously by translating both the IP address and Layer 4 port numbers for outbound connections.

Step-by-Step Solution

1
Analyze the operational requirement
Multiple internal workstations with private addresses need internet access sharing one public IP address.
The ISP has supplied only a single public IP address for all outbound host connections.
2
Identify the tracking mechanism used at Layer 4
Unique source port numbers are combined with the single public IP address.
Translating Layer 4 port numbers allows the router to keep track of individual host sessions on a single IP address.
3
Select the correct NAT implementation
Port Address Translation (PAT) / NAT Overload is selected.
PAT specifically translates private IP addresses and source port numbers to a shared public IP address.

Key Concept

Port Address Translation (PAT) / NAT Overload
Estimated Time:45s
Question 52Question →

An engineer is troubleshooting a newly configured IEEE 802.1Q trunk link on interface `GigabitEthernet 0/2` connecting two switches, `SW-DIST-01` and `SW-ACCESS-01`. Users connected to VLAN 50 report a total loss of inter-switch connectivity, whereas users on VLAN 10 and VLAN 20 experience normal operations across the trunk. The interface configuration on `SW-DIST-01` is shown below:

text
interface GigabitEthernet0/2
switchport mode trunk
switchport trunk native vlan 99
switchport trunk allowed vlan 10,20,99

Which configuration command should the engineer execute on `SW-DIST-01` to restore inter-switch connectivity for VLAN 50?

Show answer & explanation

Answer: switchport trunk allowed vlan add 50

Answer

Execute `switchport trunk allowed vlan add 50` on interface `GigabitEthernet 0/2` to permit VLAN 50 traffic while preserving existing trunked VLANs.
The command `switchport trunk allowed vlan add 50` appends VLAN 50 to the active trunk filter list. Because the current interface explicitly restricts allowed VLANs to 10, 20, and 99, VLAN 50 traffic is dropped until it is explicitly appended to the permitted list.

Step-by-Step Solution

1
Analyze the existing running configuration snippet
The `switchport trunk allowed vlan 10,20,99` line restricts frame transmission across the trunk to only VLANs 10, 20, and 99.
By default, an 802.1Q trunk allows all VLANs (1-4094) unless an allowed VLAN list filter is configured.
2
Identify the cause of traffic dropping for VLAN 50
Frames tagged with VLAN ID 50 arriving at or departing from interface `GigabitEthernet 0/2` are filtered and discarded due to missing authorization in the allowed list.
VLAN 50 is omitted from the current allowed VLAN list.
3
Determine the appropriate CLI syntax modification
Using `switchport trunk allowed vlan add 50` appends VLAN 50 to the existing list (10,20,50,99).
Omitting the `add` keyword would overwrite the entire allowed list and cause outages for VLANs 10 and 20.

Key Concept

802.1Q Trunk Allowed VLAN Filtering
Estimated Time:1m 30s
Question 53Question →

A network engineer connects two enterprise switches, `SW-BuildingA` and `SW-BuildingB`, over interface `GigabitEthernet0/12`. The switchport configurations are as follows:

SW-BuildingA (Gi0/12):
text
switchport mode trunk
switchport trunk native vlan 50
switchport trunk allowed vlan 10,20,50

SW-BuildingB (Gi0/12):
text
switchport mode trunk
switchport trunk native vlan 10
switchport trunk allowed vlan 10,20,30

A host connected to an access port in VLAN 50 on `SW-BuildingA` transmits an untagged broadcast frame destined for its local subnet. Which of the following best describes the processing and flow of this frame as it travels to `SW-BuildingB`?

Show answer & explanation

Answer: SW-BuildingA transmits the frame untagged across the trunk link; SW-BuildingB receives it untagged, classifies it into VLAN 10, and forwards it to VLAN 10 ports.

Answer

SW-BuildingA transmits the frame untagged across the trunk link; SW-BuildingB receives it untagged, classifies it into VLAN 10, and forwards it to VLAN 10 ports.
Under IEEE 802.1Q trunking specifications, frames belonging to the trunk's configured native VLAN are egressed without a VLAN tag header. SW-BuildingA has native VLAN 50 configured, so it transmits the VLAN 50 broadcast frame untagged. Upon receiving an untagged frame on trunk port Gi0/12, SW-BuildingB associates the frame with its own local native VLAN configuration (VLAN 10). Because VLAN 10 is in SW-BuildingB's allowed VLAN list, the frame is accepted and forwarded into VLAN 10, resulting in cross-VLAN traffic leakage.

Step-by-Step Solution

1
Analyze frame egress at SW-BuildingA
The originating host sends an untagged broadcast frame in VLAN 50. Port Gi0/12 on SW-BuildingA has native VLAN set to 50. Under standard IEEE 802.1Q trunking, traffic belonging to the native VLAN is egressed without an 802.1Q VLAN header (untagged).
802.1Q trunking rules dictate that frames matching the interface's native VLAN are sent untagged across the link.
2
Analyze frame ingress at SW-BuildingB
The untagged frame travels across the physical link and arrives at SW-BuildingB interface Gi0/12.
No tag was added by SW-BuildingA during egress.
3
Determine ingress VLAN assignment on SW-BuildingB
SW-BuildingB inspects the incoming frame, sees no 802.1Q tag, and maps the untagged frame to its own configured native VLAN for interface Gi0/12, which is VLAN 10.
When an 802.1Q trunk port receives an untagged frame, it automatically assigns that frame to its local native VLAN.
4
Verify VLAN allowed list processing
VLAN 10 is listed in SW-BuildingB's allowed list (`allowed vlan 10,20,30`), so SW-BuildingB processes the frame and floods it to all active access ports in VLAN 10.
Because VLAN 10 is allowed on SW-BuildingB's trunk, the frame is accepted and forwarded into VLAN 10, leaking traffic between VLAN 50 (Building A) and VLAN 10 (Building B).

Key Concept

IEEE 802.1Q Native VLAN Tagging Behavior and Native VLAN Mismatch Security Risks
Estimated Time:2m 0s
Question 54Question →

An enterprise border router maintains multiple dynamic routing protocols alongside static routes to reach remote subnets. When an incoming IPv4 packet arrives at an ingress interface, the router's decision process evaluates several criteria to select the winning route entry. In what sequential order does the router evaluate these routing criteria to select the path for packet forwarding?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of route selection evaluation is: 1) Filter for matching candidate routes, 2) Apply Longest Prefix Match, 3) Compare Administrative Distance for equal-length prefixes, and 4) Compare protocol metric values for ties within the same protocol.
Router decision engines process route selection in a strict hierarchy: First, candidate routes matching the destination IP are gathered. Next, Longest Prefix Match (LPM) selects the route with the most specific prefix length. If candidate routes have identical prefix lengths from different routing sources, Administrative Distance (AD) determines trustworthiness. Finally, if routes have equal prefix lengths and originate from the same routing protocol, the protocol's internal metric determines the best path.

Step-by-Step Solution

1
Identify matching destinations
Candidate routes matching the destination IP address are identified.
Routing decisions begin by checking which routing table entries match the target IP address.
2
Apply Longest Prefix Match (LPM)
The route with the longest subnet mask is prioritized.
LPM is the primary rule of IP routing; a more specific route (/28) always wins over a less specific route (/24).
3
Evaluate Administrative Distance (AD)
The route from the most trustworthy source is chosen if prefix lengths match.
If equal prefix lengths exist from different sources (e.g., OSPF AD 110 vs EIGRP AD 90), the lower AD wins.
4
Evaluate Protocol Metric
The path with the lowest metric cost is chosen if sources and prefix lengths are identical.
When competing routes come from the same protocol with the same prefix length, metric serves as the final tiebreaker.

Key Concept

Routing Table Selection Hierarchy (Longest Prefix Match -> Administrative Distance -> Metric)
Question 55Question →

A network administrator is assigning subnets for small remote branch offices. Each office requires an IPv4 subnet that can support at least 3030 usable host IP addresses. What is the minimum CIDR prefix length (enter the integer prefix number, such as 24 for a /24/24 subnet) that satisfies this requirement?

Show answer & explanation

Answer: 27

Answer

The minimum CIDR prefix length required to support 30 usable hosts is 27.
To host 30 usable devices, a subnet must provide at least 32 total IP addresses (3030 usable +2+ 2 reserved for network and broadcast). Using the formula 2h≥322^h \ge 32, we find h=5h = 5 host bits are needed. Subtracting 55 host bits from the total 3232 bits in an IPv4 address yields a prefix length of 2727 (a /27/27 subnet).

Step-by-Step Solution

1
Calculate the total number of IP addresses required per subnet including overhead.
30 usable hosts+1 network ID+1 broadcast ID=32 total IP addresses30\text{ usable hosts} + 1\text{ network ID} + 1\text{ broadcast ID} = 32\text{ total IP addresses}.
Every IPv4 subnet requires two reserved IP addresses: one for the network ID and one for the broadcast address.
2
Determine the required host bits (hh).
2h=32  ⟹  h=52^h = 32 \implies h = 5 host bits.
Five host bits provide 25=322^5 = 32 total IP addresses.
3
Calculate the prefix length by subtracting host bits from the total bits in an IPv4 address.
32−5=2732 - 5 = 27.
The prefix length represents the network portion of the address, calculated as 32−h32 - h.

Key Concept

Calculating CIDR Subnet Prefix Length for Host Requirements
Question 56Question →

A network engineer is provisioning an IP subnet for a server pool that requires static assignment for exactly 255255 usable host IP addresses. Which Classless Inter-Domain Routing (CIDR) prefix represents the most space-efficient subnet mask that accommodates all required host addresses?

Show answer & explanation

Answer: /23

Answer

The prefix /23 is the most space-efficient CIDR mask.
To determine the required CIDR prefix, calculate the number of host bits nn such that 2n−2≥2552^n - 2 \ge 255. With 8 host bits (/24 prefix), the usable host capacity is 28−2=2542^8 - 2 = 254, which falls short by 1 host address. Therefore, 9 host bits are required (32−9=/2332 - 9 = /23), providing 29−2=5102^9 - 2 = 510 usable host IP addresses. This is the smallest prefix length (most space-efficient) that satisfies the requirement.

Step-by-Step Solution

1
Determine the required host count formula.
Usable hosts per subnet = 2n−22^n - 2, where nn is the number of host bits.
Two IP addresses in every IPv4 subnet are reserved for the network ID and broadcast address.
2
Evaluate the capacity of a /24 subnet mask.
For /24, host bits n=32−24=8n = 32 - 24 = 8. Usable hosts = 28−2=256−2=2542^8 - 2 = 256 - 2 = 254.
Since 254 usable hosts is less than the required 255, a /24 prefix is insufficient.
3
Evaluate the capacity of a /23 subnet mask.
For /23, host bits n=32−23=9n = 32 - 23 = 9. Usable hosts = 29−2=512−2=5102^9 - 2 = 512 - 2 = 510.
Since 510 usable hosts is greater than or equal to 255, a /23 prefix fulfills the requirement with minimal wasted address space.

Key Concept

IPv4 CIDR Subnetting and Usable Host Calculation
Estimated Time:1m 15s
Question 57Question →

A network technician needs to configure a switch interface that connects to an upstream distribution switch. The link must carry traffic for multiple VLANs concurrently over the single physical link using IEEE 802.1Q tagging. Which interface configuration command must be applied to achieve this functionality?

Show answer & explanation

Answer: switchport mode trunk

Answer

The interface must be configured using `switchport mode trunk` to carry traffic for multiple VLANs over a single physical link.
The command `switchport mode trunk` configures an Ethernet interface to operate as an 802.1Q trunk link, allowing frames from multiple VLANs to be tagged and multiplexed across a single physical link between network devices.

Step-by-Step Solution

1
Identify the requirement for cross-switch link multi-VLAN traffic transport
The link must multiplex frames from multiple broadcast domains using IEEE 802.1Q header tags.
Standard access ports strips or drops tags and belong to only one VLAN.
2
Select the appropriate switchport interface command
Applying `switchport mode trunk` explicitly sets the operational mode to trunking.
Trunk ports inspect 802.1Q tags and pass traffic for all allowed VLANs across the switch interconnect.

Key Concept

VLAN Trunking and 802.1Q Configuration
Question 58Question →

A network administrator is updating the configuration of an IEEE 802.1Q trunk link on interface `GigabitEthernet1/0/48` connecting two switch stacks. The interface currently passes traffic for VLANs 10, 20, and 30. The administrator must permit VLAN 50 across the link without disrupting the traffic of the existing VLANs. Which command should be applied under interface configuration mode to accomplish this requirement?

Show answer & explanation

Answer: switchport trunk allowed vlan add 50

Answer

The command 'switchport trunk allowed vlan add 50' appends VLAN 50 to the existing list of allowed VLANs on an 802.1Q trunk interface without replacing current entries.
The command containing the 'add' parameter appends VLAN 50 to the existing allowed list (VLANs 10, 20, and 30). This allows VLAN 50 traffic to cross the trunk while keeping active production traffic on the existing VLANs uninterrupted.

Step-by-Step Solution

1
Identify the goal for trunk VLAN modification
VLAN 50 must be appended to the allowed VLAN trunk list alongside existing VLANs 10, 20, and 30.
Omitting the 'add' parameter causes the command to overwrite the existing allowed VLAN list entirely.
2
Select the proper Cisco IOS trunk configuration syntax
Use 'switchport trunk allowed vlan add 50' on interface GigabitEthernet1/0/48.
The 'add' keyword preserves currently permitted VLANs while expanding trunk access to include the new VLAN ID.

Key Concept

802.1Q Trunk Allowed VLAN List Modification
Estimated Time:1m 15s
Question 59Question →

A network administrator is troubleshooting an IEEE 802.1Q trunk link between two switches, SW-Access-A and SW-Access-B. On SW-Access-A, interface GigabitEthernet1/0/1 is configured as an 802.1Q trunk with native VLAN 20 and allowed VLANs 10, 20, and 30. On SW-Access-B, interface GigabitEthernet1/0/1 is configured as an 802.1Q trunk with native VLAN 1 and allowed VLANs 10, 20, and 30. Which of the following operational outcomes will occur on this trunk link? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Untagged frames transmitted from VLAN 20 on SW-Access-A will be assigned to VLAN 1 upon reception on SW-Access-B.; Link-layer protocols such as CDP or LLDP will log native VLAN mismatch warnings on both switches.

Answer

The correct outcomes are: untagged frames transmitted from VLAN 20 on SW-Access-A will be assigned to VLAN 1 upon reception on SW-Access-B, and link-layer protocols such as CDP or LLDP will log native VLAN mismatch warnings on both switches.
When native VLAN IDs differ across an 802.1Q trunk link, untagged traffic sent by one switch's native VLAN is implicitly placed into the receiving switch's native VLAN, causing cross-VLAN traffic leakage. Additionally, neighbor discovery protocols like CDP or LLDP continuously exchange native VLAN parameters and log errors when a mismatch is detected.

Step-by-Step Solution

1
Analyze how 802.1Q trunking handles native VLAN traffic on transmission.
SW-Access-A strips 802.1Q tags from frames belonging to its native VLAN (VLAN 20) before forwarding them out GigabitEthernet1/0/1.
By definition in the IEEE 802.1Q standard, frames matching the local interface's native VLAN are sent untagged across trunk links.
2
Determine how the receiving switch processes untagged ingress frames.
SW-Access-B receives the untagged frames and places them into its locally configured native VLAN (VLAN 1).
An 802.1Q switch implicitly assigns all incoming untagged trunk frames to whatever VLAN ID is configured as native on that specific ingress interface.
3
Evaluate link-layer management protocol behaviors for misconfigured trunk parameters.
CDP or LLDP packets report mismatched native VLAN IDs (20 vs 1), generating console notification logs.
Discovery protocols periodically advertise interface metadata including native VLAN IDs, allowing network equipment to detect asymmetric trunk configurations.
4
Evaluate the impact on tagged VLAN traffic (VLAN 10 and VLAN 30).
Tagged traffic for allowed VLANs (10 and 30) continues to traverse the trunk properly and remains isolated.
Explicit 802.1Q tags are unaffected by native VLAN mismatches, and inter-VLAN routing remains required to move traffic between different VLAN numbers.

Key Concept

802.1Q Native VLAN Operation and Mismatch Behaviors
Estimated Time:2m 0s
Question 60Question →

A network router has learned multiple routes to the same destination network from different routing sources. Arrange the following route sources in order of administrative distance priority, from the most trustworthy source (lowest administrative distance) to the least trustworthy source (highest administrative distance).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order from most trustworthy (lowest AD) to least trustworthy (highest AD) is: Directly connected interface (AD 0), Static route (AD 1), OSPF dynamic route (AD 110), and RIP dynamic route (AD 120).
Administrative distance (AD) rates the trustworthiness of routing information received from different routing sources on a scale where lower values are preferred. Directly connected routes are most trusted (AD 0), followed by static routes (AD 1), OSPF dynamic routes (AD 110), and RIP dynamic routes (AD 120).

Step-by-Step Solution

1
Identify the Administrative Distance (AD) value for directly connected networks.
Directly connected interfaces have an AD of 0.
Direct connections represent local active hardware links and are the most reliable.
2
Identify the AD value for manually configured static routes.
Static routes have a default AD of 1.
Explicit administrative configuration takes precedence over all dynamic protocols.
3
Compare default AD values of dynamic interior gateway protocols.
OSPF has an AD of 110, whereas RIP has an AD of 120.
Lower numerical AD values indicate higher trustworthiness when selecting routes from different protocols.

Key Concept

Administrative Distance Priority in Route Selection
Estimated Time:45s
PreviousPage 3 / 22Next
Network Implementation Practice Questions — CompTIA Network+ — Page 3 | Examkin