Examkin

Networking Concepts

538 questions

All types538Multiple choice279Multiple select117Numeric19Matching95Ordering28
Question 21Question →

A network administrator is reviewing IPv6 deployment standards and packet headers for an enterprise network redesign. Which of the following statements accurately describe valid IPv6 address representation rules or IPv6 header characteristics? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The double-colon shorthand (::) can be applied only once within an IPv6 address to compress consecutive zero fields.; The Hop Limit field in the IPv6 base header serves the same loop-prevention purpose as the Time to Live (TTL) field in IPv4.

Answer

The double-colon shorthand (::) can be applied only once within an IPv6 address to compress consecutive zero fields, and the Hop Limit field in the IPv6 base header serves the same loop-prevention purpose as the Time to Live (TTL) field in IPv4.
The statement specifying that the double-colon shorthand (::) can be used only once is correct because multiple instances prevent deterministic expansion of the 128-bit address. The statement noting that the Hop Limit field replaces the IPv4 Time to Live (TTL) field is also correct, as both fields serve to drop packets that exceed maximum hop counts to prevent routing loops.

Step-by-Step Solution

1
Analyze IPv6 address compression rules.
Confirm that RFC 5952 restricts double-colon (::) contiguous zero compression to a single occurrence per address to maintain deterministic 128-bit reconstruction.
If multiple double colons were permitted, a receiver could not calculate how many 16-bit zero blocks belong to each double colon.
2
Analyze IPv6 base header fields.
Identify that the Hop Limit field replaces IPv4's Time to Live (TTL) field, and the base header is fixed at 40 bytes with Extension Headers replacing variable IPv4 options.
A fixed header size improves routing processing efficiency by removing the need for a Header Length field.

Key Concept

IPv6 Address Compression Rules and Base Header Architecture
Question 22Question →

Match each IP addressing service or protocol component to its primary administrative function within network operations.

Click a left item, then click its matching right item

Items

IPAM (IP Address Management)
mDNS (Multicast DNS)
DHCP Option 82
NTP Stratum 1

Matches

Show answer & explanation

Answer

IPAM matches with centralized tracking of IP address spaces; mDNS matches with local name resolution without a dedicated DNS server; DHCP Option 82 matches with inserting circuit/remote ID metadata into request packets; NTP Stratum 1 matches with synchronizing system clocks directly from a reference atomic or GPS clock.
Each IP addressing service fulfills a distinct core infrastructure function: IPAM centralizes address governance, mDNS handles zero-configuration local name resolution, DHCP Option 82 injects physical location metadata into DHCP requests, and NTP Stratum 1 synchronizes directly to primary reference clocks.

Step-by-Step Solution

1
Identify the primary role of IPAM.
IPAM provides centralized management and monitoring of subnets, DNS records, and DHCP pools.
IPAM is designed for centralized visibility across network addressing services.
2
Identify the role of mDNS (Multicast DNS).
mDNS resolves hostnames locally using multicast without reliance on a unicast DNS infrastructure.
mDNS facilitates zero-configuration local service discovery.
3
Analyze the function of DHCP Option 82.
DHCP Option 82 adds relay agent information, such as physical port and switch ID, to DHCP request packets.
This allows administrators to apply policy based on the requester's physical network point of connection.
4
Determine the accuracy specification for NTP Stratum levels.
Stratum 1 NTP servers attach directly to Stratum 0 physical time sources (GPS, Cesium clocks).
Stratum numbering defines hierarchy and proximity to authoritative time sources.

Key Concept

Core IP addressing services (IPAM, mDNS, DHCP Relay Options, NTP) provide essential support for dynamic allocation, resolution, security context, and time synchronization across network topologies.
Question 23Question →

A network security administrator is configuring egress filtering rules on a perimeter firewall for a multi-tenant application server. The server must authenticate external network access requests using centralized RADIUS authentication services and transmit secure transactional alert messages via encrypted email submission using STARTTLS. Which TWO of the following transport protocol and port combinations must be permitted outbound on the firewall to meet these operational requirements?

Select all that apply

Show answer & explanation

Answer: UDP port 1812; TCP port 587

Answer

The firewall rules must permit UDP port 1812 for RADIUS authentication and TCP port 587 for secure SMTP submission via STARTTLS.
The requirement for centralized RADIUS authentication requires opening UDP port 1812 outbound, as RADIUS uses UDP for authentication datagrams. The requirement for encrypted email submission via STARTTLS requires opening TCP port 587, which is the standardized port for client-to-server mail submission with TLS encryption.

Step-by-Step Solution

1
Identify the standard protocol and transport layer requirements for RADIUS AAA authentication.
RADIUS authentication uses UDP as its transport protocol on standard port 1812 (with accounting on UDP port 1813).
RADIUS relies on connectionless UDP transport for low-overhead authentication datagram exchange.
2
Identify the standard protocol and transport layer requirements for secure email submission.
Encrypted client-to-server mail submission using STARTTLS standardizes on TCP port 587.
TCP port 587 is designated for mail user agents submitting mail to a mail transfer agent with opportunistic TLS security.
3
Evaluate the incorrect options against protocol specifications.
TCP port 1812 misidentifies RADIUS as connection-oriented TCP, while TCP port 25 refers to unencrypted legacy server-to-server SMTP relay.
Matching transport protocol types (TCP vs UDP) and specific service ports is required for precise firewall ACL definition.

Key Concept

Standard default port numbers and transport layer protocols for RADIUS authentication and secure SMTP mail submission
Estimated Time:2m 0s
Question 24Question →

A network security analyst is monitoring how a workstation handles an incoming encrypted session response starting from raw physical signal reception up to payload presentation. Place the following decapsulation actions in the correct sequential order, from the initial action occurring at the lowest OSI layer to the final action occurring at the higher OSI layer.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of decapsulation processing from the lowest to highest OSI layer is: 1) Converting physical voltage signals on the media into a raw bitstream (Layer 1), 2) Verifying the target MAC address and validating the Frame Check Sequence (Layer 2), 3) Inspecting the destination IP address and evaluating header checksums (Layer 3), 4) Reassembling segment sequence numbers and mapping target port numbers to an active socket (Layer 4), and 5) Decrypting TLS payloads and formatting character encodings (Layer 6).
During decapsulation of an incoming transmission, data flows upward through the OSI model: Layer 1 (Physical) handles bit signal conversion; Layer 2 (Data Link) processes MAC addresses and checks the Frame Check Sequence; Layer 3 (Network) inspects logical IP addressing; Layer 4 (Transport) handles segment sequence numbers and port sockets; and Layer 6 (Presentation) decrypts TLS payloads and formats character syntax.

Step-by-Step Solution

1
Identify the OSI layer responsible for signal conversion and bit synchronization
Converting physical signals into raw binary bitstreams occurs at Layer 1 (Physical Layer). This must happen first upon signal reception.
Physical media signals must be synchronized into bits before any protocol data unit headers can be parsed.
2
Identify the OSI layer responsible for MAC addressing and CRC error detection
Verifying destination MAC addresses and checking the Frame Check Sequence (FCS) occurs at Layer 2 (Data Link Layer).
Frame headers encapsulate packet headers and are stripped at Layer 2 after error validation.
3
Identify the OSI layer responsible for IP address inspection and packet routing
Processing destination IP addresses and IP checksums occurs at Layer 3 (Network Layer).
Once the Ethernet frame header is stripped, the host inspects the underlying IP packet header.
4
Identify the OSI layer responsible for port numbers, TCP sequencing, and socket mapping
Reassembling segment numbers and assigning traffic to target application ports occurs at Layer 4 (Transport Layer).
Transport protocols (TCP/UDP) manage segment reassembly and process communication endpoints (ports).
5
Identify the OSI layer responsible for TLS decryption and character set formatting
Decrypting TLS payloads and formatting character syntax occurs at Layer 6 (Presentation Layer).
The Presentation Layer handles data formatting, syntax translation, and cryptographic operations before handing data to the application.

Key Concept

OSI Model Decapsulation Order and Layer Functions
Question 25Question →

A network engineer is analyzing the structural design differences between IPv4 and IPv6 packet headers. In IPv4, optional parameters increase the header size dynamically up to 60 bytes, requiring routers to process variable-length headers. How does the IPv6 header architecture efficiently support optional control data while keeping the base IPv6 header fixed at a constant 40 bytes?

Show answer & explanation

Answer: By inserting optional Extension Headers sequentially between the base IPv6 header and the upper-layer payload using the Next Header field

Answer

IPv6 handles optional control parameters by inserting optional Extension Headers sequentially between the fixed 40-byte base header and the upper-layer payload, linked via the Next Header field.
The IPv6 protocol uses a fixed 40-byte base header to streamline routing lookup and performance. Optional data—such as hop-by-hop options, routing headers, fragmentation information, and IPsec security payloads—are offloaded to Extension Headers. These are chained sequentially after the base header using the Next Header field.

Step-by-Step Solution

1
Examine the IPv6 base header architecture
The IPv6 base header is strictly fixed at 40 bytes to allow efficient hardware-based processing by intermediate routers.
Eliminating variable-length headers in the base structure removes processing overhead.
2
Analyze how optional information (such as fragmentation or security) is appended
Options are moved into dedicated Extension Headers placed after the base header.
Intermediate routers generally only need to inspect the base header unless specific extension headers require processing.
3
Identify the linking mechanism between headers
The Next Header field in the base header specifies the type of the first extension header (or upper-layer protocol), forming a daisy chain.
This allows flexible, modular header expansion without changing the base header size.

Key Concept

IPv6 Extension Headers and Next Header Chaining
Question 26Question →

A network administrator is configuring inbound firewall rules on a security zone interface separating managed infrastructure switches from a central Network Management System (NMS). The switches are configured to send asynchronous, unprompted alert notifications to the NMS whenever a physical interface state changes. Which port and transport layer protocol combination must be permitted on the firewall to allow these unsolicited switch notifications to reach the central management server?

Show answer & explanation

Answer: UDP port 162

Answer

UDP port 162 is the standard port and protocol required to receive unsolicited Simple Network Management Protocol (SNMP) traps and notifications on an NMS.
Simple Network Management Protocol (SNMP) uses two distinct UDP ports depending on the direction and nature of the communication. When managed network devices send unprompted, asynchronous event alerts (SNMP Traps or InformRequests) to a Network Management System (NMS), the traffic is destined for UDP port 162 on the NMS. Therefore, the perimeter firewall must permit inbound UDP port 162 traffic from the switches to the NMS.

Step-by-Step Solution

1
Identify the protocol and communication direction required by the scenario
The network switches are sending asynchronous, unsolicited event alerts to a central Network Management System (NMS), which corresponds to Simple Network Management Protocol (SNMP) Traps.
Unprompted event notifications initiated by managed agents use SNMP Trap messages.
2
Differentiate between SNMP polling ports and SNMP trap ports
SNMP agent polling (queries initiated by the NMS) uses UDP port 161, whereas SNMP trap messages (alerts initiated by managed devices) are sent to destination UDP port 162 on the NMS collector.
Separating polling requests from event traps prevents trap notifications from interfering with routine request-response polling traffic.
3
Determine the transport protocol requirement
SNMP standard operations utilize UDP for low-overhead, connectionless transport.
UDP provides the required lightweight transport mechanism for SNMP messages without session establishment overhead.

Key Concept

SNMP Port Differentiation (UDP 161 vs UDP 162)
Estimated Time:1m 30s
Question 27Question →

A network engineer is troubleshooting a cross-platform file transfer utility operating between a legacy mainframe and a modern Linux server. While the network connection establishes without error, transferred text files display corrupt characters because the source host formats data using EBCDIC character encoding while the destination expects ASCII. Which OSI model layer is directly responsible for handling character set translation and data syntax formatting between disparate systems?

Show answer & explanation

Answer: Presentation Layer

Answer

Presentation Layer
The Presentation Layer (Layer 6) serves as the network's data translator. It handles tasks such as character code conversion (e.g., EBCDIC to ASCII), data compression, encryption, and syntax formatting, enabling distinct computer systems with different internal data representations to communicate effectively.

Step-by-Step Solution

1
Analyze the reported technical issue described in the scenario.
The issue involves mismatched character encodings (EBCDIC versus ASCII) and syntax formatting between two different computer architectures.
Identifying the functional requirement (character translation and data representation) narrows down which OSI layer handles this specific task.
2
Map the functional requirement to OSI Model layer responsibilities.
Layer 6 (Presentation Layer) is specifically defined to manage data representation, character code translation, formatting, syntax standardization, encryption, and compression.
The Presentation Layer acts as the translator for the network, ensuring heterogeneous systems can interpret application data correctly.

Key Concept

OSI Model Presentation Layer Functions
Estimated Time:1m 0s
Question 28Question →

Match each network protocol or service requirement on the left with its standard default port number and primary transport protocol on the right.

Click a left item, then click its matching right item

Items

Simple Network Management Protocol (SNMP) polling queries
Secure File Transfer Protocol (SFTP) administrative file transfers
Domain Name System (DNS) zone transfers between primary and secondary servers
Network Time Protocol (NTP) clock synchronization

Matches

Show answer & explanation

Answer

Simple Network Management Protocol (SNMP) polling queries matches UDP port 161; Secure File Transfer Protocol (SFTP) administrative file transfers matches TCP port 22; Domain Name System (DNS) zone transfers between primary and secondary servers matches TCP port 53; Network Time Protocol (NTP) clock synchronization matches UDP port 123.
Each service is correctly paired with its transport protocol and port: SNMP polling query traffic uses UDP port 161; SFTP leverages SSH encapsulation on TCP port 22; DNS zone transfers switch to TCP port 53 for reliability; and NTP time synchronization operates over UDP port 123.

Step-by-Step Solution

1
Identify the transport protocol and port requirements for management and polling services.
SNMP queries use UDP port 161 (SNMP traps use UDP 162).
Management polling relies on lightweight UDP communications.
2
Identify encrypted administrative file transfer protocols.
SFTP operates inside an SSH session on TCP port 22.
Unlike legacy FTP (TCP 20/21) or FTPS (TCP 989/990), SFTP shares SSH's underlying port.
3
Differentiate standard DNS queries from DNS zone transfers.
DNS zone transfers require reliable bulk data transfer over TCP port 53.
Standard client queries use UDP port 53, but large database transfers between DNS servers require TCP port 53.
4
Identify network synchronization protocol ports.
NTP utilizes UDP port 123.
Time synchronization relies on low-latency UDP packet delivery.

Key Concept

Common Network Ports and Transport Layer Dependencies
Question 29Question →

A network technician is reviewing Layer 2 switch forwarding modes and port auto-negotiation behaviors. Match each switching operation or port feature on the left with its corresponding functional description on the right.

Click a left item, then click its matching right item

Items

Store-and-Forward Switching
Cut-Through Switching
Fragment-Free Switching
Auto-MDIX

Matches

Show answer & explanation

Answer

Store-and-Forward Switching matches buffering the full frame and verifying the FCS CRC. Cut-Through Switching matches reading only the destination MAC address for minimal latency. Fragment-Free Switching matches inspecting the first 64 bytes to eliminate collision fragments. Auto-MDIX matches automatically detecting cable pinouts and swapping transmit/receive pairs.
Store-and-Forward buffers the full frame for FCS validation; Cut-Through forwards after inspecting only the 6-byte destination MAC; Fragment-Free inspects 64 bytes to drop collision fragments; Auto-MDIX automatically configures internal transmit/receive pinouts based on connected cabling.

Step-by-Step Solution

1
Identify full-frame validation switching behavior
Store-and-Forward buffers the entire frame to calculate the Frame Check Sequence CRC, ensuring invalid frames are dropped.
Full frame buffering provides maximum reliability at the expense of slight latency.
2
Identify ultra-low latency forwarding behavior
Cut-Through reads only the destination MAC address (6 bytes) before immediately forwarding.
Minimal preamble/address inspection yields the lowest possible forwarding delay.
3
Identify collision fragment mitigation behavior
Fragment-Free inspects the first 64 bytes, which is where collision fragments occur in half-duplex Ethernet.
This serves as a compromise between cut-through speed and basic collision filtering.
4
Identify physical interface pinout automation
Auto-MDIX electronically adjusts pin functions to allow straight-through or crossover cables interchangeably.
Automated physical layer detection eliminates wiring mismatched connections.

Key Concept

Switch Frame Forwarding Methods and Auto-MDIX
Estimated Time:1m 30s
Question 30Question →

A network administrator is designing an IP addressing scheme for a new corporate branch facility using the assigned block 10.45.128.0/1910.45.128.0/19. The engineering division requires a dedicated subnet capable of supporting at least 1,1001,100 usable host IP addresses. Which CIDR prefix represents the smallest possible subnet allocation that satisfies this host requirement while conserving IP space, and what is the last usable host IP address in that subnet?

Show answer & explanation

Answer: /21/21 prefix with a last usable host address of 10.45.135.25410.45.135.254

Answer

The /21/21 prefix with a last usable host address of 10.45.135.25410.45.135.254
The correct selection uses a /21/21 prefix, which grants 11 host bits (211−2=2,0462^{11} - 2 = 2,046 usable host addresses), satisfying the requirement for at least 1,100 hosts while conserving address space. With a 3rd octet block size of 8, the subnet range is 10.45.128.010.45.128.0 to 10.45.135.25510.45.135.255, making 10.45.135.25410.45.135.254 the final usable host IP address.

Step-by-Step Solution

1
Determine the minimum number of host bits required for 1,100 hosts.
Using the formula 2h−2≥11002^h - 2 \ge 1100, h=10h=10 yields 1,0221,022 usable hosts (insufficient), while h=11h=11 yields 2,0462,046 usable hosts. Therefore, 1111 host bits are needed.
Two addresses (network ID and broadcast address) must be subtracted from the total address count.
2
Calculate the required CIDR prefix length.
32−11=2132 - 11 = 21, so a /21/21 prefix is required.
An IPv4 address consists of 32 total bits.
3
Determine the block size and subnet range starting from 10.45.128.010.45.128.0.
With 1111 host bits (33 bits in the 3rd octet and 88 bits in the 4th octet), the 3rd octet block increment is 23=82^3 = 8. The subnet spans 10.45.128.010.45.128.0 to 10.45.135.25510.45.135.255.
The 3rd octet starts at 128 and increments by 8, giving a range of 128 through 135.
4
Identify the broadcast address and last usable host address.
Broadcast address is 10.45.135.25510.45.135.255, and the last usable host IP is 10.45.135.25410.45.135.254.
The last usable host IP is immediately prior to the subnet broadcast address.

Key Concept

Calculating required subnet mask size based on host capacity constraints and determining subnet host address bounds.
Question 31Question →

A network administrator is configuring a subnet for a small office branch using the subnet mask 255.255.255.240255.255.255.240. What is the maximum number of usable host IP addresses available on this subnet?

Show answer & explanation

Answer: 14

Answer

14 usable host IP addresses
A subnet mask of 255.255.255.240255.255.255.240 provides 4 host bits, resulting in 24=162^4 = 16 total IP addresses. Subtracting 2 reserved addresses (the network address and broadcast address) leaves exactly 14 usable host IP addresses.

Step-by-Step Solution

1
Determine the number of host bits from the subnet mask.
The dotted-decimal mask 255.255.255.240255.255.255.240 converted to binary has 28 network bits and 4 host bits (32−28=432 - 28 = 4).
The last octet value 240240 is 11110000211110000_2, leaving 4 trailing zeros for host addressing.
2
Calculate total IP addresses in the subnet.
24=162^4 = 16 total IP addresses.
The total address capacity of a subnet is calculated using 2h2^h, where hh is the number of host bits.
3
Calculate usable host IP addresses.
16−2=1416 - 2 = 14 usable host IP addresses.
Two IP addresses in every standard subnet are reserved: the network ID (all host bits 0) and the broadcast address (all host bits 1).

Key Concept

Calculating usable IPv4 host addresses from a subnet mask by subtracting network and broadcast addresses
Question 32Question →

A network administrator is auditing an enterprise multi-protocol routing environment. Match each dynamic routing protocol on the left with its corresponding default administrative distance, primary metric calculation method, and underlying algorithm on the right.

Click a left item, then click its matching right item

Items

Internal EIGRP
eBGP
OSPF
RIPv2

Matches

Show answer & explanation

Answer

Internal EIGRP matches Administrative Distance 90 with composite bandwidth/delay metrics; eBGP matches Administrative Distance 20 with path-vector AS-Path metrics; OSPF matches Administrative Distance 110 with cost metrics via Dijkstra; RIPv2 matches Administrative Distance 120 with hop count metrics via Bellman-Ford.
Each dynamic routing protocol correctly maps to its standardized default Administrative Distance (eBGP=20, Internal EIGRP=90, OSPF=110, RIPv2=120) and matching metric/algorithm characteristics.

Step-by-Step Solution

1
Determine the default Administrative Distance (AD) for each dynamic routing protocol.
eBGP has AD 20, Internal EIGRP has AD 90, OSPF has AD 110, and RIPv2 has AD 120.
Administrative Distance defines source trustworthiness when different protocols learn identical destination prefixes.
2
Associate each protocol with its underlying path computation algorithm and metric scheme.
Internal EIGRP uses DUAL with bandwidth/delay; eBGP uses Path Vector with AS-Path; OSPF uses Dijkstra SPF with interface cost; RIPv2 uses Bellman-Ford with hop count.
Each protocol type utilizes distinct algorithmic mechanisms to compute loop-free paths.

Key Concept

Routing protocol Administrative Distance hierarchies, underlying path calculation algorithms, and metric evaluation mechanisms.
Question 33Question →

A network engineer is designing an infrastructure layout for a smart factory floor containing eight automated assembly stations. To guarantee that failure of a single cable run does not isolate critical controllers while maintaining reasonable cabling costs, the engineer connects all stations to a central distribution switch and adds direct redundant interconnects only between the three highest-priority controllers. Which of the following network topologies is being implemented?

Show answer & explanation

Answer: Hybrid (Star-Partial Mesh) topology

Answer

The network layout represents a Hybrid (Star-Partial Mesh) topology because it combines a central switch layout (star) with selective point-to-point redundant connections (partial mesh) between critical controllers.
The design combines two distinct topological concepts: a central switch to which all endpoints connect (star) and selective direct links between high-priority nodes (partial mesh). Combining these two structures results in a hybrid star-partial mesh topology, balancing fault tolerance for key nodes with overall deployment cost.

Step-by-Step Solution

1
Analyze the primary physical connectivity layout.
Connecting all eight stations to a central distribution switch forms a physical star topology.
Centralized switch connections characterize star network architectures.
2
Analyze the redundant interconnections.
Adding direct point-to-point links specifically between selected high-priority controllers creates a partial mesh overlay.
Selective redundancy without linking every node pair is the defining trait of partial mesh.
3
Combine the structural classifications to determine the overall topology.
The combination of star and partial mesh design elements yields a hybrid topology.
Networks incorporating multiple distinct topological structures are classified as hybrid topologies.

Key Concept

Hybrid Network Topologies
Question 34Question →

A network administrator is establishing central IP addressing services for remote branch offices across a routed WAN. Workstations residing on remote subnets must obtain IPv4 leases automatically and have their hostname-to-IP address mappings updated dynamically in corporate DNS. Which TWO of the following configurations must be implemented to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Configure a DHCP relay agent (IP helper) on the branch router interface pointing to the central DHCP server IP address.; Enable Dynamic DNS (DDNS) integration on the DHCP server so it sends automated A and PTR record updates to the authoritative DNS server upon issuing leases.

Answer

The required configurations are placing a DHCP relay agent on the remote router interface pointing to the DHCP server, and enabling Dynamic DNS (DDNS) integration on the DHCP server to automatically update A and PTR records.
Implementing a DHCP relay agent (IP helper address) on the remote router interface allows DHCP broadcast requests to reach the centralized DHCP server across Layer 3 boundaries. Enabling Dynamic DNS (DDNS) on the DHCP server allows it to automatically register forward (A) and reverse (PTR) DNS records on behalf of client hosts when leases are issued.

Step-by-Step Solution

1
Identify the requirement for cross-subnet DHCP leasing.
Recognize that DHCP broadcast requests from remote subnets cannot cross routers without a DHCP relay agent (IP helper) converting them to unicast traffic.
Routers drop Layer 2 broadcast packets by default.
2
Identify the requirement for automatic hostname and IP registration in DNS.
Select Dynamic DNS (DDNS) updates configured on the DHCP server to update A and PTR records automatically.
DDNS automates DNS record updates whenever leases are assigned or renewed by DHCP.

Key Concept

DHCP Relay and Dynamic DNS (DDNS) Integration
Estimated Time:1m 30s
Question 35Question →

A network administrator is configuring traffic control policies across multiple subnets in an enterprise network. Which of the following functions and operations occur specifically at Layer 3 (Network Layer) of the OSI model? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Encapsulating segments into packets containing logical source and destination IP addresses; Determining optimal path selection using dynamic routing protocols and routing tables

Answer

The correct functions operating at Layer 3 (Network Layer) are encapsulating upper-layer data into IP packets with logical addressing and determining optimal path selection using routing tables.
Layer 3 (Network Layer) is responsible for logical addressing (IP addresses), packet encapsulation, and path selection (routing) between different networks. Therefore, encapsulating segments into packets with IP addresses and determining path selection via routing tables are correct Layer 3 functions.

Step-by-Step Solution

1
Identify the primary responsibilities of Layer 3 (Network Layer) in the OSI reference model.
Layer 3 handles logical IP addressing, packet creation, and path selection (routing) across subnets.
Layer 3 enables end-to-end host communication across disparate network segments.
2
Evaluate each provided option against Layer 3 operational boundaries.
Packet encapsulation with IP addresses and routing path determination belong to Layer 3. FCS error checking belongs to Layer 2, while port-based multiplexing belongs to Layer 4.
Distinguishing protocol data units (PDUs) and header responsibilities across OSI layers ensures accurate protocol stack analysis.

Key Concept

OSI Model Layer 3 (Network Layer) Functions
Question 36Question →

A network administrator is reconfiguring an enterprise application server to query an Active Directory domain controller using encrypted Lightweight Directory Access Protocol over SSL/TLS (LDAPS). The existing firewall rule permits standard unencrypted directory queries, but secure authentication attempts are currently being dropped. Which of the following port and transport protocol combinations must be permitted through the firewall to allow LDAPS communications?

Show answer & explanation

Answer: TCP port 636

Answer

TCP port 636 is required to allow secure Lightweight Directory Access Protocol (LDAPS) traffic.
Lightweight Directory Access Protocol over SSL/TLS (LDAPS) uses TCP port 636 to secure directory query authentication via transport layer encryption.

Step-by-Step Solution

1
Identify the target protocol and encryption requirement from the scenario.
The scenario requires Lightweight Directory Access Protocol over SSL/TLS (LDAPS).
Differentiating between cleartext and encrypted directory services is necessary to identify the proper destination port.
2
Determine the transport layer protocol requirement.
Establishing a TLS session requires reliable, stateful transmission provided by TCP.
TCP handles session setup and reliable delivery needed for cryptographic handshakes.
3
Match the protocol to its standardized default port number.
Standard LDAP operates over TCP port 389, while encrypted LDAPS uses TCP port 636.
Firewall rules must permit TCP port 636 to allow encrypted directory authentication.

Key Concept

Common Ports and Protocols - Secure Directory Services (LDAP vs LDAPS)
Question 37Question →

An enterprise Layer 2 switch has Port 1 and Port 2 assigned to VLAN 1010, and Port 3 assigned to VLAN 2020. Port 1 receives an Ethernet frame with an unknown destination MAC address. Which of the following actions will the switch take upon receiving this frame?

Show answer & explanation

Answer: Flood the frame out Port 2 only, while updating the MAC address table with the source MAC address on Port 1 in VLAN 1010.

Answer

The switch will flood the frame out Port 2 only while recording the source MAC address of the frame on Port 1 in VLAN 10.
When a Layer 2 switch receives an Ethernet frame with an unknown destination MAC address, it performs unknown unicast flooding. This operation forwards a copy of the frame out every port belonging to the same VLAN as the receiving port, except the port on which the frame arrived. Because Port 1 and Port 2 reside in VLAN 10, Port 2 is the only eligible forwarding destination. Furthermore, the switch updates its MAC address table with the frame's source MAC address mapped to Port 1 within VLAN 10.

Step-by-Step Solution

1
Examine source MAC address learning
The switch inspects the ingress frame's source MAC address and maps it to Port 1 and VLAN 1010 in its CAM table.
Layer 2 switches build MAC address tables dynamically by observing incoming frame source addresses.
2
Examine destination MAC lookup
The destination MAC address is missing from the switch MAC table for VLAN 1010, marking it as an unknown unicast frame.
When a destination MAC address is not present in the table, the switch cannot perform selective point-to-point forwarding.
3
Determine flooding domain scope
The switch forwards the frame out Port 2 (VLAN 1010) only, completely excluding Port 3 (VLAN 2020).
VLAN boundaries define separate Layer 2 broadcast domains; unknown unicast flooding is strictly contained within the ingress VLAN.

Key Concept

Layer 2 Unknown Unicast Flooding and VLAN Broadcast Domain Isolation
Question 38Question →

An enterprise operations team is allocated the network block 172.28.64.0/21172.28.64.0/21 to deploy microservices within a private cloud environment. To satisfy security policies, the administrator must divide this entire block into equal-sized subnets such that each subnet can accommodate at least 100100 usable host IP addresses while reserving as much space as possible for maximum subnetting density (using the longest possible subnet mask that meets the requirement). What is the total number of usable host IP addresses available across all created subnets combined?

Show answer & explanation

Answer: 2016

Answer

2016 usable host IP addresses
To host at least 100100 usable IP addresses, each subnet requires 77 host bits (27−2=1262^7 - 2 = 126 usable hosts), which corresponds to a /25/25 prefix (32−7=2532 - 7 = 25). Subnetting a /21/21 network block into /25/25 subnets yields 225−21=24=162^{25-21} = 2^4 = 16 distinct subnets. Because each /25/25 subnet reserves 11 network address and 11 broadcast address, each subnet has 126126 usable host IPs. Across all 1616 subnets, the total usable host capacity is 16×126=201616 \times 126 = 2016.

Step-by-Step Solution

1
Determine the required subnet mask for each subnet to support at least 100 hosts
A /25/25 prefix (255.255.255.128255.255.255.128) providing 126 usable host IP addresses per subnet
The formula for usable hosts is 2h−2≥1002^h - 2 \ge 100. For h=6h = 6, 26−2=622^6 - 2 = 62 (insufficient). For h=7h = 7, 27−2=1262^7 - 2 = 126 (sufficient). The subnet prefix length is 32−7=2532 - 7 = 25.
2
Calculate how many /25/25 subnets fit into the parent /21/21 block
16 subnets
The difference between the new subnet prefix (/25/25) and the parent prefix (/21/21) is 25−21=425 - 21 = 4 bits. The number of subnets is 24=162^4 = 16.
3
Calculate the total aggregate usable host capacity
2016 aggregate usable host addresses
Multiplying the total subnets (1616) by the usable hosts per subnet (126126) yields 16×126=201616 \times 126 = 2016.

Key Concept

Subnet partitioning and usable host capacity calculation under CIDR constraints
Question 39Question →

A Layer 3 core switch processes an incoming packet destined for host 10.50.4.15010.50.4.150. The switch's active routing table contains four candidate routes:

- Route 1: 10.50.4.0/2210.50.4.0/22 via OSPF (Administrative Distance: 110, Metric: 20)
- Route 2: 10.50.4.128/2510.50.4.128/25 via iBGP (Administrative Distance: 200, Metric: 100)
- Route 3: 10.50.0.0/1610.50.0.0/16 via Static Route (Administrative Distance: 1, Metric: 0)
- Route 4: 10.50.4.128/2610.50.4.128/26 via EIGRP External (Administrative Distance: 170, Metric: 15)

Which route will the switch select to forward the packet, and what is the primary decision rule applied?

Show answer & explanation

Answer: Route 4 (10.50.4.128/2610.50.4.128/26), because longest prefix match takes precedence over administrative distance and metric.

Answer

The switch will select Route 4 (10.50.4.128/2610.50.4.128/26) because longest prefix match is the primary rule for Layer 3 forwarding decisions.
The router uses the Longest Prefix Match (LPM) rule as the absolute first criterion when making forwarding decisions. Subnet mask /26/26 (255.255.255.192255.255.255.192) has 26 network bits, making it more specific than /25/25, /22/22, or /16/16. Because Route 4 covers 10.50.4.15010.50.4.150 and has the longest prefix length, it is selected immediately regardless of its higher Administrative Distance.

Step-by-Step Solution

1
Determine which subnets contain the destination address 10.50.4.15010.50.4.150.
The destination address 10.50.4.15010.50.4.150 falls into all four subnet ranges: 10.50.0.0/1610.50.0.0/16 (10.50.0.0−10.50.255.25510.50.0.0 - 10.50.255.255), 10.50.4.0/2210.50.4.0/22 (10.50.4.0−10.50.7.25510.50.4.0 - 10.50.7.255), 10.50.4.128/2510.50.4.128/25 (10.50.4.128−10.50.4.25510.50.4.128 - 10.50.4.255), and 10.50.4.128/2610.50.4.128/26 (10.50.4.128−10.50.4.19110.50.4.128 - 10.50.4.191).
Before selecting a route, a router checks which routing table entries encompass the target IP address.
2
Compare the subnet mask lengths of the matching candidate routes.
Prefix lengths are /16, /22, /25, and /26. The longest prefix match is /26 (Route 4).
The Longest Prefix Match (LPM) rule dictates that the route with the most specific (longest) subnet mask is chosen first.
3
Evaluate whether Administrative Distance (AD) or Metric needs to be considered.
LPM resolves the routing decision immediately, so AD (1 vs 110 vs 170 vs 200) and metrics are ignored.
Administrative Distance and metrics are tie-breakers used only when candidate routes have identical prefix lengths.

Key Concept

Longest Prefix Match (LPM) Routing Table Logic
Question 40Question →

An enterprise network administrator notices that user authentication attempts using Kerberos are failing across multiple branch offices due to time skew between client workstations and domain controllers. To ensure automated clock synchronization across the network, which transport protocol and destination port must be permitted on the network firewalls?

Show answer & explanation

Answer: UDP port 123

Answer

UDP port 123 is required to allow Network Time Protocol (NTP) traffic for network-wide time synchronization.
Network Time Protocol (NTP) uses UDP port 123 to maintain accurate time synchronization across systems, which is essential for time-sensitive protocols such as Kerberos authentication.

Step-by-Step Solution

1
Identify the required network service based on the symptom of time skew causing Kerberos authentication failures.
The necessary service is Network Time Protocol (NTP), which provides clock synchronization across devices.
Kerberos relies on accurate timestamps (typically within 5 minutes) to prevent replay attacks.
2
Determine the transport protocol and standard port number used by NTP.
NTP operates over UDP on port 123.
UDP is chosen for its minimal protocol overhead and low latency, which are critical for precise timing.

Key Concept

Network Time Protocol (NTP) operates over UDP port 123 to synchronize system clocks across network devices.
Estimated Time:1m 0s
PreviousPage 2 / 27Next