Networking Concepts

538 questions

Question 461Question

A network administrator is designing the communication architecture for an automated logistics facility. The design requires one stream for low-latency, unacknowledged telemetry updates from mobile sensors where occasional dropped packets are acceptable, and a second stream for critical database synchronization where missing data must be retransmitted. Which of the following transport layer characteristics correctly distinguish the connectionless protocol chosen for sensor telemetry from the connection-oriented protocol chosen for database synchronization? (SELECT TWO)

Select all that apply

Show answer & explanation

Answer: The sensor telemetry protocol operates with minimal header overhead of 8 bytes and delegates error recovery to higher-layer applications, whereas the database synchronization protocol uses a minimum 20-byte header containing reliability control fields.; The database synchronization protocol utilizes sequence numbers and acknowledgment tracking to support sliding-window flow control and ordered segment reassembly.

Answer

The correct selections state that the connectionless telemetry protocol operates with an 8-byte header overhead while delegating error recovery, and that the connection-oriented database protocol utilizes sequence numbers and acknowledgment tracking for flow control and ordered delivery.
The options describing the 8-byte header size with application-level error recovery and the option describing sequence/acknowledgment numbers for sliding-window flow control correctly detail the technical differences between UDP and TCP. UDP minimizes latency and overhead with an 8-byte header, while TCP uses at least 20 bytes of header data to track sequence numbers, ACKs, and window size for reliable delivery.

Step-by-Step Solution

1
Identify the protocol types required for each traffic flow based on the scenario requirements.
Sensor telemetry requires a connectionless protocol (UDP) prioritizing low latency over reliability. Database synchronization requires a connection-oriented protocol (TCP) guaranteeing reliable, ordered delivery.
UDP provides lightweight datagram transmission without connection overhead, whereas TCP guarantees packet delivery via connection management.
2
Analyze header structure and overhead differences between UDP and TCP.
UDP uses a fixed 8-byte header containing Source Port, Destination Port, Length, and Checksum. TCP uses a minimum 20-byte header containing sequence/acknowledgment numbers, window sizing, and flags.
The extra header fields in TCP are necessary to maintain state and perform reliability mechanisms.
3
Evaluate flow control and delivery mechanisms for TCP vs. UDP.
TCP uses sequence numbers, ACK fields, and sliding windows to manage data reassembly and traffic rates. UDP provides no native sequencing or flow control.
Connection-oriented protocols build stateful control structures into the transport header to handle lost or out-of-order segments.

Key Concept

Connection-oriented protocols (TCP) establish stateful sessions using sequence numbers, ACKs, and flow control with a minimum 20-byte header, whereas connectionless protocols (UDP) send unacknowledged datagrams with minimal 8-byte header overhead.
Estimated Time:2m 0s
Question 462Question

A network administrator is standardizing network documentation and needs to compress the full 128-bit IPv6 address `2001:0db8:0000:0000:0000:0000:0000:0001` into its valid shorthand form. Which of the following represents the correct compressed IPv6 address?

Show answer & explanation

Answer: 2001:db8::1

Answer

The correct compressed shorthand representation is 2001:db8::1.
The shorthand representation `2001:db8::1` correctly suppresses the leading zero in the second block (0db8 to db8) and compresses the five consecutive blocks of zeros into a single double colon (`::`).

Step-by-Step Solution

1
Omit leading zeros in each 16-bit hexadecimal block.
2001:0db8 becomes 2001:db8.
Leading zeros in hexadecimal hextets are redundant and can be omitted.
2
Compress contiguous fields of zeros using double colon (::) notation.
The five contiguous blocks of 0000 (:0000:0000:0000:0000:0000:) become ::.
Standard RFC 5952 zero compression permits replacing consecutive zero blocks with double colons.
3
Verify that the double colon is only used once in the entire address.
2001:db8::1 is formed cleanly with exactly one double colon.
Using double colons more than once renders an IPv6 address ambiguous when expanding back to 128 bits.

Key Concept

IPv6 Address Compression Rules (RFC 5952)
Question 463Question

A network administrator is reviewing packet capture data and interface configurations to verify IPv6 protocol operations across an enterprise network. Which of the following statements regarding IPv6 header fields and address representation rules are correct? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The Flow Label field in the base IPv6 header is a 20-bit field used to identify packets belonging to a specific communication flow for Quality of Service (QoS) handling.; The Next Header field in the base IPv6 header specifies the type of header immediately following the base header, serving a function equivalent to the IPv4 Protocol field.

Answer

The statement regarding the 20-bit Flow Label field used for QoS flow identification and the statement regarding the Next Header field specifying the subsequent header type (equivalent to the IPv4 Protocol field) are correct.
The correct choices accurately identify that the 20-bit Flow Label field identifies traffic flows for QoS without inspecting payload contents, and that the Next Header field indicates the protocol or extension header following the base IPv6 header, replacing the IPv4 Protocol field.

Step-by-Step Solution

1
Analyze IPv6 header field functions.
Identify that the Flow Label (20 bits) handles packet flow QoS and the Next Header (8 bits) identifies extension headers or upper-layer protocols.
Understanding IPv6 base header architecture distinguishes modern IPv6 fields from legacy IPv4 fields.
2
Evaluate IPv6 address compression rules.
Determine that applying `::` twice in an address like `2001:db8::1000::1` violates RFC 5952.
A double colon can only be used once per IPv6 address to maintain unambiguous 128-bit address expansion.
3
Evaluate Hop Limit field definition.
Confirm Hop Limit replaces TTL to prevent routing loops, not payload sizing.
Payload size is specified by the Payload Length field in the IPv6 base header.

Key Concept

IPv6 Base Header Fields and Address Compression Syntax
Question 464Question

During a storage network optimization project, a network engineer observes packet drops on switch ports during peak bursts. While end-to-end TCP sliding window mechanisms manage flow control between the source host and destination storage array, the engineer implements IEEE 802.3x Pause frames to temporarily halt transmission between adjacent switch nodes when ingress port buffers near capacity. At which layer of the OSI reference model does this hop-by-hop flow control mechanism operate?

Show answer & explanation

Answer: Data Link Layer (Layer 2)

Answer

The hop-by-hop flow control mechanism using IEEE 802.3x Pause frames operates at the Data Link Layer (Layer 2).
The correct answer is the Data Link Layer (Layer 2). IEEE 802.3x Pause frames are Media Access Control (MAC) layer frames that allow an overloaded receiving network interface to request that the adjacent transmitting node temporarily stop sending frames. Because this operates strictly on a single link between adjacent hardware interfaces using MAC-level control units, it belongs to Layer 2.

Step-by-Step Solution

1
Analyze the flow control scope presented in the scenario.
The mechanism described (IEEE 802.3x Pause frames) functions strictly between directly connected adjacent nodes (hop-by-hop) rather than end-to-end host applications.
Differentiating between hop-by-hop link management and end-to-end host transport management is key to identifying the correct OSI layer.
2
Identify the protocol data unit (PDU) and sublayer involved.
Pause frames are structured MAC control frames handled by Ethernet network interface cards and switch port logic.
Media Access Control (MAC) sublayer handling and Ethernet frame creation reside at Layer 2.
3
Map the function to the OSI reference model.
Node-to-node frame delivery, error detection, and link-level flow control are core duties of Layer 2 (Data Link Layer).
Layer 2 manages node-to-node transmission on a shared or point-to-point physical medium.

Key Concept

Distinguishing Link-Layer (Layer 2) Hop-by-Hop Flow Control from Transport-Layer (Layer 4) End-to-End Flow Control
Question 465Question

A network administrator analyzes a multi-hop traffic path between Host A (192.168.1.50/24192.168.1.50/24) and Server B (10.0.2.80/2410.0.2.80/24) separated by a default gateway Layer 3 router. Host A initiates a file transfer over TCP. As the data payload traverses the egress interface of the router toward Server B's local subnet, which structural transformations occur during the de-encapsulation and re-encapsulation process at Layer 2 and Layer 3?

Show answer & explanation

Answer: The router strips the incoming Layer 2 frame header and FCS trailer, decrements the Layer 3 IPv4 Time to Live (TTL) field, recalculates the IPv4 header checksum, and encapsulates the unchanged Layer 3 packet into a new Layer 2 frame with the router egress interface's MAC as the source and Server B's MAC as the destination.

Answer

The router strips the incoming Layer 2 frame header and FCS trailer, decrements the IP TTL, recalculates the IP header checksum, and encapsulates the unchanged IP packet into a new Layer 2 frame using the egress MAC address as source and the destination host's MAC address as target.
When a packet traverses a Layer 3 boundary, the router de-encapsulates the incoming Layer 2 frame by stripping its header and trailer. It operates on the Layer 3 IP header by decrementing the TTL field (and recomputing the checksum). The router then re-encapsulates the original IP packet into a brand-new Layer 2 frame equipped with source MAC address of the router's egress interface and destination MAC address of the destination host (or next-hop router).

Step-by-Step Solution

1
Analyze incoming frame processing at the router's ingress interface
The router receives the physical bits, processes the Layer 2 frame header, verifies the frame check sequence (FCS), and strips the Layer 2 header and trailer to extract the enclosed Layer 3 IPv4 packet PDU.
Layer 2 data frames are hop-by-hop units that terminate at the receiving Layer 3 interface.
2
Evaluate Layer 3 header processing and routing table lookup
The router inspects the IP header destination address (10.0.2.8010.0.2.80), decrements the Time to Live (TTL) field by 1, and recalculates the IPv4 header checksum.
Routers decrement TTL to prevent indefinite forwarding loops and must update the checksum due to modifying the TTL field.
3
Perform Layer 2 re-encapsulation for the egress network segment
The router queries its ARP cache for Server B's IP address (10.0.2.8010.0.2.80), constructs a new Layer 2 Ethernet frame header containing the egress interface's MAC as the source MAC and Server B's MAC as the destination MAC, appends a new FCS, and transmits the frame.
Re-encapsulation builds a new Data Link PDU specific to the media and hardware addresses of the target subnet.

Key Concept

Layer 3 Routing PDU Encapsulation and De-encapsulation Mechanics
Estimated Time:2m 0s
Question 466Question

An enterprise network architect is evaluating several network deployments and infrastructure physical/logical configurations across an organization. Match each architectural scenario on the left with its correct network topology or network type classification on the right.

Click a left item, then click its matching right item

Items

A modern datacenter fabric designed to optimize high-throughput east-west traffic using a two-tier architecture where every edge switch connects to every core switch with uniform latency.
A municipal network infrastructure interconnecting multiple city department buildings across a 25-kilometer urban area using leased dark fiber.
A legacy legacy industrial system connecting controllers along a single continuous linear coaxial segment that relies on 50-ohm terminating resistors at each physical end.
A specialized high-speed network that provides servers with dedicated block-level access to disk arrays over Fibre Channel switches.

Matches

Show answer & explanation

Answer

Spine-Leaf Topology matches the two-tier datacenter fabric; Metropolitan Area Network (MAN) matches the 25-kilometer municipal building interconnection; Physical Bus Topology matches the linear coaxial segment requiring terminating resistors; Storage Area Network (SAN) matches the dedicated high-speed block-level storage network.
Each deployment scenario aligns precisely with its architectural definition: two-tier equal-hop datacenter fabrics form a Spine-Leaf topology; municipal networks covering a city footprint constitute a MAN; single-trunk coax requiring terminating resistors represents a physical Bus topology; and dedicated high-speed Fibre Channel storage infrastructure represents a SAN.

Step-by-Step Solution

1
Analyze datacenter east-west traffic design requirements.
Identified two-tier architecture connecting every edge switch to every core switch, which defines a Spine-Leaf topology.
Spine-Leaf offers predictable two-hop latency and high throughput for server-to-server traffic.
2
Evaluate geographic footprint of municipal network covering 25 km across a city.
Identified scope as broader than a single campus/LAN but smaller than a global WAN, which corresponds to a Metropolitan Area Network (MAN).
MAN scope covers an entire city or metropolitan region.
3
Examine physical cabling characteristics requiring terminating resistors on a single coaxial trunk.
Matches the physical Bus topology.
Bus topologies suffer from signal reflection unless terminated with proper resistors at both physical cable ends.
4
Determine classification for dedicated Fibre Channel server-to-storage network.
Identified as a Storage Area Network (SAN).
SANs offload block storage traffic from the production LAN onto dedicated storage fabrics.

Key Concept

Classification of physical and logical network topologies alongside geographic network scope types.
Question 467Question

An unmanaged switch receives an Ethernet frame on port FastEthernet 0/1. The frame has a source MAC address of 0011.2233.4455 and a destination MAC address of 6677.8899.AABB. The switch's MAC address table currently contains no entries for either address. Which of the following operations will the switch perform first upon receiving this frame?

Show answer & explanation

Answer: Record MAC address 0011.2233.4455 associated with port FastEthernet 0/1 in the MAC address table, and flood the frame out all operational ports except FastEthernet 0/1 within the frame's VLAN.

Answer

The switch updates its MAC address table by associating the source MAC address 0011.2233.4455 with FastEthernet 0/1, then floods the frame out all other active ports belonging to the same VLAN.
The correct answer accurately describes the standard two-step Layer 2 switch operational logic: learning and forwarding. First, the switch learns the source MAC address (0011.2233.4455) and maps it to ingress port FastEthernet 0/1. Second, because the destination MAC address (6677.8899.AABB) is unknown in the MAC table, the switch performs unknown unicast flooding by copying the frame to all operational ports within the same VLAN except the receiving port.

Step-by-Step Solution

1
Examine the frame's source MAC address
The switch reads source MAC address 0011.2233.4455 and ingress port FastEthernet 0/1.
Switches dynamically build their MAC address (CAM) table by inspecting the source MAC address of incoming frames on each interface.
2
Update the MAC address table (Learning Process)
An entry mapping 0011.2233.4455 to port FastEthernet 0/1 is added/refreshed in the table.
Learning source MAC addresses allows future frames destined for 0011.2233.4455 to be forwarded directly to FastEthernet 0/1.
3
Lookup the frame's destination MAC address (Forwarding Decision)
Destination MAC address 6677.8899.AABB is not found in the MAC address table.
When a destination MAC address is missing from the table, the frame is classified as an unknown unicast frame.
4
Execute unknown unicast flooding
The frame is forwarded out all active switch ports belonging to the ingress port's VLAN, excluding the port on which it arrived (FastEthernet 0/1).
Flooding ensures that the intended recipient host receives the frame and can reply, enabling the switch to learn the recipient's MAC address location.

Key Concept

Switch Learning and Forwarding Operations (Unknown Unicast Flooding)
Question 468Question

A network administrator needs to configure a DNS resource record to resolve a web server's domain name directly to its 32-bit IPv4 address. Which of the following DNS record types should the administrator create?

Show answer & explanation

Answer: An A record

Answer

An A record is used to map a hostname or domain name to an IPv4 address.
An Address (A) record maps a fully qualified domain name (FQDN) directly to a 32-bit IPv4 address, fulfilling the host name resolution requirement.

Step-by-Step Solution

1
Identify the target service and requirement
The requirement is to map a domain name directly to a 32-bit IPv4 address within DNS.
DNS resolution requires selecting the specific record type corresponding to the target data type (IPv4 vs IPv6 vs Alias).
2
Evaluate standard DNS record types
An Address (A) record is specifically designed for 32-bit IPv4 host address mapping.
Different DNS record types serve distinct functions; A records handle standard IPv4 forward lookups.

Key Concept

DNS Record Types and Functionality
Question 469Question

A network engineer is configuring an IEEE 802.1Q trunk connection between two Layer 2 enterprise switches, Switch-A and Switch-B. Switch-A has its trunk port configured with native VLAN 10, whereas Switch-B has its trunk port configured with native VLAN 20. Host 1 is attached to an access port on Switch-A assigned to VLAN 10, and Host 2 is attached to an access port on Switch-B assigned to VLAN 20. If Host 1 transmits an unencapsulated broadcast frame into Switch-A, what occurs when this traffic traverses the link to Switch-B and reaches Host 2?

Show answer & explanation

Answer: Switch-A transmits the frame untagged across the trunk. Switch-B receives the untagged frame, assigns it to its native VLAN 20, and forwards it to Host 2 without requiring a Layer 3 router.

Answer

Switch-A transmits the frame untagged across the trunk. Switch-B receives the untagged frame, assigns it to its native VLAN 20, and forwards it to Host 2 without requiring a Layer 3 router.
Under IEEE 802.1Q trunking standards, frames assigned to the native VLAN of an egress trunk interface are transmitted untagged. Because Switch-A has native VLAN 10 configured, any frame from VLAN 10 traversing the trunk is sent without an 802.1Q tag. When Switch-B receives an untagged frame on its trunk port, it automatically attributes that frame to its own locally configured native VLAN (VLAN 20). Consequently, the broadcast frame is flooded to all ports in VLAN 20 on Switch-B, reaching Host 2 directly at Layer 2.

Step-by-Step Solution

1
Analyze Switch-A ingress and egress trunk behavior
Host 1 sends an unencapsulated frame into an access port on VLAN 10. When Switch-A forwards this frame out its trunk port, it compares the frame's VLAN (VLAN 10) to the trunk port's configured native VLAN (VLAN 10). Because they match, Switch-A transmits the frame untagged across the trunk link.
According to IEEE 802.1Q standards, traffic matching the local native VLAN of a trunk port is sent without an explicit 4-byte 802.1Q VLAN header.
2
Analyze Switch-B ingress trunk processing
Switch-B receives the untagged frame on its trunk port. Switch-B maps all incoming untagged frames received on a trunk interface to its own locally configured native VLAN, which is VLAN 20.
Trunk ports inspect incoming frames; if no 802.1Q tag is present, the switch implicitly tags/assigns the frame to its local native VLAN.
3
Analyze Layer 2 broadcast forwarding to destination host
Because the broadcast frame is now internally associated with VLAN 20 on Switch-B, Switch-B floods the frame out all ports belonging to VLAN 20 broadcast domain, delivering it directly to Host 2.
The native VLAN mismatch leaks Layer 2 traffic between VLAN 10 on Switch-A and VLAN 20 on Switch-B without requiring a Layer 3 routing device.

Key Concept

802.1Q Native VLAN Ingress/Egress Tagging and Traffic Leakage
Question 470Question

A network administrator is reviewing protocol operations at Layer 4 (Transport Layer) of the OSI model. Which of the following core functions are performed at this layer? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Process-to-process multiplexing using port numbers; Flow control and connection management using segment sliding windows

Answer

The Transport Layer (Layer 4) provides process-to-process multiplexing via port numbers and flow control through segment sequencing and sliding windows.
Layer 4 (Transport Layer) manages end-to-end communication between software processes on different hosts. Key responsibilities include process-to-process multiplexing using TCP/UDP port numbers and flow control (such as sliding window mechanisms in TCP) to prevent sender buffer overrun.

Step-by-Step Solution

1
Identify the OSI layer referenced in the question stem
The target is Layer 4, the Transport Layer.
Understanding which OSI layer is being queried narrows down the protocol data units (PDUs) and functional scope.
2
Evaluate each function against Layer 4 duties
Multiplexing via port numbers and flow control/windowing are primary responsibilities of Transport layer protocols like TCP and UDP.
Layer 4 is responsible for end-to-end communication services between process sockets.
3
Eliminate functions associated with lower OSI layers
Logical IP routing is a Layer 3 (Network) task, and MAC address framing is a Layer 2 (Data Link) task.
Differentiating adjacent layer functions prevents misidentifying PDU operations.

Key Concept

OSI Transport Layer (Layer 4) Primary Functions
Estimated Time:1m 0s
Question 471Question

A network technician is configuring a Layer 2 switch port connected to an IP phone, which in turn bridges a connection to a desktop workstation. The switch port is configured to handle traffic for both Data VLAN 10 and Voice VLAN 20. Which TWO of the following statements correctly describe how the switch processes Ethernet frames on this port? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Traffic originating from the desktop workstation arrives untagged and is assigned to Data VLAN 10 by the switch port.; Voice traffic destined for the IP phone is transmitted from the switch port tagged with an 802.1Q header for VLAN 20.

Answer

The correct statements are that traffic originating from the desktop workstation arrives untagged and is assigned to Data VLAN 10, and voice traffic destined for the IP phone is transmitted tagged with an 802.1Q header for VLAN 20.
When an IP phone and desktop PC share a single switch port, the switch handles PC traffic as untagged data belonging to the configured Data VLAN. Traffic intended for the IP phone is encapsulated with an 802.1Q tag specifying the Voice VLAN, enabling the phone to separate its voice traffic from the workstation's data traffic.

Step-by-Step Solution

1
Analyze workstation data frame processing
Frames from the workstation arrive untagged at the IP phone bridge and pass untagged to the switch port, where the switch maps them to Data VLAN 10.
Standard desktop network cards transmit untagged Ethernet frames, which the switch associates with the untagged native/data VLAN configured on the port.
2
Analyze IP phone voice frame processing
Voice traffic sent from the switch port to the IP phone is encapsulated with an 802.1Q header specifying VLAN 20.
The IP phone reads the 802.1Q tag to extract voice traffic for itself while stripping tags and bridging untagged data traffic to the attached PC.

Key Concept

802.1Q frame tagging behavior on switch ports configured with voice and data VLANs
Question 472Question

A network architect is designing stateless access control rules for a perimeter gateway to support an out-of-band network management architecture. The security design mandates four specific operational services:
1. Centralized device administration AAA that encrypts the entire packet payload.
2. Accurate network time synchronization across all infrastructure nodes.
3. Unsolicited, asynchronous alert notifications sent from managed edge switches to a central monitoring station.
4. Secure, encrypted transmission of system log messages to a centralized SIEM platform.

Which combination of protocols, transport layer types, and default port numbers correctly satisfies all four architecture requirements?

Show answer & explanation

Answer: TACACS+ on TCP port 49, NTP on UDP port 123, SNMP Traps on UDP port 162, and Syslog over TLS on TCP port 6514

Answer

TACACS+ on TCP port 49, NTP on UDP port 123, SNMP Traps on UDP port 162, and Syslog over TLS on TCP port 6514 correctly satisfies all four requirements.
The correct selection accurately pairs each specified service with its standard port and transport protocol: TACACS+ encrypts the entire payload over TCP port 49; NTP synchronizes time via UDP port 123; SNMP Traps deliver asynchronous notifications to UDP port 162; and Syslog over TLS secures system logs over TCP port 6514.

Step-by-Step Solution

1
Identify the protocol that encrypts the entire AAA packet payload and its transport parameters.
TACACS+ encrypts the complete packet body (unlike RADIUS, which encrypts only passwords) and operates over TCP port 49.
Security requirement 1 specifies full payload encryption for device administration AAA.
2
Determine the transport protocol and default port for Network Time Protocol (NTP).
NTP uses UDP port 123.
Requirement 2 mandates network time synchronization.
3
Differentiate between SNMP Polling and SNMP Trap transport definitions.
Asynchronous switch notifications (Traps) are sent to destination UDP port 162, whereas NMS polling requests target UDP port 161.
Requirement 3 specifies unsolicited, asynchronous alert notifications from managed switches.
4
Identify the secure transport variant for system log forwarding.
Standard unencrypted Syslog uses UDP port 514, while encrypted Syslog over TLS uses TCP port 6514.
Requirement 4 specifies encrypted transmission of log messages.

Key Concept

Core Management Ports and Transport Protocols
Estimated Time:2m 0s
Question 473Question

A network engineer is configuring a network management platform that collects high-frequency telemetry data from core switches. The data collector requires a transport protocol that minimizes packet header overhead and does not delay data transmission with connection establishment or acknowledgment tracking. Which of the following features are characteristic of the transport protocol appropriate for this telemetry traffic? (SELECT TWO)

Select all that apply

Show answer & explanation

Answer: A fixed 8-byte header structure without fields for sequence numbering or flow control; Best-effort data delivery operating without a prior connection establishment handshake

Answer

The characteristics of the connectionless protocol (UDP) required for high-frequency telemetry are a fixed 8-byte header structure without sequence numbers or flow control, and best-effort data delivery operating without a prior connection handshake.
The scenario describes a telemetry application requiring User Datagram Protocol (UDP), which is connectionless. UDP relies on a fixed 8-byte header containing no sequence numbers, window sizes, or acknowledgment fields, and it sends datagrams using best-effort delivery without establishing a session handshake first.

Step-by-Step Solution

1
Identify the application requirements and transport layer protocol type.
The requirement for low header overhead and no transmission delay due to connection setup or tracking points to User Datagram Protocol (UDP), a connectionless protocol.
High-frequency telemetry prioritizes low latency and minimal overhead over guaranteed delivery.
2
Evaluate protocol header and operational characteristics.
UDP features a minimal 8-byte header (source port, destination port, length, checksum) and operates on a best-effort basis without an initial handshake.
Connectionless protocols eliminate session state tracking, connection handshakes, and windowing mechanisms.

Key Concept

Connectionless protocol (UDP) characteristics versus connection-oriented protocol (TCP) mechanisms
Estimated Time:1m 30s
Question 474Question

A network engineer is auditing advanced Layer 2 switching configurations and traffic handling mechanisms across an enterprise network infrastructure. Match each switching concept or frame processing scenario on the left with its corresponding Layer 2 operational behavior on the right.

Click a left item, then click its matching right item

Items

Voice VLAN configuration on a single physical switch interface connected to an IP phone and workstation
Private VLAN (PVLAN) Isolated Port operational behavior
IEEE 802.1Q Trunk Port handling of incoming untagged Ethernet frames
Switch CAM table MAC address aging expiration and unknown unicast frame handling

Matches

Show answer & explanation

Answer

Voice VLAN pairs with separating voice 802.1Q tagged traffic from untagged PC data on a single port. PVLAN Isolated Port pairs with restricting frame forwarding exclusively to promiscuous ports while blocking other isolated/community ports. IEEE 802.1Q Trunk handling of untagged frames pairs with mapping them to the native VLAN without inserting an 802.1Q header. CAM table aging expiration pairs with unknown unicast flooding out all active ports in the VLAN except the receiving interface.
Each concept correctly maps to its foundational Layer 2 behavior: Voice VLAN separates tagged VoIP traffic from untagged PC traffic on one physical interface; PVLAN Isolated Ports restrict Layer 2 forwarding exclusively to promiscuous ports; 802.1Q Trunk Native VLAN handling processes untagged ingress frames without appending internal 802.1Q headers; and CAM table aging triggers unknown unicast flooding strictly within the source VLAN.

Step-by-Step Solution

1
Analyze Voice VLAN operation on an interface connected to an IP phone daisy-chained to a PC.
Identify that voice traffic utilizes 802.1Q tagging (often with 802.1p Class of Service bits) while data traffic from the PC remains untagged on the port's access VLAN.
Voice VLAN segregation relies on Layer 2 tagging to differentiate real-time voice packets from standard data packets over a single physical link.
2
Analyze Private VLAN (PVLAN) Isolated Port mechanics.
Determine that an isolated port completely blocks Layer 2 communication to all other ports within the primary/secondary VLAN except promiscuous ports.
PVLANs enforce micro-segmentation by ensuring isolated host ports cannot talk to each other directly at Layer 2.
3
Analyze IEEE 802.1Q trunking behavior for native VLAN ingress frames.
Confirm that untagged ingress frames on a trunk interface are associated with the native VLAN and sent without adding an 802.1Q tag header.
IEEE 802.1Q maintains backward compatibility for untagged traffic by assigning untagged frames to a single native VLAN per trunk link.
4
Analyze CAM table MAC aging and frame forwarding behavior.
Recognize that when a MAC address is flushed or aged out of the CAM table, frames directed to that MAC address are treated as unknown unicast traffic and flooded out all ports in the broadcast domain except the ingress port.
Switches use unknown unicast flooding to ensure delivery when a destination MAC-to-port mapping is absent from the forwarding database.

Key Concept

Advanced Layer 2 Switching Mechanics, Frame Tagging, VLAN Isolation, and Forwarding Logic
Question 475Question

Match each network protocol on the left with its standard default port and transport protocol on the right.

Click a left item, then click its matching right item

Items

SSH (Secure Shell)
HTTPS (Hypertext Transfer Protocol Secure)
SNMP (Simple Network Management Protocol)
RDP (Remote Desktop Protocol)

Matches

Show answer & explanation

Answer

SSH matches with TCP Port 22, HTTPS matches with TCP Port 443, SNMP matches with UDP Port 161, and RDP matches with TCP Port 3389.
Each protocol is accurately matched with its default well-known port and transport protocol: SSH operates on TCP port 22, HTTPS operates on TCP port 443, SNMP operates on UDP port 161, and RDP operates on TCP port 3389.

Step-by-Step Solution

1
Identify remote administration and secure web service ports
SSH maps to TCP port 22 and HTTPS maps to TCP port 443.
SSH provides encrypted shell access over TCP port 22, while HTTPS secures web communications over TCP port 443.
2
Identify monitoring and graphical remote access ports
SNMP maps to UDP port 161 and RDP maps to TCP port 3389.
SNMP uses unacknowledged UDP transport on port 161 for low-latency status polling, whereas RDP requires a reliable TCP connection on port 3389 for graphical desktop sessions.

Key Concept

Standard default port numbers and transport layer protocols for network services
Question 476Question

A network engineer is troubleshooting a communication failure affecting a industrial telemetry client connected to a central monitoring server. Packet captures obtained at the server interface show that incoming IP datagrams containing UDP segments arrive intact with valid IP headers and checksums. However, the host operating system immediately responds to each datagram with an ICMP Destination Unreachable (Port Unreachable) message. At which layer of the OSI model is the demultiplexing process failing, preventing the payload from reaching the receiving application process?

Show answer & explanation

Answer: Transport Layer (Layer 4)

Answer

Transport Layer (Layer 4)
The correct answer identifies the Transport Layer (Layer 4). Port numbers reside at Layer 4 and are used to multiplex and demultiplex network streams to specific host application sockets. Receiving an ICMP Port Unreachable error confirms that Layer 2 framing and Layer 3 IP routing succeeded in delivering the frame to the host, but the Transport Layer stack could not map the destination UDP port to an active, listening application process.

Step-by-Step Solution

1
Analyze the packet capture symptoms
IP datagrams reach the destination host with valid IP headers, but generate an ICMP Port Unreachable message from the host.
ICMP Port Unreachable is emitted when an endpoint receives a transport segment destined for a port number with no listening socket.
2
Map port addressing to the OSI Model
Port numbers (TCP/UDP) function as software addressing endpoints at Layer 4 (Transport Layer).
Layer 4 uses port numbers to demultiplex incoming network data to the correct application layer process.
3
Identify the OSI layer responsible for the failure
The demultiplexing failure occurs at Layer 4.
Because Layer 3 IP processing succeeded, the breakdown occurs during Layer 4 port matching.

Key Concept

OSI Layer 4 Transport Layer protocol demultiplexing using port numbers
Question 477Question

During a configuration audit of an enterprise router, a network engineer notices several IPv6 addresses entered by junior administrators. The engineer must ensure all addresses conform to standard IPv6 formatting rules (RFC 5952). Which of the following IPv6 addresses represents a syntactically valid shorthand compression of the uncompressed address 2001:0db8:0000:0000:00ab:0000:0000:0001?

Show answer & explanation

Answer: 2001:db8::ab:0:0:1

Answer

2001:db8::ab:0:0:1 is the correct, syntactically valid compressed IPv6 address.
The address '2001:db8::ab:0:0:1' correctly applies RFC 5952 IPv6 representation rules. Leading zeros within hextets are removed (0db8 -> db8, 00ab -> ab, 0001 -> 1), and the first longest sequence of contiguous zero hextets is replaced with a single double-colon (::). The second zero sequence is represented with single zeros to avoid using multiple double colons.

Step-by-Step Solution

1
Identify leading zero suppression rules for each 16-bit hextet.
2001 remains 2001; 0db8 becomes db8; 0000 becomes 0; 00ab becomes ab; 0001 becomes 1.
Leading zeros in any 16-bit hexadecimal group must be omitted, but trailing zeros within a hextet must be preserved.
2
Apply the double-colon (::) zero compression rule to contiguous blocks of zero hextets.
The address contains two blocks of zeros: two consecutive 0000 hextets (positions 3–4) and two consecutive 0000 hextets (positions 6–7).
When zero sequence lengths are equal, RFC 5952 specifies compressing the first sequence of zero hextets with a single double-colon (::).
3
Assemble the compressed address using only a single double-colon (::).
2001:db8::ab:0:0:1
Using :: more than once in an address introduces ambiguity during parsing.

Key Concept

IPv6 Address Compression Rules (RFC 5952)
Estimated Time:1m 30s
Question 478Question

A Layer 2 switch receives an untagged Ethernet frame on access port FastEthernet 0/1, which is assigned to VLAN 20. The destination MAC address of the frame is not present in the switch's CAM (MAC address) table. Switch port FastEthernet 0/24 is configured as an 802.1Q trunk port with a native VLAN of 20 and allowed VLANs 10, 20, and 30. Switch port FastEthernet 0/12 is an access port in VLAN 10, and FastEthernet 0/13 is an access port in VLAN 20. How will the switch process and forward this frame?

Show answer & explanation

Answer: The switch floods the frame untagged out FastEthernet 0/13 and untagged out trunk port FastEthernet 0/24, while omitting FastEthernet 0/12.

Answer

The switch floods the frame untagged out FastEthernet 0/13 and untagged out trunk port FastEthernet 0/24, while omitting FastEthernet 0/12.
The incoming frame enters on access port FastEthernet 0/1 in VLAN 20. When a switch receives a frame with an unmapped destination MAC address (unknown unicast), it floods the frame to every active interface within that specific VLAN except the ingress port. FastEthernet 0/13 is in VLAN 20, so it receives the frame untagged. Trunk port FastEthernet 0/24 allows VLAN 20, but since VLAN 20 is configured as the native VLAN on that trunk, 802.1Q rules dictate that the frame is transmitted without a VLAN header tag. FastEthernet 0/12 belongs to VLAN 10 and is isolated from VLAN 20 traffic.

Step-by-Step Solution

1
Determine the broadcast domain (VLAN) of the incoming frame.
The untagged frame arrives on access port FastEthernet 0/1, which is assigned to VLAN 20. The frame is internally associated with VLAN 20.
Access ports assign untagged ingress frames to their configured port VLAN ID (PVID).
2
Evaluate the switch forwarding rule for an unknown destination MAC address.
Because the destination MAC address is missing from the CAM table, the frame is classified as unknown unicast and must be flooded out all ports belonging to VLAN 20 except ingress port FastEthernet 0/1.
Layer 2 switches perform unknown unicast flooding within the source VLAN boundary.
3
Determine tagging behavior for egress ports.
Port FastEthernet 0/13 is an access port in VLAN 20, so the frame egresses untagged. Port FastEthernet 0/24 is a trunk carrying VLAN 20 as its native VLAN, so the frame egresses untagged. Port FastEthernet 0/12 is in VLAN 10 and is excluded entirely.
802.1Q trunks do not tag frames associated with the designated native VLAN.

Key Concept

Unknown Unicast Flooding and IEEE 802.1Q Native VLAN Egress Tagging Rules
Question 479Question

A host computer initiates a file transfer and passes data down the OSI model stack for network transmission. Which of the following sequences correctly lists the Protocol Data Units (PDUs) generated during this outbound encapsulation process in order from the highest layer to the lowest layer?

Show answer & explanation

Answer: Data, Segment, Packet, Frame, Bits

Answer

The correct sequence of Protocol Data Units (PDUs) during outbound encapsulation from highest layer to lowest layer is Data, Segment, Packet, Frame, and Bits.
Outbound encapsulation processes data top-down through the protocol stack. The Application, Presentation, and Session layers manage Data. The Transport layer encapsulates this into Segments (or UDP datagrams). The Network layer encapsulates segments into Packets with logical IP addresses. The Data Link layer encapsulates packets into Frames with physical MAC addresses. Finally, the Physical layer converts frames into Bits for transmission over the network medium.

Step-by-Step Solution

1
Determine the direction of data flow from the scenario.
The host is sending data, meaning traffic moves outbound (top-down) from upper applications down to the physical medium.
Outbound traversal requires adding headers sequentially from Layer 7 to Layer 1.
2
Match each OSI layer to its designated Protocol Data Unit (PDU).
Layers 5-7 handle Data, Layer 4 creates Segments, Layer 3 creates Packets, Layer 2 creates Frames, and Layer 1 transmits Bits.
Each layer encapsulates data received from the layer above by appending its own header/trailer.
3
Arrange the PDUs in top-down sequence.
Data → Segment → Packet → Frame → Bits.
This order reflects the exact encapsulation workflow of an originating host stack.

Key Concept

OSI Layer Encapsulation Order and PDU Terminology
Question 480Question

A network administrator analyzes traffic captures taken at different network segments along a multi-hop path while Host A transmits a file to Host B across a standard Layer 3 router (without NAT). Which of the following statements correctly describe how protocol headers and Data Link trailers are altered or processed during this network traversal? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The Layer 2 Data Link frame header and trailer are stripped at the router's ingress interface and encapsulated with a new source MAC and next-hop destination MAC at the egress interface.; The Layer 3 IP header retains the original source and destination IP addresses from Host A to Host B throughout the router traversal.

Answer

The correct statements are that Layer 2 frame headers and trailers are stripped and replaced at each router hop, and that Layer 3 IP headers preserve the original end-to-end IP addresses across standard routing hops.
Layer 2 framing (MAC headers and FCS trailers) operates strictly on a hop-by-hop basis, meaning a router must strip the incoming link-layer frame and construct a brand-new frame for the next segment. Simultaneously, Layer 3 logical addressing (source and destination IP addresses) remains unchanged end-to-end across standard routing hops.

Step-by-Step Solution

1
Analyze Layer 2 scope during router traversal.
Layer 2 addressing (MAC addresses, Ethernet headers, FCS trailers) is local to a single collision/broadcast domain. Routers terminate Layer 2 broadcast domains, stripping inbound frames and encapsulating outbound IP packets into new frames suited for the next-hop link.
Data Link encapsulation is hop-by-hop.
2
Analyze Layer 3 scope during router traversal.
Layer 3 IP headers contain end-to-end addressing. Routers update the Time-to-Live (TTL) field and recalculate the IP checksum, but the original source IP and final destination IP remain constant across intermediate standard routers.
Network layer addressing provides end-to-end logical path identification.
3
Evaluate intermediate switch and router processing against OSI layer roles.
Intermediate Layer 2 switches do not alter Layer 4 TCP port numbers or headers, nor do routers rebuild Layer 3 headers from scratch.
Encapsulation layers remain isolated; devices only modify fields relevant to their operational layer and lower-layer framing.

Key Concept

Hop-by-Hop Data Link Encapsulation vs. End-to-End Network Address Preservation
PreviousPage 24 / 27Next
Networking Concepts Practice Questions — CompTIA Network+ — Page 24 | Examkin