Networking Concepts

538 questions

All types538 Multiple choice279 Multiple select117 Numeric19 Matching95 Ordering28

A network engineer is reviewing an enterprise IPv6 deployment plan and packet capture specifications. Match each IPv6 address prefix on the left with its correct operational scope or functional purpose on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

fe80::/10 matches link-local single-segment scope; ff02::1:ff00:0/104 matches solicited-node multicast for NDP; fc00::/7 matches unique local private addressing; and 2001:db8::/32 matches reserved documentation space.

Each IPv6 prefix corresponds directly to its defined architectural function: fe80::/10 is restricted to single-link operations; ff02::1:ff00:0/104 generates solicited-node multicast targets for NDP address resolution; fc00::/7 designates unique local addresses for internal enterprise routing; and 2001:db8::/32 is reserved globally for examples and documentation.

Step-by-Step Solution

Identify the scope of fe80::/10

Link-Local unicast prefix

Addresses starting with fe80:: are constrained to a single broadcast domain or link and are never forwarded by routers.

Identify the function of ff02::1:ff00:0/104

Solicited-Node Multicast range

Used by ICMPv6 Neighbor Discovery Protocol (NDP) Neighbor Solicitation messages to map IPv6 addresses to MAC addresses efficiently.

Identify the scope of fc00::/7

Unique Local Address (ULA) prefix

Serves a similar role to IPv4 RFC 1918 private IP addresses, allowing site-wide routing without Internet exposure.

Identify the purpose of 2001:db8::/32

Documentation IPv6 prefix

Allocated specifically to ensure sample configurations and text documentation do not accidentally overlap with operational production addresses.

Key Concept

IPv6 Address Prefixes and Operational Scopes

Question 482Question →

A managed Layer 2 switch receives an Ethernet frame on access port FastEthernet 0/1, which is assigned to VLAN 20. The switch inspects its MAC address table and finds an entry for the source MAC address, but the destination MAC address is not present in the table. Which action will the switch take to forward this frame?

Flood the frame out of all operational ports assigned to VLAN 20, excluding port FastEthernet 0/1.

Forward the frame out of all operational ports on the switch regardless of their VLAN assignment.

Add an 802.1Q tag for VLAN 20 to the frame header and forward it out of the native VLAN port.

Drop the frame immediately and transmit an ICMP destination unreachable notification to the sender.

Show answer & explanation

Answer: Flood the frame out of all operational ports assigned to VLAN 20, excluding port FastEthernet 0/1.

Answer

Flood the frame out of all operational ports assigned to VLAN 20, excluding port FastEthernet 0/1.

When a Layer 2 switch encounters an unknown destination MAC address, it handles the frame as unknown unicast by flooding it to all active interfaces assigned to the frame's ingress VLAN, excluding the port on which the frame entered.

Step-by-Step Solution

Examine the switch forwarding table state for the destination MAC address.

The destination MAC address is absent from the MAC address table, classifying the packet as an unknown unicast frame.

Layer 2 switches rely on MAC address table lookups to perform selective frame filtering and forwarding.

Apply Layer 2 unknown unicast forwarding logic within the ingress VLAN.

The switch floods the frame out of every active interface in VLAN 20 except the receiving interface FastEthernet 0/1.

Flooding allows the frame to reach the intended destination host while preserving VLAN broadcast domain isolation and preventing loops on the ingress interface.

Key Concept

Layer 2 Unknown Unicast Flooding and VLAN Isolation

Question 483Question →

A network technician is auditing frame forwarding behavior on an enterprise Layer 2 switch. An Ethernet frame arrives at an 802.1Q trunk interface carrying a tag for VLAN 50. Upon inspecting its MAC address table, the switch finds no entry corresponding to the destination MAC address of the frame. Which TWO of the following actions will the switch execute to handle this frame?

Select all that apply

Inspect the source MAC address of the frame and update the MAC address table entry for VLAN 50.

Flood the frame out of all operational interfaces assigned to VLAN 50, excluding the ingress trunk port.

Flood the frame out of all active interfaces across all configured VLANs on the switch.

Strip the 802.1Q tag and route the packet using the Layer 3 destination IP address header.

Remove the 802.1Q header tag and transmit the frame untagged out of native VLAN ports only.

Show answer & explanation

Answer: Inspect the source MAC address of the frame and update the MAC address table entry for VLAN 50.; Flood the frame out of all operational interfaces assigned to VLAN 50, excluding the ingress trunk port.

Answer

The switch will record the source MAC address into its MAC address table for VLAN 50 and flood the unknown unicast frame out of all active ports assigned to VLAN 50, excluding the port on which it arrived.

When a frame reaches a switch interface, the switch performs source MAC learning and records the association between the MAC address, ingress port, and VLAN 50. If the destination MAC address is absent from the CAM table, the switch executes unknown unicast flooding, transmitting the frame out of all active ports assigned to VLAN 50 except the receiving ingress port.

Step-by-Step Solution

Analyze ingress processing for source MAC address learning.

The switch reads the source MAC address and 802.1Q VLAN ID (VLAN 50) to update or add an entry in its CAM/MAC address table for the ingress port.

MAC address learning happens on incoming frames regardless of whether the destination address is known.

Evaluate destination lookup for frame forwarding.

Since the destination MAC address is missing from the MAC address table, the frame is classified as an unknown unicast frame.

Unknown unicast traffic requires flooding to ensure delivery to the intended destination host.

Apply VLAN broadcast domain containment rules.

The frame is flooded to all interfaces belonging to VLAN 50, omitting the ingress interface.

VLANs act as distinct Layer 2 broadcast domains, restricting unknown unicast flooding strictly within the specified VLAN boundary.

Key Concept

Layer 2 MAC Table Learning and Unknown Unicast Flooding within VLAN Boundaries

Estimated Time:1m 30s

Question 484Question →

A network architect is allocating IPv4 subnets from the parent block $192.168.100.0/24$ for a newly constructed branch office. Following Variable Length Subnet Masking (VLSM) best practices, subnets are assigned sequentially starting from the lowest available network address in descending order of subnet size. The branch office requirements are as follows:
- Data VLAN: $60$ workstations
- VoIP VLAN: $28$ IP phones
- Management VLAN: $12$ network switch interfaces
- WAN Redundancy VLAN: $3$ usable host IP addresses required ( $2$ physical router interfaces plus $1$ HSRP virtual IP)

Assuming each subnet is sized to the smallest standard CIDR block that satisfies its respective requirements, what is the starting IP address of the remaining contiguous unallocated pool in the $192.168.100.0/24$ block?

192.168.100.116

192.168.100.120

192.168.100.128

192.168.100.118

Show answer & explanation

Answer: $192.168.100.120$

Answer

192.168.100.120

is the starting network address of the unallocated space.

The starting address of the unallocated pool is

192.168.100.120

. Allocating the subnets sequentially by largest size first yields: Data VLAN on

192.168.100.0/26

(ends .63), VoIP VLAN on

192.168.100.64/27

(ends .95), Management VLAN on

192.168.100.96/28

(ends .111), and WAN Redundancy VLAN on

192.168.100.112/29

(ends .119, requiring a

/29

block to fit

3

usable IPs). The unallocated space starts at

192.168.100.120

Step-by-Step Solution

Sort VLAN requirements in descending order of size to apply VLSM efficiently.

Order: Data VLAN (

60

hosts)

\rightarrow

VoIP VLAN (

28

hosts)

\rightarrow

Management VLAN (

12

hosts)

\rightarrow

WAN Redundancy VLAN (

3

hosts).

Allocating largest subnets first prevents address fragmentation and ensures boundary alignment.

Calculate required block sizes and assign the Data VLAN.

Needs

60 + 2 = 62

IP addresses. Next power of

2

64

(

/26

). Allocated block:

192.168.100.0/26

(

192.168.100.0 - 192.168.100.63

Subnet must account for host capacity plus

1

network ID and

1

broadcast address.

Calculate required block size and assign the VoIP VLAN.

Needs

28 + 2 = 30

IP addresses. Next power of

2

32

(

/27

). Allocated block:

192.168.100.64/27

(

192.168.100.64 - 192.168.100.95

/27

block supplies

30

usable host IPs (

32 - 2

Calculate required block size and assign the Management VLAN.

Needs

12 + 2 = 14

IP addresses. Next power of

2

16

(

/28

). Allocated block:

192.168.100.96/28

(

192.168.100.96 - 192.168.100.111

/28

block supplies

14

usable host IPs (

16 - 2

Calculate required block size and assign the WAN Redundancy VLAN.

Needs

3

usable IPs (

2

physical +

1

HSRP VIP)

+ 2

(network + broadcast)

= 5

total addresses. Next power of

2

8

(

/29

). Allocated block:

192.168.100.112/29

(

192.168.100.112 - 192.168.100.119

/30

only provides

2

usable host IPs (

4 - 2

), which is insufficient for

3

usable IPs. A

/29

prefix (

8

total addresses) must be selected.

Determine the next available unallocated IP address.

The final allocated block ends at

192.168.100.119

. The remaining unallocated pool begins at

192.168.100.120

The next address immediately following

192.168.100.119

192.168.100.120

Key Concept

VLSM Subnet Block Sizing and Address Boundary Alignment

Question 485Question →

A network security architect is reviewing enterprise core IP addressing service configurations to harden multi-VLAN operations and directory service integration. Match each specific service capability or deployment requirement on the left with its corresponding network protocol, DNS record type, or service mechanism on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

1. Injecting switch attachment details pairs with DHCP Option 82. 2. Advertising server hostnames, ports, priority, and weight pairs with DNS SRV Record. 3. Securing name resolution using cryptographic signatures pairs with DNSSEC. 4. Distributing UTC clock synchronization metrics pairs with NTP.

The pairings are correct because each IP service mechanism directly addresses the stated technical requirement: DHCP Option 82 appends switch attachment metadata to relay requests; DNS SRV records specify target hostnames along with port numbers, priority, and weight; DNSSEC adds cryptographic signature verification to DNS records; and NTP distributes synchronized stratum-based clock references for precise logging across network nodes.

Step-by-Step Solution

Analyze the requirement for attaching switch port metadata into DHCP requests across subnets.

Identify that DHCP Relay Agent Information Option (Option 82) allows intermediate Layer 3 relay switches to append subscriber circuit IDs and remote IDs before relaying queries.

Option 82 provides security and targeted IP assignment based on physical switch port locations.

Examine service locator requirements that include port, priority, weight, and target hostname information.

Match with the DNS SRV (Service) record specification.

SRV records explicitly publish transport port numbers along with priority and load-balancing weights for service endpoint discovery.

Evaluate the cryptographic authentication mechanism for protecting DNS records against tampering and cache poisoning.

Match with DNSSEC (DNS Security Extensions).

DNSSEC adds digital signatures to DNS records to provide origin authority and data integrity verification.

Determine the service responsible for propagating accurate hierarchical UTC time synchronization across enterprise logs.

Match with Network Time Protocol (NTP).

NTP uses hierarchical stratum reference clocks to align time values across distributed systems.

Key Concept

Core Enterprise IP Addressing Services and Features

Question 486Question →

A network engineer is auditing protocol specifications at the transport layer. Match each transport layer feature or mechanism on the left with its corresponding operational protocol characteristic on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

TCP Three-Way Handshake matches establishing formal session state and sequence numbers; UDP Fixed 8-Byte Header matches minimizing overhead by omitting sequence/acknowledgment fields; TCP Sliding Window Mechanism matches dynamically regulating transmission volume via receiver buffer capacity; UDP Best-Effort Delivery matches transmitting independent datagrams without tracking order or retransmissions.

Each feature aligns directly with its underlying transport protocol design: TCP mechanisms (Three-Way Handshake and Sliding Window) fulfill connection initialization and buffer flow control, whereas UDP attributes (Fixed 8-Byte Header and Best-Effort Delivery) exemplify lightweight, stateless datagram transport.

Step-by-Step Solution

Categorize each item on the left as either a connection-oriented (TCP) or connectionless (UDP) mechanism.

TCP items represent stateful connection management and flow control functions. UDP items represent stateless, minimal-overhead datagram transport.

Connection-oriented protocols focus on session state and reliability, whereas connectionless protocols prioritize low latency and minimal overhead.

Map TCP mechanisms to session creation and data flow management characteristics.

The Three-Way Handshake corresponds to session state establishment, while the Sliding Window mechanism corresponds to receiver-driven flow control.

TCP requires explicit session initialization and dynamic rate adjustment to prevent receiver buffer exhaustion.

Map UDP mechanisms to structural header design and datagram delivery characteristics.

The 8-byte header reflects the absence of connection control fields, and best-effort delivery describes unacknowledged, independent packet transmission.

Connectionless transport eliminates connection setup and tracking fields to reduce header size and processing delay.

Key Concept

Connection-Oriented vs. Connectionless Protocol Characteristics (TCP vs. UDP)

Question 487Question →

A network technician is auditing Layer 2 frame processing on a managed switch. Port 1 is an access port assigned to VLAN 30 (Engineering), Port 2 is an access port assigned to VLAN 40 (Finance), and Port 24 is configured as an 802.1Q trunk port allowing VLANs 10, 30, and 40, with Native VLAN configured as 10. A workstation connected to Port 1 sends an Ethernet broadcast frame (destination MAC `FF:FF:FF:FF:FF:FF`). Which TWO of the following statements correctly describe how the switch handles this incoming frame? (Select TWO.)

Select all that apply

The switch floods the broadcast frame out all active access ports assigned to VLAN 30, but does not transmit it out Port 2.

The switch strips any existing VLAN tags and forwards the frame out Port 24 without an 802.1Q header.

The switch inserts an 802.1Q tag specifying VLAN ID 30 into the Ethernet frame header before forwarding it out Port 24.

The switch inspects the destination IP address and uses its local ARP table to route the Layer 2 broadcast directly into VLAN 40.

The switch replaces the frame's source MAC address with the switch's base MAC address before egressing out Port 24.

Show answer & explanation

Answer: The switch floods the broadcast frame out all active access ports assigned to VLAN 30, but does not transmit it out Port 2.; The switch inserts an 802.1Q tag specifying VLAN ID 30 into the Ethernet frame header before forwarding it out Port 24.

Answer

The switch floods the broadcast frame out all active access ports assigned to VLAN 30 while excluding VLAN 40 ports, and encapsulates the frame with an 802.1Q tag specifying VLAN ID 30 when forwarding it over the trunk link.

VLANs operate as separate Layer 2 broadcast domains. Therefore, an Ethernet broadcast originating on a VLAN 30 access port is flooded only to other ports within VLAN 30 (excluding ports in VLAN 40). Additionally, when forwarding this frame out an 802.1Q trunk link where the native VLAN is set to 10, the switch must insert an 802.1Q VLAN tag (VID 30) into the frame to preserve its VLAN membership across the trunk.

Step-by-Step Solution

Determine the Layer 2 broadcast domain boundary for the ingress frame.

The ingress frame arrives on Port 1, which is explicitly assigned to VLAN 30. A VLAN isolates broadcast traffic into a single logical broadcast domain.

Broadcast frames are replicated strictly within the originating VLAN boundary, meaning ports assigned to VLAN 40 (such as Port 2) will not receive the frame.

Evaluate frame forwarding logic across the 802.1Q trunk port.

Port 24 is configured as an 802.1Q trunk allowing VLAN 30. Because VLAN 30 is non-native (Native VLAN is 10), an 802.1Q header with VLAN ID 30 is inserted.

802.1Q trunking rules dictate that all non-native VLAN traffic MUST be tagged with a 4-byte 802.1Q header upon egress to maintain VLAN identity across switches.

Key Concept

VLAN Broadcast Containment and 802.1Q Trunk Egress Tagging Logic

Question 488Question →

An edge router receives route advertisements from multiple sources for destination networks overlapping with the target IP address $172.16.10.45$ . The router's routing table currently contains the following active operational entries:

Protocol Source	Destination Prefix	Administrative Distance	Metric	Next-Hop Interface
EIGRP (Internal)	$172.16.0.0/16$	90	156160	GigabitEthernet0/0
OSPF	$172.16.10.0/24$	110	20	GigabitEthernet0/1
eBGP	$172.16.10.32/27$	20	100	GigabitEthernet0/2
Static Route	$172.16.10.0/24$	120	0	GigabitEthernet0/3

When the router processes an inbound IP packet addressed to $172.16.10.45$ , which next-hop interface will be selected to forward the packet?

GigabitEthernet0/2, because longest prefix matching takes precedence over administrative distance during forwarding decisions.

GigabitEthernet0/0, because EIGRP has a lower administrative distance (90) than OSPF (110) and Static routes (120).

GigabitEthernet0/1, because OSPF matches the standard /24 classful network boundary with a lower metric than eBGP.

GigabitEthernet0/3, because static routes override dynamic dynamic routing protocols for packet forwarding.

Show answer & explanation

Answer: GigabitEthernet0/2, because longest prefix matching takes precedence over administrative distance during forwarding decisions.

Answer

The router forwards the packet out interface GigabitEthernet0/2 because the eBGP route 172.16.10.32/27 has the longest matching prefix (/27) for the target IP address 172.16.10.45.

When a router receives a packet, it searches its routing table for all entries that match the destination IP address. If multiple matching routes exist with different prefix lengths, the router strictly enforces the Longest Prefix Match (LPM) rule. In this scenario, the target IP

172.16.10.45

matches

172.16.0.0/16

172.16.10.0/24

, and

172.16.10.32/27

. The

/27

subnet mask is the most specific match (27 bits), making GigabitEthernet0/2 the correct forwarding interface regardless of administrative distance or protocol metric.

Step-by-Step Solution

Determine which advertised subnets contain the target IP address 172.16.10.45.

The target address 172.16.10.45 is contained within 172.16.0.0/16, 172.16.10.0/24, and 172.16.10.32/27 (range: 172.16.10.32 - 172.16.10.63).

All three prefix ranges match the target IP destination.

Understand the distinction between routing table installation and packet forwarding logic.

Administrative distance (AD) determines which route gets installed in the routing table when identical prefixes exist. Longest Prefix Match (LPM) determines packet forwarding among installed routes.

Multiple routes with different prefix lengths can coexist simultaneously in the routing table.

Compare the prefix lengths of all matching installed routes.

Comparing bit mask lengths: /27 (27 bits) > /24 (24 bits) > /16 (16 bits).

Longest Prefix Match requires selecting the route with the highest number of matching network prefix bits.

Map the longest matching prefix to its corresponding egress interface.

The /27 prefix route corresponds to interface GigabitEthernet0/2.

GigabitEthernet0/2 is the next-hop interface for 172.16.10.32/27.

Key Concept

Longest Prefix Match (LPM) in Layer 3 Packet Forwarding

Question 489Question →

Security audit logs indicate that endpoints located in a newly provisioned research laboratory segment (subnet $10.45.80.0/24$ ) are failing to receive dynamic IP address assignments. The organization maintains a centralized redundant DHCP server cluster at $10.45.10.50$ . While unicast routing between the subnets is verified to be functioning properly, client broadcast DHCPDISCOVER messages originating from the laboratory segment are stopped at the local router interface. Which configuration change on the gateway router will allow the research segment endpoints to obtain dynamic IP leases from the central cluster?

Adding the IP helper address pointing to 10.45.10.50 on the router interface serving subnet 10.45.80.0/24

Adding the IP helper address pointing to 10.45.80.1 on the router interface directly connected to the DHCP server

Creating an authoritative CNAME record on the DNS server mapping the subnet broadcast address to 10.45.10.50

Reconfiguring the client endpoints to transmit DHCP discovery requests over TCP port 68 instead of UDP port 67

Show answer & explanation

Answer: Adding the IP helper address pointing to 10.45.10.50 on the router interface serving subnet 10.45.80.0/24

Answer

Configure the IP helper address pointing to 10.45.10.50 on the incoming router interface for subnet 10.45.80.0/24.

Routers do not forward Layer 2 or Layer 3 broadcast messages across subnet boundaries by default. When endpoints emit DHCPDISCOVER broadcasts on subnet 10.45.80.0/24, the router interface serving as their default gateway drops the broadcast. Configuring an IP helper address on that specific incoming interface enables the router to act as a DHCP Relay Agent, converting the broadcast into a unicast frame addressed directly to the central DHCP server at 10.45.10.50.

Step-by-Step Solution

Identify the cause of DHCP request drops across subnets

Routers block broadcast frames (such as DHCPDISCOVER sent to 255.255.255.255) by default to prevent broadcast storms across network boundaries.

Layer 3 boundaries isolate broadcast domains.

Determine the required relay agent placement

The router interface receiving the client broadcast (subnet 10.45.80.0/24 default gateway) must act as a DHCP Relay Agent.

The relay agent intercept broadcast traffic on the client subnet and encapsulates it into unicast traffic directed to the central server IP address.

Select the correct interface configuration command

Applying the IP helper address command on the client-facing interface routes UDP broadcasts (including DHCP on port 67) to 10.45.10.50.

This enables cross-subnet IP addressing service delivery without placing a DHCP server on every local segment.

Key Concept

DHCP Relay / IP Helper Agent Configuration

Estimated Time:1m 15s

Question 490Question →

A network administrator is troubleshooting a connection failure where internal application servers reject connections from newly deployed management systems. Log analysis reveals that the application servers perform a mandatory reverse IP lookup to validate host identity before establishing a session. While forward lookup zones resolve hostnames to IP addresses correctly, reverse lookups fail for statically addressed hosts because Dynamic DNS (DDNS) updates are only executed by dynamic DHCP clients. Which DNS record type must be manually created in the reverse lookup zone to resolve this issue?

PTR records mapping the IP addresses of the static management systems to their canonical hostnames

CNAME records pointing the static IP addresses to the existing forward A records of the hosts

DHCP Relay IP Helper addresses configured on the local switch interfaces to relay dynamic updates

SRV records defining the service ports and transport protocols used by DNS name resolution daemons

Show answer & explanation

Answer: PTR records mapping the IP addresses of the static management systems to their canonical hostnames

Answer

Manually creating Pointer (PTR) records in the reverse lookup zone resolves IP addresses to domain names for static hosts.

Reverse DNS lookups query the reverse lookup zone (in-addr.arpa for IPv4) to convert an IP address into a domain name. Because statically configured hosts do not automatically register reverse records via DHCP/DDNS integration, PTR (Pointer) records must be manually created to populate the reverse lookup zone and satisfy security authentication checks.

Step-by-Step Solution

Analyze the authentication requirement

The application servers require valid reverse DNS resolution (IP address to hostname mapping) to authorize connecting clients.

Security checks often rely on reverse lookup verification to prevent IP spoofing.

Identify the cause of missing records

Statically configured hosts do not participate in automated Dynamic DNS (DDNS) registrations handled by DHCP daemons.

Without DDNS or manual intervention, reverse lookup zone entries remain incomplete for static IP addresses.

Select the appropriate DNS record type

Create PTR records in the corresponding in-addr.arpa reverse lookup zone.

PTR records specifically map IP addresses to domain names, resolving reverse lookup queries.

Key Concept

DNS Record Types and Reverse Lookup Operation

Question 491Question →

A network host connected to Switch Port 1 (configured as a Layer 2 access port in VLAN 10) transmits a unicast Ethernet frame destined for a host on Switch Port 2 (also an access port in VLAN 10). The switch's MAC address table already contains an active, valid entry mapping the destination MAC address to Switch Port 2. Which of the following operations will the switch perform upon receiving the frame?

Inspect the destination MAC address, identify the matching entry for Switch Port 2, and forward the untagged frame exclusively out Switch Port 2.

Insert a 4-byte 802.1Q VLAN header containing VLAN ID 10 into the frame before transmitting it out Switch Port 2.

Flood the frame out all active interfaces across all VLANs on the switch except Switch Port 1 to locate the destination host.

Decapsulate the frame header, evaluate the Layer 3 IP header, and route the packet directly to the default gateway before forwarding it to Switch Port 2.

Show answer & explanation

Answer: Inspect the destination MAC address, identify the matching entry for Switch Port 2, and forward the untagged frame exclusively out Switch Port 2.

Answer

The switch inspects the destination MAC address, identifies the matching MAC address table entry for Switch Port 2, and forwards the untagged frame exclusively out Switch Port 2.

When a switch receives a unicast frame on an access port, it looks up the destination MAC address in its MAC address table. Since the address is present (known unicast) and belongs to the same VLAN, the switch forwards the frame directly out the associated port (Switch Port 2) without adding 802.1Q tags.

Step-by-Step Solution

Analyze the incoming frame and port mode configuration

The frame arrives on Switch Port 1, which is assigned as an access port in VLAN 10.

Access ports accept untagged frames and associate them internally with their configured VLAN.

Perform a MAC address table lookup for the destination address

A matching entry is found linking the destination MAC address directly to Switch Port 2.

Known unicast entries allow the switch to perform microsegmentation and forward traffic directly to the target port.

Determine the egress frame handling for an access port

The frame is egressed out Switch Port 2 in standard untagged Ethernet frame format.

802.1Q tags are stripped or never added on access ports connected to end hosts.

Key Concept

Switching Concepts and VLAN Forwarding Logic

Estimated Time:1m 15s

Question 492Question →

Match each network classification to its primary geographic scope or architectural function.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Personal Area Network (PAN) pairs with short-range personal device connection; Storage Area Network (SAN) pairs with dedicated block-level storage access; Campus Area Network (CAN) pairs with interconnecting LANs across adjacent campus buildings; Metropolitan Area Network (MAN) pairs with citywide geographic coverage.

Each network classification aligns directly with its defined spatial scale or storage function: PAN covers immediate short-range personal devices, SAN delivers high-speed block storage access, CAN links multiple building LANs within a campus setting, and MAN encompasses a municipality or city.

Step-by-Step Solution

Analyze the geographic reach and structural characteristics of each network type listed.

Short-range peripheral connections correspond to PAN, block-level storage consolidation corresponds to SAN, multi-building LAN aggregation corresponds to CAN, and citywide coverage corresponds to MAN.

Network types are categorized either by spatial distance limits or by specialized infrastructure roles.

Pair each network classification to its matching functional description.

PAN matches short-range device connectivity; SAN matches high-speed block storage fabric; CAN matches multi-building LAN interconnectivity; MAN matches citywide or municipal scope.

Connecting each classification to its definition validates understanding of standard networking scope specifications.

Key Concept

Classification of network types based on geographic scale and operational function

Estimated Time:1m 30s

Question 493Question →

A network administrator is performing packet flow analysis on a network where a host on Subnet A sends traffic to a server on Subnet B through an intermediate Layer 3 router. Which statement correctly describes the encapsulation and de-encapsulation actions executed by the router as it forwards a data packet toward its destination?

The router strips the incoming Layer 2 frame header and trailer to inspect the Layer 3 IP packet destination, maintains the original IP packet payload, and encapsulates it inside a new Layer 2 frame with source and destination MAC addresses updated for the next hop.

The router de-encapsulates the packet through Layer 4 to inspect TCP port numbers before re-encapsulating the data into a brand-new IP packet and Ethernet frame.

The router strips both the Layer 2 Ethernet header and Layer 3 IP header, forwarding only the Layer 4 segment to the next switch for MAC address resolution.

The router modifies the destination IP address inside the Layer 3 header to match the next-hop router's physical MAC address while keeping the Layer 2 frame untouched.

Show answer & explanation

Answer: The router strips the incoming Layer 2 frame header and trailer to inspect the Layer 3 IP packet destination, maintains the original IP packet payload, and encapsulates it inside a new Layer 2 frame with source and destination MAC addresses updated for the next hop.

Answer

The router removes the incoming Layer 2 framing, inspects the Layer 3 IP header to determine the next hop, decrements the Time to Live (TTL), and encapsulates the preserved IP packet into a new Layer 2 frame with updated MAC addresses.

The correct response accurately highlights that Layer 3 routers strip incoming Layer 2 frame encapsulation to read the destination IP address, keep the IP packet intact for end-to-end delivery, and construct a new Layer 2 frame with updated source and destination hardware addresses for the outbound link.

Step-by-Step Solution

Receive and process Layer 2 frame

The router interface receives the physical signals, validates the Frame Check Sequence (FCS), and strips the Layer 2 Ethernet header and trailer.

Layer 2 framing is hop-to-hop and only delivers data across the single local broadcast domain.

Inspect Layer 3 IP packet

The router reads the destination IP address from the IP header, decrements the Time to Live (TTL) field by 1, and recalculates the IP header checksum.

Logical end-to-end addressing resides at Layer 3 and governs route decision-making across subnet boundaries.

Re-encapsulate into new Layer 2 frame

The router queries ARP/neighbor discovery for the next-hop MAC address, encapsulates the IP packet into a new Layer 2 frame using its egress interface MAC as the source and the next-hop MAC as the destination, and sends the frame.

Data must be framed appropriately for the specific link layer protocol of the egress network interface.

Key Concept

Hop-by-Hop Layer 2 Re-framing vs End-to-End Layer 3 Packet Preservation

Estimated Time:2m 0s

Question 494Question →

A senior network engineer is designing a multi-protocol enterprise network architecture utilizing both Interior Gateway Protocols (IGPs) and Exterior Gateway Protocols (EGPs). Which of the following statements correctly describe dynamic routing protocol characteristics and path evaluation behaviors in this environment? (Select TWO)

Select all that apply

Internal BGP (iBGP) routes have a default Administrative Distance of 200, causing a router to prefer an internal OSPF route (Administrative Distance of 110) if both protocols advertise the exact same prefix length.

Link-state dynamic routing protocols, such as OSPF, exchange Link-State Advertisements (LSAs) to construct a complete link-state database (LSDB) before running the Dijkstra algorithm to calculate the shortest path tree.

Dynamic routing protocol algorithms evaluate metrics exclusively at Layer 2, appending hop-by-hop MAC address tables to frame headers to complete end-to-end path calculations across WAN boundaries.

Border Gateway Protocol (BGP) neighbors establish peerings using connectionless UDP transport on port 179 to minimize packet encapsulation delay when exchanging full routing tables.

Show answer & explanation

Answer: Internal BGP (iBGP) routes have a default Administrative Distance of 200, causing a router to prefer an internal OSPF route (Administrative Distance of 110) if both protocols advertise the exact same prefix length.; Link-state dynamic routing protocols, such as OSPF, exchange Link-State Advertisements (LSAs) to construct a complete link-state database (LSDB) before running the Dijkstra algorithm to calculate the shortest path tree.

Answer

The statement regarding Internal BGP having an Administrative Distance of 200 compared to OSPF's 110, and the statement regarding link-state protocols building an LSDB via LSAs prior to running the Dijkstra algorithm, are both correct.

The statement concerning Internal BGP (iBGP) is correct because iBGP carries a default Administrative Distance of 200, which is higher (less preferred) than OSPF's default AD of 110 when choosing between equal prefix matches. The statement concerning link-state protocols is also correct because OSPF routers gather topology information via LSAs to populate the local Link-State Database (LSDB) before running the Dijkstra algorithm to calculate optimal routes.

Step-by-Step Solution

Evaluate the Administrative Distance relationship between iBGP and OSPF.

OSPF routes have an Administrative Distance (AD) of 110, whereas iBGP routes have an AD of 200. Because lower AD indicates higher trustworthiness, OSPF is preferred over iBGP for equal prefix matches.

Administrative Distance is the first tie-breaker used by the routing table manager when multiple protocols advertise the same prefix.

Analyze link-state routing protocol convergence and database synchronization mechanisms.

OSPF routers synchronize their Link-State Database (LSDB) by exchanging Link-State Advertisements (LSAs) and then run Dijkstra's Shortest Path First (SPF) algorithm.

Unlike distance-vector protocols that share routing tables by rumor, link-state protocols require a complete topology map prior to path computation.

Verify OSI layer boundaries for routing protocols and BGP transport requirements.

Routing decisions occur at Layer 3 using IP headers, and BGP uses TCP port 179 for reliable peering.

Layer 2 MAC headers change at each router hop, and BGP relies on TCP's connection-oriented guarantees rather than connectionless UDP.

Key Concept

Administrative Distance hierarchy and Link-State Routing Protocol convergence mechanisms

Estimated Time:2m 0s

Question 495Question →

A network administrator assigns the IPv4 prefix $192.168.10.0/29$ to a small network segment. Which of the following statements regarding this subnet are correct? (Select TWO)

Select all that apply

The subnet mask in dotted-decimal notation is 255.255.255.248.

The network provides a total of 6 usable IP addresses for host devices.

The network provides a total of 8 usable IP addresses for host devices.

The broadcast address for this subnet segment is 192.168.10.8.

Show answer & explanation

Answer: The subnet mask in dotted-decimal notation is 255.255.255.248.; The network provides a total of 6 usable IP addresses for host devices.

Answer

The subnet mask is 255.255.255.248 and the network provides a total of 6 usable IP addresses for host devices.

For a /29 subnet, there are 3 host bits remaining (

32 - 29 = 3

). The subnet mask corresponds to 255.255.255.248. The total number of IP addresses in the block is

2^3 = 8

. Subtracting the network identifier (192.168.10.0) and the broadcast address (192.168.10.7) leaves 6 usable IP addresses for hosts.

Step-by-Step Solution

Calculate the subnet mask from CIDR notation /29.

The subnet mask has 29 network bits and 3 host bits. In dotted-decimal form, 255.255.255.248.

Converting /29 to binary gives 11111111.11111111.11111111.11111000, which equals 255.255.255.248.

Calculate total IP addresses and usable host addresses.

Total addresses =

2^3 = 8

. Usable host addresses =

8 - 2 = 6

The network ID (192.168.10.0) and broadcast address (192.168.10.7) cannot be assigned to hosts.

Key Concept

IPv4 Subnetting and Usable Host Calculation

Question 496Question →

A network engineer is integrating a new remote branch office subnet ( $172.16.40.0/24$ ) connected to corporate headquarters through a Layer 3 site-to-site VPN. Client workstations at the branch fail to obtain dynamic IP configurations from the central enterprise DHCP server ( $10.10.10.5$ ). Packet captures confirm that client DHCPDISCOVER broadcast frames arrive at the branch router's inbound local interface, but no DHCPOFFER packets are returned. Which configuration change on the branch router directly resolves this connectivity failure?

Configure an IP helper address pointing to

10.10.10.5

on the branch router's LAN interface facing the client subnet.

Configure an IP helper address pointing to

10.10.10.5

on the branch router's WAN interface facing the VPN tunnel.

Add a CNAME record on the headquarters DNS server mapping the branch default gateway IP to the central DHCP server hostname.

Enable UDP port 69 relay forwarding on the branch router's LAN interface to pass client discovery packets across the gateway.

Show answer & explanation

Answer: Configure an IP helper address pointing to $10.10.10.5$ on the branch router's LAN interface facing the client subnet.

Answer

Configure an IP helper address pointing to

10.10.10.5

on the branch router's LAN interface facing the client subnet.

Configuring an IP helper address on the client-facing LAN interface allows the branch router to intercept client broadcast DHCPDISCOVER messages (UDP port 67). The router converts these broadcasts into unicast IP packets targeted directly at the remote central DHCP server (

10.10.10.5

) across the routed VPN, populating the gateway IP field (GIADDR) so the server can assign an address from the

172.16.40.0/24

scope.

Step-by-Step Solution

Analyze the traffic type and network boundary condition.

Client workstations issue broadcast DHCPDISCOVER requests (

255.255.255.255

) on the local LAN. Routers drop Layer 3 broadcast traffic by default.

Broadcast packets cannot naturally traverse the Layer 3 site-to-site VPN to reach the central server at

10.10.10.5

Determine the correct service mechanism and placement.

A DHCP Relay Agent (IP Helper) must be deployed on the router interface receiving the client broadcasts (the local LAN interface).

The relay agent intercept broadcasts on the ingress LAN interface, encapsulates them into unicast packets directed to

10.10.10.5

, and inserts gateway IP address (GIADDR) information so the server knows which scope to allocate from.

Evaluate distractor configurations against technical requirements.

Placing the helper on the WAN interface, creating CNAME records, or forwarding UDP port 69 (TFTP) fails to address the root cause of unforwarded DHCP UDP 67/68 broadcasts.

Only configuring the IP helper address on the LAN interface correctly converts local incoming broadcasts to unicast packets sent to the central server.

Key Concept

DHCP Relay Agent and IP Helper Placement

Question 497Question →

An infrastructure team is deploying Voice over IP (VoIP) telephony across a corporate network. To ensure IP phones can dynamically discover the target hostname, listening port number, and transport protocol of the primary SIP server via domain queries, which DNS resource record type must be provisioned in the internal DNS zone?

SRV record

PTR record

CNAME record

MX record

Show answer & explanation

Answer: SRV record

Answer

The SRV record must be provisioned because it includes host, protocol, and port details required for service discovery.

The SRV record (Service Location record) is specifically formatted (e.g., _sip._tcp.example.com) to specify the location of servers for specified services, including the target domain name, port number, priority, and weight.

Step-by-Step Solution

Identify the operational requirement for client endpoint discovery.

IP phones require locating a specific service (SIP) along with its associated transport protocol (e.g., UDP/TCP) and port number (e.g., 5060).

Standard host resolution records only map names to IP addresses without service port context.

Evaluate standard DNS record capabilities against service discovery requirements.

Only an SRV (Service Location) record contains fields for service name, protocol, priority, weight, port, and target host.

SRV records are explicitly designed to allow clients to locate services operating on non-standard ports or specific server instances.

Key Concept

DNS SRV Record for Service Location

Question 498Question →

A system engineer is updating perimeter firewall rules to allow local network devices to retrieve operating system installation images from a Trivial File Transfer Protocol (TFTP) provisioning server. Which transport protocol and port combination must be permitted inbound on the server?

UDP port 69

TCP port 21

TCP port 22

UDP port 67

Show answer & explanation

Answer: UDP port 69

Answer

UDP port 69

Trivial File Transfer Protocol (TFTP) operates on UDP port 69. It provides low-overhead, connectionless file transfer suitable for devices requesting firmware or PXE network boot images.

Step-by-Step Solution

Identify the protocol specified for retrieving boot images.

The scenario identifies Trivial File Transfer Protocol (TFTP).

TFTP is specifically designed for simple, unauthenticated file downloads during network bootstrapping.

Determine the transport protocol and standard service port for TFTP.

TFTP listens on UDP port 69.

Because TFTP relies on UDP rather than TCP, inbound requests must be permitted on UDP destination port 69.

Key Concept

Trivial File Transfer Protocol (TFTP) port and transport protocol assignment

Estimated Time:1m 0s

Question 499Question →

A network technician connects a new workstation to Port 4 on a Layer 2 switch. Port 4 is configured as an access port in VLAN 30. The workstation immediately sends a broadcast ARP request to discover its default gateway. The switch currently has active access ports in VLAN 10 and VLAN 30, as well as an 802.1Q trunk port carrying both VLANs (with VLAN 1 as the native VLAN). Which of the following actions will the switch take upon receiving this frame?

Forward the frame to all active access ports in VLAN 30 and encapsulate it with an 802.1Q tag for VLAN 30 across the trunk port.

Flood the frame out all active access ports in both VLAN 10 and VLAN 30 to ensure the default gateway receives the ARP request.

Inspect the IP payload and route the packet directly to the default gateway interface residing in VLAN 10.

Drop the frame at the ingress port because untagged broadcast traffic cannot traverse an 802.1Q trunk port.

Show answer & explanation

Answer: Forward the frame to all active access ports in VLAN 30 and encapsulate it with an 802.1Q tag for VLAN 30 across the trunk port.

Answer

The switch forwards the broadcast frame out all active access ports assigned to VLAN 30 and tags the frame with an 802.1Q header for VLAN 30 before transmitting it across the trunk port.

VLANs partition a physical switch into distinct Layer 2 broadcast domains. When an untagged broadcast frame enters an access port assigned to VLAN 30, the switch floods the frame to all local active interfaces belonging to VLAN 30. Furthermore, when forwarding the frame across an 802.1Q trunk link where VLAN 30 is non-native, the switch inserts an 802.1Q tag header containing the VLAN 30 ID so the adjacent switch maintains proper VLAN isolation.

Step-by-Step Solution

Identify the ingress port's VLAN assignment and frame type.

The frame enters Port 4 (assigned to VLAN 30) as an untagged Layer 2 broadcast frame destined for ffff.ffff.ffff.

Traffic entering an access port is implicitly associated with that port's configured access VLAN.

Determine the Layer 2 forwarding domain boundaries.

The broadcast domain is restricted exclusively to interfaces belonging to VLAN 30.

VLANs logically segment a physical switch into isolated Layer 2 broadcast domains.

Apply 802.1Q trunking rules for outgoing interfaces.

The frame is flooded to all active local access ports in VLAN 30 and sent out the trunk port with an added 4-byte 802.1Q header specifying VLAN 30.

802.1Q trunk links carry traffic for multiple VLANs by appending VLAN identification tags to non-native VLAN frames.

Key Concept

VLAN Broadcast Isolation and 802.1Q Trunk Tagging

Question 500Question →

A network engineer is documenting network protocol stack operations for a technical audit. Match each OSI model layer listed on the left to its corresponding primary functional responsibility on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Session Layer (Layer 5) matches establishing and synchronizing application dialog control checkpoints; Presentation Layer (Layer 6) matches data formatting, character encoding, and encryption; Transport Layer (Layer 4) matches end-to-end segmentation, flow control, and port addressing; Data Link Layer (Layer 2) matches node-to-node framing and physical MAC addressing.

Each OSI model layer serves a distinct role in data processing: Layer 5 manages session connections and checkpoints; Layer 6 standardizes syntax, encoding, and encryption; Layer 4 facilitates transport segmentation and port communication; and Layer 2 constructs data frames for physical hop-to-hop media traversal.

Step-by-Step Solution

Identify the primary responsibility of the Session Layer (Layer 5).

Layer 5 establishes, maintains, and terminates communication sessions, managing synchronization checkpoints between end-user applications.

Dialog management and session recovery are core functions defined at Layer 5.

Identify the primary responsibility of the Presentation Layer (Layer 6).

Layer 6 acts as a data translator, handling syntax formatting, MIME/character conversion, and cryptographic operations such as encryption and compression.

It ensures that data sent from the application layer of one system can be read by the application layer of another system.

Identify the primary responsibility of the Transport Layer (Layer 4).

Layer 4 handles service-to-service host communications, segmenting data streams, providing port addressing, and controlling data flow (via TCP/UDP).

Transport protocols govern reliable or unreliable host-to-host data delivery mechanism.

Identify the primary responsibility of the Data Link Layer (Layer 2).

Layer 2 organizes raw bits into structured frames and applies physical hardware MAC addressing for single-hop delivery across local networks.

Physical medium transmission management and frame error checking (FCS) operate at Layer 2.

Key Concept

OSI Model Seven Layer Functional Breakdown

Estimated Time:1m 30s

PreviousPage 25 / 27Next

Networking Concepts

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept