Examkin

Tüm alıştırma soruları

1987 soru

Tüm türler1,987Çoktan seçmeli1,020Çoklu seçim452Sayısal18Eşleştirme229Sıralama203Boşluk doldurma22Kısa cevap43
Soru 141Soru →

A network technician is configuring static IPv4 addresses for new network monitoring probes on a subnetwork assigned the address block 192.168.50.144/28192.168.50.144/28. Which of the following IP addresses are valid usable host addresses on this subnet? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: 192.168.50.146192.168.50.146; 192.168.50.157192.168.50.157

Cevap

The addresses 192.168.50.146192.168.50.146 and 192.168.50.157192.168.50.157 are valid usable host addresses on the 192.168.50.144/28192.168.50.144/28 subnet.
For the network block 192.168.50.144/28192.168.50.144/28, the /28/28 prefix yields a block size of 16 (256−240256 - 240). The subnet boundaries are defined by the network ID 192.168.50.144192.168.50.144 and the broadcast address 192.168.50.159192.168.50.159. Therefore, valid host IP addresses must fall strictly between 192.168.50.145192.168.50.145 and 192.168.50.158192.168.50.158. The addresses 192.168.50.146192.168.50.146 and 192.168.50.157192.168.50.157 fall within this range.

Adım Adım Çözüm

1
Determine the subnet mask and block size from the CIDR prefix.
A /28/28 prefix corresponds to a subnet mask of 255.255.255.240255.255.255.240. The block size (increment) per subnet is 256−240=16256 - 240 = 16.
Calculating the block size identifies the boundary and increment for the subnet range.
2
Identify the network ID and broadcast address for the subnet.
The network ID is 192.168.50.144192.168.50.144. The next subnet starts at 144+16=160144 + 16 = 160, making the broadcast address 192.168.50.159192.168.50.159.
Network ID and broadcast address delineate the extreme boundaries of the subnet.
3
Calculate the usable host address range.
The first usable host address is 192.168.50.145192.168.50.145 and the last usable host address is 192.168.50.158192.168.50.158.
Usable host addresses exclude the network ID and broadcast address (2n−22^n - 2).
4
Evaluate the candidate options against the usable host range.
192.168.50.146192.168.50.146 and 192.168.50.157192.168.50.157 lie strictly within the range 192.168.50.145192.168.50.145–192.168.50.158192.168.50.158, while 192.168.50.144192.168.50.144 is the network ID and 192.168.50.159192.168.50.159 is the broadcast address.
Only IP addresses within the usable host range can be statically configured on end-device interfaces.

Anahtar Kavram

IPv4 Usable Host Address Range Calculation
Soru 142Soru →

A network administrator needs to manually configure interface GigabitEthernet1/0/22 on a Cisco Catalyst switch as a dedicated access port for a workstation in VLAN 35 (FINANCE). Assuming VLAN 35 already exists in the VLAN database, which set of commands must be applied under the interface configuration mode to properly complete this task?

Cevabı ve açıklamayı göster

Cevap: switchport mode access
switchport access vlan 35

Cevap

To configure a switch interface as a static access port in VLAN 35, the engineer must enter interface configuration mode and execute 'switchport mode access' followed by 'switchport access vlan 35'.
The correct command sequence requires defining the interface operational type as an access port using 'switchport mode access' and then binding the port to the specific VLAN ID using 'switchport access vlan 35'.

Adım Adım Çözüm

1
Enter interface configuration mode
Navigates to the interface context using 'interface GigabitEthernet1/0/22'.
Configuration commands for port membership must be executed under the specific interface prompt.
2
Set administrative mode to access
Executes 'switchport mode access'.
Definitive host access operation disables DTP dynamic negotiation into trunking state.
3
Assign the access VLAN ID
Executes 'switchport access vlan 35'.
Maps untagged ingress frames from the connected device into VLAN 35.

Anahtar Kavram

Cisco IOS Access Port Assignment Syntax
Soru 143Soru →

Two Cisco routers, R1 and R2, are directly connected via their GigabitEthernet0/0 interfaces and configured to run OSPFv2. During verification, a network engineer notices that the routers fail to form an OSPF neighbor relationship. Which TWO parameters configured on the interfaces or within the OSPF process must match identically in the OSPF Hello packets for the neighbor adjacency to successfully form? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Area ID; Hello and Dead timer intervals

Cevap

The parameters that must match identically for OSPFv2 neighbor adjacency formation are Area ID and Hello and Dead timer intervals.
To successfully establish an OSPFv2 neighbor adjacency, directly connected routers must agree on several Hello packet fields, including identical Area IDs, matching Hello and Dead timers, matching IP subnet/mask, matching authentication settings, and matching stub area flags. Area ID and Hello/Dead timer intervals are mandatory matching parameters.

Adım Adım Çözüm

1
Analyze OSPF Hello packet contents required for neighbor validation.
Identify parameters that are verified upon receipt of a Hello packet on an OSPF-enabled interface.
For two OSPF routers to establish a neighbor relationship, key fields in the Hello packet header must match.
2
Evaluate the Area ID requirement.
Confirm that both connected interfaces must share the exact same Area ID.
If the Area ID field in the incoming Hello packet does not match the receiving interface's configured area, the packet is dropped.
3
Evaluate the Hello and Dead timer requirements.
Confirm that Hello intervals and Dead intervals must match exactly.
Mismatched timers prevent the routers from agreeing on keepalive expectations, causing adjacency initialization to fail.
4
Evaluate local vs global parameters (Process ID and Router ID).
Determine that Process ID is local only and Router ID must be unique.
Process ID is assigned locally per device, while Router IDs must never match to avoid duplicate router ID conflicts in the OSPF topology.

Anahtar Kavram

OSPFv2 Neighbor Adjacency Requirements
Soru 144Soru →

An engineer is troubleshooting a degraded Ethernet connection on switch interface `FastEthernet0/8` connected to an end host. The interface output reveals high numbers of `late collisions` and `deferred` frames, while `input errors` remain at zero:

text
FastEthernet0/8 is up, line protocol is up (connected)
Hardware is Fast Ethernet, address is 000c.ce6b.a108
Full-duplex, 100Mb/s, media type is 100BaseTX
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 buffer
3842 late collisions, 1045 deferred, 0 lost carrier

Which TWO physical or data-link conditions are the most probable causes of these output statistics? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: A duplex mismatch where the switch port is forced to full-duplex and the connected device is operating in half-duplex; The copper cable segment length exceeds the maximum 100-meter limit defined by Ethernet standards

Cevap

The most probable causes are a duplex mismatch where one side operates in full-duplex while the other operates in half-duplex, and an Ethernet copper cable run that exceeds the 100-meter maximum length specification.
Late collisions occur when a device detects a collision after transmitting the first 64 bytes of an Ethernet frame. The two primary causes are a duplex mismatch (where one end operates in full-duplex while the other operates in half-duplex, causing the half-duplex end to detect late collisions) and an over-length cable run (where cable propagation delay exceeds the slot time of 512 bit times).

Adım Adım Çözüm

1
Analyze the interface statistics provided in the CLI output
Identified high numbers of late collisions (3842) and deferred frames (1045), with zero CRC or input errors.
Late collisions occur when a collision is detected after the first 64 bytes (512 bits) of a frame have been transmitted.
2
Evaluate potential causes of late collisions on Ethernet links
Duplex mismatches (full-duplex on switch, half-duplex on host) cause the half-duplex host to detect full-duplex transmissions as late collisions. Excessively long cable runs (>100m) delay collision detection past the 64-byte window.
Late collisions are exclusively associated with timing issues on half-duplex collision domains or duplex mismatches.
3
Eliminate invalid options based on Layer 1/Layer 2 symptom profiles
Native VLAN mismatches affect traffic routing/tagging across trunks rather than interface collision counters. Cable pinout mismatches without Auto-MDIX cause the link status to remain down/down.
Physical cabling pinout errors prevent link layer synchronization entirely.

Anahtar Kavram

Late Collision and Duplex Mismatch Troubleshooting
Soru 145Soru →

Two Cisco Catalyst switches, SW1 and SW2, are connected via their GigabitEthernet0/1 interfaces. SW1 is configured with `switchport mode dynamic desirable` and `switchport trunk native vlan 99`. SW2 is configured with `switchport mode dynamic auto` and retains its default native VLAN 1. Assuming default IEEE 802.1Q trunking behavior, what is the resulting operational state of this interswitch link?

Cevabı ve açıklamayı göster

Cevap: A trunking operational mode is successfully established via DTP negotiation, but PVST+ places VLAN 1 and VLAN 99 into a blocking state on the link due to a PVID inconsistency.

Cevap

A trunking operational mode is successfully established via DTP negotiation, but PVST+ places VLAN 1 and VLAN 99 into a blocking state on the link due to a PVID inconsistency.
Dynamic Trunking Protocol (DTP) operates independently of native VLAN configurations, allowing a port in dynamic desirable mode to successfully negotiate an operational 802.1Q trunk with a port in dynamic auto mode. However, Cisco PVST+ sends Spanning Tree BPDUs with VLAN tagging metadata (SSTP). When the switches receive BPDUs indicating different native VLAN IDs (VLAN 99 vs VLAN 1), PVST+ flags a PVID inconsistency and places VLAN 1 and VLAN 99 into a blocking state on the interface to prevent unauthorized cross-VLAN data leakage and loops.

Adım Adım Çözüm

1
Analyze DTP mode negotiation between SW1 and SW2
SW1 (`dynamic desirable`) actively sends DTP frames to SW2 (`dynamic auto`), negotiating the link into an operational 802.1Q trunk.
DTP negotiation only evaluates DTP operational modes and encapsulation settings, not native VLAN IDs.
2
Evaluate Native VLAN configuration parameter compatibility
SW1 uses Native VLAN 99, while SW2 uses Native VLAN 1, creating a native VLAN mismatch across the trunk.
Untagged frames sent from VLAN 99 on SW1 would arrive on SW2 and be incorrectly ingested into VLAN 1.
3
Determine Spanning Tree Protocol (PVST+) operational behavior
PVST+ detects the Port VLAN ID (PVID) mismatch using Cisco Shared Spanning Tree Protocol (SSTP) BPDUs and places VLAN 1 and VLAN 99 into a `PVID-inc` (blocking) state on GigabitEthernet0/1.
Blocking the mismatched native VLANs prevents potential Layer 2 loops and cross-VLAN traffic leakage while allowing other matching VLANs to continue forwarding normally.

Anahtar Kavram

802.1Q Native VLAN Mismatch and PVST+ PVID Inconsistency Protection
Tahmini Süre:2m 0s
Soru 146Soru →

A network administrator is assigned the IPv6 prefix block `2001:db8:cafe:a000::/56` for a branch office. The administrator must divide this allocation into multiple `/64` subnets for individual client VLANs. Which prefix represents the last `/64` subnet available within this assigned block?

Cevabı ve açıklamayı göster

Cevap: 2001:db8:cafe:a0ff::/64

Cevap

The prefix 2001:db8:cafe:a0ff::/64 represents the last /64 subnet available within the assigned /56 block.
The prefix 2001:db8:cafe:a0ff::/64 correctly identifies the last /64 subnet within the 2001:db8:cafe:a000::/56 assignment. A /56 prefix allocates 8 bits (bits 57 through 64) for creating /64 subnets, which correspond to the last two hexadecimal digits of the fourth hextet. The range of the fourth hextet for these subnets is from a000 to a0ff.

Adım Adım Çözüm

1
Determine the number of subnet bits available between the assigned prefix length (/56) and the target prefix length (/64).
64 - 56 = 8 subnet bits, which equal 2 hexadecimal digits.
Each hexadecimal character in an IPv6 address represents 4 bits (1 nibble).
2
Identify which hextet and bit positions contain these subnet bits.
The first 48 bits cover the first three hextets (2001:db8:cafe:). The assigned /56 prefix includes the first 8 bits of the fourth hextet ('a0'). The subnet bits occupy the remaining 8 bits of the fourth hextet.
The fourth hextet spans bits 49 through 64.
3
Calculate the maximum value for the 8 subnet bits.
8 bits of all binary 1s equal hex 'ff'. The fourth hextet ranges from 'a000' (first subnet) to 'a0ff' (last subnet).
Hexadecimal 'a0' followed by 'ff' forms the last valid /64 prefix.

Anahtar Kavram

IPv6 Subnetting and Prefix Length Calculations
Soru 147Soru →

An administrator is configuring a corporate WLAN on a Cisco Wireless LAN Controller (WLC) GUI for enterprise clients requiring 802.1X authentication and centralized CAPWAP traffic forwarding. During initial client association tests, clients fail to complete 802.1X authentication and fail to receive an IP address via DHCP. Inspection of the WLC GUI shows that the WLAN status is enabled, but client traffic is mapped to the default management interface, and no authentication server is processing client login requests for this WLAN. Which TWO configurations within the WLC GUI WLAN edit menu must be applied to resolve these client connectivity issues? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Navigate to WLANs > Edit > Security > AAA Servers tab and select the active RADIUS server under Server 1 in the Authentication Servers section.; Navigate to WLANs > Edit > General tab and change the Interface/Interface Group dropdown from management to the mapped dynamic client VLAN interface.

Cevap

To resolve 802.1X client authentication failure and improper DHCP address assignment, the administrator must select an active RADIUS server under the Security > AAA Servers tab and reassign the WLAN interface mapping from management to the client dynamic VLAN interface under the General tab.
In the Cisco WLC GUI, establishing functional client connectivity for an 802.1X enterprise WLAN requires configuring AAA authentication server bindings under WLANs > Edit > Security > AAA Servers. Additionally, assigning client traffic to the correct dynamic interface corresponding to the client VLAN must be performed under the WLANs > Edit > General tab.

Adım Adım Çözüm

1
Diagnose 802.1X RADIUS server assignment failure
Identify that 802.1X authentication requests are dropped because no RADIUS server is bound to the WLAN under WLANs > Edit > Security > AAA Servers.
WLC WLANs configured for WPA2/WPA3-Enterprise (802.1X) require an explicit AAA server mapping in the WLAN settings to pass EAP messages to RADIUS.
2
Diagnose client VLAN and DHCP failure
Identify that mapping client traffic to the management interface prevents clients from obtaining lease addresses on the designated client subnet.
Cisco WLC GUI requires mapping each WLAN to its corresponding dynamic interface on the General tab to ensure proper VLAN tagging and DHCP relay forwarding.

Anahtar Kavram

WLAN Interface Mapping and AAA Server Association in Cisco WLC GUI
Soru 148Soru →

A network administrator is troubleshooting interswitch trunking between SW-Core1 and SW-Access1. The administrator issues the `show interfaces trunk` command on SW-Core1 and observes the following output:

PortModeEncapsulationStatusNative vlan
Gi0/24on802.1qtrunking10
PortVlans allowed on trunk
Gi0/241-4094
PortVlans allowed and active in management domain
Gi0/241,10,20,30
PortVlans in spanning tree forwarding state and not pruned
Gi0/241,10,30

Users in VLAN 20 connected to SW-Access1 report complete loss of connectivity to resources in VLAN 20 connected to SW-Core1, whereas users in VLAN 10 and VLAN 30 report normal operation. Based on the command output, what is the cause of the communication failure for VLAN 20?

Cevabı ve açıklamayı göster

Cevap: VLAN 20 is not in the Spanning Tree Protocol forwarding state (or has been pruned) on interface GigabitEthernet0/24.

Cevap

VLAN 20 is missing from the Spanning Tree Protocol forwarding state list on the trunk interface, preventing frames in VLAN 20 from being forwarded across the link.
The correct answer identifies that VLAN 20 is absent from the final section of the output: 'Vlans in spanning tree forwarding state and not pruned'. For traffic to pass across an 802.1Q trunk, a VLAN must be allowed on the trunk, active in the VLAN database, and in the STP forwarding state.

Adım Adım Çözüm

1
Analyze the 'Vlans allowed on trunk' field in the CLI output.
Interface GigabitEthernet0/24 allows VLANs 1-4094, meaning no explicit manual pruning (`switchport trunk allowed vlan`) is blocking VLAN 20.
Verifies that trunk port configuration permits VLAN 20 traffic.
2
Analyze the 'Vlans allowed and active in management domain' field.
VLAN 20 is listed alongside VLAN 1, 10, and 30, confirming VLAN 20 exists in the local VLAN database and is active.
Rules out local VLAN creation or state issues on SW-Core1.
3
Compare active management VLANs against 'Vlans in spanning tree forwarding state and not pruned'.
VLANs 1, 10, and 30 are forwarding, but VLAN 20 is absent from this list.
If a VLAN is missing from the final STP forwarding section, traffic for that VLAN is either blocked by STP or dynamic VTP pruning, preventing frame transmission across the link.

Anahtar Kavram

802.1Q Trunk Operational Verification and STP Per-VLAN Forwarding States
Tahmini Süre:1m 30s
Soru 149Soru →

A newly deployed workstation experiences network initial connection timeouts and fails to receive an IPv4 address allocation from the DHCP server upon booting up. A technician notes that the switch interface connected to the workstation takes 30 seconds to begin forwarding traffic due to standard 802.1D Spanning Tree Protocol (STP) state transitions. Which configuration change on the access interface resolves this issue, and what is its exact operational behavior?

Cevabı ve açıklamayı göster

Cevap: Enable PortFast on the access interface, allowing it to bypass the Listening and Learning states and transition immediately from Blocking to Forwarding.

Cevap

Enabling PortFast on the host access interface immediately transitions the port from Blocking to Forwarding by bypassing the 15-second Listening and 15-second Learning STP states.
Standard 802.1D STP transitions ports through Blocking, Listening (15s), and Learning (15s) states before entering Forwarding. On edge access ports connected to workstations, this 30-second delay causes DHCP requests to time out. Enabling PortFast allows the switch interface to transition immediately from Blocking to Forwarding, bypassing Listening and Learning states.

Adım Adım Çözüm

1
Identify the cause of the delay during host boot-up.
Standard IEEE 802.1D STP requires a port to spend 15 seconds in the Listening state and 15 seconds in the Learning state (total 30 seconds) before reaching Forwarding.
During this 30-second delay, the switch drops user data frames, causing host applications (such as DHCP client requests) to time out.
2
Determine the appropriate Cisco STP optimization feature for access ports connected to end devices.
Cisco PortFast is designed specifically for access ports connected directly to workstations, servers, or end-user hosts.
PortFast bypasses the Listening and Learning states, allowing the interface to transition directly from Blocking to Forwarding upon link up.

Anahtar Kavram

Cisco STP PortFast operation and state bypass mechanism
Tahmini Süre:1m 0s
Soru 150Soru →

A network administrator needs to create VLAN 85 named GUESTS on a Cisco Catalyst switch and configure interface GigabitEthernet0/2 as a static access port assigned to this VLAN, starting from Privileged EXEC mode (`Switch#`). In what sequence should the administrator execute the required Cisco IOS commands?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct configuration order starts in Privileged EXEC mode with 'configure terminal', followed by 'vlan 85', 'name GUESTS', 'interface GigabitEthernet0/2', 'switchport mode access', and finally 'switchport access vlan 85'.
To successfully create a VLAN and configure an access port in Cisco IOS, commands must be executed in a specific hierarchical sequence. Starting at Privileged EXEC mode (`Switch#`), the user enters Global Configuration mode (`Switch(config)#`) using `configure terminal`. Next, VLAN 85 is instantiated with `vlan 85` into VLAN configuration mode (`Switch(config-vlan)#`), where `name GUESTS` sets the label. Moving back to Global Configuration mode context to select the target interface via `interface GigabitEthernet0/2` places the user in Interface Configuration mode (`Switch(config-if)#`). Here, `switchport mode access` disables dynamic trunk negotiation, and `switchport access vlan 85` assigns the port to the intended broadcast domain.

Adım Adım Çözüm

1
Enter Global Configuration mode from Privileged EXEC mode.
Prompt changes to `Switch(config)#` after running `configure terminal`.
Global configuration mode is required to initiate VLAN creation and interface selection commands.
2
Create VLAN 85.
Prompt changes to `Switch(config-vlan)#` after issuing `vlan 85`.
Creates the VLAN ID in the Layer 2 database and opens VLAN configuration submode.
3
Assign the name GUESTS to the VLAN.
VLAN 85 is labeled with the name GUESTS upon executing `name GUESTS`.
Name configuration must take place inside the VLAN configuration submode.
4
Select interface GigabitEthernet0/2 for editing.
Prompt changes to `Switch(config-if)#` after issuing `interface GigabitEthernet0/2`.
Moves the CLI context into interface configuration mode for the specified target interface.
5
Set the administrative mode of the port to static access mode.
The port mode changes from dynamic negotiation to explicit access mode via `switchport mode access`.
Statically defining access mode ensures DTP negotiation does not form a trunk link unintentionally.
6
Assign the interface to VLAN 85.
Traffic on GigabitEthernet0/2 is tagged internally for VLAN 85 using `switchport access vlan 85`.
Associates untagged frames received on this access port with VLAN 85.

Anahtar Kavram

Cisco IOS CLI hierarchy for VLAN definition and static access port assignment
Tahmini Süre:1m 30s
Soru 151Soru →

An enterprise network engineering team is evaluating the operational impact of transitioning from traditional SNMPv2c polling and manual CLI management to an automated, controller-based network architecture using RESTCONF and streaming telemetry. During a recent outage post-mortem, the team noted two major operational issues: high CPU utilization on core switches caused by frequent SNMP polling requests led to missed monitoring alerts, and manual CLI configuration updates across 200 branch switches caused severe configuration drift. Which statement accurately describes how adopting model-driven telemetry and centralized controller automation resolves these specific operational deficiencies?

Cevabı ve açıklamayı göster

Cevap: Streaming telemetry utilizes a push-based subscription model over protocols like gRPC to continuously transmit data without CPU-intensive polling, while centralized controllers leverage structured data models and APIs to enforce automated configuration consistency across all managed devices.

Cevap

Streaming telemetry utilizes a push-based subscription model over protocols like gRPC to continuously transmit data without CPU-intensive polling, while centralized controllers leverage structured data models and APIs to enforce automated configuration consistency across all managed devices.
The correct answer accurately reflects the two primary operational shifts brought by network automation: (1) Replacing pull-based SNMP polling with subscription-based streaming telemetry (e.g., gRPC, NETCONF, RESTCONF) to dramatically reduce device CPU overhead and improve monitoring granularity; and (2) Replacing manual CLI configuration with centralized controller APIs and data models (YANG) to automate change management, guarantee consistency, and prevent configuration drift.

Adım Adım Çözüm

1
Analyze the operational deficiency related to network monitoring (SNMP polling overhead).
Identify that traditional SNMP uses a pull mechanism where management stations repeatedly query devices, causing high CPU consumption. Streaming telemetry solves this by using a push mechanism based on subscriptions, allowing devices to continuously stream structured data with significantly less overhead.
Understanding the shift from reactive pull-based polling to proactive push-based telemetry.
2
Analyze the operational deficiency related to device configuration management (configuration drift across 200 branch switches).
Identify that manual per-device CLI configuration leads to inconsistencies and human error. Centralized controller automation uses RESTful APIs and YANG data models to treat network configurations programmatically and declaratively, ensuring uniform deployment and automated compliance auditing.
Understanding how controller-driven automation enforces central intent and eliminates manual configuration errors.
3
Evaluate the choices to identify the statement that accurately addresses both telemetry push mechanics and controller-driven configuration consistency.
Select the option stating that streaming telemetry uses push subscriptions to eliminate polling overhead and centralized controllers use structured data models/APIs to enforce consistency.
Correlating the theoretical benefits of network automation with real-world enterprise operational shifts.

Anahtar Kavram

Operational impacts of network automation: Push-based telemetry vs SNMP polling, and controller/API-driven consistency vs manual CLI drift.
Soru 152Soru →

An administrator connects a workstation to a Cisco Catalyst switch interface configured with standard IEEE 802.1D Spanning Tree Protocol (STP) where PortFast has NOT been enabled. Arrange the operational steps and port state transitions in the correct chronological sequence from the moment physical link status changes to up until the spanning-tree topology update process completes.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological sequence for standard 802.1D STP port activation without PortFast is: 1) Initializing in the Blocking state to inspect incoming BPDUs; 2) Transitioning to the Listening state (15s) to elect spanning-tree roles via BPDU exchange without MAC learning; 3) Transitioning to the Learning state (15s) after the first Forward Delay to populate MAC address table entries; 4) Transitioning to the Forwarding state after the second Forward Delay to process user data frames; 5) Transmitting a Topology Change Notification (TCN) BPDU toward the Root Bridge due to the non-PortFast state transition.
The correct order reflects standard 802.1D STP convergence behavior: Blocking -> Listening (15s role election) -> Learning (15s MAC table population) -> Forwarding (active data transfer) -> TCN generation. Disabling or omitting PortFast on an access interface causes the full 30-second convergence delay and forces a network-wide MAC address table aging timer reduction via TCN BPDUs.

Adım Adım Çözüm

1
Determine initial port state upon link initialization.
The port initializes in the Blocking state, dropping ingress traffic while listening for BPDUs.
Preventing layer 2 switching loops requires keeping the port from forwarding broadcast or unicast traffic prior to topology calculation.
2
Trace the first state transition during spanning-tree role determination.
The port enters the Listening state for 15 seconds (Forward Delay), sending and receiving BPDUs.
During Listening, the switch determines whether the port will become a Root Port, Designated Port, or return to Blocking, but does not learn MAC addresses.
3
Trace the second state transition following the first Forward Delay expiration.
The port transitions to the Learning state for 15 seconds (Forward Delay), inspecting frame source MAC addresses to populate the CAM table.
Learning MAC address locations prior to active frame forwarding minimizes unicast flooding once data transmission begins.
4
Identify the active operational state reached after timer expiration.
The port transitions to the Forwarding state, enabling bi-directional user payload frame transmission.
After passing two full Forward Delay timers (30 seconds total), the interface is confirmed loop-free and fully operational.
5
Determine post-transition notification behavior for non-PortFast ports.
The switch transmits a Topology Change Notification (TCN) BPDU out its Root Port toward the Root Bridge.
Because PortFast is not configured, transitioning a port to Forwarding triggers a topology change event, instructing switches in the domain to reduce MAC aging timers from 300 seconds to the Forward Delay timer (15 seconds).

Anahtar Kavram

IEEE 802.1D STP Port State Convergence Sequence and TCN Generation
Soru 153Soru →

A network security architect is reviewing the organization's defense-in-depth posture following a risk assessment. Match each enterprise security threat scenario on the left with its most appropriate primary mitigation control on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

An external attacker sends high volumes of UDP traffic with forged source IP addresses to exposed NTP servers to overwhelm enterprise edge routers.
An attacker sets up a proxy server mimicking a legitimate login portal to capture session cookies and bypass standard SMS-based two-factor authentication.
A malicious insider connects an unauthorized laptop to a dynamic switch port and floods the switch with generated MAC addresses to capture unencrypted traffic.
An automated botnet attempts a low-and-slow execution of common passwords against hundreds of user accounts to evade traditional lockout rules.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

NTP UDP amplification pairs with Control Plane Policing and NTP query restrictions; Adversary-in-the-Middle phishing pairs with FIDO2/WebAuthn domain-bound hardware key authentication; CAM table MAC flooding pairs with Port Security MAC limits; Password spraying across multiple accounts pairs with risk-based smart lockout policies.
Each security threat scenario directly maps to its precise technological defense: NTP amplification relies on CoPP and NTP service hardening; AiTM phishing proxies require FIDO2 domain binding; switch CAM flooding requires Port Security limits; and password spraying requires tenant-wide risk-based lockout controls.

Adım Adım Çözüm

1
Analyze threat scenario 1 (NTP UDP traffic with spoofed IPs).
Identified as a Distributed Denial of Service (DDoS) reflection/amplification attack targeting network control planes.
Control Plane Policing (CoPP) rate-limits incoming control plane traffic and restricting open NTP query access prevents amplification.
2
Analyze threat scenario 2 (Proxy capturing session cookies and SMS 2FA).
Identified as an Adversary-in-the-Middle (AiTM) phishing attack targeting authentication mechanisms.
Phishing-resistant authentication protocols such as FIDO2/WebAuthn use origin-bound public key cryptography that fails if the domain name in the browser does not match.
3
Analyze threat scenario 3 (Flooding dynamic switch ports with generated MAC addresses).
Identified as a Layer 2 CAM table overflow/MAC flooding attack.
Port Security enforces maximum MAC address limits per access port, preventing switch CAM table exhaustion and fail-open behaviors.
4
Analyze threat scenario 4 (Low-and-slow execution of common passwords across many accounts).
Identified as a password spraying attack.
Traditional account lockout triggers per-user failure limits; smart/risk-based lockout policies evaluate tenant-wide password attempt patterns to block spraying.

Anahtar Kavram

Key Security Concepts, Threats, Vulnerabilities, and Mitigations
Soru 154Soru →

A financial enterprise migrates its multi-site network infrastructure from legacy per-device CLI administration to a centralized configuration management and model-driven telemetry architecture. Which two statements accurately describe the operational impacts of adopting this automation paradigm?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configuration drift across network switches is minimized through centralized enforcement of declarative data models.; Network health visibility improves because streaming telemetry continuously pushes structured data subscription feeds without relying on periodic pull queries.

Cevap

The two correct operational impacts are that configuration drift is minimized through centralized enforcement of declarative data models, and network health visibility improves via model-driven streaming telemetry pushing real-time structured data.
Centralized network automation establishes a single source of truth using declarative configuration models, which continuously mitigates configuration drift. Furthermore, replacing legacy SNMP polling with model-driven streaming telemetry enables real-time push subscriptions of structured metrics, significantly improving network visibility and operational efficiency.

Adım Adım Çözüm

1
Evaluate the effect of centralized configuration management on device compliance.
Centralized tools compare live configurations against a defined declarative standard, preventing unapproved local modifications and eliminating configuration drift.
Traditional manual CLI edits lead to inconsistent configurations across devices, whereas automated controllers enforce a single source of truth.
2
Evaluate the difference between legacy SNMP polling and model-driven telemetry.
Streaming telemetry pushes data continuously or on event trigger, providing granular visibility with lower CPU overhead compared to periodic SNMP polling.
Telemetry uses subscription models over transport protocols like gRPC/NETCONF to efficiently stream operational stats.
3
Analyze distractor statements for technical accuracy regarding management architecture.
Ansible is agentless (no on-box daemon required), and HTTP GET is strictly a non-mutating read operation.
Identifying agent vs agentless paradigms and standard HTTP/REST CRUD verb behaviors exposes the errors in the wrong options.

Anahtar Kavram

Impact of Automation and Model-Driven Telemetry on Enterprise Network Management
Soru 155Soru →

A network architect is designing an enterprise branch network that requires high-speed inter-VLAN routing for internal communication between local subnets, alongside deep packet inspection, stateful traffic monitoring, and intrusion prevention for all internet-bound traffic. Which deployment strategy correctly assigns these operational roles to the appropriate network components to maximize performance and security?

Cevabı ve açıklamayı göster

Cevap: Perform local inter-VLAN packet forwarding on a Layer 3 switch using ASIC-based routing, and forward external traffic to a Next-Generation Firewall (NGFW) for application-layer inspection and security enforcement.

Cevap

Local inter-VLAN routing should be performed on a Layer 3 switch using ASIC-based forwarding, while edge traffic should be directed through a Next-Generation Firewall (NGFW) for stateful application-layer inspection.
In enterprise architecture, assigning Layer 3 switches to handle inter-VLAN routing leverages ASIC hardware for high-bandwidth, low-latency internal traffic forwarding. Positioning a Next-Generation Firewall (NGFW) at the network perimeter provides dedicated stateful packet inspection, application recognition, and security policy enforcement for external traffic.

Adım Adım Çözüm

1
Analyze the requirements for internal inter-VLAN routing.
Layer 3 switches use dedicated hardware Application-Specific Integrated Circuits (ASICs) to route traffic between local VLANs at wire speed with minimal latency.
Routing internal subnets at Layer 3 on switch hardware offloads throughput demands from security edge devices.
2
Analyze the requirements for external internet-bound security enforcement.
Next-Generation Firewalls (NGFWs) perform stateful packet inspection, deep packet inspection (DPI), and application-level security policy enforcement.
Standard Layer 3 switches lack advanced threat prevention, deep packet inspection, and stateful application control features.
3
Evaluate component assignments.
Combining Layer 3 switches for internal forwarding with an NGFW at the internet perimeter fulfills both high throughput and robust security requirements.
This functional division adheres to Cisco enterprise architectural best practices.

Anahtar Kavram

Operational roles and functional differentiation of Layer 3 switches and Next-Generation Firewalls (NGFWs) in enterprise design.
Tahmini Süre:2m 0s
Soru 156Soru →

A network administrator is establishing link aggregation between a Cisco AireOS Wireless LAN Controller (WLC) and an upstream Cisco Catalyst switch to increase bandwidth and provide interface redundancy. The administrator configures ports GigabitEthernet 1/0/1 through 1/0/4 on the Catalyst switch using the command 'channel-group 10 mode active' and enables LAG on the WLC. However, after the WLC reboots, the EtherChannel fails to negotiate successfully. Which condition is causing this link aggregation failure?

Cevabı ve açıklamayı göster

Cevap: The upstream switch ports are configured for dynamic LACP negotiation, but Cisco AireOS WLCs only support static EtherChannel bundles configured with mode on.

Cevap

The upstream switch ports are configured for dynamic LACP negotiation, but Cisco AireOS WLCs only support static EtherChannel bundles configured with mode on.
Cisco AireOS Wireless LAN Controllers require all connected distribution system ports to be bundled into a single static EtherChannel. Because AireOS does not support LACP (IEEE 802.3ad) or PAgP negotiation protocols, the upstream switch interfaces must be configured with 'mode on'. When the switch ports are configured with 'mode active', the switch expects LACP packets that the AireOS controller never sends, preventing the link aggregation bundle from establishing.

Adım Adım Çözüm

1
Identify the protocol support for Link Aggregation (LAG) on Cisco AireOS Wireless LAN Controllers.
AireOS controllers do not support dynamic EtherChannel negotiation protocols such as LACP or PAgP.
LAG on AireOS bundles all physical distribution system ports into a single logical channel that requires unconditional static bundling on the connected switch.
2
Evaluate the switch port configuration command 'channel-group 10 mode active'.
The 'mode active' keyword enables LACP dynamic negotiation on the Catalyst switch ports.
Because the WLC will not transmit or respond to LACP control packets, the switch ports remain in an unbundled or suspended state waiting for LACP negotiation.
3
Determine the necessary configuration change on the switch interfaces.
Change the switch port channel command to 'channel-group 10 mode on'.
Configuring 'mode on' forces the switch ports into a static EtherChannel without attempting LACP or PAgP negotiation, matching the WLC requirements.

Anahtar Kavram

Cisco AireOS WLC Link Aggregation (LAG) EtherChannel Mode Requirements
Soru 157Soru →

An enterprise infrastructure deployment utilizes a physical server running a bare-metal Type 1 hypervisor. Two virtual machines, VM1 and VM2, reside on this physical host and are attached to the same virtual switch (vSwitch) configured on VLAN 50. The host's physical Network Interface Card (pNIC) connects to an external physical Layer 2 switch port configured for VLAN 50. When VM1 transmits an Ethernet broadcast frame, which statement correctly describes the component roles and frame forwarding behavior across this environment?

Cevabı ve açıklamayı göster

Cevap: The internal vSwitch switches the broadcast frame directly to VM2 and forwards a copy out through the pNIC to the physical switch, while the bare-metal Type 1 hypervisor directly manages physical hardware resource allocation.

Cevap

The internal vSwitch switches the broadcast frame directly to VM2 and forwards a copy out through the pNIC to the physical switch, while the bare-metal Type 1 hypervisor directly manages physical hardware resource allocation.
In a virtualized environment with a bare-metal Type 1 hypervisor, the embedded virtual switch (vSwitch) operates as a standard Layer 2 switch for connected virtual interfaces. When a VM sends a broadcast frame, the vSwitch floods the frame to all local virtual ports belonging to that VLAN (delivering it directly to VM2) and transmits a copy through the physical host NIC (pNIC) uplink to the external physical switch. The Type 1 hypervisor directly controls hardware resources without requiring an intermediate host operating system.

Adım Adım Çözüm

1
Analyze the hypervisor architecture type and role.
A Type 1 hypervisor runs directly on the bare-metal host hardware (without a host OS) and manages hardware resources for virtual machines directly.
Understanding the hypervisor architecture establishes how hardware interactions and virtual networking components operate.
2
Determine the local frame forwarding behavior on the virtual switch (vSwitch).
The vSwitch acts as a software-based Layer 2 switch inside the hypervisor. When VM1 generates a broadcast frame on VLAN 50, the vSwitch floods it to all local ports in VLAN 50 (reaching VM2).
Local intra-host switching occurs within the hypervisor software without requiring packets to exit to the physical network first.
3
Determine the egress frame forwarding behavior to the physical network.
The vSwitch also forwards the broadcast frame out of the uplink interface (pNIC) to the external physical Layer 2 switch so that other physical devices in VLAN 50 receive the broadcast.
Broadcast domains extend across both virtual and connected physical switch ports configured on the same VLAN.

Anahtar Kavram

Virtual Switch (vSwitch) and Type 1 Hypervisor Operational Roles
Tahmini Süre:2m 0s
Soru 158Soru →

Match each transport layer protocol characteristic on the left to its corresponding protocol on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Establishes a stateful connection using a 3-way handshake prior to transmitting data
Features a simple, fixed 8-byte header structure for minimal transmission overhead
Uses sliding windows and acknowledgments to perform dynamic flow control
Provides stateless, best-effort transport optimal for latency-sensitive traffic

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

TCP corresponds to connection establishment via a 3-way handshake and dynamic flow control via windowing. UDP corresponds to low overhead with an 8-byte header and stateless best-effort delivery for latency-sensitive applications.
TCP provides stateful session establishment, reliable delivery, and flow control mechanisms, making it suitable for applications requiring guaranteed data delivery. UDP maintains no connection state, operates with an 8-byte header, and prioritizes rapid transmission for traffic where timeliness matters more than missing packet retransmission.

Adım Adım Çözüm

1
Analyze connection-oriented and reliability features
The 3-way handshake and dynamic windowing/acknowledgments belong to TCP.
TCP provides reliable, ordered, and flow-controlled communication.
2
Analyze connectionless and overhead features
The 8-byte fixed header and stateless delivery for real-time applications belong to UDP.
UDP trades error recovery and sequencing for maximum speed and minimal overhead.

Anahtar Kavram

Transport layer protocol comparison: TCP connection-oriented reliability vs. UDP connectionless efficiency
Tahmini Süre:1m 0s
Soru 159Soru →

An engineer connects two Cisco Catalyst switches using their GigabitEthernet0/1 interfaces. Interface GigabitEthernet0/1 on Switch-1 is configured with `switchport mode dynamic auto`. Interface GigabitEthernet0/1 on Switch-2 is configured with `switchport mode trunk` followed by `switchport nonegotiate`. What is the resulting operational state of the GigabitEthernet0/1 interface on Switch-1?

Cevabı ve açıklamayı göster

Cevap: It operates as an access port because dynamic trunking negotiation frames are suppressed by Switch-2.

Cevap

The interface on Switch-1 operates as an access port because dynamic trunking negotiation frames are suppressed by Switch-2.
When an interface is in dynamic auto mode, it does not initiate DTP negotiation; it only responds to incoming DTP frames. Since the remote switch interface is configured with 'switchport nonegotiate', no DTP packets are sent across the link. Consequently, the local interface remains in its default access operational state.

Adım Adım Çözüm

1
Analyze Switch-1 DTP configuration
Switch-1 is configured as 'dynamic auto', meaning it will operate as an access port unless it actively receives DTP desirable or trunk negotiation frames.
Ports in dynamic auto mode wait passively for DTP proposals from the neighboring switch.
2
Analyze Switch-2 DTP configuration
Switch-2 has 'switchport nonegotiate' applied, which completely stops the interface from transmitting DTP frames.
The 'switchport nonegotiate' command disables DTP frame generation on static trunk or access ports.
3
Determine the resulting link operational state on Switch-1
Because Switch-1 receives no DTP negotiation frames, it never transitions to trunk mode and remains operating as an access port.
Without receiving incoming DTP frames, a dynamic auto interface defaults to operational access mode.

Anahtar Kavram

DTP Mode Negotiation and Nonegotiate Behavior
Soru 160Soru →

Match each OSPFv2 network type on the left to its corresponding DR/BDR election behavior, neighbor adjacency capability, and default Hello/Dead timer characteristics on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Broadcast Network Type
Point-to-Point Network Type
Point-to-Multipoint Network Type
Loopback Interface Network Type

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Broadcast Network Type matches with DR/BDR election and Hello 10s/Dead 40s. Point-to-Point Network Type matches with no DR/BDR election and Hello 10s/Dead 40s. Point-to-Multipoint Network Type matches with no DR/BDR election and Hello 30s/Dead 120s. Loopback Interface Network Type matches with no DR/BDR election, no neighbors, and /32 host route advertisement.
Each OSPF network type is designed for specific underlying link technologies. Broadcast multiaccess networks perform DR/BDR election with 10s/40s timers. Point-to-point bypasses DR election with 10s/40s timers. Point-to-multipoint bypasses DR election with 30s/120s timers. Loopback interfaces advertise /32 host routes without forming adjacencies.

Adım Adım Çözüm

1
Analyze Broadcast multiaccess network characteristics.
Broadcast networks (e.g., Ethernet interfaces running OSPF) require DR and BDR elections to avoid N(N−1)/2N(N-1)/2 full mesh adjacencies. The standard Hello timer is 10 seconds, and the Dead timer is 40 seconds.
DR/BDR selection is mandatory on multiaccess media.
2
Analyze Point-to-Point network characteristics.
Point-to-Point networks connect two endpoints directly. DR/BDR election is bypassed because only two routers exist on the segment. Timers default to Hello 10s and Dead 40s.
Electing a DR/BDR on a two-node point-to-point connection adds unnecessary protocol overhead.
3
Analyze Point-to-Multipoint network characteristics.
Point-to-Multipoint treats the physical or logical multiaccess network as multiple point-to-point connections. It disables DR/BDR elections and defaults to longer timers (Hello 30s, Dead 120s).
Used primarily in WAN/hub-and-spoke topologies where direct spoke-to-spoke broadcast reachability is absent.
4
Analyze Loopback network characteristics.
In Cisco IOS OSPFv2, loopback interfaces automatically default to the Loopback network type, advertising the interface IP as a /32 host route regardless of the configured netmask, without participating in neighbor discovery.
Loopback interfaces represent logical local endpoints, not actual transit links.

Anahtar Kavram

OSPFv2 Network Types, Adjacencies, Timers, and DR/BDR Requirements
ÖncekiSayfa 8 / 100Sonraki
Tüm alıştırma soruları — Cisco CCNA | Examkin