Examkin

Tüm alıştırma soruları

1987 soru

Tüm türler1,987Çoktan seçmeli1,020Çoklu seçim452Sayısal18Eşleştirme229Sıralama203Boşluk doldurma22Kısa cevap43
Soru 1701Soru →

A network router receives a broadcast DHCP Discover packet from a client host on interface GigabitEthernet0/1. The interface is configured with the command `ip helper-address 192.168.10.5` to forward requests to a central DHCP server located in a different subnet. Which TWO actions does the router perform when processing and relaying this broadcast message? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: It converts the client incoming broadcast packet into a unicast packet directed to 192.168.10.5.; It populates the gateway IP address (giaddr) field in the DHCP packet header with the IP address of GigabitEthernet0/1.

Cevap

The router converts the client's incoming broadcast packet into a unicast packet directed to the configured IP helper address (192.168.10.5), and it populates the gateway IP address (giaddr) field with the IP address of its client-facing interface (GigabitEthernet0/1).
When a router receives a client DHCP broadcast on an interface configured with `ip helper-address`, it acts as a DHCP Relay Agent. It converts the broadcast into a unicast IP packet destined for the helper address and populates the `giaddr` (gateway IP address) field in the DHCP message header with the IP address of the receiving interface. This informs the DHCP server which IP subnet pool to draw from.

Adım Adım Çözüm

1
Examine the client DHCP broadcast reception
The client sends a broadcast DHCP Discover message which arrives on interface GigabitEthernet0/1.
DHCP clients initially do not possess an IP address and must communicate using local broadcast.
2
Process the ip helper-address configuration
The router intercepts the UDP broadcast on port 67 because `ip helper-address` is enabled on GigabitEthernet0/1.
The helper command enables the router to act as a Relay Agent on the incoming client-facing interface.
3
Modify the DHCP header fields and packet format
The router sets the giaddr field to GigabitEthernet0/1's IP address and changes the packet destination to unicast (192.168.10.5).
The server relies on giaddr to pick the correct IP pool, and unicast routing allows the packet to traverse routed boundaries to reach the DHCP server.

Anahtar Kavram

DHCP Relay Agent Operation and giaddr insertion
Soru 1702Soru →

A network administrator issues the command `spanning-tree vlan 20 priority 16384` on a Cisco Catalyst switch running Rapid PVST+. What priority value will be carried in the Bridge Identifier (BID) field of outgoing BPDUs for VLAN 20?

Cevabı ve açıklamayı göster

Cevap: 16404

Cevap

The effective priority value carried in the Bridge Identifier for VLAN 20 is 16404.
Rapid PVST+ uses the 802.1t System ID Extension mechanism, which appends the 12-bit VLAN ID directly to the 4-bit base bridge priority. Adding the configured base priority of 16384 to the VLAN ID of 20 yields a total priority value of 16404 in transmitted BPDUs.

Adım Adım Çözüm

1
Identify the base Bridge Priority configured on the switch.
The base priority configured via CLI is 1638416384.
The command `spanning-tree vlan 20 priority 16384` sets the base priority component of the Bridge ID.
2
Determine the System ID Extension value for the VLAN.
The System ID Extension value equals the VLAN number, which is 2020.
Rapid PVST+ uses 802.1t System ID Extension to carry unique STP instances per VLAN without consuming extra MAC addresses.
3
Calculate the total Bridge Priority by adding the base priority to the System ID Extension.
16384+20=1640416384 + 20 = 16404.
The 16-bit priority structure combines the 4-bit priority multiplier with the 12-bit VLAN identifier.

Anahtar Kavram

System ID Extension and Bridge Priority Calculation in Rapid PVST+
Soru 1703Soru →

Arrange the following Cisco IOS Syslog severity levels in order from most critical (lowest numeric level) to least critical (highest numeric level).

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order from most critical to least critical is Emergency (Level 0), Critical (Level 2), Warning (Level 4), and Informational (Level 6).
Cisco IOS Syslog messages follow standard severity levels ranging from 0 (Emergency, highest urgency) to 7 (Debugging, lowest urgency). Sorting from most critical to least critical requires ordering by increasing numeric value: Emergency (0), Critical (2), Warning (4), and Informational (6).

Adım Adım Çözüm

1
Identify the numeric severity level assigned to each Syslog level name
Emergency is Level 0, Critical is Level 2, Warning is Level 4, and Informational is Level 6.
Cisco IOS Syslog uses a standard numeric scale from 0 to 7 to define message severity.
2
Sort the identified levels from lowest numeric value to highest numeric value
Emergency (0) -> Critical (2) -> Warning (4) -> Informational (6).
Lower numeric values indicate higher urgency/criticality in Syslog operations.

Anahtar Kavram

Syslog Severity Levels (0 to 7)
Tahmini Süre:1m 0s
Soru 1704Soru →

An enterprise network administrator discovers that an unauthorized host on an internal VLAN is performing a Man-in-the-Middle (MitM) attack by broadcasting spoofed ARP messages, associating its own MAC address with the IP address of the default gateway. Which Layer 2 security mechanism should be implemented on the access switches to mitigate this specific threat?

Cevabı ve açıklamayı göster

Cevap: Dynamic ARP Inspection (DAI) to validate ARP requests and responses against the trusted DHCP snooping binding database.

Cevap

Dynamic ARP Inspection (DAI) should be configured on access switches to validate ARP packets against the DHCP snooping binding database.
Dynamic ARP Inspection (DAI) is the primary mitigation technique against ARP poisoning and ARP spoofing attacks. DAI intercepts all ARP requests and responses on untrusted switch ports and verifies the validity of the IP-to-MAC bindings against the trusted DHCP snooping binding database before forwarding the packet.

Adım Adım Çözüm

1
Identify the type of attack described in the scenario.
The attack described is ARP spoofing/poisoning, where an attacker sends fake ARP messages to intercept network traffic.
Understanding the attack mechanism (Layer 2 address resolution manipulation) is necessary to choose the appropriate mitigation tool.
2
Evaluate security mechanisms designed to inspect and protect Layer 2 ARP traffic.
Dynamic ARP Inspection (DAI) is specifically designed to prevent ARP poisoning by comparing ARP IP-to-MAC mapping claims against a reliable binding source (DHCP Snooping database).
DAI intercepts ARP packets on untrusted ports and drops invalid ARP responses.

Anahtar Kavram

Mitigating Layer 2 ARP Spoofing Attacks using Dynamic ARP Inspection (DAI)
Tahmini Süre:1m 30s
Soru 1705Soru →

A Cisco router has three active interfaces with the following operational statuses and IPv4 addresses:
- Loopback 10: 10.200.1.1/24 (up/up)
- Loopback 20: 172.16.50.1/24 (up/up)
- GigabitEthernet 0/0: 192.168.100.1/24 (up/up)

The OSPFv2 process is initialized using the `router ospf 100` command without an explicitly configured router-id command.

What IPv4 address will be selected as the OSPFv2 Router ID for this router?

Cevabı ve açıklamayı göster

Cevap: 172.16.50.1

Cevap

172.16.50.1
OSPFv2 determines its Router ID using a strict three-tier precedence logic: (1) an explicitly configured OSPF router-id command, (2) the highest IPv4 address among active loopback interfaces, and (3) the highest IPv4 address among active non-loopback (physical) interfaces. Because no manual router ID was configured, the router compares the loopback interfaces (10.200.1.1 and 172.16.50.1) and chooses the highest value, 172.16.50.1. Physical interfaces like GigabitEthernet 0/0 are not considered because active loopbacks exist.

Adım Adım Çözüm

1
Check for manual OSPF Router ID configuration
No explicit `router-id` command was configured under the `router ospf 100` process.
Manual configuration always takes highest precedence in OSPF Router ID selection.
2
Evaluate active loopback interfaces
Two active loopback interfaces exist: Loopback 10 (10.200.1.1) and Loopback 20 (172.16.50.1).
In the absence of a manually configured Router ID, OSPF selects the highest IPv4 address among active loopback interfaces.
3
Compare loopback IPv4 addresses
172.16.50.1 is numerically higher than 10.200.1.1, so 172.16.50.1 is chosen.
Physical interface IPs (such as GigabitEthernet 0/0 with 192.168.100.1) are ignored when active loopback interfaces are present.

Anahtar Kavram

OSPFv2 Router ID Selection Precedence
Soru 1706Soru →

An attacker on a local Ethernet network sends spoofed ARP messages to associate their MAC address with the IP address of the default gateway, allowing them to secretly intercept and relay network traffic between a victim host and the router. Which type of security threat is being executed?

Cevabı ve açıklamayı göster

Cevap: Man-in-the-middle (MitM) attack

Cevap

Man-in-the-middle (MitM) attack
A Man-in-the-middle (MitM) attack occurs when an unauthorized entity places itself between two communicating network endpoints. ARP spoofing on a local Ethernet segment is a primary technique used to execute a MitM attack at Layer 2.

Adım Adım Çözüm

1
Analyze the attack mechanism described in the scenario.
The attacker sends spoofed ARP responses mapping their MAC address to the default gateway's IP address.
This causes local endpoints to update their ARP tables and send frames intended for the router to the attacker's device instead.
2
Classify the security threat based on the attacker's operational position and capability.
The attacker can read, alter, or drop packets passing between the victim host and the default gateway without either party realizing.
Interception and relaying of communication between two unaware parties is defined as a Man-in-the-middle (MitM) attack.

Anahtar Kavram

Man-in-the-Middle (MitM) Threats and ARP Spoofing
Tahmini Süre:45s
Soru 1707Soru →

An enterprise edge router receives its primary route to the 172.20.10.0/24172.20.10.0/24 destination network via OSPF, which uses a default Administrative Distance of 110110. A network administrator must configure a floating static backup route targeting next-hop IP address 192.168.12.2192.168.12.2 that will remain inactive in the routing table unless the primary OSPF route becomes unavailable. Which Cisco IOS command accomplishes this objective?

Cevabı ve açıklamayı göster

Cevap: ip route 172.20.10.0 255.255.255.0 192.168.12.2 120

Cevap

The command 'ip route 172.20.10.0 255.255.255.0 192.168.12.2 120' correctly configures the backup floating static route.
The correct command specifies an Administrative Distance of 120 at the end of the syntax. Because 120 is higher than the default OSPF distance of 110, Cisco IOS keeps this static route out of the routing table as long as the OSPF route is active. If the OSPF route fails and is withdrawn, the floating static route with AD 120 becomes the best available path and is inserted into the routing table.

Adım Adım Çözüm

1
Identify the Administrative Distance (AD) of the primary dynamic routing protocol.
OSPF has a default Administrative Distance of 110.
Floating static routes rely on AD values to determine route preference.
2
Determine the required Administrative Distance for the floating static route.
The static route AD must be strictly greater than 110 (e.g., 120).
Routers select routes with the lowest AD. Setting a higher value keeps the static route inactive while OSPF is healthy.
3
Construct the Cisco IOS static route command syntax.
The syntax is 'ip route <prefix> <mask> <next-hop> <distance>'. Placing 120 at the end sets the floating distance.
Specifying 120 at the end of the command overrides the default static AD of 1.

Anahtar Kavram

Floating Static Routes and Administrative Distance
Soru 1708Soru →

A network administrator is configuring IPv4 static routes on router R1. The administrator must implement a primary default static route pointing to next-hop IP address 203.0.113.1203.0.113.1, as well as a backup floating static route for destination subnet 172.16.10.0/24172.16.10.0/24 via next-hop IP 192.168.1.2192.168.1.2. The backup route must take effect only if the primary path learned via OSPF (Administrative Distance of 110) becomes unavailable. Which two commands must the administrator execute on router R1 to satisfy these requirements? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: ip route 0.0.0.0 0.0.0.0 203.0.113.1; ip route 172.16.10.0 255.255.255.0 192.168.1.2 120

Cevap

The administrator must configure the default route using `ip route 0.0.0.0 0.0.0.0 203.0.113.1` and the floating static backup route using `ip route 172.16.10.0 255.255.255.0 192.168.1.2 120`.
The default route requires the prefix and mask `0.0.0.0 0.0.0.0` pointing to next-hop 203.0.113.1203.0.113.1. To serve as a backup to an OSPF route with an Administrative Distance of 110, the floating static route must specify an Administrative Distance higher than 110, which the command specifying an AD of 120 accomplishes.

Adım Adım Çözüm

1
Determine the standard command syntax for an IPv4 default static route.
A default route matches all destination networks using prefix 0.0.0.00.0.0.0 and mask 0.0.0.00.0.0.0, forming the command `ip route 0.0.0.0 0.0.0.0 203.0.113.1`.
Quad-zero notation (0.0.0.0 0.0.0.0) is required in Cisco IOS to represent any unlisted IPv4 destination.
2
Calculate the necessary Administrative Distance for a floating static route intended to back up OSPF.
OSPF has a default Administrative Distance of 110. The backup static route requires an Administrative Distance higher than 110 (such as 120).
Cisco routers select routes based on the lowest Administrative Distance. A higher AD keeps the static route inactive until the primary OSPF route is removed from the routing table.

Anahtar Kavram

IPv4 Default Static Route Syntax and Floating Static Route Administrative Distance Selection
Soru 1709Soru →

A network engineer is configuring a Cisco Catalyst switch to connect end-user workstations. The workstations must belong to VLAN 25, which should be named HR. Which two CLI commands or command sequences must be performed on the switch to complete this setup correctly?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: In global configuration mode, execute `vlan 25` followed by `name HR`.; In interface configuration mode for GigabitEthernet0/1, execute `switchport access vlan 25`.

Cevap

To properly set up an access port in VLAN 25, VLAN 25 must be created in global configuration mode (`vlan 25` / `name HR`), and the interface must be assigned to that VLAN using `switchport access vlan 25` in interface configuration mode.
Configuring an access port requires defining the VLAN in global configuration mode (`vlan 25` and `name HR`) and assigning the physical interface to that VLAN using `switchport access vlan 25`.

Adım Adım Çözüm

1
Enter global configuration mode and define VLAN 25 with its name.
VLAN 25 is created and stored in the switch VLAN database.
Creating the VLAN ensures the broadcast domain exists before or upon assigning ports to it.
2
Enter interface configuration mode and assign the interface to VLAN 25.
Interface GigabitEthernet0/1 is placed into access mode for VLAN 25.
The `switchport access vlan 25` command specifies which VLAN untagged frames received on the port belong to.

Anahtar Kavram

VLAN Creation and Access Port Assignment
Tahmini Süre:1m 15s
Soru 1710Soru →

Place the following Cisco IOS password encryption types in order of security strength, from weakest (least secure) to strongest (most secure).

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order from weakest to strongest security strength is Type 0 (Plaintext), Type 7 (Reversible Vigenère cipher), Type 5 (MD5 hash), and Type 9 (scrypt hash).
The sequence from weakest to strongest begins with Type 0 (unencrypted plaintext). Next is Type 7, which uses weak, reversible Vigenère encryption intended only to stop casual viewing. Type 5 uses a one-way MD5 hash which cannot be mathematically decrypted. Finally, Type 9 uses the modern memory-hard scrypt algorithm to provide maximum protection against high-speed dictionary and brute-force attacks.

Adım Adım Çözüm

1
Identify unencrypted plaintext storage
Type 0 represents completely unencrypted text in the configuration file.
Plaintext offers no protection because anyone viewing the running configuration can read the password.
2
Identify weakly obfuscated passwords
Type 7 is created by 'service password-encryption' using a reversible algorithm.
Type 7 prevents casual shoulder surfing but can be trivially reversed back to plaintext.
3
Identify standard cryptographic hashes
Type 5 relies on the MD5 one-way hash algorithm.
One-way hashes cannot be decrypted back to plaintext, making Type 5 much stronger than Type 7 obfuscation.
4
Identify modern memory-hard password hashes
Type 9 uses the scrypt algorithm for enhanced key derivation.
scrypt is designed to resist hardware-accelerated offline brute-force attacks, making it stronger than MD5.

Anahtar Kavram

Cisco IOS Password Encryption Algorithm Types and Relative Security Strengths
Soru 1711Soru →

A Cisco IOS router is configured with the following logging parameters:

text
logging buffered warnings
logging trap 3
logging monitor notifications

An engineer connects to the router over SSH, enters privileged EXEC mode, and executes the command `terminal monitor`. Shortly after, the following two syslog events occur on the router in rapid succession:

1. `%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to down`
2. `%LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down`

Which logging destination(s) will successfully display or store BOTH of these log events?

Cevabı ve açıklamayı göster

Cevap: Only the active SSH session

Cevap

Only the active SSH session will display both events.
Cisco IOS syslog severity levels range from 0 (Emergency, most critical) to 7 (Debugging, least critical). When a threshold is set for a logging destination, messages with severity numbers less than or equal to that threshold are logged. Event 1 has severity 5 (Notifications) and Event 2 has severity 3 (Errors). The SSH session monitoring threshold is set to notifications (level 5), which accepts severity levels 0, 1, 2, 3, 4, and 5. Thus, both events are displayed in the terminal session after executing `terminal monitor`.

Adım Adım Çözüm

1
Identify the severity level of each generated log message from its header mnemonic.
Event 1 (%LINEPROTO-5-UPDOWN) has a severity level of 5 (Notice / Notifications). Event 2 (%LINK-3-UPDOWN) has a severity level of 3 (Error / Errors).
Cisco IOS syslog messages encode the severity level as a single digit between the facility name and the mnemonic string.
2
Evaluate Cisco IOS syslog severity filtering rules.
A destination configured for severity level NN will record or display all messages with severity levels from 0 (Emergency) up to and including NN. Messages with numerical severity greater than NN are filtered out.
Lower numerical severity values indicate higher criticality in the Syslog standard.
3
Analyze each configured logging destination against the two events.
- Internal Buffer (`logging buffered warnings` = level 4): Stores levels 0–4. Captures Event 2 (level 3), drops Event 1 (level 5).
- Remote Syslog Server (`logging trap 3` = level 3): Captures levels 0–3. Captures Event 2 (level 3), drops Event 1 (level 5).
- SSH Session (`logging monitor notifications` = level 5, enabled via `terminal monitor`): Displays levels 0–5. Captures both Event 1 (level 5) and Event 2 (level 3).
Only level 5 threshold includes both level 3 and level 5 messages.

Anahtar Kavram

Cisco IOS Syslog Severity Hierarchy and Destination Filtering
Soru 1712Soru →

A network engineer is configuring network telemetry across enterprise routers. Which two statements accurately describe SNMP notifications and SNMPv3 security level capabilities?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: SNMP Informs require the receiving Network Management System (NMS) to send an acknowledgment back to the agent.; The authPriv security level in SNMPv3 provides HMAC-based message authentication as well as packet payload encryption.

Cevap

SNMP Informs require the receiving Network Management System to acknowledge receipt with a Response PDU, and the SNMPv3 authPriv security level provides both user authentication and packet payload encryption.
SNMP Informs provide reliable delivery by requiring the receiving Network Management Station to acknowledge receipt using an SNMP Response PDU. Additionally, the SNMPv3 authPriv security level provides authentication using HMAC algorithms such as SHA/MD5 and encryption using algorithms such as AES.

Adım Adım Çözüm

1
Analyze notification operational mechanics
Identify that SNMP Traps are unacknowledged UDP messages (destination port 162), whereas SNMP Informs require an explicit Response PDU acknowledgment from the receiver.
Traps are fire-and-forget, whereas Informs add application-layer reliability via acknowledgments.
2
Evaluate SNMPv3 security levels
Differentiate between noAuthNoPriv (no authentication, no encryption), authNoPriv (authentication enabled, no encryption), and authPriv (both authentication and privacy/encryption enabled).
authPriv is the only tier offering both authentication and encryption.

Anahtar Kavram

SNMP Notification Reliability (Traps vs Informs) and SNMPv3 Security Models (authPriv vs authNoPriv)
Soru 1713Soru →

A network administrator is assigning an IP address to a newly deployed web server. The default gateway interface for the server's subnet is configured with the IP address 172.20.108.1172.20.108.1 and a subnet mask of 255.255.252.0255.255.252.0. Which of the following IPv4 addresses is a valid usable host address on the same subnet as the default gateway?

Cevabı ve açıklamayı göster

Cevap: 172.20.110.50172.20.110.50

Cevap

The IP address 172.20.110.50172.20.110.50 is a valid usable host address on the 172.20.108.0/22172.20.108.0/22 subnet.
The subnet mask 255.255.252.0255.255.252.0 (/22) establishes a block size of 44 in the third octet (256−252=4256 - 252 = 4). For the default gateway IP 172.20.108.1172.20.108.1, the subnet network address is 172.20.108.0/22172.20.108.0/22, giving a usable host range of 172.20.108.1172.20.108.1 to 172.20.111.254172.20.111.254 and a broadcast address of 172.20.111.255172.20.111.255. The IP address 172.20.110.50172.20.110.50 falls directly within this valid host range.

Adım Adım Çözüm

1
Determine the subnet block size in the third octet
A subnet mask of 255.255.252.0255.255.252.0 (/22 prefix length) leaves 22 host bits in the third octet. The block size is calculated as 256−252=4256 - 252 = 4.
Subnet boundaries in the third octet occur in increments of 44.
2
Calculate the network address, broadcast address, and host range
Since 108108 is a multiple of 44 (4×27=1084 \times 27 = 108), the network address is 172.20.108.0/22172.20.108.0/22. The next subnet starts at 172.20.112.0172.20.112.0, making the broadcast address 172.20.111.255172.20.111.255.
The broadcast address is one integer below the next subnet's network address.
3
Identify the usable host range and evaluate candidate IP addresses
The usable host IP range is from 172.20.108.1172.20.108.1 through 172.20.111.254172.20.111.254. The IP address 172.20.110.50172.20.110.50 lies within this range.
Any IP strictly between the network ID and broadcast ID can be assigned to host interfaces.

Anahtar Kavram

IPv4 Subnet Masking and Usable Host Range Calculation
Soru 1714Soru →

An enterprise router is configured with the command `ntp master 4` and has an active server association configured via `ntp server 10.20.30.5` (which is a Stratum 2 reference source). The command `show ntp status` indicates that the clock is currently synchronized to 10.20.30.5. Which TWO statements accurately describe the NTP operational behavior and stratum hierarchy in this deployment? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The router functions at Stratum 3 because it dynamically calculates its stratum level by incrementing the Stratum 2 source's level by 1 while synchronized.; If connectivity to 10.20.30.5 is lost and all external NTP references become unreachable, the router will fall back to serving time at Stratum 4.

Cevap

The router functions at Stratum 3 by incrementing the external Stratum 2 source by 1, and if the external source becomes unreachable, the router falls back to operating at Stratum 4 using its internal clock.
When a router is actively synchronized to an external Stratum 2 NTP server, its operational stratum level becomes Stratum 3 (upstream stratum + 1). The configured `ntp master 4` command acts as a fallback mechanism; if external synchronization is lost, the router maintains NTP server capability by serving time to downstream clients at Stratum 4.

Adım Adım Çözüm

1
Analyze the active NTP synchronization state
The router is actively synchronized to 10.20.30.5, which operates at Stratum 2.
When synchronized to an active NTP server, a router dynamically calculates its stratum by adding 1 to the upstream server's stratum level (2+1=32 + 1 = 3).
2
Evaluate the fallback mechanism of the `ntp master` command
The `ntp master 4` command serves as a secondary/fallback source.
While synchronized to a valid external reference, the local NTP master logic remains dormant. If all external sources fail, the router defaults to using its system clock as a Stratum 4 source for downstream devices.

Anahtar Kavram

NTP Stratum Calculation and Master Fallback Operation
Soru 1715Soru →

Two Cisco routers, R10 and R20, are connected over an Ethernet segment and configured for OSPFv2 routing. Which two configuration parameters must match identically on the interconnecting interfaces of both routers for an OSPFv2 neighbor adjacency to form successfully? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: OSPF Area ID; Hello and Dead timer intervals

Cevap

The OSPF Area ID and the Hello and Dead timer intervals must match identically on both connected interfaces.
To form an OSPFv2 neighbor adjacency, connected interfaces must reside in the same OSPF Area ID and have identical Hello and Dead timer settings. If either parameter differs, the routers fail to proceed past the INIT state.

Adım Adım Çözüm

1
Analyze OSPFv2 Hello packet contents required for adjacency validation
Identified fields that must match in Hello packets: Area ID, Subnet Mask, Hello/Dead timers, Authentication, and Stub area flags.
OSPF routers exchange Hello packets to negotiate neighbor relationships and verify matching network parameters.
2
Evaluate the requirement for Area ID and Timers
Area ID and Hello/Dead timer values are required to match across adjacent interfaces.
A mismatch in Area ID or Hello/Dead timers causes routers to ignore Hello packets or drop neighbor relationships.
3
Evaluate Router ID and Process ID requirements
Router IDs must be unique across routers, and Process IDs are locally significant.
Process ID is only used locally by Cisco IOS to identify the OSPF process instance, while Router ID identifies the node uniquely within the OSPF autonomous system.

Anahtar Kavram

OSPFv2 Mandatory Neighbor Adjacency Parameters
Soru 1716Soru →

During network maintenance, an administrator views a Cisco IOS syslog message containing the severity code %SYS-3-CPUHOG. Which severity level description corresponds to numeric severity level 3 in Cisco IOS syslog logging?

Cevabı ve açıklamayı göster

Cevap: Error

Cevap

Error
In Cisco IOS Syslog logging, numeric level 3 maps directly to the Error severity level. The mnemonic 'Every Alert Can Make Severe Problems In Danger' or standard range (0-Emergency, 1-Alert, 2-Critical, 3-Error, 4-Warning, 5-Notice, 6-Informational, 7-Debugging) defines these values.

Adım Adım Çözüm

1
Identify the standard Cisco IOS Syslog severity level hierarchy
Levels range from 0 (Emergency) to 7 (Debugging).
Cisco IOS assigns a standard numeric severity level (0 to 7) to every syslog message.
2
Map numeric value 3 to its severity name
Level 0 = Emergency, Level 1 = Alert, Level 2 = Critical, Level 3 = Error, Level 4 = Warning, Level 5 = Notice, Level 6 = Informational, Level 7 = Debugging.
Level 3 specifically indicates an error condition that impacts device operation.

Anahtar Kavram

Cisco IOS Syslog Severity Levels (0-7)
Soru 1717Soru →

Match each enterprise network security threat on the left with its corresponding operational description or attack vector characteristic on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Distributed Denial of Service (DDoS)
Man-in-the-Middle (MitM)
Spear Phishing
Zero-Day Exploit

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Distributed Denial of Service (DDoS) matches flooding resources from multiple distributed endpoints; Man-in-the-Middle (MitM) matches intercepting traffic in the active communication path; Spear Phishing matches targeted social engineering targeting specific individuals; Zero-Day Exploit matches attacking an undisclosed vulnerability before a patch exists.
Each security threat term is accurately mapped to its primary attack vector and operational impact within enterprise network environments.

Adım Adım Çözüm

1
Analyze Distributed Denial of Service (DDoS)
Identified as a multi-source resource exhaustion attack targeting availability.
DDoS specifically leverages multiple distributed hosts to saturate network bandwidth or host processing capacity.
2
Analyze Man-in-the-Middle (MitM)
Identified as an active path insertion and packet interception attack.
MitM relies on tricking two endpoints into routing data through an adversary's host to eavesdrop or modify traffic.
3
Analyze Spear Phishing
Identified as a tailored social engineering vector.
Spear phishing differs from generic mass phishing by customizing content to deceive specific targeted individuals or organizations.
4
Analyze Zero-Day Exploit
Identified as an attack on unpatched, publicly unknown code vulnerabilities.
Zero-day refers to software flaws exploited prior to patch availability or public security advisory release.

Anahtar Kavram

Key Security Concepts, Threats, Vulnerabilities, and Mitigations
Soru 1718Soru →

A network administrator needs to configure a Cisco IOS router to relay DHCP broadcast requests from local clients on VLAN 10 to a centralized DHCP server located at 192.168.50.10 in a different subnet. On which interface must the administrator configure the ip helper-address 192.168.50.10 command?

Cevabı ve açıklamayı göster

Cevap: On the local client-facing gateway interface that receives incoming broadcast requests from VLAN 10

Cevap

The ip helper-address command must be configured on the local client-facing gateway interface that receives incoming broadcast messages.
To act as a DHCP relay agent, a Cisco router must intercept incoming DHCP broadcast messages on the local gateway interface (client-facing interface) and re-transmit them as unicast traffic to the specified DHCP server address.

Adım Adım Çözüm

1
Identify the interface where client DHCP DISCOVER UDP broadcasts land.
The LAN-facing gateway interface (or subinterface/SVI) for VLAN 10 receives the broadcast frames.
DHCP clients issue requests as local broadcasts. The router must listen for and intercept these packets at the receiving gateway interface.
2
Apply the ip helper-address command pointing to the remote DHCP server IP address on that interface.
The router intercepts incoming broadcasts on VLAN 10, sets the gateway IP address (giaddr) field, and forwards the request as a unicast IP packet to 192.168.50.10.
Enabling the helper address on the incoming gateway interface activates DHCP relay agent operations specifically for that broadcast domain.

Anahtar Kavram

DHCP Relay Agent Interface Placement
Soru 1719Soru →

A network engineer is implementing First Hop Redundancy Protocols (FHRP) across an enterprise distribution layer, deploying HSRPv2 on VLAN 10 and VRRPv3 on VLAN 20. Which two statements correctly describe the operational mechanics, protocol addresses, and default behavior differences between HSRPv2 and VRRPv3? (Select two.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: HSRPv2 sends hello messages to the multicast destination IPv4 address 224.0.0.102, whereas VRRPv3 sends advertisement packets to the multicast address 224.0.0.18 for IPv4 deployments.; VRRP allows the virtual IP address to match a physical IP address assigned to the Master router's interface, whereas HSRP requires the virtual IP to be unique and different from all physical interface IP addresses in the group.

Cevap

HSRPv2 sends hello packets to multicast address 224.0.0.102 while VRRPv3 uses 224.0.0.18, and VRRP permits configuring a virtual IP that matches a physical interface IP while HSRP requires a unique virtual IP address.
The correct statements correctly identify the protocol multicast addresses (HSRPv2 uses 224.0.0.102, whereas VRRPv3 uses 224.0.0.18) and the virtual IP assignment rules (VRRP allows the virtual IP to match a physical interface IP, whereas HSRP mandates a unique virtual IP address).

Adım Adım Çözüm

1
Analyze multicast destination addressing for HSRPv2 and VRRPv3.
HSRPv1 uses 224.0.0.2, HSRPv2 uses 224.0.0.102 (UDP 1985). VRRPv2 and VRRPv3 (IPv4) use 224.0.0.18 (IP protocol 112).
Correct protocol understanding requires knowing transport and network layer multicast identifiers.
2
Evaluate virtual IP address assignment constraints.
HSRP requires the virtual IP to be unique within the subnet and not assigned as a physical IP on any participating gateway interface. VRRP permits the virtual IP to be identical to the IP address configured on the Master router's physical interface (IP address owner).
This is a fundamental architectural difference between Cisco proprietary HSRP and standard VRRP.
3
Evaluate preemption defaults for both protocols.
HSRP preemption is disabled by default. VRRP preemption is enabled by default.
Default preemption rules dictate failover and recovery behavior when a higher-priority device comes online.

Anahtar Kavram

FHRP Protocol Differences (HSRP vs. VRRP Addressing, Virtual IP Rules, and Preemption Defaults)
Soru 1720Soru →

A network administrator is evaluating the operational behavior and port roles of Rapid PVST+ on Cisco Catalyst switches. Which two statements regarding Rapid PVST+ operations are correct?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An Alternate port functions as a backup path to the root bridge and can rapidly transition to the root port role if the active root port fails.; Designated ports utilize an explicit proposal and agreement handshake on point-to-point links to transition directly to the forwarding state.

Cevap

The two correct statements are that an Alternate port acts as a backup path to the root bridge, and that Designated ports use a proposal and agreement handshake on point-to-point links for rapid state transitions.
Rapid PVST+ defines an Alternate port as a discarded port receiving BPDUs from another switch, providing a backup path toward the root bridge. Additionally, Rapid PVST+ uses a proposal/agreement handshake on point-to-point links to bypass legacy 802.1D listening/learning timers and achieve rapid convergence.

Adım Adım Çözüm

1
Analyze Rapid PVST+ port roles and state transition mechanisms.
Identified that Alternate ports offer immediate backup paths to the root bridge, and point-to-point links use proposal/agreement sync mechanisms for fast convergence.
Rapid PVST+ (802.1w implementation per VLAN) replaces timer-based convergence with explicit sync handshakes and active alternate backup paths.
2
Evaluate misconfigurations and priority calculations.
Confirmed that PortFast on trunk links creates loops and priority values must strictly follow 4096 increments due to the System ID Extension.
Bridge priorities consist of a 4-bit priority field (increments of 4096) combined with a 12-bit VLAN ID field.

Anahtar Kavram

Rapid PVST+ Port Roles and Sync Handshake Mechanics
ÖncekiSayfa 86 / 100Sonraki
Tüm alıştırma soruları — Cisco CCNA | Examkin