Tüm alıştırma soruları

1987 soru

Tüm türler1,987 Çoktan seçmeli1,020 Çoklu seçim452 Sayısal18 Eşleştirme229 Sıralama203 Boşluk doldurma22 Kısa cevap43

A network administrator is assigning an IP address to a core switch interface with the IPv4 address $172.16.138.200$ and a subnet mask of $255.255.248.0$ . What is the broadcast address of this subnetwork?

172.16.143.255

172.16.143.254

172.16.139.255

172.32.143.255

Cevabı ve açıklamayı göster

Cevap: $172.16.143.255$

Cevap

The broadcast address for the subnetwork containing

172.16.138.200/21

172.16.143.255

For a subnet mask of

255.255.248.0

(/21), the third octet block size is

256 - 248 = 8

. Subnet boundaries in the third octet occur at multiples of 8 (

0, 8, 16, \dots, 136, 144

). Since the host IP is

172.16.138.200

, it falls in the subnet starting at

172.16.136.0

. The broadcast address is one less than the next subnet boundary (

172.16.144.0

), resulting in

172.16.143.255

Adım Adım Çözüm

Determine the prefix length and block size from the subnet mask

255.255.248.0

The subnet mask

255.255.248.0

corresponds to a /21 prefix. The interesting octet is the third octet, giving a block size of

256 - 248 = 8

Identifying the block size determines the increment between consecutive subnet boundaries.

Calculate the network ID containing the host address

172.16.138.200

Dividing the third octet value

138

8

yields

17.25

. Multiplying

17 \times 8 = 136

establishes the network boundary at

172.16.136.0/21

Finds the starting network address of the subnet.

Calculate the broadcast address by subtracting 1 from the next subnet boundary.

The next subnet boundary is

172.16.136.0 + 8 = 172.16.144.0

. Subtracting 1 gives

172.16.143.255

The broadcast address is the highest address in the subnet with all host bits set to 1.

Anahtar Kavram

Subnet Block Size and Broadcast Address Derivation

Soru 1742Soru →

A Cisco IOS router is configured as an authoritative DHCP server with IP address conflict detection enabled (using the default ping settings). Place the operational steps in the correct chronological order to show how the router handles an incoming broadcast DHCP DISCOVER packet from a new client.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: 1) Select candidate IP address from pool based on client subnet -> 2) Send ICMP Echo Requests to verify address availability -> 3) Send DHCP OFFER to client after ICMP timeout -> 4) Receive client DHCP REQUEST accepting the offer -> 5) Create IP binding entry and send DHCP ACK.

When Cisco IOS conflict detection is active, the router evaluates an available IP address from the pool upon receiving a DHCP DISCOVER message. It probes the address using ICMP Echo Requests before transmitting a DHCP OFFER. If no reply is received, it sends the DHCP OFFER. The client responds with a DHCP REQUEST, and the server finishes the handshake by writing the binding and returning a DHCP ACK.

Adım Adım Çözüm

Address Selection

The router identifies an available IP address within the pool range matching the incoming interface subnet.

The server must choose a candidate address prior to testing its availability.

Conflict Detection (Ping Check)

The router emits ICMP Echo Request pings to the candidate IP address (2 pings by default in Cisco IOS).

Cisco IOS conflict detection prevents assigning duplicate IP addresses already active on the local segment.

DHCP OFFER Transmission

Having received no ICMP Echo Reply, the router builds and sends a DHCP OFFER containing the candidate IP address, subnet mask, default router, and DNS settings.

Absence of ping reply confirms the IP is free to offer.

DHCP REQUEST Receipt

The client processes the offer and broadcasts a DHCP REQUEST packet to notify all local DHCP servers of its choice.

The client must explicitly request the offered parameters.

Binding Creation and DHCP ACK

The server records the MAC-to-IP binding in `show ip dhcp binding` and sends a DHCP ACK back to the client.

The lease is finalized only when the server acknowledges the client request and stores the active binding.

Anahtar Kavram

Cisco IOS DHCP Server Address Conflict Detection Sequence during DORA Process

Soru 1743Soru →

A network administrator needs to create VLAN 60 named DEV_TEAM on a Cisco Catalyst switch and configure interface GigabitEthernet0/15 as a static access port assigned to that VLAN. Place the Cisco IOS CLI commands in the correct chronological sequence to perform this configuration starting from Privileged EXEC mode.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence is: configure terminal -> vlan 60 -> name DEV_TEAM -> interface GigabitEthernet0/15 -> switchport mode access -> switchport access vlan 60.

To configure a new VLAN with a specific name and assign a port to it, the process must follow Cisco IOS hierarchy: first enter global configuration mode ('configure terminal'), instantiate the VLAN and enter VLAN sub-mode ('vlan 60'), set the VLAN name ('name DEV_TEAM'), enter interface sub-mode ('interface GigabitEthernet0/15'), set the port mode ('switchport mode access'), and assign the access VLAN ('switchport access vlan 60').

Adım Adım Çözüm

Enter Global Configuration mode

Switch prompt changes to Switch(config)#

VLAN creation commands are global configuration commands and cannot be executed directly from Privileged EXEC mode.

Create VLAN 60

Switch prompt changes to Switch(config-vlan)#

Executes VLAN creation and switches context to VLAN configuration mode.

Name the VLAN DEV_TEAM

VLAN 60 is labeled with the name DEV_TEAM

The 'name' command must be executed within VLAN configuration context.

Select interface GigabitEthernet0/15

Switch prompt changes to Switch(config-if)#

Interface-specific settings require moving into interface configuration sub-mode.

Set port operational mode to access

DTP dynamic trunking negotiation is disabled for active access mode

Configuring 'switchport mode access' ensures the interface acts purely as a static access link.

Assign the port to VLAN 60

GigabitEthernet0/15 becomes an active access member of VLAN 60

Binds untagged ingress/egress frames on GigabitEthernet0/15 to broadcast domain VLAN 60.

Anahtar Kavram

Cisco IOS sequence for creating VLANs, configuring VLAN names, and assigning static access interfaces

Soru 1744Soru →

A router receives routes to the destination network $10.50.0.0/16$ via internal EIGRP (Administrative Distance $90$ ). An engineer intends to create a floating static route as a backup path and executes the command `ip route 10.50.0.0 255.255.0.0 192.168.12.2 80`. Which outcome occurs as a direct result of this configuration?

The newly configured static route immediately replaces the EIGRP route in the routing table because its Administrative Distance of

80

is lower than

90

The static route remains inactive in the background and only enters the routing table if the primary EIGRP neighbor adjacency fails.

The router installs both routes into the active routing table simultaneously and performs load balancing across both paths.

The command is rejected by Cisco IOS because custom administrative distance values below

90

are prohibited for static routes.

Cevabı ve açıklamayı göster

Cevap: The newly configured static route immediately replaces the EIGRP route in the routing table because its Administrative Distance of $80$ is lower than $90$ .

Cevap

The newly configured static route immediately replaces the EIGRP route in the routing table because its Administrative Distance of 80 is lower than 90.

Cisco routers use Administrative Distance (AD) to evaluate route trustworthiness when multiple sources learn paths to identical prefixes. Internal EIGRP has a default AD of 90. Configuring a static route with an AD of 80 makes it more preferred than EIGRP because a lower AD value indicates higher priority. As a result, the static route preempts the EIGRP route immediately in the routing table rather than functioning as a backup.

Adım Adım Çözüm

Identify the Administrative Distance (AD) of the existing primary route.

Internal EIGRP has a default AD of

90

Administrative Distance is used by Cisco IOS to select the best path when multiple routing sources supply routes to the same destination.

Analyze the configured AD of the static route command `ip route 10.50.0.0 255.255.0.0 192.168.12.2 80`.

The trailing value

80

sets the static route's AD to

80

The default static route AD is

1

, but appending a number at the end overrides the default AD value.

Compare the two AD values to determine routing table selection.

Since

80 < 90

, the static route is considered more trustworthy than EIGRP.

Lower AD values are preferred. To make a static route a floating backup, its AD must be higher than the primary protocol (e.g., AD of 95 or higher).

Anahtar Kavram

Floating Static Route Administrative Distance Requirements

Soru 1745Soru →

During an enterprise security audit following a system compromise, an incident response team discovers that a database server was accessed without authorization. The investigation shows that an outdated operating system service contained a coding flaw, which permitted an attacker to run a publicly available script to gain administrative access. Which security term specifically describes the flaw in the outdated operating system service?

Vulnerability

Exploit

Threat

Risk

Cevabı ve açıklamayı göster

Cevap: Vulnerability

Cevap

The correct terminology for the coding flaw in the outdated operating system service is a vulnerability.

In security fundamentals, a vulnerability is defined as any weakness, flaw, or bug in software, hardware, or administrative controls that can be leveraged by a threat actor. The unpatched legacy operating system service containing a coding flaw is the system vulnerability.

Adım Adım Çözüm

Analyze the security components described in the scenario.

Identified four elements: the unpatched operating system service flaw, the publicly available script, the external attacker, and the potential business damage.

Deconstructing an incident report into core security definitions is necessary to accurately classify each component.

Differentiate between Vulnerability, Exploit, Threat, and Risk.

The flaw/weakness in software is the Vulnerability; the script taking advantage of it is the Exploit; the external attacker is the Threat; the calculated impact/likelihood of loss is the Risk.

Standard security framework definitions (such as ISO/IEC 27000 and NIST) strictly define these core security terms.

Match the specific target of the question to the correct definition.

The question specifically asks about the coding flaw present in the service, which aligns exactly with Vulnerability.

The software weakness itself is the vulnerability that enables an attack to occur.

Anahtar Kavram

Core Information Security Terminology (Threat vs. Vulnerability vs. Exploit vs. Risk)

Soru 1746Soru →

A Cisco router receives an IPv4 packet with a destination IP address of 172.16.50.170. The router inspects its routing table and finds the following route entries:

S 172.16.50.0/24 [1/0] via 10.0.0.1, GigabitEthernet0/0
D 172.16.50.128/25 [90/2560] via 10.0.0.2, GigabitEthernet0/1
O 172.16.50.160/27 [110/50] via 10.0.0.3, GigabitEthernet0/2
S 172.16.50.176/28 [1/0] via 10.0.0.4, GigabitEthernet0/3

Which next-hop IP address and outgoing interface will the router select to forward this packet?

10.0.0.3 via GigabitEthernet0/2

10.0.0.1 via GigabitEthernet0/0

10.0.0.2 via GigabitEthernet0/1

10.0.0.4 via GigabitEthernet0/3

Cevabı ve açıklamayı göster

Cevap: 10.0.0.3 via GigabitEthernet0/2

Cevap

10.0.0.3 via GigabitEthernet0/2

When a router performs a forwarding lookup for destination 172.16.50.170, it checks all installed routes to find matches. The prefix 172.16.50.160/27 includes addresses from 172.16.50.160 to 172.16.50.191. Because /27 is the longest (most specific) prefix length among all matching routes, the router selects this entry (next-hop 10.0.0.3 via GigabitEthernet0/2). Administrative distance is not evaluated during lookup across routes of different prefix lengths.

Adım Adım Çözüm

Identify all candidate routing table entries that match the destination IP address 172.16.50.170.

Three routes match: 172.16.50.0/24 (range .0 - .255), 172.16.50.128/25 (range .128 - .255), and 172.16.50.160/27 (range .160 - .191). The route 172.16.50.176/28 (range .176 - .191) does not match.

Only matching routes are eligible for forwarding decisions.

Compare the prefix lengths of all matching candidate routes.

Prefix lengths are /24, /25, and /27. The longest prefix match is /27.

Routers use the Longest Prefix Match (LPM) rule first when making forwarding decisions.

Determine the next-hop and exit interface associated with the longest matching route.

The route 172.16.50.160/27 specifies next-hop 10.0.0.3 out interface GigabitEthernet0/2.

Administrative distance is only evaluated when comparing identical prefixes from different sources, not when comparing routes of different prefix lengths.

Anahtar Kavram

Longest Prefix Match (LPM) Routing Decision Logic

Soru 1747Soru →

An enterprise network administrator needs to design an IPv4 subnet for a new IP security camera deployment that must support 500 host devices. What is the maximum number of usable host IPv4 addresses provided by the smallest standard CIDR subnet block that can accommodate this requirement?

Cevabı ve açıklamayı göster

Cevap: 510

Cevap

510 usable host IPv4 addresses

To support 500 host devices, the number of host bits

h

must satisfy

2^h - 2 \ge 500

. A

/24

subnet (

h = 8

) yields only

2^8 - 2 = 254

usable hosts, which is insufficient. The smallest subnet size that meets the requirement is a

/23

subnet (

h = 9

), which provides

2^9 - 2 = 510

usable host addresses.

Adım Adım Çözüm

Determine the host bit requirement formula

Use

2^h - 2 \ge 500

, where

h

represents host bits.

In every standard IPv4 subnet, two addresses are reserved: the network ID (all host bits 0) and the broadcast address (all host bits 1).

Calculate the smallest number of host bits that accommodates 500 hosts

2^8 - 2 = 254

usable addresses (too small for 500 hosts);

2^9 - 2 = 510

usable addresses (meets the requirement).

Selecting 9 host bits leaves

32 - 9 = 23

network bits, resulting in a

/23

prefix length.

Calculate the usable host capacity

2^9 - 2 = 512 - 2 = 510

usable host addresses.

Subtracting 2 reserved addresses from the 512 total addresses gives 510 valid host assignments.

Anahtar Kavram

IPv4 Subnet Sizing and Usable Host Calculation

Soru 1748Soru →

A network engineer configures IPsec encryption on a site-to-site VPN tunnel connecting two corporate offices to ensure that intercepted data packets cannot be read by unauthorized individuals. Which core security principle of the CIA triad is directly achieved by this control?

Confidentiality

Integrity

Availability

Non-repudiation

Cevabı ve açıklamayı göster

Cevap: Confidentiality

Cevap

Confidentiality

Confidentiality ensures that information is kept secret and inaccessible to unauthorized entities. Implementing IPsec encryption scrambles packet payloads into ciphertext, preventing eavesdroppers from reading the contents.

Adım Adım Çözüm

Identify the primary objective described in the scenario.

The goal is to prevent unauthorized users from reading intercepted packets sent across the network.

Protecting data secrecy and preventing eavesdropping is the baseline requirement.

Map the technical control (IPsec encryption) to its corresponding CIA triad pillar.

Encryption renders plaintext data unreadable without the secret key, fulfilling the requirement for confidentiality.

Confidentiality is specifically concerned with keeping data hidden from unauthorized eyes.

Anahtar Kavram

CIA Triad: Confidentiality

Tahmini Süre:45s

Soru 1749Soru →

A network administrator needs to configure and verify a floating static route on a Cisco IOS router to back up a primary OSPF path (Administrative Distance 110) for destination network $10.50.0.0/24$ via next-hop IP $192.168.12.2$ . Place the required configuration and verification steps in the correct chronological order.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct operational sequence begins with entering global configuration mode, configuring the static route with an administrative distance of 120 (higher than OSPF's 110), verifying that OSPF remains the active route in the routing table, simulating a primary path link failure, and finally confirming that the floating static route is inserted into the routing table.

The sequence follows standard configuration and verification workflow: enter global config mode -> apply the floating static route command with AD 120 -> verify primary path retention in RIB -> force failover by shutting down primary path -> verify backup static route installation in RIB.

Adım Adım Çözüm

Access CLI configuration mode

Router transitions to global configuration prompt

CLI commands altering routing topology must be executed in global configuration mode.

Configure the IPv4 floating static route

Route `ip route 10.50.0.0 255.255.255.0 192.168.12.2 120` is added to router candidate table

An Administrative Distance of 120 ensures the static route is floating because it is higher than OSPF's AD of 110.

Verify initial RIB state

OSPF route is present in routing table; floating static route is absent

The router selects routes with lower Administrative Distance when multiple paths exist.

Simulate primary interface failure

OSPF path is removed from RIB due to dead neighbor / link down

The primary route withdrawal triggers route selection re-evaluation for destination network

10.50.0.0/24

Verify failover to backup floating static route

Static route via

192.168.12.2

with AD 120 is installed in RIB

With the lower AD route gone, the floating static route becomes the best available path.

Anahtar Kavram

Floating Static Route Configuration and Failover Lifecycle

Soru 1750Soru →

A network administrator has configured HSRPv2 between two routers, R1 (Active, priority 110, interface tracking decrements priority by 30) and R2 (Standby, priority 100, preemption enabled). Arrange the operational steps in the correct chronological sequence from the moment R1's tracked interface fails until R2 successfully handles traffic as the new Active router.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct chronological order is: 1) R1 detects tracked interface failure and reduces priority to 80; 2) R1 advertises the degraded priority via HSRP Hello; 3) R2 identifies its higher priority and sends an HSRP Coup message; 4) R1 relinquishes active status and broadcasts an HSRP Resign message; 5) R2 assumes the Active state and broadcasts a Gratuitous ARP to update switch CAM tables.

The failover process begins locally on R1 when the tracked link drops, causing priority degradation. Next, R1 informs the segment via Hello packets containing the updated priority. R2 evaluates this priority against its own higher priority and uses its preemption configuration to send a Coup message. R1 acknowledges this by relinquishing control and issuing a Resign message while moving to Standby state. Finally, R2 assumes the Active state and broadcasts a Gratuitous ARP to rewrite switch port bindings for the shared virtual MAC address.

Adım Adım Çözüm

Identify the initial triggering event

R1's tracked interface drops, reducing R1's priority from 110 to 80.

HSRP interface tracking dynamically recalculates priority immediately upon physical link or line protocol failure.

Determine how priority changes are communicated

R1 transmits Hello packets advertising priority 80.

HSRP routers exchange control messages periodically to communicate current group state and priority values.

Analyze preemption logic on the standby device

R2 observes R1's priority (80) is lower than R2's (100) and sends a Coup packet.

Preemption allows a router with higher priority than the current Active router to claim the Active role.

Trace active router role surrender

R1 transitions to Standby after issuing a Resign packet.

Receiving a valid Coup from a higher-priority router forces the current Active router to yield leadership.

Verify Layer 2 forwarding convergence

R2 moves to Active state and emits a Gratuitous ARP.

GARP ensures attached Layer 2 switches immediately rewrite their MAC tables so traffic sent to the virtual IP/MAC reaches R2.

Anahtar Kavram

HSRP Preemption and Interface Tracking Convergence Sequence

Soru 1751Soru →

A network administrator is deploying SNMPv3 on a Cisco IOS router to allow a central Network Management System (NMS) located at $10.20.1.100$ to poll interface metrics. The administrator configures a custom MIB view and applies an inbound extended Access Control List (ACL) on the router's management interface ( $10.20.1.1$ ).

The router configuration is as follows:
text
snmp-server view IF_ONLY 1.3.6.1.2.1.2 included
snmp-server group MON_GROUP v3 priv read IF_ONLY
snmp-server user MON_USER MON_GROUP v3 auth sha Pass123 priv aes 128 Priv456
ip access-list extended MGMT_ACL
permit udp host 10.20.1.100 host 10.20.1.1 eq 162
deny ip any any
interface GigabitEthernet0/0
ip access-group MGMT_ACL in

When the NMS attempts to perform SNMP GetRequest operations to monitor interface statistics, all polling requests fail due to timeouts. Which modification will restore SNMP polling functionality?

Update MGMT_ACL to permit inbound UDP traffic targeted to destination port 161 on the router.

Remove the explicit deny ip any any statement from MGMT_ACL because Cisco IOS ACLs automatically permit stateless UDP response traffic.

Reconfigure the NMS client to initiate polling requests over TCP port 161 to establish connection state through the interface ACL.

Change the MIB object identifier in the IF_ONLY view from 1.3.6.1.2.1.2 to CDP TLV subtree 1.3.6.1.4.1.9 to allow interface polling.

Cevabı ve açıklamayı göster

Cevap: Update MGMT_ACL to permit inbound UDP traffic targeted to destination port 161 on the router.

Cevap

Update MGMT_ACL to permit inbound UDP traffic targeted to destination port 161 on the router.

SNMP uses two distinct UDP ports for operation: UDP port 161 is used by the SNMP agent (the router) to listen for requests (such as GetRequest, GetNextRequest, and SetRequest) sent by an NMS. UDP port 162 is used by an NMS or notification receiver to listen for asynchronous traps and informs sent by managed agents. Because the NMS is attempting to poll the router for interface stats, the incoming traffic targets UDP port 161. Updating the ACL to permit destination UDP port 161 allows these polling requests to reach the SNMP agent process.

Adım Adım Çözüm

Analyze the SNMP transport port requirements for polling vs notifications.

SNMP agents listen for incoming queries (Get, GetNext, Set) on UDP port 161. SNMP management stations listen for traps and informs on UDP port 162.

The NMS is initiating GetRequest operations toward the router, meaning incoming packets arriving at the router interface will have a destination port of UDP 161.

Inspect the inbound interface ACL MGMT_ACL applied to GigabitEthernet0/0.

The ACL permits UDP traffic from host 10.20.1.100 to host 10.20.1.1 eq 162 and drops all other traffic with deny ip any any.

Because destination port 161 is not permitted, the router drops incoming SNMP GetRequest packets from the NMS before they reach the SNMP engine, resulting in polling timeouts.

Determine the necessary ACL correction.

Modifying the ACL rule to match destination UDP port 161 allows the router to receive and process the SNMPv3 requests.

Permitting UDP port 161 aligns the firewall filter with standard SNMP agent listening behavior.

Anahtar Kavram

SNMP Transport Ports and Inbound Access Control

Soru 1752Soru →

A network administrator is troubleshooting remote access on a branch gateway router (Branch-GW). SSH version 2 has been configured, but remote management attempts over SSH fail immediately with a transport layer connection error, whereas Telnet connections are unexpectedly accepted. The administrator collects the following configuration and status outputs from the router:

text
Branch-GW# show ip ssh
SSH Enabled - version 2.0
Authentication timeout: 60 secs; Authentication retries: 3
Device Mode: SSH Server
RSA Key size: 2048 bits

Branch-GW# show running-config | section line vty
line vty 0 4
access-class MGMT-ACCESS in
login local
transport input telnet
line vty 5 15
access-class MGMT-ACCESS in
login local
transport input telnet

Which configuration change must be applied to Branch-GW to resolve the connection issue and enforce secure SSH access on all VTY lines?

Execute transport input ssh under line vty 0 15 to allow inbound SSH sessions.

Add permit any to the MGMT-ACCESS access list because standard ACLs block SSH transport negotiation by default.

Re-execute crypto key generate rsa modulus 512 to reset the key length for SSH version 2 compatibility.

Change login local to login under line vty 0 15 to permit public-key authentication.

Cevabı ve açıklamayı göster

Cevap: Execute transport input ssh under line vty 0 15 to allow inbound SSH sessions.

Cevap

Execute transport input ssh under line vty 0 15 to allow inbound SSH sessions.

The output from 'show running-config' demonstrates that all virtual terminal lines (vty 0 15) are configured with 'transport input telnet'. This restricts incoming management traffic strictly to Telnet (TCP port 23) and causes the router to reject incoming SSH (TCP port 22) connection requests at the line level. Changing the setting to 'transport input ssh' permits SSH inbound sessions.

Adım Adım Çözüm

Analyze 'show ip ssh' verification output

SSH v2 is active and an RSA key of 2048 bits has been properly generated.

Verifies that global SSH preconditions (hostname, domain name, RSA key pair generation) are fully met.

Inspect VTY line configuration under 'show running-config'

'transport input telnet' is explicitly binding VTY lines 0 through 15 to accept only unencrypted Telnet traffic.

Even when SSH service is enabled globally, Cisco IOS VTY lines refuse incoming SSH transport connections if SSH is omitted from transport input.

Identify the required CLI configuration command

Navigate to 'line vty 0 15' and issue 'transport input ssh' (or 'transport input ssh telnet').

Re-enables inbound SSH connections across all virtual terminal lines.

Anahtar Kavram

VTY Line Transport Protocol Binding

Soru 1753Soru →

A network engineer initializes OSPFv2 on a Cisco router using the configuration below:

router ospf 10
router-id 1.1.1.1
network 10.1.1.0 0.0.0.3 area 0

The router also has an active Loopback 0 interface with IP address 172.16.1.1/24 and an active GigabitEthernet0/0 interface with IP address 10.1.1.1/30.

After neighbor adjacencies are established, the engineer enters OSPF configuration mode and executes the command `router-id 2.2.2.2`. No further commands are issued, and the router is not rebooted.

Which IP address is currently used as the active OSPF Router ID by the running OSPF process?

1.1.1.1

2.2.2.2

172.16.1.1

10.1.1.1

Cevabı ve açıklamayı göster

Cevap: 1.1.1.1

Cevap

1.1.1.1 is the active OSPF Router ID because changing the router-id configuration does not update the operational Router ID until the OSPF process is cleared or the router is restarted.

The correct choice is 1.1.1.1. When OSPF initializes, the explicit `router-id` command overrides all interface IP addresses. Once selected and active, changing the `router-id` setting does not dynamically change the operational router ID until the OSPF process is restarted using the `clear ip ospf process` privileged EXEC mode command or by reloading the device.

Adım Adım Çözüm

Determine initial Router ID election

The OSPF process elected 1.1.1.1 because an explicit `router-id` command takes highest precedence during initialization.

Explicit configuration overrides loopback and physical interface IP addresses.

Analyze the impact of changing the `router-id` command on an active process

Configuring `router-id 2.2.2.2` updates the running configuration file, but does NOT dynamically reset active neighbor adjacencies or change the live operational Router ID.

OSPF requires an explicit process reset via `clear ip ospf process` or a device reboot to enact a new Router ID.

Identify the current operational Router ID

The operational Router ID remains 1.1.1.1.

No process restart command was executed after changing the configuration.

Anahtar Kavram

OSPFv2 Router ID Non-Preemptive Precedence and Process Reset Requirement

Soru 1754Soru →

An enterprise router is being configured to share a single public IPv4 address assigned to its WAN interface, Serial0/0/0, among private LAN devices matched by access list 105. What specific Cisco IOS keyword must be appended to the end of the global command `ip nat inside source list 105 interface Serial0/0/0` to enable Port Address Translation (PAT)?

Cevabı ve açıklamayı göster

Cevap: overload

Cevap

overload

The keyword `overload` enables Port Address Translation (PAT) on Cisco IOS routers. Appending `overload` to `ip nat inside source list <acl> interface <interface>` enables transport-layer port multiplexing so multiple inside local IP addresses can be translated to a single inside global IP address simultaneously.

Adım Adım Çözüm

Analyze the global NAT configuration command syntax.

The statement `ip nat inside source list 105 interface Serial0/0/0` binds inside local traffic defined by ACL 105 to the WAN interface's public IP address.

Without port tracking enabled, dynamic NAT maps hosts on a strict 1-to-1 basis, exhausting the single IP address after one translation.

Identify the required keyword for enabling PAT (many-to-one translation).

Appending `overload` tells Cisco IOS to tracking source TCP/UDP port numbers, allowing multiple internal hosts to share the single IP address on interface Serial0/0/0.

The `overload` parameter explicitly instructs the router to perform Port Address Translation (PAT).

Anahtar Kavram

Port Address Translation (PAT) Interface-based Configuration Syntax

Soru 1755Soru →

A network engineer needs to configure a floating static route on Cisco router R1 for destination subnet $10.10.20.0/24$ via next-hop IP $192.168.1.2$ . The route must serve as a backup to an existing OSPF path, which has a default Administrative Distance of $110$ . The engineer decides to set the backup route's Administrative Distance to $130$ .

Complete the Cisco IOS global configuration command below by filling in the missing trailing Administrative Distance value.

Aşağıdaki boşlukları doldurun

R1(config)# ip route 10.10.20.0 255.255.255.0 192.168.1.2

Cevabı ve açıklamayı göster

Cevap

The trailing Administrative Distance value required to complete the command is 130.

Specifying 130 at the end of the `ip route` command assigns an Administrative Distance higher than the primary OSPF route's AD of 110. This keeps the route out of the routing table during normal operation and activates it only when the primary path is removed.

Adım Adım Çözüm

Identify the standard Cisco IOS syntax for a static route.

The basic command syntax is `ip route <prefix> <mask> <next-hop> [distance]`.

Placing an optional integer value at the end of the static route command assigns a custom Administrative Distance.

Determine the requested Administrative Distance value for the floating static route.

The specified Administrative Distance value is 130.

Setting the AD to 130 ensures it is higher than OSPF's default AD of 110, keeping the static route floating in reserve until the OSPF route fails.

Anahtar Kavram

Floating Static Route CLI Syntax and Administrative Distance

Tahmini Süre:1m 0s

Soru 1756Soru →

An enterprise network experiences an internal security incident where an unauthorized host on access VLAN 10 poisons the ARP caches of adjacent endpoints by advertising its own MAC address as the default gateway. A network engineer must implement a Layer 2 mitigation strategy that intercepts, inspects, and validates ARP requests and responses against a trusted IP-to-MAC binding table built by DHCP snooping. Which security mechanism directly mitigates this threat?

Dynamic ARP Inspection (DAI), which checks ARP packets on untrusted ports against the DHCP snooping binding database to discard spoofed ARP replies.

Port Security with sticky MAC address learning enabled across switch trunk links to restrict invalid gateway frame propagation.

Standard IPv4 Access Control Lists (ACLs) applied inbound on the switch virtual interface (SVI) without explicit deny entries.

RADIUS authentication on switch access ports, which encrypts Layer 2 ARP payloads to prevent host spoofing.

Cevabı ve açıklamayı göster

Cevap: Dynamic ARP Inspection (DAI), which checks ARP packets on untrusted ports against the DHCP snooping binding database to discard spoofed ARP replies.

Cevap

Dynamic ARP Inspection (DAI), which checks ARP packets on untrusted ports against the DHCP snooping binding database to discard spoofed ARP replies.

Dynamic ARP Inspection (DAI) is a Layer 2 security feature that defends against ARP poisoning and spoofing attacks. When DAI is enabled on a VLAN, switch ports are designated as trusted or untrusted. DAI intercepts all ARP requests and responses on untrusted ports and verifies the IP-to-MAC address bindings against a database built by DHCP snooping. If the ARP packet contains invalid or spoofed mappings, DAI drops the packet.

Adım Adım Çözüm

Identify the specific threat scenario

The attack involves ARP poisoning (cache poisoning), where a malicious host sends gratuitous or forged ARP responses linking the default gateway's IP address to its own MAC address, facilitating a Man-in-the-Middle (MitM) attack.

Understanding the attack vector at Layer 2 is critical for selecting the appropriate mitigation control.

Evaluate required mitigation mechanisms against Layer 2 threats

Dynamic ARP Inspection (DAI) is designed specifically to prevent ARP spoofing by inspecting ARP packets on untrusted interfaces.

DAI compares the incoming ARP packet's MAC and IP address fields against valid entries in the DHCP snooping binding database.

Distinguish DAI from other Layer 2 and AAA security controls

Port Security limits MAC address counts, ACLs filter Layer 3/4 headers, and RADIUS handles AAA, leaving DAI as the only feature that validates ARP frame integrity against DHCP snooping data.

A comprehensive security strategy relies on applying the correct feature to its corresponding vulnerability.

Anahtar Kavram

Mitigating Layer 2 ARP Poisoning Threats using Dynamic ARP Inspection (DAI) and DHCP Snooping

Soru 1757Soru →

Match each element of a Cisco IPv4 routing table entry on the left with its corresponding operational role on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Cevabı ve açıklamayı göster

Cevap

The first integer inside the brackets matches the Administrative Distance (trustworthiness of the route source). The second integer inside the brackets matches the Metric (routing protocol path cost). The IP address following 'via' matches the next-hop address. The interface designation matches the local egress interface.

In Cisco IOS routing table output entries (such as O 192.168.10.0/24 [110/65] via 10.1.1.2, GigabitEthernet0/0/1), the components strictly follow a defined syntax: the first bracketed integer is the Administrative Distance (believability/trustworthiness rating), the second bracketed integer is the routing protocol metric (cost of the path), the IP address following 'via' is the next-hop address of the adjacent router, and the ending interface identifier is the local exit port.

Adım Adım Çözüm

Analyze the Cisco routing table entry bracket notation [AD/Metric].

Identify that the first number represents Administrative Distance and the second number represents Metric cost.

Cisco IOS routes display bracketed values formatted strictly as [Administrative Distance / Metric].

Examine the forwarding path descriptors ('via IP' and interface name).

Map 'via IP' to the next-hop router's address and the interface name to the local outbound port.

'via' indicates the immediate upstream router address, while the final parameter indicates the local exit interface.

Anahtar Kavram

Routing Table Components & Cisco IOS Route Entry Structure

Soru 1758Soru →

Which two statements accurately describe the default operational characteristics of Cisco Hot Standby Router Protocol version 1 (HSRPv1)? (Select two.)

Geçerli olan tümünü seçin

Preemption is disabled by default on HSRP-enabled interfaces.

The default interface priority assigned to an HSRP group member is 100.

The virtual IP address can be configured to match the physical IP address of the active router's interface.

When interface priorities are equal, the router with the lowest physical IPv4 address becomes active.

Cevabı ve açıklamayı göster

Cevap: Preemption is disabled by default on HSRP-enabled interfaces.; The default interface priority assigned to an HSRP group member is 100.

Cevap

Preemption is disabled by default on HSRP-enabled interfaces, and the default interface priority assigned to an HSRP group member is 100.

The correct options accurately identify default HSRP behavior: preemption is disabled by default so a higher-priority router does not automatically assume the active role, and the default interface priority value is 100.

Adım Adım Çözüm

Evaluate default HSRP priority settings

Confirm that Cisco IOS assigns a default priority of 100 to HSRP group interfaces.

Priorities range from 0 to 255, with 100 being the baseline default.

Evaluate default HSRP preemption behavior

Confirm that preemption is disabled by default in HSRP.

Without the standby preempt command, a newly booted or recovered router with a higher priority remains in Standby state.

Verify virtual IP rules and tie-breaking logic

Identify incorrect statements regarding physical IP reuse and tie-breaker rules.

HSRP virtual IPs must not equal physical interface IPs, and tie-breakers favor the highest IP address.

Anahtar Kavram

HSRP Default Operational Parameters and Preemption Mechanics

Soru 1759Soru →

An infrastructure auditor reviews the local access credentials and line configuration snippet on an enterprise Cisco IOS switch:

text
username auditmgr privilege 15 secret 8 $8$ vG4k$9mP...
username techuser privilege 1 password 0 Cisco123!
service password-encryption
!
line console 0
login local
!
line vty 0 4
login local
transport input ssh
!
line vty 5 15
login
transport input ssh

Based on this configuration, which statement accurately describes the operational and security impact on administrative access?

VTY lines 5 through 15 will automatically fall back to local database authentication because transport input ssh is enforced across all VTY lines.

The auditmgr account uses Type 8 PBKDF2 hashing, which provides weaker protection than the reversible Type 7 cipher applied to techuser by service password-encryption.

VTY lines 5 through 15 will fail local database authentication because they specify login instead of login local, while techuser credentials are protected only by weak Type 7 encryption.

Executing service password-encryption elevates techuser to privilege level 15 and converts the unencrypted password string into a secure Type 9 scrypt hash.

Cevabı ve açıklamayı göster

Cevap: VTY lines 5 through 15 will fail local database authentication because they specify login instead of login local, while techuser credentials are protected only by weak Type 7 encryption.

Cevap

VTY lines 5 through 15 will fail local database authentication because they specify 'login' instead of 'login local', and 'techuser' credentials are stored using weak reversible Type 7 encryption.

The statement identifying that VTY lines 5 through 15 will fail local database authentication due to using 'login' instead of 'login local', alongside identifying that 'techuser' relies on weak Type 7 encryption, is correct. On Cisco IOS lines, 'login' requires a line-specific password and ignores the local username database. Additionally, 'service password-encryption' only applies weak Type 7 reversible obfuscation to 'password' commands rather than strong 'secret' hashing (Type 5, 8, or 9).

Adım Adım Çözüm

Analyze VTY line configuration for authentication mode consistency.

Lines 0-4 use 'login local' which queries the local database. Lines 5-15 use 'login' which expects a line password rather than checking local usernames, resulting in authentication failures for local database users accessing lines 5-15.

The 'login' command alone tells IOS to prompt for a line password set via 'password <str>' under the line context, whereas 'login local' instructs IOS to authenticate against configured 'username' database statements.

Evaluate local username password security types.

The 'auditmgr' account uses 'secret 8' (Type 8 PBKDF2 SHA-256 hash). The 'techuser' account uses 'password 0' which 'service password-encryption' transforms into a weak, easily reversible Type 7 cipher.

Type 7 encryption is weak Vigenère obfuscation meant only to prevent shoulder surfing. Type 8 (PBKDF2) and Type 9 (scrypt) secret hashes are cryptographically secure.

Combine line authentication behavior and password security analysis.

The configuration suffers from both line authentication misconfiguration on VTY 5-15 and weak credential protection for 'techuser'.

Combining these evaluations identifies the statement correctly detailing line authentication failure for local accounts on VTY 5-15 and weak Type 7 encryption.

Anahtar Kavram

Line Access Authentication and Cisco IOS Password Encryption Types

Soru 1760Soru →

A network operations engineer is migrating a dual-core distribution block from VRRPv2 to HSRPv2. During the migration on Switch-1 (interface VLAN 50, IPv4 address 10.50.1.1/24), the engineer attempts to assign 10.50.1.1 as the HSRP virtual IP address using the command `standby 50 ip 10.50.1.1`. The IOS XE CLI immediately returns an error and rejects the configuration. Which statement correctly explains the protocol design difference causing this failure?

HSRP requires the virtual IP address to be an unassigned IP address within the subnet, whereas VRRP allows a router interface physical IP address to serve as the virtual IP address.

HSRP allows assigning a physical interface IP address as the virtual IP only if the standby priority is configured to 255 prior to issuing the virtual IP command.

HSRPv2 requires the virtual IP address to reside in a separate, non-overlapping IPv4 subnet from the primary interface IP address assigned to the SVI.

The router rejects the command because preemption must be explicitly disabled on the SVI before matching the virtual IP address to an existing physical address.

Cevabı ve açıklamayı göster

Cevap: HSRP requires the virtual IP address to be an unassigned IP address within the subnet, whereas VRRP allows a router interface physical IP address to serve as the virtual IP address.

Cevap

HSRP requires the virtual IP address to be an unassigned IP address within the subnet, whereas VRRP allows a router interface physical IP address to serve as the virtual IP address.

In HSRP, the virtual IP address must be a distinct, unassigned address within the IP subnet shared by the participating routers. VRRP supports IP address ownership (where the virtual IP matches a physical interface IP address and gives that router priority 255), but HSRP strictly disallows assigning a router's physical interface IP address as the HSRP virtual IP address.

Adım Adım Çözüm

Analyze the operational rules for Cisco HSRP virtual IP address configuration.

HSRP (v1 and v2) mandates that the configured virtual IP address must be a unique, unassigned IP address within the local primary subnet and cannot match the physical IP address of any participating router interface.

Preventing IP overlap ensures standard ARP/ICMP processing and prevents local interface address conflicts in HSRP state machines.

Compare HSRP behavior with VRRP IP address ownership functionality.

VRRP permits the IP address owner scenario where the virtual IP matches the physical IP address of an interface on the Master router (setting priority automatically to 255).

This key design difference explains why a configuration valid in VRRP fails when replicated directly in HSRP.

Anahtar Kavram

First Hop Redundancy Protocols (HSRP vs. VRRP Virtual IP Assignment Rules)

ÖncekiSayfa 88 / 100Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram