Examkin

Tüm alıştırma soruları

1020 soru

Tüm türler1,987Çoktan seçmeli1,020Çoklu seçim452Sayısal18Eşleştirme229Sıralama203Boşluk doldurma22Kısa cevap43
Soru 1Soru →

A network security administrator is deploying a site-to-site IPsec VPN tunnel between two corporate edge routers across a private WAN. The security policy requires data confidentiality and integrity for the IP payload. To minimize encapsulation overhead, the design mandates retaining the original IP packet header rather than encapsulating the packet with an additional new IP header. Which IPsec protocol and mode combination fulfills these requirements?

Cevabı ve açıklamayı göster

Cevap: Encapsulating Security Payload (ESP) in transport mode

Cevap

Encapsulating Security Payload (ESP) in transport mode
Encapsulating Security Payload (ESP) provides confidentiality through data encryption as well as data integrity and origin authentication. In transport mode, ESP encrypts only the IP payload while keeping the original IP header intact, satisfying both the security policy for confidentiality and the constraint to minimize packet overhead.

Adım Adım Çözüm

1
Identify the protocol requirement for data confidentiality and integrity.
Encapsulating Security Payload (ESP) must be selected because Authentication Header (AH) does not support encryption (confidentiality).
AH provides integrity and authentication only, whereas ESP provides encryption, integrity, and authentication.
2
Determine the operational mode based on IP header overhead constraints.
Transport mode must be used rather than tunnel mode.
Transport mode encrypts only the payload and retains the original IP header, avoiding the extra overhead of adding a new outer IP header as required in tunnel mode.

Anahtar Kavram

IPsec Security Protocols (AH vs ESP) and Operational Modes (Transport vs Tunnel)
Soru 2Soru →

A network administrator is troubleshooting a DHCP relay issue on a Cisco IOS router. Host devices on VLAN 30 (172.16.30.0/24172.16.30.0/24) use subinterface GigabitEthernet0/0.30 (172.16.30.1172.16.30.1) as their default gateway. The centralized DHCP server is located at 10.10.10.5010.10.10.50, connected off router interface GigabitEthernet0/1 (10.10.10.110.10.10.1).

Packet captures at the DHCP server reveal that incoming relayed DHCP DISCOVER messages contain a Relay Agent IP Address (`giaddr`) of 10.10.10.110.10.10.1 instead of 172.16.30.1172.16.30.1. Consequently, the DHCP server fails to assign addresses from the intended 172.16.30.0/24172.16.30.0/24 pool.

Which router misconfiguration causes the `giaddr` field to be set to 10.10.10.110.10.10.1?

Cevabı ve açıklamayı göster

Cevap: The `ip helper-address 10.10.10.50` command was incorrectly applied to interface GigabitEthernet0/1 instead of subinterface GigabitEthernet0/0.30.

Cevap

The `ip helper-address 10.10.10.50` command was incorrectly applied to interface GigabitEthernet0/1 instead of subinterface GigabitEthernet0/0.30.
When a Cisco router acts as a DHCP relay agent, it listens for broadcast UDP port 67 messages on interfaces configured with `ip helper-address <server_ip>`. When a DISCOVER packet is received on such an interface, the router converts the broadcast to a unicast packet sent to the helper IP and populates the `giaddr` (Gateway IP Address) field with the primary IP address of the INCOMING interface. Because `giaddr` was set to 10.10.10.110.10.10.1, the `ip helper-address` command was erroneously placed on interface GigabitEthernet0/1. Moving the command to GigabitEthernet0/0.30 ensures `giaddr` is populated as 172.16.30.1172.16.30.1, allowing the DHCP server to allocate from the correct 172.16.30.0/24172.16.30.0/24 pool.

Adım Adım Çözüm

1
Analyze how a Cisco IOS DHCP Relay Agent populates the Relay Agent IP Address (`giaddr`) field.
When a router receives a client broadcast DHCP DISCOVER message on an interface enabled with `ip helper-address`, it sets the `giaddr` field to the primary IP address of the INGRESS interface where the request was received.
The DHCP server uses the `giaddr` field to determine which subnet scope/pool to select for IP address assignment.
2
Evaluate the captured `giaddr` IP address value (10.10.10.110.10.10.1).
10.10.10.110.10.10.1 corresponds to interface GigabitEthernet0/1, which is the egress interface connected to the DHCP server subnet, rather than ingress subinterface GigabitEthernet0/0.30 (172.16.30.1172.16.30.1).
This indicates that the `ip helper-address` command was mistakenly configured under interface GigabitEthernet0/1.
3
Identify the corrective configuration step.
Remove `ip helper-address 10.10.10.50` from interface GigabitEthernet0/1 and place it under subinterface GigabitEthernet0/0.30.
Placing the helper address on GigabitEthernet0/0.30 ensures the router intercepts VLAN 30 client broadcasts and sets `giaddr` to 172.16.30.1172.16.30.1.

Anahtar Kavram

DHCP Relay Agent Ingress Interface Binding and giaddr Population
Soru 3Soru →

Which physical security control uses a set of two interlocking doors to directly prevent unauthorized individuals from tailgating into a secure data center facility?

Cevabı ve açıklamayı göster

Cevap: A mantrap vestibule

Cevap

A mantrap vestibule is the correct physical security control designed specifically to prevent tailgating by utilizing interlocking doors.
A mantrap vestibule features two interlocking doors where only one door can be open at a time. Once a user scans their credentials to enter the first door, that door must close fully before the second door unlocks, isolating individuals and preventing unauthorized tailgating into restricted areas.

Adım Adım Çözüm

1
Identify the primary threat described in the scenario.
The target threat is tailgating (piggybacking), where an unauthorized individual physically follows an authorized person through a secure doorway.
Preventing tailgating requires physical barriers capable of enforcing single-person entry verification.
2
Differentiate physical security controls from logical network security controls.
A mantrap vestibule physically holds an individual between two interlocking doors until identity/access is verified. Logical controls (ACLs, AAA, Port Security) operate entirely inside network software/hardware interfaces.
Only physical access controls like mantraps physically constrain human movement at facility entrances.

Anahtar Kavram

Physical Access Controls - Mantraps
Soru 4Soru →

An enterprise network team is replacing standard server deployments with hypervisor-based virtualization. During the architecture review, an engineer explains that Type 1 hypervisors provide superior performance and lower latency for enterprise workloads compared to Type 2 hypervisors. Which architectural feature directly accounts for this performance advantage in Type 1 hypervisors?

Cevabı ve açıklamayı göster

Cevap: It accesses host hardware components directly without relying on an underlying host operating system.

Cevap

The Type 1 hypervisor accesses host hardware components directly without relying on an underlying host operating system.
Type 1 (bare-metal) hypervisors install directly onto physical server hardware without requiring a host operating system. By managing physical hardware resources natively, Type 1 hypervisors eliminate the scheduling overhead and latency inherent to hosted (Type 2) hypervisors.

Adım Adım Çözüm

1
Analyze the architecture of Type 1 (bare-metal) hypervisors.
Type 1 hypervisors run directly on physical hardware without a host OS.
Eliminating the host operating system reduces latency and resource overhead, allowing direct hardware interaction for virtual machines.
2
Compare Type 1 architecture with Type 2 (hosted) hypervisors.
Type 2 hypervisors require a host operating system to manage system calls, hardware devices, and memory allocation.
Host OS mediation introduces processing overhead, making Type 2 hypervisors less suitable for high-performance enterprise workloads.

Anahtar Kavram

Type 1 vs Type 2 Hypervisor Architecture
Soru 5Soru →

A network administrator is deploying a Cisco Lightweight Access Point (AP) connected to a Layer 2 switch port configured as an 802.1Q trunk. The AP is intended to exchange CAPWAP control messages with the Wireless LAN Controller (WLC) management interface over the native VLAN while carrying client traffic on tagged VLANs. Switch syslogs immediately report a 'Native VLAN mismatch' notification on the interface, and the AP fails to join the controller. Which condition explains why management access between the AP and the WLC is failing?

Cevabı ve açıklamayı göster

Cevap: Untagged CAPWAP discovery and management packets sent by the AP arrive on a mismatched native VLAN at the switch, placing management traffic into an unintended VLAN segment.

Cevap

Untagged CAPWAP discovery and management packets sent by the AP arrive on a mismatched native VLAN at the switch, placing management traffic into an unintended VLAN segment.
Cisco Lightweight Access Points transmit their initial CAPWAP discovery and management control traffic as untagged frames by default. When connected to an 802.1Q trunk port, these untagged frames are mapped directly to the switch port's native VLAN. A native VLAN mismatch causes the switch to place the AP's management frames into an incorrect VLAN segment, preventing IP communication with the Wireless LAN Controller (WLC) management interface.

Adım Adım Çözüm

1
Identify the transmission mode of AP management and CAPWAP control traffic on an 802.1Q trunk port.
By default, Cisco Lightweight Access Points transmit CAPWAP management packets as untagged frames.
The AP relies on the native VLAN of the connected switchport to process untagged management traffic.
2
Analyze the impact of a Native VLAN mismatch on untagged frames.
When a switch port's native VLAN does not match the configured subnet or opposing link expectation, untagged packets are forwarded onto the incorrect VLAN.
Layer 2 switches assign incoming untagged frames to the port's configured native VLAN.
3
Determine the effect on WLC management access and CAPWAP tunnel establishment.
Because the AP management frames enter the wrong VLAN/IP subnet, IP routing to the WLC management IP fails and the CAPWAP state machine cannot complete.
CAPWAP discovery and join requests require bidirectional IP connectivity between the AP management IP and the WLC management interface IP.

Anahtar Kavram

AP and WLC Management Access over 802.1Q Native VLANs
Soru 6Soru →

A network administrator is configuring out-of-band management access for a Cisco Wireless LAN Controller (WLC). The administrator connects the WLC Service Port to an isolated management network while connecting the WLC Management Interface to an 802.1Q trunk port on the distribution switch. Which operational characteristic uniquely applies to the Service Port on a Cisco WLC?

Cevabı ve açıklamayı göster

Cevap: It operates strictly out-of-band, supports only untagged traffic, and maintains a dedicated default gateway separate from the main controller routing table.

Cevap

The Service Port operates strictly out-of-band, supports only untagged traffic, and maintains a dedicated default gateway separate from the main controller routing table.
The Cisco WLC Service Port provides dedicated out-of-band management capability. It is completely isolated from the controller's data plane, does not support 802.1Q VLAN tagging (untagged traffic only), and maintains its own independent default gateway settings separate from the controller's main routing table.

Adım Adım Çözüm

1
Identify the primary role and architecture of the WLC Service Port.
The Service Port is a dedicated, physical, out-of-band management interface isolated from client and AP CAPWAP traffic.
Out-of-band management ports provide access for administrative GUI/CLI tasks even during main network or controller interface outages.
2
Evaluate framing and encapsulation requirements for the Service Port.
The Service Port only accepts untagged Ethernet frames (802.1Q tagging is not supported).
It connects to an access port on an isolated management network switch.
3
Analyze routing behavior for out-of-band traffic vs in-band traffic.
The Service Port uses a separate, independent default gateway configuration specifically defined for service port management traffic.
Traffic arriving on the Service Port must route back out through its own gateway rather than using the controller's main system routing table.

Anahtar Kavram

Cisco WLC Service Port vs Management Interface characteristics
Tahmini Süre:1m 30s
Soru 7Soru →

Which Cisco Access Point (AP) mode operates by dedicating its radios to capturing wireless traffic and forwarding all raw 802.11 frames over a CAPWAP tunnel to a specified IP address for analysis by packet analyzer software such as Wireshark?

Cevabı ve açıklamayı göster

Cevap: Sniffer mode

Cevap

Sniffer mode dedicatedly captures raw 802.11 frames on a specified channel and sends them via a CAPWAP tunnel to a designated workstation running network analysis software.
In Sniffer mode, the lightweight access point dedicates its radio to a specific channel, captures all 802.11 wireless traffic, and encapsulates those frames into CAPWAP packets sent to a destination server running a network protocol analyzer.

Adım Adım Çözüm

1
Identify the AP mode configured specifically for remote packet capturing.
Sniffer mode allows an engineer to remotely capture wireless frames on a target channel without being physically present with a wireless packet capture card.
When an AP is placed in Sniffer mode, it stops serving clients and redirects all received radio traffic to a specified IP destination for decode and troubleshooting.

Anahtar Kavram

Cisco Lightweight AP Operational Modes
Tahmini Süre:45s
Soru 8Soru →

A network administrator is configuring a router interface for IPv6 stateless address autoconfiguration (SLAAC) using EUI-64. The interface is assigned the IPv6 prefix 2001:db8:cafe:10::/642001:\text{db8}:\text{cafe}:10::/64 and has a MAC address of B4A9.5A12.3456\text{B4A9.5A12.3456}. Which complete IPv6 global unicast address will be generated for this interface?

Cevabı ve açıklamayı göster

Cevap: 2001:db8:cafe:10:b6a9:5aff:fe12:3456

Cevap

2001:db8:cafe:10:b6a9:5aff:fe12:3456
The address ending in 'b6a9:5aff:fe12:3456' is correct because EUI-64 splits the MAC address B4:A9:5A:12:34:56 into two equal parts, inserts the 16-bit hex value FFFE into the middle, and flips the 7th bit of the first byte (changing 0xB4, which is 1011 0100 binary, into 0xB6, which is 1011 0110 binary).

Adım Adım Çözüm

1
Split the MAC address into two 24-bit halves and insert FFFE in the middle.
The MAC address B4:A9:5A : 12:34:56 becomes B4A9:5AFF:FE12:3456.
EUI-64 expands a 48-bit MAC address into a 64-bit interface identifier by inserting the 16-bit hex value FFFE between the OUI and the NIC specific serial number.
2
Invert the 7th bit (Universal/Local bit) of the first byte.
First byte 0xB4 in binary is 1011 0100. Inverting the 7th bit gives 1011 0110, which is 0xB6. The interface ID becomes b6a9:5aff:fe12:3456.
RFC 4291 requires flipping the 7th bit of the first byte to indicate universal scope for IEEE MAC-derived interface identifiers.
3
Combine the /64 network prefix with the generated 64-bit interface identifier.
2001:db8:cafe:10:b6a9:5aff:fe12:3456.
The full IPv6 address is constructed by appending the EUI-64 interface ID to the assigned /64 network subnet prefix.

Anahtar Kavram

EUI-64 Interface Identifier Generation
Tahmini Süre:1m 15s
Soru 9Soru →

A network administrator is deploying Cisco Lightweight Access Points (APs) operating in Local mode across an enterprise network. The APs must establish CAPWAP tunnels back to a central Wireless LAN Controller (WLC) whose Management interface resides on VLAN 10. The switch ports connected to the APs are configured as access ports assigned to VLAN 20, where an infrastructure DHCP server provides IP addressing along with DHCP Option 43. A junior engineer proposes reconfiguring all AP switch ports as 802.1Q trunk ports with PortFast enabled.

Which statement accurately evaluates this switchport configuration recommendation for Local mode AP access?

Cevabı ve açıklamayı göster

Cevap: Local mode APs transmit and receive management traffic as untagged frames, making access ports in the AP management VLAN standard; configuring 802.1Q trunks is unnecessary unless FlexConnect mode with local VLAN mapping is used.

Cevap

Local mode APs transmit and receive management traffic as untagged frames, making access ports in the AP management VLAN standard; configuring 802.1Q trunks is unnecessary unless FlexConnect mode with local VLAN mapping is used.
In Cisco centralized wireless architecture, an AP in Local mode tunnels all wireless client traffic to the Wireless LAN Controller using CAPWAP. The AP itself only needs a single IP address on an untagged access port (or untagged native VLAN) within its management VLAN to establish communication with the WLC. Configuring an 802.1Q trunk on the AP switch port is unnecessary for Local mode APs and is primarily used when deploying APs in FlexConnect mode with local VLAN switching.

Adım Adım Çözüm

1
Analyze the operational mode of the Cisco Lightweight Access Point.
The AP operates in Local mode, which means all user traffic is encapsulated within CAPWAP data tunnels and sent directly to the Wireless LAN Controller (WLC).
Local mode APs do not switch wireless client traffic locally onto the switch.
2
Determine the interface and VLAN requirement for the AP switch connection.
The AP only requires a single Layer 3 IP address to establish a CAPWAP control and data tunnel to the WLC Management interface.
Because all wireless SSID traffic is tunneled to the WLC, multiple VLAN tags do not pass over the physical switch link connected to a Local mode AP.
3
Evaluate the necessity of 802.1Q trunking vs access ports.
An access port assigned to the AP management VLAN (VLAN 20) is sufficient and recommended. 802.1Q trunks are typically only required when APs are operating in FlexConnect mode with local traffic switching across multiple VLANs.
Configuring trunks for Local mode APs adds unnecessary complexity and potential misconfigurations.

Anahtar Kavram

Lightweight AP and WLC Management Interconnects (Local vs FlexConnect AP Modes)
Soru 10Soru →

A network engineer deploys lightweight Cisco Access Points (APs) across multiple remote branch offices linked via a wide area network (WAN) to a centralized Wireless LAN Controller (WLC) in the main datacentre. During a unexpected WAN outage, wireless users at Branch 1 lose all network access to local site servers, whereas wireless users at Branch 2 continue accessing local network resources uninterrupted. Which configuration difference regarding AP modes and traffic handling accounts for this behavior during the WAN failure?

Cevabı ve açıklamayı göster

Cevap: Branch 2 deployed APs in FlexConnect mode with local switching configured for the WLAN, whereas Branch 1 deployed APs in standard Local mode, which relies on CAPWAP data tunnels to centralize all traffic at the WLC.

Cevap

Branch 2 deployed APs in FlexConnect mode with local switching configured for the WLAN, whereas Branch 1 deployed APs in standard Local mode, which relies on CAPWAP data tunnels to centralize all traffic at the WLC.
In Cisco wireless architectures, standard Local mode APs encapsulate all user traffic inside CAPWAP data tunnels and route it back to the centralized Wireless LAN Controller (WLC) regardless of destination. If the WAN link connecting a remote branch to the central WLC drops, Local mode APs cannot process or forward client packets. Conversely, FlexConnect APs are designed for remote/branch deployments; when configured for local switching, client data frames are bridged directly onto the local wired network switch port at the branch. This allows local network connectivity to persist even during a WAN link or WLC failure.

Adım Adım Çözüm

1
Analyze the operational requirements of AP modes during WAN link failure scenarios.
Identified that Local mode requires active CAPWAP control and data tunnels back to the central WLC for all traffic forwarding.
Standard Local mode APs depend entirely on the WLC to process and switch client data packets.
2
Evaluate the behavior of FlexConnect AP mode when WAN connectivity breaks.
FlexConnect mode allows APs to drop into standalone mode and switch client data packets locally to the access switch on configured local VLANs.
FlexConnect separates the control plane from the data plane, allowing local subnet resources to stay reachable locally when the central WLC is unreachable.
3
Determine why other listed modes (Monitor, Sniffer, Rogue Detector) do not apply.
Specialized AP modes (Monitor, Sniffer, Rogue Detector) do not broadcast SSIDs or handle client traffic.
Only client-serving modes like Local and FlexConnect support active client associations.

Anahtar Kavram

Cisco Lightweight AP Modes and FlexConnect Local vs Central Switching
Soru 11Soru →

A network administrator needs to assign interface GigabitEthernet0/4 on a Cisco Catalyst switch to VLAN 25. Which Cisco IOS command must be executed in interface configuration mode to set the active VLAN assignment for this access port?

Cevabı ve açıklamayı göster

Cevap: switchport access vlan 25

Cevap

The command switchport access vlan 25 correctly assigns an access port interface to VLAN 25 in Cisco IOS.
Executing switchport access vlan 25 in interface configuration mode directly sets the VLAN associated with an operational access port. If the specified VLAN does not already exist in the switch VLAN database, Cisco IOS automatically creates it upon executing this command.

Adım Adım Çözüm

1
Enter interface configuration mode for the specified port (e.g., interface GigabitEthernet0/4).
The switch prompt changes to Switch(config-if)#.
Port-specific VLAN assignments must be applied within the interface configuration context.
2
Execute switchport access vlan 25.
The port is assigned to transmit untagged traffic for VLAN 25.
The switchport access vlan <vlan-id> command sets the broadcast domain/VLAN for an access interface.

Anahtar Kavram

VLAN Configuration and Access Port Setup
Soru 12Soru →

A network administrator is migrating a medium-sized enterprise campus from a traditional Cisco three-tier architecture (Access, Distribution, Core) to a two-tier collapsed core architecture. Which statement accurately describes the architectural shift in responsibilities resulting from this topology change?

Cevabı ve açıklamayı göster

Cevap: The core switches combine high-speed backbone switching with distribution-layer functions such as inter-VLAN routing, security policy enforcement, and QoS boundary control.

Cevap

The core switches combine high-speed backbone switching with distribution-layer functions such as inter-VLAN routing, security policy enforcement, and QoS boundary control.
In a two-tier collapsed core enterprise design, the traditional distribution and core layers are merged into a single switch tier. Consequently, the collapsed core switches must handle both high-speed packet transport (core function) and policy/routing enforcement such as inter-VLAN routing, ACLs, and QoS boundaries (distribution function).

Adım Adım Çözüm

1
Analyze the traditional Cisco Three-Tier hierarchy roles
Access layer provides end-node connectivity; Distribution layer provides routing, ACL policy enforcement, and VLAN aggregation; Core layer provides high-speed backbone transport.
Understanding individual tier responsibilities is necessary to evaluate topology consolidation.
2
Evaluate the effect of collapsing the distribution layer into the core layer
The physical distribution tier is eliminated, and its functional boundaries (inter-VLAN routing, filtering, security policies) are merged into the core devices.
A two-tier collapsed core design saves cost and reduces latency in smaller enterprise environments while combining distribution and core roles into a single switch tier.

Anahtar Kavram

Two-Tier Collapsed Core Topology Functions
Tahmini Süre:1m 30s
Soru 13Soru →

An enterprise deploys Cisco lightweight Access Points (APs) configured in FlexConnect mode at a remote branch location connected via a WAN link to a centralized Wireless LAN Controller (WLC). The branch supports two SSIDs: an Enterprise WLAN configured for local switching with 802.1X (EAP) using FlexConnect Local Authentication, and a Guest WLAN configured for central switching and central authentication. If the WAN connection between the branch APs and the centralized WLC fails, causing the APs to transition to standalone mode, which statement correctly describes the resulting wireless client behavior?

Cevabı ve açıklamayı göster

Cevap: Clients on the Enterprise WLAN can successfully authenticate and maintain local data switching, while clients attempting to connect to the Guest WLAN are unable to authenticate or pass traffic.

Cevap

Clients on the Enterprise WLAN can successfully authenticate and maintain local data switching, while clients attempting to connect to the Guest WLAN are unable to authenticate or pass traffic.
In Cisco wireless architectures, FlexConnect APs in standalone mode maintain functionality for WLANs configured for local switching and local authentication. Because the Enterprise WLAN uses local switching and FlexConnect Local Authentication, clients on this SSID can continue to authenticate and forward traffic directly onto the local branch network. Conversely, WLANs configured for central switching rely on the CAPWAP data tunnel to the WLC; when WAN connectivity to the controller is lost, centrally switched WLANs like the Guest WLAN become completely disabled.

Adım Adım Çözüm

1
Analyze AP mode and controller connectivity state.
The lightweight APs are operating in FlexConnect mode and lose their CAPWAP connection to the centralized WLC, placing them in standalone mode.
FlexConnect APs are specifically designed for branch office deployments where WAN link loss to the WLC may occur.
2
Evaluate the behavior of the Enterprise WLAN.
Because the Enterprise WLAN is configured for local switching and FlexConnect Local Authentication, the AP handles 802.1X authentication and switches user traffic locally to the branch VLAN without requiring active WLC communication.
FlexConnect Local Authentication enables the AP or local RADIUS/FlexConnect Group to process authentication requests locally during WAN outages.
3
Evaluate the behavior of the Guest WLAN.
Because the Guest WLAN relies on central switching (CAPWAP data tunnel to WLC) and central authentication, it becomes completely non-functional when the CAPWAP tunnel is down.
Centrally switched traffic must traverse the CAPWAP data tunnel back to the WLC, which is impossible when WAN connectivity to the controller is disconnected.

Anahtar Kavram

Cisco FlexConnect AP Standalone Mode Operations and Local vs. Central Switching
Soru 14Soru →

A network technician is configuring a new Wireless LAN on a Cisco Wireless LAN Controller (WLC) using the web interface. The technician has created the WLAN profile, assigned the SSID, and selected the interface mapping under the General tab. However, access points are not broadcasting the new network and wireless clients cannot connect. Which checkbox under the WLANs > Edit 'General' tab must be selected to make the WLAN active and operational?

Cevabı ve açıklamayı göster

Cevap: Status

Cevap

The Status checkbox must be selected under the General tab to administratively enable the WLAN.
Newly created WLANs on a Cisco WLC are disabled by default. Under the General tab of the WLANs > Edit configuration page, checking the Status box (Enabled) is required to administratively activate the WLAN so that assigned Access Points can broadcast the SSID and process client association requests.

Adım Adım Çözüm

1
Navigate to the WLANs menu in the Cisco WLC GUI and click on the newly created WLAN ID.
The WLANs > Edit configuration screen appears showing the General tab.
This menu contains basic identity and status controls for the specific WLAN.
2
Locate the Status field on the General tab page.
The Status checkbox is unchecked by default upon WLAN creation.
Cisco WLC creates WLANs in an administratively disabled state to prevent broadcasting incomplete network settings.
3
Check the Status box to set it to Enabled and click Apply.
The WLAN state changes to Enabled and Access Points begin broadcasting the SSID.
Enabling Status activates the WLAN operational state across all assigned APs.

Anahtar Kavram

WLAN Administrative Enablement via WLC GUI
Soru 15Soru →

Refer to the following routing table output from a Cisco router:

Codes: C - connected, S - static, R - RIP, O - OSPF
Gateway of last resort is not set

10.0.0.0/8 is subnetted, 4 subnets
O 10.1.1.0/24 [110/20] via 192.168.1.2, 00:04:12, GigabitEthernet0/0
S 10.1.0.0/16 [1/0] via 192.168.1.1, GigabitEthernet0/1
O 10.1.1.128/25 [110/30] via 192.168.1.3, 00:02:15, GigabitEthernet0/2
S* 0.0.0.0/0 [1/0] via 192.168.1.254

When the router receives a packet destined for host 10.1.1.130, which next-hop IP address will the router use to forward the packet?

Cevabı ve açıklamayı göster

Cevap: 192.168.1.3

Cevap

The router will forward the packet to next-hop 192.168.1.3.
When a router makes a forwarding decision, it evaluates all routes in the routing table that cover the destination address and selects the one with the longest prefix mask (most specific match). Destination host 10.1.1.130 matches 10.1.0.0/16, 10.1.1.0/24, and 10.1.1.128/25. The route 10.1.1.128/25 is the most specific match with 25 matching bits, so the router forwards the packet to its next-hop IP address, 192.168.1.3.

Adım Adım Çözüm

1
Identify all matching routes for destination IP address 10.1.1.130.
Matching routes are 10.1.0.0/16, 10.1.1.0/24, 10.1.1.128/25, and 0.0.0.0/0.
10.1.1.130 falls within the range of 10.1.0.0–10.1.255.255 (/16), 10.1.1.0–10.1.1.255 (/24), 10.1.1.128–10.1.1.255 (/25), and default route.
2
Compare prefix lengths of all matching routes to determine the Longest Prefix Match (LPM).
10.1.1.128/25 has a 25-bit subnet mask, which is longer than /24, /16, and /0.
The router always prefers the route with the most specific (longest) prefix match before considering Administrative Distance or Metric.
3
Identify the next-hop address associated with the longest prefix match route.
The route 10.1.1.128/25 uses next-hop 192.168.1.3.
The forwarding table specifies via 192.168.1.3 for 10.1.1.128/25.

Anahtar Kavram

Longest Prefix Match (LPM) Rule
Tahmini Süre:1m 0s
Soru 16Soru →

Refer to the exhibit displaying an abbreviated routing table for router R1:

text
Gateway of last resort is 192.168.4.1 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 192.168.4.1, Serial0/0/0
S 10.1.1.0/24 [1/0] via 192.168.1.1, GigabitEthernet0/0
D 10.1.1.64/26 [90/307200] via 192.168.2.1, GigabitEthernet0/1
O 10.1.1.64/28 [110/20] via 192.168.3.1, GigabitEthernet0/2

Router R1 receives an IP packet addressed to destination host 10.1.1.6710.1.1.67. Which next-hop IP address and outbound interface will R1 use to forward this packet?

Cevabı ve açıklamayı göster

Cevap: 192.168.3.1 via GigabitEthernet0/2

Cevap

192.168.3.1 via GigabitEthernet0/2
When forwarding a packet, a router first evaluates all routes in its routing table to find matches for the destination IP address. If multiple routes match, the router strictly enforces the Longest Prefix Match (LPM) rule. For destination IP 10.1.1.67, matching prefixes are /24, /26, and /28. The /28 prefix (10.1.1.64/28) is the longest match. Therefore, R1 forwards the packet to next-hop 192.168.3.1 via interface GigabitEthernet0/2, completely ignoring Administrative Distance when prefix lengths differ.

Adım Adım Çözüm

1
Determine subnet ranges for matching routes in the routing table for destination IP 10.1.1.6710.1.1.67
The IP 10.1.1.6710.1.1.67 matches three specific routes: 10.1.1.0/24 (range .0 to .255), 10.1.1.64/26 (range .64 to .127), and 10.1.1.64/28 (range .64 to .79), as well as the default route 0.0.0.0/0.
Before comparing routing protocols or metrics, a router determines which routes encompass the destination IP address.
2
Compare matching prefix lengths to apply the Longest Prefix Match (LPM) rule
Prefix lengths are /24, /26, and /28. The /28 prefix length is the longest (most specific) match.
Cisco routers always prefer the route with the longest matching subnet mask (/28 > /26 > /24 > /0) regardless of Administrative Distance or Metric.
3
Identify the next-hop IP address and egress interface for the winning /28 route
The route `10.1.1.64/28` points to next-hop IP `192.168.3.1` out interface `GigabitEthernet0/2`.
The parameters associated with the longest prefix match determine the forwarding destination for the packet.

Anahtar Kavram

Router Forwarding Decision Logic & Longest Prefix Match (LPM)
Tahmini Süre:1m 30s
Soru 17Soru →

A network administrator configures a Cisco Catalyst switch running Rapid PVST+ with the command `spanning-tree vlan 50 priority 8192`. What total bridge priority value will this switch include in its outgoing Bridge Protocol Data Units (BPDUs) for VLAN 50?

Cevabı ve açıklamayı göster

Cevap: 82428242

Cevap

The total bridge priority included in BPDUs for VLAN 50 is 82428242.
In Cisco Rapid PVST+, the 16-bit Bridge Priority field is divided into a 4-bit configurable priority value (in increments of 4096) and a 12-bit System ID Extension representing the VLAN ID. When a base priority of 81928192 is configured for VLAN 50, the switch combines the base priority with the VLAN ID (8192+50=82428192 + 50 = 8242) to form the total bridge priority advertised in BPDUs.

Adım Adım Çözüm

1
Identify the base bridge priority configured on the switch.
The configured base bridge priority is 81928192.
The CLI command explicitly sets the base priority to 81928192.
2
Determine the System ID Extension for the specified VLAN.
The System ID Extension is equal to the VLAN ID, which is 5050.
Rapid PVST+ uses the 12-bit System ID Extension field to encode the VLAN number into the Bridge ID.
3
Calculate the total bridge priority advertised in BPDUs.
8192+50=82428192 + 50 = 8242.
Total Bridge Priority = Base Priority + System ID Extension.

Anahtar Kavram

Rapid PVST+ Bridge ID Structure and System ID Extension
Soru 18Soru →

An enterprise router has populated its IPv4 routing table with the following entries:

text
D 10.50.0.0/16 [90/2560512] via 10.1.1.1, 01:12:40, GigabitEthernet0/0
O 10.50.12.0/24 [110/20] via 10.1.1.2, 00:45:12, GigabitEthernet0/1
S 10.50.12.80/28 [1/0] via 10.1.1.3
S 10.50.12.80/29 [250/0] via 10.1.1.4

The router receives a packet with a destination IP address of 10.50.12.8510.50.12.85. Which next-hop IP address will the router select to forward this packet?

Cevabı ve açıklamayı göster

Cevap: 10.1.1.4

Cevap

10.1.1.4 via the longest prefix match route 10.50.12.80/29
When a router processes a packet destination address, it searches the routing table for all matching network prefixes and selects the route with the longest prefix length (most specific mask). The destination address 10.50.12.85 falls within the range 10.50.12.80 - 10.50.12.87 defined by 10.50.12.80/29. Because /29 is longer than /28, /24, and /16, the router forwards the packet using the next-hop 10.1.1.4 regardless of its high administrative distance value of 250.

Adım Adım Çözüm

1
Determine which routing table entries match the destination IP address 10.50.12.85.
All four entries (10.50.0.0/16, 10.50.12.0/24, 10.50.12.80/28, and 10.50.12.80/29) contain the IP address 10.50.12.85 within their subnet range.
10.50.12.80/29 spans 10.50.12.80 through 10.50.12.87, which includes 10.50.12.85.
2
Compare the prefix lengths (subnet masks) of all matching entries.
/29 is longer (more specific) than /28, /24, and /16.
Cisco routers use the Longest Prefix Match (LPM) rule as the primary criteria for forwarding decisions.
3
Identify the next-hop address associated with the longest matching prefix.
The route 10.50.12.80/29 points to next-hop 10.1.1.4.
Administrative distance is only evaluated when comparing routes with identical prefix lengths from different sources, not when selecting among matching routes of varying prefix lengths.

Anahtar Kavram

Longest Prefix Match (LPM) rule in IPv4 routing decision logic
Tahmini Süre:1m 15s
Soru 19Soru →

A network technician is adding a secondary path on Router-HQ to reach the internal subnet 172.16.40.0/24172.16.40.0/24. The primary link currently learns this destination via EIGRP with an administrative distance of 90. To ensure the secondary static path through next-hop IP 10.1.1.210.1.1.2 serves strictly as a backup when the primary link is down, which Cisco IOS command must be configured?

Cevabı ve açıklamayı göster

Cevap: ip route 172.16.40.0 255.255.255.0 10.1.1.2 100

Cevap

The command 'ip route 172.16.40.0 255.255.255.0 10.1.1.2 100' correctly configures a floating static route by specifying an administrative distance higher than the primary routing protocol.
A floating static route functions as a backup path by configuring an administrative distance (AD) higher than the primary active route's protocol. Since the primary route is learned via internal EIGRP (AD 90), assigning an AD of 100 to the static route keeps it out of the active routing table until the EIGRP path becomes unavailable.

Adım Adım Çözüm

1
Identify the primary route's Administrative Distance (AD)
EIGRP internal route has an AD of 90.
Floating static routes rely on AD values to determine precedence.
2
Determine the required AD for a floating static backup route
The floating static route must have an AD strictly greater than 90 (e.g., 100).
Lower administrative distances are preferred in the IP routing table.
3
Construct the Cisco IOS static route command syntax
'ip route <destination> <mask> <next-hop> [administrative-distance]'
Applying this syntax yields 'ip route 172.16.40.0 255.255.255.0 10.1.1.2 100'.

Anahtar Kavram

Floating Static Route Administrative Distance Calibration
Soru 20Soru →

A network administrator needs to establish out-of-band administrative access to a Cisco Wireless LAN Controller (WLC) for system maintenance. The out-of-band management network uses subnet 192.168.100.0/24192.168.100.0/24, which is completely isolated from production wireless client traffic and general infrastructure VLANs. Which physical interface and configuration method on the WLC should the administrator use to achieve this isolated management connection?

Cevabı ve açıklamayı göster

Cevap: Configure the physical Service Port with an IP address on the 192.168.100.0/24192.168.100.0/24 subnet, as it provides dedicated out-of-band management access and maintains a separate routing table.

Cevap

The Service Port should be configured with an IP address on the out-of-band network because it is physically isolated and maintains a distinct routing table from the main distribution system ports.
The Cisco WLC Service Port is specifically designed for out-of-band management. It operates independently from the controller's distribution system ports and maintains its own routing table, allowing network administrators to access the WLC GUI, SSH, or SNMP even if the production network or in-band interfaces are unreachable.

Adım Adım Çözüm

1
Identify the specific functional requirement from the scenario.
The requirement specifies completely isolated out-of-band management connectivity on subnet 192.168.100.0/24192.168.100.0/24.
Different Cisco WLC interfaces serve distinct roles (Management vs. Service Port vs. Dynamic vs. Virtual).
2
Evaluate the role of the WLC Service Port.
The Service Port is a 10/100/1000 Ethernet port dedicated solely to out-of-band management access (GUI/SSH/SNMP).
It operates outside the main data-plane distribution system trunk lines and uses a dedicated non-routable interface context.
3
Compare against in-band logical interfaces.
The Management Interface, Virtual Interface, and Dynamic Interfaces reside on distribution system ports and handle in-band traffic, client mapping, or mobility features.
Only the physical Service Port satisfies strict out-of-band isolation demands.

Anahtar Kavram

Cisco WLC Interface Types (Service Port vs. Management Interface)
Sayfa 1 / 51Sonraki
Tüm alıştırma soruları — Cisco CCNA | Examkin