Tüm alıştırma soruları

2237 soru

Soru 501Soru

A network engineer is configuring core IP addressing and discovery services for a newly integrated corporate site containing multiple VLANs. The site relies on a central DHCP cluster located in the main data center and uses specialized service location for VoIP unified communications. Which TWO of the following network service configurations must be implemented on the local network infrastructure to support these requirements?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Configure an IP helper address on each remote VLAN router interface pointing to the centralized DHCP server IP.; Create DNS SRV (Service) records specifying the hostname, port, and priority for unified communications servers.

Cevap

The correct configurations are configuring an IP helper address on each remote VLAN router interface pointing to the centralized DHCP server IP, and creating DNS SRV records specifying the hostname, port, and priority for unified communications servers.
The correct configurations involve implementing an IP helper address on each client VLAN default gateway to forward DHCP broadcasts across Layer 3 boundaries to the central server, and defining DNS SRV records to provide hostnames and port numbers for dynamic service location.

Adım Adım Çözüm

1
Analyze the DHCP relay requirement across routed subnets
Identified that client DHCP broadcast messages are dropped by Layer 3 boundaries.
An IP helper address (DHCP relay agent) must be configured on remote gateway interfaces to encapsulate DHCP broadcasts into unicast UDP packets destined for the central DHCP server.
2
Analyze service location requirements for network clients
Identified DNS SRV records as the standardized protocol location mechanism.
DNS SRV records publish both hostname and port information, enabling clients to locate specialized infrastructure services like VoIP or Active Directory controllers.
3
Evaluate and eliminate distractors based on protocol standards
Rejected A records for IPv6 (requires AAAA), incorrect DHCP relay placement, and incorrect NTP port assignment (NTP uses UDP 123, not 69).
Ensures complete technical accuracy across IPv6 DNS, DHCP architecture, and standard port mappings.

Anahtar Kavram

IP Addressing Services and Helper Configurations
Soru 502Soru

A network engineer is integrating a central IP Address Management (IPAM) system with existing DHCP and DNS infrastructure to automate IP provisioning for newly deployed IP phones. Which TWO of the following actions must be configured on the DHCP service to enable automatic IPAM tracking and direct the phones to their provisioning server?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Define vendor-specific DHCP option codes (such as Option 66 or Option 150) containing the IP address of the TFTP provisioning server.; Configure dynamic DNS (DDNS) update credentials and DHCP logging to feed active lease allocation data to the IPAM database.

Cevap

The correct configurations are defining vendor-specific DHCP option codes (such as Option 66 or Option 150) for provisioning server identification and enabling dynamic DNS updates alongside DHCP lease logging for IPAM synchronization.
Configuring DHCP options such as Option 66 or Option 150 allows DHCP servers to inform IP phones of the IP address or hostname of their provisioning server (such as TFTP). Simultaneously, enabling dynamic DNS (DDNS) integration and lease logging allows the central IPAM platform to ingest lease data continuously, keeping track of assigned IP addresses across subnets.

Adım Adım Çözüm

1
Identify the mechanism required to deliver TFTP provisioning server details to IP phones during DHCP negotiation.
Configuring specific DHCP options (Option 66 or Option 150) passes the TFTP server address directly to client phones during address assignment.
VoIP phones rely on standardized DHCP option fields in the DHCPACK payload to discover their boot file server automatically.
2
Identify how IPAM tracks active IP space and DNS mappings dynamically.
Integrating dynamic DNS (DDNS) update mechanisms and leveraging DHCP lease event logging allows the IPAM system to monitor active leases.
IPAM relies on API hooks, syslog/audit logs, or direct DDNS integrations from the DHCP server to maintain an accurate central inventory of active leases.

Anahtar Kavram

DHCP Options and IP Address Management Integration
Soru 503Soru

A network security engineer is defining stateful perimeter firewall rules to enforce infrastructure security baselines. Match each network protocol and operational scenario to its correct default transport protocol and port number.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Kerberos user authentication and ticket granting service requests
TACACS+ centralized administrative AAA communication for router management
IPsec Internet Key Exchange (IKE) Phase 1 tunnel negotiation
Trivial File Transfer Protocol (TFTP) bootstrap image provisioning

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Kerberos authentication pairs with TCP/UDP Port 88. TACACS+ router administration pairs with TCP Port 49. IPsec IKE tunnel negotiation pairs with UDP Port 500. TFTP bootstrap image provisioning pairs with UDP Port 69.
Matching each network operational service to its exact transport layer port requires recognizing protocol functions: Kerberos utilizes TCP/UDP port 88, TACACS+ utilizes TCP port 49, IPsec IKE utilizes UDP port 500, and TFTP utilizes UDP port 69.

Adım Adım Çözüm

1
Identify the primary transport requirements and default ports for directory/authentication services.
Kerberos requires port 88 over both TCP and UDP for domain authentication and key distribution.
Domain controllers listen on port 88 for ticket requests.
2
Differentiate administrative AAA security protocols by transport behavior and port assignments.
TACACS+ uses TCP port 49 for full packet encryption and reliable delivery, unlike RADIUS which uses UDP ports 1812/1813.
Cisco TACACS+ relies on TCP connection-oriented delivery to manage network hardware administration securely.
3
Determine the ISAKMP/IKE control plane port for IPsec VPN negotiation.
Internet Key Exchange (IKE) Phase 1 and Phase 2 negotiations initiate over UDP port 500.
VPN gateways exchange keying material using UDP port 500 prior to encapsulating data.
4
Identify the connectionless boot loading file transfer protocol port.
TFTP listens on UDP port 69 for initial download requests.
TFTP minimizes client memory overhead during network booting by leveraging UDP instead of TCP.

Anahtar Kavram

Core Administrative, Authentication, and Infrastructure Service Ports
Soru 504Soru

A workstation attached to switch Port 4 (assigned to VLAN 15) transmits a unicast frame intended for another host on the network. Upon receiving the frame, the switch inspects its MAC address table (CAM table) and finds no matching entry for the destination MAC address. Which action will the switch take to forward this frame?

Cevabı ve açıklamayı göster

Cevap: Flood the frame out all operational ports assigned to VLAN 15, except Port 4.

Cevap

The switch will flood the frame out all operational ports assigned to VLAN 15, excluding Port 4.
When a Layer 2 switch encounters a unicast frame with a destination MAC address not present in its CAM table, it treats the frame as an unknown unicast. The switch forwards a copy of the frame out every active port configured for that specific VLAN, excluding the port that received the frame, ensuring VLAN isolation is preserved.

Adım Adım Çözüm

1
Examine ingress port and source MAC address
The switch notes the ingress port (Port 4) and its assigned VLAN (VLAN 15), then updates its MAC address table with the source MAC address.
MAC address learning happens on ingress based on the source address of received frames.
2
Perform destination MAC address lookup in the CAM table
The destination MAC address is not found (unknown unicast).
Layer 2 switches rely on exact MAC table matches to forward frames out specific single ports.
3
Execute unknown unicast forwarding logic within the VLAN boundary
The frame is flooded to all active ports assigned to VLAN 15, except the port on which it arrived (Port 4).
Flooding ensures the frame reaches its intended recipient while strictly maintaining VLAN broadcast domain isolation.

Anahtar Kavram

Switch Unknown Unicast Flooding and VLAN Broadcast Domain Isolation
Tahmini Süre:1m 15s
Soru 505Soru

A network administrator is analyzing frame forwarding behavior on an enterprise Layer 2 switch. Port 5 is an access port assigned to VLAN 25. Port 24 is configured as an 802.1Q trunk port allowing VLANs 10, 25, and 50, with native VLAN set to VLAN 10. The switch receives an Ethernet frame on Port 5 with source MAC address 0011.2233.4455 and destination MAC address 0011.2233.9999. The switch's MAC address table currently contains no entry for destination MAC address 0011.2233.9999. Ports 1 through 10 are active access ports in VLAN 25, while Ports 11 through 20 are active access ports in VLAN 10. Which of the following actions will the switch take to process and forward this frame?

Cevabı ve açıklamayı göster

Cevap: Learns the source MAC address on Port 5 in VLAN 25, then floods the frame out active access ports assigned to VLAN 25 (except Port 5) and out Port 24 with an 802.1Q tag for VLAN 25.

Cevap

The switch updates its MAC address table with the source MAC address on Port 5 in VLAN 25, then floods the frame out all active access ports in VLAN 25 (excluding receiving Port 5) and transmits it over trunk Port 24 with an 802.1Q VLAN 25 header tag.
When a Layer 2 switch receives an Ethernet frame, it first learns the source MAC address and associates it with the ingress port and VLAN. It then checks its CAM table for the destination MAC address. Because the destination MAC address is not listed, the switch floods the frame out all active ports in the same VLAN (VLAN 25), excluding the port of arrival. When forwarding the frame out an 802.1Q trunk port, the switch inserts an 802.1Q tag specifying VLAN 25 because VLAN 25 is not the configured native VLAN.

Adım Adım Çözüm

1
Examine source MAC learning on ingress
The switch inspects the frame's source MAC address (0011.2233.4455) and maps it to Port 5 in the CAM table under VLAN 25.
Layer 2 switches build their MAC address table dynamically by inspecting source MAC addresses of incoming frames on their ingress ports.
2
Determine destination MAC forwarding lookup
The destination MAC (0011.2233.9999) is absent from the CAM table, triggering unknown unicast flooding within VLAN 25.
If a destination unicast MAC is unknown, the switch forwards the frame to all active ports participating in the same broadcast domain (VLAN), excluding the port on which the frame arrived.
3
Apply 802.1Q trunk tagging rules for egress on Port 24
The frame is forwarded out Port 24 with a VLAN 25 802.1Q header tag.
Port 24 is an 802.1Q trunk allowing VLAN 25. Because VLAN 10 is designated as the native VLAN, frames belonging to VLAN 25 must be explicitly tagged with their VLAN ID upon exiting the trunk interface.

Anahtar Kavram

Switch Frame Forwarding Logic and VLAN Tagging across 802.1Q Trunks
Tahmini Süre:2m 0s
Soru 506Soru

An enterprise network operations team is allocating IPv4 subnets from the parent block 172.31.192.0/19172.31.192.0/19 to provision Point-to-Point WAN links between datacenter locations. Each link requires a dedicated subnet configured with a /30/30 mask to connect two router interfaces. If the team provisions 4545 operational Point-to-Point link subnets sequentially starting from the lowest IP address of the parent block, what is the maximum number of additional /30/30 link subnets that can be created from the remaining unallocated space within this /19/19 block?

Cevabı ve açıklamayı göster

Cevap: 2003

Cevap

The maximum number of additional /30 link subnets that can be created from the remaining unallocated space is 2003.
The parent block has a prefix length of /19 and each link uses a /30 subnet mask. Subtracting the prefix lengths (3019=1130 - 19 = 11) gives 1111 subnet bits, which equals 211=20482^{11} = 2048 total possible /30 subnets within the /19 block. Subtracting the 45 already provisioned subnets leaves 204845=20032048 - 45 = 2003 unallocated /30 subnets.

Adım Adım Çözüm

1
Calculate the total number of /30 subnets available within a /19 parent block
2048 subnets
The prefix length difference between the child subnet (/30) and parent block (/19) is 3019=1130 - 19 = 11 bits. The total number of /30 subnets created is 211=20482^{11} = 2048.
2
Subtract the number of already allocated /30 subnets from the total available subnet capacity
2003 subnets
Subtracting the 4545 allocated subnets from the total capacity of 20482048 (204845=20032048 - 45 = 2003) yields the remaining unallocated /30 subnets.

Anahtar Kavram

Subnet allocation and capacity calculations using CIDR prefix length differences
Soru 507Soru

A network administrator is assigning a static IPv4 address to a server interface and needs to configure the appropriate subnet mask in dotted-decimal format. The network documentation specifies that the network segment uses a /25/25 CIDR prefix length. Which of the following dotted-decimal subnet masks corresponds to a /25/25 prefix?

Cevabı ve açıklamayı göster

Cevap: 255.255.255.128255.255.255.128

Cevap

The subnet mask corresponding to a /25/25 prefix length is 255.255.255.128255.255.255.128.
A /25/25 prefix length indicates that 25 bits are allocated to the network portion of the IPv4 address. The first three octets are fully masked (8+8+8=248 + 8 + 8 = 24 bits, giving 255.255.255255.255.255). The 25th bit is the first bit of the fourth octet (10000000210000000_2), which evaluates to 128128 in decimal. Therefore, the correct subnet mask is 255.255.255.128255.255.255.128.

Adım Adım Çözüm

1
Determine the distribution of network bits across the four octets for a /25/25 prefix length.
The first 24 bits occupy the first three octets (255.255.255255.255.255), leaving 1 network bit for the fourth octet.
An IPv4 address consists of 32 bits divided into four 8-bit octets.
2
Convert the 8-bit binary representation of the fourth octet to decimal.
Setting the most significant bit gives binary 10000000210000000_2, which equals 128128 in decimal.
The positional value of the highest bit in an 8-bit octet (272^7) is 128.
3
Combine all four octets into dotted-decimal notation.
The completed subnet mask is 255.255.255.128255.255.255.128.
Putting the binary octets (11111111.11111111.11111111.1000000011111111.11111111.11111111.10000000) into standard dotted-decimal formatting yields 255.255.255.128255.255.255.128.

Anahtar Kavram

Conversion of IPv4 CIDR prefix length to dotted-decimal subnet mask
Tahmini Süre:45s
Soru 508Soru

When a router receives an IP packet, it compares the destination address against multiple matching entries in its routing table. In what sequence does the router evaluate these routing criteria to select the single best path for forwarding?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct order of route selection evaluation is: 1. Longest Prefix Match, 2. Lowest Administrative Distance, 3. Lowest Metric.
Routers follow a strict hierarchy to determine the best path. First, the router checks for the longest prefix match to find the most specific network destination. If multiple candidate routes share the exact same prefix length, the router compares administrative distance to select the most reliable routing source. Finally, if routes originate from the same protocol and prefix length, the router uses the metric to break the tie.

Adım Adım Çözüm

1
Evaluate subnet mask specificity
The router selects the entry with the longest network prefix (most specific subnet mask).
Longest prefix match always takes precedence over administrative distance and metrics.
2
Compare administrative distance if prefix lengths are equal
The router selects the route coming from the source with the lower administrative distance.
Administrative distance measures the trustworthiness of the routing protocol or static route source.
3
Compare routing metric if route sources are identical
The router selects the path with the lowest metric value (e.g., hop count, cost, or bandwidth).
Metric is used to compare multiple paths learned within the exact same dynamic routing protocol.

Anahtar Kavram

Route Selection Order of Precedence
Soru 509Soru

Match each application layer protocol to its corresponding default port number and transport protocol specification.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

HTTPS
RDP
DNS
IMAP

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

HTTPS matches TCP Port 443, RDP matches TCP Port 3389, DNS matches UDP/TCP Port 53, and IMAP matches TCP Port 143.
HTTPS maps directly to TCP Port 443 for secure web communication. RDP maps to TCP Port 3389 for remote desktop access. DNS maps to UDP/TCP Port 53 for hostname-to-IP resolution. IMAP maps to TCP Port 143 for mailbox management and message retrieval.

Adım Adım Çözüm

1
Identify the standard service port for secure web browsing (HTTPS).
HTTPS uses TCP port 443.
Encrypted web traffic using TLS/SSL communicates by default over TCP 443.
2
Identify the standard service port for Microsoft Remote Desktop Protocol (RDP).
RDP uses TCP port 3389.
Remote management sessions using RDP listen on TCP port 3389.
3
Identify the service port for domain name resolution services (DNS).
DNS uses UDP/TCP port 53.
DNS relies primarily on UDP port 53 for lightweight queries and TCP port 53 for zone transfers or responses over 512 bytes.
4
Identify the standard unencrypted port for email retrieval via IMAP.
IMAP uses TCP port 143.
Standard IMAP mail access operates over TCP port 143.

Anahtar Kavram

Well-Known Transport Layer Ports and Service Mappings
Tahmini Süre:45s
Soru 510Soru

Which of the following operational features are primary characteristics of link-state routing protocols, such as OSPF? (Select TWO)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Routers build a complete topology database representing the map of the network area.; Routers exchange triggered updates known as Link-State Advertisements (LSAs) when network changes occur.

Cevap

The primary operational characteristics of link-state routing protocols are building a complete network area topology map and issuing triggered Link-State Advertisements (LSAs) upon network changes.
Link-state dynamic routing protocols function by giving every participating router full visibility into the area topology database and communicating state changes immediately via triggered Link-State Advertisements (LSAs).

Adım Adım Çözüm

1
Analyze protocol operational mechanics for link-state dynamic routing.
Link-state protocols maintain full topology awareness across a routing area and update peers using event-driven LSAs.
Link-state algorithms require routers to know the complete graph of the network before running the Shortest Path First (SPF) calculation.
2
Differentiate link-state characteristics from distance-vector mechanisms.
Periodic full-table updates and strict hop-count metrics belong to distance-vector protocols.
Distance-vector routers route 'by rumor' without a complete topology map, relying on neighbor periodic announcements and hop counts.

Anahtar Kavram

Link-State Routing Protocol Operational Characteristics
Soru 511Soru

A network technician is deploying an enterprise log management application that collects audit logs from remote branch routers across a WAN. Due to strict compliance requirements, every log entry must be delivered reliably and assembled in the exact order it was generated. Which transport layer protocol behavior explains why TCP is selected over UDP for this implementation?

Cevabı ve açıklamayı göster

Cevap: TCP establishes a formal session using a three-way handshake and guarantees ordered delivery via sequence numbers and acknowledgments.

Cevap

TCP establishes a formal session using a three-way handshake and guarantees ordered delivery via sequence numbers and acknowledgments.
TCP (Transmission Control Protocol) is a connection-oriented Layer 4 protocol. It establishes a session before transmitting data using a three-way handshake (SYN, SYN-ACK, ACK) and ensures data integrity and sequencing through sequence numbers, acknowledgment receipts, and packet retransmissions.

Adım Adım Çözüm

1
Identify the application requirements from the scenario.
The application requires reliable, guaranteed delivery and strict sequential order for data segments.
Security audit logs must not omit entries or misorder events.
2
Compare TCP and UDP capabilities against these requirements.
TCP provides connection-oriented reliability through a three-way handshake (SYN, SYN-ACK, ACK), sequence numbering, flow control, and retransmissions.
UDP is connectionless, best-effort, and lacks sequence numbering or built-in retransmissions.
3
Select the option that correctly describes TCP's connection-oriented mechanisms.
The choice detailing the three-way handshake, sequence numbers, and acknowledgments accurately identifies TCP functionality.
This behavior guarantees the reliability and ordering required by the application.

Anahtar Kavram

Connection-Oriented vs Connectionless Protocol Characteristics
Soru 512Soru

While analyzing network traffic from a workstation connected to a managed switch, a technician identifies data units formatted with physical source and destination addresses, along with a Frame Check Sequence (FCS) field added to detect transmission errors before passing the data to the physical medium. Which layer of the OSI model is responsible for performing media access control and appending this trailer?

Cevabı ve açıklamayı göster

Cevap: Data Link Layer

Cevap

Data Link Layer
The correct answer is the Data Link Layer because Layer 2 of the OSI model operates on frames. It uses Media Access Control (MAC) addresses for local node-to-node delivery and appends a trailer containing the Frame Check Sequence (FCS) to verify frame integrity over the physical link.

Adım Adım Çözüm

1
Identify the key components described in the scenario
The scenario mentions physical MAC addresses, media access control, and a Frame Check Sequence (FCS) trailer added for error detection.
Recognizing the specific Protocol Data Unit (PDU) structures and helper fields isolates which layer creates and manages these fields.
2
Map the identified functions to the corresponding OSI layer
Structuring payload data into frames with hardware MAC addresses and appending CRC/FCS trailers occurs at Layer 2.
Layer 2 (Data Link) is explicitly split into the Logical Link Control (LLC) and Media Access Control (MAC) sublayers responsible for frame encapsulation and error detection.

Anahtar Kavram

Data Link Layer (Layer 2) encapsulation, MAC addressing, and frame error checking via FCS
Soru 513Soru

A packet capture utility running on a web server records an incoming frame during an active TCP session. As the operating system network stack processes this frame during inbound de-encapsulation, which sequence accurately details the order of header removal and identifies the exact Protocol Data Unit (PDU) passed directly from Network layer (Layer 3) processing up to Transport layer (Layer 4) processing?

Cevabı ve açıklamayı göster

Cevap: The Ethernet frame header and trailer are removed at Layer 2, delivering an IP packet payload to Layer 3; Layer 3 then validates and strips the IP header, delivering a TCP segment to Layer 4.

Cevap

The Ethernet frame header and trailer are removed at Layer 2, delivering an IP packet payload to Layer 3; Layer 3 then validates and strips the IP header, delivering a TCP segment to Layer 4.
During inbound de-encapsulation, headers are stripped sequentially from lower layers to higher layers. The host NIC operates at Layer 2, checking the Frame Check Sequence (FCS) trailer and stripping the Ethernet header/trailer. The remaining payload is an IP packet, which is handed to Layer 3. The Network layer validates IP protocol information, strips the IP header, and passes the contained TCP segment up to Layer 4 for port processing.

Adım Adım Çözüm

1
Analyze incoming frame processing at Layer 2 (Data Link layer).
The network interface card (NIC) receives the bitstream, verifies the Frame Check Sequence (FCS) trailer, and strips the Ethernet header and trailer.
De-encapsulation starts at the bottom of the OSI stack, unwrapping Layer 2 framing components.
2
Identify the PDU passed from Layer 2 to Layer 3 (Network layer).
The payload delivered to Layer 3 is an IP packet.
Removing Layer 2 headers reveals the Network layer PDU, which is an IP packet.
3
Analyze Layer 3 IP header processing and delivery to Layer 4 (Transport layer).
Layer 3 verifies IP addressing, strips the IP header, and passes the remaining payload—a TCP segment—up to Layer 4.
Stripping the IP header exposes the Transport layer PDU, which for TCP traffic is designated as a segment.

Anahtar Kavram

Inbound De-encapsulation and Layered PDU Terminology
Tahmini Süre:1m 30s
Soru 514Soru

A network engineer is designing a infrastructure layout for a new satellite clinic that connects to a main regional hospital. Workstations inside the clinic connect to central Ethernet switches in a local communications closet, while high-performance imaging servers require dedicated block-level storage over a Fibre Channel fabric. To reach the main hospital across town, the facility utilizes a leased point-to-multipoint service from a telecommunications provider. Which of the following statements correctly describe the topologies and network types implemented in this architecture? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: The workstation infrastructure utilizes a physical star topology where individual link outages are isolated to single connected hosts.; The dedicated imaging server storage infrastructure is classified as a Storage Area Network (SAN).

Cevap

The correct statements are that the workstation infrastructure uses a physical star topology where individual link outages affect only single nodes, and that the imaging server storage infrastructure is classified as a Storage Area Network (SAN).
The local network layout features a physical star topology where end devices independently attach to a central switch, containing cabling faults to single nodes. Additionally, the dedicated Fibre Channel network delivering block-level storage to servers is the definition of a Storage Area Network (SAN).

Adım Adım Çözüm

1
Analyze the local workstation cabling layout.
Connecting workstations to central Ethernet switches forms a physical star topology, which isolates physical media failures to individual devices.
Star topologies centralize node connections to a central device, preventing single point-of-failure line breaks from taking down the whole network.
2
Analyze the storage network architecture.
High-performance block-level access using Fibre Channel is defined as a Storage Area Network (SAN).
SANs provide dedicated high-speed block-level data access to consolidated storage resources separate from the general LAN.
3
Evaluate the VLAN and wide-area connectivity claims.
VLAN inter-communication requires Layer 3 processing, and city-spanning links represent MAN/WAN connections rather than CANs.
VLAN boundaries enforce Layer 2 isolation, and geographic networks crossing public rights-of-way fall under MAN or WAN classifications.

Anahtar Kavram

Physical Star Topologies and Storage Area Networks (SAN)
Soru 515Soru

A network engineer is auditing Layer 2 forwarding operations, frame encapsulation rules, and switch security configurations on an enterprise switch stack. Match each switching concept or feature on the left with its precise operational behavior on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

IEEE 802.1Q Native VLAN Processing
CAM Table Entry Aging Expiration
Port Security in Sticky MAC Mode
PVST+ System ID Extension

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

IEEE 802.1Q Native VLAN Processing matches with untagged ingress frame assignment and untagged egress trunk transmission. CAM Table Entry Aging Expiration matches with unknown unicast flooding out all same-VLAN ports except ingress. Port Security in Sticky MAC Mode matches with writing dynamically learned MAC addresses to the running configuration. PVST+ System ID Extension matches with embedding the 12-bit VLAN ID into the Bridge Priority field.
Each concept correctly matches its underlying Layer 2 mechanism: 802.1Q Native VLAN handles untagged frame forwarding across trunk links; CAM Table Expiration forces unknown unicast flooding within the VLAN boundary upon lookup misses; Sticky MAC Port Security writes dynamic MACs to running-config; and the PVST+ System ID Extension embeds the 12-bit VLAN identifier directly into the 16-bit Bridge Priority structure.

Adım Adım Çözüm

1
Analyze trunk port frame encapsulation mechanisms for 802.1Q native VLANs.
Identify that 802.1Q trunks do not tag frames originating from or destined to the native VLAN, leaving ingress/egress native VLAN frames untagged.
Backward compatibility with legacy non-tagging devices requires untagged frame processing on native VLANs.
2
Evaluate MAC address table aging behavior when a host goes silent.
Determine that CAM aging deletes unused entries, forcing the switch to treat subsequent traffic to that host as unknown unicast.
When a destination MAC address is missing from the switch lookup table, Layer 2 forwarding rules require flooding the frame across the local broadcast domain.
3
Differentiate between static, dynamic, and sticky port security configurations.
Confirm sticky learning automatically converts dynamic MAC address observations into saved running configuration lines.
Sticky MAC security eliminates manual static MAC entry while preventing unauthorized hardware swaps.
4
Examine PVST+ Spanning Tree Bridge ID structure.
Match the System ID Extension to the 12-bit VLAN ID field appended to the configurable bridge priority value.
PVST+ requires each VLAN to maintain an independent STP instance with a unique Bridge Identifier.

Anahtar Kavram

Layer 2 Switching Concepts, VLAN Encapsulation, Forwarding Tables, and Spanning Tree Architecture
Soru 516Soru

A database server receives an incoming SQL query sent over an Ethernet network from a remote application server. Place the following processing and de-encapsulation steps in the correct sequential order from initial frame reception at the physical layer to final payload consumption by the database application daemon.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct de-encapsulation sequence proceeds bottom-up through the protocol stack: Layer 2 frame verification and Ethernet header stripping, Layer 3 IP header verification and removal, Layer 4 TCP port inspection, Layer 4 stream reassembly, and finally Layer 7 application parsing.
De-encapsulation requires a host network stack to process inbound data from the bottom of the OSI model to the top. The physical hardware first receives the frame, validates the Frame Check Sequence (FCS), and removes the Layer 2 Ethernet header. The underlying IP packet is passed to Layer 3, where destination IP address validity and Time to Live (TTL) are checked before stripping the IP header. The remaining Layer 4 TCP segment's header is parsed to match the destination port to an active socket, and out-of-order segments are reassembled. Finally, the raw payload is presented to the Layer 7 database engine for SQL parsing.

Adım Adım Çözüm

1
Process incoming physical signal at Layer 2
Network Interface Card checks FCS CRC, confirms MAC address match, and strips the Ethernet header/trailer.
Data Link layer headers envelope the packet on physical media and must be parsed first by network hardware.
2
Process network addressing at Layer 3
IP stack verifies destination IP, decrementing TTL, and removes the IP header.
Network layer protocol headers (IPv4/IPv6) enclose the transport segment and are stripped once host delivery is confirmed.
3
Inspect transport protocol metadata at Layer 4
OS inspects TCP flags, destination port number (e.g., port 3306 or 5432), and checksum.
Transport layer headers dictate socket mapping and segment order.
4
Reassemble TCP payload segments
Out-of-order or fragmented segments are ordered into a contiguous stream in the socket buffer.
TCP must present a reliable stream to the application layer prior to higher-level parsing.
5
Deliver payload to Layer 7 Application
Database process reads the plain SQL text payload from the socket buffer.
Application layer receives raw unencapsulated user payload after all lower-layer control headers have been stripped.

Anahtar Kavram

De-encapsulation order on receiving hosts
Tahmini Süre:2m 0s
Soru 517Soru

Match each VLAN configuration or 802.1Q trunking component on the left with its correct operational description on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Access Port
Trunk Port
Native VLAN
802.1Q Header

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

Access Port matches 'Carries traffic for a single assigned VLAN and connects directly to end-user devices.', Trunk Port matches 'Carries traffic for multiple VLANs across a single physical link using frame encapsulation.', Native VLAN matches 'Transmits and receives untagged frame traffic across an 802.1Q trunk link.', and 802.1Q Header matches 'Inserts a 4-byte field into the Ethernet frame containing a 12-bit VLAN ID (VID)'.
Each VLAN term corresponds directly to its standard IEEE 802.1Q definition: Access ports connect single-VLAN end devices, trunk ports transport multi-VLAN traffic across switches, native VLANs process untagged frames on a trunk, and 802.1Q headers insert 4 bytes of tagging information containing the VLAN ID.

Adım Adım Çözüm

1
Identify the role of an Access Port
Connects end-user devices and carries traffic for only one assigned VLAN.
Access ports strip tags before forwarding traffic to host endpoints.
2
Identify the role of a Trunk Port
Carries traffic from multiple VLANs between switches or switches and routers.
Trunks allow multiple logical networks to share a single physical cabling interface.
3
Identify the purpose of the Native VLAN
Manages untagged frame transmission over 802.1Q trunk connections.
By default, 802.1Q trunk links process untagged frames on the assigned native VLAN.
4
Identify the function of the 802.1Q Header
Inserts a 4-byte tag into the Ethernet frame specifying the 12-bit VLAN ID.
Frame tagging allows receiving switch ports to identify which VLAN the frame belongs to.

Anahtar Kavram

VLAN Trunking and 802.1Q Tagging Basics
Soru 518Soru

A network security administrator is configuring internal perimeter firewall rules to enforce compliance for user directory queries between web application servers and a central domain controller. Company policy mandates that all authentication requests across network segments must be cryptographically encrypted over SSL/TLS, and cleartext directory protocol traffic must be dropped. Which of the following port and transport protocol combinations must be explicitly permitted on the firewall to allow compliant directory services traffic?

Cevabı ve açıklamayı göster

Cevap: TCP port 636

Cevap

TCP port 636 must be permitted on the firewall to allow encrypted LDAP (LDAPS) traffic.
Lightweight Directory Access Protocol Secure (LDAPS) uses TCP port 636 to establish an encrypted TLS/SSL tunnel for directory queries and user authentication. This satisfies the requirement to encrypt all identity queries and block unencrypted traffic.

Adım Adım Çözüm

1
Identify the service and security requirements
The scenario requires directory access services (LDAP family) protected by SSL/TLS encryption.
Compliance policy mandates encrypted authentication queries and prohibits cleartext directory communications.
2
Differentiate unencrypted vs. encrypted directory port assignments
Standard cleartext LDAP uses TCP port 389, while Lightweight Directory Access Protocol Secure (LDAPS) uses TCP port 636.
Port 636 is the default port reserved for LDAP session negotiations wrapped within TLS/SSL.
3
Determine the appropriate transport layer protocol
TCP is selected over UDP because TLS/SSL encryption handshakes require reliable, connection-oriented communication.
Connection-oriented TCP guarantees packet delivery and state tracking required for secure session management.

Anahtar Kavram

Lightweight Directory Access Protocol Secure (LDAPS) Port and Transport Identification
Tahmini Süre:1m 30s
Soru 519Soru

A workstation sends an HTTP request to a remote server. Arrange the following steps of the top-down data encapsulation process in the correct sequential order from the generation of user data down to line transmission.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct encapsulation order flows top-down: Application payload formatting, Transport layer port headers (Segment), Network layer IP addressing (Packet), Data Link layer MAC framing and FCS (Frame), and Physical layer bit signaling.
Encapsulation processes data top-down through the OSI model stack: Application layer formats payload -> Transport layer appends TCP/UDP headers (creating segments) -> Network layer adds IP headers (creating packets) -> Data Link layer appends MAC headers and FCS trailers (creating frames) -> Physical layer converts bits into signals for physical media transmission.

Adım Adım Çözüm

1
Identify the initiating layer
Data originates at the Application Layer (Layer 7).
Top-down encapsulation starts with application data formatting.
2
Add Layer 4 Transport header
Creates a Segment with source and destination ports.
Transport protocols (such as TCP/UDP) manage process-to-process communication.
3
Add Layer 3 Network header
Creates a Packet with source and destination IP addresses.
Network protocols (IP) provide logical host-to-host addressing across network boundaries.
4
Add Layer 2 Data Link header and trailer
Creates a Frame with MAC addresses and FCS.
Data Link framing enables node-to-node transfer on the local medium and error detection.
5
Process at Layer 1 Physical layer
Converts binary data into signals for physical transmission.
Physical layer transmits raw bits as pulses across media.

Anahtar Kavram

OSI Data Encapsulation Order
Soru 520Soru

A network administrator is configuring an 802.1Q trunk connection between two switches. Devices on tagged VLANs communicate normally across the link, but untagged traffic sent from one switch arrives on an unexpected VLAN on the opposite switch. Which misconfiguration is the primary cause of this issue?

Cevabı ve açıklamayı göster

Cevap: A native VLAN mismatch exists between the trunk interfaces on the two switches.

Cevap

A native VLAN mismatch exists between the trunk interfaces on the two switches.
The correct answer correctly identifies a native VLAN mismatch. Under the IEEE 802.1Q trunking specification, untagged frames transmitted across a trunk link belong to the sending switch's native VLAN. When received, the neighboring switch assigns those untagged frames to its own configured native VLAN. If these VLAN IDs differ between switches, traffic leaks from one VLAN into another without routing.

Adım Adım Çözüm

1
Analyze trunk traffic behavior
Tagged traffic passes correctly, but untagged traffic is received on an unexpected VLAN.
802.1Q trunks transport tagged frames with an explicit 4-byte VLAN tag header, while untagged frames are implicitly assigned to the native VLAN configured on the receiving interface.
2
Identify the role of the Native VLAN
Recognize that mismatched native VLAN configurations cause untagged frame leakage.
If Switch-1 uses Native VLAN 10 and Switch-2 uses Native VLAN 20, untagged frames sent by Switch-1 will be interpreted as VLAN 20 traffic upon arrival at Switch-2.

Anahtar Kavram

802.1Q Native VLAN Operation
Tahmini Süre:45s
ÖncekiSayfa 26 / 112Sonraki
Tüm alıştırma soruları — CompTIA Network+ | Examkin