Network Implementation

424 soru

Soru 241Soru

A network engineer is configuring a static host entry on a datacenter firewall for a server deployed on the IPv6 subnet 2001:db8:cafe:10::/642001:\text{db8}:\text{cafe}:10::/64. The server interface uses the MAC address 00:50:56:A1:B2:C300:50:56:\text{A1}:\text{B2}:\text{C3} and generates its host portion automatically via the IEEE EUI-64 mechanism. Which of the following represents the fully compliant RFC 5952 IPv6 global unicast address for this server?

Cevabı ve açıklamayı göster

Cevap: 2001:db8:cafe:10:250:56ff:fea1:b2c3

Cevap

The correct IPv6 address is 2001:db8:cafe:10:250:56ff:fea1:b2c3.
To construct an EUI-64 IPv6 interface identifier from a MAC address (00:50:56:A1:B2:C3), insert FF:FE into the middle (00:50:56:FF:FE:A1:B2:C3) and invert the 7th bit of the first byte (0x00 becomes 0x02). Grouping into 16-bit hextets yields 0250:56ff:fea1:b2c3. Appending this to the subnet prefix 2001:db8:cafe:10::/64 gives 2001:0db8:cafe:0010:0250:56ff:fea1:b2c3. Applying RFC 5952 rules suppresses leading zeros in each hextet (0db8 -> db8, 0010 -> 10, 0250 -> 250), producing 2001:db8:cafe:10:250:56ff:fea1:b2c3.

Adım Adım Çözüm

1
Split the MAC address into two 24-bit halves and insert the hex value FF:FE in the middle.
The MAC address 00:50:56:A1:B2:C3 becomes 00:50:56:FF:FE:A1:B2:C3.
EUI-64 requires expanding a 48-bit MAC address into a 64-bit interface identifier by inserting 16 specific bits (FF:FE).
2
Invert the 7th bit (Universal/Local bit) of the first byte.
The first byte 0x00 (binary 00000000) becomes 0x02 (binary 00000010). The expanded address becomes 0250:56ff:fea1:b2c3.
IEEE EUI-64 specifies that the Universal/Local bit must be inverted (0 for universally administered MAC addresses changed to 1 for local scope representation).
3
Combine the network prefix 2001:db8:cafe:10::/64 with the calculated 64-bit interface ID.
Uncompressed full address: 2001:0db8:cafe:0010:0250:56ff:fea1:b2c3.
The first 64 bits represent the network prefix and subnet, and the last 64 bits represent the host interface identifier.
4
Apply RFC 5952 address compression rules.
2001:db8:cafe:10:250:56ff:fea1:b2c3.
Leading zeros in each hextet must be suppressed (0db8 -> db8, 0010 -> 10, 0250 -> 250). The double colon (::) is not used when no hextet consists entirely of zeros.

Anahtar Kavram

EUI-64 Interface Identifier Generation and RFC 5952 Address Compression
Tahmini Süre:2m 0s
Soru 242Soru

A network administrator is publishing DNS records for a newly deployed corporate service. The domain requires web clients to resolve `www.example.com` to the IPv4 address `192.0.2.50`, and incoming domain email must be routed to `mail.example.com`.

Which TWO of the following DNS resource record types must be configured to achieve this functionality?

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: An A record pointing www.example.com to 192.0.2.50; An MX record specifying mail.example.com as the mail exchanger

Cevap

The configuration requires an A record to map the website hostname to its IPv4 address and an MX record to specify the mail gateway handling domain email.
An Address (A) record is required to map the web server hostname to its 32-bit IPv4 address. A Mail Exchanger (MX) record is required to specify the mail server responsible for accepting incoming email on behalf of the domain.

Adım Adım Çözüm

1
Identify the IPv4 address mapping requirement for the web server hostname.
Recognize that mapping a hostname (`www.example.com`) to a 32-bit IPv4 address (`192.0.2.50`) requires an Address (A) record.
Standard forward IPv4 resolution in DNS uses A records.
2
Identify the email routing requirement for the domain.
Recognize that designating a mail server (`mail.example.com`) to receive email for the domain requires a Mail Exchanger (MX) record.
Simple Mail Transfer Protocol (SMTP) servers query MX records to determine destination mail handlers.

Anahtar Kavram

DNS Host (A) and Mail Exchanger (MX) Record Functions
Tahmini Süre:1m 0s
Soru 243Soru

A network administrator is evaluating dynamic routing protocol behaviors for a campus network infrastructure. Which of the following operational features specifically characterize Open Shortest Path First (OSPF) as a link-state routing protocol? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: It constructs a complete topological database of the network area by flooding Link-State Advertisements (LSAs).; It executes Dijkstra's Shortest Path First (SPF) algorithm to calculate the shortest path tree to destination networks.

Cevap

The correct characteristics of OSPF as a link-state routing protocol are constructing a complete topological database via Link-State Advertisements (LSAs) and executing Dijkstra's Shortest Path First (SPF) algorithm to determine optimal paths.
The correct options accurately describe how link-state routing protocols function. OSPF routers flood Link-State Advertisements (LSAs) to build a synchronized topological map (LSDB) of the area, and each router independently runs Dijkstra's Shortest Path First (SPF) algorithm on this map to identify the shortest path to each destination network.

Adım Adım Çözüm

1
Identify the fundamental mechanics of link-state routing protocols.
Link-state protocols require routers to advertise the state of their directly connected links to all routers within an area.
Flooding LSAs enables every router in the area to maintain an identical Link-State Database (LSDB).
2
Determine how link-state protocols compute optimal routes from the topology map.
Each router independently runs Dijkstra's SPF algorithm using the LSDB as the topology map.
This builds a shortest-path tree rooted at the local router to compute loop-free routes to every network prefix.
3
Evaluate and discard distractor statements that misattribute OSI layer operations or NAT mechanisms.
Discard the statements regarding Layer 2 frame encapsulation and IP address/port translation.
OSPF relies on IP Layer 3 encapsulation (protocol 89), and IP/port translation is an edge NAT feature rather than a dynamic routing mechanism.

Anahtar Kavram

Link-State Routing Protocol Mechanics (OSPF LSDB and SPF Algorithm)
Soru 244Soru

A network technician is troubleshooting an inter-switch connectivity issue. Host PC-A (IP address 192.168.10.15/24) connected to switch SW-EDGE-01 in VLAN 10 cannot communicate with Host PC-B (IP address 192.168.10.25/24) connected to switch SW-EDGE-02 in VLAN 10. The two switches are interconnected via an 802.1Q trunk link on interface GigabitEthernet0/24.

Upon inspecting interface GigabitEthernet0/24 on SW-EDGE-01, the technician reviews the following command output:

SW-EDGE-01# show interfaces gigabitethernet0/24 switchport
Name: Gi0/24
Administrative Mode: trunk
Operational Mode: trunk
Administrative Trunking Encapsulation: dot1q
Operational Trunking Encapsulation: dot1q
Negotiation of Trunking: On
Access Mode VLAN: 1 (default)
Trunking Native Mode VLAN: 1 (default)
Administrative Native VLAN tagging: disabled
Voice VLAN: none
Administrative Mode VLANs Allowed: 1-9,11-4094

Which of the following configuration commands on interface GigabitEthernet0/24 of SW-EDGE-01 will resolve the communication failure between PC-A and PC-B?

Cevabı ve açıklamayı göster

Cevap: `switchport trunk allowed vlan add 10`

Cevap

Executing `switchport trunk allowed vlan add 10` on interface GigabitEthernet0/24 appends VLAN 10 to the allowed list, enabling VLAN 10 traffic to traverse the trunk link.
The output demonstrates that interface GigabitEthernet0/24 has an administrative allowed VLAN list of `1-9,11-4094`. Because VLAN 10 is excluded from this list, switch SW-EDGE-01 prunes all ingress and egress frames belonging to VLAN 10 on this trunk interface. Executing the command `switchport trunk allowed vlan add 10` explicitly appends VLAN 10 to the permitted range, allowing traffic between PC-A and PC-B to pass across the switch link.

Adım Adım Çözüm

1
Analyze the output of `show interfaces gigabitethernet0/24 switchport`.
The parameter `Administrative Mode VLANs Allowed` is set to `1-9,11-4094`.
VLAN 10 is omitted from the allowed range, causing the switch to drop all tagged frames for VLAN 10 arriving at or departing from interface GigabitEthernet0/24.
2
Determine the corrective Cisco IOS switchport configuration command.
Using `switchport trunk allowed vlan add 10` modifies the trunk filter to permit VLAN 10 frames.
Using the `add` keyword ensures that VLAN 10 is appended to the current list of allowed VLANs without replacing the existing list.

Anahtar Kavram

802.1Q Trunk Allowed VLAN List Pruning and Configuration
Tahmini Süre:1m 15s
Soru 245Soru

An enterprise network contains multiple subnets connected through a core Layer 3 switch. Hosts on VLAN 50 (10.50.0.0/2310.50.0.0/23) fail to acquire IPv4 address leases from the centralized DHCP server located on VLAN 10 (192.168.1.100192.168.1.100). A network technician verifies that the DHCP server is operational and reachable via ICMP from the core switch. Where must the `ip helper-address 192.168.1.100` command be configured on the Layer 3 switch to enable DHCP relay functionality for the client hosts?

Cevabı ve açıklamayı göster

Cevap: On the Switch Virtual Interface (SVI) for VLAN 50

Cevap

The helper address command must be configured on the Switch Virtual Interface (SVI) for VLAN 50.
DHCP relay agents must be configured on the ingress Layer 3 interface (default gateway) of the subnet where client hosts reside. In this scenario, hosts on VLAN 50 send broadcast DHCP requests to their gateway (VLAN 50 SVI). Placing `ip helper-address 192.168.1.100` on the VLAN 50 SVI instructs the switch to convert those broadcast UDP port 67 packets into unicast traffic directed to the remote DHCP server at 192.168.1.100192.168.1.100.

Adım Adım Çözüm

1
Identify the ingress layer 3 boundary for client broadcast traffic.
Client hosts on VLAN 50 transmit DHCPDISCOVER packets as layer 2 broadcasts (255.255.255.255255.255.255.255), which are restricted to VLAN 50.
Layer 3 boundaries block broadcast traffic by default.
2
Determine the interface requiring DHCP relay agent capabilities.
The gateway interface for VLAN 50 (SVI for VLAN 50) must receive the broadcast and convert it to a unicast DHCPDISCOVER packet sent to 192.168.1.100192.168.1.100.
The IP helper address must be enabled on the specific interface receiving the client's local broadcast.
3
Verify protocol and port operation.
The relay agent listens for UDP port 67 client requests on VLAN 50 SVI and populates the `giaddr` field with 10.50.0.110.50.0.1 before unicasting the packet to the server.
The server uses `giaddr` to assign an IP address from the correct pool (10.50.0.0/2310.50.0.0/23).

Anahtar Kavram

DHCP Relay Agent Interface Placement
Tahmini Süre:1m 30s
Soru 246Soru

An organization is configuring a core router that has multiple active routing protocols running simultaneously. The router receives two competing routes for the destination network 192.168.50.0/24. The first route is learned via OSPF with a metric of 45. The second route is learned via EIGRP (Internal) with a metric of 156800. Assuming default administrative distance values are used, which path will the router select for traffic destined to 192.168.50.0/24?

Cevabı ve açıklamayı göster

Cevap: The route learned via EIGRP, because internal EIGRP has a lower administrative distance than OSPF.

Cevap

The router will select the route learned via EIGRP because its default Administrative Distance (90) is lower than OSPF's default Administrative Distance (110).
When a router receives identical network destination prefixes from two different dynamic routing protocols, it compares their Administrative Distance (AD) values. Default AD for internal EIGRP is 90, and for OSPF it is 110. Because lower AD indicates higher trustworthiness, the router selects the EIGRP path regardless of raw metric values.

Adım Adım Çözüm

1
Identify the destination prefixes and compare their subnet mask lengths.
Both protocols report the identical network prefix length (192.168.50.0/24), so longest prefix match does not eliminate either route.
Longest prefix match is always the first evaluation criteria when choosing between routes.
2
Compare the Administrative Distance (AD) of the competing dynamic routing protocols.
Internal EIGRP has a default AD of 90, while OSPF has a default AD of 110.
When different routing protocols advertise the exact same network prefix, the router uses Administrative Distance to determine source trustworthiness before comparing metrics.
3
Select the preferred route based on the lower Administrative Distance.
The EIGRP route (AD 90) is selected and placed into the IP routing table.
A lower Administrative Distance indicates a more trustworthy routing source.

Anahtar Kavram

Administrative Distance vs. Routing Metric in Route Selection
Soru 247Soru

A network administrator is deploying a Voice over IP (VoIP) system across an enterprise network. The administrator needs to configure a DNS record that allows client IP phones to dynamically discover the hostname and specific port number of the Session Initiation Protocol (SIP) server. Which DNS resource record type should the administrator create to fulfill this requirement?

Cevabı ve açıklamayı göster

Cevap: An SRV record

Cevap

An SRV record is the correct DNS record type for specifying service hostnames and port numbers.
SRV (Service Location) records enable clients to discover hostnames and designated port numbers for specific services and protocols (such as SIP or LDAP).

Adım Adım Çözüm

1
Identify the technical requirements of the scenario.
The requirement is to map a network service (SIP for VoIP) to its hostname, priority, weight, and port number in DNS.
Client applications need both server identification and destination port information for service auto-discovery.
2
Evaluate standard DNS record capabilities.
SRV records are designed specifically to provide service location data including port numbers and protocols.
Standard host records (like A or CNAME) only provide IP addresses or aliases without port details.

Anahtar Kavram

DNS Service Location (SRV) Records
Tahmini Süre:45s
Soru 248Soru

A network administrator is allocating IP addresses for a newly created VoIP segment assigned the IPv4 subnet block 172.31.80.0/21172.31.80.0/21. What is the broadcast address of this subnet?

Cevabı ve açıklamayı göster

Cevap: 172.31.87.255

Cevap

172.31.87.255
For the subnet 172.31.80.0/21172.31.80.0/21, the subnet mask is 255.255.248.0255.255.248.0. The block size in the third octet is 8. The network range extends from 172.31.80.0172.31.80.0 to 172.31.87.255172.31.87.255, making 172.31.87.255172.31.87.255 the broadcast address.

Adım Adım Çözüm

1
Determine the subnet mask and block size for a /21 prefix.
A /21 prefix corresponds to a subnet mask of 255.255.248.0255.255.248.0. The block size in the third octet is 256248=8256 - 248 = 8.
Prefix length /21 leaves 3 subnet bits in the third octet (23=82^3 = 8 block size).
2
Calculate the next subnet network address.
Adding the block size of 8 to the third octet of 172.31.80.0172.31.80.0 yields the next network address: 172.31.88.0172.31.88.0.
The next subnet boundary defines the end of the current subnet range.
3
Subtract 1 from the next network address to find the broadcast address.
172.31.88.01=172.31.87.255172.31.88.0 - 1 = 172.31.87.255.
The broadcast address is the highest address within the subnet range where all host bits are set to 1.

Anahtar Kavram

Subnet Boundary and Broadcast Address Calculation
Tahmini Süre:1m 0s
Soru 249Soru

A network administrator is troubleshooting an authentication service failure where an internal enterprise application requires reverse DNS verification before granting access to incoming clients. The administrator runs the command `dig -x 192.168.50.25` and receives the following output:

text
;; QUESTION SECTION:
;25.50.168.192.in-addr.arpa. IN PTR

;; AUTHORITY SECTION:
50.168.192.in-addr.arpa. 3600 IN SOA ns1.corp.internal. hostmaster.corp.internal. 2026072701 7200 3600 1209600 3600

Which resource record configuration must be added to the authoritative zone to resolve the hostname verification failure?

Cevabı ve açıklamayı göster

Cevap: A PTR record mapping 25.50.168.192.in-addr.arpa. to the client host's fully qualified domain name

Cevap

A PTR record mapping 25.50.168.192.in-addr.arpa. to the host's fully qualified domain name must be created in the reverse lookup zone.
The output of `dig -x` demonstrates a query for a PTR record (`25.50.168.192.in-addr.arpa. IN PTR`). The absence of an ANSWER section confirms that no PTR record currently exists for IP 192.168.50.25. Adding a valid PTR record mapping the reverse address to the host's FQDN in the authoritative zone resolves the reverse lookup request.

Adım Adım Çözüm

1
Analyze the command and output
The `dig -x` command issues a reverse lookup query for `25.50.168.192.in-addr.arpa.` expecting a PTR record. The output lacks an ANSWER section.
An missing ANSWER section with an AUTHORITY section indicates the reverse lookup zone exists, but no specific pointer record is configured for IP address 192.168.50.25.
2
Identify the required record type for reverse name resolution
Pointer (PTR) records map reverse IP domain paths (in-addr.arpa) to fully qualified domain names (FQDNs).
Applications performing reverse DNS security checks query PTR records to verify that an IP address maps back to an expected hostname.
3
Determine the correct administrative remediation
Add a PTR record for host 25 in the `50.168.192.in-addr.arpa.` zone pointing to the client's FQDN.
Creating this record populated the ANSWER section in subsequent queries, completing reverse hostname verification.

Anahtar Kavram

DNS Reverse Lookup and PTR Record Configuration
Soru 250Soru

A network engineer is investigating why enterprise client endpoints fail to locate a local software update repository server. According to system documentation, client agents perform a DNS query to discover service location details, including the designated port number, priority, and weight for load balancing.

The engineer executes the following command during troubleshooting:

text
$ dig +noall +answer _update._tcp.corp.example.com
_update._tcp.corp.example.com. 3600 IN CNAME repo1.corp.example.com.

Based on the diagnostic output, which of the following actions must the administrator take on the authoritative DNS server to resolve the discovery issue?

Cevabı ve açıklamayı göster

Cevap: Replace the CNAME record with an SRV record that specifies the target hostname, port number, priority, and weight for the service.

Cevap

Replace the CNAME record with an SRV record that specifies the target hostname, port number, priority, and weight for the service.
The correct answer is to replace the CNAME record with an SRV record. SRV records use the standard format `_service._proto.name` (e.g., `_update._tcp.corp.example.com`) and return priority, weight, port number, and target hostname. CNAME records only provide a domain alias and lack port and load-balancing parameters.

Adım Adım Çözüm

1
Analyze the client requirement and command output.
The client queries for `_update._tcp.corp.example.com` expecting service discovery parameters (port, weight, priority, target host). The `dig` output shows a CNAME record mapping to `repo1.corp.example.com`.
A CNAME record only provides an alias pointing to another domain name; it cannot supply port numbers, priorities, or weights.
2
Identify the proper DNS record type required for service location discovery.
An SRV (Service) record follows the standard naming convention `_service._proto.name` and contains symbolic fields for Priority, Weight, Port, and Target hostname.
Applications relying on automatic service discovery require SRV records to determine which port and server to connect to.
3
Select the correct administrative remediation step.
Creating an SRV record with the proper parameters allows clients querying `_update._tcp.corp.example.com` to resolve both the target server and port.
Replacing the invalid CNAME configuration with an SRV record directly fulfills the technical requirement.

Anahtar Kavram

DNS SRV (Service Location) Record Configuration
Soru 251Soru

An organization hosts an internal web server at private IP address 192.168.1.50192.168.1.50 that must be accessible to external clients on the internet using the public IP address 203.0.113.10203.0.113.10. Inbound requests from the internet to destination port 8080 must consistently map to this internal server. Which network address translation technique should the network administrator implement on the edge firewall?

Cevabı ve açıklamayı göster

Cevap: Static Network Address Translation (Static NAT)

Cevap

Static Network Address Translation (Static NAT) should be configured on the edge firewall.
Static NAT establishes a persistent, 1-to-1 mapping between a specific internal private IP address and an external public IP address. This enables external internet clients to consistently locate and initiate inbound traffic to an internal web server.

Adım Adım Çözüm

1
Identify the traffic pattern and connectivity requirements
An internal host with a private IP address needs to accept unsolicited inbound requests originating from external clients on the internet via a fixed public IP address.
Public servers located behind a firewall require a persistent, predictable mapping between their private IP address and a public IP address.
2
Evaluate candidate NAT implementation methods
Static NAT provides a persistent 1-to-1 bidirectional mapping between a single private IP address and a single public IP address.
Dynamic NAT allocates public IP addresses temporarily from a pool, and PAT multiplexes outbound traffic using Layer 4 ports; neither guarantees a static inbound translation for external connections.

Anahtar Kavram

Static NAT Implementation for Inbound Services
Soru 252Soru

When an enterprise router receives an IP packet, it executes a standardized path selection hierarchy to determine the optimal route for packet forwarding. Place the following route evaluation steps in the correct sequential order from first decision criteria to last.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence for router path selection is: 1) Filter matching routing table entries, 2) Select the longest prefix match, 3) Select the route with the lowest Administrative Distance, 4) Select the route with the lowest metric, and 5) Install equal-cost paths for Equal-Cost Multi-Path (ECMP) load balancing.
The correct order follows the standard IP routing decision tree: the router first filters candidate routes, selects the route with the Longest Prefix Match (LPM), breaks ties between different protocols using Administrative Distance (AD), breaks ties within the same protocol using metric cost, and finally utilizes Equal-Cost Multi-Path (ECMP) if all parameters are completely identical.

Adım Adım Çözüm

1
Identify all matching prefixes
Candidate routes matching the packet destination IP address are filtered.
Routing lookup requires identifying all valid target subnets first.
2
Apply Longest Prefix Match (LPM)
The route with the highest number of matching network bits is selected.
Prefix specificity always overrides protocol believability (AD) or metric.
3
Evaluate Administrative Distance (AD)
The route from the protocol with the lowest AD is selected when prefix lengths are equal.
AD measures protocol trustworthiness across distinct routing sources.
4
Evaluate Routing Protocol Metric
The path with the lowest metric cost within the selected protocol is chosen.
Metric measures relative path desirability within a single routing protocol.
5
Apply Equal-Cost Multi-Path (ECMP)
Multiple matching routes are installed for simultaneous packet forwarding.
When prefix, AD, and metric tie completely, ECMP balances traffic across paths.

Anahtar Kavram

Router Path Selection Hierarchy (LPM -> AD -> Metric -> ECMP)
Soru 253Soru

A client workstation needs to connect to an external server via FQDN. The workstation's local DNS cache is empty. Sequence the complete recursive and iterative DNS resolution steps in the exact order they occur, from the client's initial request to the receipt and caching of the final IP address response.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The correct sequence starts with the stub resolver sending a recursive query to the local recursive resolver, followed by iterative queries up the DNS hierarchy (Root server referral to TLD server, TLD server referral to Authoritative server, Authoritative server response), ending with the response returned to the stub resolver and cached locally.
The correct order follows the standard DNS resolution model: a client stub resolver initiates a recursive query to its local resolver. The local resolver then performs iterative lookups descending the hierarchy starting at the Root server, moving to the TLD server, and finally contacting the Authoritative server. Once the authoritative answer is retrieved, it is returned to the client and cached by both the local resolver and the client stub resolver.

Adım Adım Çözüm

1
Initiate query from client
The client stub resolver sends a recursive query to the designated local recursive resolver.
The client operating system delegates full resolution responsibility to the recursive resolver.
2
Query Root Name Server
The local recursive resolver sends an iterative query to a Root DNS server.
With an empty cache, the recursive resolver must start at the DNS root.
3
Receive TLD Referral
The Root DNS server responds with NS and glue records pointing to the TLD servers.
Root servers only provide referrals to TLD servers rather than final IP mapping.
4
Query TLD Name Server
The local recursive resolver queries the TLD server and receives NS records for the authoritative server.
TLD servers maintain records pointing to the authoritative servers for registered domain names.
5
Query Authoritative Name Server
The local recursive resolver queries the authoritative server and receives the final resource record (A/AAAA).
Authoritative servers host the actual DNS zone data and supply definitive answers.
6
Return Response & Cache
The recursive resolver delivers the IP address to the stub resolver, and the entry is cached.
Caching prevents repetitive full tree traversal for subsequent requests during the TTL period.

Anahtar Kavram

DNS Resolution Hierarchy & Iterative vs Recursive Query Flow
Soru 254Soru

A network administrator needs to configure a floating static route to serve as an automatic failover backup path for an internal network segment currently learned dynamically via OSPF (192.168.10.0/24192.168.10.0/24, Administrative Distance of 110110). Which of the following route configurations will ensure the backup static route remains inactive in the routing table until the primary OSPF route fails?

Cevabı ve açıklamayı göster

Cevap: Configure a static route to 192.168.10.0/24192.168.10.0/24 with an Administrative Distance value set higher than 110110, such as 130130.

Cevap

Configure a static route for the target destination network with an Administrative Distance configured higher than the primary dynamic routing protocol's Administrative Distance (for example, setting AD to 130 when OSPF uses 110).
A floating static route is designed for backup redundancy by assigning it a higher Administrative Distance (AD) than the primary routing source. Since OSPF has an AD of 110, setting the static route's AD to a value like 130 keeps it out of the active forwarding table until the OSPF route disappears.

Adım Adım Çözüm

1
Identify the Administrative Distance (AD) of the primary dynamic routing protocol.
The primary OSPF route for network 192.168.10.0/24192.168.10.0/24 has a default AD of 110110.
Administrative Distance indicates the trustworthiness of a routing source; lower values are preferred.
2
Determine the required Administrative Distance for the backup floating static route.
The static route must be configured with an AD strictly greater than 110110 (e.g., 130130).
Setting a higher AD ensures the static route is untrusted while OSPF is functional and will not be installed into the active routing table.
3
Verify failover mechanics.
When the primary OSPF neighbor or link fails, the OSPF route is removed from the routing table, allowing the floating static route (AD=130AD = 130) to be installed and forward traffic.
Routers select the active route based on Administrative Distance when prefix lengths are identical.

Anahtar Kavram

Floating Static Routes and Administrative Distance
Soru 255Soru

An organization is deploying a new VoIP phone deployment on VLAN 30 (192.168.30.0/24192.168.30.0/24). While existing desktop computers on VLAN 10 (192.168.10.0/24192.168.10.0/24) successfully acquire dynamic IPv4 addresses from a centralized DHCP server at 10.1.1.5010.1.1.50, the newly installed VoIP phones on VLAN 30 fail to receive an IP address lease. Both VLANs terminate on a central Layer 3 core switch. Which of the following configuration changes on the Layer 3 core switch will resolve the IP addressing issue for the phones on VLAN 30?

Cevabı ve açıklamayı göster

Cevap: Configure `ip helper-address 10.1.1.50` under the VLAN 30 switch virtual interface (SVI).

Cevap

Configure `ip helper-address 10.1.1.50` under the VLAN 30 switch virtual interface (SVI).
The correct action is to configure `ip helper-address 10.1.1.50` under the VLAN 30 SVI. DHCP client discovery packets are sent as local Layer 2 broadcasts. Because routers and Layer 3 switch interfaces drop broadcast packets by default, a DHCP relay agent (configured via `ip helper-address` in Cisco-style syntax) must be enabled on the interface directly connected to the client subnet. This allows the switch to intercept incoming broadcast DHCPDISCOVER traffic on UDP port 67, encapsulate it as a unicast packet with the gateway IP address (`giaddr`) set to the VLAN 30 interface address, and send it to the DHCP server at 10.1.1.5010.1.1.50.

Adım Adım Çözüm

1
Analyze why clients on VLAN 30 fail to acquire IPv4 address leases from the remote DHCP server.
Initial DHCPDISCOVER messages are Layer 2 broadcasts (255.255.255.255255.255.255.255) that cannot traverse Layer 3 boundaries (routers/SVIs) by default.
Without a relay mechanism, broadcast requests from VLAN 30 are dropped at the SVI boundary.
2
Identify the proper location and command to enable DHCP relay functionality.
Apply `ip helper-address 10.1.1.50` on the ingress Layer 3 interface facing the client broadcast domain (VLAN 30 SVI).
The relay agent intercepts client broadcasts on port 67, adds its own IP address to the `giaddr` field, and forwards the request as a unicast packet to the target server.

Anahtar Kavram

DHCP Relay Agent Placement and Operation
Soru 256Soru

A network administrator is configuring a dedicated VLAN for a new branch office security system. The system requires static IPv4 addresses for 12 IP cameras, 2 Network Video Recorders (NVRs), and 1 router default gateway interface. Which of the following CIDR subnet masks is the smallest mask that accommodates all required host IP addresses while minimizing wasted address space?

Cevabı ve açıklamayı göster

Cevap: /27

Cevap

The subnet mask /27 is the smallest CIDR prefix that accommodates all 15 required host IP addresses.
The correct option is /27. The scenario requires 15 usable IPv4 addresses (12 cameras + 2 NVRs + 1 default gateway). A /27 subnet uses 5 host bits, yielding 2^5 - 2 = 30 usable host addresses. This is the smallest prefix length (most specific mask) that accommodates all 15 hosts without shortage.

Adım Adım Çözüm

1
Calculate total host IP addresses required
12 (cameras) + 2 (NVRs) + 1 (default gateway) = 15 required host IP addresses.
Every active host and gateway interface on the subnet requires a unique usable IP address.
2
Determine the required number of host bits using the formula 2^h - 2 >= required hosts
For 4 host bits (h=4): 2^4 - 2 = 14 usable host IPs (insufficient for 15 hosts). For 5 host bits (h=5): 2^5 - 2 = 30 usable host IPs (sufficient for 15 hosts).
Two addresses in every subnet are reserved for the network ID and broadcast address.
3
Calculate the CIDR prefix length
32 total IPv4 bits - 5 host bits = /27 prefix length.
Subtracting host bits from 32 gives the prefix length for the network portion.

Anahtar Kavram

IPv4 Subnet Masking and Host Allocation
Tahmini Süre:1m 30s
Soru 257Soru

A systems engineer is configuring an edge router for a secondary data center. The site has 50 internal servers on the private IP range 10.20.0.0/2610.20.0.0/26 that require outbound Internet access to update external software repositories using a single public IP address (203.0.113.10203.0.113.10). Additionally, external administrators must be able to initiate inbound SSH connections directly to a dedicated internal management server at 10.20.0.510.20.0.5. Which combination of address translation implementations should the engineer configure on the edge router?

Cevabı ve açıklamayı göster

Cevap: Configure Port Address Translation (PAT / Overload) using public IP address 203.0.113.10203.0.113.10 for the 10.20.0.0/2610.20.0.0/26 subnet, and configure a static port translation rule mapping inbound TCP port 22 on 203.0.113.10203.0.113.10 to 10.20.0.510.20.0.5.

Cevap

Port Address Translation (PAT / Overload) should be configured for outbound host access sharing the public IP, along with a static port translation (port forwarding) mapping rule for inbound SSH access to the management server.
Port Address Translation (PAT / Overload) uses unique source port numbers at Layer 4 to allow multiple internal private IP addresses to share a single public IP address for outbound traffic. For inbound connections to internal resources, a static translation entry (such as port forwarding TCP port 22) must be created so the router knows which internal host should receive traffic initiated from external networks.

Adım Adım Çözüm

1
Analyze outbound requirement for internal subnet
50 internal hosts on 10.20.0.0/2610.20.0.0/26 must share a single public IP (203.0.113.10203.0.113.10).
Because only one public IP address is available for 50 hosts, Layer 4 Port Address Translation (PAT / NAT Overload) is required to track separate connections by source port.
2
Analyze inbound requirement for internal management server
External clients must initiate SSH connections to 10.20.0.510.20.0.5 through 203.0.113.10203.0.113.10.
Inbound connections initiated from the outside require a static, predictable mapping. Static NAT or Static PAT (Port Forwarding on TCP port 22) routes incoming traffic on the public IP directly to the internal server's private address.
3
Combine translation methods on edge router
PAT handles outbound dynamic sessions; Static NAT/PAT handles inbound SSH sessions.
This dual implementation permits outbound internet browsing for all internal hosts while maintaining targeted inbound service accessibility.

Anahtar Kavram

Combining Port Address Translation (PAT/Overload) for outbound host multiplexing with Static NAT/Port Forwarding for inbound server availability.
Soru 258Soru

A network engineer is troubleshooting an outbound connectivity issue at a branch office where 500 workstations on the 10.50.0.0/2210.50.0.0/22 internal network access external services through a router configured with Port Address Translation (PAT) on a single public IP address (198.51.100.1198.51.100.1). Users report that while standard web traffic functions without issue, a legacy proprietary monitoring application that transmits raw IP packets (using custom IP protocol 99 without TCP/UDP transport headers or unique layer-4 session identifiers) allows only one internal host at a time to communicate with a remote server. Which of the following best explains why PAT fails to multiplex multiple simultaneous connections for this application?

Cevabı ve açıklamayı göster

Cevap: PAT relies on Layer 4 transport headers or protocol-specific multiplexing identifiers to track distinct flows over a single public IP address, which raw IP protocol 99 traffic lacks.

Cevap

PAT relies on Layer 4 transport headers or protocol-specific multiplexing identifiers to track distinct flows over a single public IP address, which raw IP protocol 99 traffic lacks.
Port Address Translation (PAT) requires Layer 4 information—specifically TCP or UDP port numbers—to track and differentiate multiple internal hosts sharing a single public IP address. Protocols that run directly over IP without TCP/UDP transport headers or built-in session identifiers (such as ICMP Query IDs) cannot be multiplexed by PAT across multiple internal hosts targeting the same external destination server.

Adım Adım Çözüm

1
Analyze how Port Address Translation (PAT / NAT Overload) disambiguates connections.
PAT maps multiple private 10.50.0.0/2210.50.0.0/22 addresses to a single public IP address 198.51.100.1198.51.100.1 by assigning unique Layer 4 source port numbers (TCP/UDP) to each outbound flow.
Tracking transport layer source ports allows the router to route incoming return packets back to the exact internal host IP and internal port.
2
Evaluate the traffic characteristics of the legacy proprietary application.
The application sends raw IP packets using IP protocol number 99, bypassing Layer 4 TCP and UDP headers entirely.
Without TCP/UDP source/destination port fields or protocol-specific identification fields (such as ICMP Identifier fields), PAT has no Layer 4 data to modify or track in its state table.
3
Determine why only a single session functions at a time.
The translation table can only map the IP protocol 99 tuple (Inside Local IP \rightarrow Outside Global IP) once without port fields.
Subsequent internal hosts attempting to send IP protocol 99 traffic to the same destination remote server collide with the existing translation entry because the router cannot differentiate the flows.

Anahtar Kavram

PAT Layer 4 Multiplexing Requirements and Transport Protocol Translation Limits
Tahmini Süre:2m 0s
Soru 259Soru

Match each enterprise address translation requirement or descriptor on the left with the corresponding Network Address Translation (NAT) implementation type or address classification on the right.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

Providing permanent, bi-directional inbound accessibility to an internal server residing on a private subnet using a fixed one-to-one IP mapping.
Allowing hundreds of internal workstations to establish outbound internet connections simultaneously over a single public IP by tracking unique ephemeral Layer 4 source ports.
Assigning an internal host a temporary public IP address from a pre-configured, bounded address pool on a first-come, first-served basis for the duration of its session.
The public IPv4 address assigned to represent an internal private host to external entities on the public internet.

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

The correct matches are: 1. Permanent bi-directional inbound accessibility matches Static NAT; 2. Multiple workstations sharing a single public IP via Layer 4 source ports matches Port Address Translation (PAT / NAT Overload); 3. Assigning a temporary public IP from a pre-configured pool matches Dynamic NAT; 4. The public IPv4 address assigned to represent an internal host externally matches Inside Global Address.
Each NAT mechanism serves specific architectural requirements: Static NAT maintains a 1-to-1 static mapping for inbound services; PAT (Overload) multiplexes multiple private IPs across one public IP by translating Layer 4 source ports; Dynamic NAT allocates public IPs dynamically from a pool on a 1-to-1 basis; and Inside Global refers specifically to the translated public address representing an inside device to the outside world.

Adım Adım Çözüm

1
Analyze requirement 1 (permanent bi-directional inbound access).
Identified as requiring a static, invariant 1-to-1 mapping.
Static NAT ensures outside clients can consistently initiate connections to an internal server.
2
Analyze requirement 2 (hundreds of workstations sharing one public IP via source ports).
Identified as Port Address Translation (PAT).
PAT uses Layer 4 TCP/UDP port mapping (Overload) to multiplex many internal private addresses over a single public address.
3
Analyze requirement 3 (temporary IP assignment from a bounded pool).
Identified as Dynamic NAT.
Dynamic NAT creates temporary 1-to-1 translations on demand from an available address pool.
4
Analyze requirement 4 (naming convention for the public representation of an internal host).
Identified as Inside Global Address.
CompTIA/Cisco terminology defines Inside Global as the translated address of an inside device as viewed by external networks.

Anahtar Kavram

NAT/PAT Implementation Types and CompTIA Network Address Classifications
Soru 260Soru

Match each DNS resource record type to its corresponding technical description or administrative function within an enterprise DNS infrastructure.

Soldaki öğeye tıklayın, sonra eşleşen sağdaki öğeye tıklayın

Öğeler

SRV Record
SOA Record
RRSIG Record
CNAME Record

Eşleşmeler

Cevabı ve açıklamayı göster

Cevap

SRV Record matches the description detailing service name, protocol, port number, priority, and weight. SOA Record matches the description detailing zone administration parameters, primary master name server, contact email, and zone timers. RRSIG Record matches the description specifying DNSSEC digital signatures for RRsets. CNAME Record matches the description defining an alias mapping to a canonical hostname requiring secondary resolution.
Each DNS record type serves a distinct technical role: SRV handles service and port discovery; SOA contains zone-wide administrative metadata and replication timers; RRSIG provides DNSSEC cryptographic signatures over record sets; and CNAME acts as a domain alias pointing to a canonical domain name.

Adım Adım Çözüm

1
Analyze SRV Record requirements
Identify that SRV records uniquely incorporate service/protocol specification along with priority, weight, and port fields for service location discovery.
Used in protocols like LDAP, Kerberos, and VoIP for dynamic service locator resolution.
2
Analyze SOA Record parameters
Identify that SOA records define zone-level metadata including serial numbers, refresh, retry, expire intervals, and administrative email address.
Crucial for primary/secondary DNS replication synchronization and authoritative zone parameters.
3
Analyze RRSIG Record functionality
Identify that RRSIG is a key component of DNSSEC containing public key cryptography signatures over DNS record sets.
Prevents cache poisoning and spoofing by enabling cryptographic validation of response data.
4
Analyze CNAME Record functionality
Identify that CNAME acts as an alias to a canonical name, forcing recursive resolvers to initiate a secondary lookup cycle.
Simplifies domain management when multiple service names point to a single host entity.

Anahtar Kavram

DNS Infrastructure Record Types and Technical Functions
ÖncekiSayfa 13 / 22Sonraki