349 free Cisco 200-301 CCNA practice questions from the CertStash pack of 1,395, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 349 free here, all 1,395 in the pack, and each step includes the one before it.
Get all 1,395 questions (US$39) · Download the first 10 as a PDF · Read the study guide
Question 1
A frame that enters a switch fails the Frame Check Sequence. Which two interface counters are incremented? (Choose two.)
Show answer and explanation
Correct answer: A, D. input errors; CRC
When a frame fails the Frame Check Sequence (FCS), which is a CRC error, two counters are incremented: 'input errors' (the general category for errors on incoming frames) and 'CRC' (the specific counter for CRC/FCS failures). These counters track Layer 2 frame integrity issues on switch interfaces.
Why the other options are wrong
- B. Frame counter tracks frame counts, not CRC errors specifically.
- C. Giants counter tracks oversized frames, not CRC failures.
- E. Runts counter tracks undersized frames, not CRC errors.
Question 2
How do TCP and UDP differ in the way that they establish a connection between two endpoints?
Show answer and explanation
Correct answer: A. TCP uses the three-way handshake, and UDP does not guarantee message delivery.
TCP uses a three-way handshake (SYN, SYN-ACK, ACK) to establish a connection and guarantees message delivery through acknowledgments. UDP, being connectionless, does not establish a connection or guarantee delivery. Option A correctly identifies both of these fundamental differences between the protocols.
Why the other options are wrong
- B. Both TCP and UDP use acknowledgment packets in their own ways; this distinction is imprecise.
- C. UDP does not provide reliable transfer (TCP does), and UDP is connectionless (not TCP), this reverses the facts.
- D. TCP uses SYN, SYN-ACK, and ACK bits; it does not use FIN in the handshake. UDP does not use SYN bits at all.
Question 3
Which 802.11 frame type is Association Response?
Show answer and explanation
Correct answer: A. management
Association Response is a management frame type in 802.11 wireless networks. Management frames handle connection establishment, authentication, and association between wireless devices and access points. Association Response specifically is sent by an AP in response to an association request from a client.
Why the other options are wrong
- B. Protected frame refers to encrypted frames, not a frame type category.
- C. Action frames are a specific management subtype used for signaling, not the category for Association Response.
- D. Control frames handle RTS/CTS and acknowledgments, not association management.
Question 4
In which way does a spine-and-leaf architecture allow for scalability in a network when additional access ports are required?
Show answer and explanation
Correct answer: C. A leaf switch can be added with connections to every spine switch.
In a spine-and-leaf architecture, scalability is achieved by adding leaf switches that connect to every spine switch. This creates a non-blocking mesh topology where each new leaf switch can communicate with all spine switches, enabling horizontal scaling without oversubscription. This is the standard method for adding access ports in this design.
Why the other options are wrong
- A. Adding spine switches is expensive and unnecessary for access port scaling.
- B. Uplink specifications don't define scalability; the architecture itself does.
- D. A single connection to one spine creates a bottleneck and defeats the purpose of the mesh topology.
Question 5
What identifies the functionality of virtual machines?
Show answer and explanation
Correct answer: C. The hypervisor virtualizes physical components including CPU, memory, and storage.
The hypervisor's core function is to virtualize physical hardware components including CPU, memory, and storage, allowing multiple virtual machines to share physical resources. This abstraction layer enables efficient resource allocation and isolation between VMs, which is the fundamental capability that defines hypervisor functionality.
Why the other options are wrong
- A. Hypervisors operate at Layer 2 and Layer 3, and require management resources.
- B. Each hypervisor supports multiple virtual machines, not just one, and can support multiple virtual switches.
- D. Virtual servers work efficiently with virtual networking; physical separation from the hypervisor is not required.
Question 6
Which command automatically generates an IPv6 address from a specified IPv6 prefix and MAC address of an interface?
Show answer and explanation
Correct answer: B. ipv6 address 2001:DB8:5:112::/64 eui-64
The 'ipv6 address <prefix> eui-64' command automatically generates an IPv6 address by combining a specified IPv6 prefix with the EUI-64 identifier derived from the interface's MAC address. This creates a full /64 address without manual configuration of the host portion, using the MAC address as the basis for the interface ID.
Why the other options are wrong
- A. DHCP requires a DHCP server; it doesn't generate from a MAC address.
- C. Autoconfig uses stateless auto-configuration but does not specify a prefix like eui-64 does.
- D. This specifies a full address with a link-local scope, not prefix-based auto-generation from MAC.
Question 7
When configuring IPv6 on an interface, which two IPv6 multicast groups are joined? (Choose two.)
Show answer and explanation
Correct answer: D, E. FF02::1; FF02::2
When IPv6 is configured on an interface, it automatically joins two critical multicast groups: FF02::1 (All Nodes multicast address for local link communication) and FF02::2 (All Routers multicast address for router solicitation and advertisement). These groups enable fundamental IPv6 neighbor discovery and router communication on the link.
Why the other options are wrong
- A. 2000::/3 is a global unicast address prefix, not a multicast group.
- B. 2002::5 is a specific unicast address, not a standard multicast group.
- C. FC00::/7 is the unique local address prefix, not a multicast group.
Question 8
What is the default behavior of a Layer 2 switch when a frame with an unknown destination MAC address is received?
Show answer and explanation
Correct answer: C. The Layer 2 switch floods packets to all ports except the receiving port in the given VLAN.
When a Layer 2 switch receives a frame with an unknown destination MAC address, it floods the frame to all ports except the incoming port within the same VLAN. This broadcast behavior ensures the frame reaches its destination while allowing the switch to learn the source MAC address from the response.
Why the other options are wrong
- A. The switch does not forward first; it floods because the destination is unknown.
- B. Modern switches flood without CPU involvement; the CPU is not required for unknown unicast handling.
- D. Unknown destination frames are flooded, not dropped.
Question 9
An engineer must configure a /30 subnet between two routes. Which usable IP address and subnet mask combination meets this criteria?
Show answer and explanation
Correct answer: D. interface e0/0 description to XX-AXXX:XXXXX ip address 209.165.201.2 225.255.255.252
A /30 mask (255.255.255.252) gives four addresses: network, two usable hosts and broadcast. 209.165.201.2 sits in the 209.165.201.0/30 block, where .1 and .2 are the usable hosts, so it is a valid address for a point-to-point link. The 225 in the mask is a typing error for 255.
Why the other options are wrong
- A. 10.2.1.3 is the broadcast address of the 10.2.1.0/30 block, so it cannot be assigned to an interface.
- B. 255.255.255.248 is a /29 mask, not the required /30.
- C. 255.255.255.248 is a /29 mask, and 172.16.1.4 would be the network address in the 172.16.1.0/29 block anyway.
Question 10
Which network allows devices to communicate without the need to access the Internet?
Show answer and explanation
Correct answer: B. 172.28.0.0/16
Private IP addresses defined by RFC 1918 are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Option B (172.28.0.0/16) falls within the 172.16.0.0/12 range, making it a private address that allows communication without Internet access. The other options are either not private addresses or outside the designated RFC 1918 ranges.
Why the other options are wrong
- A. 172.9.0.0/16 is not within the private range 172.16.0.0/12; it is a public address.
- C. 192.0.0.0/8 is not a private range; the private range is 192.168.0.0/16.
- D. 209.165.201.0/24 is a public IP address range, not private.
What people say about the full 200-301 pack 4.7 from 13
What a find. Passed! Reflects the actual exam well. Was not surprised by what I saw on exam day.
You can tell these are real exam questions. The style, the phrasing, the topics all consistent with what I saw on exam day. Will use this dump for my next cert.
I used Cert Stash to prepare for my CCNA 200-301 exam after a friend recommended it. I didn’t know much about the exam before, but their materials were clear and helpful. It made studying easier, and I’d say it’s a good resource to check out.
Question 11
What is the same for both copper and fiber interfaces when using SFP modules?
Show answer and explanation
Correct answer: C. They provide minimal interruption to services by being hot-swappable
SFP (Small Form-factor Pluggable) modules, whether copper (RJ45) or fiber-based, are designed to be hot-swappable, allowing them to be inserted or removed without disrupting network services. This is a universal feature across both types. Optical attenuators (A) apply only to fiber, not copper. Option B is incorrect because a single SFP module accommodates either single-mode or multi-mode, not both. Option D is wrong because SFP modules support speeds well beyond 100 Mbps (up to 10 Gbps or more) and in full duplex.
Why the other options are wrong
- A. Inline optical attenuators are specific to fiber optic SFP modules, not copper interfaces.
- B. A single SFP module supports either single-mode or multi-mode fiber, not both simultaneously.
- D. Modern SFP modules support gigabit speeds in full duplex, far exceeding 100 Mbps half duplex.
Question 12
While examining excessive traffic on the network, it is noted that all incoming packets on an interface appear to be allowed even though an IPv4 ACL is applied to the interface. Which two misconfigurations cause this behavior? (Choose two.)
Show answer and explanation
Correct answer: B, E. A matching permit statement is too broadly defined; A matching permit statement is too high in the access list
When all incoming packets are allowed despite an ACL being applied, two common misconfigurations are: (B) a matching permit statement that is too broadly defined (such as 'permit ip any any'), which allows all traffic, and (E) a matching permit statement positioned too high in the access list, which causes it to match and permit traffic before more specific deny statements below it can be evaluated.
Why the other options are wrong
- A. An empty ACL would have implicit deny all behavior, not permit all
- C. If packets fail to match any permit statement, they hit implicit deny, not permit all
- D. A deny statement high in the list would block traffic, not permit all
Question 13
What is the purpose of using First Hop Redundancy Protocol on a specific subnet?
Show answer and explanation
Correct answer: B. sends the default route to the hosts on a network
First Hop Redundancy Protocols (FHRP) like VRRP, HSRP, and GLBP provide redundancy for the default gateway by allowing multiple routers to share a virtual IP address on a subnet. When the active gateway fails, the standby router takes over and continues sending default route information to hosts, ensuring continuous connectivity.
Why the other options are wrong
- A. While FHRP routers do exchange hello messages, this is not the primary purpose of the protocol.
- C. Loop-free topology is ensured by spanning tree protocols, not FHRP.
- D. Traffic filtering based on destination IP is performed by access lists, not FHRP.
Question 14
Which design element is a best practice when deploying an 802.11b wireless infrastructure?
Show answer and explanation
Correct answer: A. allocating nonoverlapping channels to access points that are in close physical proximity to one another
Allocating nonoverlapping channels to access points in close physical proximity is a best practice for 802.11b (and any 802.11) deployment. This minimizes interference and co-channel interference, which significantly impacts performance in the 2.4 GHz band where only three non-overlapping channels are available (1, 6, 11).
Why the other options are wrong
- B. TCP should never be disabled; it is fundamental to network communication and not related to AP signal negotiation.
- C. Configuring access points to provide only 5 Mbps is unnecessarily restrictive and contradicts best practices for maximizing throughput.
- D. 802.11b has a maximum data rate of 11 Mbps, not 54 Mbps; 54 Mbps is the maximum for 802.11g.
Question 15
Which spanning-tree enhancement avoids the learning and listening states and immediately places ports in the forwarding state?
Show answer and explanation
Correct answer: B. PortFast
PortFast is a Cisco spanning-tree enhancement that immediately places ports in the forwarding state, bypassing the learning and listening states. This is specifically designed for edge ports connecting to end devices that do not participate in spanning tree, allowing them to forward traffic immediately upon connection.
Why the other options are wrong
- A. BPDUfilter prevents sending and receiving BPDUs but doesn't address learning/listening states.
- C. BackboneFast speeds up convergence after indirect link failures, not port initialization.
- D. BPDUguard protects against unauthorized BPDU reception but doesn't skip learning/listening states.
Question 16
What is a requirement when configuring or removing LAG on a WLC?
Show answer and explanation
Correct answer: C. The controller must be rebooted after enabling or reconfiguring LAG
When enabling or reconfiguring LAG (Link Aggregation Group) on a Wireless LAN Controller, the controller must be rebooted for the changes to take effect. This is a critical requirement because LAG affects the fundamental network connectivity and management interface behavior of the controller.
Why the other options are wrong
- A. Incoming and outgoing ports are not a specific requirement for LAG configuration.
- B. While the management interface configuration may be affected, reassignment is not the primary requirement when disabling LAG.
- D. Multiple untagged interfaces on the same port is not a LAG configuration requirement.
Question 17
What are two roles of the Dynamic Host Configuration Protocol (DHCP)? (Choose two.)
Show answer and explanation
Correct answer: B, D. The DHCP server leases client IP addresses dynamically; The DHCP server offers the ability to exclude specific IP addresses from a pool of IP addresses.
DHCP servers perform two key functions: they lease IP addresses to clients dynamically (with expiration and renewal), and they allow administrators to exclude specific addresses from the available pool. Option B correctly describes the lease mechanism, and option D describes the exclusion/reservation functionality that prevents certain addresses from being assigned.
Why the other options are wrong
- A. DHCP addresses require renewal; they are not permanent assignments without renewal.
- C. Clients request DNS servers, but the standard limit is typically 3 or more, not specifically up to 4.
- E. The DHCP server manages the pool, not the client; clients request addresses from the server's pool.
Question 18
Which command must you enter to guarantee that an HSRP router with higher priority becomes the HSRP primary router after it is reloaded?
Show answer and explanation
Correct answer: A. standby 10 preempt
The standby 10 preempt command enables preemption, which allows a router with higher priority to take over as the active router after being reloaded. Without preemption enabled, the router will remain in standby even if it has higher priority than the currently active router.
Why the other options are wrong
- B. Version 1 vs 2 does not affect preemption behavior.
- C. Setting priority alone does not cause preemption; preempt must be explicitly configured.
- D. Version 2 does not enable preemption functionality.
Question 19
Which Cisco IOS command will indicate that interface GigabitEthernet 0/0 is configured via DHCP?
Show answer and explanation
Correct answer: D. show ip interface GigabitEthernet 0/0
The 'show ip interface GigabitEthernet 0/0' command displays detailed IP configuration for that specific interface, including whether it is configured to obtain its address via DHCP. The output will show 'IP address is 192.168.x.x (via DHCP)' or similar indicating DHCP assignment.
Why the other options are wrong
- A. This syntax is invalid; there is no 'dhcp' parameter for this command structure
- B. show interface shows only Layer 1/2 information without IP details
- C. This syntax is invalid; the interface must be specified before dhcp parameter
- E. show ip interface brief displays only abbreviated information, not detailed DHCP configuration
Question 20
How does WPA3 improve security?
Show answer and explanation
Correct answer: A. It uses SAE for authentication.
WPA3 uses Simultaneous Authentication of Equals (SAE) instead of the Pre-Shared Key (PSK) exchange, providing protection against brute-force and dictionary attacks. This is the primary security improvement that defines WPA3.
Why the other options are wrong
- B. RC4 is an outdated encryption algorithm and is not used in WPA3.
- C. TKIP was used in WPA; WPA3 uses stronger encryption methods like CCMP.
- D. The 4-way handshake is part of WPA/WPA2, not a WPA3 improvement.
Question 21
Which action implements physical access control as part of the security program of an organization?
Show answer and explanation
Correct answer: A. setting up IP cameras to monitor key infrastructure
Setting up IP cameras to monitor key infrastructure is a physical access control measure. It provides surveillance and documentation of who accesses critical network equipment and facilities, which is essential for physical security.
Why the other options are wrong
- B. Console port passwords are logical access control, not physical access control.
- C. Remote syslog backup is data protection and backup strategy, not physical access control.
- D. Enable passwords are logical access control to device management, not physical facility security.
Question 22
Which command is used to display the collection of OSPF link states?
Show answer and explanation
Correct answer: D. show ip ospf database
The 'show ip ospf database' command displays the OSPF link state database (LSDB), which contains the collection of all link state advertisements (LSAs) that routers have learned. This command shows the topology information that OSPF uses to calculate routes. The other options either don't exist or display different OSPF information.
Why the other options are wrong
- A. The 'show ip ospf link-state' command does not exist.
- B. While 'lsa database' sounds relevant, the correct command is 'show ip ospf database' not 'lsa database'.
- C. The 'show ip ospf neighbors' command displays neighbor relationships, not the link state database.
Question 23
What is a feature of WPA?
Show answer and explanation
Correct answer: A. TKIP/MIC encryption
WPA (Wi-Fi Protected Access) introduced TKIP (Temporal Key Integrity Protocol) with MIC (Message Integrity Check) as a core encryption and authentication mechanism, significantly improving upon WEP's weaknesses. This was a defining feature of WPA.
Why the other options are wrong
- B. A Wi-Fi application is not a security feature of the WPA standard.
- C. Preshared keys are used in WPA-PSK mode but are not the primary feature defining WPA.
- D. 802.1x is an authentication framework used with WPA-Enterprise, not a defining feature of WPA itself.
Question 24
How does MAC learning function?
Show answer and explanation
Correct answer: D. adds unknown source MAC addresses to the CAM table
MAC learning is the process by which switches dynamically learn source MAC addresses from incoming frames and add them to the CAM (Content Addressable Memory) table along with the incoming port number. This allows switches to build their MAC address table over time, enabling efficient frame forwarding based on destination MAC addresses.
Why the other options are wrong
- A. MAC learning does not send frames back to verify availability.
- B. MAC learning does not rewrite source and destination MAC addresses.
- C. Switches do not drop frames based on unknown source MAC addresses during the learning process; they learn and forward them.
Question 25
An engineer must update the configuration on two PCs in two different subnets to communicate locally with each other. One PC is configured with IP address 192.168.25.128/25 and the other with 192.168.25.100/25. Which network mask must the engineer configure on both PCs to enable the communication?
Show answer and explanation
Correct answer: C. 255.255.255.0
With /25 subnets, the network mask is 255.255.255.128. PC1 (192.168.25.128/25) is in the 192.168.25.128-255 subnet, and PC2 (192.168.25.100/25) is in the 192.168.25.0-127 subnet. To enable local communication, both must be in the same subnet, requiring a /24 mask (255.255.255.0), which puts both in the 192.168.25.0-255 subnet.
Why the other options are wrong
- A. 255.255.255.248 (/29) is too restrictive and would still separate the two addresses into different subnets.
- B. 255.255.255.224 (/27) would still separate these addresses into different subnets.
- D. 255.255.255.252 (/30) is overly restrictive and would not allow both addresses in the same subnet.
Question 26
An engineer is asked to protect unused ports that are configured in the default VLAN on a switch. Which two steps will fulfill the request? (Choose two.)
Show answer and explanation
Correct answer: C, D. Configure the port type as access and place in VLAN 99; Administratively shut down the ports.
To protect unused ports in the default VLAN, they should be configured as access ports and placed in an unused VLAN (such as VLAN 99) to prevent access, and administratively shut down to disable them completely. Placing them in a separate VLAN isolates unused devices, while shutting them down prevents any activation. Together, these steps provide comprehensive protection.
Why the other options are wrong
- A. Configuring trunk ports would allow traffic for multiple VLANs, which does not protect unused ports.
- B. Enabling CDP is a discovery protocol and does not protect unused ports from access.
- E. EtherChannel is used for link aggregation between ports and does not protect unused ports.
Question 27
What is the binary pattern of unique ipv6 unique local address?
Show answer and explanation
Correct answer: B. 11111100
IPv6 Unique Local Addresses (ULA) have a binary prefix of 11111100 (FC00::/7 in hex). The first 7 bits are set to 1111110, and the 8th bit indicates either globally unique (0) or locally assigned (1), giving either FC00::/8 or FD00::/8 for actual ULAs. Option B correctly identifies the 8-bit pattern 11111100 that represents the FD00::/8 ULA range.
Why the other options are wrong
- A. 00000000 represents the unspecified address, not ULA.
- C. 11111111 would be outside the standard ULA prefix range.
- D. 11111101 does not correctly represent the ULA binary pattern.
Question 28
What is a network appliance that checks the state of a packet to determine whether the packet is legitimate?
Show answer and explanation
Correct answer: D. firewall
A firewall is a network appliance that examines packets and determines their legitimacy by checking packet state and comparing against security policies. It operates at multiple layers to filter traffic based on connection state and rules. Layer 2 switches forward based on MAC addresses, LAN controllers manage wireless networks, and load balancers distribute traffic, none perform state-based packet legitimacy checking.
Why the other options are wrong
- A. Layer 2 switches forward frames based on MAC addresses, not packet state.
- B. LAN controllers manage wireless access points, not packet state inspection.
- C. Load balancers distribute traffic across servers, not check packet legitimacy.
Question 29
What is a function of store-and forward switching?
Show answer and explanation
Correct answer: B. It produces an effective level of error-free network traffic using CRCs.
Store-and-forward switching buffers the entire frame and checks the Frame Check Sequence (CRC) before forwarding. This error-checking mechanism ensures that only error-free frames are forwarded, producing an effective level of error-free network traffic. The switch reads the complete frame into memory, verifies the CRC, and then forwards only valid frames.
Why the other options are wrong
- A. Store-and-forward does not reduce latency; it increases latency because the entire frame must be buffered before forwarding. It also does not eliminate error checking; it includes it.
- C. Store-and-forward forwards only error-free frames, not frames regardless of errors.
- D. Store-and-forward checks more than just the destination MAC address; it verifies the entire frame's CRC.
Question 30
Which of the following dynamic routing protocols are Distance Vector routing protocols? (Choose two.)
Show answer and explanation
Correct answer: B, E. EIGRP; RIP
EIGRP and RIP are both distance vector routing protocols. EIGRP is an advanced distance vector protocol that uses feasible distance and reported distance, while RIP is a classic distance vector protocol that uses hop count. IS-IS, OSPF, and BGP are link-state or path-vector protocols, not distance vector protocols.
Why the other options are wrong
- A. IS-IS is a link-state routing protocol, not distance vector.
- C. OSPF is a link-state routing protocol, not distance vector.
- D. BGP is a path-vector exterior routing protocol, not distance vector.
Question 31
Which device separates networks by security domains?
Show answer and explanation
Correct answer: B. firewall
A firewall is the primary device that separates networks by security domains, enforcing policies between trusted internal networks and untrusted external networks, and creating controlled boundaries between different security zones.
Why the other options are wrong
- A. An intrusion protection system monitors and blocks threats but does not inherently separate security domains.
- C. A wireless controller manages wireless access points but does not separate network security domains.
- D. An access point provides wireless connectivity but does not separate security domains.
Question 32
Which two VLAN IDs indicate a default VLAN? (Choose two.)
Show answer and explanation
Correct answer: B, C. 1; 1005
VLAN 1 is the default VLAN on all Cisco switches and cannot be deleted. VLAN 1005 is also a default VLAN used for Token Ring and FDDI domains in older VTP implementations. VLANs 0 and 4096 are reserved and cannot be used for user traffic. VLAN 1006 is not a default VLAN.
Why the other options are wrong
- A. VLAN 0 is reserved and not a default user VLAN
- D. VLAN 1006 is not designated as a default VLAN
- E. VLAN 4096 is reserved and not usable
Question 33
What is a characteristic of private IPv4 addressing?
Show answer and explanation
Correct answer: C. used without tracking or registration
Private IPv4 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are used internally without requiring tracking or registration with IANA. They are not routable on the public internet and can be used freely within organizations.
Why the other options are wrong
- A. Private IPv4 address ranges contain millions of addresses, not 65,536.
- B. Private addresses are not issued by IANA; they are reserved ranges for internal use.
- D. Private addresses do not traverse the internet even with ACLs; they are non-routable on the public internet.
Question 34
Which PoE mode enables powered-devices detection and guarantees power when the device detected?
Show answer and explanation
Correct answer: A. auto
Auto mode (often called PoE Auto or PoE+) automatically detects powered devices and enables power delivery when a compatible device is detected. This is the standard detection and power-enabling mechanism in Power over Ethernet implementations.
Why the other options are wrong
- B. Static mode provides continuous power without detection, so it does not guarantee power only when a device is detected.
- C. Dynamic mode is not a standard PoE terminology and does not describe the detection mechanism.
- D. Active mode is not a recognized PoE classification for device detection and power delivery.
Question 35
Why implement VRRP?
Show answer and explanation
Correct answer: B. To provide end users with a virtual gateway in a multivendor network
VRRP is implemented primarily to provide end users with a virtual gateway in a multivendor network. By allowing multiple routers from different vendors to share a single virtual IP address, VRRP ensures that clients have a consistent default gateway that works transparently across vendor boundaries, enabling seamless redundancy without requiring vendor-specific protocols.
Why the other options are wrong
- A. VRRP does not rely on autodiscovery by end users; hosts are configured with a known virtual gateway address.
- C. Weighting schemes are not a standard feature of VRRP for providing uninterrupted service.
- D. While VRRP can detect failures, it is not specifically designed to avoid BFD overhead; these are complementary technologies.
Question 36
You are configuring your edge routers interface with a public IP address for Internet connectivity. The router needs to obtain the IP address from the service provider dynamically. Which command is needed on interface FastEthernet 0/0 to accomplish this?
Show answer and explanation
Correct answer: D. ip address dhcp
The command 'ip address dhcp' is used on a Cisco router interface to dynamically obtain an IP address from a DHCP server. This allows the edge router to receive its public IP address from the service provider's DHCP server without manual static configuration, which is the requirement for dynamic Internet connectivity.
Why the other options are wrong
- A. ip default-gateway is used to set a default gateway, not to obtain a dynamic IP address.
- B. ip route is used for static routing, not for dynamic IP address assignment.
- C. ip default-network specifies a default network route, not for dynamic IP configuration.
- E. ip address dynamic is not a valid Cisco IOS command; the correct command is 'ip address dhcp'.
Question 37
An organization secures its network with multi-factor authentication using an authenticator app on employee smartphones. How is the application secured in the case of a user's smartphone being lost or stolen?
Show answer and explanation
Correct answer: A. The application requires the user to enter a PIN before it provides the second factor
When a smartphone is lost or stolen, authenticator applications are secured by requiring the user to enter a PIN or biometric before the app provides the second factor code. This local security control prevents an unauthorized person who gains physical possession of the phone from immediately using the authenticator app, adding a layer of protection even if the device itself is compromised.
Why the other options are wrong
- B. Administrator passwords for reactivation are not a standard feature of authenticator apps.
- C. Geolocation verification is not a typical security mechanism for authenticator apps.
- D. Requiring an administrator password on reboot is not a standard authenticator app security feature.
Question 38
Where does the configuration reside when a helper address is configured lo support DHCP?
Show answer and explanation
Correct answer: B. on the router closest to the client
A DHCP helper address is configured on the router closest to the client (in the client's subnet). This router intercepts DHCP broadcast messages from clients and forwards them as unicasts to the remote DHCP server. The helper address configuration enables the router to relay DHCP requests across network segments where the server is not directly connected.
Why the other options are wrong
- A. Configuration is not placed on the router closest to the server; the server receives the relayed requests.
- C. Helper address does not need to be configured on every router; only the router adjacent to clients requires it.
- D. DHCP helper address is configured on a router interface, not on switch trunk interfaces.
Question 39
What are two functions of a server on a network? (Choose two.)
Show answer and explanation
Correct answer: A, E. handles requests from multiple workstations at the same time; runs applications that send and retrieve data for workstations that make requests
A server's core role on a network is to listen for and service client requests: it can process requests from many workstations simultaneously and it runs the applications/services (file, web, database, mail) that store, send, and retrieve data on behalf of the clients that request it. Both A and E describe this client/server request-response function.
Why the other options are wrong
- B. Redundancy can be achieved many ways (hardware clustering, load balancing, replication, backup power), not exclusively through virtual server clustering.
- C. Servers are commonly deployed in closets, branch offices, colocation, and multi-tenant clouds, not solely in single-client data centers, and the redundancy claim is again too absolute.
- D. Servers with different operating systems interoperate freely using standard network protocols such as TCP/IP, HTTP, and SMB.
Question 40
What is a zero-day exploit?
Show answer and explanation
Correct answer: C. It is when a new network vulnerability is discovered before a fix is available.
A zero-day exploit occurs when a software vulnerability is discovered and exploited before the vendor releases a patch or fix. The term 'zero-day' refers to the fact that developers have had zero days to fix the vulnerability.
Why the other options are wrong
- A. Describes a DDoS attack, which floods network resources but is not a zero-day exploit.
- B. Describes SQL injection, a specific attack type unrelated to zero-day timing.
- D. Describes a man-in-the-middle attack, which is a separate attack class independent of patch availability.
Question 41
Which service is missing when RADIUS is selected to provide management access to the WLC?
Show answer and explanation
Correct answer: D. confidentiality
RADIUS provides authentication, authorization, and accounting (AAA) but does NOT provide confidentiality or encryption for the management session itself. While RADIUS can authenticate users for WLC access, the subsequent management traffic may not be encrypted by RADIUS alone.
Why the other options are wrong
- A. RADIUS provides authorization as part of its AAA functionality.
- B. RADIUS provides authentication, which is its primary function.
- C. RADIUS provides accounting through its logging and session tracking capabilities.
Question 42
What is a requirement for nonoverlapping Wi-Fi channels?
Show answer and explanation
Correct answer: B. discontinuous frequency ranges
Non-overlapping Wi-Fi channels require discontinuous frequency ranges to avoid interference. In the 2.4 GHz band, channels 1, 6, and 11 are non-overlapping because they are separated by 25 MHz center-to-center spacing, with each channel being 22 MHz wide. This frequency separation ensures minimal interference between adjacent access points.
Why the other options are wrong
- A. Security settings have no bearing on whether channels overlap or not.
- C. Different SSIDs can operate on the same channel without preventing overlap.
- D. Transmission speeds do not determine channel overlap; frequency ranges do.
Question 43
What are two benefits of using VTP in a switching environment? (Choose two.)
Show answer and explanation
Correct answer: C, E. It maintains VLAN consistency across a switched network; It allows VLAN information to be automatically propagated throughout the switching environment.
VTP provides two main benefits: it maintains VLAN consistency across a switched network by synchronizing VLAN databases (option C), and it automatically propagates VLAN information throughout the switching environment (option E). This reduces manual VLAN configuration and ensures all switches have consistent VLAN definitions.
Why the other options are wrong
- A. Reading frame tags is a function of trunk ports and 802.1Q tagging, not VTP.
- B. VTP does not automatically assign ports to VLANs; ports must be manually assigned.
- D. Multiple VLANs using a single interface is a trunk function, not a VTP benefit.
Question 44
Which command should you enter to verify the priority of a router in an HSRP group?
Show answer and explanation
Correct answer: D. show standby
The show standby command displays HSRP status information including priority, state, active router, and standby router details. This is the correct command to verify router priority in an HSRP group.
Why the other options are wrong
- A. show hsrp is not a valid command syntax; the correct command is show standby.
- B. show sessions displays session information, not HSRP priority.
- C. show interfaces displays interface status but not HSRP-specific priority information.
Question 45
Which device permits or denies network traffic based on a set of rules?
Show answer and explanation
Correct answer: B. firewall
A firewall is the network device specifically designed to permit or deny traffic based on configured security rules and policies. It acts as a gatekeeper between networks, inspecting traffic and making access control decisions.
Why the other options are wrong
- A. A switch forwards frames based on MAC addresses and does not make permit/deny decisions based on rules.
- C. A wireless controller manages wireless access points but does not primarily enforce traffic rules.
- D. An access point provides wireless connectivity but does not filter traffic based on security rules.
Question 46
An administrator must secure the WLC from receiving spoofed association requests. Which steps must be taken to configure the WLC to restrict the requests and force the user to wait 10 ms to retry an association request?
Show answer and explanation
Correct answer: D. Enable the Protected Management Frame service and set the Comeback timer to 10.
Protected Management Frame (PMF) service protects against spoofed association requests and management frame attacks. The Comeback timer specifies the duration a client must wait before retrying an association after rejection, measured in milliseconds. Setting this to 10 enforces the 10 ms retry delay requirement.
Why the other options are wrong
- A. MAC filtering and SA Query timeout do not address spoofed association request protection.
- B. 802.1x Layer 2 security is for authentication, not spoofed association prevention; Comeback timer is correct for retry delay but not the right mechanism.
- C. SA Teardown Protection addresses association teardown attacks, not spoofed association requests; SA Query timeout is not the correct timer for retry delays.
Question 47
By default, how long will the switch continue to know a workstation MAC address after the workstation stops sending traffic?
Show answer and explanation
Correct answer: B. 300 seconds
The default MAC address aging time on Cisco switches is 300 seconds (5 minutes). After this time period, if a device does not send any traffic, its MAC address entry is removed from the MAC address table. This allows the table to remain current and prevents stale entries.
Why the other options are wrong
- A. 200 seconds is not the standard default aging time.
- C. 600 seconds is longer than the typical default.
- D. 900 seconds is longer than the typical default.
Question 48
When a client and server are not on the same physical network, which device is used to forward requests and replies between client and server for DHCP?
Show answer and explanation
Correct answer: B. DHCP relay agent
A DHCP relay agent is a network device that forwards DHCPDISCOVER messages and other DHCP communications between clients and servers when they reside on different physical networks or subnets. This allows DHCP requests to reach a server that is not directly on the client's local network segment.
Why the other options are wrong
- A. DHCPOFFER is a DHCP message type, not a device.
- C. The DHCP server responds to requests but does not forward between networks.
- D. DHCPDISCOVER is a DHCP message type, not a forwarding device.
Question 49
What are two reasons for an engineer to configure a floating static route? (Choose two.)
Show answer and explanation
Correct answer: A, C. to enable fallback static routing when the dynamic routing protocol fails; to automatically route traffic on a secondary path when the primary path goes down
Floating static routes have two primary purposes: (A) they enable fallback routing by using a higher administrative distance, so they only become active when the primary dynamic route fails; and (C) they automatically route traffic on a secondary path when the primary path goes down because the higher AD causes the route to be inactive until the primary fails. These are the core use cases for floating static routes in network redundancy.
Why the other options are wrong
- B. Source-based routing requires policy-based routing or similar mechanisms, not floating static routes.
- D. Load balancing via static routing uses equal-cost multipath, not floating routes with different administrative distances.
- E. Controlling return path requires route manipulation on other routers or policy-based mechanisms, not floating static routes.
Question 50
Which key function is provided by the data plane?
Show answer and explanation
Correct answer: D. Forwarding traffic to the next hop
The primary function of the data plane is forwarding traffic to the next hop based on forwarding information already established by the control plane. This is the core operational responsibility of the data plane in packet forwarding.
Why the other options are wrong
- A. Originating packets is typically an end-host function, not a primary data plane function.
- B. Exchanging routing table data is a control plane function.
- C. Making routing decisions based on routing protocols is a control plane function; the data plane executes decisions.
Question 51
Which statement about Cisco Discovery Protocol is true?
Show answer and explanation
Correct answer: A. It is a Cisco-proprietary protocol.
Cisco Discovery Protocol (CDP) is a proprietary protocol developed by Cisco and runs only on Cisco devices. It operates at the data link layer (Layer 2) and allows Cisco devices to discover and share information with directly connected Cisco neighbors including routers, switches, and other Cisco equipment.
Why the other options are wrong
- B. CDP runs at the data link layer (Layer 2), not the network layer (Layer 3).
- C. CDP is proprietary to Cisco and cannot discover non-Cisco devices like third-party firewalls.
- D. CDP runs only on the data link layer, not on both the physical and data link layers.
Question 52
A network administrator must enable DHCP services between two sites. What must be configured for the router to pass DHCPDISCOVER messages on to the server?
Show answer and explanation
Correct answer: B. a DHCP Relay Agent
A DHCP Relay Agent must be configured on the router to forward DHCPDISCOVER and other DHCP broadcast messages from clients on one network segment to a DHCP server located on another network segment. This enables DHCP services to function across multiple sites or subnets.
Why the other options are wrong
- A. DHCP Binding refers to the mapping of IP addresses to devices, not forwarding.
- C. DHCP Snooping is a security feature that monitors DHCP traffic, not a relay mechanism.
- D. A DHCP Pool defines available addresses on a server, not relay functionality.
Question 53
When a site-to-site VPN is used, which protocol is responsible for the transport of user data?
Show answer and explanation
Correct answer: A. IPsec
IPsec is responsible for the transport and encryption of user data in a site-to-site VPN. It provides confidentiality, integrity, and authentication for data packets. IKEv1 and IKEv2 are key exchange protocols used to establish IPsec security associations, not for data transport. MD5 is a hashing algorithm, not a VPN transport protocol.
Why the other options are wrong
- B. IKEv1 is a key exchange protocol for establishing VPN tunnels, not for user data transport
- C. MD5 is a cryptographic hash function, not a VPN transport protocol
- D. IKEv2 is a key exchange protocol for security association negotiation, not data transport
Question 54
Which two QoS tools provide congestion management? (Choose two.)
Show answer and explanation
Correct answer: A, E. CBWFQ; PQ
CBWFQ (Class-Based Weighted Fair Queuing) and PQ (Priority Queuing) both provide congestion management by determining how queued packets are handled when congestion occurs. CBWFQ allocates bandwidth based on traffic classes, while PQ prioritizes traffic based on strict priority levels. Both actively manage queued packets during congestion.
Why the other options are wrong
- B. FRTS (Frame Relay Traffic Shaping) shapes traffic but does not manage congestion through queuing.
- C. CAR (Committed Access Rate) provides traffic policing/rate limiting, not congestion management.
- D. PBR (Policy-Based Routing) makes routing decisions based on policies, not congestion management.
Question 55
Which level of severity must be set to get informational syslogs?
Show answer and explanation
Correct answer: D. debug
The debug severity level (level 7) is the lowest severity level in the syslog severity scale and captures the most detailed information, including informational messages. It provides the comprehensive logging needed to capture all informational syslogs along with debugging details.
Why the other options are wrong
- A. Alert (level 1) is a higher severity level that filters out informational messages.
- B. Critical (level 2) is too high a severity threshold to capture informational messages.
- C. Notice (level 5) is higher than debug and does not capture all informational details.
Question 56
A packet is destined for 10.10.1.22. Which static route does the router choose to forward the packet?
Show answer and explanation
Correct answer: B. ip route 10.10.1.20 255.255.255.252 10.10.255.1
The router chooses the route with the longest prefix match. For destination 10.10.1.22: Option A covers 10.10.1.0-15 (/28), Option B covers 10.10.1.20-23 (/30), Option C covers 10.10.1.16-19 (/30), and Option D covers 10.10.1.20-21 (/31). The IP 10.10.1.22 matches options A and B, but B has a /30 mask (longer) compared to A's /28 mask, so B is selected by longest prefix match.
Why the other options are wrong
- A. While this matches, it has a /28 prefix which is shorter than the /30 in option B.
- C. This covers 10.10.1.16-19, which does not include 10.10.1.22.
- D. This covers 10.10.1.20-21, which does not include 10.10.1.22.
Question 57
Which action is taken by the data plane within a network device?
Show answer and explanation
Correct answer: B. Forwards traffic to the next hop.
The data plane moves transit packets through the device, and its job is forwarding traffic to the next hop. Building routing information belongs to the control plane, and CLI access belongs to the management plane.
Why the other options are wrong
- A. Building a routing table from a routing protocol is a control plane function.
- C. The forwarding table is built from control plane information, and the defining data plane action tested here is forwarding traffic to the next hop.
- D. CLI access is a management plane function.
Question 58
What are two reasons to implement IPv4 private addressing on a network? (Choose two.)
Show answer and explanation
Correct answer: A, E. To enable internal applications to treat the private IPv4 addresses as unique; To conserve global unique IPv4 addresses
Private IPv4 addressing allows internal applications to treat addresses as unique within the organization (option A), and it conserves the limited pool of globally unique public IPv4 addresses (option E). Option B is incorrect because private addressing actually complicates renumbering across merged networks. Option C is wrong because private addresses don't expand routing tables. Option D is misleading because private addressing isn't a primary denial-of-service protection mechanism.
Why the other options are wrong
- B. Private addressing can complicate network merging due to potential address overlap rather than facilitate it.
- C. Private addresses don't expand routing tables; they reduce the need for globally routable entries.
- D. While private addresses provide some isolation, they are not a primary DoS protection mechanism; that requires firewalls and other security measures.
Question 59
What are two roles of Domain Name Services (DNS)? (Choose two.)
Show answer and explanation
Correct answer: D, E. enables applications to identify resources by name instead of IP address; allows a single host name to be shared across more than one IP address
DNS enables name-to-IP address resolution, allowing applications to locate resources by hostname rather than memorizing IP addresses (option D). Additionally, DNS supports load balancing and redundancy by allowing a single hostname to resolve to multiple IP addresses (option E), improving reliability and performance.
Why the other options are wrong
- A. DNS uses hierarchical, not flat structure
- B. DNS does not encrypt traffic; that is TLS/SSL or VPN functionality
- C. DNS does not provide security by hiding IPs; FQDNs are publicly resolvable
Question 60
For what two purposes does the Ethernet protocol use physical addresses?
Show answer and explanation
Correct answer: A, E. to uniquely identify devices at Layer 2; to allow communication between different devices on the same network
Ethernet physical (MAC) addresses serve two primary purposes: (A) they uniquely identify devices at Layer 2 to distinguish one device from another on the network, and (E) they enable communication between different devices on the same network by providing the addressing mechanism for frames on the local link. These are the core functions of MAC addressing in Ethernet.
Why the other options are wrong
- B. MAC addresses do not enable communication across different networks; that is the purpose of Layer 3 IP addresses.
- C. MAC addresses do not differentiate frame types from packets; that is determined by protocol fields.
- D. MAC addresses do not establish priority for transmission; that is handled by other mechanisms like QoS.
- F. MAC addresses are not used for remote device detection; ARP is used to discover MAC addresses of known IP addresses on the same network.
Question 61
Aside from discarding, which two states does the switch port transition through while using RSTP (802.1w)? (Choose two.)
Show answer and explanation
Correct answer: D, E. learning; forwarding
RSTP (802.1w) uses five port states: discarding, learning, forwarding, disabled, and blocking (for compatibility). However, the question asks for states aside from discarding. The two main operational states that ports transition through in RSTP are learning and forwarding. A port moves through these states to learn MAC addresses and eventually forward user data.
Why the other options are wrong
- A. Blocking is a legacy STP state; RSTP consolidates blocking, disabled, and listening into 'discarding' state.
- B. Speaking is not a standard STP or RSTP port state.
- C. Listening is a legacy STP state; RSTP eliminated it in favor of the discarding state.
Question 62
Which value can you modify to configure a specific interface as the preferred forwarding interface?
Show answer and explanation
Correct answer: B. The port priority
Port priority is the configurable value used in STP to determine which interface becomes the preferred forwarding interface. When multiple ports have the same cost to the root bridge, the port with the lower priority value is selected. Port priority ranges from 0-240 (in multiples of 16) and can be modified per interface to influence port selection.
Why the other options are wrong
- A. The interface number is a physical identifier and cannot be modified to affect STP port selection.
- C. VLAN priority affects traffic prioritization, not STP port selection for forwarding.
- D. Hello time is a timer value affecting BPDU transmission frequency, not individual port forwarding preference.
Question 63
How does a Cisco Unified Wireless Network respond to Wi-Fi channel overlap?
Show answer and explanation
Correct answer: C. It analyzes client load and background noise and dynamically assigns a channel.
Cisco Unified Wireless Networks use dynamic channel assignment through features like Cisco CleanAir and Radio Resource Management (RRM). The system analyzes client load, interference, background noise, and neighboring APs to automatically select optimal channels, reducing overlap and improving performance. This is a core capability of enterprise wireless controllers.
Why the other options are wrong
- A. While administrators can assign channels manually, the question asks specifically about how the network responds to overlap, not manual configuration options.
- B. Manufacturer segregation is not a standard response mechanism for channel overlap in Cisco systems.
- D. Automatic alternation between bands is not the primary response mechanism; RRM makes intelligent per-AP channel decisions based on actual environmental analysis.
Question 64
What is a function performed by a web server?
Show answer and explanation
Correct answer: D. provide an application that is transmitted over HTTP
A web server's primary function is to serve web content, applications transmitted over HTTP/HTTPS protocols to client browsers. Option A describes email servers, option B describes file servers with FTP access, and option C describes authentication/authorization servers or identity management systems. Web servers specifically host and deliver HTTP-based applications.
Why the other options are wrong
- A. Email sending and retrieval is the function of mail servers, not web servers.
- B. File storage and FTP access is the function of FTP servers, not web servers.
- C. User authentication and authorization is typically handled by directory services or identity servers, not web servers.
Question 65
What is the difference regarding reliability and communication type between TCP and UDP?
Show answer and explanation
Correct answer: D. TCP is reliable and is a connection-oriented protocol; UDP is not reliable and is a connectionless protocol.
TCP (Transmission Control Protocol) is reliable, ensuring all data is delivered in order without corruption, and is connection-oriented, requiring a three-way handshake to establish and terminate connections. UDP (User Datagram Protocol) is not reliable, it offers best-effort delivery without guarantees, and is connectionless, sending datagrams without establishing a connection first.
Why the other options are wrong
- A. TCP is connection-oriented, not connectionless; UDP is connectionless, not connection-oriented.
- B. Both statements are reversed from the correct characterization.
- C. TCP is connection-oriented, not connectionless; UDP is not reliable, not reliable.
Question 66
Which function is performed by the collapsed core layer in a two-tier architecture?
Show answer and explanation
Correct answer: A. enforcing routing policies
In a two-tier (collapsed core) architecture, the core layer combines distribution and core functions, with the primary responsibility of enforcing routing policies and providing high-speed connectivity between the access and external networks. Option A correctly identifies this policy enforcement role. Option B (marking traffic) is typically an access layer function. Option C (security policies) is primarily an edge or distributed function, not core. Option D (attaching users) is an access layer responsibility, not core.
Why the other options are wrong
- B. Marking traffic for QoS policies is typically performed at the access or edge layer.
- C. Applying granular security policies is usually an access or distribution layer function.
- D. Attaching end users to the network is an access layer function, not a core layer function.
Question 67
What occurs to frames during the process of frame flooding?
Show answer and explanation
Correct answer: C. Frames are sent to every port on the switch in the same VLAN except from the originating port.
During frame flooding, when a switch does not have a MAC address table entry for the destination, it sends frames to every port on the switch in the same VLAN as the originating port, except the originating port itself. This prevents unnecessary flooding to VLANs where the frame is not needed and avoids immediate loops by not sending back to the source port.
Why the other options are wrong
- A. Frames are not sent to ports in other VLANs; flooding respects VLAN boundaries.
- B. When a MAC address entry exists in the table, frames are sent to that specific port, not flooded to all ports.
- D. The originating port is excluded from flooding; frames go to every other port in the same VLAN.
Question 68
How does authentication differ from authorization?
Show answer and explanation
Correct answer: B. Authentication verifies the identity of a person accessing a network, and authorization determines what resource a user can access.
Authentication is the process of verifying a user's identity (who they are), typically through credentials like username and password. Authorization is the process of determining what resources an authenticated user is allowed to access (what they can do). These are distinct security functions that work together in access control.
Why the other options are wrong
- A. The definitions are reversed; authentication verifies identity, not records resource access.
- C. Both definitions are incorrect and reversed from their actual meanings.
- D. Authorization does not create syslog messages; that is logging functionality separate from authorization.
Question 69
Which command prevents passwords from being stored in the configuration as plain text on a router or switch?
Show answer and explanation
Correct answer: C. service password-encryption
The 'service password-encryption' command applies type 7 encryption to all passwords stored in the running configuration, preventing them from being displayed as plain text. This is a global encryption service for configuration passwords.
Why the other options are wrong
- A. Enable secret hashes the enable password but doesn't encrypt all configuration passwords.
- B. Enable password stores passwords in plain text without the service encryption command.
- D. This syntax is incorrect and doesn't represent a valid encryption command.
Question 70
Which MAC address is recognized as a VRRP virtual address?
Show answer and explanation
Correct answer: A. 0000.5E00.010a
VRRP (Virtual Router Redundancy Protocol) uses a reserved MAC address range 0000.5E00.0100 to 0000.5E00.01FF, where the last octet is the VRRP group ID. The MAC address 0000.5E00.010a corresponds to VRRP group 10 (0x0a in hex). This is the standard IANA-assigned MAC address range for VRRP virtual routers.
Why the other options are wrong
- B. 0005.3709.8968 is not a VRRP reserved MAC address.
- C. 0000.0C07.AC99 is a Cisco proprietary MAC address used for HSRP (Hot Standby Router Protocol), not VRRP.
- D. 0007.C070.AB01 is not a VRRP reserved MAC address.
Question 71
What are two requirements for an HSRP group? (Choose two.)
Show answer and explanation
Correct answer: A, B. exactly one active router; one or more standby routers
An HSRP (Hot Standby Router Protocol) group requires exactly one active router that forwards traffic using the virtual IP address, and one or more standby routers that monitor the active router and take over if it fails. The active router is the primary forwarder, while standby routers remain ready to assume the role. There is no concept of 'backup virtual routers' or 'standby active routers' in HSRP terminology.
Why the other options are wrong
- C. HSRP does not use the term 'backup virtual routers'; standby routers serve this function.
- D. There is no role called 'standby active router' in HSRP; routers are either active or standby.
- E. HSRP requires one or more standby routers, not exactly one backup virtual router.
Question 72
Which two statements about the purpose of the OSI model are accurate? (Choose two.)
Show answer and explanation
Correct answer: A, B. Defines the network functions that occur at each layer; Facilitates an understanding of how information travels throughout a network
The two accurate purposes of the OSI model are: (A) it defines the network functions that occur at each layer, providing a structured framework for understanding networking, and (B) it facilitates an understanding of how information travels throughout a network by breaking the communication process into seven distinct layers. These are the foundational purposes of the OSI reference model.
Why the other options are wrong
- C. Changes in one layer can impact other layers; the layers are interdependent, not completely isolated.
- D. The OSI model is a conceptual framework; it does not directly ensure reliable data delivery, that is the responsibility of protocols implemented at specific layers.
Question 73
An engineer is configuring router R1 with an IPv6 static route for prefix 2019:C15C:0CAF:E001::/64. The next hop must be 2019:C15C:0CAF:E002::1. The route must be reachable via the R1 Gigabit 0/0 interface. Which command configures the designated route?
Show answer and explanation
Correct answer: D. R1(config)#ipv6 route 2019:C15C:0CAF:E001::/64 2019:C15C:0CAF:E002::1
IPv6 static routes are configured in global configuration mode using the ipv6 route command with the destination prefix and next-hop address. Option D correctly uses ipv6 route (not ip route) from the config prompt (not config-if) and specifies the next-hop IPv6 address 2019:C15C:0CAF:E002::1.
Why the other options are wrong
- A. Uses 'ip route' instead of 'ipv6 route' for IPv6, and specifies interface instead of next-hop address.
- B. Uses 'ip route' instead of 'ipv6 route' for IPv6 routing configuration.
- C. Uses config-if prompt instead of config prompt, and omits the interface specification if using next-hop only.
Question 74
When an access point is seeking to join wireless LAN controller, which message is sent to the AP-Manager interface?
Show answer and explanation
Correct answer: D. Discovery request
When an access point seeks to join a wireless LAN controller, it sends a Discovery Request message to the AP-Manager interface. This is the initiation message from the AP to discover and locate the WLC. The WLC then responds with a Discovery Response, but the question asks which message is SENT TO the AP-Manager interface, which is the Discovery Request from the AP.
Why the other options are wrong
- A. Discovery Response is sent FROM the controller to the AP, not TO the AP-Manager interface.
- B. DHCP Request is used for IP address assignment, not for AP-to-controller discovery.
- C. DHCP Discover is the initial DHCP message, not specific to AP controller joining.
Question 75
Router A learns the same route from two different neighbors; one of the neighbor routers is an OSPF neighbor, and the other is an EIGRP neighbor. What is the administrative distance of the route that will be installed in the routing table?
Show answer and explanation
Correct answer: B. 90
EIGRP has an administrative distance of 90, while OSPF has an administrative distance of 110. When Router A receives the same route from both protocols, it will select the EIGRP route because EIGRP has the lower AD value. Therefore, the route installed in the routing table will have an AD of 90.
Why the other options are wrong
- A. 20 is the AD for EIGRP summary routes or iBGP, not standard EIGRP.
- C. 110 is the AD for OSPF, which is higher than EIGRP's AD of 90, so OSPF would not be selected.
- D. 115 is the AD for OSPF external routes, not relevant to this scenario.
Question 76
Which two conditions must be met before SSH operates normally on a Cisco IOS switch? (Choose two.)
Show answer and explanation
Correct answer: D, E. The switch must be running a k9 (crypto) IOS image; The ip domain-name command must be configured on the switch.
For SSH to operate normally on a Cisco IOS switch, two conditions must be met: the switch must be running a k9 (crypto) IOS image (D) which contains cryptographic algorithms needed for SSH encryption, and the ip domain-name command must be configured (E) because the switch uses this domain name to generate RSA key pairs which are essential for SSH operation. IP routing, console passwords, and Telnet status are not requirements.
Why the other options are wrong
- A. IP routing is not required for SSH to function on a switch
- B. A console password is not a requirement for SSH operation
- C. Telnet does not need to be disabled; SSH and Telnet can coexist
Question 77
Where does a switch maintain DHCP snooping information?
Show answer and explanation
Correct answer: D. In the binding database
DHCP snooping maintains information about trusted DHCP servers, client IP-to-MAC bindings, and lease information in the binding database. This database is used to validate DHCP messages and prevent unauthorized DHCP servers. The CAM table stores MAC addresses, the frame forwarding database is a general term not specific to DHCP, and the MAC address table does not store DHCP binding information.
Why the other options are wrong
- A. The CAM table stores MAC address-to-port mappings, not DHCP binding information.
- B. The frame forwarding database is a generic term and does not specifically store DHCP snooping data.
- C. The MAC address table is for Layer 2 forwarding decisions, not DHCP bindings.
Question 78
Which technique can you use to route IPv6 traffic over an IPv4 infrastructure?
Show answer and explanation
Correct answer: B. 6 to 4 tunneling
6to4 tunneling is a technique that encapsulates IPv6 packets within IPv4 packets to allow IPv6 traffic to traverse IPv4 infrastructure. It automatically creates tunnels by embedding IPv6 addresses within IPv4 addresses, enabling communication between IPv6 networks across IPv4 backbones.
Why the other options are wrong
- A. NAT translates IPv4 addresses, not a method to route IPv6 over IPv4.
- C. L2TPv3 is a Layer 2 tunneling protocol, not specifically designed for IPv6-over-IPv4 routing.
- D. Dual-stack runs IPv4 and IPv6 simultaneously on the same infrastructure, not a tunneling technique.
Question 79
Which security program element involves installing badge readers on data-center doors to allow workers to enter and exit based on their job roles?
Show answer and explanation
Correct answer: A. physical access control
Physical access control involves using badge readers, key cards, locks, and other mechanisms to restrict physical access to facilities based on authorization and job role. Badge readers on data-center doors are a direct example of physical access control systems. Biometrics uses biological traits like fingerprints, role-based access control is a software/system authorization concept, and multifactor authentication is an identity verification mechanism, none of which specifically describe badge reader door access.
Why the other options are wrong
- B. Biometrics uses biological characteristics like fingerprints or iris scans, not badge readers.
- C. Role-based access control is a software authorization concept, not a physical access mechanism.
- D. Multifactor authentication verifies identity through multiple factors, not through badge readers on doors.
Question 80
What does physical access control regulate?
Show answer and explanation
Correct answer: A. access to networking equipment and facilities
Physical access control regulates who can physically enter and access networking equipment, facilities, and data centers. This includes badge access, locks, and surveillance to prevent unauthorized physical access to critical infrastructure.
Why the other options are wrong
- B. This describes logical access control to server resources, not physical access control.
- C. This describes network-based logical access control via VLANs or business segmentation.
- D. This describes logical access control to systems and files, not physical facility access.
Question 81
What is a characteristic of a SOHO network?
Show answer and explanation
Correct answer: C. enables multiple users to share a single broadband connection
A SOHO (Small Office/Home Office) network is characterized by its small size and typical feature of enabling multiple users to share a single broadband connection from an ISP. Option A describes enterprise architectures with redundancy, option B describes a full mesh topology used in larger networks, and option D describes large-scale networks serving thousands of users.
Why the other options are wrong
- A. SOHO networks are small and simple, not requiring three tiers of devices.
- B. Full mesh topologies are not typical of SOHO networks; they use simple star topologies.
- D. SOHO networks serve very few users, typically under 10, not 1000 or more.
Question 82
In a CDP environment, what happens when the CDP interface on an adjacent device is configured without an IP address?
Show answer and explanation
Correct answer: C. CDP operates normally, but it cannot provide IP address information for that neighbor
CDP operates at Layer 2 and does not depend on IP addresses to function. It sends advertisements via LLDP frames that are independent of IP configuration. However, CDP can only report information about interfaces that are configured; if an interface has no IP address, CDP will still advertise the interface but cannot provide IP address information for that neighbor.
Why the other options are wrong
- A. CDP operates normally without IP addresses; it functions at Layer 2
- B. CDP does not use IP addresses from other interfaces as a workaround
- D. CDP provides other information beyond just IP addresses, such as device type and model
Question 83
What is a capability of FTP in network management operations?
Show answer and explanation
Correct answer: B. uses separate control and data connections to move files between server and client
FTP fundamentally operates using separate control and data connections. The control connection (TCP port 21) handles commands and responses, while the data connection (TCP port 20 in active mode or dynamic ports in passive mode) transfers the actual file data. This is a core architectural feature that distinguishes FTP. Options A, C, and D are incorrect: FTP does not offer proprietary session layer support, does not encrypt data (that's what SFTP/SSH does), and uses TCP not UDP.
Why the other options are wrong
- A. FTP does not offer proprietary session layer support
- C. FTP does not encrypt data; SFTP does that
- D. FTP uses TCP, not UDP, and devices are not directly connected in the traditional sense
Question 84
An engineer must configure a WLAN using the strongest encryption type for WPA2-PSK. Which cipher fulfills the configuration requirement?
Show answer and explanation
Correct answer: B. AES
AES (Advanced Encryption Standard) is the strongest cipher for WPA2-PSK. It is the mandatory encryption standard for WPA2 and provides robust 128-bit or 256-bit encryption. WEP is deprecated and weak, RC4 is a stream cipher with vulnerabilities, and TKIP is an older cipher that was superseded by AES in WPA2.
Why the other options are wrong
- A. WEP is deprecated and insecure, no longer recommended
- C. RC4 has cryptographic weaknesses and is not suitable for modern security
- D. TKIP is weaker than AES and was replaced as the standard for WPA2
Question 85
What is the function of the control plane?
Show answer and explanation
Correct answer: A. It exchanges routing table information.
The control plane is responsible for exchanging routing information between network devices using routing protocols such as OSPF, BGP, and EIGRP. This function creates the routing tables and forwarding information that the data plane uses to make forwarding decisions.
Why the other options are wrong
- B. CLI access is a management plane function.
- C. FIB lookup is a data plane function, not control plane.
- D. Forwarding traffic is a data plane function, not control plane.
Question 86
In which two ways does a password manager reduce the chance of a hacker stealing a user's password? (Choose two.)
Show answer and explanation
Correct answer: A, E. It encourages users to create stronger passwords; It protects against keystroke logging on a compromised device or web site
Password managers reduce theft risk by encouraging stronger, more complex passwords that users would not create manually (A), and by protecting against keystroke logging through auto-fill functionality that bypasses keyboard input on compromised systems (E). These two mechanisms directly address common password theft vectors.
Why the other options are wrong
- B. Password managers do not use internal firewalls; they rely on encryption and master passwords.
- C. Storing on local workstations with antivirus doesn't specifically prevent password theft from hackers.
- D. Password managers don't provide a second authentication factor; they work with the user's authentication.
Question 87
Which networking function occurs on the data plane?
Show answer and explanation
Correct answer: D. forwarding remote client/server traffic
The data plane handles the actual forwarding of user traffic between hosts and networks (option D). Processing SSH management traffic (option A) occurs on the management plane. OSPF Hello packets (option B) and spanning-tree elections (option C) are control plane functions that manage network topology and routing decisions, not user data forwarding.
Why the other options are wrong
- A. SSH management traffic is part of the management plane, not data plane.
- B. OSPF Hello packets are control plane routing protocol messages.
- C. Spanning-tree elections are control plane functions for loop prevention.
Question 88
Which function is performed by DHCP snooping?
Show answer and explanation
Correct answer: B. rate-limits certain traffic
DHCP snooping rate-limits DHCP traffic to prevent DHCP starvation attacks and DoS attacks targeting DHCP services. It monitors DHCP messages on untrusted ports and only allows messages from trusted DHCP servers, thereby limiting the rate and source of DHCP traffic. It does not listen to multicast for packet forwarding, does not propagate VLAN information, and while it provides some DoS mitigation for DHCP specifically, rate-limiting is its primary function.
Why the other options are wrong
- A. DHCP snooping does not listen to multicast traffic for general packet forwarding purposes.
- C. DHCP snooping does not propagate VLAN information between switches; that is VTP.
- D. While DHCP snooping provides mitigation against DHCP-based attacks, general DDoS mitigation is not its primary function.
Question 89
What occurs when PortFast is enabled on an interface that is connected to another switch?
Show answer and explanation
Correct answer: D. Spanning-tree fails to detect a switching loop increasing the likelihood of broadcast storms.
When PortFast is enabled on a port connected to another switch, the port bypasses STP convergence states and immediately forwards traffic. If that connection creates a loop, spanning-tree fails to detect it because the port never properly goes through STP negotiation, resulting in potential broadcast storms.
Why the other options are wrong
- A. PortFast does not accelerate root port recalculation; it actually bypasses proper STP operation.
- B. PortFast does not shut down ports that receive BPDUs; this describes BPDU guard behavior.
- C. PortFast has no relationship to VTP propagation.
Question 90
Which state is bypassed in Rapid PVST+ when PortFast is enabled on a port?
Show answer and explanation
Correct answer: C. learning
In Rapid PVST+, when PortFast is enabled on a port, the port transitions directly from the disabled state to the forwarding state, bypassing the learning state. The learning state is normally used to populate the MAC address table before forwarding frames. With PortFast enabled, the port assumes it connects to an end device (not another switch), so the learning phase is unnecessary and is skipped entirely. The port still technically passes through the listening state (formerly called blocking in traditional STP), but the learning state is the one explicitly bypassed by the PortFast feature in Rapid PVST+.
Why the other options are wrong
- A. Blocking is not the state bypassed; in Rapid PVST+ with PortFast, the port still observes listening (formerly blocking) briefly.
- B. Forwarding is the destination state, not a bypassed state; it is the state the port enters after learning is skipped.
- D. Discarding is a state in some STP variants but is not the primary state bypassed in Rapid PVST+ PortFast configuration.
Question 91
Which statements describe the routing protocol OSPF? (Choose three.)
Show answer and explanation
Correct answer: A, C, E. It supports VLSM; It confines network instability to one area of the network; It allows extensive control of routing updates.
OSPF correctly (A) supports VLSM (Variable Length Subnet Masking) for efficient address allocation, (C) confines network instability to one area preventing network-wide recalculations, and (E) allows extensive control of routing updates through various configuration options like areas, authentication, and metrics. Options B, D, and F are incorrect because OSPF operates within autonomous systems (not between them), reduces rather than increases overhead, and is more complex than RIP v2.
Why the other options are wrong
- B. OSPF routes within autonomous systems; BGP is used between autonomous systems.
- D. OSPF reduces routing overhead compared to distance-vector protocols like RIP.
- F. OSPF is significantly more complex to configure than RIP v2 due to areas and LSA mechanisms.
Question 92
An implementer is preparing hardware for virtualization to create virtual machines on a host. What is needed to provide communication between hardware and virtual machines?
Show answer and explanation
Correct answer: B. hypervisor
A hypervisor is the software layer that enables virtualization by abstracting hardware resources and allowing multiple virtual machines to run on a single physical host. It manages communication and resource allocation between the host hardware and virtual machines. A router connects networks, a switch connects devices on a network, and a straight cable is physical infrastructure, none provide the virtualization abstraction layer needed for VMs.
Why the other options are wrong
- A. A router connects separate networks, not required for VM-to-hardware communication.
- C. A switch connects devices on a LAN but doesn't provide virtualization capability.
- D. A straight cable is physical infrastructure but provides no virtualization or communication management.
Question 93
What is the difference in data transmission delivery and reliability between TCP and UDP?
Show answer and explanation
Correct answer: B. TCP requires the connection to be established before transmitting data. UDP transmits data at a higher rate without ensuring packet delivery.
TCP establishes a connection via three-way handshake before transmitting data and provides reliable, ordered delivery with error checking. UDP is connectionless and transmits data immediately without ensuring delivery, making it faster but unreliable. Option B accurately contrasts these fundamental differences.
Why the other options are wrong
- A. TCP does not transmit at higher rates (it is slower due to reliability overhead), and UDP does not retransmit lost data (it simply discards it).
- C. This reverses the protocols: UDP does not establish connections, and TCP uses the three-way handshake, not UDP.
- D. While UDP supports multicast/broadcast and TCP supports unicast, the claim that TCP transmits at higher rates is false; TCP is slower due to reliability mechanisms.
Question 94
What is one reason to implement LAG on a Cisco WLC?
Show answer and explanation
Correct answer: C. to provide link redundancy and load balancing
Link Aggregation Group (LAG) on a Cisco WLC provides link redundancy and load balancing by combining multiple physical links into a single logical link. This increases bandwidth capacity and provides failover protection if one physical link fails. The traffic can be distributed across multiple links, improving performance and reliability.
Why the other options are wrong
- A. LAG does not provide encryption or security for management frames; that requires separate protocols like HTTPS.
- B. LAG does not enable switch ports to use different VLANs; it aggregates links within the same VLAN configuration.
- D. LAG provides link redundancy but not specific stateful or link-state failover mechanisms.
Question 95
Which two IP addressing schemes provide internet access to users on the network while preserving the public IPv4 address space? (Choose two.)
Show answer and explanation
Correct answer: A, B. IPv6 addressing; PAT with private internal addressing
IPv6 addressing provides internet access with an enormous address space that doesn't deplete public IPv4 addresses. PAT (Port Address Translation) with private internal addressing allows multiple internal devices to share a single public IP, preserving the limited IPv4 address space. These are the two primary methods for providing internet access while protecting IPv4 resources.
Why the other options are wrong
- C. A single public Class A network uses public addresses directly, providing no conservation benefit.
- D. Private networks only have no internet access by definition.
- E. Custom addresses from ARIN are still public addresses and don't preserve the global pool.
Question 96
Which type of traffic is sent with pure IPsec?
Show answer and explanation
Correct answer: C. unicast messages from a host at a remote site to a server at headquarters
IPsec in its standard implementation supports unicast traffic, which includes messages from a single host to a single destination such as a remote site host communicating with a headquarters server. IPsec does not natively support multicast or broadcast traffic, and spanning-tree is a Layer 2 protocol that cannot traverse IPsec tunnels designed for Layer 3 traffic.
Why the other options are wrong
- A. Multicast traffic is not supported by standard IPsec.
- B. Broadcast packets (ARP, etc.) are Layer 2 and cannot be encapsulated in IPsec tunnels.
- D. Spanning-tree updates are Layer 2 protocol data units and cannot be transmitted through IPsec.
Question 97
Which three describe the reasons large OSPF networks use a hierarchical design? (Choose three.)
Show answer and explanation
Correct answer: A, B, E. to speed up convergence; to reduce routing overhead; to confine network instability to single areas of the network
Hierarchical OSPF design using areas provides three key benefits: (A) speeds up convergence by limiting the scope of LSA floods to specific areas rather than the entire network, (B) reduces routing overhead by minimizing the number of LSA updates and routing table entries each router must process, and (E) confines network instability to single areas so that topology changes in one area don't trigger full network recalculations. Options C, D, and F are not valid reasons for hierarchical OSPF design.
Why the other options are wrong
- C. Hierarchical design uses routers at all levels, not replacing them with switches for cost reduction.
- D. Hierarchical design doesn't increase bandwidth or directly decrease latency.
- F. Hierarchical design actually increases configuration complexity due to area configuration requirements.
Question 98
Which two statements about NTP operations are true? (Choose two.)
Show answer and explanation
Correct answer: A, B. NTP uses UDP over IP; Cisco routers can act as both NTP authoritative servers and NTP clients.
NTP uses UDP port 123 over IP for communication, making option A correct. Cisco routers have flexible NTP functionality and can operate as both NTP servers (using 'ntp master' command) and NTP clients (using 'ntp server' command), making option B correct. Options C and D are incorrect because they falsely restrict Cisco routers to only one role, and option E is incorrect because NTP does not use TCP.
Why the other options are wrong
- C. Cisco routers can act as both servers and clients, not only servers
- D. Cisco routers can act as both servers and clients, not only clients
- E. NTP uses UDP, not TCP
Question 99
R1 has learned route 192.168.12.0/24 via IS-IS, OSPF, RIP, and Internal EIGRP. Under normal operating conditions, which routing protocol is installed in the routing table?
Show answer and explanation
Correct answer: B. Internal EIGRP
When multiple routing protocols learn the same route, the protocol with the lowest administrative distance (AD) is installed in the routing table. EIGRP has an AD of 90 for internal routes, OSPF has 110, IS-IS has 115, and RIP has 120. Internal EIGRP with AD 90 is the lowest, so it wins and is installed in the routing table.
Why the other options are wrong
- A. IS-IS has an AD of 115, which is higher than EIGRP's 90, so it is not selected.
- C. RIP has an AD of 120, the highest among these protocols, so it is not selected.
- D. OSPF has an AD of 110, which is higher than EIGRP's 90, so it is not selected.
Question 100
What is the destination MAC address of a broadcast frame?
Show answer and explanation
Correct answer: B. ff:ff:ff:ff:ff:ff
The broadcast MAC address is ff:ff:ff:ff:ff:ff, which represents all 48 bits set to 1 in hexadecimal. This special address ensures that a frame is delivered to all devices on the local network segment, as every host recognizes this address as intended for them. This is the standardized broadcast address at Layer 2.
Why the other options are wrong
- A. This is not a valid broadcast address; it appears to be a unicast MAC.
- C. This is a unicast MAC address, not a broadcast address.
- D. This is a unicast MAC address, not a broadcast address.
- E. This is not a valid broadcast address; broadcast requires all bits set to 1.
Question 101
What is an appropriate use for private IPv4 addressing?
Show answer and explanation
Correct answer: D. on hosts that communicate only with other internal hosts
Private IPv4 addresses (RFC 1918) are designed for internal use only, on hosts that communicate with other internal hosts within an organization. This is their intended and appropriate use case.
Why the other options are wrong
- A. Private addresses cannot communicate bidirectionally with external hosts without NAT translation.
- B. While hosts may use private addresses to stream outbound, this is not the primary appropriate use.
- C. Public-facing interfaces must use publicly routable addresses, not private ones.
Question 102
Which interface mode must be configured to connect the lightweight APs in a centralized architecture?
Show answer and explanation
Correct answer: C. access
In a centralized lightweight AP architecture, the switches connecting to lightweight APs must configure those interfaces in access mode. Access mode is appropriate because each interface connects to a single device (the AP) and should belong to a single VLAN, unlike trunk ports which carry multiple VLANs.
Why the other options are wrong
- A. WLAN dynamic is not a standard interface mode designation.
- B. Trunk mode is used to carry multiple VLANs between switches, not for connecting to APs.
- D. Management mode is not a standard interface mode; management traffic uses access or trunk mode.
Question 103
Which command must be entered to configure a DHCP relay?
Show answer and explanation
Correct answer: D. ip helper-address
The 'ip helper-address' command configures a DHCP relay on a router interface, allowing DHCP requests from clients on that network segment to be forwarded to a DHCP server on a different network. Option B (ip dhcp pool) configures a DHCP server, not a relay. Option C (ip address dhcp) configures an interface to obtain its IP via DHCP. Option A is not a valid command.
Why the other options are wrong
- A. ip dhcp relay is not a valid command
- B. ip dhcp pool configures a DHCP server, not a relay
- C. ip address dhcp configures a client to get an IP, not a relay
Question 104
Which WPA3 enhancement protects against hackers viewing traffic on the Wi-Fi network?
Show answer and explanation
Correct answer: A. SAE encryption
SAE (Simultaneous Authentication of Equals) is a WPA3 enhancement that replaces the Pre-Shared Key (PSK) exchange mechanism and protects against hackers viewing traffic on the Wi-Fi network through eavesdropping on the handshake. TKIP is an older WPA cipher, scrambled encryption keys are not a standard WPA3 term, and AES is used in both WPA2 and WPA3.
Why the other options are wrong
- B. TKIP is an older WPA encryption method, not a WPA3 enhancement
- C. Scrambled encryption keys are not a defined WPA3 enhancement feature
- D. AES encryption is used in both WPA2 and WPA3, not unique to WPA3
Question 105
An engineer must configure neighbor discovery between the company router and an ISP. What is the next step to complete the configuration if the ISP uses a third-party router?
Show answer and explanation
Correct answer: A. Enable LLDP globally.
When configuring neighbor discovery between a company router and an ISP using a third-party router, LLDP (Link Layer Discovery Protocol) must be enabled globally on the company router. LLDP is a vendor-neutral protocol that works across different manufacturers' equipment, making it the appropriate choice for inter-company communications with third-party devices. CDP (Cisco Discovery Protocol) is Cisco-proprietary and may not be supported by the ISP's third-party equipment. Enabling LLDP globally ensures the router can discover and communicate with the ISP's router regardless of the manufacturer.
Why the other options are wrong
- B. Disabling CDP on gi0/0 alone does not enable neighbor discovery; LLDP must be actively enabled for third-party equipment compatibility.
- C. Enabling LLDP TLVs on the ISP router is the ISP's responsibility and not the next step for the company engineer to take on their own router.
- D. Disabling auto-negotiation is unrelated to neighbor discovery configuration and would not help establish discovery between routers.
Question 106
Which two statements are true about the command ip route 172.16.3.0 255.255.255.0 192.168.2.4? (Choose two.)
Show answer and explanation
Correct answer: A, E. It establishes a static route to the 172.16.3.0 network; It uses the default administrative distance.
The command 'ip route 172.16.3.0 255.255.255.0 192.168.2.4' creates a static route to the 172.16.3.0 network via next-hop 192.168.2.4. This uses the default administrative distance of 1 for static routes. Option A correctly identifies the destination network, and option E confirms the default AD is applied.
Why the other options are wrong
- B. 192.168.2.4 is the next-hop gateway, not the destination network.
- C. This route applies specifically to the 172.16.3.0 network, not unknown destinations.
- D. 192.168.2.4 is a next-hop address, not an interface address used for unknown traffic.
- F. Static routes have AD of 1 and are preferred over dynamic routes, so they are used first, not last.
Question 107
What are two recommendations for protecting network ports from being exploited when located in an office space outside of an IT closet? (Choose two.)
Show answer and explanation
Correct answer: D, E. implement port-based authentication; shut down unused ports
Unused ports should be shut down to prevent unauthorized access (E), and port-based authentication (802.1X) can be implemented to ensure only authorized devices connect (D). These two measures directly prevent physical port exploitation in unsecured office spaces.
Why the other options are wrong
- A. PortFast is used for spanning tree optimization, not port security in office spaces.
- B. Static ARP entries address ARP spoofing, not physical port exploitation.
- C. Fixed speed configuration doesn't prevent port exploitation or unauthorized access.
Question 108
A network engineer must configure two new subnets using the address block 10.70.128.0/19 to meet these requirements: • The first subnet must support 24 hosts. • The second subnet must support 472 hosts. • Both subnets must use the longest subnet mask possible from the address block. Which two configurations must be used to configure the new subnets and meet a requirement to use the first available address in each subnet for the router interfaces? (Choose two.)
Show answer and explanation
Correct answer: A, E. interface vlan 1148 ip address 10.70.148.1 255.255.254.0; interface vlan 155 ip address 10.70.155.65 255.255.255.224
Starting with 10.70.128.0/19 (64 total addresses in the /19 block). For 24 hosts, we need /27 (32 addresses, longest mask). For 472 hosts, we need /23 (512 addresses, longest mask). First subnet: 10.70.128.0/27 at 10.70.128.1. Second subnet starts after using /23: 10.70.130.0/23, but checking option D: 10.70.159.1/23 and option A: 10.70.148.1/23 are within range. Option A (10.70.148.1 /23) works for 472 hosts. Option E (10.70.155.65 /25) provides 128 addresses, sufficient for 24 hosts with longest possible mask in that segment.
Why the other options are wrong
- B. The /25 mask only provides 128 addresses but /27 is longer (more specific) for the 24-host requirement.
- C. /26 mask provides 64 addresses, acceptable for 24 hosts, but not the longest mask possible from the block allocation.
- D. While /23 works for 472 hosts, this address is not optimally positioned within the allocation scheme.
Question 109
A router has two static routes to the same destination network under the same OSPF process. How does the router forward packets to the destination if the net-hop devices are different?
Show answer and explanation
Correct answer: D. The router load-balances traffic over all routes to the destination.
When a router has multiple static routes to the same destination with equal metrics (same cost), it implements Equal Cost Multipath (ECMP) routing and load-balances traffic across all available routes. This distributes the traffic load among the multiple next-hop devices rather than selecting just one route.
Why the other options are wrong
- A. Route age is not a criterion for selecting between equal-cost routes.
- B. IP address order is not used for load-balancing decisions in ECMP.
- C. MAC addresses are not used in routing decisions at the network layer.
Question 110
When a floating static route is configured, which action ensures that the backup route is used when the primary route fails?
Show answer and explanation
Correct answer: D. The floating static route must have a higher administrative distance than the primary route so it is used as a backup
A floating static route serves as a backup by having a higher administrative distance than the primary route. When the primary route fails, the floating static route becomes active because routers prefer routes with lower administrative distances. By making the backup route have a higher AD, it remains in the routing table but unused until the primary fails.
Why the other options are wrong
- A. This is backwards; the primary route should have the lower AD to be preferred.
- B. The default-information originate command is used for default route propagation in OSPF, not for floating static route configuration.
- C. A floating static route must have a higher AD than the primary, not lower, to function as a backup.
Question 111
Which QoS traffic handling technique retains excess packets in a queue and reschedules these packets for later transmission when the configured maximum bandwidth has been surpassed?
Show answer and explanation
Correct answer: D. traffic shaping
Traffic shaping queues excess packets and reschedules them for later transmission when bandwidth limits are exceeded. This smooths traffic flow by delaying packets rather than dropping them. Traffic policing (option A) drops or marks excess packets. Weighted random early detection (option B) is a congestion avoidance mechanism that randomly drops packets before congestion occurs. Traffic prioritization (option C) determines which packets are serviced first but doesn't queue and reschedule.
Why the other options are wrong
- A. Traffic policing drops excess packets rather than queueing them
- B. WRED is a congestion avoidance mechanism, not a queueing and rescheduling mechanism
- C. Traffic prioritization determines service order but doesn't queue and reschedule
Question 112
If all OSPF routers in a single area are configured with the same priority value, what value does a router use for the OSPF router ID in the absence of a loopback interface?
Show answer and explanation
Correct answer: C. the highest IP address among its active interfaces
When no loopback interface is configured, OSPF selects the highest IP address among all active interfaces as the router ID. This ensures a stable, unique identifier for the router. The loopback interface, when configured, always takes precedence over physical interfaces, but in its absence, the highest active interface IP is used.
Why the other options are wrong
- A. Fast Ethernet is not specifically prioritized; the highest IP among all active interfaces is used.
- B. Console management interfaces are not OSPF-routable and would not be considered.
- D. The lowest IP address is not used; OSPF specifically uses the highest IP address.
- E. The priority value is not used for router ID selection; only when selecting the designated router.
Question 113
An engineer is configuring remote access to a router from IP subnet 10.139.58.0/28. The domain name, crypto keys, and SSH have been configured. Which configuration enables the traffic on the destination router?
Show answer and explanation
Correct answer: A. line vty 0 15 access-class 120 in ! ip access-list extended 120 permit tcp 10.139.58.0 0.0.0.15 any eq 22
SSH uses TCP port 22 for remote access. The correct configuration applies an extended ACL to the vty lines (virtual terminal lines used for remote access) to permit TCP traffic from the source subnet 10.139.58.0/28 to any destination on port 22. Extended ACLs are required on vty lines to control remote access.
Why the other options are wrong
- B. Uses UDP instead of TCP; SSH requires TCP. Also applies to interface instead of vty lines, which is incorrect for remote access control.
- C. Uses standard ACL which cannot match port numbers; only extended ACLs can match specific ports. Also applies to interface instead of vty lines.
- D. While it has the correct vty configuration, the ACL syntax is incorrect, the destination host and port must come after the source with 'any eq 22' for vty application.
Question 114
Which three statements are typical characteristics of VLAN arrangements? (Choose three.)
Show answer and explanation
Correct answer: B, D, E. Connectivity between VLANs requires a Layer 3 device; Each VLAN uses a separate address space; A switch maintains a separate bridging table for each VLAN.
Connectivity between VLANs requires a Layer 3 device (option B), each VLAN uses a separate address space (option D), and a switch maintains a separate bridging table for each VLAN (option E). These are fundamental characteristics of how VLANs logically segment networks and isolate traffic domains.
Why the other options are wrong
- A. New switches do have a default VLAN (VLAN 1) already configured.
- C. VLANs increase collision domains by breaking up broadcast domains into smaller segments.
- F. VLANs can span multiple switches through trunk links that carry traffic from multiple VLANs.
Question 115
If a notice-level message is sent to a syslog server, which event has occurred?
Show answer and explanation
Correct answer: C. A routing instance has flapped.
A notice-level syslog message indicates normal but significant events. A routing instance flapping (repeatedly transitioning up and down) is a notice-level event that indicates a problem requiring attention but not a critical system failure. This is a significant operational condition worthy of logging at notice level.
Why the other options are wrong
- A. Device restart is typically logged at warning or informational level, not specifically notice.
- B. Debug operations are typically logged at debug level (lowest severity), not notice.
- D. ARP inspection failure would likely be logged at warning or higher severity level depending on context.
Question 116
What is a benefit for external users who consume public cloud resources?
Show answer and explanation
Correct answer: C. Accessed over the Internet
A key benefit of public cloud resources for external users is that they are accessed over the Internet. This provides accessibility from anywhere without requiring dedicated connections, making it the primary distinguishing benefit of public cloud consumption.
Why the other options are wrong
- A. Public cloud is accessed over the Internet, not dedicated WAN links.
- B. Public cloud resources are typically hosted on virtualized infrastructure, not exclusively physical servers.
- D. Public cloud data centers are distributed globally and are not typically located in the same data center as users.
Question 117
A Cisco engineer must configure a single switch interface to meet these requirements: • Accept untagged frames and place them in VLAN 20 Accept tagged frames in VLAN 30 when CDP detects a Cisco IP phone Which command set must the engineer apply?
Show answer and explanation
Correct answer: B. switchport mode access switchport access vlan 20 switchport voice vlan 30
The switchport voice vlan command is the correct way to configure a switch port to accept tagged frames for a Cisco IP phone when CDP detects it. Option B uses switchport mode access with vlan 20 for untagged frames and switchport voice vlan 30 for tagged voice traffic from the IP phone. This is the standard configuration for ports connecting to IP phones that need both data (untagged) and voice (tagged) traffic.
Why the other options are wrong
- A. switchport trunk allowed vlan is trunk-specific syntax and contradicts access mode configuration.
- C. switchport mode dynamic auto and trunk native vlan commands are for trunk negotiation, not for access ports with voice VLAN.
- D. switchport mode trunk and switchport access vlan cannot coexist; a port cannot be both trunk and access mode simultaneously.
Question 118
What criteria is used first during the root port selection process?
Show answer and explanation
Correct answer: B. lowest path cost to the toot bridge
During root port selection in Spanning Tree Protocol, the first criterion evaluated is the lowest path cost to the root bridge. This is the primary tiebreaker when a switch has multiple ports connected to the root bridge or its descendants. Only if path costs are equal do subsequent tiebreakers like neighbor bridge ID come into play.
Why the other options are wrong
- A. Local port ID is the last criterion in root port selection, used only after all other tiebreakers fail.
- C. Lowest neighbor's bridge ID is the second tiebreaker, applied only if path costs are equal.
- D. Lowest neighbor's port ID is the final tiebreaker, used only when all previous criteria are equal.
Question 119
Which mode must be used to configure EtherChannel between two switches without using a negotiation protocol?
Show answer and explanation
Correct answer: B. on
The 'on' mode configures EtherChannel statically without negotiation protocols. It forces the interfaces into an EtherChannel without using LACP or PAgP, providing a direct bundling method between switches.
Why the other options are wrong
- A. Active mode uses LACP negotiation protocol.
- C. Auto mode uses PAgP negotiation protocol.
- D. Desirable mode uses PAgP negotiation protocol.
Question 120
What is the difference between 1000BASE-LX/LH and 1000BASE-ZX interfaces?
Show answer and explanation
Correct answer: D. 1000BASE-LX/LH is supported on links up to 10km, and 1000Base-ZX operates over links up to 70 km
Both standards run over single-mode fibre, and the key difference is reach. 1000BASE-LX/LH is rated for links of up to about 10 km, while 1000BASE-ZX is an extended-reach optic for links of up to about 70 km.
Why the other options are wrong
- A. It is LX/LH, not ZX, that can run over multimode fibre with a mode-conditioning patch cable, so this statement has it backwards.
- B. Dual-rate 100M/1G multimode support is not what sets 1000BASE-ZX apart from 1000BASE-LX/LH.
- C. 1000BASE-ZX reaches about 70 km, not 1000 km, and LX/LH reaches about 10 km, not 70 km.
Question 121
Which switch technology establishes a network connection immediately when it is plugged in?
Show answer and explanation
Correct answer: A. PortFast
PortFast is a Spanning Tree feature that allows a switch port to transition to forwarding state immediately when a device is connected, bypassing the normal listening and learning states, which is essential for end devices that should not participate in STP calculations.
Why the other options are wrong
- B. BPDU guard prevents spanning tree topology changes by disabling ports that receive BPDUs, not for establishing immediate connections.
- C. UplinkFast optimizes failover for uplink redundancy, not for immediate connection establishment to end devices.
- D. BackboneFast reduces STP reconvergence time when indirect link failures occur, not for immediate port forwarding.
Question 122
When a WLAN with WPA2 PSK is configured in the Wireless LAN Controller GUI, which format is supported?
Show answer and explanation
Correct answer: B. ASCII
WPA2 PSK (Pre-Shared Key) on Cisco Wireless LAN Controllers supports ASCII format for the passphrase. ASCII allows human-readable characters to be entered directly as the pre-shared key. Decimal, unicode, and base64 are not the supported formats for WPA2 PSK configuration in the WLC GUI.
Why the other options are wrong
- A. Decimal format is not supported for WPA2 PSK configuration.
- C. Unicode is not a supported format for WPA2 PSK in the WLC GUI.
- D. Base64 is not a supported format for WPA2 PSK configuration on WLCs.
Question 123
An engineer has configured the domain name, user name, and password on the local router. What is the next step to complete the configuration for a Secure Shell access RSA key?
Show answer and explanation
Correct answer: B. crypto key generate rsa
After configuring the domain name, username, and password on a router, the next step to enable SSH is to generate RSA keys using the 'crypto key generate rsa' command. This creates the public-private key pair necessary for SSH encryption. Key generation must occur before SSH can be enabled.
Why the other options are wrong
- A. The 'crypto key import' command is used to import existing keys, not generate new ones.
- C. The 'crypto key zeroize' command removes/deletes keys and is used for cleanup, not generation.
- D. The 'crypto key pubkey-chain' command is used for managing trusted public keys, not generating local RSA keys.
Question 124
Which protocol must be implemented to support separate authorization and authentication solutions for wireless APs?
Show answer and explanation
Correct answer: B. TACACS+
TACACS+ separates authentication, authorisation and accounting into distinct processes, so each can be handled by a separate solution. RADIUS combines authentication and authorisation into a single exchange, so it cannot keep them separate.
Why the other options are wrong
- A. RADIUS combines authentication and authorisation in one process, so it cannot support separate solutions for each.
- C. 802.1X is a port-based access control framework that relies on a AAA protocol behind it, and it does not separate authorisation from authentication.
- D. Kerberos is a ticket-based authentication protocol, not a AAA protocol for separating authorisation on network devices.
Question 125
R1 has learned route 10.10.10.0/24 via numerous routing protocols. Which route is installed?
Show answer and explanation
Correct answer: C. route with the lowest administrative distance
When a router has learned the same route via multiple routing protocols, it selects the route with the lowest administrative distance (AD). Administrative distance is a trustworthiness rating assigned to routing protocols; lower values are preferred. This ensures consistent route selection based on protocol priority rather than cost or hop count.
Why the other options are wrong
- A. The highest IP address of the next hop is not a routing selection criterion.
- B. Cost is compared only among routes from the same routing protocol; AD is compared across different protocols.
- D. Prefix length selection only applies when routes have the same AD and source; it's not the primary criterion across protocols.
Question 126
How do TCP and UDP differ in the way they provide reliability for delivery of packets?
Show answer and explanation
Correct answer: B. TCP provides flow control to avoid overwhelming a receiver by sending too many packets at once, UDP sends packets to the receiver in a continuous stream without checking.
TCP provides flow control through windowing and other mechanisms to prevent overwhelming the receiver by regulating packet transmission rate. UDP, being connectionless and unreliable, sends packets continuously without such flow control mechanisms or checks on the receiver's ability to process them. This is a fundamental difference in how these protocols handle delivery management.
Why the other options are wrong
- A. This statement is backwards; TCP guarantees delivery with error checking, while UDP does not provide message acknowledgement or retransmission.
- C. This is reversed; TCP is connection-oriented and reliable, while UDP is connectionless and unreliable.
- D. Both statements are incorrect; UDP does not provide reliable delivery or three-way handshakes.
Question 127
What is the collapsed layer in collapsed core architectures?
Show answer and explanation
Correct answer: A. Core and distribution
In a collapsed core architecture, the core and distribution layers are combined into a single layer. This reduces the number of network tiers from the traditional three-tier model (access, distribution, core) to a two-tier model (access and collapsed core/distribution). This is common in smaller networks to reduce costs and complexity.
Why the other options are wrong
- B. Access and WAN are not the layers that collapse in this architecture.
- C. While distribution and access are separate in traditional models, it is core and distribution that collapse together.
- D. Core and WAN are not the layers involved in collapsed core architecture.
Question 128
Which command on a port enters the forwarding state immediately when a PC is connected to it?
Show answer and explanation
Correct answer: A. switch(config)#spanning-tree portfast default
PortFast lets an access port skip the listening and learning states and transition straight to forwarding when a device such as a PC is plugged in. Issuing spanning-tree portfast default in global configuration mode enables PortFast on all non-trunking access ports at once, so any port a PC connects to forwards immediately.
Why the other options are wrong
- B. This globally enables BPDU Guard on PortFast-enabled ports as a protection mechanism; it does not itself put a port into forwarding state.
- C. The trunk keyword applies PortFast to a port configured as a trunk (for example toward a router or server NIC teaming), not the access port where a PC attaches.
- D. This disables PortFast, forcing the port through the normal 30-second listening/learning delay.
Question 129
Which action is taken by switch port enabled for PoE power classification override?
Show answer and explanation
Correct answer: A. If a monitored port exceeds the maximum administrative value for power, the port is shutdown and err-disabled.
When a PoE switch port is configured with power classification override, if a monitored port exceeds the maximum administrative power value, the port is shut down and placed in an err-disabled state to prevent overpower conditions and potential equipment damage. This protection mechanism ensures that connected devices do not draw more power than the administrator has permitted.
Why the other options are wrong
- B. Syslog messages are generated for various PoE events, but this is not specific to power classification override behavior.
- C. Data flow is not paused during power usage checking; monitoring occurs independently of data transmission.
- D. Ports are disabled when power exceeds maximum limits, not when it falls below minimum; low power typically indicates device failure is detected separately.
Question 130
What is the MAC address used with VRRP as a virtual address?
Show answer and explanation
Correct answer: B. 00-00-5E-00-01-0a
VRRP uses the MAC address 00-00-5E-00-01-0a as the virtual gateway MAC address. This is a standardized IEEE-assigned MAC address for VRRP virtual routers, where the format includes 00-00-5E (IANA OUI for VRRP) followed by 00-01 and the VRRP group number in the last octet. This allows hosts to use a consistent MAC address regardless of which physical router is active.
Why the other options are wrong
- A. 00-05-42-38-53-31 is not the standard VRRP virtual MAC address.
- C. 00-00-0C-07-AD-89 is associated with HSRP, not VRRP.
- D. 00-07-C0-70-AB-01 is not the standard VRRP virtual MAC address.
Question 131
If a switch port receives a new frame while it is actively transmitting a previous frame, how does it process the frames?
Show answer and explanation
Correct answer: C. The new frame is placed in a queue for transmission after the previous frame
When a switch port receives a new frame while actively transmitting a previous frame, the new frame is placed in a memory buffer (queue) and transmitted after the current frame completes. This is standard switch behavior using frame buffering to handle momentary traffic bursts.
Why the other options are wrong
- A. Frames are not dropped or reordered; the new frame is simply queued, and no retransmission request is needed.
- B. The previous frame completes transmission normally; new frames are queued, not the other way around.
- D. Switches are half-duplex or full-duplex devices; frames cannot be processed and delivered simultaneously on the same port in either mode without buffering.
Question 132
An engineer needs to add an old switch back into a network. To prevent the switch from corrupting the VLAN database, with action must be taken?
Show answer and explanation
Correct answer: A. Add the switch in the VTP domain with a lower revision number.
When adding an old switch with a potentially higher revision number to a VTP domain, it could corrupt the VLAN database by propagating outdated VLAN configurations. Adding it with a lower revision number ensures the existing domain's VLAN information takes precedence and prevents the old switch from overwriting the current database.
Why the other options are wrong
- B. A higher revision number would cause the old switch to override the current VLAN database, worsening the corruption risk.
- C. DTP settings control trunking negotiation, not VLAN database protection.
- D. DTP desirable mode affects trunk formation but does not protect against VTP revision number corruption.
Question 133
Which two commands can you use to configure an actively negotiate EtherChannel? (Choose two.)
Show answer and explanation
Correct answer: D, E. channel-group 10 mode desirable; channel-group 10 mode active
Active and desirable modes actively negotiate EtherChannel. Active mode actively initiates LACP negotiation, and desirable mode actively initiates PAgP negotiation. Both modes send periodic negotiation frames rather than passively waiting for neighbor detection.
Why the other options are wrong
- A. On mode forces EtherChannel without any negotiation protocol
- B. Auto mode passively waits for negotiation from the other side
- C. Passive mode waits to receive LACP packets before negotiating
Question 134
Which two WAN architecture options help a business scalability and reliability for the network? (Choose two.)
Show answer and explanation
Correct answer: C, E. dual-homed branches; dynamic routing
Dual-homed branches (multiple WAN connections) provide redundancy and failover capability, improving reliability. Dynamic routing protocols automatically adapt to network changes and failures, enabling scalability by distributing traffic across multiple paths and responding to topology changes without manual intervention.
Why the other options are wrong
- A. Asynchronous routing is not a standard WAN architecture approach.
- B. Single-homed branches have only one connection, reducing reliability and scalability.
- D. Static routing does not scale well; manual updates are required for topology changes.
Question 135
An engineer must configure an OSPF neighbor relationship between router R1 and R3. The authentication configuration has been configured and the connecting interfaces are in the same 192.168.1.0/30 subnet. What are the next two steps to complete the configuration? (Choose two.)
Show answer and explanation
Correct answer: B, C. configure both interfaces with the same area ID; configure the hello and dead timers to match on both sides
To establish an OSPF neighbor relationship, both routers must be configured with the same area ID (OSPF operates on a per-area basis for neighbors to form adjacency), and the hello and dead timers must match on both sides (mismatched timers will prevent adjacency from forming). The process ID and router ID do not need to match between neighbors; these are local identifiers. OSPF interfaces are activated through the 'network' command under the OSPF process, not by configuring them as 'active'.
Why the other options are wrong
- A. OSPF interfaces are activated via the network command in OSPF configuration, not by configuring interfaces as 'OSPF active'.
- D. The OSPF process ID is a local identifier and does not need to match between routers to form neighbor adjacencies.
- E. Router IDs do not need to match; each router maintains its own unique router ID for OSPF operation.
Question 136
Which type of port is used to connect the wired network when an autonomous AP maps two VLANs to its WLANs?
Show answer and explanation
Correct answer: C. trunk
When an autonomous AP maps two or more VLANs to its WLANs, the switch port connecting the AP must be a trunk port to carry multiple VLAN tags. A trunk port allows tagged traffic from multiple VLANs to traverse a single physical link. Access ports only support a single VLAN, LAG and EtherChannel are link aggregation technologies unrelated to VLAN tagging.
Why the other options are wrong
- A. Access ports only support a single VLAN and cannot carry multiple VLAN tags.
- B. LAG is for link aggregation, not for carrying multiple VLANs.
- D. EtherChannel is a port aggregation technology, not a VLAN carrying mechanism.
Question 137
Which mode allows access points to be managed by Cisco Wireless LAN Controllers?
Show answer and explanation
Correct answer: B. lightweight
Lightweight mode is the standard mode where access points are fully managed and controlled by Cisco Wireless LAN Controllers. The APs rely on the controller for configuration, security policies, and operational management.
Why the other options are wrong
- A. Bridge mode is for point-to-point or point-to-multipoint wireless links, not AP management.
- C. Mobility Express is a controller-less deployment option where the AP itself acts as a controller.
- D. Autonomous mode is standalone AP operation without controller management.
Question 138
Which implementation provides the strongest encryption combination for the wireless environment?
Show answer and explanation
Correct answer: D. WPA2 + AES
WPA2 with AES provides the strongest encryption combination currently available for wireless environments. WPA2 is more secure than WPA, and AES is more secure than TKIP. WEP is deprecated and vulnerable to known attacks.
Why the other options are wrong
- A. WEP has been proven to have critical security vulnerabilities and is deprecated.
- B. WPA with TKIP is weaker than WPA2 with AES; TKIP has known weaknesses.
- C. WPA with AES is more secure than WPA alone but WPA2 is superior to WPA.
Question 139
What is a characteristic of spine-and-leaf architecture?
Show answer and explanation
Correct answer: D. Each device is separated by the same number of hops.
In a spine-and-leaf topology, every leaf switch connects to every spine switch, creating a consistent path length. Every device is separated by the same number of hops (typically 2), which provides predictable latency. This is a key advantage over traditional hierarchical networks. The architecture enables equal-cost multipath (ECMP) routing and eliminates STP blocked ports by allowing all links to be active.
Why the other options are wrong
- A. Links between leaf switches do not exist in the standard spine-and-leaf design; connectivity is only between leaves and spines.
- B. Spine-and-leaf architecture actively avoids STP by enabling all links to be active and using ECMP instead of blocking ports.
- C. Spine-and-leaf provides predictable, consistent latency, not variable latency.
Question 140
What is a similarity between 1000BASE-LX and 1000BASE-T standards?
Show answer and explanation
Correct answer: A. Both use the same data-link header and trailer formats.
Both 1000BASE-LX (fiber optic) and 1000BASE-T (twisted pair) are Gigabit Ethernet standards that operate at Layer 2 and use the same IEEE 802.3 frame format with identical data-link headers and trailers, regardless of the physical medium differences.
Why the other options are wrong
- B. 1000BASE-LX uses LC or SC connectors, not RJ-45; only 1000BASE-T uses RJ-45.
- C. 1000BASE-LX supports up to 10 kilometers; 1000BASE-T supports only 100 meters.
- D. 1000BASE-LX uses LC/SC connectors and 1000BASE-T uses RJ-45, not LR connectors.
Question 141
How does TFTP operate in a network?
Show answer and explanation
Correct answer: C. Uses block numbers to identify and mitigate data-transfer errors
TFTP (Trivial File Transfer Protocol) uses block numbers to identify each data packet in a transfer sequence. These block numbers allow both sender and receiver to track which packets have been successfully transmitted and received, enabling TFTP to detect and handle data-transfer errors despite operating over the unreliable UDP protocol.
Why the other options are wrong
- A. TFTP operates over UDP without encryption or authentication, making it inherently insecure.
- B. TFTP uses UDP port 69 for both control and data, not TCP port 20.
- D. TFTP uses a single UDP connection for both control and data traffic, not separate connections.
Question 142
Which two outcomes are predictable behaviors for HSRP? (Choose two.)
Show answer and explanation
Correct answer: A, E. The two routers negotiate one router as the active router and the other as the standby router; The two routers share a virtual IP address that is used as the default gateway for devices on the LAN.
HSRP provides high availability by having two routers negotiate to designate one as the active router and one as the standby router. These routers share a virtual IP address and virtual MAC address that serves as the default gateway for LAN devices. When the active router fails, the standby router assumes the virtual IP and MAC address to maintain connectivity.
Why the other options are wrong
- B. HSRP routers do not share the same physical interface IP address; they have individual addresses and share only a virtual IP address. Traffic is not load-balanced in standard HSRP.
- C. HSRP does not synchronize full configurations; it only shares HSRP-related state information.
- D. HSRP does not have both routers act as default gateways simultaneously; only the active router uses the virtual address at any given time (no load balancing in basic HSRP).
Question 143
What is a benefit of VRRP?
Show answer and explanation
Correct answer: A. It provides the default gateway redundancy on a LAN using two or more routers.
The primary benefit of VRRP is that it provides default gateway redundancy on a LAN segment by allowing two or more routers to share a virtual IP address and MAC address. When the active router fails, the standby router seamlessly takes over without requiring host reconfiguration.
Why the other options are wrong
- B. VRRP does not provide traffic load balancing to multi-hop destinations; it provides gateway redundancy only.
- C. Loop prevention in Layer 2 is the function of Spanning Tree Protocol, not VRRP.
- D. Sharing routing table information is the function of dynamic routing protocols like OSPF, not VRRP.
Question 144
What is a practice that protects a network from VLAN hopping attacks?
Show answer and explanation
Correct answer: C. Change native VLAN to an unused VLAN ID
Changing the native VLAN from the default VLAN 1 to an unused VLAN ID prevents VLAN hopping attacks that exploit the native VLAN on trunk ports. When an attacker sends untagged frames on a trunk port, they are assigned to the native VLAN; using an unused VLAN prevents this attack vector. Dynamic ARP inspection and ACLs do not specifically prevent VLAN hopping. Port security does not address VLAN hopping.
Why the other options are wrong
- A. Dynamic ARP inspection prevents ARP spoofing, not VLAN hopping attacks.
- B. ACLs cannot prevent traffic from changing VLANs as a security measure against hopping.
- D. Port security restricts MAC addresses on ports but does not prevent VLAN hopping attacks.
Question 145
What are two functions of a Layer 2 switch? (Choose two.)
Show answer and explanation
Correct answer: C, E. moves packets within a VLAN; makes forwarding decisions based on the MAC address of a packet
Layer 2 switches operate at the data link layer and make forwarding decisions based on MAC addresses (option E). They forward frames within and between VLANs on the local network (option C). Option A describes RADIUS/authentication servers, option B describes Layer 3 routing functions, and option D describes inter-VLAN routing which requires a Layer 3 device.
Why the other options are wrong
- A. Authentication servers are not a function of Layer 2 switches.
- B. Selecting best routes on a WAN is a Layer 3 (router) function, not Layer 2.
- D. Moving packets between different VLANs requires Layer 3 routing, not Layer 2 switching alone.
Question 146
Which component of an Ethernet frame is used to notify a host that traffic is coming?
Show answer and explanation
Correct answer: C. preamble
The preamble is a 7-byte field of alternating 1s and 0s (10101010 pattern) that precedes an Ethernet frame and serves to synchronize the receiver's clock with the transmitter's clock. This notifies the receiving host that traffic is coming and allows it to prepare to receive and decode the incoming frame data.
Why the other options are wrong
- A. The start of frame delimiter (SFD) comes after the preamble and marks the actual beginning of the frame data.
- B. The Type field identifies the protocol of the payload data, not the arrival of traffic.
- D. The Data field contains the actual payload and does not notify of incoming traffic.
Question 147
Which command is used to verify the DHCP relay agent address that has been set up on your Cisco IOS router?
Show answer and explanation
Correct answer: D. show ip interface
The 'show ip interface' command displays detailed information about router interfaces, including the DHCP relay agent address configuration. This command shows whether DHCP relay is enabled and provides the relay agent's IP address details that have been configured on the interface.
Why the other options are wrong
- A. show ip interface brief only shows basic interface status, not DHCP relay configuration details
- B. show ip dhcp bindings displays DHCP client lease information, not relay agent settings
- C. show ip route displays routing table entries, not DHCP relay configuration
- E. show interface shows physical layer information without IP configuration details
- F. show ip dhcp pool displays DHCP pool configuration on a server, not relay agent info
Question 148
What is a function of an endpoint on a network?
Show answer and explanation
Correct answer: C. allows users to record data and transmit to a file server
An endpoint is a device used by end-users to access network resources and services. The primary function is allowing users to record, process, and transmit data to servers and other resources on the network.
Why the other options are wrong
- A. Providing wireless services is the function of access points, not endpoints.
- B. Connecting devices to the network is the function of network interface cards and switches, not the endpoint itself.
- D. Forwarding traffic between VLANs is the function of routers or layer 3 switches, not endpoints.
Question 149
What is the default port-security behavior on a trunk link?
Show answer and explanation
Correct answer: A. It places the port in the err-disabled state if it learns more than one MAC address.
The default port security behavior places a port in err-disabled state when a violation occurs, such as learning more than one MAC address on a port configured to allow only one. This is the standard default action to protect against MAC address spoofing and unauthorized devices.
Why the other options are wrong
- B. Port security does not cause network loops; it prevents unauthorized access.
- C. Port security does not disable native VLAN configuration.
- D. Port security triggers on violation of the configured limit, not after a fixed number of static configurations.
Question 150
Which command is used to enable LLDP globally on a Cisco IOS ISR?
Show answer and explanation
Correct answer: A. lldp run
The 'lldp run' command is used to enable LLDP globally on a Cisco IOS device. This command activates LLDP at the device level, allowing it to send and receive LLDP advertisements on all capable interfaces.
Why the other options are wrong
- B. lldp enable is not the correct global enablement command.
- C. lldp transmit controls transmission on individual interfaces, not global enablement.
- D. cdp run enables CDP, not LLDP.
- E. cdp enable enables CDP, not LLDP.
Question 151
A user configured OSPF and advertised the Gigabit Ethernet interface in OSPF. By default, to which type of OSPF network does this interface belong?
Show answer and explanation
Correct answer: C. broadcast
By default, Ethernet and Gigabit Ethernet interfaces are treated as broadcast network types in OSPF. This means OSPF will elect a Designated Router (DR) and Backup Designated Router (BDR) on the segment, and routers will form adjacencies with these routers rather than with every neighbor.
Why the other options are wrong
- A. Point-to-multipoint is used for non-broadcast media or specific configurations, not the default for Gigabit Ethernet.
- B. Point-to-point is the default for serial interfaces or when manually configured, not for Ethernet interfaces.
- D. Nonbroadcast (NBMA) requires manual neighbor configuration and is not the default for standard Ethernet interfaces.
Question 152
A network engineer must implement an IPv6 configuration on the vlan 2000 interface to create a routable locally-unique unicast address that is blocked from being advertised to the internet. Which configuration must the engineer apply?
Show answer and explanation
Correct answer: B. interface vlan 2000 ipv6 address fd00::1234:2343/64
Unique Local Addresses (ULAs) in IPv6 begin with fd00::/8 and are designed to be routable locally but intentionally not advertised to the internet. Option B (fd00::1234:2343/64) is the correct format for a ULA. Option D uses fc00::/8 which is deprecated, option C (fe80::/10) is link-local, and option A uses multicast addressing (ff00::/8).
Why the other options are wrong
- A. ff00::/8 is reserved for multicast addresses, not unicast local addresses.
- C. fe80::/10 is link-local scope and cannot be routed beyond the local link.
- D. fc00::/8 is the deprecated format for ULAs; fd00::/8 is the current standard.
Question 153
How are VLAN hopping attacks mitigated?
Show answer and explanation
Correct answer: A. manually implement trunk ports and disable DTP
VLAN hopping attacks exploit Dynamic Trunking Protocol (DTP) and misconfigured trunk ports. The primary mitigation is to manually configure trunk ports and disable DTP, preventing attackers from negotiating trunk status and using double-tagging to hop between VLANs. This removes the attack vector entirely by requiring explicit trunk configuration.
Why the other options are wrong
- B. Extended VLANs are simply a numbering range and do not mitigate hopping attacks.
- C. Placing all ports in the default VLAN actually increases risk and does nothing to prevent hopping on trunk ports.
- D. Dynamic ARP Inspection protects against ARP spoofing but does not address VLAN hopping attacks.
Question 154
By default, how does EIGRP determine the metric of a route for the routing table?
Show answer and explanation
Correct answer: A. It uses the bandwidth and delay values of the path to calculate the route metric.
EIGRP uses bandwidth and delay values of the path to calculate the route metric. By default, EIGRP's composite metric formula incorporates these two primary parameters (bandwidth being weighted more heavily), along with reliability and load in the full formula. This allows EIGRP to make intelligent routing decisions based on actual link characteristics.
Why the other options are wrong
- B. EIGRP does not use a default metric of 10; it calculates based on specific link parameters.
- C. EIGRP does not count hops; that is characteristic of distance-vector protocols like RIP.
- D. While bandwidth is used, EIGRP uses actual link bandwidth, not a reference bandwidth comparison like OSPF does.
Question 155
Using direct sequence spread spectrum, which three 2.4-GHz channels are used to limit collisions?
Show answer and explanation
Correct answer: C. 1, 6, 11
In the 2.4 GHz WiFi band, channels 1, 6, and 11 are the three non-overlapping channels used in the United States and many other regions. These channels are spaced 5 channels apart and have minimal overlap, allowing three independent networks to operate simultaneously without interference. This is the standard recommendation for limiting collisions in shared spectrum.
Why the other options are wrong
- A. Channels 5, 6, and 7 overlap significantly with each other and are not the standard non-overlapping set.
- B. Channels 1, 2, and 3 overlap considerably and are not optimal for collision avoidance.
- D. Channels 1, 5, and 10 include channel 10, which is not a standard channel in all regions and does not follow the proper spacing.
Question 156
When a site-to-site VPN is configured which IPsec mode provides encapsulation and encryption of the entire original IP packet?
Show answer and explanation
Correct answer: D. IPsec tunnel mode with ESP
IPsec tunnel mode with ESP (Encapsulating Security Payload) provides complete encapsulation and encryption of the entire original IP packet, creating a new outer IP header. This is the standard for site-to-site VPN where the original packet becomes the payload, and the ESP protocol encrypts and authenticates the entire original packet.
Why the other options are wrong
- A. Transport mode with AH only authenticates and does not encrypt; it also does not encapsulate the entire packet.
- B. Tunnel mode with AH only provides authentication without encryption of the payload.
- C. Transport mode operates on upper-layer protocols without encapsulating the entire original IP packet as required for site-to-site VPN.
Question 157
What are two benefits of FHRPs? (Choose two.)
Show answer and explanation
Correct answer: D, E. They enable automatic failover of the default gateway; They allow multiple devices to serve as a single virtual gateway for clients in the network
FHRPs like HSRP, VRRP, and GLBP provide two key benefits: they enable automatic failover of the default gateway (option D) by using virtual IP and MAC addresses so hosts don't need ARP cache updates when the active router fails, and they allow multiple devices to serve as a single virtual gateway (option E) through a virtual IP address shared by participating routers. Options A, B, and C are not FHRP benefits; encryption, loop prevention, and port bundling are handled by other protocols.
Why the other options are wrong
- A. FHRPs do not provide encryption; that is handled by other security protocols.
- B. Loop prevention in Layer 2 is handled by Spanning Tree Protocol, not FHRPs.
- C. Port bundling to increase bandwidth is accomplished through EtherChannel, not FHRPs.
Question 158
Which type of organization should use a collapsed-core architecture?
Show answer and explanation
Correct answer: A. small and needs to reduce networking costs
A collapsed-core architecture combines the core and distribution layers into a single layer, reducing equipment and complexity. This design is most appropriate for small organizations seeking to minimize networking costs while maintaining basic functionality.
Why the other options are wrong
- B. Large organizations with strict uptime requirements typically use a three-tier design for redundancy.
- C. Flexible, scalable designs favor a three-tier architecture, not collapsed-core.
- D. Organizations expecting dramatic growth need expandable architectures, not the limited collapsed-core design.
Question 159
When using Rapid PVST+, which command guarantees the switch is always the root bridge for VLAN 200?
Show answer and explanation
Correct answer: B. spanning-tree vlan 200 priority 0
Setting the spanning-tree priority to 0 guarantees the switch becomes the root bridge for that VLAN because priority values range from 0 to 65535 in 4096-increment steps, and 0 is the lowest possible value. The bridge with the lowest priority is elected as root, making this the only command that absolutely guarantees root status.
Why the other options are wrong
- A. A priority of 614440 is arbitrary and does not guarantee root status; a lower priority switch could exist.
- C. While 'root primary' places the switch as root, it does so by setting priority to 24576, not an absolute guarantee if another switch later gets configured lower.
- D. This priority value does not guarantee root status; many other priority values would be lower.
Question 160
What is the effect when loopback interfaces and the configured router ID are absent during the OSPF Process configuration?
Show answer and explanation
Correct answer: D. The highest up/up physical interface IP address is selected as the router ID.
When no loopback interface is configured and no explicit router ID is set, OSPF selects the highest IP address on an active (up/up) physical interface as the router ID. This is the automatic router ID selection process in OSPF when neither a loopback nor a manually configured router ID exists.
Why the other options are wrong
- A. OSPF does not increment the lowest IP address; it uses the highest IP address instead.
- B. A router ID of 0.0.0.0 would prevent OSPF from running, not enable it with that ID.
- C. OSPF will still run and automatically select a router ID; it does not fail without manual configuration.
Question 161
Which encryption method is used by WPA3?
Show answer and explanation
Correct answer: B. AES
WPA3 encrypts data with AES, using CCMP-128 in Personal mode and GCMP-256 in the 192-bit Enterprise mode. SAE replaces the pre-shared key handshake for authentication and key exchange, but the encryption cipher itself is AES.
Why the other options are wrong
- A. TKIP is the legacy WPA cipher and is not allowed in WPA3.
- C. SAE is WPA3's authentication and key exchange method, not its encryption cipher.
- D. PSK is an authentication method from WPA2 Personal, not an encryption method.
Question 162
A network administrator must configure SSH for remote access to router R1. The requirement is to use a public and private key pair to encrypt management traffic to and from the connecting client. Which configuration, when applied, meets the requirements?
Show answer and explanation
Correct answer: D. R1#enable R1#configure terminal R1(config)#ip domain-name cisco.com R1(config)#crypto key generate rsa modulus 1024
SSH requires RSA key generation using the crypto key generate rsa command with a modulus value. The correct syntax is 'crypto key generate rsa modulus 1024' (or higher for better security). Elliptic Curve (EC) keys are not used for standard SSH on Cisco routers. The 'crypto key encrypt' command is not the correct syntax for key generation. RSA with modulus 1024 or higher is the standard for SSH.
Why the other options are wrong
- A. EC (Elliptic Curve) keys are not used for SSH key generation on Cisco routers.
- B. EC keys are not the standard for SSH; RSA is required. Also, keysize is not the correct parameter for EC in this context.
- C. The command syntax 'crypto key encrypt' is incorrect; the proper command is 'crypto key generate rsa'.
Question 163
Which virtual MAC address is used by VRRP group 1?
Show answer and explanation
Correct answer: D. 0000.5E00.0101
VRRP uses a well-known virtual MAC address format: 0000.5E00.01xx, where xx is the VRRP group number in hexadecimal. For VRRP group 1, the MAC address is 0000.5E00.0101 (with 01 being the hexadecimal representation of group 1).
Why the other options are wrong
- A. 0504.0367.4921 is not a valid VRRP virtual MAC address format.
- B. 0007.c061.bc01 is typically associated with Cisco devices but not the VRRP virtual MAC format.
- C. 0050.0c05.ad81 is not the correct VRRP virtual MAC; it may be another Cisco MAC format.
Question 164
Which function does the range of private IPv4 addresses perform?
Show answer and explanation
Correct answer: A. allows multiple companies to each use the same addresses without conflicts
Private IPv4 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are reserved for internal use and are not routable on the public Internet. This allows multiple organizations to independently use the same address ranges without conflicts, as these addresses are never exposed to the Internet backbone.
Why the other options are wrong
- B. Private addresses cannot reach hosts outside the enterprise directly; they require NAT for outbound Internet connectivity.
- C. Private addressing actually requires NAT to communicate with the Internet, not the opposite.
- D. Private addresses do not enable direct secure communications to the Internet; they must be translated first.
Question 165
What are two descriptions of three-tier network topologies? (Choose two.)
Show answer and explanation
Correct answer: A, B. The distribution layer runs Layer 2 and Layer 3 technologies; The network core is designed to maintain continuous connectivity when devices fail
The three-tier model consists of access, distribution, and core layers. The distribution layer operates at both Layer 2 and Layer 3, providing connectivity and some routing functions between access and core layers. The network core is designed with redundancy and high availability to maintain continuous connectivity when devices fail, using technologies like dual links and fast convergence protocols.
Why the other options are wrong
- C. The distribution layer, not the access layer, manages routing between devices in different domains.
- D. The core layer is not responsible for maintaining wired connections to individual hosts; that is the access layer's function.
- E. The core and distribution layers have different functions; the core focuses on speed and availability while distribution handles policy and access control.
Question 166
Which protocol is used for secure remote CLI access?
Show answer and explanation
Correct answer: D. SSH
SSH (Secure Shell) is the industry-standard protocol for secure remote CLI access. It encrypts all traffic between the client and server, protecting credentials and session data from eavesdropping.
Why the other options are wrong
- A. Telnet transmits credentials and data in cleartext, making it insecure.
- B. HTTP is for web traffic and is not designed for CLI access.
- C. HTTPS is for web traffic encryption, not CLI management access.
Question 167
Which QoS forwarding per-hop behavior changes a specific value in a packet header to set the class of service for the packet?
Show answer and explanation
Correct answer: D. marking
Marking is the QoS feature that modifies packet header fields (such as DSCP or CoS values) to set the class of service for prioritization. This is distinct from shaping (rate control), classification (identifying traffic), and policing (enforcement with drops).
Why the other options are wrong
- A. Shaping buffers and delays traffic to control rate, not marking header values.
- B. Classification identifies traffic types but does not modify packet headers.
- C. Policing enforces bandwidth limits by dropping or marking excess traffic, but marking is the header modification mechanism itself.
Question 168
Which type of information resides on a DHCP server?
Show answer and explanation
Correct answer: A. a list of the available IP addresses in a pool
A DHCP server maintains a pool of available IP addresses that can be assigned to clients requesting dynamic IP configuration. This pool is the core function of DHCP, allowing the server to track and distribute IP addresses from a configured range.
Why the other options are wrong
- B. DNS servers maintain name-to-IP mappings, not DHCP servers
- C. Active Directory or authentication servers store credentials, not DHCP servers
- D. DHCP can use MAC addresses for reservations but doesn't primarily store static MAC lists like a management database would
Question 169
How does STP prevent forwarding loops at OSI Layer 2?
Show answer and explanation
Correct answer: D. Port blocking
Spanning Tree Protocol prevents forwarding loops at Layer 2 by blocking certain ports through the port blocking mechanism. STP calculates a spanning tree topology and places redundant ports in a blocking state, preventing frames from circulating endlessly through the network.
Why the other options are wrong
- A. TTL is a Layer 3 mechanism used in IP networks, not Layer 2
- B. MAC address forwarding is how switches learn and forward frames, not how STP prevents loops
- C. Collision avoidance is a media access mechanism, not related to loop prevention
Question 170
What does the implementation of a first-hop redundancy protocol protect against on a network?
Show answer and explanation
Correct answer: A. default gateway failure
First-hop redundancy protocols (HSRP, VRRP, GLBP) protect against default gateway failure by providing redundancy at the first hop. When the primary gateway fails, a secondary gateway automatically takes over, ensuring that hosts can still reach remote networks without manual intervention or gateway reconfiguration.
Why the other options are wrong
- B. BGP neighbor flapping is a routing protocol issue, not related to first-hop redundancy.
- C. Spanning-tree loops are prevented by the Spanning Tree Protocol, not FHRP.
- D. Root-bridge loss is a Layer 2 spanning-tree concern, not an FHRP responsibility.
Question 171
What is a syslog facility?
Show answer and explanation
Correct answer: D. set of values that represent the processes that can generate a log message
A syslog facility is a numeric code that represents the source or process type that generates a log message. Facilities are predefined values (0-23) that categorize which processes or applications are sending log messages, such as kernel messages (0), user-level messages (1), mail system (2), system daemons (3), etc. This allows syslog to organize and route messages based on their originating process type.
Why the other options are wrong
- A. A facility is not a host configuration; it's a categorization of message types.
- B. Syslog facilities have nothing to do with passwords or NMS authentication.
- C. Facilities classify message sources, not severity levels; severity is handled separately.
Question 172
Which unified access point mode continues to serve wireless clients after losing connectivity to the Cisco Wireless LAN Controller?
Show answer and explanation
Correct answer: C. flexconnect
Flexconnect mode (formerly called Hybrid Remote Edge Access Point mode) allows access points to continue serving wireless clients even after losing connectivity to the Cisco Wireless LAN Controller, switching to autonomous operation for critical functions.
Why the other options are wrong
- A. Local mode requires active controller connectivity.
- B. Mesh mode is for backhaul connections between APs, not client service autonomy.
- D. Sniffer mode is for wireless packet capture and analysis only.
Question 173
What is a function of MAC learning on a switch?
Show answer and explanation
Correct answer: D. A static MAC address is manually added to the MAC table.
Entries reach the MAC address table in two ways: dynamically, when the switch learns the source address of incoming frames, or statically, when an administrator adds an address by hand. A static entry is added manually and is not aged out. The other three statements are false: learning is on by default, unknown unicast frames are flooded rather than dropped, and the ARP table is built from ARP messages, not from the MAC table.
Why the other options are wrong
- A. MAC address learning is enabled by default on VLANs, not disabled.
- B. Frames with unknown destination MAC addresses are flooded, not dropped.
- C. The MAC address table is separate from the ARP table; MAC table is Layer 2 while ARP is Layer 3.
Question 174
Which switching concept is used to create separate broadcast domains?
Show answer and explanation
Correct answer: C. VLAN
VLANs create separate broadcast domains by logically segmenting a physical switch into multiple virtual networks. Each VLAN is its own broadcast domain, preventing broadcast traffic from crossing VLAN boundaries. STP manages loop prevention, VTP manages VLAN information distribution, and CSMA/CD is a media access control method, none create separate broadcast domains.
Why the other options are wrong
- A. STP prevents switching loops but does not create broadcast domains.
- B. VTP distributes VLAN information but does not create the domains themselves.
- D. CSMA/CD is a legacy media access protocol unrelated to broadcast domain separation.
Question 175
Which type of address is shared by routers in a HSRP implementation and used by hosts on the subnet as their default gateway address?
Show answer and explanation
Correct answer: B. virtual IP address
In HSRP implementation, a virtual IP address is the shared address used by participating routers and configured as the default gateway on hosts. This virtual IP remains constant and associated with a virtual MAC address, allowing seamless failover between the active and standby routers without requiring hosts to update their default gateway configuration or ARP cache.
Why the other options are wrong
- A. Multicast addresses are used for HSRP protocol communication, not as the default gateway address for hosts.
- C. Loopback addresses are used for router management and identification, not as default gateways for network hosts.
- D. Broadcast addresses are used for network-wide communication, not as specific default gateway addresses for subnets.
Question 176
The address block 192.168.32.0/24 must be subnetted into smaller networks. The engineer must meet these requirements: • Create 8 new subnets. • Each subnet must accommodate 30 hosts. • Interface VLAN 10 must use the last usable IP in the first new subnet. • A Layer 3 interface is used. Which configuration must be applied to the interface?
Show answer and explanation
Correct answer: C. no switchport ip address 192.168.32.30 255.255.255.224
To create 8 subnets from a /24 network requires 3 additional bits (2^3=8), resulting in /27 subnets. Each /27 provides 32 addresses with 30 usable hosts. The first subnet is 192.168.32.0/27 (0-31), and the last usable IP is .30. The no switchport command enables Layer 3 routing on the interface, and 255.255.255.224 is the /27 subnet mask.
Why the other options are wrong
- A. The IP 192.168.32.97 is not the last usable IP in the first subnet, and /27 mask (255.255.255.224) doesn't match the address calculation.
- B. The switchport command disables Layer 3 routing when Layer 3 is required, and /28 provides only 14 usable hosts, insufficient for 30 required.
- D. IP 192.168.32.62 is in the second subnet, not the first, and /28 doesn't meet the 30-host requirement.
Question 177
Which two options are the best reasons to use an IPV4 private IP space? (Choose two.)
Show answer and explanation
Correct answer: A, D. to enable intra-enterprise communication; to conserve global address space
Private IP spaces (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are designed to enable communication within an enterprise without consuming globally routable addresses. Option A is correct because private IPs facilitate intra-enterprise communication, and option D is correct because using private addresses conserves the limited global IPv4 address space. While NAT (B) uses private IPs, it is a mechanism rather than a reason to use private space. Option C is vague and not a primary design goal, and option E is not a recognized benefit.
Why the other options are wrong
- B. NAT is a technique that uses private IPs but is not a primary reason to adopt private address space.
- C. Connecting applications is too vague and not a defined purpose of private IP space.
- E. Managing routing overhead is not a characteristic benefit of private IP address usage.
Question 178
A corporate office uses four floors in a building. • Floor 1 has 24 users. • Floor 2 has 29 users. Floor 3 has 28 users. • Floor 4 has 22 users. Which subnet summarizes and gives the most efficient distribution of IP addresses for the router configuration?
Show answer and explanation
Correct answer: C. 192.168.0.0/25 as summary and 192.168.0.0/27 for each floor
The largest floor needs 29 hosts, and a /27 gives 30 usable addresses, so /27 is the smallest subnet that fits every floor. Four /27 blocks use 128 addresses, which is exactly one /25, so 192.168.0.0/25 summarises them with no wasted space.
Why the other options are wrong
- A. A /28 gives only 14 usable addresses, too few for any of the floors.
- B. A /25 per floor gives 126 usable addresses for fewer than 30 users, and a /23 summary wastes far more address space than needed.
- D. A /29 gives only 6 usable addresses, far too small for any floor.
Question 179
What is the benefit of configuring PortFast on an interface?
Show answer and explanation
Correct answer: B. After the cable is connected, the interface is available faster to send and receive user data.
PortFast's primary benefit is that it allows end-device interfaces to skip the normal spanning tree state transitions (listening and learning), enabling them to reach the forwarding state immediately after a cable connection. This is especially important for devices like servers or workstations that need to obtain DHCP addresses or establish connections without delay.
Why the other options are wrong
- A. PortFast does not prioritize frames; it only affects interface state transitions, not frame processing priority.
- C. PortFast speeds up interface availability, not real-time frame processing; QoS handles voice and video prioritization.
- D. PortFast does not affect the speed setting of an interface; that is determined by hardware capabilities and negotiation.
Question 180
How does QoS optimize voice traffic?
Show answer and explanation
Correct answer: B. by reducing packet loss
QoS optimizes voice traffic primarily by reducing packet loss, which is critical for voice quality. Voice over IP is highly sensitive to packet loss because missing packets result in audio dropouts and intelligibility problems. While QoS may also differentiate traffic types, the fundamental mechanism for voice optimization is ensuring minimal packet loss through prioritization and resource allocation.
Why the other options are wrong
- A. Voice quality improves through prioritization, not simply bandwidth reduction.
- C. While QoS can differentiate traffic, this is a means to an end, not the primary optimization goal.
- D. QoS reduces jitter, not increases it; increased jitter degrades voice quality.
Question 181
What is the path for traffic sent from one user workstation to another workstation on a separate switch in a three-tier architecture model?
Show answer and explanation
Correct answer: D. access - distribution - core - distribution - access
In a three-tier architecture (access, distribution, core), traffic between two workstations on different access switches traverses: access switch → distribution switch → core switch → distribution switch → access switch. This path ensures traffic passes through the appropriate hierarchy layers for optimal routing and network management.
Why the other options are wrong
- A. Direct access-to-core connection bypasses the distribution layer, which is essential in three-tier design.
- B. This path skips the core layer entirely, which contradicts three-tier architecture principles.
- C. This path goes to core directly from one access switch without returning through the proper distribution layer on the other side.
Question 182
An engineer is configuring NAT to translate the source subnet of 10.10.0.0/24 to any one of three addresses: 192.168.3.1, 192.168.3.2, or 192.168.3.3. Which configuration should be used?
Show answer and explanation
Correct answer: D. enable configure terminal ip nat pool mypool 192.168.3.1 192.168.3.3 prefix-length 30 access-list 1 permit 10.10.0.0 0.0.0.255 ip nat inside source list 1 pool mypool interface g1/1 ip nat inside interface g1/2 ip nat outside
This question requires configuring Dynamic NAT to translate a source subnet to a pool of addresses. Option D correctly uses 'ip nat inside source list' which translates inside addresses to the pool, specifies the proper wildcard mask (0.0.0.255 for /24), defines the pool with prefix-length 30, and correctly assigns g1/1 as inside and g1/2 as outside interfaces. Option A uses 'outside destination' which is incorrect for this scenario. Option B uses the wrong wildcard mask (0.0.0.254). Option C uses route map syntax which is not the standard approach here.
Why the other options are wrong
- A. Uses 'ip nat outside destination' instead of 'ip nat inside source', which translates destination addresses rather than source addresses
- B. Uses incorrect wildcard mask 0.0.0.254 instead of 0.0.0.255 for the /24 subnet
- C. Uses route map syntax instead of standard access-list for NAT source translation
Question 183
Which QoS tool is used to optimize voice traffic on a network that is primarily intended for data traffic?
Show answer and explanation
Correct answer: D. PQ
PQ (Priority Queuing) is the appropriate QoS tool for optimizing voice traffic on data networks. PQ ensures that voice packets receive the highest priority in the queue, guaranteeing low latency and jitter, critical requirements for voice quality. Voice traffic is assigned to the priority queue, which is always served first before other queues.
Why the other options are wrong
- A. WRED (Weighted Random Early Detection) manages congestion through packet dropping, not by prioritizing voice.
- B. FIFO (First In, First Out) treats all traffic equally and does not optimize for voice.
- C. WFQ (Weighted Fair Queuing) provides fair allocation but does not guarantee priority for voice like PQ does.
Question 184
Which per-hop traffic-control feature does an ISP implement to mitigate the potential negative effects of a customer exceeding its committed bandwidth?
Show answer and explanation
Correct answer: A. policing
Policing is the per-hop traffic-control feature that monitors traffic rates and takes action (dropping or marking) when traffic exceeds the committed bandwidth limit. ISPs use policing to enforce SLA commitments and prevent customers from exceeding provisioned rates.
Why the other options are wrong
- B. Queuing manages packet order and priority but does not enforce bandwidth limits.
- C. Marking modifies packet headers for QoS but does not enforce bandwidth constraints.
- D. Shaping buffers traffic to smooth it within limits but is typically used internally; policing is the standard ISP enforcement mechanism.
Question 185
Which type of attack is mitigated by dynamic ARP inspection?
Show answer and explanation
Correct answer: C. man-in-the-middle
Dynamic ARP Inspection (DAI) validates ARP packets and prevents ARP spoofing attacks, which are the primary mechanism for man-in-the-middle attacks on local networks by allowing attackers to intercept traffic between hosts.
Why the other options are wrong
- A. DAI does not mitigate DDoS attacks, which operate at different network layers.
- B. DAI does not directly protect against malware propagation.
- D. DAI does not prevent worm propagation; it specifically addresses ARP-based attacks.
Question 186
Which two goals reasons to implement private IPv4 addressing on your network? (Choose two.)
Show answer and explanation
Correct answer: B, D. Conserve IPv4 address; Reduce the risk of a network security breach
Private IPv4 addressing conserves the limited public IPv4 address space by allowing unlimited internal addresses without requiring registration. It also reduces security risk by hiding internal network topology from the Internet, as private addresses are not routable publicly and require NAT to reach external networks, providing a layer of network obscurity.
Why the other options are wrong
- A. PCI regulations do not specifically mandate private addressing; they focus on data protection.
- C. Private addressing does not reduce forwarding table size; that depends on routing design.
- E. There is no widespread local law requiring private IPv4 addressing.
Question 187
The SW1 interface g0/1 is in the down/down state. What are two reasons for the interface condition? (Choose two.)
Show answer and explanation
Correct answer: D, E. The interface is error-disabled; There is a speed mismatch
An interface that is error-disabled shows as down/down with an err-disabled status. A speed mismatch stops the physical link from coming up, which also leaves the interface down/down.
Why the other options are wrong
- A. A protocol mismatch, such as mismatched encapsulation, leaves the interface up/down because the physical layer is still up.
- B. A duplex mismatch lets the link come up and causes errors and collisions, not a down/down state.
- C. A shut down interface shows as administratively down/down, not simply down/down.
Question 188
Which feature or protocol determines whether the QOS on the network is sufficient to support IP services?
Show answer and explanation
Correct answer: C. IP SLA
IP SLA (IP Service Level Agreement) is a feature that measures and reports on network performance characteristics such as latency, jitter, packet loss, and bandwidth. It proactively determines whether the Quality of Service on the network is sufficient to support IP services like VoIP and video. LLDP and CDP are discovery protocols. EEM is for event-based automation.
Why the other options are wrong
- A. LLDP is a neighbor discovery protocol, not a QoS measurement tool
- B. CDP is a Cisco discovery protocol for identifying neighbors, not QoS assessment
- D. EEM (Embedded Event Manager) is for event-driven automation and scripting, not QoS monitoring
Question 189
When deploying syslog, which severity level logs informational messages?
Show answer and explanation
Correct answer: D. 6
In syslog severity levels, level 6 represents 'Informational' messages. The syslog scale ranges from 0 (Emergency) to 7 (Debug), with level 6 specifically designated for informational messages that provide normal operational information without indicating an error condition.
Why the other options are wrong
- A. Level 0 is Emergency, the most severe level.
- B. Level 2 is Critical, indicating a serious error condition.
- C. Level 4 is Warning, indicating a potential problem that should be investigated.
Question 190
A wireless administrator has configured a WLAN; however, the clients need access to a less congested 5-GHz network for their voice quality. Which action must be taken to meet the requirement?
Show answer and explanation
Correct answer: A. enable Band Select
Band Select is a wireless feature that steers dual-band capable clients toward the less congested 5-GHz band when both 2.4-GHz and 5-GHz networks are available with the same SSID. This feature automatically directs compatible clients to the preferred band to reduce congestion and improve voice quality, directly addressing the requirement stated in the question.
Why the other options are wrong
- B. DTIM (Delivery Traffic Indication Map) is used for power management, not band steering.
- C. RX-SOP (Receive Start of Packet) is related to packet reception timing, not band selection.
- D. AAA override is related to authentication, not band steering or network selection.
Question 191
Which command can you enter to determine the addresses that have been assigned on a DHCP Server?
Show answer and explanation
Correct answer: C. Show ip DHCP binding.
The `show ip dhcp binding` command displays all addresses currently assigned by the DHCP server, including the IP address, client identifier, lease expiration time, and binding type. This is the standard command for viewing active DHCP leases and assigned addresses.
Why the other options are wrong
- A. There is no `show ip dhcp database` command in standard Cisco IOS.
- B. The `show ip dhcp pool` command displays pool configuration, not active bindings.
- D. The correct command is `show ip dhcp server statistics`, and it shows server statistics, not assigned addresses.
Question 192
What must a network administrator consider when deciding whether to configure a new wireless network with APs in autonomous mode or APs running in cloud-based mode?
Show answer and explanation
Correct answer: A. Autonomous mode APs are less dependent on an underlay but more complex to maintain than APs in cloud-based mode.
Autonomous mode APs operate independently with less dependency on centralized infrastructure (underlay), but require individual configuration and management of each AP, making them more complex to maintain. Cloud-based mode APs depend on connectivity to a central controller or cloud service for management and configuration, which simplifies maintenance but increases underlay dependency. Option A correctly captures this trade-off.
Why the other options are wrong
- B. While cloud-based APs do rely on underlays, they are actually less complex to maintain (centrally managed) than autonomous APs.
- C. Cloud-based APs are harder to deploy and easier to automate due to centralized management, opposite of what the option states.
- D. Autonomous mode APs are harder to deploy and automate than cloud-based mode, which is the opposite of this statement.
Question 193
Which type of IPv6 address is publicly routable in the same way as IPv4 public addresses?
Show answer and explanation
Correct answer: D. global unicast
Global unicast addresses are the IPv6 equivalent of IPv4 public addresses and are publicly routable across the internet. They are assigned from the range 2000::/3 and allow end-to-end communication globally. Unique local addresses are private, link-local addresses are only for local network segments, and multicast addresses are for one-to-many communication.
Why the other options are wrong
- A. Multicast addresses are for one-to-many communication, not public routing.
- B. Unique local addresses are private and not publicly routable.
- C. Link-local addresses are only valid on the local network segment and are not globally routable.
Question 194
What is the role of disaggregation in controller-based networking?
Show answer and explanation
Correct answer: A. It divides the control-plane and data-plane functions.
Disaggregation in controller-based networking refers to the separation of the control plane (decision-making and routing logic) from the data plane (packet forwarding). This separation allows for more flexible, programmable networks where intelligence is centralized in controllers while forwarding devices focus on moving data efficiently. This is fundamental to Software-Defined Networking (SDN).
Why the other options are wrong
- B. This describes functional division of devices, not the control/data plane separation of disaggregation.
- C. Route summarization between layers is a routing function, not related to disaggregation.
- D. Network topology conversion is unrelated to the control/data plane disaggregation concept.
Question 195
An office has 8 floors with approximately 30-40 users per floor. One subnet must be used. Which command must be configured on the router Switched Virtual Interface to use address space efficiently?
Show answer and explanation
Correct answer: B. ip address 192.168.0.0 255.255.254.0
With 8 floors and 30-40 users per floor, the maximum need is approximately 320 addresses. A /23 network (255.255.254.0) provides 512 usable addresses (510 hosts), which efficiently accommodates the entire building in one subnet while minimizing waste. A /24 (option A) would only provide 254 addresses, which is insufficient. Options C and D provide even smaller address spaces unsuitable for the requirement.
Why the other options are wrong
- A. A /24 with mask 255.255.255.0 provides only 254 usable addresses, insufficient for 8 floors × 40 users.
- C. A /25 with mask 255.255.255.128 provides only 126 usable addresses, far too small for the total requirement.
- D. A /27 with mask 255.255.255.224 provides only 30 usable addresses, insufficient even for a single floor.
Question 196
What is a feature of TFTP?
Show answer and explanation
Correct answer: A. offers anonymous user login ability
TFTP (Trivial File Transfer Protocol) offers anonymous user login capability without requiring authentication credentials. This is a defining characteristic of TFTP, making it useful for simple file transfers in network boot scenarios.
Why the other options are wrong
- B. FTP uses two separate connections; TFTP uses a single connection over UDP.
- C. TFTP uses UDP port 69, not TCP port 20 (which is used by FTP data transfers).
- D. TFTP provides no security features; it transmits data in plaintext without encryption.
Question 197
What are two examples of multifactor authentication? (Choose two.)
Show answer and explanation
Correct answer: B, E. soft tokens; unique user knowledge
Soft tokens (B) are one authentication factor (something you have), and unique user knowledge (E) represents another factor (something you know). Together they constitute multifactor authentication.
Why the other options are wrong
- A. Single sign-on is a convenience mechanism, not an authentication factor.
- C. Password expiration is an access control policy, not an authentication factor.
- D. A shared password repository is a credential management mechanism, not an authentication factor itself.
Question 198
What facilitates a Telnet connection between devices by entering the device name?
Show answer and explanation
Correct answer: B. DNS lookup
DNS (Domain Name System) lookup facilitates Telnet connections by resolving device names to their IP addresses. When a user enters a device name instead of an IP address, the local DNS resolver queries the DNS server to obtain the corresponding IP address, allowing the Telnet connection to proceed.
Why the other options are wrong
- A. SNMP is used for network monitoring and management, not for hostname resolution.
- C. Syslog is used for centralized logging of system messages, not for name-to-IP resolution.
- D. NTP synchronizes time across devices but does not resolve device names to IP addresses.
Question 199
How do TCP and UDP differ in the way they guarantee packet delivery?
Show answer and explanation
Correct answer: C. TCP uses checksum, acknowledgements, and retransmissions, and UDP uses checksums only
TCP guarantees packet delivery through three mechanisms: checksums for error detection, acknowledgements to confirm receipt, and retransmissions to resend lost packets. UDP, being connectionless and unreliable, only uses checksums for basic error detection but does not guarantee delivery or retransmit lost packets. This is the fundamental difference between these transport layer protocols.
Why the other options are wrong
- A. Parity checks are not a standard TCP mechanism; UDP does not use cyclic redundancy checks as its only method.
- B. Two-dimensional parity checks are not used in TCP; UDP does not use retransmissions.
- D. TCP does not use parity checks as a primary delivery guarantee; UDP does not use acknowledgements.
Question 200
What is the difference between IPv6 unicast and anycast addressing?
Show answer and explanation
Correct answer: A. An individual IPv6 unicast address is supported on a single interface on one node, but an IPv6 anycast address is assigned to a group of interfaces on multiple nodes.
IPv6 unicast addresses are assigned to a single interface on a single node and receive traffic destined for that specific address. IPv6 anycast addresses are assigned to multiple interfaces on different nodes, and traffic destined for an anycast address is delivered to the nearest instance (in terms of routing distance). This is the fundamental distinction between the two addressing types.
Why the other options are wrong
- B. Both unicast and anycast nodes require routing configuration; this statement incorrectly characterizes their configuration requirements.
- C. Unicast nodes do not require special configuration; they work by default. This reverses the actual requirements.
- D. This contradicts the definition; unicast is for individual interfaces, while anycast is assigned to groups of interfaces.
Question 201
The service password-encryption command is entered on a router. What is the effect of this configuration?
Show answer and explanation
Correct answer: A. restricts unauthorized users from viewing clear-text passwords in the running configuration
The 'service password-encryption' command encrypts passwords in the running configuration display, restricting unauthorized users from viewing clear-text passwords. It does not prevent administrators from entering clear-text passwords, protect VLAN databases, or encrypt VPN tunnel traffic.
Why the other options are wrong
- B. Administrators can still configure clear-text passwords; the command only hides them in display output
- C. This command does not protect the VLAN database from unauthorized connections
- D. This command does not encrypt VPN tunnel traffic; that requires VPN protocol configuration
Question 202
Which command creates a static NAT binding for a PC address of 10.1.1.1 to the public routable address 209.165.200.225 assigned to the PC?
Show answer and explanation
Correct answer: A. R1(config)#ip nat inside source static 10.1.1.1 209.165.200.225
Static NAT syntax requires 'ip nat inside source static' followed by the private (inside) address first, then the public (outside) address. The private address 10.1.1.1 is on the inside network and maps to public address 209.165.200.225. Option A correctly orders these parameters.
Why the other options are wrong
- B. Uses 'outside source' which is incorrect; NAT translation should be configured from the inside perspective.
- C. Reverses the address order, putting the public address before the private address.
- D. Uses 'outside source' and reverses the address order, both incorrect for this scenario.
Question 203
Which two circumstances can prevent two routers from establishing an OSPF neighbor adjacency? (Choose two.)
Show answer and explanation
Correct answer: D, E. mismatched hello timers and dead timers; use of the same router ID on both devices
Mismatched hello and dead timers prevent neighbors from establishing adjacency because they cannot agree on keepalive intervals, and duplicate router IDs prevent adjacency because OSPF requires unique identifiers per router. Both of these are critical OSPF parameters that must match or be unique respectively for neighbor formation.
Why the other options are wrong
- A. Autonomous system numbers are used in EIGRP, not OSPF; OSPF uses process IDs which must match for the same routing domain.
- B. OSPF uses unicast for neighbor establishment on point-to-point links, and multicast 224.0.0.5 is used for hellos, not 224.0.0.10.
- C. Process IDs do not need to match between routers; they are locally significant and do not affect neighbor adjacency.
Question 204
What are two reasons a network administrator would use CDP? (Choose two.)
Show answer and explanation
Correct answer: D, E. to verify Layer 2 connectivity between two devices when Layer 3 fails; to obtain the IP address of a connected device in order to telnet to the device
Network administrators use CDP to obtain the IP address of directly connected devices for remote management (option E) and to verify Layer 2 connectivity between devices when Layer 3 connectivity fails (option D). CDP discovers directly connected neighbors at the data link layer, making it useful for these troubleshooting and management tasks.
Why the other options are wrong
- A. CDP does not verify cable types; it only confirms device presence and connectivity.
- B. CDP cannot determine the status of network services on remote devices; it only shows device presence.
- C. CDP obtains VLAN information only in limited cases and is not a primary use case.
- F. CDP cannot determine routing protocol status between devices; it only shows direct connectivity.
Question 205
How are the switches in a spine-and-leaf topology interconnected?
Show answer and explanation
Correct answer: B. Each leaf switch is connected to each spine switch.
In a spine-and-leaf topology, each leaf switch is connected to every spine switch, creating a full mesh between the two layers. This design provides redundancy, equal path lengths, and optimal load distribution. Traffic from any leaf switch can traverse to any other leaf switch through any spine switch with equal cost paths.
Why the other options are wrong
- A. Connecting each leaf to only one spine eliminates redundancy and defeats the purpose of the spine-and-leaf architecture.
- C. Looping connections between two spine switches creates spanning tree blocking and is not part of the spine-and-leaf design.
- D. There is no central leaf switch in spine-and-leaf topology; the design uses separate layers of spine and leaf switches.
Question 206
What are two benefits of using the PortFast feature? (Choose two.)
Show answer and explanation
Correct answer: C, D. Enabled interfaces never generate topology change notifications; Enabled interfaces come up and move to the forwarding state immediately.
PortFast allows interfaces to skip the listening and learning states and move directly to forwarding, which means they never generate topology change notifications (since they bypass the normal STP state transitions). Option C is correct because PortFast-enabled ports transition directly to forwarding without going through learning state, thus avoiding topology change notifications. Option D is correct because this is the primary benefit, interfaces come up immediately in forwarding state rather than waiting through STP timers.
Why the other options are wrong
- A. PortFast enables interfaces to skip listening state entirely, not to be placed in it.
- B. PortFast eliminates the wait time; interfaces move to forwarding immediately, not after 50 seconds.
- E. PortFast-enabled interfaces do not enter learning state, so they never generate topology change notifications from that transition.
Question 207
Which command can you enter to allow Telnet to be supported in addition to SSH?
Show answer and explanation
Correct answer: A. transport input telnet ssh
The command `transport input telnet ssh` enables both Telnet and SSH protocols on virtual terminal (VTY) lines. This allows multiple access methods for remote management of the device while maintaining security options.
Why the other options are wrong
- B. This command only enables Telnet, not SSH in addition to it.
- C. This command disables Telnet rather than enabling both protocols.
- D. Privilege level configuration does not control which protocols are supported.
Question 208
Which port type supports the spanning-tree portfast command without additional configuration?
Show answer and explanation
Correct answer: D. access ports
The spanning-tree portfast command is designed for and supports access ports without additional configuration. Access ports are edge ports that connect end devices and benefit from PortFast by skipping the listening and learning states. Trunk ports, Layer 3 interfaces, and sub-interfaces do not support portfast without additional configuration or modifications.
Why the other options are wrong
- A. Trunk ports do not support portfast without additional configuration due to their role in spanning-tree topology.
- B. Layer 3 sub-interfaces are routed interfaces and do not participate in spanning-tree.
- C. Layer 3 main interfaces are routed and do not support spanning-tree portfast.
Question 209
What mechanism carries multicast traffic between remote sites and supports encryption?
Show answer and explanation
Correct answer: D. GRE over IPsec
GRE over IPsec is the mechanism that carries multicast traffic between remote sites while supporting encryption. GRE encapsulates multicast packets, and IPsec provides the encryption layer for secure transport across untrusted networks.
Why the other options are wrong
- A. ISATAP is a tunnel mechanism for IPv6 but does not inherently support encryption.
- B. IPsec over ISATAP does not efficiently support multicast traffic delivery.
- C. GRE alone encapsulates multicast but does not provide encryption without IPsec.
Question 210
Which network action occurs within the data plane?
Show answer and explanation
Correct answer: D. compare the destination IP address to the IP routing table
The data plane handles the forwarding of actual user traffic. Comparing a destination IP address to the routing table and making forwarding decisions is a core data plane function that occurs on every packet. This is distinguished from control plane activities like running routing protocols or processing management commands.
Why the other options are wrong
- A. Replying to ICMP echo requests involves both control and data planes, but is primarily a control plane function.
- B. Processing NETCONF RPCs is a management plane function, not data plane.
- C. Running routing protocols (OSPF, EIGRP, RIP, BGP) is a control plane function that determines what routes exist, not data plane forwarding.
Question 211
A WLC sends alarms about a rogue AP, and the network administrator verifies that the alarms are caused by a legitimate autonomous AP. How must the alarms be stopped for the MAC address of the AP?
Show answer and explanation
Correct answer: D. Set the AP Class Type to Friendly.
To stop alarms about a rogue access point that is actually legitimate, set the AP Class Type to 'Friendly'. This tells the WLC that the AP is authorized and legitimate, preventing it from generating rogue AP alarms.
Why the other options are wrong
- A. Removing the AP from WLC management would not stop alarms; the AP is not necessarily managed by the WLC.
- B. Manual containment is a containment action for hostile rogue APs, not for friendly legitimate APs.
- C. Manually removing the AP from Pending state is not the correct procedure for classifying legitimate APs.
Question 212
Which statement about LLDP is true?
Show answer and explanation
Correct answer: B. It is configured in global configuration mode.
LLDP (Link Layer Discovery Protocol) is configured in global configuration mode on network devices. LLDP is an industry-standard, vendor-independent protocol that runs at the data link layer and allows devices to discover and advertise their identity and capabilities to directly connected neighbors.
Why the other options are wrong
- A. LLDP is an open, industry-standard protocol, not Cisco proprietary (unlike CDP).
- C. LLDP update frequency is configurable and not a fixed value.
- D. LLDP runs at the data link layer (Layer 2), not the transport layer (Layer 4).
Question 213
When a switch receives a frame for an unknown destination MAC address, how is the frame handled?
Show answer and explanation
Correct answer: A. flooded to all ports except the origination port
When a switch receives a frame with an unknown destination MAC address (not found in its MAC address table), it floods the frame to all ports except the port where the frame originated. This ensures the destination device receives the frame if it is connected to any other port on the switch. This is fundamental switch forwarding behavior.
Why the other options are wrong
- B. The switch does not forward to just the first available port; it floods to all relevant ports.
- C. Broadcasting implies a broadcast address; flooding for unknown unicast destinations sends to all ports except the originating one, not a full broadcast.
- D. Unknown destination frames are not dropped; they are flooded to allow the destination to be reached.
Question 214
What are two benefits that the UDP protocol provide for application traffic? (Choose two.)
Show answer and explanation
Correct answer: A, E. UDP traffic has lower overhead than TCP traffic; The application can use checksums to verify the integrity of application data
UDP has lower overhead than TCP because it omits connection establishment, flow control, and retransmission mechanisms, making it faster for latency-sensitive applications. UDP also allows applications to implement optional checksums for data integrity verification, providing flexibility without the overhead of TCP's mandatory reliability features.
Why the other options are wrong
- B. UDP does not provide automatic retransmission; it is connectionless and unreliable.
- C. UDP has no CTL field or three-way handshake; it is connectionless.
- D. UDP does not maintain connection state; TCP maintains connection state for stability.
Question 215
By default, which virtual MAC address does HSRP group 14 use?
Show answer and explanation
Correct answer: D. 00:00:0c:07:ac:0e
HSRP version 1 uses the virtual MAC address 0000.0c07.acXX, where XX is the group number in hexadecimal. Group 14 is 0e in hex, giving 00:00:0c:07:ac:0e.
Why the other options are wrong
- A. The 00:05:5e prefix does not match the Cisco HSRP virtual MAC format, and 14 is not converted to hex.
- B. This does not use the HSRP 0000.0c07.ac prefix and writes the group number in decimal instead of hex.
- C. This address has no relationship to the HSRP virtual MAC format.
Question 216
Which protocol prompts the Wireless LAN Controller to generate its own local web administration SSL certificate for GUI access?
Show answer and explanation
Correct answer: B. HTTPS
HTTPS (B) is the protocol that prompts the Wireless LAN Controller to generate its own local web administration SSL certificate for GUI access. When HTTPS is used for web administration, the WLC automatically creates a self-signed SSL certificate to secure the connection between the administrator's browser and the WLC management interface.
Why the other options are wrong
- A. RADIUS is an authentication protocol, not related to SSL certificate generation
- C. TACACS+ is an authentication protocol, not related to SSL certificate generation
- D. HTTP is unencrypted and does not require or generate SSL certificates
Question 217
What is a difference between local AP mode and FlexConnect AP mode?
Show answer and explanation
Correct answer: A. Local AP mode creates two CAPWAP tunnels per AP to the WLC
In Local AP mode, each access point creates two CAPWAP (Control and Provisioning of Wireless Access Points) tunnels to the Wireless LAN Controller, one for control traffic and one for data traffic. This dual-tunnel architecture is specific to Local AP mode and enables the WLC to manage and handle all traffic centrally.
Why the other options are wrong
- B. Local AP mode does not cause the AP to behave as an autonomous AP; that describes autonomous mode or standalone operation.
- C. FlexConnect mode is specifically designed to function even when the AP loses connectivity with the WLC by using local switching, so this statement is false.
- D. In FlexConnect mode with local switching configured, traffic is switched locally at the AP, not bridged to the WLC; this option describes the opposite of actual behavior.
Question 218
You have configured a router with an OSPF router ID, but its IP address still reflects the physical interface. Which action can you take to correct the problem in the least disruptive way?
Show answer and explanation
Correct answer: A. Reload the OSPF process
Reloading the OSPF process using clear ip ospf process causes OSPF to re-elect its router ID, allowing it to recognize and use the configured router ID without requiring a full router reboot. This is the least disruptive method to correct the issue.
Why the other options are wrong
- B. While a loopback address helps for router ID selection going forward, it does not immediately correct the current problem.
- C. Rebooting the entire router is more disruptive than necessary.
- D. Saving the configuration alone does not force the router ID to be re-elected.
Question 219
Which type of wireless encryption is used for WPA2 in preshared key mode?
Show answer and explanation
Correct answer: A. AES-128
WPA2 in preshared key (PSK) mode uses AES-128 encryption by default. WPA2-PSK implements AES with a 128-bit key size. AES-256 would require enterprise mode or specific configuration, so it does not apply to standard WPA2-PSK.
Why the other options are wrong
- B. TKIP with RC4 is associated with WPA, not WPA2.
- C. AES-256 is not the standard encryption for WPA2-PSK mode.
- D. RC4 is an older stream cipher used in WPA, not WPA2.
Question 220
Which effect does the aaa new-model configuration command have?
Show answer and explanation
Correct answer: A. It enables AAA services on the device.
The 'aaa new-model' command globally enables AAA (Authentication, Authorization, and Accounting) services on a Cisco device. It is the foundational command that must be executed first before any other AAA-related configurations can be applied. Without this command, AAA services are not active.
Why the other options are wrong
- B. Connecting to a RADIUS server requires additional commands like 'radius server' and 'aaa group server radius'.
- C. Associating a RADIUS server to a group requires separate configuration commands after AAA is enabled.
- D. Configuring local users is done with different commands like 'username' and does not require aaa new-model alone.
Question 221
Which IPv6 address block sends packets to a group address rather than a single address?
Show answer and explanation
Correct answer: D. FF00::/8
IPv6 multicast addresses use the FF00::/8 block and are designed to send packets to a group of addresses rather than a single unicast address. Multicast enables one-to-many communication where a single packet is delivered to multiple recipients identified by a single multicast group address.
Why the other options are wrong
- A. 2000::/3 is the global unicast address block for single host communication.
- B. FC00::/7 is the unique local address block for private unicast communication.
- C. FE80::/10 is the link-local address block for single-link unicast communication.
Question 222
What is a function of a remote access VPN?
Show answer and explanation
Correct answer: D. allows the users to access company internal network resources through a secure tunnel
Remote access VPNs allow individual users to securely connect to internal company network resources from remote locations through an encrypted tunnel, enabling access to internal resources without being physically present on the company network.
Why the other options are wrong
- A. This describes a site-to-site VPN, not remote access VPN.
- B. This is a characteristic but not the primary function; remote access is for individual users.
- C. Remote access VPNs are used precisely when users are NOT connected to the internal network.
Question 223
Which statement about VLAN configuration is true?
Show answer and explanation
Correct answer: A. The switch must be in VTP server or transparent mode before you can configure a VLAN
Before configuring a VLAN on a switch, the switch must be in VTP (VLAN Trunking Protocol) server or transparent mode. VTP client mode does not allow VLAN creation. This requirement ensures proper VLAN management and synchronization across the network when using VTP.
Why the other options are wrong
- B. Extended VLANs (1006-4094) do not require a specific config-vlan mode; they follow normal VLAN configuration procedures.
- C. Dynamic inter-VLAN routing applies to normal VLANs (1-1005), and extended VLANs (1006-4094) do not support dynamic inter-VLAN routing in the same way.
- D. A switch in VTP transparent mode saves VLAN configurations to both the running configuration and the startup configuration, not just running configuration.
Question 224
Which two statements about exterior routing protocols are true? (Choose two.)
Show answer and explanation
Correct answer: B, C. They determine the optimal path between autonomous systems; BGP is the current standard exterior routing protocol.
Exterior routing protocols determine optimal paths between autonomous systems (statement B is true), and BGP is the current standard exterior routing protocol used in modern networks (statement C is true). Statement A is incorrect because that describes interior routing; EGP and EIGRP are not commonly supported together in modern networks as exterior protocols.
Why the other options are wrong
- A. Interior routing protocols determine optimal paths within an AS, not exterior protocols.
- D. Most modern networks use only BGP for external routing, not both EGP and BGP together.
- E. EIGRP is an interior routing protocol, not an exterior protocol, and EGP is obsolete.
Question 225
What is a function of a Next-Generation IPS?
Show answer and explanation
Correct answer: A. correlates user activity with network events
A Next-Generation IPS correlates user activity with network events to provide advanced threat detection and visibility. This correlation enables context-aware security decisions and identifies sophisticated attacks that involve coordinated activities across users and network traffic.
Why the other options are wrong
- B. Acting as a controller is a network architecture function, not specific to IPS.
- C. RADIUS server integration is part of AAA systems, not a core IPS function.
- D. MAC address learning is a switch function, not an IPS function.
Question 226
On workstations running Microsoft Windows, which protocol provides the default gateway for the device?
Show answer and explanation
Correct answer: B. DHCP
DHCP (Dynamic Host Configuration Protocol) is responsible for providing IP configuration information to Windows workstations, including the default gateway address. The DHCP server distributes the gateway information in DHCP Offer messages that clients use to route traffic outside their local subnet.
Why the other options are wrong
- A. STP (Spanning Tree Protocol) manages network topology, not gateway assignment.
- C. SNMP is used for network management and monitoring, not gateway configuration.
- D. DNS resolves domain names to IP addresses, not gateway assignment.
Question 227
You have two paths for the 10.10.10.0 network - one that has a feasible distance of 3072 and the other of 6144. What do you need to do to load balance your EIGRP routes?
Show answer and explanation
Correct answer: C. Change the variance for the path that has a feasible distance of 3072 to 2
To enable unequal-cost load balancing in EIGRP, the variance must be set to a value that allows the higher feasible distance route to be considered. With feasible distances of 3072 and 6144, a variance of 2 (6144÷3072=2) would allow both paths to be used for load balancing.
Why the other options are wrong
- A. Changing maximum paths enables load balancing only if routes meet the feasibility condition; it does not address the distance mismatch.
- B. You cannot arbitrarily change feasible distances; they are calculated based on actual network metrics.
- D. Changing IP addresses does not affect load balancing decisions in EIGRP.
Question 228
Which mode must be set for Aps to communicate to a Wireless LAN Controller using the Control and Provisioning of Wireless Access Points (CAPWAP) protocol?
Show answer and explanation
Correct answer: C. lightweight
Access Points must be configured in lightweight mode to communicate with a Wireless LAN Controller using the CAPWAP protocol. In lightweight mode, the AP delegates control functions to the WLC and only handles data forwarding and wireless transmission.
Why the other options are wrong
- A. Route mode is not a valid AP operational mode in Cisco wireless architecture.
- B. Bridge mode is not applicable for AP-to-WLC communication; CAPWAP uses lightweight mode.
- D. Autonomous mode means the AP operates independently without a WLC and does not use CAPWAP.
Question 229
What are two characteristics of an SSID? (Choose two.)
Show answer and explanation
Correct answer: B, E. It is at most 32 characters long; It can be hidden or broadcast in a WLAN.
An SSID (Service Set Identifier) is the network name broadcast or hidden by a wireless access point. Option B correctly states that SSIDs are at most 32 characters long. Option E correctly identifies that SSIDs can be hidden or broadcast. Option C is incorrect because the SSID identifies the network, not the individual access point. Option A is wrong because SSIDs identify networks, not clients. Option D is wrong because SSIDs provide network identification, not security themselves.
Why the other options are wrong
- A. SSIDs identify networks, not individual clients in a WLAN.
- C. SSIDs identify a wireless network, not a specific access point.
- D. SSIDs do not provide security; they only identify the network name.
Question 230
Which two pieces of information can you determine from the output of the show ntp status command? (Choose two.)
Show answer and explanation
Correct answer: B, D. the IP address of the peer to which the clock is synchronized; whether the clock is synchronized
The 'show ntp status' command displays whether the system clock is synchronized (indicating sync status) and the IP address of the NTP peer to which the clock is synchronized. These two pieces of information are essential for verifying NTP operation. The command does not provide information about static configuration of peers, configured servers, or the specific NTP version of the peer.
Why the other options are wrong
- A. Show ntp status does not indicate whether a peer is statically configured
- C. Show ntp status does not list the configured NTP servers; use 'show ntp associations' for that
- E. Show ntp status does not display the NTP version number of the peer
Question 231
An engineer configured an OSPF neighbor as a designated router. Which state verifies the designated router is in the proper mode?
Show answer and explanation
Correct answer: D. Full
The Full state indicates that an OSPF router has completed its neighbor relationship and has fully synchronized its link-state database with the neighbor. A designated router must reach the Full state to properly function in its role. The Init state is the first state when discovering neighbors, 2-way is when bidirectional communication is established, and Exchange is when routers begin synchronizing their databases, but Full is the final state indicating complete adjacency.
Why the other options are wrong
- A. Init is the initial state when a router first detects a neighbor; it does not indicate proper DR mode operation.
- B. 2-way state means routers can see each other but have not fully synchronized databases; this is not the proper DR state.
- C. Exchange state is when routers are in the process of synchronizing their databases but have not completed it.
Question 232
Which two actions are performed by the Weighted Random Early Detection mechanism? (Choose two.)
Show answer and explanation
Correct answer: D, E. It can mitigate congestion by preventing the queue from filling up; It drops lower-priority packets before it drops higher-priority packets.
WRED (Weighted Random Early Detection) operates by selectively dropping packets based on queue depth and packet priority before the queue becomes full. It drops lower-priority packets first (option E) to prevent queue overflow (option D), thereby mitigating congestion through early, intelligent packet discard rather than tail-drop behavior.
Why the other options are wrong
- A. WRED does not perform protocol discovery; it manages queue congestion.
- B. WRED cannot guarantee delivery; it actively drops packets to manage congestion.
- C. While WRED can differentiate flows, it identifies them at a basic level using IP header information, not with particularly high granularity compared to DPI methods.
Question 233
What is a role of access points in an enterprise network?
Show answer and explanation
Correct answer: C. connect wireless devices to a wired network
Access points serve as the bridge between wireless devices and the wired network infrastructure, allowing wireless clients to connect to the corporate network. Option A confuses AP functions with SNMP and DDoS mitigation, option B describes firewalls as the first line of defense, and option D describes authentication services handled by centralized servers, not access points themselves.
Why the other options are wrong
- A. SNMP and DDoS prevention are not access point functions.
- B. Firewalls and edge security devices serve as the first line of defense, not APs.
- D. Secure logins are handled by authentication servers and RADIUS, not the AP itself.
Question 234
Which two practices are recommended for an acceptable security posture in a network? (Choose two.)
Show answer and explanation
Correct answer: D, E. Disable unused or unnecessary ports, interfaces, and services; Maintain network equipment in a secure location.
Disabling unused ports and services reduces attack surface (D), and maintaining equipment in secure locations prevents physical tampering and unauthorized access (E). These are fundamental hardening practices. Backing up to USB drives compromises encryption, and placing internal servers in DMZ defeats the purpose of segmentation.
Why the other options are wrong
- A. Cryptographic keychains are not a standard recommended authentication practice; proper key management systems should be used instead.
- B. Internal email and file servers should be in secure internal networks, not DMZ, which is designed for external-facing services.
- C. Backing up to uncontrolled USB drives introduces security risks and does not align with secure backup practices.
Question 235
Which action does the router take as it forwards a packet through the network?
Show answer and explanation
Correct answer: C. The router replaces the original source and destination MAC addresses with the sending router MAC address as the source and neighbor MAC address as the destination.
When a router forwards a packet, it keeps the source and destination IP addresses unchanged but replaces the source MAC address with its own outgoing interface MAC address and the destination MAC address with the next-hop router's MAC address. This is the standard Layer 2 rewriting process in routing.
Why the other options are wrong
- A. Routers do not encapsulate original packets with tags identifying source MAC; MAC rewriting occurs instead.
- B. IP addresses are not encapsulated with the sending router IP as source; IP headers remain unchanged.
- D. Label rewriting is a concept in MPLS, not standard IP routing forwarding behavior.
Question 236
Which QoS Profile is selected in the GUI when configuring a voice over WLAN deployment?
Show answer and explanation
Correct answer: A. Platinum
Platinum is the highest priority QoS profile used for voice over WLAN deployments in the Cisco GUI configuration. Platinum provides the strictest quality of service guarantees needed for real-time voice traffic requirements.
Why the other options are wrong
- B. Bronze is a lower-tier QoS profile unsuitable for voice.
- C. Gold is a mid-tier profile, insufficient for critical voice applications.
- D. Silver is a lower-tier profile not designated for voice deployments.
Question 237
What protocol allows an engineer to back up 20 network router configurations globally while using the copy function?
Show answer and explanation
Correct answer: C. FTP
FTP (File Transfer Protocol) is the appropriate protocol for backing up multiple network configurations globally. FTP provides reliable file transfer capabilities and is widely supported across network devices for configuration backup and restoration. While SNMP is used for network management, it is not the primary protocol for bulk configuration file transfers. TCP is a transport layer protocol, not an application protocol for this purpose. SMTP is for email.
Why the other options are wrong
- A. TCP is a transport layer protocol, not an application-level file transfer mechanism
- B. SMTP is designed for email transmission, not file backup
- D. SNMP is for network management and monitoring, not bulk configuration file transfers
Question 238
An engineer requires a switch interface to actively attempt to establish a trunk link with a neighbor switch. What command must be configured?
Show answer and explanation
Correct answer: B. switchport mode dynamic desirable
The switchport mode dynamic desirable (B) command configures an interface to actively attempt to establish a trunk link with a neighbor switch. In desirable mode, the switch actively sends DTP frames and will form a trunk with any neighboring port in trunk, desirable, or auto mode. This is the actively attempting mode, whereas auto mode only responds to requests.
Why the other options are wrong
- A. Switchport mode trunk statically configures a trunk but does not dynamically negotiate
- C. Switchport nonegotiate disables DTP negotiation; it does not actively attempt trunking
- D. Switchport mode dynamic auto does not actively attempt; it only responds to requests from desirable
Question 239
Which two characteristics describe the access layer in a three-tier network architecture? (Choose two.)
Show answer and explanation
Correct answer: B, D. physical connection point for a LAN printer; layer at which a wireless access point connects to the wired network
The access layer is characterized as the physical connection point where end devices like LAN printers connect to the network, and it is where wireless access points connect to the wired infrastructure. These are the defining functions of the access tier in three-tier design.
Why the other options are wrong
- A. Serving as the network aggregation point is a function of the distribution layer, not the access layer.
- C. Continuous redundant uptime requirements are designed at the core layer, not the access layer.
- E. Providing a boundary between Layer 2 and Layer 3 is a function of the distribution layer, which typically houses L3 routing.
Question 240
What prevents a workstation from receiving a DHCP address?
Show answer and explanation
Correct answer: A. STP
STP (Spanning Tree Protocol) can block ports to prevent loops, which would prevent a workstation from sending DHCP discovery packets and receiving an address. If a port is in a blocking state, no traffic including DHCP can traverse it. The other options (VTP, 802.1Q, DTP) are VLAN-related protocols that don't directly block DHCP.
Why the other options are wrong
- B. VTP manages VLAN information but does not prevent DHCP address assignment.
- C. 802.1Q is a VLAN tagging standard and does not prevent DHCP functionality.
- D. DTP negotiates trunk status between switches but does not block DHCP traffic.
Question 241
A Cisco engineer is configuring a factory-default router with these three passwords: • The user EXEC password for console access is p4ssw0rd1. • The user EXEC password for Telnet access is s3cr3t2. • The password for privileged EXEC mode is priv4t3p4ss. Which command sequence must the engineer configure?
Show answer and explanation
Correct answer: B. enable secret priv4t3p4ss ! line con 0 password p4ssw0rd1 login ! line vty 0 15 password s3cr3t2 login
The correct sequence requires: (1) 'enable secret' for privileged mode password, (2) 'line con 0' with 'password' and 'login' for console access, and (3) 'line vty 0 15' with 'password' and 'login' for Telnet access. The 'login' command is required on both line types to prompt for password authentication. Option B correctly includes all necessary commands with proper syntax.
Why the other options are wrong
- A. Missing 'login' commands on both line con 0 and line vty, which means passwords won't be prompted.
- C. Incorrect syntax with 'password login' instead of 'password' followed by 'login' as separate commands.
- D. Uses incorrect syntax 'enable secret privilege 15' which is not valid Cisco configuration.
Question 242
An engineer observes high usage on the 2.4GHz channels and lower usage on the 5GHz channels. What must be configured to allow clients to preferentially use 5GHz access points?
Show answer and explanation
Correct answer: A. Client Band Select
Client Band Select is a wireless configuration feature that allows access points to steer or encourage dual-band capable clients to preferentially connect to the 5GHz band, which typically offers higher throughput and less congestion. Re-Anchor Roamed Clients deals with client mobility, OEAP Split Tunnel is a VPN feature, and 11ac MU-MIMO is a 5GHz technology specification that doesn't control client band selection behavior.
Why the other options are wrong
- B. Re-Anchor Roamed Clients manages client roaming between access points, not band preference.
- C. OEAP Split Tunnel is a VPN configuration feature unrelated to band selection.
- D. 11ac MU-MIMO is a technical specification, not a configuration that steers clients to 5GHz.
Question 243
What is a function of Wireless LAN Controller?
Show answer and explanation
Correct answer: C. send LWAPP packets to access points
A Wireless LAN Controller (WLC) sends LWAPP (Lightweight Access Point Protocol) packets to access points to manage and control them. LWAPP is the control protocol used between WLCs and lightweight access points, enabling centralized management of wireless networks. The WLC uses this protocol to configure, monitor, and manage the access points.
Why the other options are wrong
- A. WLCs do not register with a single access point; rather, multiple APs register with the WLC.
- B. While SSIDs are used in wireless networks, this is not a primary function of the WLC itself.
- D. Monitoring is a function, but LWAPP packet transmission is the more specific and fundamental function.
Question 244
What is a recommended approach to avoid co-channel congestion while installing access points that use the 2.4 GHz frequency?
Show answer and explanation
Correct answer: A. different nonoverlapping channels
To avoid co-channel congestion when deploying access points on the 2.4 GHz frequency, the recommended approach is to use different nonoverlapping channels. The 2.4 GHz band has only three non-overlapping channels (1, 6, and 11 in North America), and deploying access points on different non-overlapping channels prevents interference and signal degradation. Options B, C, and D all involve overlapping channels, which cause interference and congestion.
Why the other options are wrong
- B. Using overlapping channels creates interference and defeats the purpose of avoiding congestion.
- C. Using only one non-overlapping channel limits deployment options and does not solve congestion.
- D. Using different overlapping channels causes co-channel interference and signal degradation.
Question 245
A device detects two stations transmitting frames at the same time. This condition occurs after the first 64 bytes of the frame is received. Which interface counter increments?
Show answer and explanation
Correct answer: C. late collision
A late collision occurs when two stations transmit frames simultaneously, but the collision is detected after the first 64 bytes of the frame have been received. Early collisions are detected within the first 64 bytes. Late collisions indicate a timing or distance problem and suggest violations of Ethernet cable length specifications or duplex mismatches.
Why the other options are wrong
- A. A runt is a frame shorter than the minimum Ethernet frame size, not related to simultaneous transmission detection.
- B. A collision counter increments for both early and late collisions, but the specific condition describes a late collision.
- D. CRC (cyclic redundancy check) errors are frame integrity errors, not related to simultaneous transmission detection.
Question 246
What are the two functions of SSIDs? (Choose two.)
Show answer and explanation
Correct answer: A, E. uses the maximum of 32 alphanumeric characters; broadcasts by default
SSIDs have two primary functions: they use a maximum of 32 alphanumeric characters as an identifier, and they are broadcast by default to allow devices to discover available networks. Options A and E correctly describe these functions.
Why the other options are wrong
- B. SSIDs do not control Wi-Fi network speed; this is determined by the Wi-Fi standard and configuration.
- C. SSIDs are used in both controller-based and standalone access point networks, not exclusively controller-based.
- D. An SSID can support multiple access points, not just a single one; this is common in enterprise deployments.
Question 247
An engineer configures interface Gi1/0 on the company PE router to connect to an ISP. Neighbor discovery is disabled. Which action is necessary to complete the configuration if the ISP uses third-party network devices?
Show answer and explanation
Correct answer: B. Enable LLDP globally.
The question states that neighbor discovery is disabled, and the exhibit shows that interface Gi1/0 already has lldp transmit and lldp receive configured. The interface part of LLDP is therefore done. Since the ISP uses third-party (non-Cisco) devices, Cisco Discovery Protocol (CDP) is not suitable because it is Cisco-proprietary. LLDP (IEEE 802.1AB) supports non-Cisco devices, and its global state is disabled by default. Enabling LLDP globally with lldp run completes the configuration.
Why the other options are wrong
- A. Disabling autonegotiation is not necessary; it has no bearing on neighbor discovery with the ISP devices.
- C. LLDP-MED is an extension of LLDP and is not required for basic neighbor discovery; standard LLDP is sufficient.
- D. Disabling CDP on the interface would eliminate neighbor discovery capability with Cisco devices and does not solve the third-party compatibility issue.
Question 248
Which IPsec transport mode encrypts the IP header and the payload?
Show answer and explanation
Correct answer: D. tunnel
IPsec tunnel mode encrypts the entire original IP packet including its header and payload, then wraps it in a new IP header. This is the correct definition of tunnel mode, which is commonly used for site-to-site VPNs.
Why the other options are wrong
- A. Pipe is not an IPsec transport mode.
- B. Transport mode only encrypts the payload and upper-layer protocols, not the IP header.
- C. Control is not an IPsec transport mode.
Question 249
On a corporate network, hosts on the same VLAN can communicate with each other, but they are unable to communicate with hosts on different VLANs. What is needed to allow communication between the VLANs?
Show answer and explanation
Correct answer: A. a router with subinterfaces configured on the physical interface that is connected to the switch
To allow communication between different VLANs, a router with subinterfaces configured on the physical interface connected to the switch is required. Each subinterface corresponds to a different VLAN and has its own IP address. Traffic is routed between VLANs using trunk links that carry tagged frames for multiple VLANs to the router.
Why the other options are wrong
- B. A router with only a single IP address on a physical interface cannot route between VLANs.
- C. Access links connect individual devices to single VLANs and do not enable inter-VLAN communication.
- D. While a trunk link is needed, a switch alone cannot route between VLANs; a router is required.
Question 250
A router running EIGRP has learned the same route from two different paths. Which parameter does the router use to select the best path?
Show answer and explanation
Correct answer: C. metric
EIGRP uses the metric to select the best path when multiple routes to the same destination exist. The EIGRP metric is calculated using bandwidth, delay, reliability, and load. When comparing two EIGRP routes, the one with the lower metric is chosen. Administrative distance is used to compare routes from different routing protocols, as-path is a BGP attribute, and cost is a generic term not used specifically in EIGRP.
Why the other options are wrong
- A. As-path is a BGP attribute used for path selection in BGP, not EIGRP.
- B. Administrative distance is used to compare routes learned from different routing protocols, not to select among multiple EIGRP routes.
- D. While 'cost' is conceptually related to metrics, EIGRP specifically uses the term 'metric' not 'cost' in its selection process.
Question 251
Which type if network attack overwhelms the target server by sending multiple packets to a port until the half-open TCP resources of the target are exhausted?
Show answer and explanation
Correct answer: A. SYN flood
A SYN flood attack overwhelms a target server by sending numerous SYN packets to a port, exhausting the server's half-open TCP connection resources. The server allocates resources for each SYN received and waits for the final ACK in the three-way handshake, which never arrives, leaving those resources tied up until timeout.
Why the other options are wrong
- B. Reflection attacks use intermediary servers to bounce traffic; they don't specifically target half-open TCP resources.
- C. Teardrop attacks exploit fragmentation by sending overlapping IP fragments, not involving TCP port exhaustion.
- D. Amplification attacks use third-party servers to magnify traffic volume, not directly exhausting half-open connections.
Question 252
Which technology is used to improve web traffic performance by proxy caching?
Show answer and explanation
Correct answer: A. WSA
The Web Security Appliance (WSA) is Cisco's solution for improving web traffic performance through proxy caching and content filtering. WSA caches frequently accessed web content, reducing bandwidth consumption and improving response times for users. This is its primary function in network security and performance optimization.
Why the other options are wrong
- B. Firepower is a threat defense and intrusion prevention platform, not a proxy caching solution.
- C. ASA is an adaptive security appliance focused on firewall and VPN functions, not web caching.
- D. FireSIGHT is a management and intelligence platform, not a web caching solution.
Question 253
What happens when a switch receives a frame with a destination MAC address that recently aged out?
Show answer and explanation
Correct answer: B. The switch floods the frame to all ports in the VLAN except the port that received the frame.
When a switch receives a frame with a destination MAC address that has aged out (removed from the MAC address table), the switch treats it as an unknown destination and floods the frame to all ports in the same VLAN except the originating port. This ensures the frame reaches its destination while maintaining VLAN boundaries.
Why the other options are wrong
- A. The switch floods within the specific VLAN, not to all VLANs, to maintain VLAN segmentation.
- C. There is no MAC address aging table that tracks historical addresses; aged entries are simply removed.
- D. The switch does not drop unknown destination frames; it floods them within the VLAN to find the destination.
Question 254
When the active router in a VRRP group fails, which router assumes the role and forwards packets?
Show answer and explanation
Correct answer: C. backup
In VRRP, the active router is called the master and the other routers in the group are backups. When the master fails, the backup with the highest priority becomes master and starts forwarding packets for the virtual IP.
Why the other options are wrong
- A. Forwarding is not a VRRP role name.
- B. Standby is the HSRP term, not the VRRP term.
- D. Listening is an HSRP and STP state, not a VRRP role.
Question 255
A network administrator is setting up a new IPv6 network using the 64-bit address 2001:0EB8:00C1:2200:0001:0000:0000:0331/64. To simplify the configuration, the administrator has decided to compress the address. Which IP address must the administrator configure?
Show answer and explanation
Correct answer: D. ipv6 address 2001:EB8:C1:2200:1::331/64
IPv6 compression rules allow removing leading zeros from each hextet and replacing one sequence of consecutive all-zero hextets with '::'. The original address 2001:0EB8:00C1:2200:0001:0000:0000:0331 compresses to 2001:EB8:C1:2200:1::331 by removing leading zeros and replacing the three consecutive zero hextets with ::.
Why the other options are wrong
- A. This omits a zero group; the address should have 0001 not just 1.
- B. This incorrectly compresses the first hextet; 2001 cannot become 21.
- C. This fails to use the :: compression for consecutive zero hextets, leaving 0000:331 instead of ::331.
Question 256
When OSPF learns multiple paths to a network, how does it select a route?
Show answer and explanation
Correct answer: C. It divides a reference bandwidth of 100 Mbps by the actual bandwidth of the exiting interface to calculate the route with the lowest cost.
OSPF calculates the cost of a route by dividing a reference bandwidth (default 100 Mbps) by the actual bandwidth of the interface. This cost is used as the metric, and OSPF selects the route with the lowest total cost. The formula is: Cost = Reference Bandwidth / Interface Bandwidth.
Why the other options are wrong
- A. OSPF uses cost (bandwidth-based), not a simple addition of metrics, and does not select based on lowest bandwidth alone.
- B. OSPF is a link-state protocol that uses cost metrics, not hop count like RIP.
- D. K values are used in EIGRP metric calculations, not OSPF.
Question 257
Which protocol requires authentication to transfer a backup configuration file from a router to a remote server?
Show answer and explanation
Correct answer: A. FTP
FTP (File Transfer Protocol) requires authentication with username and password credentials to establish a connection and transfer files. TFTP is an unauthenticated, simplified protocol; SMTP is for email; and DTP is not a standard file transfer protocol. FTP is the correct choice for secure, authenticated backup file transfers.
Why the other options are wrong
- B. SMTP is used for email transmission, not file transfers.
- C. TFTP is trivial FTP and requires no authentication.
- D. DTP is not a standard protocol for file transfers.
Question 258
Which wireless security protocol relies on Perfect Forward Secrecy?
Show answer and explanation
Correct answer: D. WPA3
WPA3 is the first wireless security protocol to mandate Perfect Forward Secrecy (PFS) through its use of Simultaneous Authentication of Equals (SAE) key exchange mechanism. PFS ensures that even if long-term keys are compromised, session keys remain secure.
Why the other options are wrong
- A. WEP is deprecated and uses static RC4 encryption without forward secrecy.
- B. WPA2 uses PSK or 802.1X but does not mandate Perfect Forward Secrecy.
- C. WPA was a transitional standard with limited forward secrecy capabilities compared to WPA3.
Question 259
Which configuration command can you apply to a HSRP router so that its local interface becomes active if all other routers in the group fail?
Show answer and explanation
Correct answer: A. no additional config is required
No additional configuration is required. By default, HSRP is configured so that if all other routers in the group fail, the local interface automatically becomes active. This is the inherent behavior of HSRP without needing specific commands like track, preempt, or priority adjustments.
Why the other options are wrong
- B. The 'standby track' command monitors specific interfaces but isn't needed for this scenario.
- C. The 'preempt' command allows a higher-priority router to take over, but doesn't address all-routers-fail scenario.
- D. Setting priority only affects comparison with other active routers, not automatic takeover on total failure.
Question 260
An engineer must configure traffic for a VLAN that is untagged by the switch as it crosses a trunk link. Which command should be used?
Show answer and explanation
Correct answer: D. switchport trunk native vlan 10
The native VLAN is the only VLAN whose traffic is untagged on a trunk link. By configuring 'switchport trunk native vlan 10', traffic for VLAN 10 will cross the trunk untagged while all other VLANs remain tagged, meeting the requirement for untagged VLAN traffic across the trunk.
Why the other options are wrong
- A. This command specifies the trunking encapsulation method (dot1q vs ISL) but does not designate an untagged VLAN.
- B. This command allows specific VLANs on the trunk but does not make them untagged.
- C. This command enables trunk mode but does not configure any VLAN as untagged.
Question 261
An email user has been lured into clicking a link in an email sent by their company's security organization. The webpage that opens reports that it was safe, but the link may have contained malicious code. Which type of security program is in place?
Show answer and explanation
Correct answer: A. user awareness
This scenario describes a user awareness or security awareness training exercise. The company intentionally sent a phishing-like email to test whether users would click suspicious links, and the resulting page confirmed the test was safe. This is a common method used to educate users about security threats and improve their ability to recognize social engineering attempts.
Why the other options are wrong
- B. A brute force attack attempts to guess credentials through repeated attempts, not phishing.
- C. Physical access control protects facilities and equipment, not user behavior regarding email links.
- D. While the email itself uses social engineering tactics, the overall program is user awareness training, not the attack itself.
Question 262
Which WAN access technology is preferred for a small office / home office architecture?
Show answer and explanation
Correct answer: A. broadband cable access
Broadband cable access is the preferred WAN technology for small office/home office environments because it offers high-speed connectivity, is cost-effective, and is widely available in residential and small business areas. It provides sufficient bandwidth for typical SOHO needs without the expense of dedicated leased lines or the limitations of older technologies.
Why the other options are wrong
- B. Frame-relay is legacy technology and expensive for SOHO deployments.
- C. Dedicated leased lines are too costly for typical SOHO budgets.
- D. ISDN provides limited bandwidth and is obsolete for modern SOHO requirements.
Question 263
Which two protocols must be disabled to increase security for management connections to a Wireless LAN Controller? (Choose two.)
Show answer and explanation
Correct answer: C, D. HTTP; Telnet
HTTP and Telnet should be disabled to increase security for management connections to a Wireless LAN Controller. Both protocols transmit credentials and management traffic in cleartext, making them vulnerable to eavesdropping and man-in-the-middle attacks. HTTPS, SSH, and TFTP should be used instead. HTTPS and SSH provide encrypted management access, while TFTP is typically used for firmware updates and is less critical for disabling compared to HTTP and Telnet.
Why the other options are wrong
- A. HTTPS should be enabled as it provides encrypted management access.
- B. SSH should be enabled as it provides secure encrypted management access.
- E. TFTP is for file transfer and is less critical than disabling HTTP and Telnet for management security.
Question 264
Which two pieces of information can you learn by viewing the routing table? (Choose two.)
Show answer and explanation
Correct answer: C, E. whether the administrative distance was manually or dynamically configured; the length of time that a route has been known
The routing table displays the administrative distance (AD) of routes, which indicates the trustworthiness of the routing source, and the length of time a route has been known (shown as the age or uptime of the route entry). The AD can be manually configured (static routes or redistributed routes) or dynamically determined by the routing protocol. ACL application direction, BGP/EIGRP AS numbers, and neighbor adjacencies are not visible in the routing table output.
Why the other options are wrong
- A. ACL application direction (inbound/outbound) is not shown in the routing table; this information is in ACL or interface configurations.
- B. BGP and EIGRP AS numbers are not displayed in the routing table.
- D. Neighbor adjacencies are shown in protocol-specific outputs like 'show eigrp neighbors' or 'show ip ospf neighbor', not the routing table.
Question 265
After installing a new Cisco ISE server which task must the engineer perform on the Cisco WLC to connect wireless clients on a specific VLAN based on their credentials?
Show answer and explanation
Correct answer: C. Enable the Allow AAA Override.
To allow the Cisco WLC to place wireless clients on specific VLANs based on their credentials from ISE, the engineer must enable AAA Override on the WLC. This setting allows RADIUS attributes returned from ISE (such as VLAN assignments) to override the default interface settings and dynamically assign clients to VLANs based on their authentication results.
Why the other options are wrong
- A. Disabling LAG Mode is unrelated to credential-based VLAN assignment.
- B. Event Driven RRM is for radio resource management, not VLAN assignment.
- D. Authorizing MIC APs is for authenticating mobility controllers, not client VLAN assignment.
Question 266
Which IPv6 address type provides communication between subnets and cannot route on the Internet?
Show answer and explanation
Correct answer: B. unique local
Unique local IPv6 addresses (FC00::/7) are designed for private communication within organizations or sites, similar to RFC 1918 private addresses in IPv4. They cannot route on the Internet but allow inter-subnet communication within a private network. Link-local addresses are limited to a single link, multicast addresses send to groups, and global unicast addresses are routable on the Internet.
Why the other options are wrong
- A. Link-local addresses (FE80::/10) are limited to a single link and cannot communicate between subnets.
- C. Multicast addresses are for group communication, not subnet-to-subnet communication.
- D. Global unicast addresses (2000::/3) are routable on the Internet.
Question 267
What is the difference between RADIUS and TACACS+?
Show answer and explanation
Correct answer: B. TACACS+ separates authentication and authorization, and RADIUS merges them.
A key difference between RADIUS and TACACS+ is that TACACS+ separates authentication and authorization into distinct phases, allowing more granular control. RADIUS combines authentication and authorization into a single process. This separation in TACACS+ enables more flexible and detailed access control policies.
Why the other options are wrong
- A. TACACS+ logs command-level accounting, but this is not the primary difference from RADIUS; both log accounting information differently.
- C. RADIUS encrypts only the password, while TACACS+ encrypts the entire payload, this is correct but option B is the more fundamental architectural difference.
- D. Both protocols can be used for multiple types of authentication; RADIUS is not limited to dial authentication only.
Question 268
Which enhancements were implemented as part of WPA3?
Show answer and explanation
Correct answer: A. Forward secrecy and SAE in personal mode for secure initial key exchange
WPA3 introduced Simultaneous Authentication of Equals (SAE) to replace Pre-Shared Key (PSK) exchange in personal mode, providing forward secrecy and protection against dictionary attacks. This is a key enhancement that provides secure initial key exchange without the weaknesses of WPA2's Four-Way Handshake.
Why the other options are wrong
- B. 802.1x authentication and AES-128 existed in WPA2 Enterprise, not introduced in WPA3.
- C. AES-64 is not a valid encryption standard; WPA3 uses AES-128 and AES-256.
- D. TKIP is a legacy WPA1 encryption method deprecated and removed in WPA3.
Question 269
What is a function spine-and-leaf architecture?
Show answer and explanation
Correct answer: A. Offers predictable latency of the traffic path between end devices.
A spine-and-leaf architecture provides predictable latency because every path from a leaf switch to another leaf switch traverses exactly the same number of hops through the spine layer. This consistent path length ensures deterministic latency regardless of which two devices communicate, making it ideal for data center environments requiring performance guarantees.
Why the other options are wrong
- B. Spine-and-leaf architecture is not specific to multicast traffic and does not limit multicast to directly connected servers.
- C. While spine-and-leaf improves bandwidth, it adds a layer rather than mitigating oversubscription through additional leaf switches.
- D. Spine-and-leaf architecture does not limit payload sizes within the leaf layer.
Question 270
What is a function of Opportunistic Wireless Encryption in an environment?
Show answer and explanation
Correct answer: B. protect traffic on open networks
Opportunistic Wireless Encryption (OWE) is designed to protect traffic on open networks by encrypting data even when connecting to networks without traditional authentication. It allows users to connect to open WiFi networks while still having their traffic encrypted, addressing the security vulnerability of unencrypted connections.
Why the other options are wrong
- A. OWE does not provide authentication; it only provides encryption protection.
- C. OWE does not offer compression capabilities.
- D. OWE uses modern encryption standards (not WEP, which is outdated and insecure).
Question 271
Which access layer threat-mitigation technique provides security based on identity?
Show answer and explanation
Correct answer: C. 802.1x
802.1x (Port-based Network Access Control) is an authentication protocol that provides security based on user or device identity. It requires authentication before granting network access, making identity the fundamental security mechanism, unlike the other options which work at the MAC or DHCP level without identity verification.
Why the other options are wrong
- A. Dynamic ARP Inspection prevents ARP spoofing but does not provide identity-based security.
- B. DHCP snooping prevents DHCP attacks but operates at the protocol level, not identity level.
- D. Using non-default native VLANs is a configuration best practice but does not provide identity-based security.
Question 272
Which function does an SNMP agent perform?
Show answer and explanation
Correct answer: A. It sends information about MIB variables in response to requests from the NMS
An SNMP agent is a software component running on a managed device that collects and maintains information about the device's operation. Its primary function is to respond to requests from the Network Management Station (NMS) by providing values of MIB (Management Information Base) variables. The agent acts as a passive responder to queries initiated by the NMS.
Why the other options are wrong
- B. Routing management is a function of routing protocols like OSPF, not SNMP agents.
- C. User authentication coordination is the role of TACACS+ or RADIUS servers, not SNMP agents.
- D. SNMP agents respond to requests; they do not initiate requests to remote nodes about catastrophic events.
Question 273
What causes a port to be placed in the err-disabled state?
Show answer and explanation
Correct answer: B. link flapping
Link flapping, the condition where a port rapidly transitions between up and down states, causes a switch port to enter the err-disabled state as a protective mechanism to prevent network instability caused by unstable connections.
Why the other options are wrong
- A. A port with nothing plugged in simply remains in a down or disabled state; this alone does not trigger err-disabled.
- C. Latency is a performance metric and does not cause ports to enter err-disabled state.
- D. The shutdown command explicitly disables a port but places it in shut down state, not err-disabled state.
Question 274
Why was the RFC 1918 address space defined?
Show answer and explanation
Correct answer: A. conserve public IPv4 addressing
RFC 1918 defined private address spaces (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) specifically to conserve the limited public IPv4 address space by allowing organizations to use private addresses internally while only consuming public addresses for external-facing devices.
Why the other options are wrong
- B. NAT existed independently; RFC 1918 was not defined to support NAT, though they work together.
- C. RFC 1918 addresses IPv4, not IPv6 space.
- D. While it may reduce overlapping issues, the primary purpose was address space conservation.
Question 275
What is the role of a firewall in an enterprise network?
Show answer and explanation
Correct answer: A. determines which packets are allowed to cross from unsecured to secured networks
The primary role of a firewall in enterprise networks is to determine which packets are allowed to cross network boundaries between secured and unsecured segments. It enforces security policies by inspecting traffic and making access control decisions at trust boundaries.
Why the other options are wrong
- B. A firewall does not allow unauthorized packets to pass; it denies them based on policy.
- C. Firewalls typically use stateful inspection, not stateless inspection, to track connection states.
- D. Firewalls do not explicitly deny all packets; they implement specific policies that permit legitimate traffic while denying unauthorized traffic.
Question 276
A user configured OSPF in a single area between two routers. A serial interface connecting R1 and R2 is running encapsulation PPP. By default, which OSPF network type is seen on this interface when the user types show ip ospf interface on R1 or R2?
Show answer and explanation
Correct answer: B. point-to-point
PPP (Point-to-Point Protocol) interfaces are point-to-point links that directly connect two routers without the possibility of multiple neighbors. OSPF automatically detects this and sets the network type to point-to-point on PPP interfaces by default. This eliminates the need for DR/BDR election on the link.
Why the other options are wrong
- A. Nonbroadcast is used for Frame Relay and X.25 networks, not PPP.
- C. Point-to-multipoint is used for WAN topologies with multiple remote sites connected to a central location, not simple PPP links.
- D. Broadcast network type is used on Ethernet and other broadcast media, not PPP interfaces.
Question 277
Which two values or settings must be entered when configuring a new WLAN in the Cisco Wireless LAN Controller GUI? (Choose two.)
Show answer and explanation
Correct answer: C, D. SSID; profile name
When configuring a new WLAN in the Cisco Wireless LAN Controller GUI, the SSID (Service Set Identifier) and profile name are the two mandatory settings that must be entered. The SSID identifies the wireless network, and the profile name is used to reference the WLAN configuration. QoS settings are optional, access point IP addresses are not required at WLAN creation (APs join the controller dynamically), and management interface settings are configured separately at the controller level.
Why the other options are wrong
- A. QoS settings are optional configuration parameters, not mandatory.
- B. Access point IP addresses are not entered during WLAN configuration; APs discover and join the controller automatically.
- E. Management interface settings are configured at the controller level, not during individual WLAN creation.
Question 278
Which two pieces of information about a Cisco device can Cisco Discovery Protocol communicate? (Choose two.)
Show answer and explanation
Correct answer: A, C. the native VLAN; the VTP domain
CDP advertises the native VLAN of trunk ports and the VTP domain name. These are key pieces of information that CDP communicates to adjacent devices. CDP does not communicate trunking protocol details, spanning-tree priority, or spanning-tree protocol information directly.
Why the other options are wrong
- B. CDP does not communicate trunking protocol information like 802.1Q or ISL
- D. CDP does not communicate spanning-tree priority values
- E. CDP does not communicate spanning-tree protocol type information
Question 279
What is the primary effect of the spanning-tree portfast command?
Show answer and explanation
Correct answer: D. It minimizes spanning-tree convergence time.
PortFast minimizes spanning-tree convergence time by allowing a port to transition directly to the forwarding state, bypassing the listening and learning states. This is the primary and intended effect of the command, especially useful for end-device connections. While it does affect port states, the core purpose is convergence time reduction.
Why the other options are wrong
- A. PortFast skips the listening state entirely, not 'immediately enables' it there.
- B. PortFast behavior is not tied to switch reload events.
- C. PortFast does not enable BPDU messages; it may ignore them on access ports.
Question 280
Which two statements about eBGP neighbor relationships are true? (Choose two.)
Show answer and explanation
Correct answer: A, B. The two devices must reside in different autonomous systems; Neighbors must be specifically declared in the configuration of each device
External BGP (eBGP) neighbors must (A) reside in different autonomous systems, which is the defining characteristic of eBGP, and (B) be specifically declared in the configuration of each device using the 'neighbor' command. Options C, D, and E are incorrect because eBGP neighbors don't form dynamically, must be in different ASes (not same), and don't require matching timers.
Why the other options are wrong
- C. eBGP neighbors must be explicitly configured; they don't form dynamically after network statements.
- D. eBGP is specifically for devices in different autonomous systems; same-AS neighbors are iBGP.
- E. Timer synchronization is not a requirement for eBGP neighbor relationships.
Question 281
When a switch receives a frame for a known destination MAC address, how is the frame handled?
Show answer and explanation
Correct answer: C. sent to the port identified for the known MAC address
When a switch learns a MAC address and receives a frame destined for a known MAC address, it forwards the frame only to the specific port associated with that MAC address in the MAC address table. This unicast forwarding reduces unnecessary flooding and improves network efficiency. This occurs only after the switch has learned the destination MAC address from previous frames.
Why the other options are wrong
- A. Flooding to all ports except the origin occurs only for unknown destination MAC addresses.
- B. Switches do not use first-available-port logic; they use MAC address tables.
- D. Broadcasting to all ports occurs for broadcast addresses or unknown destinations, not known unicast addresses.
Question 282
Which channel-group mode must be configured when multiple distribution interfaces connected to a WLC are bundled?
Show answer and explanation
Correct answer: B. Channel-group mode on.
When multiple distribution system ports connected to a WLC are bundled using EtherChannel, they must be configured in 'on' mode, which creates a static aggregation without negotiation protocols. This is the required mode for WLC distribution interface bundles.
Why the other options are wrong
- A. Passive mode is used for LACP negotiation but is not the standard configuration for WLC distribution interfaces.
- C. Desirable mode is used for PAgP negotiation, which is not appropriate for WLC distribution system port bundling.
- D. Active mode is used for LACP but is not the required mode; WLC distributions typically use static 'on' mode.
Question 283
What is the difference between an IPv6 link-local address and a unique local address?
Show answer and explanation
Correct answer: A. The scope of an IPv6 link-local address is limited to a directly attached interface, but an IPv6 unique local address is used throughout a company site or network.
Link-local addresses (fe80::/10) have scope limited to a single link and directly connected interfaces, while unique local addresses (fc00::/7) are designed for use within a site or organization similar to private IPv4 addresses. This is the fundamental difference in their scope and intended use cases.
Why the other options are wrong
- B. Link-local addresses are not global in scope; unique local addresses are not limited to loopback.
- C. This reverses the correct scope assignments for both address types.
- D. Link-local addresses are not limited to loopback addresses; this incorrectly describes both types.
Question 284
An engineer just installed network 10.120.10.0/24. Which configuration must be applied to the R14 router to add the new network to its OSPF routing table?
Show answer and explanation
Correct answer: A. Router ospf 100 Network 10.120.10.0 0.0.0.255 area 0
The correct OSPF network command syntax uses a wildcard mask (inverse mask), not a standard subnet mask. The format is 'network <network-address> <wildcard-mask> area <area-id>'. For the network 10.120.10.0/24, the wildcard mask is 0.0.0.255 (inverse of 255.255.255.0). Since the diagram shows R14 is part of OSPF 100 Area 0, the correct configuration is 'router ospf 100' followed by 'network 10.120.10.0 0.0.0.255 area 0'. Option A uses the correct OSPF process number (100), correct wildcard mask format (0.0.0.255), and correct area (0).
Why the other options are wrong
- B. Uses OSPF process 120 instead of 100, includes an unnecessary static route command, and incorrectly uses standard subnet mask instead of wildcard mask in the network command.
- C. Missing the 'area 0' parameter in the network command; OSPF network statements require the area specification.
- D. Uses standard subnet mask (255.255.255.0) instead of the required wildcard mask (0.0.0.255) in the network command.
Question 285
A packet from a company's branch office is destined to host 172.31.0.1 at headquarters. The sending router has three possible matches in its routing table for the packet: prefixes 172.31.0.0/16, 172.31.0.0/24, and 172.31.0.0/25. How does the router handle the packet?
Show answer and explanation
Correct answer: C. It sends the traffic via prefix 172.31.0.0/25.
Routers use longest prefix match to select the most specific route when multiple matches exist. Among /16, /24, and /25 prefixes, the /25 (172.31.0.0/25) is the longest (most specific) prefix that matches 172.31.0.1, so it is selected. The /25 covers addresses 172.31.0.0-172.31.0.127, which includes 172.31.0.1, and is more specific than the /24 and /16 matches.
Why the other options are wrong
- A. The /24 prefix is less specific than the /25 prefix.
- B. The /16 prefix is the least specific of the three matching routes.
- D. The default gateway is only used when no more specific routes match.
Question 286
Which command implies the use of SNMPv3?
Show answer and explanation
Correct answer: A. snmp-server user
The 'snmp-server user' command is specific to SNMPv3 and is used to configure SNMPv3 users with authentication and privacy settings. Options B and C are used across SNMPv1, SNMPv2c, and SNMPv3. Option D defines communities which are specific to SNMPv1 and SNMPv2c, not SNMPv3.
Why the other options are wrong
- B. snmp-server host is used for all SNMP versions
- C. snmp-server enable traps is used for all SNMP versions
- D. snmp-server community is specific to SNMPv1 and SNMPv2c
Question 287
Which command should you enter to configure an LLDP delay time of 5 seconds?
Show answer and explanation
Correct answer: D. lldp reinit 5
The 'lldp reinit 5' command configures an LLDP delay time of 5 seconds. The lldp reinit command takes the delay value in seconds (not milliseconds), so '5' specifies a 5-second delay before LLDP reinitializes on an interface.
Why the other options are wrong
- A. lldp timer controls transmission intervals, and 5000 would be incorrect units for the reinit command.
- B. lldp holdtime controls how long neighbors retain LLDP information, not reinitialization delay.
- C. lldp reinit uses seconds as the parameter unit, not milliseconds.
Question 288
An engineer is configuring SSH version 2 exclusively on the R1 router. What is the minimum configuration required to permit remote management using the cryptographic protocol?
Show answer and explanation
Correct answer: B. hostname R1 ip domain name cisco crypto key generate rsa general-keys modulus 1024 username cisco privilege 15 password 0 cisco123 ip ssh version 2 line vty 0 15 transport input ssh login local
SSH version 2 requires a hostname, domain name (for RSA key generation), RSA key generation with modulus, username with privilege level, password, SSH version specification, and VTY line configuration with SSH transport. Option B includes all required elements: hostname, domain name, RSA key generation, username, password, SSH version 2, and VTY transport input ssh.
Why the other options are wrong
- A. Includes 'service password-encryption' which is optional; more critically, missing 'ip domain name' required for RSA key generation.
- C. Missing 'ip domain name' which is required for the router to generate RSA keys properly.
- D. Uses 'transport input all' instead of 'transport input ssh', allowing non-SSH protocols and violating the requirement for SSH version 2 exclusively.
Question 289
In which situation is private IPv4 addressing appropriate for a new subnet on the network of an organization?
Show answer and explanation
Correct answer: C. There is limited unique address space, and traffic on the new subnet will stay local within the organization.
Private IPv4 addressing (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) is appropriate when address space is limited and traffic remains within the organization's internal network. Since private addresses are not routable on the Internet, they are ideal for internal subnets with no external routing requirements.
Why the other options are wrong
- A. Limiting broadcasts is not the primary reason to use private addresses; broadcast domain management is handled through subnet design and VLAN segmentation.
- B. ISPs specifically require public IPv4 addresses to be advertised for Internet-accessible services, making private addressing inappropriate here.
- D. Site-to-site VPNs to outside organizations can use private addresses since the VPN tunnel encrypts and encapsulates the traffic, but this is not the primary use case definition.
Question 290
Which two network actions occur within the data plane? (Choose two.)
Show answer and explanation
Correct answer: C, D. Add or remove an 802.1Q trunking header; Match the destination MAC address to the MAC address table.
The data plane handles the actual forwarding of traffic. Adding or removing 802.1Q trunking headers (option C) is a frame manipulation task performed during forwarding. Matching destination MAC addresses to the MAC address table (option D) is the core switching function that determines where to forward frames. Both are data plane operations that occur during packet/frame processing.
Why the other options are wrong
- A. Running routing protocols is a control plane function, not data plane.
- B. Processing NETCONF RPCs is a management plane function.
- E. Replying to ICMP echo requests is a control plane function handled by the device itself.
Question 291
A network engineer must configure an interface with IP address 10.10.10.145 and a subnet mask equivalent to 11111111.11111111.11111111.11111000. Which subnet mask must the engineer use?
Show answer and explanation
Correct answer: A. /29
The binary mask has three full octets of 1s (24 bits) plus 11111000 in the last octet, which adds five more 1 bits. That makes 29 network bits, which is /29 or 255.255.255.248.
Why the other options are wrong
- B. /30 is 11111100 in the last octet, which has six 1 bits, not five.
- C. /27 is 11100000 in the last octet, which has only three 1 bits.
- D. /28 is 11110000 in the last octet, which has only four 1 bits.
Question 292
How is RFC 1918 addressing used in a network?
Show answer and explanation
Correct answer: C. They are used with NAT to preserve public IPv4 addresses.
RFC 1918 defines private IP address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that are used internally within networks alongside NAT (Network Address Translation) to preserve scarce public IPv4 addresses. This allows organizations to use private addresses internally while translating to public addresses for Internet communication.
Why the other options are wrong
- A. Private RFC 1918 addresses cannot access the Internet directly without NAT conversion.
- B. While RFC 1918 addresses provide some security through obscurity, their primary purpose is address preservation, not security.
- D. ISPs use public addresses and routing protocols for Internet routing, not RFC 1918 private addresses.
Question 293
What is the primary purpose of a First Hop Redundancy Protocol?
Show answer and explanation
Correct answer: D. It reduces routing failures by allowing more than one router to represent itself as the default gateway of a network
The primary purpose of FHRP (such as HSRP, VRRP, or GLBP) is to provide redundancy and high availability at the default gateway level. FHRPs allow multiple routers to share a virtual IP address and MAC address, presenting themselves as a single default gateway. If the active router fails, a backup router automatically takes over, reducing routing failures and ensuring gateway availability.
Why the other options are wrong
- A. Sharing configuration information between neighbors is a function of routing protocols like OSPF, not FHRPs.
- B. FHRPs do not perform Layer 3 load balancing based on OSPF metrics; they provide failover redundancy.
- C. Creating multiple loop-free paths using bridge priorities is the function of Spanning Tree Protocol, not FHRPs.
Question 294
A network analyst is tasked with configuring the date and time on a router using EXEC mode. The date must be set to January 1, 2020 and the time must be set to 12:00 am. Which command should be used?
Show answer and explanation
Correct answer: D. clock set
The 'clock set' command in EXEC mode is used to manually set the date and time on a router. The syntax is 'clock set HH:MM:SS MONTH DAY YEAR'. Option A (clock timezone) sets the timezone offset. Option B (clock summer-time date) sets daylight saving time with specific dates. Option C (clock summer-time recurring) sets daylight saving time to recur annually. Only option D directly sets the actual date and time.
Why the other options are wrong
- A. clock timezone sets timezone offset, not the actual time
- B. clock summer-time date sets DST with specific dates, not the actual time
- C. clock summer-time recurring sets annual DST, not the actual time
Question 295
Which WLC interface provides out-of-band management in the Cisco Unified Wireless Network Architecture?
Show answer and explanation
Correct answer: B. service port
The service port on a Wireless LAN Controller provides out-of-band management connectivity, meaning it operates independently from the normal data path and is used for administrative access to the controller itself, separate from AP-Manager traffic which handles AP communication.
Why the other options are wrong
- A. AP-Manager interface is for in-band management and AP communication, not out-of-band management.
- C. Dynamic interfaces are used for DHCP relay and client data traffic, not management.
- D. Virtual interface is used for client mobility and guest anchoring, not management.
Question 296
A network engineer must create a diagram of a multivendor network. Which command must be configured on the Cisco devices so that the topology of the network is allowed to be mapped?
Show answer and explanation
Correct answer: A. Device(config)#lldp run
LLDP (Link Layer Discovery Protocol) is the standard protocol for multivendor network topology discovery and mapping. It is vendor-independent and works across different manufacturers' equipment, making it ideal for creating diagrams of multivendor networks. The command 'lldp run' enables LLDP globally on Cisco devices.
Why the other options are wrong
- B. CDP (Cisco Discovery Protocol) is Cisco-proprietary and will not work with non-Cisco devices in a multivendor environment.
- C. The interface-level CDP enable command is also Cisco-specific and not suitable for multivendor networks.
- D. Flow-sampler-map is used for NetFlow configuration, not for topology discovery and mapping.
Question 297
R1 as an NTP server must have: • NTP authentication enabled • NTP packets sourced from Interface loopback 0 • NTP stratum 2 • NTP packets only permitted to client IP 209.165.200.225 How should R1 be configured?
Show answer and explanation
Correct answer: C. ntp authenticate ntp authentication-key 2 md5 CISCO123 ntp source Loopback0 ntp access-group server-only 10 ntp master 2 ! access-list 10 permit 209.165.200.225
ntp authenticate with an MD5 authentication key enables authentication, ntp source Loopback0 sets the source interface and ntp master 2 makes R1 a stratum 2 server. The ntp access-group command references a standard ACL, so access-list 10 permit 209.165.200.225 correctly limits NTP service to that client.
Why the other options are wrong
- A. IOS NTP authentication keys use MD5 here, and ntp access-group needs a standard ACL rather than an extended entry with UDP and ports.
- B. ntp interface and ntp stratum are not valid IOS commands for setting the source and stratum.
- D. ntp stratum is not a valid IOS command, and the extended ACL entry is invalid for access-list 10 used by ntp access-group.
Question 298
What is the function of a controller in controller-based networking?
Show answer and explanation
Correct answer: A. It serves as the centralized management point of an SDN architecture
In Software-Defined Networking (SDN), the controller is the centralized management point that controls the network's control plane, making routing and forwarding decisions and managing the overall network behavior.
Why the other options are wrong
- B. Core routers maintain routing decisions, but they are not called controllers in SDN architecture.
- C. The controller manages the control plane, not the data plane; the data plane consists of forwarding devices.
- D. This describes a line card function on a router, not the controller in SDN.
Question 299
Which feature or protocol is required for an IP SLA to measure UDP jitter?
Show answer and explanation
Correct answer: D. NTP
NTP (Network Time Protocol) is required for IP SLA to accurately measure UDP jitter. Jitter measurement requires precise time synchronization between the source and destination to calculate the variation in packet delay. NTP provides the accurate clock synchronization necessary for these precise measurements.
Why the other options are wrong
- A. LLDP is a link-layer discovery protocol and is not needed for jitter measurement.
- B. EEM (Embedded Event Manager) is for event detection and automation, not time synchronization.
- C. CDP (Cisco Discovery Protocol) is for device discovery and does not provide time synchronization.
Question 300
Which condition must be met before an NMS handles an SNMP trap from an agent?
Show answer and explanation
Correct answer: C. The NMS software must be loaded with the MIB associated with the trap.
For an NMS (Network Management System) to properly process and understand SNMP trap messages from an agent, the NMS must have the Management Information Base (MIB) file loaded that corresponds to the trap being sent. The MIB defines the structure and meaning of the trap data, enabling the NMS to interpret and respond appropriately.
Why the other options are wrong
- A. Receiving the same trap from multiple agents is not a requirement for handling a trap.
- B. Inform messages and traps serve different purposes; both are not required together.
- D. The NMS and agent do not need to be on the same router to communicate.
Question 301
Based on the output of the show ip route command, which statements are true regarding the routing table? (Choose two.)
Show answer and explanation
Correct answer: B, C. There are 20 different network masks within the 10.0.0.0/8 network; Ten routes are equally load-balanced between Te0/1/0.100 and Te0/2/0.100.
Option B is correct because the output states '10.0.0.0/8 is variably subnetted, 6692 subnets, 20 masks'. The output shows only part of the table, so this count comes from that line, not from counting the visible entries. Option C is correct because ten routes appear with two equal paths: 0.0.0.0/0, 10.0.1.0/24, 10.0.2.0/23, 10.0.4.0/22, 10.0.8.0/21, 10.0.16.0/20, 10.0.32.0/19, 10.1.255.240/28, 10.2.0.0/16 and 10.3.0.0/16. Each has one path via 10.85.33.14 on TenGigabitEthernet0/2/0.100 and one via 10.85.33.10 on TenGigabitEthernet0/1/0.100, with the same distance and metric, for example [170/51968]. The value 7w0d is the age of the route, not its cost.
Why the other options are wrong
- A. The administrative distance shown is [170/51968], indicating AD 170, but this is EIGRP's external AD, not a manual change from internal AD 90.
- D. The output shows 'B 10.0.0.0/8 [20/0] via 10.48.144.14', so the 10.0.0.0/8 network was learned via BGP (code B), not external EIGRP.
- E. While 10.85.33.14 appears as a gateway, the output shows it is used as a next-hop for EIGRP routes, not configured as a static default route.
Question 302
Which technology prevents client devices from arbitrarily connecting to the network without state remediation?
Show answer and explanation
Correct answer: B. 802.1x
802.1x is an authentication protocol that prevents unauthorized devices from connecting to the network until they authenticate. It enforces state remediation by requiring network access credentials before allowing traffic, blocking devices that fail authentication or lack proper credentials.
Why the other options are wrong
- A. 802.11n is a wireless standard specifying data rates and performance, not access control.
- C. MAC Authentication Bypass allows unauthenticated access based on MAC address, the opposite of prevention.
- D. IP Source Guard prevents IP spoofing but does not prevent unauthorized device connection without authentication.
Question 303
An engineer is configuring switch SW1 to act as an NTP server when all upstream NTP server connectivity fails. Which configuration must be used?
Show answer and explanation
Correct answer: B. SW1# config t SW1(config)#ntp master SW1(config)#ntp server192.168.1.1
The 'ntp master' command configures a router as an NTP master/server that will provide time to clients when upstream NTP servers are unavailable. This allows the switch to serve as a stratum NTP server during failover scenarios. The second command establishes the primary upstream server connection.
Why the other options are wrong
- A. The ntp peer command establishes peer relationships, not master server status.
- C. There is no standard 'ntp backup' command in Cisco NTP configuration.
- D. This configuration only defines a server relationship without establishing the switch as a master.
Question 304
Which concern is addressed with the use of private IPv4 addressing?
Show answer and explanation
Correct answer: D. Lack of available publicly routable unique IPv4 address
Private IPv4 addressing directly addresses the shortage of publicly routable unique IPv4 addresses by allowing organizations to use reserved address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) internally without consuming the limited global address space. This was critical as IPv4 exhaustion became a concern.
Why the other options are wrong
- A. CIDR and VLSM are supported by modern routing protocols regardless of private addressing use.
- B. Security at the network perimeter is handled by firewalls and NAT, not private addressing itself.
- C. TCP/UDP port availability is not related to IPv4 addressing schemes; this is not a valid networking concern.
Question 305
When a WPA2-PSK WLAN is configured in the Wireless LAN Controller, what is the minimum number of characters that is required in ASCII format?
Show answer and explanation
Correct answer: B. 8
WPA2-PSK requires a minimum of 8 characters in ASCII format for the pre-shared key. This minimum length requirement helps ensure adequate password strength against brute-force attacks.
Why the other options are wrong
- A. 6 characters is below the WPA2-PSK minimum requirement.
- C. 12 characters exceeds the minimum requirement, though longer passwords are recommended.
- D. 18 characters far exceeds the minimum requirement.
Question 306
Why would VRRP be implemented when configuring a new subnet in a multivendor environment?
Show answer and explanation
Correct answer: D. to enable normal operations to continue after a member failure without requiring a change in a host ARP cache
VRRP is implemented in multivendor environments to enable normal operations to continue after a member failure without requiring changes to host ARP cache entries. Because VRRP uses a standardized virtual IP and MAC address that remains constant regardless of which physical router is active, hosts maintain the same default gateway address and don't need ARP updates when failover occurs, providing seamless redundancy across different vendor equipment.
Why the other options are wrong
- A. VRRP is vendor-neutral and works across multivendor environments; it doesn't specifically require multiple Cisco devices.
- B. While VRRP does interoperate across vendors, it is not Cisco-specific and doesn't provide additional security features unique to Cisco.
- C. Spanning-tree loop prevention is separate from VRRP functionality; VRRP addresses gateway redundancy, not loop-free paths.
Question 307
Two switches are connected and using Cisco Dynamic Trunking Protocol. SW1 is set to Dynamic Auto and SW2 is set to Dynamic Desirable. What is the result of this configuration?
Show answer and explanation
Correct answer: D. The link becomes a trunk port.
When SW1 is set to Dynamic Auto and SW2 is set to Dynamic Desirable, the link becomes a trunk port. Dynamic Desirable actively negotiates trunking and will initiate trunk formation, while Dynamic Auto will respond to trunk negotiation requests. Since one side (Desirable) is actively attempting to negotiate a trunk, the result is a trunk link.
Why the other options are wrong
- A. The link will not become an access port with these DTP settings.
- B. DTP mismatches do not typically result in an error disabled state.
- C. The link will be operational as a trunk, not in a down state.
Question 308
A network administrator needs to aggregate 4 ports into a single logical link which must negotiate layer 2 connectivity to ports on another switch. What must be configured when using active mode on both sides of the connection?
Show answer and explanation
Correct answer: B. LACP
LACP (Link Aggregation Control Protocol) is used to dynamically negotiate and aggregate multiple ports into a single logical link. When active mode is configured on both sides of a connection, LACP automatically detects and establishes the link aggregation group. LLDP is for device discovery, Cisco vPC is for multi-chassis aggregation, and 802.1q is for VLAN tagging, none dynamically negotiate port aggregation.
Why the other options are wrong
- A. LLDP is a discovery protocol and does not negotiate link aggregation.
- C. Cisco vPC is used for virtual port channels across multiple switches, not standard port aggregation.
- D. 802.1q is a VLAN tagging standard unrelated to port aggregation negotiation.
Question 309
Which goal is achieved by the implementation of private IPv4 addressing on a network?
Show answer and explanation
Correct answer: A. provides an added level of protection against Internet exposure
Private IPv4 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are not routable on the Internet and require NAT to communicate externally. This non-routable nature provides protection by preventing direct Internet exposure of internal systems.
Why the other options are wrong
- B. Private addressing does not reduce forwarding table size; all addresses still require routing entries.
- C. Private networks cannot communicate directly across the Internet without NAT translation.
- D. Private addressing actually prevents direct communication across public boundaries without NAT.
Question 310
What is a benefit of using a Cisco Wireless LAN Controller?
Show answer and explanation
Correct answer: A. It eliminates the need to configure each access point individually.
A key benefit of using a Cisco Wireless LAN Controller is centralized management of access points, eliminating the need to configure each AP individually. The controller manages multiple lightweight APs from a central location, reducing administrative overhead and ensuring consistent network policies across all access points.
Why the other options are wrong
- B. Centralized management through a controller actually simplifies configuration, not makes it more complex.
- C. Multiple SSIDs can share the same authentication method when managed by a controller.
- D. A controller supports lightweight APs; autonomous APs operate independently without a controller.
Question 311
Which SDN plane forwards user-generated traffic?
Show answer and explanation
Correct answer: D. Data plane
The data plane (also called forwarding plane) is responsible for forwarding user-generated traffic based on decisions made by the control plane. It operates at the infrastructure layer where actual packet forwarding occurs, in contrast to the control plane which makes routing decisions, the management plane which handles administrative functions, and the policy plane which defines traffic policies.
Why the other options are wrong
- A. Management plane handles administrative and monitoring functions, not traffic forwarding.
- B. Control plane makes routing decisions but does not forward user traffic itself.
- C. Policy plane defines traffic policies and rules, not the forwarding of user traffic.
Question 312
A network administrator enters the following command on a router: logging trap 3. What are three message types that will be sent to the Syslog server? (Choose three.)
Show answer and explanation
Correct answer: B, D, F. emergency; critical; error
The 'logging trap 3' command sets the severity level to 3, which is 'Error'. Syslog levels work inclusively from 0-7, where level 3 includes: level 0 (Emergency), level 1 (Alert), level 2 (Critical), and level 3 (Error). Therefore, Emergency (B), Critical (D), and Error (F) are the three message types sent.
Why the other options are wrong
- A. Informational is level 6, above the trap level 3
- C. Warning is level 4, above the trap level 3
- E. Debug is level 7, the highest and above trap level 3
Question 313
Which QoS tool can you use to optimize voice traffic on a network that is primarily intended for data traffic?
Show answer and explanation
Correct answer: C. PQ
PQ (Priority Queuing) is the optimal QoS tool for optimizing voice traffic on a data-centric network. PQ establishes priority levels and ensures that high-priority traffic (like voice) is processed before lower-priority traffic (like data). This guarantees that voice packets receive minimal delay and are transmitted first, making PQ ideal for networks where voice traffic must be protected from congestion caused by data traffic.
Why the other options are wrong
- A. WRED (Weighted Random Early Detection) manages congestion through probabilistic dropping, not suitable for voice prioritization.
- B. FIFO (First-In-First-Out) treats all traffic equally with no prioritization; it cannot protect voice traffic.
- D. WFQ (Weighted Fair Queuing) fairly distributes bandwidth; it lacks the strict priority mechanism needed for voice.
Question 314
A network engineer is configuring a switch so that it is remotely reachable via SSH. The engineer has already configured the host name on the router. Which additional command must the engineer configure before entering the command to generate the RSA key?
Show answer and explanation
Correct answer: C. ip domain-name domain
Before generating RSA keys for SSH, a domain name must be configured using 'ip domain-name' because the RSA key generation process requires a domain name to create the key pair with a fully qualified domain name. The hostname is already configured. Option A (password) is for line configuration, option B (authentication-retries) is an SSH refinement, and option D (crypto key generate) is the command that comes after the domain name is set.
Why the other options are wrong
- A. Password configuration is not required before RSA key generation
- B. ip ssh authentication-retries is a refinement, not a prerequisite
- D. This is the command to generate the key, which comes after domain-name is configured
Question 315
What is the expected outcome when an EUI-64 address is generated?
Show answer and explanation
Correct answer: C. The seventh bit of the original MAC address of the interface is inverted
When generating an EUI-64 interface ID from a MAC address, the seventh bit (the Universal/Local bit) of the first octet is inverted. This is a key characteristic of the EUI-64 process. For example, a MAC starting with 00 becomes 02, or a MAC starting with 02 becomes 00. This modified MAC address is then used as the 64-bit interface ID in the IPv6 address.
Why the other options are wrong
- A. EUI-64 uses the MAC address as a basis, not a random 64-bit value.
- B. FE80 is the prefix for link-local addresses, not inserted into the MAC address during EUI-64 generation.
- D. The MAC address is modified (the seventh bit is inverted) before being used as the interface ID.
Question 316
What does a switch use to build its MAC address table?
Show answer and explanation
Correct answer: C. ingress traffic
A switch builds its MAC address table by examining the source MAC addresses of frames arriving on ingress ports. When a frame enters a port, the switch learns the source MAC address and associates it with that port, allowing future frames destined for that MAC address to be forwarded correctly. This is the fundamental mechanism of MAC address learning in switches.
Why the other options are wrong
- A. VTP is used for VLAN Trunking Protocol, not MAC address table building.
- B. DTP is used for Dynamic Trunking Protocol to negotiate trunk status, not for MAC learning.
- D. Egress traffic (outgoing frames) does not build the MAC address table; ingress traffic does.
Question 317
When configuring a WLAN with WPA2 PSK in the Cisco Wireless LAN Controller GUI, which two formats are available to select? (Choose two.)
Show answer and explanation
Correct answer: B, C. ASCII; hexadecimal
When configuring WPA2 PSK (Pre-Shared Key) in the Cisco Wireless LAN Controller, the two available passphrase formats are ASCII and hexadecimal. ASCII allows entry of readable text characters, while hexadecimal allows entry using 64 hexadecimal characters. These are the standard formats supported for PSK configuration in enterprise wireless controllers.
Why the other options are wrong
- A. Decimal format is not supported for WPA2 PSK configuration.
- D. Binary format is not offered as a configuration option in the WLC GUI.
- E. Base64 encoding is not a selectable format for WPA2 PSK passphrase entry.
Question 318
Which function forwards frames to ports that have a matching destination MAC address?
Show answer and explanation
Correct answer: D. frame switching
Frame switching is the function that looks up destination MAC addresses in the MAC address table and forwards frames out the matching port(s). This is the core function of Layer 2 switches.
Why the other options are wrong
- A. Frame flooding occurs when the destination MAC is unknown, forwarding to all ports except ingress.
- B. Frame filtering is the process of deciding which frames to discard or block.
- C. Frame pushing is not a standard switching function; this term is not used in networking.
Question 319
What are two similarities between UTP Cat 5e and Cat 6a cabling? (Choose two.)
Show answer and explanation
Correct answer: B, D. Both support speeds of at least 1 Gigabit; Both support runs of up to 100 meters.
UTP Cat 5e and Cat 6a both support minimum speeds of 1 Gigabit Ethernet, and both support cable runs of up to 100 meters for standard Ethernet applications. Cat 5e is rated for 1 Gbps at 100 meters, while Cat 6a supports 10 Gbps at shorter distances but still supports 1 Gbps at the full 100 meters.
Why the other options are wrong
- A. Only Cat 6a supports 10 Gigabit speeds; Cat 5e is limited to 1 Gigabit.
- C. 55 meters is not a standard cable run specification; the standard is 100 meters.
- E. Cat 5e operates at 100 MHz, and Cat 6a operates at 500 MHz; they do not both operate at 500 MHz.
Question 320
Which keyword in a NAT configuration enables the use of one outside IP address for multiple inside hosts?
Show answer and explanation
Correct answer: D. overload
The 'overload' keyword enables Port Address Translation (PAT), which allows multiple inside hosts to share a single outside IP address by using different port numbers. This is essential for conserving public IP addresses when many internal devices need to communicate externally. Without 'overload', only one inside host could use a given outside address at a time.
Why the other options are wrong
- A. Source specifies which traffic to translate but does not enable multiple hosts per address
- B. Static creates one-to-one permanent mappings, not multiple-to-one dynamic translations
- C. Pool defines a range of addresses but without 'overload' still maps one-to-one
Question 321
A network administrator enabled port security on a switch interface connected to a printer. What is the next configuration action in order to allow the port to learn the MAC address of the printer and insert it into the table automatically?
Show answer and explanation
Correct answer: C. enable sticky MAC addressing
Sticky MAC addressing is the feature that enables a port to dynamically learn and automatically insert the MAC address of connected devices into the MAC address table. This method combines dynamic learning with the ability to save learned addresses persistently. Once enabled, the port learns the printer's MAC address automatically without manual configuration.
Why the other options are wrong
- A. Dynamic MAC address learning is a general switch function, not specifically the port security feature requested.
- B. Static MAC addressing requires manual configuration, not automatic learning.
- D. Auto MAC address learning is not the specific port security terminology used in Cisco configurations.
Question 322
Which value is the unique identifier that an access point uses to establish and maintain wireless connectivity to wireless network devices?
Show answer and explanation
Correct answer: B. SSID
The SSID (Service Set Identifier) is the unique identifier that an access point broadcasts to establish and maintain wireless connectivity with wireless network devices. It is the network name that devices see and use to connect to the wireless network. VLAN ID is a wired network concept, RFID is radio frequency identification for object tracking, and WLAN ID is not a standard wireless networking term.
Why the other options are wrong
- A. VLAN ID is used for wired network segmentation, not wireless access point identification.
- C. RFID is used for object identification and tracking, not wireless access point connectivity.
- D. WLAN ID is not a standard term; the correct term is SSID.
Question 323
An application in the network is being scaled up from 300 servers to 600. Each server requires 3 network connections to support production, backup, and management traffic. Each connection resides on a different subnet. The router configuration for the production network must be configured first using a subnet in the 10.0.0.0/8 network. Which command must be configured on the interface of the router to accommodate the requirements and limit wasted IP address space?
Show answer and explanation
Correct answer: B. ip address 10.10.10.1 255.255.252.0
For 600 servers with 3 connections each requiring separate subnets, the production subnet alone needs to accommodate 600 hosts. A /22 subnet (255.255.252.0) provides 1024 usable addresses, which accommodates 600 hosts with minimal waste. A /23 (255.255.254.0) provides only 512 addresses, which is insufficient for 600 servers. A /20 provides too many addresses wasting space, and /28 only provides 14 addresses which is far too small.
Why the other options are wrong
- A. /23 provides only 512 usable addresses, insufficient for 600 servers.
- C. /20 provides 4096 addresses, which wastes significant IP address space.
- D. /28 provides only 14 usable addresses, far too small for this requirement.
Question 324
In an SDN architecture, which function of a network node is centralized on a controller?
Show answer and explanation
Correct answer: C. Makes a routing decision
In SDN architecture, the control plane is centralized on a controller. Routing decisions, the logic of determining where packets should go, are made by the centralized controller and distributed to data plane devices (switches/routers) via protocols like OpenFlow. This separates control from forwarding, which is the core SDN principle.
Why the other options are wrong
- A. Creating the IP routing table is part of control plane functions, but the more specific answer about decision-making is stronger.
- B. Filtering and packet discarding are data plane functions that remain distributed on network devices.
- D. Protocol access for remote devices is a management function, not a control plane routing function.
Question 325
Why is UDP more suitable than TCP for applications that require low latency such as VoIP?
Show answer and explanation
Correct answer: D. TCP sends an acknowledgement for every packet received: UDP operates without acknowledgments
UDP is more suitable for low-latency applications like VoIP because it operates without requiring acknowledgments for every packet, eliminating the overhead and delay caused by TCP's acknowledgment mechanism. This reduces latency significantly.
Why the other options are wrong
- A. UDP does not guarantee delivery; TCP is the reliable protocol with guaranteed delivery.
- B. UDP does not use sequencing; TCP uses sequence numbers to ensure ordered delivery.
- C. TCP uses congestion control and flow control for efficiency; UDP uses neither, which is why it has lower latency.
Question 326
Which command is used to specify the delay time in seconds for LLDP to initialize on any interface?
Show answer and explanation
Correct answer: C. lldp reinit
The 'lldp reinit' command specifies the delay time in seconds before LLDP initializes on any interface after a change occurs. This command controls how quickly LLDP will restart transmission after a reconfiguration event.
Why the other options are wrong
- A. lldp timer controls the transmission interval between LLDP advertisements, not initialization delay.
- B. lldp tlv-select controls which TLVs are transmitted, not initialization delay.
- D. lldp holdtime controls how long LLDP information is retained by neighbors, not initialization delay.
Question 327
How does CAPWAP communicate between an access point in local mode and a WLC?
Show answer and explanation
Correct answer: D. The access point has the ability to link to any switch in the network, assuming connectivity to the WLC
CAPWAP (Control and Provisioning of Wireless Access Points) allows access points in local mode to establish a tunnel with the WLC over any IP network path. The access point can connect to any switch in the network as long as IP connectivity to the WLC exists; it does not require direct connection to the same switch or a direct copper cable link to the controller.
Why the other options are wrong
- A. Access points must be connected to the wired network to communicate with the WLC and provide wireless service.
- B. The access point and WLC do not need to be on the same switch; they communicate over the IP network.
- C. Access points do not need direct copper cable connections to the WLC; they use CAPWAP tunnels over any IP-routable path.
Question 328
Which type of IPv6 address is similar to a unicast address but is assigned to multiple devices on the same network at the same time?
Show answer and explanation
Correct answer: C. anycast address
An anycast address is assigned to multiple devices on the same network simultaneously, and packets destined to an anycast address are delivered to the nearest device (in terms of routing distance) that has that address. This is distinct from unicast (one device), multicast (group), and link-local (special-purpose) addresses.
Why the other options are wrong
- A. Global unicast addresses are assigned to a single device and are globally routable.
- B. Link-local addresses are automatically assigned to a single interface and are used for local network communication only.
- D. Multicast addresses are assigned to groups of devices, but packets are delivered to all members of the group, not the nearest one.
Question 329
Which Layer 2 switch function encapsulates packets for different VLANs so that the packets transverse the same port and maintain traffic separation between the VLANs?
Show answer and explanation
Correct answer: D. VLAN tagging
VLAN tagging is the process of encapsulating packets with VLAN identifiers (using 802.1Q tags) so that multiple VLANs can traverse the same physical trunk port while maintaining traffic separation between different VLANs.
Why the other options are wrong
- A. VLAN marking is not a standard term; tagging is the correct function that marks packets with VLAN information.
- B. VLAN numbering refers to assigning VLAN identifiers, not the encapsulation mechanism for trunk ports.
- C. VLAN DSCP relates to quality of service markings, not to the encapsulation of packets for VLAN separation.
Question 330
After you deploy a new WLAN controller on your network, which two additional tasks should you consider? (Choose two.)
Show answer and explanation
Correct answer: A, E. deploy load balancers; configure additional security policies
After deploying a new WLAN controller, deploying load balancers ensures traffic distribution and high availability for the controller, and configuring additional security policies protects the wireless network from threats. These are the two primary considerations for a secure and scalable wireless infrastructure beyond basic controller deployment.
Why the other options are wrong
- B. VLANs would typically be configured before or during controller setup, not as a separate task after
- C. VRRP groups are used for router redundancy, not typically required for WLAN controller deployment
- D. PoE switches would be evaluated during planning, not as a post-deployment task
Question 331
What is a function of Cisco Advanced Malware Protection for a Next-Generation IPS?
Show answer and explanation
Correct answer: A. inspecting specific files and file types for malware
Cisco Advanced Malware Protection (AMP) for Next-Generation IPS specifically inspects files and file types to detect and prevent malware threats. It analyzes file behavior and signatures to identify malicious content before it can compromise the network.
Why the other options are wrong
- B. Authorizing traffic is not an AMP function; this relates to access control.
- C. User authentication is handled by AAA systems, not by AMP.
- D. URL filtering is a separate security function, not part of AMP.
Question 332
Which QoS queuing method discards or marks packets that exceed the desired bit rate of traffic flow?
Show answer and explanation
Correct answer: B. policing
Policing is the QoS mechanism that monitors traffic and discards or marks packets that exceed a configured bit rate threshold. When traffic exceeds the desired rate, policing takes immediate action by either dropping the excess packets or remarking them with a lower priority marking. Unlike shaping, which buffers excess packets, policing enforces limits in real-time.
Why the other options are wrong
- A. CBWFQ (Class-Based Weighted Fair Queuing) is a queuing mechanism, not a rate-limiting tool.
- C. LLQ (Low Latency Queuing) prioritizes certain traffic classes but doesn't inherently discard excess traffic.
- D. Shaping buffers excess packets rather than discarding them; it smooths traffic over time.
Question 333
What is the maximum bandwidth of a T1 point-to-point connection?
Show answer and explanation
Correct answer: A. 1.544 Mbps
A T1 line has a maximum bandwidth of 1.544 Mbps. This is the standard North American digital transmission rate consisting of 24 channels at 64 kbps each plus framing bits, totaling 1.544 Mbps.
Why the other options are wrong
- B. 2.048 Mbps is the bandwidth of an E1 line, the European equivalent to T1.
- C. 34.368 Mbps is the bandwidth of a T3 line.
- D. 43.7 Mbps is not a standard telecom line rate.
Question 334
An engineer must configure interswitch VLAN communication between a Cisco switch and a third-party switch. Which action should be taken?
Show answer and explanation
Correct answer: B. configure IEEE 802.1q
IEEE 802.1q (B) is the industry-standard VLAN tagging protocol that must be configured for interswitch VLAN communication, particularly between Cisco switches and third-party switches. It is the standard protocol supported across all vendors. ISL is Cisco-proprietary and would not work with third-party switches, while DSCP and 802.1p are not trunk encapsulation protocols.
Why the other options are wrong
- A. DSCP is a QoS marking mechanism, not a trunk encapsulation protocol
- C. ISL is Cisco-proprietary and incompatible with third-party switches
- D. IEEE 802.1p is a QoS priority mechanism, not a trunk encapsulation protocol
Question 335
Which set of 2 4 GHz nonoverlapping wireless channels is standard in the United States?
Show answer and explanation
Correct answer: D. channels 1, 6, and 11
Channels 1, 6, and 11 are the three non-overlapping channels in the 2.4 GHz band used in the United States. These channels have sufficient frequency separation (25 MHz apart) to avoid interference with each other.
Why the other options are wrong
- A. Channel 14 is not available in the United States; channels 1-13 are available in the US, with 1-11 being standard.
- B. Channels 2, 7, 9, and 11 overlap with each other and are not the standard non-overlapping set.
- C. Channel 9 overlaps with both channels 6 and 11, making this set unsuitable as non-overlapping channels.
Question 336
Which feature on the Cisco Wireless LAN Controller when enabled restricts management access from specific networks?
Show answer and explanation
Correct answer: B. CPU ACL
CPU ACL (Access Control List) on a Cisco Wireless LAN Controller restricts management access from specific networks by filtering traffic destined to the controller's management interface. It operates at the CPU level and controls which sources can reach management services. TACACS and RADIUS are authentication protocols, not access restriction mechanisms, and Flex ACL is not a standard WLC feature for management access restriction.
Why the other options are wrong
- A. TACACS is an authentication/authorization protocol, not a management access restriction feature
- C. Flex ACL is not a standard Cisco WLC feature for management access control
- D. RADIUS is an authentication protocol, not a management access restriction mechanism
Question 337
Which action is taken by a switch port enabled for PoE power classification override?
Show answer and explanation
Correct answer: D. Should a monitored port exceed the maximum administrative value for power, the port is shut down and err-disabled
When a PoE switch port is configured with power classification override and a monitored port exceeds the maximum administrative power threshold, the port automatically shuts down and enters an err-disabled state. This protection prevents equipment damage and power supply overload.
Why the other options are wrong
- A. Data flow is not temporarily paused during PoE power checking; monitoring occurs in parallel with data transmission.
- B. Syslog messages may be generated, but this is not the action taken by power classification override itself.
- C. Switches do not typically disconnect ports for drawing less than minimum power; they monitor maximum power limits instead.
Question 338
A port security violation has occurred on a switch port due to the maximum MAC address count being exceeded. Which command must be configured to increment the security-violation count and forward an SNMP trap?
Show answer and explanation
Correct answer: C. switchport port-security violation restrict
The restrict violation mode increments the security-violation counter and sends an SNMP trap notification when a violation occurs, while continuing to drop offending traffic. This provides visibility into the violation through SNMP alerts while maintaining port functionality. Protect mode drops traffic silently without incrementing counters. Access mode is not a valid violation mode. Shutdown mode disables the port entirely.
Why the other options are wrong
- A. Access is not a valid port security violation mode.
- B. Protect mode drops traffic but does not increment the violation counter or send SNMP traps.
- D. Shutdown mode disables the port rather than just sending an SNMP trap.
Question 339
Which two statements about VTP are true? (Choose two.)
Show answer and explanation
Correct answer: A, E. All switches must be configured with the same VTP domain name; All switches must use the same VTP version
All switches in a VTP domain must be configured with the same VTP domain name to participate in VLAN synchronization. All switches must use the same VTP version (version 1, 2, or 3) to ensure compatibility in VLAN advertisement and pruning. The VTP server's revision number being highest is important for updates but is a result of configuration, not a requirement.
Why the other options are wrong
- B. Trunk negotiation is not a VTP requirement; trunk ports carry VLAN information but are configured separately
- C. All switches must have the same domain name, not unique names
- D. The VTP server does not need to have the highest revision number; it simply updates based on its configuration
Question 340
Which two tasks must be performed to configure NTP to a trusted server in client mode on a single network device? (Choose two.)
Show answer and explanation
Correct answer: A, C. Enable NTP authentication; Specify the IP address of the NTP server.
To synchronize with a trusted NTP server, the client must point to the server's IP address with ntp server. Trust is established by enabling NTP authentication with ntp authenticate, a key and a trusted key, so the device only accepts time from an authenticated source.
Why the other options are wrong
- B. The time zone only changes how local time is displayed and plays no part in configuring a trusted NTP client.
- D. NTP authentication uses shared symmetric keys, not a server private key.
- E. Disabling NTP broadcasts is not required for a device running in client mode.
Question 341
Why does a switch flood a frame to all ports?
Show answer and explanation
Correct answer: B. The destination MAC address of the frame is unknown.
A switch maintains a MAC address table and forwards frames based on destination MAC addresses. When a frame arrives with a destination MAC address that is not in the MAC address table (unknown destination), the switch cannot determine which port to forward it to, so it floods the frame out all ports except the incoming port to ensure delivery.
Why the other options are wrong
- A. MAC addresses cannot be zero; this is not a valid scenario.
- C. An unknown source MAC address is learned and added to the MAC table, but does not trigger flooding based on source.
- D. Frames with identical source and destination MAC addresses are typically dropped or handled as special cases, not flooded.
Question 342
Which set of actions satisfy the requirement for multifactor authentication?
Show answer and explanation
Correct answer: C. The user enters a user name and password, and then clicks a notification in an authentication app on a mobile device.
Option C satisfies multifactor authentication requirements by combining two different factors: something the user knows (username and password) and something the user has (a mobile device with an authentication app). Option A uses only one factor (knowledge), Option B mixes two possession factors without knowledge factor, and Option D uses only one factor (something you have) since a PIN is entered into a physical token.
Why the other options are wrong
- A. Re-entering credentials is the same knowledge factor repeated, not multifactor authentication
- B. A key fob and email link are both possession factors; multifactor requires different types of factors
- D. Both PIN and RSA token are possession factors; only one factor type is present
Question 343
Which attribute does a router use to select the best path when two or more different routes to the same destination exist from two different routing protocols?
Show answer and explanation
Correct answer: C. administrative distance
When a router learns the same destination from two different routing protocols, it uses administrative distance (AD) to select which route to install in the routing table. The route from the protocol with the lower AD value is preferred. This is the mechanism for preferring one routing protocol over another.
Why the other options are wrong
- A. The DUAL algorithm is specific to EIGRP and is used to calculate feasible successors, not to compare different routing protocols.
- B. Metric is compared only within the same routing protocol; administrative distance is used to compare across different protocols.
- D. Hop count is a metric within RIP; it does not apply when comparing different routing protocols.
Question 344
Which field within the access-request packet is encrypted by RADIUS?
Show answer and explanation
Correct answer: B. password
In RADIUS, the User-Password field is encrypted using MD5 hashing with a shared secret between the client and server. This is the only field in the access-request packet that undergoes encryption. The username, authenticator, and authorized services are transmitted in plaintext or are not encrypted fields.
Why the other options are wrong
- A. Authorized services are not encrypted in RADIUS packets.
- C. The authenticator is used for validation but is not encrypted.
- D. The username is transmitted in plaintext in RADIUS access-request packets.
Question 345
Which access point mode relies on a centralized controller for management, roaming, and SSID configuration?
Show answer and explanation
Correct answer: A. lightweight mode
Lightweight mode (also called Thin AP mode) relies on a centralized wireless controller to manage the access points, handle roaming between APs, and configure SSIDs. The controller provides centralized management while the lightweight APs handle only basic operations like RF transmission.
Why the other options are wrong
- B. Autonomous mode has distributed management; each AP operates independently without a central controller.
- C. Bridge mode connects two separate networks wirelessly, not a typical centralized AP architecture.
- D. Repeater mode extends wireless coverage by retransmitting signals, not a centralized management architecture.
Question 346
What provides centralized control of authentication and roaming in an enterprise network?
Show answer and explanation
Correct answer: B. a wireless LAN controller
A Wireless LAN Controller (WLC) provides centralized management of wireless access points, including authentication, authorization, roaming support, and policy enforcement across the enterprise network.
Why the other options are wrong
- A. Lightweight access points operate under a controller's direction but do not provide centralized control themselves.
- C. Firewalls provide network security and access control but not wireless-specific authentication and roaming management.
- D. LAN switches manage wired network traffic and do not handle wireless authentication or roaming.
Question 347
Which protocol does an access point use to draw power from a connected switch?
Show answer and explanation
Correct answer: B. Cisco Discovery Protocol
Cisco Discovery Protocol (CDP) is the protocol used by access points to communicate with switches and negotiate Power over Ethernet (PoE) delivery. While PoE itself is a power delivery mechanism, CDP is the Cisco-specific protocol that facilitates the communication necessary for the switch to provide power to the access point.
Why the other options are wrong
- A. IGMP is for IP multicast group management, not device power negotiation.
- C. Adaptive Wireless Path Protocol is not a standard protocol for PoE negotiation.
- D. NDP is an IPv6 protocol for address resolution and neighbor discovery, not PoE delivery.
Question 348
Which two actions influence the EIGRP route selection process? (Choose two.)
Show answer and explanation
Correct answer: B, D. The router calculates the feasible distance of all paths to the destination route; The router calculates the best backup path to the destination route and assigns it as the feasible successor.
EIGRP route selection is influenced by calculating the feasible distance (the lowest cost to reach a destination) and identifying backup paths known as feasible successors. The feasible distance is calculated by the local router, and feasible successors are determined by comparing the advertised distance (AD) from neighbors with the local feasible distance using the feasibility condition.
Why the other options are wrong
- A. Advertised distance is calculated by the upstream neighbor to inform the local router of their distance to the destination, not the bandwidth on the link.
- C. EIGRP uses feasible distance (the metric calculated by the local router), not just the advertised distance from neighbors.
- E. The reported distance in EIGRP is not calculated by multiplying delay by 256; the metric uses K values and bandwidth/delay/reliability/load calculations.
Question 349
Which configuration ensures that the switch is always the root for VLAN 750?
Show answer and explanation
Correct answer: B. Switch(config)#spanning-tree vlan 750 priority 0
Priority 0 is the lowest possible bridge priority, so the switch will always win the root election for VLAN 750, whatever priorities other switches later use. The root primary macro only works out a value once, lower than the current root's, and does not guarantee the switch stays root if another switch is later set lower.
Why the other options are wrong
- A. 38418607 is not a valid bridge priority, which must be 0 to 61440 in steps of 4096.
- C. Root primary sets a priority only once, relative to the current root, so another switch configured with a lower priority later can take over as root.
- D. 614440 is not a valid bridge priority, which must be 0 to 61440 in steps of 4096.
That was 349 of 1,395.
The full Cisco 200-301 CCNA pack has all 1,395 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.
Not ready yet? Get the first 697 free as one PDF by email. Get the Half Pack →