Cisco CCNA 200-301 Practice Questions with Explanations

Correct answer: C

A host route is a route to a specific host address with a /32 subnet mask (for IPv4). The routing table output shows '10.10.13.10/32 [110/6576] via 10.10.10.1' which is clearly a /32 route, indicating it is a host route rather than a network route. Host routes are used when you need to route traffic to a specific individual host rather than an entire network.

Why the other options are wrong:

• A. A default route has a destination of 0.0.0.0/0 and is used when no other routes match; 10.10.13.10/32 is specific, not a default route.
• B. A network route covers multiple hosts in a subnet (like /25, /24, /30); a /32 designates a single host, not a network.
• D. A floating static route is a backup route with higher administrative distance; nothing in the output indicates this is a backup or floating route.

Correct answer: D

Host A has IP address 10.10.13.214. Looking at Router1's routing table, multiple routes match this destination: 10.10.13.0/25 (covers 10.10.13.0-127), 10.10.13.128/28 (covers 10.10.13.128-143), 10.10.13.144/28 (covers 10.10.13.144-159), 10.10.13.160/29 (covers 10.10.13.160-167), and 10.10.13.208/29 (covers 10.10.13.208-215). Since 10.10.13.214 falls within the 10.10.13.208/29 range and this prefix has the longest match (29 bits), it is selected by the longest prefix match algorithm.

Why the other options are wrong:

• A. 10.10.10.0/28 does not contain 10.10.13.214; it covers a different subnet.
• B. 10.10.13.0/25 matches but is less specific (shorter prefix) than 10.10.13.208/29.
• C. 10.10.13.144/28 does not contain 10.10.13.214; it covers 10.10.13.144-159.

Correct answer: A

TCP uses a three-way handshake (SYN, SYN-ACK, ACK) to establish a connection and guarantees message delivery through acknowledgments. UDP, being connectionless, does not establish a connection or guarantee delivery. Option A correctly identifies both of these fundamental differences between the protocols.

Why the other options are wrong:

• B. Both TCP and UDP use acknowledgment packets in their own ways; this distinction is imprecise.
• C. UDP does not provide reliable transfer (TCP does), and UDP is connectionless (not TCP)-this reverses the facts.
• D. TCP uses SYN, SYN-ACK, and ACK bits; it does not use FIN in the handshake. UDP does not use SYN bits at all.

Correct answer: A

Association Response is a management frame type in 802.11 wireless networks. Management frames handle connection establishment, authentication, and association between wireless devices and access points. Association Response specifically is sent by an AP in response to an association request from a client.

Why the other options are wrong:

• B. Protected frame refers to encrypted frames, not a frame type category.
• C. Action frames are a specific management subtype used for signaling, not the category for Association Response.
• D. Control frames handle RTS/CTS and acknowledgments, not association management.

Correct answer: C

In a spine-and-leaf architecture, scalability is achieved by adding leaf switches that connect to every spine switch. This creates a non-blocking mesh topology where each new leaf switch can communicate with all spine switches, enabling horizontal scaling without oversubscription. This is the standard method for adding access ports in this design.

Why the other options are wrong:

• A. Adding spine switches is expensive and unnecessary for access port scaling.
• B. Uplink specifications don't define scalability; the architecture itself does.
• D. A single connection to one spine creates a bottleneck and defeats the purpose of the mesh topology.

Correct answer: C

The hypervisor's core function is to virtualize physical hardware components including CPU, memory, and storage, allowing multiple virtual machines to share physical resources. This abstraction layer enables efficient resource allocation and isolation between VMs, which is the fundamental capability that defines hypervisor functionality.

Why the other options are wrong:

• A. Hypervisors operate at Layer 2 and Layer 3, and require management resources.
• B. Each hypervisor supports multiple virtual machines, not just one, and can support multiple virtual switches.
• D. Virtual servers work efficiently with virtual networking; physical separation from the hypervisor is not required.

Correct answer: B

The 'ipv6 address <prefix> eui-64' command automatically generates an IPv6 address by combining a specified IPv6 prefix with the EUI-64 identifier derived from the interface's MAC address. This creates a full /64 address without manual configuration of the host portion, using the MAC address as the basis for the interface ID.

Why the other options are wrong:

• A. DHCP requires a DHCP server; it doesn't generate from a MAC address.
• C. Autoconfig uses stateless auto-configuration but does not specify a prefix like eui-64 does.
• D. This specifies a full address with a link-local scope, not prefix-based auto-generation from MAC.

Correct answer: C

When a Layer 2 switch receives a frame with an unknown destination MAC address, it floods the frame to all ports except the incoming port within the same VLAN. This broadcast behavior ensures the frame reaches its destination while allowing the switch to learn the source MAC address from the response.

Why the other options are wrong:

• A. The switch does not forward first; it floods because the destination is unknown.
• B. Modern switches flood without CPU involvement; the CPU is not required for unknown unicast handling.
• D. Unknown destination frames are flooded, not dropped.

Correct answer: A

A /30 subnet has a subnet mask of 255.255.255.252, which provides exactly 4 IP addresses: network, 2 usable host addresses, and broadcast. Option A uses 10.2.1.3 with mask 255.255.255.252, which is a valid usable host IP in the 10.2.1.0/30 network (usable IPs are .1 and .3, with .0 as network and .2 reserved for broadcast in point-to-point). Option D has a typo in the subnet mask (225 instead of 255), making it invalid.

Why the other options are wrong:

• B. Uses 255.255.255.248 which is a /29 subnet mask, providing 8 addresses, not 2 usable hosts for a point-to-point link.
• C. Uses 255.255.255.248 which is a /29 subnet mask, not the required /30.
• D. Contains a typo in the subnet mask with '225' instead of '255', making it syntactically invalid.

Correct answer: B

Private IP addresses defined by RFC 1918 are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. Option B (172.28.0.0/16) falls within the 172.16.0.0/12 range, making it a private address that allows communication without Internet access. The other options are either not private addresses or outside the designated RFC 1918 ranges.

Why the other options are wrong:

• A. 172.9.0.0/16 is not within the private range 172.16.0.0/12; it is a public address.
• C. 192.0.0.0/8 is not a private range; the private range is 192.168.0.0/16.
• D. 209.165.201.0/24 is a public IP address range, not private.

Correct answer: D

The /28 subnet mask (255.255.255.240) divides each Class C network into subnets with 16 addresses each. For the 192.168.16.128/28 network, the valid host range is 192.168.16.129-192.168.16.142, with 192.168.16.128 being the network address and 192.168.16.143 being the broadcast address. The configuration error occurs because 192.168.16.143 is the broadcast address for this subnet and cannot be assigned to an interface, as broadcast addresses are reserved for network use.

Why the other options are wrong:

• A. The address 192.168.16.143 is within the private range (192.168.0.0/16), but that is not why it generates an error.
• B. Routers absolutely support /28 masks; this is a standard subnet mask used in networking.
• C. 192.168.16.143 is not the network address; 192.168.16.128 is the network address for the /28 subnet.

Correct answer: B

Unique local IPv6 addresses (FC00::/7) are designed for private communication within organizations or sites, similar to RFC 1918 private addresses in IPv4. They cannot route on the Internet but allow inter-subnet communication within a private network. Link-local addresses are limited to a single link, multicast addresses send to groups, and global unicast addresses are routable on the Internet.

Why the other options are wrong:

• A. Link-local addresses (FE80::/10) are limited to a single link and cannot communicate between subnets.
• C. Multicast addresses are for group communication, not subnet-to-subnet communication.
• D. Global unicast addresses (2000::/3) are routable on the Internet.

Correct answer: D

IPv6 multicast addresses use the FF00::/8 block and are designed to send packets to a group of addresses rather than a single unicast address. Multicast enables one-to-many communication where a single packet is delivered to multiple recipients identified by a single multicast group address.

Why the other options are wrong:

• A. 2000::/3 is the global unicast address block for single host communication.
• B. FC00::/7 is the unique local address block for private unicast communication.
• C. FE80::/10 is the link-local address block for single-link unicast communication.

Correct answer: A

A key benefit of using a Cisco Wireless LAN Controller is centralized management of access points, eliminating the need to configure each AP individually. The controller manages multiple lightweight APs from a central location, reducing administrative overhead and ensuring consistent network policies across all access points.

Why the other options are wrong:

• B. Centralized management through a controller actually simplifies configuration, not makes it more complex.
• C. Multiple SSIDs can share the same authentication method when managed by a controller.
• D. A controller supports lightweight APs; autonomous APs operate independently without a controller.

Correct answer: A

When a PoE switch port is configured with power classification override, if a monitored port exceeds the maximum administrative power value, the port is shut down and placed in an err-disabled state to prevent overpower conditions and potential equipment damage. This protection mechanism ensures that connected devices do not draw more power than the administrator has permitted.

Why the other options are wrong:

• B. Syslog messages are generated for various PoE events, but this is not specific to power classification override behavior.
• C. Data flow is not paused during power usage checking; monitoring occurs independently of data transmission.
• D. Ports are disabled when power exceeds maximum limits, not when it falls below minimum; low power typically indicates device failure is detected separately.

Correct answer: C

During frame flooding, when a switch does not have a MAC address table entry for the destination, it sends frames to every port on the switch in the same VLAN as the originating port, except the originating port itself. This prevents unnecessary flooding to VLANs where the frame is not needed and avoids immediate loops by not sending back to the source port.

Why the other options are wrong:

• A. Frames are not sent to ports in other VLANs; flooding respects VLAN boundaries.
• B. When a MAC address entry exists in the table, frames are sent to that specific port, not flooded to all ports.
• D. The originating port is excluded from flooding; frames go to every other port in the same VLAN.

Correct answer: A

Private IPv4 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) are reserved for internal use and are not routable on the public Internet. This allows multiple organizations to independently use the same address ranges without conflicts, as these addresses are never exposed to the Internet backbone.

Why the other options are wrong:

• B. Private addresses cannot reach hosts outside the enterprise directly; they require NAT for outbound Internet connectivity.
• C. Private addressing actually requires NAT to communicate with the Internet, not the opposite.
• D. Private addresses do not enable direct secure communications to the Internet; they must be translated first.

Correct answer: C

SLAAC (Stateless Address Auto-Configuration) enables a host to automatically derive a global unicast IPv6 address from the MAC address using the EUI-64 process. When SLAAC is enabled on an interface, it generates the full global unicast address by combining the prefix advertised by a router with the EUI-64-derived interface identifier derived from the MAC address.

Why the other options are wrong:

• A. Link-local addresses are automatically generated; explicitly assigning one does not enable global unicast derivation from MAC.
• B. Disabling EUI-64 would prevent the MAC-based address generation that SLAAC relies upon.
• D. Stateful DHCPv6 requires manual server configuration and does not derive addresses from MAC addresses using EUI-64.

Correct answer: B

TCP provides flow control through windowing and other mechanisms to prevent overwhelming the receiver by regulating packet transmission rate. UDP, being connectionless and unreliable, sends packets continuously without such flow control mechanisms or checks on the receiver's ability to process them. This is a fundamental difference in how these protocols handle delivery management.

Why the other options are wrong:

• A. This statement is backwards; TCP guarantees delivery with error checking, while UDP does not provide message acknowledgement or retransmission.
• C. This is reversed; TCP is connection-oriented and reliable, while UDP is connectionless and unreliable.
• D. Both statements are incorrect; UDP does not provide reliable delivery or three-way handshakes.

Correct answer: D

CAPWAP (Control and Provisioning of Wireless Access Points) allows access points in local mode to establish a tunnel with the WLC over any IP network path. The access point can connect to any switch in the network as long as IP connectivity to the WLC exists; it does not require direct connection to the same switch or a direct copper cable link to the controller.

Why the other options are wrong:

• A. Access points must be connected to the wired network to communicate with the WLC and provide wireless service.
• B. The access point and WLC do not need to be on the same switch; they communicate over the IP network.
• C. Access points do not need direct copper cable connections to the WLC; they use CAPWAP tunnels over any IP-routable path.

Correct answer: D

The IPv6 address block FF00::/12 is reserved for multicast addresses. Multicast packets are sent to a single address but delivered to multiple hosts that have joined the multicast group. This is distinct from unicast (FF80::/10 is link-local unicast, FC00::/7 is unique local unicast, and 2000::/3 is global unicast).

Why the other options are wrong:

• A. 2000::/3 is the global unicast address block, used for one-to-one communication.
• B. FC00::/7 is the unique local address block, used for private unicast communication.
• C. FE80::/10 is the link-local address block, used for unicast communication on a single link.

Correct answer: D

TCP (Transmission Control Protocol) is reliable, ensuring all data is delivered in order without corruption, and is connection-oriented, requiring a three-way handshake to establish and terminate connections. UDP (User Datagram Protocol) is not reliable-it offers best-effort delivery without guarantees-and is connectionless, sending datagrams without establishing a connection first.

Why the other options are wrong:

• A. TCP is connection-oriented, not connectionless; UDP is connectionless, not connection-oriented.
• B. Both statements are reversed from the correct characterization.
• C. TCP is connection-oriented, not connectionless; UDP is not reliable, not reliable.

Correct answer: D

Global unicast addresses are the IPv6 equivalent of IPv4 public addresses and are publicly routable across the internet. They are assigned from the range 2000::/3 and allow end-to-end communication globally. Unique local addresses are private, link-local addresses are only for local network segments, and multicast addresses are for one-to- many communication.

Why the other options are wrong:

• A. Multicast addresses are for one-to-many communication, not public routing.
• B. Unique local addresses are private and not publicly routable.
• C. Link-local addresses are only valid on the local network segment and are not globally routable.

Correct answer: C

When generating an EUI-64 interface ID from a MAC address, the seventh bit (the Universal/Local bit) of the first octet is inverted. This is a key characteristic of the EUI-64 process. For example, a MAC starting with 00 becomes 02, or a MAC starting with 02 becomes 00. This modified MAC address is then used as the 64-bit interface ID in the IPv6 address.

Why the other options are wrong:

• A. EUI-64 uses the MAC address as a basis, not a random 64-bit value.
• B. FE80 is the prefix for link-local addresses, not inserted into the MAC address during EUI-64 generation.
• D. The MAC address is modified (the seventh bit is inverted) before being used as the interface ID.

Correct answer: B

The maximum requirement is Floor 2 with 29 users. A /25 subnet provides 128 usable addresses (126 hosts), which efficiently accommodates 29 users per floor with minimal waste. Four /25 subnets fit within a /23 summary address, which provides 512 total addresses (510 hosts). This gives both appropriate summary addressing for router configuration and efficient distribution without excessive overhead.

Why the other options are wrong:

• A. /28 provides only 14 usable addresses, insufficient for the 29 users on Floor 2.
• C. /27 provides 30 usable addresses but /25 as a summary only covers 128 total addresses; the math doesn't align for four floors efficiently.
• D. /29 provides only 6 usable addresses, far too small for any floor's user count.

Correct answer: A

For 20 hosts, we need a subnet with at least 22 usable addresses (20 hosts + network + broadcast). A /28 subnet mask (255.255.255.240) provides 16 total addresses (14 usable), which is insufficient. A /27 subnet mask (255.255.255.224) provides 32 total addresses (30 usable), which accommodates 20 hosts. Looking at the existing subnets: 10.10.225.0/28 (0-15), 10.10.225.16/28 (16-31), 10.10.225.64/26 (64-127), the next available /27 block would start at 10.10.225.32. However, 10.10.225.32-10.10.225.63 would overlap with planning. The first available /27 that doesn't overlap is 10.10.225.48-10.10.225.79, which uses mask 255.255.255.224 and network address 10.10.225.48.

Why the other options are wrong:

• B. 10.10.225.32/28 only provides 14 usable addresses, insufficient for 20 hosts.
• C. 10.10.225.48/24 is invalid notation; the subnet mask 255.255.255.224 requires /27, and 10.10.225.48 is not a proper /27 network boundary.
• D. 10.10.225.32/27 overlaps with the existing 10.10.225.16/28 subnet range.

Correct answer: D

In a spine-and-leaf topology, every leaf switch connects to every spine switch, creating a consistent path length. Every device is separated by the same number of hops (typically 2), which provides predictable latency. This is a key advantage over traditional hierarchical networks. The architecture enables equal-cost multipath (ECMP) routing and eliminates STP blocked ports by allowing all links to be active.

Why the other options are wrong:

• A. Links between leaf switches do not exist in the standard spine-and-leaf design; connectivity is only between leaves and spines.
• B. Spine-and-leaf architecture actively avoids STP by enabling all links to be active and using ECMP instead of blocking ports.
• C. Spine-and-leaf provides predictable, consistent latency, not variable latency.

Correct answer: B

With 8 floors and 30-40 users per floor, the maximum need is approximately 320 addresses. A /23 network (255.255.254.0) provides 512 usable addresses (510 hosts), which efficiently accommodates the entire building in one subnet while minimizing waste. A /24 (option A) would only provide 254 addresses, which is insufficient. Options C and D provide even smaller address spaces unsuitable for the requirement.

Why the other options are wrong:

• A. A /24 with mask 255.255.255.0 provides only 254 usable addresses, insufficient for 8 floors × 40 users.
• C. A /25 with mask 255.255.255.128 provides only 126 usable addresses, far too small for the total requirement.
• D. A /27 with mask 255.255.255.224 provides only 30 usable addresses, insufficient even for a single floor.

Correct answer: C

A late collision occurs when two stations transmit frames simultaneously, but the collision is detected after the first 64 bytes of the frame have been received. Early collisions are detected within the first 64 bytes. Late collisions indicate a timing or distance problem and suggest violations of Ethernet cable length specifications or duplex mismatches.

Why the other options are wrong:

• A. A runt is a frame shorter than the minimum Ethernet frame size, not related to simultaneous transmission detection.
• B. A collision counter increments for both early and late collisions, but the specific condition describes a late collision.
• D. CRC (cyclic redundancy check) errors are frame integrity errors, not related to simultaneous transmission detection.

Correct answer: C

When PC_A sends data to PC_B on the same VLAN (VLAN 200) through Switch1, the source and destination MAC addresses remain unchanged throughout the transmission. Switches operate at Layer 2 and forward frames based on MAC addresses, but they do not modify the source or destination MAC addresses in the frame. The switch only uses these addresses to make forwarding decisions and updates its own MAC address table. The original MAC addresses from PC_A (source) and PC_B (destination) stay the same as the frame travels through the switch.

Why the other options are wrong:

• A. Switches do not change the source MAC address of the original sender; they only learn and forward based on it.
• B. MAC flooding or broadcast addresses are not used for unicast communication between two known hosts on the same VLAN.
• D. Switches do not rewrite MAC addresses with their own; they forward frames using the original source and destination MAC addresses.

Correct answer: C

In the 2.4 GHz WiFi band, channels 1, 6, and 11 are the three non-overlapping channels used in the United States and many other regions. These channels are spaced 5 channels apart and have minimal overlap, allowing three independent networks to operate simultaneously without interference. This is the standard recommendation for limiting collisions in shared spectrum.

Why the other options are wrong:

• A. Channels 5, 6, and 7 overlap significantly with each other and are not the standard non-overlapping set.
• B. Channels 1, 2, and 3 overlap considerably and are not optimal for collision avoidance.
• D. Channels 1, 5, and 10 include channel 10, which is not a standard channel in all regions and does not follow the proper spacing.

Correct answer: C

TCP guarantees packet delivery through three mechanisms: checksums for error detection, acknowledgements to confirm receipt, and retransmissions to resend lost packets. UDP, being connectionless and unreliable, only uses checksums for basic error detection but does not guarantee delivery or retransmit lost packets. This is the fundamental difference between these transport layer protocols.

Why the other options are wrong:

• A. Parity checks are not a standard TCP mechanism; UDP does not use cyclic redundancy checks as its only method.
• B. Two-dimensional parity checks are not used in TCP; UDP does not use retransmissions.
• D. TCP does not use parity checks as a primary delivery guarantee; UDP does not use acknowledgements.

Correct answer: A

Band Select is a wireless feature that steers dual-band capable clients toward the less congested 5-GHz band when both 2.4-GHz and 5-GHz networks are available with the same SSID. This feature automatically directs compatible clients to the preferred band to reduce congestion and improve voice quality, directly addressing the requirement stated in the question.

Why the other options are wrong:

• B. DTIM (Delivery Traffic Indication Map) is used for power management, not band steering.
• C. RX-SOP (Receive Start of Packet) is related to packet reception timing, not band selection.
• D. AAA override is related to authentication, not band steering or network selection.

Correct answer: B

The broadcast MAC address is ff:ff:ff:ff:ff:ff, which represents all 48 bits set to 1 in hexadecimal. This special address ensures that a frame is delivered to all devices on the local network segment, as every host recognizes this address as intended for them. This is the standardized broadcast address at Layer 2.

Why the other options are wrong:

• A. This is not a valid broadcast address; it appears to be a unicast MAC.
• C. This is a unicast MAC address, not a broadcast address.
• D. This is a unicast MAC address, not a broadcast address.
• E. This is not a valid broadcast address; broadcast requires all bits set to 1.

Correct answer: C

The preamble is a 7-byte field of alternating 1s and 0s (10101010 pattern) that precedes an Ethernet frame and serves to synchronize the receiver's clock with the transmitter's clock. This notifies the receiving host that traffic is coming and allows it to prepare to receive and decode the incoming frame data.

Why the other options are wrong:

• A. The start of frame delimiter (SFD) comes after the preamble and marks the actual beginning of the frame data.
• B. The Type field identifies the protocol of the payload data, not the arrival of traffic.
• D. The Data field contains the actual payload and does not notify of incoming traffic.

Correct answer: D

The command 'ip address dhcp' is used on a Cisco router interface to dynamically obtain an IP address from a DHCP server. This allows the edge router to receive its public IP address from the service provider's DHCP server without manual static configuration, which is the requirement for dynamic Internet connectivity.

Why the other options are wrong:

• A. ip default-gateway is used to set a default gateway, not to obtain a dynamic IP address.
• B. ip route is used for static routing, not for dynamic IP address assignment.
• C. ip default-network specifies a default network route, not for dynamic IP configuration.
• E. ip address dynamic is not a valid Cisco IOS command; the correct command is 'ip address dhcp'.

Correct answer: B

6to4 tunneling is a technique that encapsulates IPv6 packets within IPv4 packets to allow IPv6 traffic to traverse IPv4 infrastructure. It automatically creates tunnels by embedding IPv6 addresses within IPv4 addresses, enabling communication between IPv6 networks across IPv4 backbones.

Why the other options are wrong:

• A. NAT translates IPv4 addresses, not a method to route IPv6 over IPv4.
• C. L2TPv3 is a Layer 2 tunneling protocol, not specifically designed for IPv6-over-IPv4 routing.
• D. Dual-stack runs IPv4 and IPv6 simultaneously on the same infrastructure, not a tunneling technique.

Correct answer: C

The router has two interfaces configured with /24 subnets (192.168.1.1/24 and 192.168.1.2/24) that overlap in the same IP address space. Both subnets are 192.168.1.0/24, which means they are identical networks. A router cannot have two interfaces in the same subnet as this creates a routing conflict and violates fundamental IP addressing principles. The router will reject this configuration because it cannot have multiple interfaces assigned to the same network address.

Why the other options are wrong:

• A. The design will not function because of the overlapping subnet issue on the router interfaces.
• B. While spanning-tree would be needed for redundancy with the switch connection, this is not the primary design flaw that prevents the network from functioning.
• D. The connection between switches should be a trunk for VLAN traffic, but this is not the critical issue preventing the design from working.
• E. 802.1Q encapsulation on router interfaces would be needed if VLANs were being used across the router, but the fundamental addressing problem prevents the router from even accepting this configuration.

Correct answer: A

Broadband cable access is the preferred WAN technology for small office/home office environments because it offers high-speed connectivity, is cost-effective, and is widely available in residential and small business areas. It provides sufficient bandwidth for typical SOHO needs without the expense of dedicated leased lines or the limitations of older technologies.

Why the other options are wrong:

• B. Frame-relay is legacy technology and expensive for SOHO deployments.
• C. Dedicated leased lines are too costly for typical SOHO budgets.
• D. ISDN provides limited bandwidth and is obsolete for modern SOHO requirements.

Correct answer: B

IPv6 Unique Local Addresses (ULA) have a binary prefix of 11111100 (FC00::/7 in hex). The first 7 bits are set to 1111110, and the 8th bit indicates either globally unique (0) or locally assigned (1), giving either FC00::/8 or FD00::/8 for actual ULAs. Option B correctly identifies the 8-bit pattern 11111100 that represents the FD00::/8 ULA range.

Why the other options are wrong:

• A. 00000000 represents the unspecified address, not ULA.
• C. 11111111 would be outside the standard ULA prefix range.
• D. 11111101 does not correctly represent the ULA binary pattern.

Correct answer: C

When PC1 (192.168.10.10) sends a packet to PC2 (192.168.20.10), the source and destination IP addresses remain constant throughout the entire routing path. IP addresses are not modified by routers during forwarding; only the MAC addresses (Layer 2) change at each hop. As the packet travels from PC1 through R1 to R2 and eventually to PC2, the source IP remains 192.168.10.10 and the destination IP remains 192.168.20.10. When the packet arrives at interface Gi0/0 on router R2 (which connects to R2 from R1), these addresses are unchanged.

Why the other options are wrong:

• A. Router interfaces change MAC addresses but never change the source and destination IP addresses; the destination would still be PC2's IP (192.168.20.10), not R2's interface IP.
• B. This incorrectly shows PC2's network subnet address as the source, which is wrong; the source must be PC1's actual IP address.
• D. This shows router interface IP addresses instead of the actual source and destination host IP addresses; router IPs are used only for the next hop, not as the packet's source and destination.

Correct answer: C

SFP (Small Form-factor Pluggable) modules, whether copper (RJ45) or fiber-based, are designed to be hot-swappable, allowing them to be inserted or removed without disrupting network services. This is a universal feature across both types. Optical attenuators (A) apply only to fiber, not copper. Option B is incorrect because a single SFP module accommodates either single-mode or multi-mode, not both. Option D is wrong because SFP modules support speeds well beyond 100 Mbps (up to 10 Gbps or more) and in full duplex.

Why the other options are wrong:

• A. Inline optical attenuators are specific to fiber optic SFP modules, not copper interfaces.
• B. A single SFP module supports either single-mode or multi-mode fiber, not both simultaneously.
• D. Modern SFP modules support gigabit speeds in full duplex, far exceeding 100 Mbps half duplex.

Correct answer: A

In a two-tier (collapsed core) architecture, the core layer combines distribution and core functions, with the primary responsibility of enforcing routing policies and providing high- speed connectivity between the access and external networks. Option A correctly identifies this policy enforcement role. Option B (marking traffic) is typically an access layer function. Option C (security policies) is primarily an edge or distributed function, not core. Option D (attaching users) is an access layer responsibility, not core.

Why the other options are wrong:

• B. Marking traffic for QoS policies is typically performed at the access or edge layer.
• C. Applying granular security policies is usually an access or distribution layer function.
• D. Attaching end users to the network is an access layer function, not a core layer function.

Correct answer: D

The primary function of a Layer 3 device (router) is to forward traffic between different networks using IP addresses and routing logic. Option D correctly defines this role. Option A relates to wireless access points (Layer 2). Option B describes firewall/security functions, which are not the primary Layer 3 function. Option C describes Layer 2 switching within a broadcast domain, not Layer 3 routing between networks.

Why the other options are wrong:

• A. Transmitting wireless traffic is a Layer 1-2 function of wireless access points, not Layer 3.
• B. Analyzing and dropping unauthorized traffic is a security/firewall function, not the primary Layer 3 role.
• C. Forwarding within the same broadcast domain is a Layer 2 switching function, not Layer 3 routing.

Correct answer: A

To avoid co-channel congestion when deploying access points on the 2.4 GHz frequency, the recommended approach is to use different nonoverlapping channels. The 2.4 GHz band has only three non-overlapping channels (1, 6, and 11 in North America), and deploying access points on different non-overlapping channels prevents interference and signal degradation. Options B, C, and D all involve overlapping channels, which cause interference and congestion.

Why the other options are wrong:

• B. Using overlapping channels creates interference and defeats the purpose of avoiding congestion.
• C. Using only one non-overlapping channel limits deployment options and does not solve congestion.
• D. Using different overlapping channels causes co-channel interference and signal degradation.

Correct answer: D

Software-as-a-Service (SaaS) is the cloud model where employees access applications via the internet without installing, managing, or updating software locally. This directly addresses the manager's concern about not wasting time on occasional software management. Option A (IaaS) provides infrastructure but requires management. Option B (PaaS) is for development platforms. Option C (BPaaS) is for business processes but is not the standard model described.

Why the other options are wrong:

• A. Infrastructure-as-a-Service requires users to manage operating systems and applications.
• B. Platform-as-a-Service is designed for developers to build applications, not for occasional software use.
• C. Business Process-as-a-Service is not a standard cloud model for avoiding software management overhead.

Correct answer: A

Client Band Select is a wireless configuration feature that allows access points to steer or encourage dual-band capable clients to preferentially connect to the 5GHz band, which typically offers higher throughput and less congestion. Re-Anchor Roamed Clients deals with client mobility, OEAP Split Tunnel is a VPN feature, and 11ac MU-MIMO is a 5GHz technology specification that doesn't control client band selection behavior.

Why the other options are wrong:

• B. Re-Anchor Roamed Clients manages client roaming between access points, not band preference.
• C. OEAP Split Tunnel is a VPN configuration feature unrelated to band selection.
• D. 11ac MU-MIMO is a technical specification, not a configuration that steers clients to 5GHz.

Correct answer: D

The data plane handles the actual forwarding of user traffic between hosts and networks (option D). Processing SSH management traffic (option A) occurs on the management plane. OSPF Hello packets (option B) and spanning-tree elections (option C) are control plane functions that manage network topology and routing decisions, not user data forwarding.

Why the other options are wrong:

• A. SSH management traffic is part of the management plane, not data plane.
• B. OSPF Hello packets are control plane routing protocol messages.
• C. Spanning-tree elections are control plane functions for loop prevention.

Correct answer: C

TCP is preferred when data reliability and delivery guarantee are critical, as it provides connection-oriented communication, error checking, and retransmission of lost packets. UDP is preferred when some packet loss is acceptable in exchange for lower latency and less overhead. Option C correctly states this relationship, while options A, B, and D contain reversed or incorrect characterizations of the protocols' strengths.

Why the other options are wrong:

• A. This reverses the actual relationship; TCP prioritizes reliability over latency, and UDP prioritizes low latency.
• B. TCP ensures in-order delivery and rejects dropped data; UDP allows both dropped and out-of-order packets.
• D. This reverses the actual use cases; UDP is time-sensitive while TCP can tolerate higher latency.

Correct answer: A

Comparing the two interface outputs, SiteA shows a reliability of 166/255 while SiteB shows a reliability of 255/255. This significant difference in reliability metrics indicates that SiteA's interface is experiencing errors that are degrading the connection quality. The reliability value of 166/255 means the interface is only 65% reliable, which directly correlates with the reported intermittent connectivity issues. High reliability values at SiteB combined with poor reliability at SiteA suggest interface errors are incrementing on the SiteA side, causing packet loss and intermittent application connectivity.

Why the other options are wrong:

• B. Both sites show comparable bandwidth utilization (input/output rates) that are well below the 10Gbps capacity, so high usage is not the cause.
• C. Both interfaces correctly specify SFP-LR media type, and both show they are up with proper line protocol status.
• D. The cable type is appropriate for the connection (single-mode fiber with SFP-LR transceivers), and SiteB's interface works perfectly, so cable type is not the issue.