Question 1

On a Cisco Catalyst switch, you want to display the current MAC address forwarding or filtering table that shows which MAC addresses are associated with which ports. Which IOS command should you use to view this MAC address table?

Accepted Answer

Introduction / Context: Cisco Catalyst switches maintain a MAC address table, also known as the forwarding or filter table, that maps MAC addresses to specific switch ports. This table is critical for efficient layer 2 forwarding. Network administrators routinely need to inspect this table to troubleshoot connectivity issues, verify where a device is connected, or confirm that learning is occurring as expected. The question asks which Cisco IOS command displays this MAC address table on a switch. Given Data / Assumptions: The device is a Cisco switch running IOS with standard switch commands. You want to see which MAC addresses are associated with which interfaces and VLANs. You know that there is a specific show command used on switches for this purpose. Other commands such as show running-config or show interfaces provide different information. Concept / Approach: The MAC address table is a layer 2 construct. Cisco IOS on Catalyst switches provides the show mac address-table command to display this table. This command lists learned MAC addresses, the VLAN they belong to, and the associated port. Other similar sounding commands either do not exist or serve different functions. For example, show running-config displays configuration, not dynamic MAC learning. The key is to recall the exact syntax used by Cisco for this feature. Step-by-Step Solution: 1. Recall that to view MAC address mappings on a Cisco switch, you use a show mac related command. 2. Consider the known standard command: show mac address-table. 3. Recognize that this command output lists MAC addresses, VLANs, and interfaces, matching exactly what the question asks for. 4. Evaluate the other options and see that they either refer to nonstandard commands or provide different types of information. 5. Conclude that show mac address-table is the correct IOS command to display the MAC forwarding table. Verification / Alternative check: If you have used Cisco switches, you likely have typed show mac address-table many times when tracing where a host is connected. On older software versions, a similar command was show mac-address-table, but modern syntax uses show mac address-table. The output clearly includes columns such as VLAN, MAC address, type, and ports, which confirms that it is the correct tool for this task. Why Other Options Are Wrong: Option a: show mac filter is not a standard command to display the main MAC address table on typical Cisco Catalyst switches. Option b: show running-config displays the device configuration, including interface settings and VLAN configuration, but not the dynamic MAC address table. Option d: show mac filter-table is not a standard IOS command and does not match Cisco documentation for viewing the MAC table. Option e: show interfaces mac is not a typical Cisco IOS command; show interfaces displays interface statistics but not the full MAC address table in tabular form. Common Pitfalls: Candidates sometimes confuse router and switch commands or assume that show running-config will reveal everything. Another pitfall is misremembering the dash or spacing in the command. On exams, command choices are often designed to look very similar, with small differences like hyphens or pluralization. Always recall that the correct switch command is written as show mac address-table with a space and not with hyphens or alternative words. Practicing on real or simulated Cisco devices helps embed the exact syntax into memory and avoids errors in both exam and real world troubleshooting situations. Final Answer: The correct IOS command is show mac address-table.

Question 2

You want to enable the IEEE 802.1w Rapid Spanning Tree Protocol (RSTP) on a Cisco switch that supports Per VLAN Spanning Tree. Which global configuration mode command should you use to configure the switch to run rapid per VLAN spanning tree (rapid-…

Accepted Answer

Introduction / Context: Cisco Catalyst switches support different Spanning Tree Protocol (STP) modes, including the original IEEE 802.1d STP, the faster 802.1w Rapid STP (RSTP), and Cisco variations such as Per VLAN Spanning Tree Plus (PVST+) and Rapid Per VLAN Spanning Tree (rapid-pvst). To take advantage of faster convergence, many networks enable rapid-pvst mode. This question checks whether you know the correct global configuration command and context to enable 802.1w based rapid-pvst on a Cisco switch. Given Data / Assumptions: The switch supports different STP modes such as pvst, rapid-pvst, and mst. You want to enable the rapid-pvst mode, which is Cisco's implementation of IEEE 802.1w RSTP on a per VLAN basis. The configuration must be done in global configuration mode, not just at an interface level. You are choosing from commands that are very similar in format and prompt level. Concept / Approach: To change the STP mode on a Cisco switch, you use the spanning-tree mode command in global configuration mode. The supported keywords include pvst, rapid-pvst, and mst. Rapid-pvst corresponds to the rapid per VLAN spanning tree mode based on 802.1w. The prompt for global configuration mode is Switch(config)#. Commands entered at the EXEC level such as Switch# without entering configuration mode will not change global STP mode. Commands that explicitly mention 802.1w instead of rapid-pvst are not valid IOS syntax for setting the spanning tree mode on most Catalyst platforms. Step-by-Step Solution: 1. Recall that STP mode is a global setting, not an interface specific setting, so you must be in global configuration mode. 2. Recognize the global configuration prompt as Switch(config)#. 3. Remember the correct keyword for rapid STP per VLAN on Cisco devices is rapid-pvst. 4. Combine these facts to form the command: spanning-tree mode rapid-pvst. 5. Place this command at the global configuration level, giving: Switch(config)# spanning-tree mode rapid-pvst. Verification / Alternative check: You can confirm this behavior by recalling other possible modes. For example, to configure multiple spanning tree, you would type Switch(config)# spanning-tree mode mst. In the same pattern, rapid-pvst is the keyword used for the rapid version of PVST. Additionally, most Cisco official examples show exactly this syntax when enabling RSTP with per VLAN support. This consistency across documentation and labs confirms the answer. Why Other Options Are Wrong: Option b: Switch# spanning-tree mode rapid-pvst is entered from EXEC mode, not configuration mode, so it is not a valid configuration command. Option c: There is no commonly supported spanning-tree mode 802.1w keyword; the correct keyword is rapid-pvst, not 802.1w in Cisco IOS syntax. Option d: Similar to option b and c, this is EXEC mode and uses the wrong keyword, so it is not correct. Option e: Switch(config-if)# spanning-tree mode rapid-pvst would be interface configuration mode, but STP mode is not configured per interface; it is global for the switch. Common Pitfalls: Exam candidates often focus only on the keyword rapid-pvst and overlook the configuration context, choosing answers that show the correct keyword but the wrong prompt level. Another pitfall is confusing the IEEE standard number 802.1w with actual IOS syntax. While 802.1w describes Rapid STP, Cisco uses the rapid-pvst keyword to configure it. To avoid mistakes, always remember that global STP mode changes are done at the Switch(config)# prompt and use the exact IOS keywords defined by Cisco, not the IEEE numbers. Final Answer: To enable rapid per VLAN spanning tree, you should use Switch(config)# spanning-tree mode rapid-pvst.

Question 3

Two switches are connected together using two crossover cables to provide redundancy, but Spanning Tree Protocol (STP) is disabled on both switches. In this situation, what is the most likely effect on the switched Ethernet network?

Accepted Answer

Introduction / Context: In a switched Ethernet network, loop free topology is essential to prevent frames from circulating endlessly. Spanning Tree Protocol (STP) is the standard mechanism that detects and logically disables redundant paths so that there is only one active path between any two points. When multiple physical links exist and STP is disabled, switching loops are created. This question is testing whether you understand that redundant links without STP cause broadcast storms rather than automatic load balancing or simple table issues. Given Data / Assumptions: There are two switches connected by two crossover cables, creating two parallel layer 2 links. Spanning Tree Protocol is completely disabled on both switches. The switches are operating as normal transparent bridges that forward frames based on MAC addresses. End devices are sending unicast, multicast, and broadcast traffic over the network. Concept / Approach: When there are redundant layer 2 paths and no loop prevention mechanism, frames can circulate indefinitely. Broadcast frames and unknown unicast frames are flooded out all ports in the same VLAN except the one on which they are received. With two parallel links between switches, a flooded frame can travel back and forth, being copied repeatedly and never aged out. This creates a broadcast storm, consuming bandwidth and switch CPU resources and eventually leading to network collapse. STP prevents this by blocking one of the redundant links, but since STP is disabled in this scenario, the protection is not present. Step-by-Step Solution: 1. Recognize that two crossover cables between the same pair of switches create a physical loop at layer 2. 2. Note that STP is disabled, so the switches will not logically block any of the redundant ports. 3. Understand that when a broadcast or unknown unicast frame is received, the switch floods it out all other ports in the same VLAN. 4. The flooded frame travels over both links to the other switch, which also floods it back, creating a loop. 5. New copies of the same frame continue to circulate, building into a broadcast storm that overwhelms the network. 6. Conclude that the correct effect is a broadcast storm on the switched network. Verification / Alternative check: In real networks, if you connect two switches with multiple links and disable STP, you will typically see immediate symptoms such as extremely high CPU utilization on the switches, massive increases in broadcast traffic, and loss of connectivity for normal data flows. Network monitoring tools will show an abnormal amount of broadcast frames. When STP is reenabled or one of the redundant links is removed, the storm stops, confirming that the loop and lack of STP were the causes. Why Other Options Are Wrong: Option a: Routing tables are a layer 3 concept and switches at layer 2 do not rely on them for basic forwarding, so this is not the main issue. Option b: The MAC table may change rapidly due to the loop, but the key problem is not a failure to update; it is the uncontrolled flooding. Option d: Standard switches do not automatically load balance at layer 2 over parallel links without additional features such as EtherChannel and proper configuration. Option e: Without STP or link aggregation protocols, both physical links are active and used for flooding, which contributes to the loop instead of leaving one link idle. Common Pitfalls: Learners sometimes think that more physical links always improve redundancy and performance automatically. However, at layer 2, redundant links require STP or another loop prevention system. Another pitfall is confusing broadcast storms with simple high utilization due to a heavy workload. Broadcast storms are self sustaining and continue even without new user traffic, which can make troubleshooting difficult. Remember that STP is the default safeguard, and disabling it in a network with redundant links almost always leads to broadcast storm scenarios. Final Answer: The most likely result is that broadcast storms will occur on the switched network when STP is disabled and redundant links are present.

Question 4

On a Cisco switch, which proprietary Spanning Tree Protocol (STP) extension will place a port into an err-disabled state if a Bridge Protocol Data Unit (BPDU) is received on that port, typically used to protect PortFast enabled access ports from une…

Accepted Answer

Introduction / Context: Cisco provides several Spanning Tree Protocol (STP) extensions that enhance stability and security in switched networks. One common security feature is designed to protect access layer ports that are configured with PortFast and should never receive BPDUs from another switch. If a BPDU appears on such a port, it may indicate that an unauthorized switch or loop has been connected. The extension that reacts by placing the port into an err-disabled state is the focus of this question, which is important for both certification exams and real world network hardening. Given Data / Assumptions: Access ports are configured with PortFast so that end devices can quickly reach a forwarding state. These ports should connect only to hosts, not to other switches. The requirement is to shut down the port automatically if a BPDU is ever received on it. The question is asking which Cisco proprietary STP extension performs this protection function. Concept / Approach: BPDU Guard is a Cisco enhancement that works with PortFast. When enabled on a PortFast interface, BPDU Guard monitors for incoming BPDUs. Under normal conditions, host devices do not send BPDUs, so none should appear. If a BPDU is detected, BPDU Guard assumes that a switch or loop has been connected where only an end host should be, and it immediately puts the port into an err-disabled state. This behavior prevents potential topology loops or unintended participation in STP. Other extensions such as BPDU Filter, Root Guard, and Loop Guard have different roles and do not automatically err-disable an access port on BPDU reception in the same way. Step-by-Step Solution: 1. Identify that the port is intended as a PortFast enabled access port that should connect only to end hosts. 2. Recognize that receiving a BPDU on such a port is considered an error and a security concern. 3. Recall that BPDU Guard is designed specifically to protect PortFast ports by shutting them down if a BPDU is received. 4. Understand that when BPDU Guard triggers, the port moves into an err-disabled state, requiring manual intervention or automatic recovery configuration. 5. Confirm that none of the other listed STP extensions exactly match this behavior. Verification / Alternative check: In practice, Cisco documentation and configuration examples show that enabling spanning-tree bpduguard enable on an interface or globally causes PortFast interfaces to be disabled if BPDUs appear. Network engineers often use this in access networks to protect against misconnected switches or malicious attempts to manipulate STP. When a port goes err-disabled due to BPDU Guard, show interface status will display the err-disabled state and the reason, confirming that BPDU Guard is responsible. Why Other Options Are Wrong: Option b: BPDU Filter suppresses the transmission or reception of BPDUs under certain conditions, but by itself does not automatically place a port into err-disabled on BPDU reception. Option c: Root Guard is used on ports where you do not want a new root bridge to appear, and it places the port into a root inconsistent state if superior BPDUs are received, not an err-disabled state for simple BPDU reception on access ports. Option d: Loop Guard is designed to prevent alternate or root ports from erroneously transitioning to forwarding state when BPDUs stop arriving, not for blocking access ports when BPDUs are received. Option e: UplinkFast improves convergence for access layer switches that lose a root port link, but it does not protect PortFast access ports from BPDUs. Common Pitfalls: A common confusion is between BPDU Guard and BPDU Filter. While both involve BPDUs on access ports, their behavior is different. BPDU Filter may stop BPDUs from being sent or acted upon, which can be dangerous if misused. BPDU Guard, on the other hand, takes a protective action by shutting down the port when a BPDU appears. Remember that Guard is about protecting the network by disabling the port, while Filter is about controlling BPDU traffic flow. Keeping these roles clear helps avoid configuration mistakes that could weaken network stability or security. Final Answer: The Cisco STP extension that err-disables a PortFast port when a BPDU is received is BPDU Guard.

Question 5

Which Cisco 802.1d Spanning Tree Protocol extension is used to stop BPDUs from being transmitted out a specific port, often on access ports that are connected to end hosts and should not participate in STP?

Accepted Answer

Introduction / Context: In Cisco switching environments, several Spanning Tree Protocol enhancements are available to fine tune how BPDUs are sent and received. On some edge ports that connect only to hosts, administrators may want to prevent BPDUs from being sent or processed so that those ports do not cause unnecessary STP activity. The Cisco feature that stops BPDUs from being transmitted out a port under certain conditions is called BPDU Filter. This question focuses on correctly identifying that feature among other STP related mechanisms. Given Data / Assumptions: You have an access port that connects to an end host and should not participate in STP exchanges. You want to prevent BPDUs from being transmitted out that port. You may also want to ignore incoming BPDUs on that port, depending on configuration mode. Concept / Approach: BPDU Filter is a Cisco extension that can be configured either globally or on a per interface basis. When applied to an interface, it can suppress the sending and in some cases the processing of BPDUs, effectively hiding the port from the STP topology. This is particularly useful on ports that are connected to devices that are never expected to participate in STP, such as end user PCs. It is different from BPDU Guard, which shuts down the port when a BPDU is received, and from Root Guard and Loop Guard, which protect the stability of the STP topology in other ways. The key clue in the question is that the feature stops BPDUs from being transmitted. Step-by-Step Solution: 1. Identify that the main requirement is to stop BPDUs from being sent out a port. 2. Recall that BPDU Guard reacts to received BPDUs by err-disabling the port, rather than simply suppressing BPDU transmission. 3. Note that Root Guard prevents a port from becoming a root port, and Loop Guard protects against unidirectional link issues, neither of which directly stops BPDU transmission. 4. Recognize that BPDU Filter can be configured so that an interface neither sends nor processes BPDUs in normal operation. 5. Conclude that BPDU Filter is the Cisco 802.1d extension that stops BPDUs from being transmitted out a specific port. Verification / Alternative check: Cisco configuration guides show that the command spanning-tree bpdufilter enable under an interface enables this behavior. When active, the interface does not send BPDUs, and depending on mode, may also ignore incoming BPDUs, effectively removing the port from STP participation. This confirms that BPDU Filter is the feature described. In contrast, BPDU Guard is configured with spanning-tree bpduguard enable and causes a port shutdown on BPDU reception, which is a different behavior than just stopping BPDU output. Why Other Options Are Wrong: Option b: BPDU Guard is used to err-disable a port when BPDUs are received, not to silently stop BPDUs from being transmitted. Option c: Root Guard is applied to ports where you do not want a new root bridge to appear, and it places a port into a root inconsistent state on receiving certain BPDUs, but it does not stop BPDU transmission by itself. Option d: Loop Guard protects against a condition where BPDUs suddenly stop being received on non designated ports; it does not stop BPDUs from being sent. Option e: PortFast allows a port to transition quickly to forwarding state, but it does not in itself suppress BPDUs. It is often used together with BPDU Guard or BPDU Filter for edge ports. Common Pitfalls: Many students confuse BPDU Guard with BPDU Filter because both are associated with access ports and PortFast. The simple way to remember the difference is that Guard protects the network by shutting the port when BPDUs are seen, while Filter hides the port from STP by suppressing BPDUs. Misusing BPDU Filter can be dangerous because if a switch is accidentally connected to such a port, the lack of BPDUs can allow loops to form undetected. Therefore, network designers often prefer BPDU Guard as a safer default for user facing ports, while using BPDU Filter only in carefully controlled scenarios. Final Answer: The Cisco extension that stops BPDUs from being transmitted out a port is BPDU Filter.

Question 6

In a switched Ethernet network, which switching technology is specifically used to reduce the size of a broadcast domain by logically segmenting a single physical network into multiple separate logical networks?

Accepted Answer

Introduction / Context: In Ethernet networks, a broadcast domain is the set of devices that receive broadcast frames from one another. Large broadcast domains can lead to excessive broadcast traffic and reduced performance. A key design goal in modern networks is to reduce the size of broadcast domains while still using shared physical infrastructure. Virtual LANs, or VLANs, provide a way to achieve this by logically segmenting the network. This question asks you to identify which switching technology directly reduces the size of a broadcast domain. Given Data / Assumptions: The network uses Ethernet switches for layer 2 connectivity. There is a need to reduce the size of broadcast domains for performance and security reasons. Multiple technologies are available, including trunking, VLANs, STP, and link aggregation. The question focuses on which technology reduces the broadcast domain size itself, not just improves redundancy or capacity. Concept / Approach: VLANs logically divide a single physical switch into multiple virtual switches, each with its own separate broadcast domain. Hosts in one VLAN do not receive broadcast frames from hosts in another VLAN unless a router or layer 3 device forwards traffic between them. Trunking protocols like ISL and IEEE 802.1Q carry multiple VLANs over a single link but do not, by themselves, create segmentation; they simply transport VLAN information. Spanning Tree Protocol prevents loops but does not change broadcast domain size. EtherChannel aggregates links for more bandwidth and redundancy but also leaves the broadcast domain unchanged. Therefore, VLANs are the technology that directly reduces broadcast domain size. Step-by-Step Solution: 1. Recall that a broadcast domain is the set of devices that receive each other's broadcast frames. 2. Understand that VLANs create separate logical layer 2 segments, each acting as an independent broadcast domain. 3. Recognize that ISL and 802.1Q are tagging methods that allow VLANs to traverse trunk links, but the VLAN construct itself is what defines domain boundaries. 4. Note that STP only blocks ports to prevent loops; it does not change which devices share broadcasts. 5. Note that EtherChannel combines physical links into a logical link for bandwidth and redundancy, but devices on either side still share the same broadcast domain. 6. Conclude that Virtual LANs are the switching technology that reduces broadcast domain size. Verification / Alternative check: In practice, when you configure multiple VLANs on a switch and assign different ports to different VLANs, a broadcast sent on VLAN 10 is not delivered to ports in VLAN 20. This is easy to confirm with packet sniffer tools. Only traffic that goes through a router or a layer 3 switch can move between VLANs, which proves that VLANs define broadcast domain boundaries. Trunks are simply used so that multiple VLANs can share an uplink while remaining logically separated. Why Other Options Are Wrong: Option a: ISL is a Cisco proprietary trunking protocol that encapsulates VLAN information in frames, but it does not inherently split broadcast domains; VLANs do that. Option b: IEEE 802.1Q is a standard trunking method that inserts VLAN tags inside Ethernet frames, again used to carry VLANs over links rather than define broadcast domain size by itself. Option d: STP prevents switching loops and resulting broadcast storms, but the entire switched domain still remains one broadcast domain unless VLANs are configured. Option e: EtherChannel aggregates multiple physical links into one logical link for redundancy and higher bandwidth; broadcast domain size remains unchanged. Common Pitfalls: Learners often confuse trunking with VLANs and assume that enabling 802.1Q trunking alone creates isolation. In reality, trunks only carry existing VLANs across links. The real segmentation comes from VLAN configuration on switch ports. Another pitfall is thinking that STP or link aggregation technologies somehow reduce broadcast traffic by splitting domains. They may improve stability or capacity but do not change broadcast domain boundaries. Always remember that VLAN equals broadcast domain at layer 2, which simplifies reasoning about exam questions and design decisions. Final Answer: The switching technology that reduces the size of a broadcast domain is Virtual LANs (VLANs).

Question 7

You want to improve network performance by increasing the bandwidth available to hosts and at the same time limit the size of broadcast domains for better scalability and security. Which option provides both higher bandwidth and smaller broadcast do…

Accepted Answer

Introduction / Context: Modern enterprise networks must balance the need for higher bandwidth with the need to control broadcast traffic and isolate groups of users for security. Simple shared media such as hubs cannot provide sufficient bandwidth or isolation. Switches introduce microsegmentation by providing dedicated bandwidth per port, and VLANs allow logical segmentation that breaks large broadcast domains into smaller ones. This question asks you to choose the option that simultaneously increases bandwidth for hosts and reduces broadcast domain size. Given Data / Assumptions: The network currently experiences broadcast traffic that affects many hosts. There is a requirement to give hosts more bandwidth than a shared hub would provide. Segmentation of users into smaller groups is desired for performance and security. Cisco style switches are available so that VLANs can be configured. Concept / Approach: Switches operate at layer 2 and provide dedicated collision domains for each port, which effectively gives each host its own segment and improves bandwidth compared to hubs. However, if all ports are in a single VLAN, they still share one broadcast domain. By configuring multiple VLANs on the switches and assigning ports appropriately, you create multiple smaller broadcast domains. Each VLAN is its own logical network, and broadcasts stay within that VLAN. This approach delivers both improved per host bandwidth and reduced broadcast domain size. Other devices like hubs and unmanaged repeaters simply repeat signals and do not provide segmentation or additional bandwidth beyond the shared medium. Step-by-Step Solution: 1. Recognize that hubs and repeaters operate at the physical layer and create a single shared collision domain, so they do not increase per host bandwidth or limit broadcast domains. 2. Understand that basic switches already provide separate collision domains per port, increasing bandwidth compared to hubs. 3. However, if the switch uses only one VLAN, all ports are still in a single broadcast domain. 4. Introducing multiple VLANs on the switches breaks the network into several logical segments, each with its own broadcast domain. 5. Hosts within each VLAN enjoy dedicated switch port bandwidth and are not impacted by broadcast traffic from other VLANs. 6. Conclude that switches configured with multiple VLANs best satisfy both requirements. Verification / Alternative check: Consider a scenario with one switch and 48 hosts. With a single VLAN, a broadcast from any host is seen by all 47 others. If you create four VLANs of 12 hosts each, a broadcast in one VLAN is seen by only 11 other hosts, greatly reducing broadcast scope. At the same time, each host still has a dedicated switch port, so there is no shared collision domain. This confirms that using switches with VLANs achieves higher bandwidth and smaller broadcast domains simultaneously. Why Other Options Are Wrong: Option a: Managed hubs may offer management features, but they still operate as multiport repeaters, sharing bandwidth among all ports and maintaining a single broadcast and collision domain. Option b: Bridges can segment collision domains between segments, but a single bridge does not provide the same flexible VLAN based segmentation and scalability as modern switches. Option c: Switches with a single VLAN improve collision domain separation but do not limit broadcast domains, since all ports still share one broadcast domain. Option e: Unmanaged repeaters simply regenerate electrical signals and offer no segmentation or bandwidth improvement per host. Common Pitfalls: A common misunderstanding is thinking that switches alone automatically solve broadcast traffic issues. While they solve collisions, they do not reduce broadcast domain size unless VLANs are used. Another pitfall is assuming that bridges and switches are equivalent for all scale levels. In large networks, VLAN capable switches provide far more flexibility and performance. Also, some learners confuse collision domains with broadcast domains; it is important to remember that VLANs define broadcast domains, while switch ports define collision domains. Final Answer: The best way to increase bandwidth and limit broadcast domain size is to use switches configured with multiple VLANs.

Question 8

A switch is configured with three VLANs (VLAN2, VLAN3, and VLAN4). A router has been added to provide inter VLAN communication, and only a single physical connection is planned between the router and the switch. What is the minimum type of interface…

Accepted Answer

Introduction / Context: When multiple VLANs exist on a switch and a router is used to provide inter VLAN routing, a common design is the router on a stick model. In this design, a single physical interface on the router is configured as a trunk to the switch and multiple subinterfaces are created, one per VLAN. Each subinterface has an IP address in the corresponding VLAN subnet and acts as the default gateway for that VLAN. This question asks which type of router interface is the minimum appropriate choice for this trunk connection in a typical modern network. Given Data / Assumptions: The switch has three VLANs: VLAN2, VLAN3, and VLAN4. Only one physical link will connect the router and the switch. The router will handle inter VLAN routing using subinterfaces over a trunk link. The available interface types include low speed serial and various Ethernet speeds. Concept / Approach: Router on a stick requires an Ethernet interface that supports trunking with IEEE 802.1Q or ISL encapsulation. A serial interface is not appropriate for an 802.1Q trunk to a switch, and 56 Kbps is far too slow for typical LAN inter VLAN routing needs. While a 10 Mbps Ethernet port could technically carry VLAN tagged traffic, many exam style questions assume Fast Ethernet as the minimum practical standard in switched LAN environments. Fast Ethernet provides 100 Mbps bandwidth and can be configured for trunking, making it the usual choice for inter VLAN connections in such scenarios, unless higher speed requirements dictate Gigabit Ethernet. Step-by-Step Solution: 1. Recognize that inter VLAN routing through a single physical link requires an Ethernet trunk between the router and switch. 2. Understand that this is implemented by creating multiple subinterfaces on the router's Ethernet port, each configured with encapsulation dot1q and an IP address for its VLAN. 3. Eliminate serial interfaces because they cannot serve as 802.1Q trunks in a standard router on a stick design to a LAN switch. 4. Evaluate 10 Mbps Ethernet versus 100 Mbps Fast Ethernet. Both can technically support trunking but 100 Mbps is typically considered the minimum recommended bandwidth in modern campus designs and matches exam expectations. 5. Note that 1 Gbps Gigabit Ethernet is an even better choice but is not strictly the minimum required to make the design work. 6. Conclude that the minimum appropriate interface type is a 100 Mbps Fast Ethernet interface. Verification / Alternative check: Exam questions from Cisco certified training material frequently describe router on a stick using a Fast Ethernet interface on the router, configured with subinterfaces like Fa0.1, Fa0.2, and Fa0.3 for VLAN2, VLAN3, and VLAN4. The corresponding switch port is configured as a trunk. This consistent use of Fast Ethernet indicates that it is considered the baseline interface type for this design in test scenarios, confirming the choice of a 100 Mbps Fast Ethernet interface as the correct answer. Why Other Options Are Wrong: Option a: A 10 Mbps Ethernet interface could technically work, but it is usually not presented as the minimum recommended option in certification contexts where Fast Ethernet is expected. Option b: A 56 Kbps serial interface cannot function as an 802.1Q Ethernet trunk and also lacks the bandwidth required for normal LAN inter VLAN traffic. Option d: A 1 Gbps Gigabit Ethernet interface is more than sufficient but does not represent the minimum type of interface required in this question. Option e: Serial interfaces with Frame Relay encapsulation are used for WAN connections and are not appropriate for Ethernet trunking to a LAN switch. Common Pitfalls: One common mistake is to think that any router interface type is acceptable as long as IP can be configured. However, router on a stick relies on Ethernet trunking, which requires an Ethernet interface that supports VLAN tagging. Another pitfall is focusing on maximum performance and choosing Gigabit Ethernet by default, even when the question specifically asks for the minimum interface type. Reading the wording carefully and remembering typical LAN speeds used in exam examples will help you choose the most appropriate answer in context. Final Answer: The minimum interface type needed on the router for a single trunk link that carries multiple VLANs is a 100 Mbps Fast Ethernet interface.

Question 9

On a Cisco Catalyst 2960 switch, you want to configure a port as an 802.1Q trunk so that it can carry multiple VLANs between switches. Which command should you use on the interface to set the switchport into permanent trunk mode?

Accepted Answer

Introduction / Context: Cisco Catalyst switches such as the 2960 are commonly used to create VLAN aware switched networks. To carry traffic for multiple VLANs across a single physical link between switches or between a switch and a router, you must configure that link as a trunk. On some models, encapsulation is fixed to 802.1Q, and you only need to set the switchport mode. This question asks which specific interface configuration command puts a port into permanent trunk mode on a 2960 switch. Given Data / Assumptions: The device is a Cisco Catalyst 2960 switch. You are configuring an interface in interface configuration mode. The goal is to carry traffic for multiple VLANs over that port. The encapsulation type is not configurable on the 2960 because it uses 802.1Q only. Concept / Approach: On 2960 switches, the encapsulation for trunks is fixed to dot1q, so you do not use a trunk encapsulation command. Instead, you control whether a port operates as an access port or a trunk port using the switchport mode commands. The command switchport mode trunk forces the port into permanent trunk mode, meaning it sends and receives tagged frames for multiple VLANs. Other commands such as switchport mode access or dynamic desirable configure other behaviors through Dynamic Trunking Protocol, but the question is specifically about setting a trunk port directly. Step-by-Step Solution: 1. Enter interface configuration mode on the switch for the desired port. 2. Recall that for a 2960 switch, trunk encapsulation is not configurable, so you do not need an encapsulation command. 3. Use the switchport mode command to choose between access, trunk, and dynamic modes. 4. To make the port always act as a trunk, enter the command switchport mode trunk. 5. After this, you can specify allowed VLANs if necessary, but the basic trunk function is established by this mode command. Verification / Alternative check: In Cisco documentation and lab examples, configuring a trunk on a 2960 switch always includes lines similar to interface FastEthernet0/24 followed by switchport mode trunk. The absence of a switchport trunk encapsulation command is normal on these models, confirming that mode selection is the key. Running the show interfaces trunk command afterward will list the port as a trunk, which verifies that the configuration is correct. Why Other Options Are Wrong: Option a: trunk on is not a valid Cisco IOS command for configuring trunks on 2960 switches. Option b: trunk all is not a valid interface mode command in IOS. Option c: switchport trunk on is not correct syntax; Cisco uses switchport mode trunk to set the mode. Option e: switchport trunk encapsulation dot1q is used on some platforms that support multiple encapsulation types, but 2960 switches use only dot1q and do not require or allow this command. Even on platforms where it exists, you still need switchport mode trunk to enable trunking. Common Pitfalls: A common mistake is to assume that encapsulation must always be set explicitly, even on platforms where it is fixed. On exams, options may include valid commands from other switch models to distract you. Another pitfall is confusing interface configuration mode commands with global configuration or EXEC mode syntax. Always pay attention to the prompt shown in example commands and remember that switchport configuration is done at the interface level. Practicing on real or simulated 2960 devices makes the correct syntax very familiar and reduces the chance of choosing invalid options. Final Answer: To put a port into permanent trunk mode on a 2960 switch, use switchport mode trunk in interface configuration mode.

Question 10

You connect a new host to a switch port, but the host cannot log in to or reach a server that is plugged into another port on the same switch. Routing is not involved. Which of the following is the most likely cause of the connectivity problem?

Accepted Answer

Introduction / Context: In VLAN aware switched networks, devices that are supposed to communicate at layer 2 must be in the same VLAN. Even if they are connected to the same physical switch, if their ports are assigned to different VLANs, their traffic is kept logically separate and will not reach each other without routing. This scenario is very common when a new host is added to a network and the switch port is left in a default VLAN or misconfigured. The question tests your understanding of VLAN membership and its impact on basic host connectivity. Given Data / Assumptions: A new host is connected to a switch port. A server is connected to another port on the same switch. The host cannot log in to or reach the server. No mention is made of inter VLAN routing or use of a router for this connection. The issue is likely confined to layer 2 configuration on the switch. Concept / Approach: Switch ports belong to VLANs, and all ports in the same VLAN form a single broadcast domain. Hosts in the same VLAN can communicate directly at layer 2, assuming IP settings such as subnet and gateway are consistent. If two hosts are in different VLANs on the same switch, they require layer 3 routing between those VLANs to communicate. When a new host cannot reach a server, and both are supposed to be on the same subnet and VLAN, a common cause is that the new port is assigned to the wrong VLAN. Correcting VLAN membership for that port usually restores connectivity. Step-by-Step Solution: 1. Recognize that both devices are on the same physical switch, so physical connectivity is present. 2. Since the problem description does not involve a router, focus on layer 2 issues such as VLAN membership. 3. Understand that if the host port is in VLAN 10 and the server port is in VLAN 20, they are in separate broadcast domains and cannot communicate without routing. 4. Check the port configuration with commands like show interfaces switchport to verify the VLAN assignment. 5. Realize that the most likely problem is that the new host port is not in the correct VLAN that the server uses. 6. Conclude that the wrong VLAN membership on the host port is the most probable cause. Verification / Alternative check: In real troubleshooting, you would verify the IP configuration on the host and server to ensure they are in the same subnet. Then you would inspect the switch port configuration for both devices. If the server port is in VLAN 10 and the host port is in VLAN 1, ARP requests from the host for the server will never reach the server because they are isolated by VLAN boundaries. Changing the host port to VLAN 10 and testing again usually restores connectivity, confirming that VLAN mismatch was the root cause. Why Other Options Are Wrong: Option a: The problem statement says both devices are on the same switch and does not involve routing, so a missing router route is unlikely to be the cause. Option b: VTP (VLAN Trunking Protocol) is used to distribute VLAN definitions between switches, not to assign ports to VLANs. In a single switch scenario, port membership is a more direct concern. Option c: Invalid MAC addresses are extremely rare in normal hosts, and even if a MAC were unusual, it would not prevent the switch from forwarding based on that address as long as it is unique. Option e: The STP mode used by the switch does not affect whether two ports in the same VLAN can communicate under normal conditions, unless a port is blocked, which the question does not suggest. Common Pitfalls: A frequent mistake is assuming that as long as devices are on the same physical switch, they can talk to each other. In VLAN environments, logical segmentation is what matters. Another pitfall is focusing exclusively on IP settings and routing when the real issue is at layer 2. Always verify VLAN membership and trunk status when a host cannot reach another device on the same switch. This habit will save time in both exam questions and practical troubleshooting tasks. Final Answer: The most likely cause is that the switch port the host is connected to is not configured with the correct VLAN membership to match the server.

Question 11

In a VLAN enabled switched network, what is meant by the term frame tagging when traffic is sent over a trunk link between switches or between a switch and a router?

Accepted Answer

Introduction / Context: In VLAN aware networks, switches and routers often need to carry traffic for multiple VLANs across a single physical link. To keep VLANs logically separate while sharing this link, devices must indicate in each frame to which VLAN the frame belongs. This process is known as frame tagging. Understanding the concept of frame tagging is essential for working with 802.1Q and other trunking technologies in Cisco based networks. Given Data / Assumptions: Multiple VLANs are configured in the network. Switches or routers are connected with trunk links that carry traffic for more than one VLAN. The term frame tagging is used in the context of these trunk links. The question focuses on what information is inserted into the frame and why. Concept / Approach: Frame tagging refers to the method of inserting VLAN identification into Ethernet frames when they traverse a trunk link. Technologies such as IEEE 802.1Q insert a small header field in the Ethernet frame that contains the VLAN ID and some control information. Cisco ISL uses encapsulation to include VLAN information. When a tagged frame arrives at the other end of the trunk, the receiving device reads the VLAN information and forwards the frame only to ports that belong to that VLAN. This allows many VLANs to be multiplexed over one physical connection while preserving logical separation. Step-by-Step Solution: 1. Identify that the question is specifically about VLANs and trunk links. 2. Recall that trunk ports must be able to distinguish which VLAN each frame belongs to as they carry traffic for multiple VLANs simultaneously. 3. Understand that frame tagging is the process of adding VLAN related information into each frame. 4. Recognize that IEEE 802.1Q does this by inserting a VLAN tag into the Ethernet frame header, while other methods like ISL encapsulate the frame. 5. Conclude that frame tagging is about inserting VLAN identification information so that multiple VLANs can share a trunk link. Verification / Alternative check: To verify, you can look at packet captures on trunk links. Tools such as Wireshark display a VLAN tag field when capturing frames on an 802.1Q trunk. This field shows the VLAN ID and confirms that each frame carries explicit VLAN information. Access ports, by contrast, do not use tagging and send frames without VLAN headers to end hosts. This difference between tagged trunk traffic and untagged access traffic demonstrates that frame tagging is specifically a trunk link concept for multiplexing VLANs. Why Other Options Are Wrong: Option a: Adding a sequence number to frames is related to higher layer protocols or specialized mechanisms, not typical VLAN frame tagging. Option b: Priority bits for Quality of Service may be present in the same 802.1Q header, but frame tagging in this context is primarily about VLAN identification, not just QoS marking. Option d: Encryption is a security feature handled by other technologies and is not the definition of frame tagging in VLAN scenarios. Option e: Checksums already exist in Ethernet frames as the Frame Check Sequence, but that is for error detection and not specific to VLAN frame tagging. Common Pitfalls: A common error is to confuse VLAN tagging with general header fields such as checksums or sequence numbers. Another pitfall is thinking that tagging happens on all ports, when in fact only trunk ports tag frames for VLAN identification. Access ports send and receive untagged frames for a single VLAN. Also, some learners mix up QoS marking with VLAN tagging because both use bits in the header, but they serve different purposes. Always remember that the central idea of frame tagging in this context is to carry VLAN identification across shared links. Final Answer: Frame tagging is inserting VLAN identification information into Ethernet frames so that multiple VLANs can share a single trunk link while remaining logically separate.

Question 12

Which Cisco VLAN tagging method uses an external encapsulation header around the original Ethernet frame so that multiple VLANs can be multiplexed over a trunk link, rather than inserting a tag inside the existing Ethernet header as IEEE 802.1Q does?

Accepted Answer

Introduction / Context: Cisco networks historically supported two major methods for carrying VLAN information across trunk links: IEEE 802.1Q and the Cisco proprietary Inter Switch Link (ISL). Both approaches allow multiple VLANs to share a single physical link, but they handle tagging differently. IEEE 802.1Q inserts a VLAN tag inside the existing Ethernet header, while ISL encapsulates the original Ethernet frame inside a new header. This question asks you to identify which Cisco method uses external encapsulation for VLAN tagging. Given Data / Assumptions: Multiple VLANs must be transported over a trunk link between Cisco devices. Some methods insert tags within the frame header, others use encapsulation around the frame. The focus is on the Cisco proprietary method that encapsulates the original frame. Technologies unrelated to VLAN trunking, such as MPLS, are also listed as distractors. Concept / Approach: ISL is a Cisco proprietary VLAN trunking protocol that wraps the entire original Ethernet frame with a new ISL header and trailer. This is called external encapsulation because the VLAN information is added outside the existing frame. IEEE 802.1Q, by contrast, modifies the Ethernet header by inserting a VLAN tag field inside it. MPLS works at a different layer and uses labels to forward packets through label switched paths, not for standard layer 2 VLAN trunking. VTP is a management protocol for distributing VLAN information between switches, not a trunk encapsulation method. Understanding these distinctions allows you to correctly identify ISL as the external encapsulation method. Step-by-Step Solution: 1. Recall that Cisco supported both ISL and IEEE 802.1Q for VLAN trunking on some platforms. 2. Remember that IEEE 802.1Q inserts a tag inside the Ethernet frame header, modifying the frame but not fully encapsulating it. 3. Recognize that ISL takes the whole original frame and encapsulates it with an additional header and trailer that carry VLAN ID and other information. 4. Consider the wording external encapsulation method in the question, which corresponds directly to the ISL approach. 5. Eliminate options that refer to technologies not used for basic VLAN trunk encapsulation on Ethernet links. Verification / Alternative check: Cisco documentation describes ISL as encapsulating frames with a 26 byte header and a 4 byte trailer, which include VLAN ID and integrity information. Packet captures on old platforms that still support ISL show the original Ethernet frame fully intact inside an ISL header. In contrast, 802.1Q adds a 4 byte tag between the source MAC address and the EtherType field in the existing header. This confirms that ISL uses external encapsulation, matching the description in the question. Why Other Options Are Wrong: Option a: IEEE 802.1Q tagging inserts a VLAN tag inside the Ethernet frame header; it does not encapsulate the frame externally. Option c: MPLS label switching uses labels to forward packets in a service provider environment and operates differently from simple layer 2 VLAN trunking on Ethernet links. Option d: Token Ring source route bridging is an older technology that is not used for Ethernet VLAN trunk encapsulation. Option e: VTP operates as a control protocol to distribute VLAN information between switches, but it does not define how frames are tagged or encapsulated on trunks. Common Pitfalls: Learners sometimes assume that any VLAN mechanism involving Cisco must refer to 802.1Q, since ISL is less common on modern equipment. Another frequent confusion is between VTP and trunking methods. VTP manages VLAN definitions but does not carry user data frames itself. On exams, paying attention to keywords such as external encapsulation versus header insertion will help you distinguish ISL from 802.1Q. Even though ISL is legacy on many platforms, understanding its characteristics remains useful for historical and exam oriented knowledge. Final Answer: The Cisco tagging method that uses external encapsulation to multiplex VLANs over a trunk is ISL (Inter Switch Link) encapsulation.

Question 13

In Cisco IOS, which of the following commands is a correct example of a standard IP access list statement used to match specific IPv4 traffic?

Accepted Answer

Introduction / Context: Access control lists, often called ACLs, are a core topic in Cisco certification exams and real world router configurations. Standard IP access lists use only source IPv4 addresses and wildcard masks and are identified by specific number ranges or names. This question asks you to recognise a correctly formed standard access list command among several similar but incorrect examples. Given Data / Assumptions: We are working with numbered Cisco IOS standard IP access lists. Standard lists use numbers from 1 to 99 and 1300 to 1999. Standard lists match only source IP addresses with an optional wildcard mask, not protocols or ports. The syntax must follow the Cisco IOS format: access-list list-number {permit|deny} source wildcard-mask. Concept / Approach: To identify a valid standard ACL line, you need to check three things. First, confirm that the list number is in the standard ACL range. Second, ensure that the syntax matches the simple source plus wildcard form, without protocol or port information that would make it an extended ACL. Third, verify that spacing and keywords are correct and that no extra words such as the word standard appear in the command where they do not belong. Step-by-Step Solution: Look at option a: access-list 110 uses list number 110, which is in the extended ACL range, not the standard range, so this is not a standard ACL. Option b uses access-list 1, which is in the standard range, and the format deny 172.16.10.1 0.0.0.0 is valid, because a wildcard mask of 0.0.0.0 matches exactly that single host address. Option c also uses list 1 but combines 172.16.10.1 with 255.255.0.0, which looks like a subnet mask rather than a wildcard mask; a correct wildcard for a big block would look like 0.0.255.255 instead. Option d uses access-list standard 1 1.1.1.1, which is not valid IOS syntax because the keyword standard is not used this way in numbered ACLs. Option e uses list number 101, which again falls into the extended ACL range and is not a standard ACL example. Verification / Alternative check: Cisco documentation shows examples such as access-list 1 permit 10.0.0.0 0.255.255.255 and access-list 1 deny host 172.16.10.1 or access-list 1 deny 172.16.10.1 0.0.0.0. All of these follow the pattern list number in the standard range, followed by permit or deny, source address and wildcard mask. Comparing these examples with the options confirms that option b matches the expected form of a standard ACL entry. Why Other Options Are Wrong: Option a uses list number 110, which belongs to extended ACLs and would normally include protocol and possibly ports. It is not a standard ACL. Option c uses a value that looks like a subnet mask, not a wildcard mask, and therefore does not reflect a correct standard ACL example for basic exam style questions. Option d introduces the keyword standard in the wrong place, making the syntax invalid. Option e uses list number 101, which is an extended ACL and would not be classified as a standard ACL. Common Pitfalls: Learners sometimes mix up wildcard masks with subnet masks or assume that any access-list command is standard regardless of its number. Another common mistake is forgetting that standard ACLs only match source addresses and never include transport layer ports or destination addresses. Remember that the list number and the presence or absence of protocol information are strong clues about whether an ACL is standard or extended. Final Answer: The correct example of a standard IP access list is access-list 1 deny 172.16.10.1 0.0.0.0.

Question 14

You must create a standard IP access list that denies all hosts in the IPv4 range 192.168.160.0 through 192.168.191.255. Which wildcard mask and command combination correctly matches this network range?

Accepted Answer

Introduction / Context: Standard IP access lists on Cisco IOS rely on wildcard masks to match ranges of IPv4 addresses. In this question you must deny a very specific contiguous block of addresses from 192.168.160.0 up to 192.168.191.255. To choose the correct command, you must translate this range into a network address and wildcard mask that exactly cover this block and nothing more. Given Data / Assumptions: The required blocked range is 192.168.160.0 to 192.168.191.255 inclusive. We are using a standard numbered access list with list number 10. Standard ACLs use wildcard masks, where 0 means match exactly and 1 bits indicate do not care positions. The ACL line must correctly cover this /19 range without including addresses outside it. Concept / Approach: The range 192.168.160.0 to 192.168.191.255 is a block of 32 contiguous class C style networks. The third octet runs from 160 to 191. A block of size 32 in the third octet corresponds to a prefix length of /19, which has a subnet mask of 255.255.224.0 and a wildcard mask of 0.0.31.255. In Cisco ACLs, you write the network address followed by the wildcard mask, so the correct entry should use 192.168.160.0 with wildcard 0.0.31.255. Step-by-Step Solution: Compute the size of the range in the third octet: 191 minus 160 plus one gives 32 values, so the block size is 32. A block size of 32 in one octet corresponds to 2^5, which means 5 host bits and therefore a prefix of 32 minus 5 equals 27 if this were a host portion, but here we are aggregating subnet level networks. For this address, the correct prefix that covers 160 through 191 is /19. The subnet mask for a /19 network is 255.255.224.0. The corresponding wildcard mask is the inverse: 0.0.31.255. In Cisco standard ACL syntax, you specify the network address and wildcard mask, so the correct line is access-list 10 deny 192.168.160.0 0.0.31.255. Check that this wildcard exactly covers all addresses from 192.168.160.0 through 192.168.191.255 and does not extend into 192.168.192.0 or below 192.168.160.0. Verification / Alternative check: You can verify the wildcard by adding it to the base address: 192.168.160.0 plus 0.0.31.255 gives 192.168.191.255 as the upper bound. Because wildcard bits mark positions where any value is allowed, this range matches all addresses whose third octet is in the range 160 to 191 and whose fourth octet runs from 0 to 255. That is exactly the intended block. Why Other Options Are Wrong: Option a uses 255.255.224.0, which is a subnet mask, not a wildcard. ACLs require wildcard masks, so this syntax is wrong in this context. Option b uses wildcard 0.0.191.255, which would cover a much larger range than 160 through 191 in the third octet and is not tied to a clean power of two block. Option d starts from 192.168.0.0, so it includes hosts that should not be denied, such as 192.168.0.1, making it incorrect for the specified range only. Option e uses an extended ACL number and protocol but the question specifically frames this as a standard ACL example and focuses on the network range, so it is not the best match for the exam objective. Common Pitfalls: Many students confuse subnet masks and wildcard masks or try to use the subnet mask directly in ACL statements. Another common mistake is miscalculating the wildcard so that it covers too many or too few addresses. Remember that wildcards are simply the bitwise inverse of the subnet mask and that block sizes are powers of two. Practising these conversions will make ACL design much easier. Final Answer: The correct command is access-list 10 deny 192.168.160.0 0.0.31.255, which uses the proper wildcard mask to block 192.168.160.0 through 192.168.191.255.

Question 15

On a Cisco router, which command allows you to verify whether an IP access list has been applied to a particular interface and in which direction it is active?

Accepted Answer

Introduction / Context: After you create an access control list on a Cisco router, you must apply it to an interface in either the inbound or outbound direction for it to take effect. Troubleshooting connectivity often requires you to confirm whether a particular access list is actually active on an interface and which direction it is filtering. Cisco IOS offers several show commands that display ACL information, and you must know which one gives you interface level attachment details. Given Data / Assumptions: An IP access list has been defined on the router configuration. You want to know if this access list is applied to a specific interface. You also want to see whether the ACL is applied inbound, outbound or not at all. You are working with standard Cisco IOS commands. Concept / Approach: The show access-lists command displays the contents of access lists and any hit counters but does not tell you which interfaces they are bound to. The show running-config command reveals configuration lines but can be long and harder to parse quickly. The show ip interface command, when run for a specific interface or for all interfaces, includes a section that explicitly states whether an inbound or outbound access list is set. Therefore show ip interface is the best tool to answer the question of whether an ACL is enabled on a particular interface. Step-by-Step Solution: Consider the requirements: you want to confirm that an ACL is enabled on a particular interface and see the direction of application. The show access-lists command will show the rules in each list and hit counts, but it does not list bound interfaces. The show ip interface command provides detailed status for each interface, including lines like Inbound access list is 101 or Outbound access list is not set. By running show ip interface or show ip interface serial0 or show ip interface fastethernet0/0, you can see exactly which ACL, if any, is attached to that interface. Therefore, among the options, show ip interface is the correct command for determining whether an IP access list is enabled on a particular interface. Verification / Alternative check: In lab environments, you can configure an ACL and apply it with ip access-group 101 in under an interface, then use show ip interface to check the result. The output will clearly mention the list number for inbound and outbound directions. This direct evidence confirms that show ip interface is the intended verification command rather than show access-lists. Why Other Options Are Wrong: Option a, show ip port, is not a standard Cisco IOS command and does not relate to ACLs. Option b, show access-lists, displays the definitions of ACLs and counters but not where they are applied. Option d, show access-lists interface, is not a valid IOS show command in classic router syntax. Option e, show running-config access-list, is also not a standard command; you would instead use show running-config and visually search, but that is not the concise interface focused answer expected. Common Pitfalls: A typical mistake is to rely only on show access-lists and assume that if a list exists it must be in use. This can lead to confusion when traffic does not pass as expected. Always remember that ACLs are inactive until applied to an interface or vty line. Learning to quickly read show ip interface output saves a lot of troubleshooting time. Final Answer: The correct command is show ip interface, which displays whether an IP access list is enabled on a specific interface and in which direction.

Question 16

If you want to deny all Telnet connections destined for the IPv4 network 192.168.10.0/24 while allowing other traffic, which extended access list command would you use on a Cisco router?

Accepted Answer

Introduction / Context: Extended IP access lists on Cisco routers allow you to filter traffic based on protocol, source address, destination address and even specific port numbers. Telnet uses TCP port 23, and a common requirement is to block Telnet access to a particular subnet for security reasons while still allowing other protocols. This question asks you to identify the correct extended ACL line that will deny all Telnet connections to the 192.168.10.0 slash 24 network. Given Data / Assumptions: The target network to protect is 192.168.10.0 with subnet mask 255.255.255.0, so the wildcard mask is 0.0.0.255. You want to deny Telnet, which uses TCP port 23, destined to that network from any source. You are using an extended ACL number in the 100 to 199 range, such as 100. Syntax must include protocol, source, destination and port information correctly. Concept / Approach: For this requirement the ACL line must specify protocol tcp, a source of any, a destination of 192.168.10.0 0.0.0.255 and the destination port equal to 23. The keyword eq 23 or eq telnet can be used. The ACL number 100 places the list in the extended range. Standard ACLs would not be adequate here because they match only source addresses and cannot inspect ports or destination addresses. Step-by-Step Solution: Determine the protocol: Telnet uses TCP, so the ACL line must begin with access-list 100 deny tcp. Define the source: because you want to deny Telnet from any host, the source part should be any. Define the destination: the network 192.168.10.0 with mask 255.255.255.0 uses wildcard 0.0.0.255, so the destination field should be 192.168.10.0 0.0.0.255. Specify the destination port: Telnet uses port 23, so the end of the line should read eq 23 or eq telnet. Putting these pieces together gives access-list 100 deny tcp any 192.168.10.0 0.0.0.255 eq 23, which matches option c. Verification / Alternative check: In a lab, you could configure this ACL, apply it inbound on the interface that leads toward 192.168.10.0 slash 24 and test. Telnet sessions to any host in that subnet would fail, while other traffic such as ping or HTTP could still succeed if permitted by subsequent ACL entries. This confirms that the syntax correctly targets only Telnet traffic. Why Other Options Are Wrong: Option a uses 192.168.10.0 255.255.255.0, which looks like a subnet mask, not a wildcard mask, and also omits a source field, so it is not valid extended ACL syntax. Option b uses an invalid wildcard 0.255.255.255, which would match an overly broad and incorrect range of addresses. Option d omits the protocol keyword tcp and reverses the order of source and destination, which is not correct for Cisco IOS ACLs. Option e uses access-list 10, which is in the standard ACL range, and would be interpreted as a standard access list that cannot match ports or destination addresses in the extended way required. Common Pitfalls: Students often forget that ACL syntax always lists source before destination, or they mistakenly use subnet masks instead of wildcard masks. Another common error is placing the ACL in the standard range when they need extended capabilities. Practising the correct order of parameters and remembering that wildcards are inverse masks will help avoid these issues. Final Answer: The correct extended ACL line is access-list 100 deny tcp any 192.168.10.0 0.0.0.255 eq 23.

Question 17

On a Cisco router interface, which command is used in interface configuration mode to apply an IP access list numbered 101 in the inbound direction?

Accepted Answer

Introduction / Context: Defining an access control list is only the first step in controlling traffic on a Cisco router. To have any effect, the ACL must be applied to an interface in a specific direction. Cisco IOS uses the ip access-group command in interface configuration mode to bind a numbered or named IP ACL to that interface. This question checks your familiarity with the exact command syntax used to apply a list. Given Data / Assumptions: ACL number 101 has already been created in the global configuration. You are in interface configuration mode, such as interface fastethernet0 slash 0. You want to apply this ACL to filter incoming packets on that interface. The command must be valid Cisco IOS syntax for IP ACL application. Concept / Approach: In Cisco IOS, the ip access-group command is used under an interface to apply an IP ACL. The format is ip access-group list-number in or ip access-group list-number out. The keyword in means the ACL will evaluate packets as they enter the interface, while out means as they exit. Other similar looking phrases, such as ip access-list or access-group ip, are used in different contexts or are simply invalid. Step-by-Step Solution: Recognise that the context is interface configuration mode, not global ACL definition mode. Recall the correct IOS syntax: ip access-group followed by the ACL number and direction. Because the requirement is to filter traffic inbound, the command must end with in. The correct pattern is therefore ip access-group 101 in. Compare this with the options and see that option c exactly matches the correct syntax. Verification / Alternative check: If you configure ip access-group 101 in on an interface and then run show ip interface for that interface, you will see a line such as Inbound access list is 101, confirming that the command correctly attached the ACL. Removing the command with no ip access-group 101 in will clear that binding, which further validates the command usage. Why Other Options Are Wrong: Option a, ip access-list 101 out, resembles the global configuration mode used to create a named ACL and also uses out instead of the required in; it is not the correct interface subcommand. Option b, access-list ip 101 in, reverses the keyword order and is not a valid Cisco IOS command. Option d, access-group ip 101 in, again misorders the keywords and does not match supported syntax. Option e, ip access-group 101 outbound, invents the word outbound instead of the valid keyword out and is not accepted by IOS. Common Pitfalls: A common mistake is to confuse ip access-list, which starts the definition of a named ACL, with ip access-group, which applies a list to an interface. Another pitfall is forgetting to specify the correct direction, leading to an ACL that appears configured but does not actually filter the traffic path you expect. Always double check whether you need in or out based on traffic flow diagrams. Final Answer: To apply ACL 101 inbound on an interface, you use ip access-group 101 in.

Question 18

From a security perspective, which type of attack is most commonly associated with overwhelming a network or service so that legitimate users cannot access it?

Accepted Answer

Introduction / Context: Modern networks face many different types of attacks, ranging from physical tampering to sophisticated application exploits. One of the most widely discussed and frequently seen attack categories is the Denial of Service, often abbreviated as DoS. These attacks aim specifically to disrupt availability, one of the three core pillars of information security alongside confidentiality and integrity. This question asks you to identify that category among a set of options. Given Data / Assumptions: We are interested in an attack that targets network or service availability rather than physical locks or configuration wizards. The attack typically overwhelms bandwidth, CPU, memory or application resources. The context is generic network security as taught in Cisco and similar networking courses. Only one option correctly describes this common attack category. Concept / Approach: A Denial of Service attack is any deliberate action that prevents legitimate users from accessing a network service. This can be accomplished by flooding a link with traffic, exhausting server resources with bogus requests or abusing protocol weaknesses. Distributed Denial of Service, or DDoS, is a powerful form that uses many compromised machines to amplify the impact. While other options mention configuration features or unrelated concepts, DoS is the one that directly matches the description of a network being overwhelmed and made unavailable. Step-by-Step Solution: Review option a, lock picking, which is a physical security threat but not a network traffic based attack and therefore not the common network attack described here. Option b, Naggle, seems to refer loosely to the Nagle algorithm, a TCP optimisation, and is not itself an attack type. Option c explicitly states DoS, Denial of Service, which is well known as an attack where attackers flood a target to make it unavailable. Option d, auto secure, is actually a Cisco feature that helps harden a router, not an attack. Option e, social engineering, is a serious security risk but is more about tricking people than about directly overwhelming network services; the question emphasises the network attack that is most common today, which usually refers to DoS style flooding. Verification / Alternative check: Security reports and vendor advisories routinely describe Denial of Service and Distributed Denial of Service incidents affecting large websites, Internet service providers and even critical infrastructure. These attacks are prominent because they can be launched remotely, often using botnets of infected devices. This broad, repeated presence in security news supports the claim that DoS attacks remain one of the most common network threats. Why Other Options Are Wrong: Option a focuses on physical lock picking, which is a physical intrusion method, not a network attack performed over IP. Option b does not correspond to a widely recognised attack type and appears to be a distractor using a misspelled protocol feature name. Option d, auto secure, is a Cisco configuration wizard that helps protect against attacks, so it is actually defensive rather than offensive. Option e, while important in social engineering and phishing contexts, does not specifically match the description of overwhelming network resources to cause loss of availability. Common Pitfalls: Some learners may over focus on glamorous attacks such as advanced malware or password cracking and underestimate how disruptive simpler flooding attacks can be. It is also easy to confuse features like auto secure or Nagle with attack names when reading quickly. Always link the phrase Denial of Service directly with the idea of overwhelming a target to make it unavailable. Final Answer: The most common network attack described is a DoS (Denial of Service) attack, which attempts to overwhelm services so that legitimate users can't access them.

Question 19

Which Cisco IOS extended access list command will correctly stop host 172.16.10.1 from initiating Telnet sessions to host 172.16.30.5 while leaving other traffic between these hosts unaffected?

Accepted Answer

Introduction / Context: Extended access lists on Cisco routers allow precise control over which conversations are permitted or denied by matching protocol, source, destination and port. In this scenario, the goal is to block only Telnet traffic from one specific internal host to another, without affecting other protocols such as ping or HTTP between the same addresses. This level of granularity is exactly what extended ACLs are designed to provide. Given Data / Assumptions: Source host to block: 172.16.10.1. Destination host to protect: 172.16.30.5. Protocol to deny: Telnet, which uses TCP port 23. You are creating an extended ACL, so the list number should be in the 100 to 199 range, for example 101. Concept / Approach: An extended ACL entry that achieves this should specify tcp, the source as host 172.16.10.1, the destination as host 172.16.30.5 and a destination port of 23 or keyword telnet. The host keyword is a clean way to indicate a single IP address without writing a wildcard mask. Other traffic between these hosts should be allowed by subsequent permit statements, so this deny entry should target only the Telnet protocol. Step-by-Step Solution: Start with the extended ACL number and action: access-list 101 deny. Specify the protocol as tcp because Telnet runs over TCP. Use host 172.16.10.1 to match exactly the sending host. Use host 172.16.30.5 to match exactly the receiving host. Finish with eq 23 to match only Telnet traffic rather than all TCP ports. Putting these together yields access-list 101 deny tcp host 172.16.10.1 host 172.16.30.5 eq 23, which is option a. Verification / Alternative check: If you configure this ACL and apply it appropriately on a router interface in the path, Telnet sessions from 172.16.10.1 to 172.16.30.5 should fail, while pings and web access between the same hosts can succeed, assuming other permits are present. This behaviour shows that only the Telnet port is being filtered, confirming that the ACL line is properly specific. Why Other Options Are Wrong: Option b uses ip instead of tcp for the protocol but then incorrectly appends eq 23. Access lists using ip as the protocol do not specify ports, so this syntax is invalid and would not selectively block Telnet. Common Pitfalls: Option c uses list number 1, which corresponds to a standard ACL that should not include port information, and its syntax attempts to combine wildcards and ports in a way that does not match IOS conventions. Option d blocks Telnet from any source to host 172.16.30.5, which is broader than required and would also block Telnet from other hosts that should perhaps be permitted. Option e actually permits Telnet between the two hosts, which is the opposite of the stated requirement. Common Pitfalls: It is easy to mix up the order of source and destination fields or to forget to narrow the rule using host or proper wildcard masks. Another frequent error is to use a standard ACL for tasks that clearly require protocol and port awareness, which only extended ACLs can provide. Remember that port numbers are only valid in ACL entries when you specify a transport layer protocol like tcp or udp. Final Answer: The correct command is access-list 101 deny tcp host 172.16.10.1 host 172.16.30.5 eq 23, which blocks only Telnet between those two hosts.

Question 20

On a Cisco router, which line configuration command is used on VTY lines to apply an IP access list that controls which remote hosts are allowed to establish Telnet or SSH sessions?

Accepted Answer

Introduction / Context: Virtual terminal lines, or VTY lines, on Cisco routers and switches are used for remote management connections such as Telnet and SSH. To harden access to these lines, administrators often apply access lists that restrict which source IP addresses are allowed to open remote sessions. This is done with a different command than the one used on physical interfaces, and recognising that difference is important for both exams and real configurations. Given Data / Assumptions: You want to control who can Telnet or SSH into the router via VTY lines. You have already created a standard or extended IP access list with number 50 that matches permitted or denied source addresses. You are configuring the VTY lines, for example with line vty 0 4. You need the specific command that tells the VTY lines to use that ACL for inbound management traffic. Concept / Approach: On VTY lines, the command access-class is used, not ip access-group. The syntax is access-class list-number in or access-class list-number out. In this context, in refers to connections coming into the VTY lines from remote hosts. Using access-class 50 in under line vty 0 4 applies ACL 50 so that only matching sources are permitted or denied according to the ACL entries. Step-by-Step Solution: Remember that physical interfaces use ip access-group, but VTY lines use access-class. You must first enter line configuration mode with a command such as line vty 0 4. Within that mode, the correct command pattern is access-class 50 in, where 50 is the number of the ACL you created earlier. This command tells the router to apply the ACL to all incoming management connections attempting to use those VTY lines. Comparing with the options, option a matches exactly the required syntax, so it is the correct answer. Verification / Alternative check: After configuring line vty 0 4 and applying access-class 50 in, you can view the running configuration to see the binding. You can also test by attempting to connect from an allowed address and a denied address according to ACL 50. The allowed host should be able to Telnet or SSH, while the denied host should receive a refusal or time out. This functional test confirms that access-class is doing its job. Why Other Options Are Wrong: Option b, ip access-group 50 in, is correct for applying ACLs to data plane traffic on physical or logical interfaces, but it is not a valid command under line vty configuration and will not be accepted there. Option c, line vty 0 4 access-class 50, merges two different configuration mode commands into one line and is not valid IOS syntax. Option d, access-list 50 vty in, uses the wrong keyword order and does not exist as a valid command. Option e, transport input access-list 50, confuses protocol selection (transport input ssh telnet) with ACL application; there is no transport input access-list subcommand. Common Pitfalls: It is common to mistakenly use ip access-group on VTY lines because it is so familiar from interface configuration. Another mistake is to forget that access-class operates in the context of management connections only; it does not filter normal routed traffic. Distinguishing these two use cases will help you design secure and correct router configurations. Final Answer: To apply an ACL on VTY lines, you use access-class 50 in under the line vty configuration.

CISCO Certification Questions