CCNA Practice Test

Answer: D
When OSPF priorities are tied, the router with the highest router ID (derived from a configured loopback, or the highest active IP address if none is set) is elected DR. Process ID is locally significant and not used in DR election, boot order alone doesn't decide the election outcome once priorities tie, and interface count plays no role.

Answer: D
Dynamic routing protocols such as OSPF or EIGRP exchange periodic or triggered updates, which consumes CPU and bandwidth, but they automatically reconverge after topology changes; static routes require manual reconfiguration and carry no such overhead — this matches choice D. Choice A is wrong because static routes have no convergence mechanism at all; they remain in the routing table unless manually removed or their next hop becomes unreachable, and they do not run anything resembling OSPF's SPF recalculation. Choice C is wrong because static routes do carry a default administrative distance of 1, not 0 (0 is reserved for directly connected routes), and administrators can also manually set a different distance. Choice B is wrong because dynamic routing protocols are specifically designed to scale across multi-router topologies with redundant paths, not restricted to single-router networks.

Answer: A
When two routing sources offer a route to the same destination, the router installs the one with the lowest administrative distance, and a static route's default AD of 1 beats OSPF's default AD of 110, so the static route is installed — this matches choice A. Choice B is wrong because being a link-state protocol has no bearing on route selection here; administrative distance, not the underlying routing algorithm, decides which source wins. Choice C is wrong because a router does not load-balance across routes from different sources with different administrative distances to the same prefix; only the lowest-AD route is installed. Choice D is wrong because both listed routes are valid non-connected sources to 10.0.0.0/24, so the router does not fall back to using only directly connected routes.

Answer: C
A /22 mask (255.255.252.0) groups the third octet into blocks of 4, and 172.16.5.10 falls in the block 172.16.4.0-172.16.7.255, so 172.16.7.50 is within the same subnet and reachable without routing — this matches choice C. Choice A is wrong because 172.16.5.0-172.16.5.255 is the range for a /24 mask, narrower than the configured /22, and would incorrectly exclude 172.16.7.50 from the local subnet. Choice B is wrong because 172.16.0.0-172.16.255.255 is the range for a /16 mask, far broader than /22, and would incorrectly treat unrelated /22 blocks as local. Choice D is wrong because 172.16.4.0-172.16.4.255 is only a single /24-sized slice of the actual /22 block, so it incorrectly excludes addresses like 172.16.5.10 and 172.16.7.50 that legitimately fall within the same /22 subnet.

Answer: D
EIGRP's DUAL algorithm computes a successor and feasible successor for each route, giving it a loop-free backup path and fast convergence, and it sends only partial, triggered updates rather than RIP-style periodic full broadcasts — this matches choice D. Choice A is wrong because flooding a full link-state database to every router, using a designated router, describes OSPF's behavior on multi-access segments, not EIGRP, which is a distance-vector protocol with no link-state database. Choice B is wrong because EIGRP uses a composite metric based on bandwidth and delay by default, not RIP's simple hop count, and RIP's 15-hop limit does not apply to EIGRP. Choice C is wrong because EIGRP does perform automatic neighbor discovery through periodic hello packets (every 5 seconds on LAN/high-speed links), so manual per-route neighbor configuration is not required.

Answer: A
Routers apply the longest prefix match rule, selecting the most specific matching route in the table regardless of administrative distance or metric, so the more specific /24 route to 192.168.1.0 is chosen over the /0 default route — this matches choice A. Choice B is wrong because administrative distance is only compared when multiple sources offer routes to the exact same prefix; it does not override longest prefix match between routes of different lengths. Choice C is wrong because equal-cost load balancing only occurs between multiple routes of the same prefix length and equal metric, not between a /0 and a /24 route. Choice D is wrong because there is no ambiguity or loop here — the router simply installs and uses the single most specific matching route.

Answer: C
Router-on-a-stick describes a single physical router interface divided into VLAN-tagged subinterfaces to route between VLANs over one trunk link to a switch. Switched virtual interfaces (SVIs) are a different approach used on Layer 3 switches, proxy ARP is unrelated to VLAN routing, and HSRP provides gateway redundancy, not inter-VLAN routing itself.

Answer: D
IP Connectivity is weighted 25%, the highest among the six official domains, covering routing concepts, OSPF, and related topics, making it the domain deserving the greatest study emphasis. Security Fundamentals (15%), Network Access (20%), and Automation and Programmability (10%) are all weighted lower and should receive proportionally less study time.

Answer: C
On a multi-access broadcast segment, OSPF routers that are neither the DR nor BDR (DROthers) intentionally stop at two-way with each other and form full adjacency only with the DR and BDR, which limits the number of adjacencies and the associated LSA flooding — this matches choice C. Choice A is wrong because a hello/dead timer mismatch prevents the neighbor relationship from forming at all, since the routers never agree to become neighbors, rather than allowing it to reach and then stall at two-way. Choice B is wrong because an area ID mismatch, like mismatched hello/dead timers, blocks neighbor formation entirely at the Init/ExStart stage rather than stalling adjacency at two-way. Choice D is wrong because an authentication failure similarly prevents hello packets from being accepted at all, so no neighbor relationship, not even two-way, would form.

Answer: D
OSPF DR election first compares interface priority, default 1, highest wins, uses the router ID to break a tie, and excludes any router configured with priority 0 from ever becoming DR or BDR; the election is also non-preemptive, so a later-configured higher priority does not displace an existing DR without an adjacency reset — this matches choice D. Choice A is wrong because it reverses the process by ignoring priority, when priority is actually compared first and only used as a tiebreaker if priorities match. Choice B is wrong because the number of interfaces a router has in the area plays no role in DR election, which is evaluated per segment based on priority and router ID. Choice C is wrong because DR election is not based on boot or adjacency-reestablishment order; a router that reloads does not automatically win or lose DR status based on timing alone.

Answer: A
Administrative distance ranks the trustworthiness of a route's source and is compared before any metric; a static route's default distance of 1 beats OSPF's default distance of 110, so the static route is installed even though OSPF is also advertising the same prefix — this matches choice A. Choice B is wrong because being dynamically maintained does not automatically confer preference; OSPF's higher administrative distance of 110 makes it less trusted than the static route here, not more. Choice C is wrong because load balancing across routes to the same prefix only happens between routes from the same source with equal metric, not between a static route and an OSPF route with different administrative distances. Choice D is wrong because a conflict in administrative distance doesn't cause routes to be withdrawn; it simply determines which single route is installed.

Answer: C
The routing table shows what the device will actually forward, and testing from a host in the affected subnet validates the entire end-to-end path rather than just one device's local view. A is wrong because counters not incrementing only shows a lack of traffic, not whether the destination is actually reachable. B is wrong because a clean configuration file does not guarantee the resulting routing table or forwarding path is correct. D is wrong because an unchanged uptime only confirms no reload occurred; it says nothing about whether the change broke reachability.

Answer: D
A first hop redundancy protocol gives clients one static virtual IP address that the active router answers, so failover only requires the standby router to assume that same virtual address and its virtual MAC. A is wrong because reconfiguring every client's gateway address at failover is exactly what a virtual IP is designed to avoid. B is wrong because clients hold a single configured gateway address; they do not alternate between two physical addresses. C is wrong because the broadcast address is reserved for the subnet as a whole and cannot serve as a usable default gateway.

Answer: C
The governing rule is that a next hop lying outside the connected subnets makes the route recursive: the router looks up the destination, finds 192.0.2.77, then performs an additional lookup for how to reach that address itself, resolving down to an exit interface. A is wrong because summarization is a separate concept about combining prefixes for advertisement; nothing here advertises 192.0.2.77 and the destination as one route. B is wrong because no encapsulation is implied by a recursive next hop; the router simply performs an extra table lookup, it does not build a GRE tunnel. D is wrong because static routes do not carry or check an administrative distance on the next-hop address itself, and such routes are accepted as long as the next hop resolves.

Answer: A
A /27 mask leaves 5 host bits (2^5-2=30 usable hosts), exactly meeting the requirement with minimal waste. A /28 gives only 14 usable hosts (too few), while /26 and /25 provide far more addresses per subnet than needed, wasting IP space.

Answer: A
A /30 subnet has only four addresses, where 10.203.113.4 is the network address and 10.203.113.7 is the broadcast address, leaving .5 and .6 as the two usable interface addresses, making D correct. B is wrong because it includes .7, the broadcast address, which cannot be assigned to an interface. C is wrong because it includes both the network address .4 and the broadcast address .7. D is wrong because it includes the network address .4, which identifies the subnet rather than a host.

Answer: B
Multiple access points sharing one SSID over a common distribution system form an extended service set, which is what lets clients roam without reassociating to a new network name. An independent basic service set is an ad hoc, AP-free topology, mesh describes APs relaying traffic wirelessly rather than through wired LAN, and a wireless bridge joins two wired segments rather than serving roaming clients.

Answer: C
A switch builds a MAC address table and forwards frames only out the necessary port, so each switch port is its own dedicated collision domain; a hub is a Layer 1 repeater that floods every bit out every port, so all hub ports share one collision domain — this matches choice C. Choice A reverses the roles: it is the hub, not the switch, that shares a single collision domain. Choice B is wrong because although an unconfigured switch does share one broadcast domain across its ports until VLANs are added, it still gives each port its own collision domain, unlike a hub. Choice D wrongly extends full-duplex operation — which does eliminate collisions when both ends support it — to hubs, but hubs are half-duplex shared-medium devices that cannot negotiate full-duplex and so never eliminate their collision domain.

Answer: D
When the DF bit is set and the packet exceeds the outgoing interface's MTU, RFC 791 requires the router to discard the packet rather than fragment it, and it typically returns an ICMP type 3 code 4 'fragmentation needed' message so the sender can perform Path MTU Discovery — this matches choice D. Choice A is wrong because the DF bit explicitly forbids fragmentation; a router honoring DF never fragments despite it. Choice B is wrong because jumbo frames are a Layer 2 Ethernet MTU setting configured on interfaces, and switches do not fragment or reformat IP packets based on a Layer 3 DF bit. Choice C is wrong because a compliant router does not silently forward an oversized packet when DF is set — that would defeat the DF bit's entire purpose.

Answer: C
Layer 4 (Transport) handles end-to-end connection establishment, flow control, and reliability via protocols like TCP; Layer 2 handles framing on a single link, Layer 3 handles logical addressing and routing, and Layer 7 handles application-specific services, none of which manage session-level connection state.

Answer: B
Addresses in the fe80::/10 range are link-local, automatically assigned to every IPv6 interface and used only for on-link functions such as neighbor discovery and next-hop routing, never routed beyond the local segment — this matches choice B. Choice A is wrong because global unicast addresses come from the 2000::/3 range, not fe80::/10, and fe80 addresses are never forwarded onto the internet. Choice C is wrong because IPv6 multicast addresses come from the ff00::/8 range (all-routers is ff02::2), not the fe80 link-local range. Choice D is wrong because unique local addresses use the fc00::/7 range for private site routing, a distinct prefix from fe80::/10, and neither ULA nor link-local addresses are meant for WAN routing.

Answer: A
Cisco uses Pearson VUE as its authorized delivery partner, offering the CCNA 200-301 both at physical Pearson VUE test centers and remotely through the OnVUE online-proctored option, which uses a live remote proctor — this matches choice A. Choice B is wrong because OnVUE remote testing is explicitly offered as an alternative to the physical test center, contrary to the claim that it is never available online. Choice C is wrong because both delivery methods require proctoring, a human proctor on-site or a live remote proctor via OnVUE; the exam is never self-graded or unproctored. Choice D is wrong because Cisco does not operate its own separate testing platform for this exam; Pearson VUE is the delivery provider in both formats.

Answer: B
Pearson VUE's published OnVUE requirement is a minimum of 6 Mbps download and 2 Mbps upload speed, needed to reliably support the live video proctoring and screen-sharing used throughout the remote exam session — this matches choice B. Choice A is wrong because 1 Mbps download and 1 Mbps upload falls well below the published minimum and risks connection drops during the proctored session. Choice C is wrong because 25 Mbps download and 10 Mbps upload substantially overstates the actual published minimum; while faster service works fine, it is not the required floor. Choice D is wrong because OnVUE does publish a specific minimum bandwidth requirement rather than leaving it undefined; a merely stable connection below the minimum can still fail the pre-exam system check.

Answer: C
The CCNA certification is valid for 3 years from the date it is earned, after which the holder must recertify by passing a current qualifying exam or meeting Cisco's continuing education requirements to maintain active status — this matches choice C. Choice D is wrong because 1 year is far shorter than Cisco's published validity period and does not match any current Cisco certification tier. Choice B is wrong because 2 years is also shorter than the actual 3-year validity window Cisco assigns to the CCNA. Choice A is wrong because 5 years overstates the validity period; that duration is not used for the CCNA under Cisco's certification policy.

Answer: D
Addresses beginning FE80 fall in the fe80::/10 link-local range, autoconfigured on every interface and used only for communication on the directly attached link. A is wrong because global unicast addresses begin with 2000 through 3FFF, not FE80. B is wrong because multicast addresses begin with FF, not FE80. C is wrong because unique local addresses begin with FC00 or FD00, not FE80.

Answer: D
A high count of CRC errors means frames are arriving with checksums that do not match their contents, which points to a physical layer problem such as a damaged cable, bad connector, faulty transceiver, or electrical interference. A is wrong because a routing misconfiguration like a mismatched OSPF area ID prevents an adjacency from forming rather than corrupting frames in transit. B is wrong because an access list denies matching traffic outright; it does not produce checksum failures. C is wrong because insufficient bandwidth shows up as output drops once a queue fills, not as corrupted, failed-checksum frames.

Answer: A
Collisions should never occur on a full-duplex link, so late collisions mean the peer is actually operating half duplex and applying collision detection, a classic duplex mismatch. B is wrong because a cable that is long but still within the 100 meter specification does not generate collisions on a full-duplex link. C is wrong because a VLAN misconfiguration changes which broadcast domain a port belongs to; it does not produce collision counters. D is wrong because a stale routing table entry affects Layer 3 forwarding, not Layer 2 collision detection on a single link.

Answer: B
A layer 2 discovery protocol like CDP or LLDP reports each neighboring device's identity, platform, and the exact port connecting the two sides, which is exactly what validating a diagram against reality requires. A is wrong because the routing table only lists reachable Layer 3 networks and next hops, not which device is physically attached to each port. C is wrong because the MAC address table lists addresses learned per port, including ones reached through intermediate switches, without identifying the neighboring device. D is wrong because the DHCP binding table lists leased addresses and client MACs, unrelated to physical neighbor topology.

Answer: C
The four-layer TCP/IP model folds the OSI application, presentation, and session layers into a single application layer, so formatting, encryption, and dialog management all live there, making C correct. A is wrong because the internet layer only maps to OSI Layer 3, handling addressing and routing. B is wrong because the network access layer covers OSI Layers 1 and 2, the physical and data link functions. D is wrong because the transport layer maps to OSI Layer 4, providing segmentation and delivery, not presentation or session services.

Answer: D
Adding a sequence number and destination port is a transport layer function, and the transport layer's protocol data unit is called a segment, making B correct. A is wrong because a packet is formed one layer down, when the network layer adds the IP header. B is wrong because a frame is formed at the data link layer, when MAC addressing and a trailer are added. C is wrong because a bit stream is the physical layer's representation of data on the wire, two layers below the transport layer.

Answer: B
A successful ping proves Layers 1 through 3 work, and a completed three-way handshake proves the transport layer works end to end, so an HTTP 500 response, a server-side application error, places the fault at the application layer, making C correct. A is wrong because the network layer is already proven functional by the successful ping. C is wrong because a data link layer fault would prevent the ping itself from succeeding. D is wrong because the transport layer is proven functional by the completed three-way handshake in the capture.

Answer: C
Comparing a packet's destination IPv4 address against the routing table to choose an exit interface is a network layer function, making D correct. A is wrong because the data link layer is only rewritten hop by hop with a new header; it does not choose the exit interface. B is wrong because the physical layer only transmits bits onto the medium and plays no role in the forwarding decision. D is wrong because the session layer manages dialogs between end applications, not a router's packet forwarding.

Answer: A
Each basic service set is identified by a BSSID, a MAC-format value tied to the AP radio for that SSID, and clients use it to address frames within the cell. The ESSID is simply the extended network name shared by multiple APs, the distribution system is the wired backbone connecting APs rather than an identifier in frames, and MIB handles belong to SNMP management, not 802.11 addressing.

Answer: D
A switch floods a unicast frame out every port in the VLAN except the ingress port only when it has no MAC address table entry for the destination, so the frame still reaches its owner and the switch learns the address from the reply, making A correct. A is wrong because a frame failing its FCS check is discarded outright, not flooded. B is wrong because spanning tree blocking ports would prevent flooding out those ports, not cause flooding elsewhere. C is wrong because a Layer 2 forwarding decision never examines the destination IP address.

Answer: A
Successful ARP replies prove Layers 1 through 3 are healthy between the two hosts, so a TCP connection being reset immediately points to something actively refusing the connection at the transport layer, most often a host-based firewall rejecting the destination port, making D correct. B is wrong because a wrong MAC address learned at Layer 2 would prevent frames from reaching the host at all. C is wrong because late collisions or cabling faults would also disrupt the working ARP exchange described. D is wrong because a subnet mask error would prevent the hosts from attempting direct delivery in the first place.

Answer: B
Fiber carries light instead of electrical signals, so it is immune to the plant's electromagnetic interference and comfortably spans 320 meters, well within multimode fiber's typical reach, making A correct. A is wrong because Category 6 copper is limited to 100 meters per segment and remains susceptible to strong interference. C is wrong because shielded twisted-pair copper is still capped at the same 100 meter Ethernet segment limit despite its shielding. D is wrong because coaxial cable is neither a standard modern Ethernet LAN medium nor rated for 320 meters in this design.

Answer: C
Rising CRC and input errors with zero output errors mean inbound frames are arriving corrupted, which points to physical-path damage such as a bad cable, connector, or failing transceiver, making D correct. A is wrong because an MTU mismatch produces giant or oversized-frame drops, not checksum failures. B is wrong because a hard speed mismatch usually prevents the link from coming up at all. D is wrong because a duplex mismatch typically shows up as late collisions and transmission deferrals, not pure CRC growth with zero output errors.

Answer: D
In IEEE Ethernet shorthand the leading number is the speed in megabits and the T suffix means twisted-pair copper, so 1000BASE-T is gigabit Ethernet over four pairs of copper with the standard 100 meter reach, making B correct. A is wrong because single-mode fiber reaching 5 kilometers describes 1000BASE-LX. B is wrong because 100 megabit Ethernet over two pairs of copper describes 100BASE-TX, not 1000BASE-T. C is wrong because 10 gigabit Ethernet over short-reach multimode fiber describes 10GBASE-SR, a different speed and medium.

Answer: A
An interface showing up/down means the port detects a usable physical signal, but the data link protocol itself is not operating, pointing to a Layer 2 problem such as a keepalive or encapsulation mismatch, making B correct. B is wrong because an administrative shutdown reports as administratively down, not up/down. C is wrong because a cable unplugged at the far end would show down/down, since the physical layer itself would not detect a signal. D is wrong because failed interface hardware would typically also report the physical layer as down, not up.

Answer: B
Newer access points requiring 802.3at or 802.3bt power levels will fail to boot on a switch port that only supplies the lower 802.3af wattage budget, even with a cable that tests clean, making D correct. A is wrong because trunk configuration on a switch port has no relationship to whether PoE is delivered. C is wrong because PoE passes through standard structured cabling and patch panels without issue. D is wrong because modern switch and AP ports negotiate pair usage automatically via auto-MDIX, so a crossover cable is not required.

Answer: C
A /26 leaves 6 host bits, giving 2 to the sixth power minus 2, or 62 usable addresses, in the block 172.16.4.0 through 172.16.4.63, making .63 the broadcast address, so B is correct. A is wrong because 64 counts the raw addresses without subtracting the network and broadcast addresses. B is wrong because 30 usable hosts with broadcast .31 describes a /27, not a /26. D is wrong because 126 usable hosts with broadcast .127 describes a /25, not a /26.

Answer: D
A 255.255.240.0 mask is a /20, so the third octet increments in blocks of 16, placing 172.31.99.201 in the network 172.31.96.0 through 172.31.111.255, making A correct. A is wrong because it treats the mask as a /24, which would only apply if the mask were 255.255.255.0. B is wrong because 172.31.96.0 through 172.31.103.255 spans only 8 addresses in the third octet, which describes a /21. C is wrong because 172.31.64.0 through 172.31.127.255 spans 64 addresses in the third octet, which describes a /18.

Answer: A
Nine host bits yield 510 usable addresses, the smallest power-of-two block that covers 500 devices, and nine host bits corresponds to a /23, making B correct. B is wrong because a /24 supplies only 254 usable addresses, too few for 500 devices. C is wrong because a /25 supplies only 126 usable addresses, far below the requirement. D is wrong because a /22 supplies 1022 usable addresses, roughly double what is needed, wasting more space than a /23.

Answer: D
A /21 spans eight consecutive third-octet values, so 10.10.32.0/21 covers 10.10.32.0 through 10.10.39.255, making the usable host range .32.1 through .39.254, so B is correct. A is wrong because extending to .47.254 treats the network as a /20, doubling the actual block size. B is wrong because stopping at .32.254 treats the network as a /24, far smaller than the actual /21. C is wrong because starting at .33.1 misplaces the block's first usable address by one.

Answer: B
With a /28 mask the block size is 16, so subnets begin at .64 and .80; the host at .66 falls in 10.44.17.64/28 while .81 falls in 10.44.17.80/28, and traffic between different subnets always needs a Layer 3 device regardless of a shared switch, making D correct. A is wrong because the hosts are not actually in the same subnet. C is wrong because the broadcast addresses for these two /28 blocks are .79 and .95, not .66 or .81. D is wrong because hosts within the same /28 communicate directly without a router.

Answer: C
Moving from /25 to /27 borrows two bits, creating exactly four subnets at 203.0.113.0, .32, .64, and .96, each leaving five host bits for 30 usable addresses, making D correct. A is wrong because any prefix divides cleanly into a longer prefix; boundary alignment is never a problem. B is wrong because eight subnets would require borrowing three bits, not two. D is wrong because 62 usable addresses per subnet describes a /26, not a /27.

Answer: A
The four /16 networks 10.4 through 10.7 form one contiguous block that exactly matches 10.4.0.0/14, since a /14 covers four consecutive /16s starting on a multiple of four, making C correct. B is wrong because a single /16 covers only 10.4.0.0/16, just one of the four branches. C is wrong because 10.0.0.0/13 would pull in 10.0.0.0 through 10.7.255.255, overreaching beyond the four branches. D is wrong because a /15 only covers 10.4.0.0 and 10.5.0.0, missing the 10.6 and 10.7 branches entirely.

Answer: B
The subnet 192.168.7.160/27 runs from .160 through .191, so .191 is its directed broadcast address and cannot be assigned to any host, including a printer, making A correct. A is wrong because assigning a device the broadcast address breaks IP delivery regardless of whether that device ignores broadcast traffic. C is wrong because the network address of this /27 block is .160, not .191. D is wrong because the broadcast address depends entirely on the subnet mask, not on whether the last octet is 255.

Answer: C
With a /21 mask the block containing 172.19.200.77 runs from 172.19.200.0 through 172.19.207.255, and the gateway 172.19.196.1 falls in the previous /21 block, so the host can never ARP for a gateway outside its own subnet, making C correct. A is wrong because the gateway and host are actually in different /21 blocks, so the root cause is logical, not a duplex mismatch. B is wrong because 255.255.248.0 is a perfectly legal contiguous /21 mask. D is wrong because nothing reserves .77 in a /21 network; the reserved addresses in this block are .200.0 and .207.255.

Answer: D
Leading zeros drop from every hextet and the double colon may replace only one run of consecutive zero hextets, so 2001:0db8:0000:0000:00a9:0000:0000:0930 compresses to 2001:db8::a9:0:0:930, making C correct. A is wrong because it compresses the wrong zero run; with two equal-length runs, convention compresses the first one. B is wrong because using two double colons in one address is illegal, since the expansion becomes ambiguous. C is wrong because 0930 must be written as 930, not truncated to 93, since only leading zeros may be dropped.

Answer: A
Addresses in fe80::/10 are link-local, autoconfigured on every IPv6 interface and valid only for communication on the directly attached link, since routers never forward them, making A correct. B is wrong because unique local addresses come from fc00::/7, not fe80::/10. C is wrong because global unicast addresses begin in the 2000::/3 range, not fe80. D is wrong because the all-routers multicast group is ff02::2, an entirely different address family from link-local fe80 addresses.

Answer: B
With SLAAC, the host learns the 64-bit network prefix from a router advertisement and generates its own interface identifier, typically using EUI-64 or a randomized value, making C correct. A is wrong because a host never derives its address by copying and incrementing the router's own address. C is wrong because DNS servers resolve names and play no role in assigning addresses. D is wrong because broadcasting a DHCPDISCOVER and waiting for a full address is how DHCPv4 works, not SLAAC, which does not require a stateful DHCPv6 exchange.

Answer: C
Before activating a tentative address, a host sends a neighbor solicitation targeted at its own address as duplicate address detection; if any node answers, the address is already in use and must not be activated, making D correct. A is wrong because prefix delegation is a separate DHCPv6-PD exchange initiated toward a delegating router. B is wrong because routers build their neighbor table from ordinary traffic they observe, not from a registration message. D is wrong because switches learn MAC addresses from the source address of frames, not from a targeted neighbor solicitation.

Answer: D
Unique local addresses from fc00::/7 are the IPv6 counterpart of private addressing: routable inside an organization, never routed on the public internet, and built with a random 40-bit global ID that makes collisions unlikely if labs later merge, making B correct. A is wrong because multicast addresses from ff00::/8 identify groups of receivers, not individually addressable lab hosts. B is wrong because link-local addresses from fe80::/10 cannot cross even a single router. C is wrong because global unicast addresses from 2000::/3 are publicly routable, the opposite of what an internal-only lab requires.

Answer: A
The well-known multicast group ff02::1 reaches every IPv6 node on the local link and ff02::2 reaches every router on the link, filling the role IPv4 broadcasts once played, making D correct. B is wrong because the loopback and unspecified addresses are ::1 and ::, not ff02::1 and ff02::2. C is wrong because the solicited-node group takes the form ff02::1:ffxx:xxxx and DHCPv6 servers use ff02::1:2. D is wrong because anycast addresses are assigned from ordinary unicast address space, not from the ff02:: multicast range.

Answer: B
Real-time audio favors UDP precisely because it sends datagrams with no handshake, no acknowledgment waiting, and no retransmission stalls, keeping latency low while tolerating small losses. TCP's ordering and reliability introduce delay that damages live streams, UDP performs no retransmission at all, and window scaling improves TCP throughput but cannot remove retransmission-induced latency.

Answer: C
The middle step of the three-way handshake is a SYN-ACK: the server proposes its own initial sequence number and acknowledges the client's by adding one, hence 4821. A bare ACK is the client's third step, FIN begins connection teardown rather than setup, and RST would abort the attempt instead of continuing it.

Answer: D
Stratum counts distance from the reference clock: the internet source at stratum 1 makes the core router stratum 2, and the switches syncing from the router become stratum 3. Stratum is never inherited unchanged, stratum 0 designates the reference clocks themselves rather than network devices, and 15 is merely the edge of validity rather than a default assignment.

Answer: A
Only version 3 offers user-based security, and its authPriv level provides both authentication and privacy through encryption, satisfying the mandate. Community strings in v2c travel in cleartext no matter their complexity, ACL restrictions on v1 limit sources but never encrypt, and informs are acknowledged notifications that inherit v2c's plaintext weakness.

Answer: C
At the T1 timer, roughly 50% of the lease duration, the client sends a unicast DHCPREQUEST directly to the original server to renew the lease before it expires — this matches choice C. Choice A is wrong because no renewal attempt happens immediately upon receiving the lease; the client simply uses the address and waits until T1 is reached before attempting renewal. Choice B is wrong because the client does not wait for full expiration before attempting renewal; if T1's unicast attempt fails, it still tries again via broadcast at T2, about 87.5%, before the lease actually expires. Choice D is wrong because 100% of the lease duration is when the lease has already expired and the client must restart the full DHCP discovery process, not the point of the first renewal attempt.

Answer: C
PAT (NAT overload) maps every internal host's session to the single public IP address but assigns each session a unique source port, and the router tracks the resulting IP-address-and-port combination in its translation table to correctly demultiplex returning traffic — this matches choice C. Choice A is wrong because MAC addresses are Layer 2 information and are not carried inside the IP header at all, so a router cannot use them for this purpose. Choice B is wrong because PAT's entire purpose is to let many hosts share one public IP; rotating through an address pool describes dynamic NAT, not overload/PAT. Choice D is wrong because the NAT translation table is built from IP addresses and port numbers, not hostnames, and DNS plays no role in the translation lookup.

Answer: A
NTP synchronizes device clocks to a common, often hierarchical (stratum-based) time source, ensuring consistent, correlatable timestamps across switch and router logs — this matches choice A. Choice B is wrong because SNMP (using UDP ports 161 for polling and 162 for traps) is a monitoring and management protocol, not a clock-synchronization protocol. Choice C is wrong because CDP is Cisco's proprietary neighbor-discovery protocol, sending hellos every 60 seconds to learn about directly connected devices, and has nothing to do with time synchronization. Choice D is wrong because TFTP (UDP port 69) is a simple file-transfer protocol used for tasks like backing up configurations or IOS images, not for synchronizing clocks.

Answer: B
HSRP and similar FHRPs present a shared virtual IP and virtual MAC (HSRP's is 0000.0c07.acXX) as the default gateway; if the active router fails, a standby router takes over that virtual address so hosts keep using the same gateway without reconfiguration — this matches choice B. Choice A is wrong because FHRPs operate at Layer 3 gateway redundancy and have no role in DNS resolution or caching. Choice C is wrong because VLAN tagging is configured on trunk ports via 802.1Q, unrelated to FHRP virtual addressing or bridge priority, which is an STP concept, not HSRP. Choice D is wrong because FHRPs do not compress or otherwise alter broadcast traffic; they only provide a redundant virtual gateway address.

Answer: C
Port address translation, also called NAT overload, distinguishes simultaneous sessions from many internal hosts by assigning each a unique source port while they all share one public outside address, tracked in the router's translation table — this matches choice C. Choice B is wrong because static NAT creates a fixed one-to-one mapping typically used to publish a single internal server at a permanent public address, not to let many hosts share one address. Choice D is wrong because dynamic NAT maps inside addresses to a pool of outside addresses one-to-one without port multiplexing, so it runs out of translations once the pool is exhausted rather than letting many hosts share a single address indefinitely. Choice A is wrong because proxy ARP answers ARP requests on behalf of a host on a different segment so that host appears locally reachable; it has nothing to do with translating many inside addresses to one outside address.

Answer: B
DHCP discovery is sent as a broadcast that routers do not forward by default, so the ip helper-address command converts it to a unicast destined for the configured DHCP server and inserts the receiving interface's address, the gateway information giaddr, so the server can select the correct scope — this matches choice B. Choice A is wrong because a static route only tells the router how to reach the server's subnet; it does nothing to convert or forward the original broadcast discovery packet, which the router would otherwise drop. Choice C is wrong because permitting DHCP traffic in an access list only stops the router from blocking it; it does not perform the broadcast-to-unicast relay function needed to cross the router boundary. Choice D is wrong because adding a secondary IP address changes what subnet the interface itself belongs to; it does not relay broadcasts to a remote DHCP server.

Answer: D
Correlating events across multiple devices requires both a syslog destination to collect messages and NTP synchronization so every device's timestamps agree. A is wrong because each device timestamping independently from its own unsynchronized clock is exactly the problem that breaks correlated analysis. B is wrong because SNMP community strings and an access list configure polling and traffic filtering, not logging or time synchronization. C is wrong because a DHCP pool and default route configure address leasing and routing, unrelated to syslog delivery or timestamping.

Answer: A
SNMPv3 should be selected because it adds authentication and encryption, while versions 1 and 2c send their community strings in clear text, exposing read-write access to anyone capturing the traffic. B is wrong because wide legacy support does not offset version 1 transmitting its community string unencrypted. C is wrong because version 2c only added bulk retrieval and improved error handling over version 1; it never added encryption. D is wrong because confining SNMP to a management VLAN does not eliminate the risk of a compromised host on that same VLAN capturing clear-text credentials.

Answer: B
Voice needs a strictly prioritized, low-latency queue with policing, because buffering only converts packet loss into delay that further damages a live call, and voice gains nothing from being held. A is wrong because a large output buffer increases queuing delay instead of avoiding it, the opposite of what voice needs. C is wrong because best-effort, fair-queued treatment gives voice no priority over bulk data and does not bound its delay or jitter. D is wrong because shaping that delays voice until bulk transfers finish introduces exactly the latency voice cannot tolerate.

Answer: D
An EtherChannel bundles the physical links into one logical interface, so spanning tree sees and treats the bundle as a single port with no member individually blocked, making the full aggregate bandwidth available — this matches choice D. Choice A is wrong because PortFast is meant for access ports connecting end hosts, skipping the listening/learning delay; it does not bundle multiple links into one logical interface or prevent STP from blocking a redundant link. Choice C is wrong because putting each link in a separate VLAN does not stop spanning tree from blocking a redundant path within a VLAN, and it does not create one logical link. Choice B is wrong because BPDU guard err-disables a port that unexpectedly receives a BPDU, typically to protect against a rogue switch; it would disable one of the redundant links rather than bundle them into an active logical interface.

Answer: C
An access port is configured for a single untagged VLAN and does not process 802.1Q tags, so a tagged frame arriving on it does not match the expected format and is discarded — this matches choice C. Choice A is wrong because forwarding a tagged frame into its tagged VLAN is trunk-port behavior, not how an access port handles an unexpected tag. Choice B is wrong because switches do not strip and re-tag frames to silently correct a VLAN mismatch on an access port; the frame is simply dropped. Choice D is wrong because unknown-unicast flooding applies to frames with an unrecognized destination MAC within a single VLAN, not to malformed tagged frames received on an access port.

Answer: D
PAgP is a Cisco-proprietary protocol for negotiating EtherChannel bundles, whereas LACP (IEEE 802.3ad) is the open standard supported across vendors. STP prevents loops and is unrelated to channel negotiation, and VTP synchronizes VLAN databases, also unrelated to link aggregation negotiation.

Answer: B
In Rapid PVST+, a port that receives a superior BPDU but loses the election for root or designated port becomes an alternate port and sits in the discarding state, providing a loop-free standby path without forwarding traffic — this matches choice B. Choice A is wrong because a root port reaches the forwarding state once the topology is stable, but this port is explicitly not the root port, so labeling it 'Root port, Forwarding' misassigns its role. Choice D is wrong because designated ports also forward once stable, and Learning is only a brief transitional state on the way to forwarding, not the steady blocking state described here. Choice C is wrong because a backup port is a role that arises on a shared-media segment where a switch has two connections to the same collision domain, a different scenario from this one, and backup ports also sit in discarding, not forwarding.

Answer: B
A wireless LAN controller centrally manages a fleet of lightweight access points over CAPWAP, pushing configuration, coordinating RF optimization, and handling client roaming across the APs — this matches choice B. Choice A is wrong because an autonomous access point manages its own configuration and RF settings independently and has no relationship to a controller, the opposite of centralized management. Choice C is wrong because a Layer 2 switch acting as an STP root bridge only manages spanning tree topology; it has no CAPWAP relationship with access points and performs no RF or roaming functions. Choice D is wrong because a DHCP relay agent only forwards DHCP broadcasts to a remote server; it plays no role in AP configuration, RF management, or roaming.

Answer: C
A native VLAN mismatch means untagged frames sent from one switch's native VLAN are received and interpreted as belonging to the other switch's different native VLAN, so traffic can leak between the two VLANs; Cisco switches detect this via CDP and typically log a warning, and STP can also flag it — this matches choice C. Choice A is wrong because the trunk link itself typically stays up and continues passing tagged VLAN traffic normally; only the native, untagged VLAN is affected. Choice B is wrong because voice VLAN is a separate, explicitly configured VLAN and is not automatically the native VLAN, so the mismatch is not limited to voice traffic. Choice D is wrong because DTP negotiates trunking encapsulation and mode (access/trunk), not the native VLAN number, so it cannot resolve a native VLAN mismatch.

Answer: B
The roughly thirty-second delay comes from spanning tree's listening (15 seconds) and learning (15 seconds) states before a port reaches forwarding; PortFast skips straight to forwarding for ports where a switch, and therefore a loop, cannot appear, and is normally paired with BPDU guard so the port err-disables if a switch is connected anyway — this matches choice B. Choice A is wrong because globally disabling spanning tree removes loop protection network-wide, a dangerous approach that risks broadcast storms, not a targeted fix for one access port. Choice C is wrong because configuring a port as a trunk changes its VLAN tagging behavior, not the STP forward-delay timers, and trunk ports still go through the normal STP states. Choice D is wrong because the forward-delay timers, 15 seconds each by default, are fixed STP values independent of interface speed; raising the link speed does not shorten them.

Answer: D
Native VLAN frames cross an 802.1Q trunk untagged while every other VLAN is tagged, so if the two ends configure different native VLANs, each side treats the peer's untagged traffic as belonging to its own native VLAN, silently merging two VLANs into one broadcast domain. A is wrong because only the native VLAN skips tagging; every other VLAN is tagged. B is wrong because native VLAN traffic is still forwarded across the trunk untagged, not dropped or pruned. C is wrong because there is no automatic second physical link for native VLAN traffic; DTP only negotiates trunking mode, not a parallel path for one VLAN.

Answer: A
VLANs are separate broadcast domains and separate IP subnets, so moving traffic between VLAN 10 and VLAN 20 requires a Layer 3 device, a router subinterface or a multilayer switch SVI, to route between them. B is wrong because a trunk only carries multiple VLANs' tagged frames between switches; it never routes traffic from one VLAN into another. C is wrong because placing both VLANs on one switch chassis does not remove the Layer 2 boundary between them. D is wrong because Rapid PVST+ only prevents Layer 2 loops within a VLAN's own topology and has no role in inter-VLAN forwarding.

Answer: B
Lightweight access points tunnel both control messages and client data to the wireless LAN controller over CAPWAP, which is what lets the controller centrally manage configuration and forward traffic. A is wrong because SNMP only polls interface counters and status for network management, not client traffic. C is wrong because RADIUS carries authentication exchanges between the controller and an identity server, a separate exchange from the AP-to-controller tunnel. D is wrong because NTP only synchronizes clocks and plays no role in carrying control or data traffic.

Answer: D
When a VLAN is deleted while ports still reference it, those ports do not fail over to VLAN 1 or any other VLAN; they go inactive and pass no traffic until the VLAN is recreated or the ports are reassigned, which matches exactly what happened on Gi0/10 through Gi0/20. The claim that deletion resets ports to VLAN 1 is wrong because access ports keep referencing the deleted VLAN ID instead of falling back to a default. The claim that the change erased port-channel configuration is wrong because the VLAN database and EtherChannel bundling are independent configuration areas. The claim that the ports negotiated into trunks is wrong because removing a VLAN does not trigger DTP renegotiation or any mode change on the interface.

Answer: C
Extended ACLs (numbered 100-199 or 2000-2699) can filter on source and destination IP address, protocol, and port number, making them the correct tool to permit only HTTPS (TCP 443) to a specific destination while denying everything else — this matches choice C. Choice A is wrong because standard ACLs (numbered 1-99) match only the source address and cannot filter by destination or port, and the 100-199 range it cites actually belongs to extended ACLs, not standard ones. Choice B is wrong because port security restricts which MAC addresses may transmit on a switchport; it does not filter IP traffic by address or port. Choice D is wrong because DHCP snooping guards against rogue DHCP servers by trusting or distrusting ports, which has no bearing on filtering general traffic to a web server.

Answer: A
DHCP snooping marks ports as trusted or untrusted, allowing DHCP server responses (OFFER/ACK) only from trusted ports, and it builds a binding table of IP-to-MAC-to-port mappings used by related features like Dynamic ARP Inspection, preventing rogue or unauthorized DHCP servers from handing out malicious configurations — this matches choice A. Choice B is wrong because DHCP snooping does not encrypt any traffic; it is a filtering and tracking feature, not a cryptographic one, and switches have no such onboard AES engine for DHCP. Choice C is wrong because DHCP snooping does not assign IP addresses at all, static or otherwise; it monitors and filters existing DHCP exchanges. Choice D is wrong because DHCP snooping has no load-balancing function; distributing requests across servers is unrelated to its trust/binding-table purpose.

Answer: C
Port security lets administrators define which MAC addresses are allowed on a port and specify a violation action; the shutdown mode err-disables the port entirely when an unauthorized MAC is detected — this matches choice C. Choice A is wrong because 802.1Q trunking configures VLAN tagging across a trunk link and has nothing to do with restricting which MAC addresses may use a port. Choice D is wrong because root guard protects the placement of the STP root bridge by blocking superior BPDUs on a port, not restricting MAC addresses. Choice B is wrong because BPDU filtering suppresses BPDU transmission and processing on a port, which is unrelated to authorizing specific MAC addresses.

Answer: C
In the AAA framework, authentication confirms a user's or device's identity, typically via credentials verified against a server such as RADIUS or TACACS+, while authorization determines the specific resources, commands, or privileges granted to that already-authenticated identity — this matches choice C. Choice B is wrong because authentication and authorization are distinct, sequential steps with different purposes, not the same process repeated for redundancy. Choice A is wrong because it swaps the definitions: authentication, not authorization, verifies identity, and authorization, not authentication, governs permitted actions, regardless of whether RADIUS or TACACS+ is used. Choice D is wrong because both authentication and authorization apply broadly across wired and wireless access, since 802.1X is used on both, not split exclusively between the two media.

Answer: C
A VPN, commonly built with IPsec, creates an encrypted tunnel over the public internet so remote users can securely reach internal network resources as though they were locally connected — this matches choice C. Choice A is wrong because VLAN trunking extends VLANs between switches on the same administratively controlled network over a trunk link; it is not designed to secure traffic over the public internet for remote employees. Choice B is wrong because Spanning Tree Protocol prevents Layer 2 loops within a switched network and plays no role in remote-access security. Choice D is wrong because CDP simply discovers directly connected Cisco devices on a local segment and is not routable or usable across the internet for remote access.

Answer: A
WEP relies on a static, easily-cracked RC4 key scheme with well-documented cryptographic weaknesses, including reused initialization vectors, making it insecure by modern standards — this matches choice A. Choice B is wrong because WPA3-Enterprise, especially with the 192-bit CNSA suite, is the current strongest Wi-Fi security standard and provides forward secrecy, the opposite of WEP's broken design. Choice D is wrong because WPA2-AES (CCMP) uses a 128-bit AES-based cipher that has no known practical break, unlike WEP's RC4 scheme. Choice C is wrong because WPA2 with 802.1X derives a unique dynamic key per session through EAP authentication, avoiding the static-key weakness that makes WEP insecure.

Answer: B
A /22 subnet mask is 255.255.252.0, and an ACL wildcard mask is the bitwise inverse of a subnet mask, giving 0.0.3.255 for a /22 — this matches choice B. Choice A is wrong because 0.0.255.255 is the wildcard mask for a /16 network, a much broader range than the /22 in the question. Choice C is wrong because 255.255.252.0 is the subnet mask itself, not its inverse; using a subnet mask directly in an access-list wildcard field is one of the most common configuration mistakes and matches the opposite of every bit that should be ignored. Choice D is wrong because 0.0.0.255 is the wildcard mask for a /24 network, which is more specific than the /22 range the ACL needs to match.

Answer: C
A standard ACL can match only the source address, so applying it near the source would deny that source's traffic to every destination rather than just the intended one; placing it close to the destination instead ensures only traffic actually headed to the protected destination is filtered — this matches choice C. Choice A is wrong because placing a filter close to the source to discard traffic early is the correct placement rule for extended ACLs, which can match destination too, not standard ACLs. Choice B is wrong because Cisco does not require standard ACLs to be duplicated on every router in the path; a single, correctly placed ACL is sufficient and duplicating it elsewhere is unnecessary and error-prone. Choice D is wrong because placement absolutely matters for a standard ACL; filtering by source address only produces very different results depending on how close to the source or destination it is applied.

Answer: D
Every Cisco access list ends with an invisible deny any statement, so traffic that does not match any of the configured permit entries falls through to that implicit deny and is dropped — this matches choice D. Choice A is wrong because the interface itself does not default to denying traffic before the list is evaluated; it is specifically the list's own implicit deny at the end that causes the drop. Choice B is wrong because applying a list in the wrong direction, in vs. out, would cause it to filter the wrong traffic entirely, not explain why unmatched traffic is dropped. Choice C describes a real ACL ordering pitfall, a broad statement shadowing one below it, but that requires an existing explicit deny to be shadowed, whereas this question states no deny statement was configured at all, so the drop is caused by the implicit deny, not statement ordering.

Answer: C
The default port security violation mode is shutdown, which err-disables the port entirely, stopping all traffic rather than just the offending frames, until it is manually re-enabled or recovers via the errdisable recovery timer; protect silently discards unauthorized frames without logging, and restrict discards them while also logging and counting the violation — this matches choice C. Choice A is wrong because it describes the protect mode's actual behavior, not the default shutdown mode. Choice B is wrong because it describes the restrict mode's actual behavior, logging and counting violations while continuing to forward known traffic, which is not the default either. Choice D is wrong because port security's default, and every standard violation mode, blocks the unauthorized address rather than permitting it to keep forwarding; there is no permit-and-log violation mode.

Answer: C
WPA2-Enterprise authenticates every user individually through 802.1X against a RADIUS server, so each client gets unique session keys and credentials can be revoked per user, unlike WPA2-Personal's single shared pre-shared key. A is wrong because lengthening the pre-shared key still leaves every device sharing one identical secret, the exact weakness Enterprise mode eliminates. B is wrong because Enterprise mode still encrypts traffic with AES-CCMP; it adds 802.1X authentication rather than replacing encryption. D is wrong because client capacity is a function of the access point's hardware and channel, not of the authentication mode configured.

Answer: A
Protecting vty lines means restricting which source addresses may connect with an access class, requiring encrypted SSH instead of clear-text Telnet, and timing out idle sessions automatically. B is wrong because leaving every line open with no access class maximizes exposure instead of reducing it. C is wrong because a shared account destroys individual attribution, making it impossible to tell which administrator performed an action. D is wrong because disabling session and command logging removes the record needed to investigate a session, rather than protecting it.

Answer: B
Centralized AAA provides authentication of identity, authorization of the specific commands a user may run, and accounting that records what was executed, all tied to one identity. A is wrong because handling authorization and accounting only locally on each device means permissions and activity logs do not follow the user centrally. C is wrong because accounting alone provides no centralized authentication or command-level authorization. D is wrong because AAA governs who can log in and what they can do, not encryption of traffic through the device.

Answer: C
DHCP snooping mitigates a rogue DHCP server by permitting DHCP server responses only on trusted ports, so a rogue server on an untrusted access port cannot hand out addresses or a malicious default gateway. A is wrong because a MAC table overflow flood is a CAM table exhaustion attack unrelated to which port a DHCP OFFER arrives on. B is wrong because physical access to a wiring closet is a facilities security concern, not something a Layer 2 snooping feature can control. D is wrong because password guessing targets the switch's own management credentials, a different attack from a rogue address-assignment server.

Answer: D
Declarative tools, such as Ansible playbooks that describe a desired end state, let the automation engine determine and idempotently apply the steps needed to reach and maintain that state, unlike imperative scripts which require explicitly ordered commands — this matches choice D. Choice C is wrong because specifying every individual command is the defining trait of an imperative approach, the opposite of declarative. Choice A is wrong because declarative automation tools like Ansible, Puppet, and Terraform are multi-vendor and are not limited to Cisco hardware or a specific IOS-XE release. Choice B is wrong because declarative configuration files are commonly and reliably stored in version control systems like Git, and idempotent tools produce the same result on repeated runs rather than changing output each time.

Answer: A
RESTCONF and NETCONF expose structured, model-driven (YANG-based) data that can be reliably queried and modified programmatically without fragile text parsing, making them the modern standard for network automation. Screen-scraping CLI output is fragile and error-prone, manual Telnet sessions aren't automatable and Telnet itself is insecure, and SNMP traps are event notifications, not a mechanism for making configuration changes.

Answer: C
Infrastructure as Code treats network and infrastructure definitions as versioned, text-based artifacts (e.g., YAML or JSON) that drive automated configuration generation and deployment, enabling repeatability and change tracking. Port mirroring copies traffic for monitoring, PortFast speeds up STP transition on access ports, and static NAT maps a fixed IP translation—none relate to representing infrastructure as version-controlled code.

Answer: B
YAML's clean, indentation-based syntax makes it highly readable for humans while remaining machine-parsable, which is why tools like Ansible use it extensively for playbooks and variable files. Binary ASN.1 is a compact encoding used in protocols like SNMP (not human-friendly), MRT is a binary format for routing table dumps, and 802.1Q tagging is a Layer 2 frame format unrelated to automation data serialization.

Answer: A
JSON represents data as key-value pairs organized into nested objects in braces and arrays in brackets, a structure that maps directly onto native data types in most scripting languages, which is why REST APIs favor it. B is wrong because fixed-width, positional fields describe legacy formats like COBOL copybooks, not JSON's self-describing structure. C is wrong because tag-delimited markup requiring a schema like DTD or XSD describes XML, a different serialization format. D is wrong because JSON is plain text, not a binary format requiring a vendor-specific decoder like Protocol Buffers.

Answer: B
Declarative tools accept a description of the desired end state and calculate the steps needed to converge the device on it, which makes reapplying the same description idempotent. A is wrong because imperative configuration requires the administrator to specify each exact command and its order manually, rather than the tool determining the steps. C is wrong because typing commands directly into the CLI is manual configuration, with no tool determining convergence steps. D is wrong because reactive configuration only runs after an external trigger like an SNMP trap or syslog alert, not as a description of a target state.

Answer: C
The northbound interface exposes the SDN controller's capabilities to applications and orchestration systems, typically as a REST API, so business systems can request outcomes without knowing device syntax. A is wrong because carrying configuration down to devices via NETCONF or OpenFlow describes the southbound interface, the opposite direction. B is wrong because peering with an ISP's edge router over eBGP is a routing function unrelated to the application-facing interface. D is wrong because clock synchronization across the control plane is handled by NTP, not the northbound API.