CCNA Practice Test.

1. An engineer subnets 192.168.10.0/24 into networks that each support at least 30 hosts. Which subnet mask satisfies this requirement while wasting the fewest addresses?

• A. 255.255.255.192 (/26)
• B. 255.255.255.224 (/27)
• C. 255.255.255.240 (/28)
• D. 255.255.255.128 (/25)

2. Which statement correctly differentiates a Layer 2 switch's collision domain behavior from that of a legacy Ethernet hub?

• A. A switch places every port in its own collision domain, while a hub shares one collision domain across all ports
• B. A hub places every port in its own collision domain, while a switch shares one collision domain
• C. Both switches and hubs place every port in the same broadcast domain and same collision domain
• D. Switches and hubs both eliminate collision domains entirely by default

3. A network engineer needs a Layer 3 device to fragment a 1500-byte frame that must traverse a link with a smaller MTU. What is the most likely consequence if the Don't Fragment (DF) bit is set in the IP header?

• A. The router fragments the packet anyway and reassembles it at the far end
• B. The router drops the packet and may send an ICMP 'fragmentation needed' message back to the sender
• C. The switch converts the packet to a jumbo frame automatically
• D. The packet is forwarded unchanged regardless of MTU

4. Which OSI layer is primarily responsible for establishing, managing, and terminating logical connections such as TCP sessions between two hosts?

• A. Layer 2 (Data Link)
• B. Layer 7 (Application)
• C. Layer 4 (Transport)
• D. Layer 3 (Network)

5. An administrator observes that IPv6 address fe80::1a2b:3c4d:5e6f:7a8b is assigned to a router interface. What is the correct classification and purpose of this address?

• A. A global unicast address used for internet-routable communication
• B. A link-local address used only for communication on the local network segment
• C. A multicast address used to reach all routers on the segment
• D. A unique local address used for site-local routing across the WAN

6. A switch port configured as an access port receives a frame tagged with 802.1Q VLAN ID 20, but the port is assigned to VLAN 10. What does the switch do with this frame?

• A. It forwards the frame normally into VLAN 20
• B. It drops the frame because access ports do not expect or accept tagged frames
• C. It re-tags the frame with VLAN 10 and forwards it
• D. It floods the frame to all VLANs as an unknown unicast

7. Which EtherChannel negotiation protocol is Cisco proprietary, as opposed to the open-standard alternative?

• A. LACP (Link Aggregation Control Protocol)
• B. VTP (VLAN Trunking Protocol)
• C. PAgP (Port Aggregation Protocol)
• D. STP (Spanning Tree Protocol)

8. In Rapid PVST+, a switch port that is neither the root port nor a designated port, but is blocking to prevent a loop, is in which port state and role?

• A. Forwarding, Root port
• B. Discarding, Alternate port
• C. Learning, Designated port
• D. Forwarding, Backup port

9. A wireless engineer is deploying an 802.11 network where multiple lightweight access points must be centrally managed for configuration, RF optimization, and roaming. What component provides this centralized control?

• A. A wireless LAN controller (WLC)
• B. An autonomous access point
• C. A Layer 2 switch acting as a root bridge
• D. A DHCP relay agent

10. Two switches connect via a trunk link but have mismatched native VLANs configured on each end. What is the most likely operational impact?

• A. The trunk fails to come up entirely
• B. Traffic for the native VLANs may leak between the mismatched VLANs, and CDP/STP may log a native VLAN mismatch warning
• C. Only voice VLAN traffic is affected, all data VLANs are unaffected
• D. The switches automatically renegotiate a matching native VLAN via DTP

11. Which statement about the differences between static routing and dynamic routing protocols is accurate?

• A. Static routes automatically adjust when a link fails, while dynamic routes require manual reconfiguration
• B. Dynamic routing protocols consume more router CPU and bandwidth for updates, but adapt automatically to topology changes
• C. Static routes cannot be assigned an administrative distance
• D. Dynamic routing protocols are only usable in single-router networks

12. A router has the following routes to reach 10.0.0.0/24: a static route with administrative distance 1, and an OSPF route with administrative distance 110. Both are in the routing table. Which route is installed and used for forwarding?

• A. The OSPF route, because OSPF is a link-state protocol
• B. The static route, because it has the lower administrative distance
• C. Both routes are installed and traffic is load-balanced
• D. Neither route is installed; the router uses only directly connected routes

13. An OSPF network has two routers on the same multi-access segment, both configured with the same OSPF priority and no manual DR configuration. What determines which router becomes the Designated Router?

• A. The router that boots up second
• B. The router with the fewest interfaces
• C. The router with the lowest OSPF process ID
• D. The router with the highest router ID

14. A host with IP 172.16.5.10/22 needs to determine whether 172.16.7.50 is on its local subnet or requires routing through a gateway. What is the correct subnet range for 172.16.5.10/22?

• A. 172.16.4.0 - 172.16.7.255
• B. 172.16.5.0 - 172.16.5.255
• C. 172.16.0.0 - 172.16.255.255
• D. 172.16.4.0 - 172.16.4.255

15. Which routing protocol characteristic best distinguishes EIGRP as an advanced distance-vector protocol from a pure distance-vector protocol like RIP?

• A. EIGRP uses the Diffusing Update Algorithm (DUAL) to maintain backup routes and converge rapidly without full periodic broadcasts
• B. EIGRP requires manual configuration of every route with no automatic neighbor discovery
• C. EIGRP only supports a hop count metric identical to RIP
• D. EIGRP floods full link-state databases to every router in the area

16. A router's routing table contains a default route (0.0.0.0/0) and a more specific route to 192.168.1.0/24. A packet destined for 192.168.1.50 arrives. Which route does the router use?

• A. The default route, since it is always checked first
• B. The 192.168.1.0/24 route, because routers use longest prefix match
• C. Both routes are used simultaneously via load balancing
• D. Neither route; the packet is dropped as ambiguous

17. An engineer configures inter-VLAN routing using a single router interface with subinterfaces, each tagged for a different VLAN via 802.1Q encapsulation. What is this configuration commonly called?

• A. Proxy ARP routing
• B. Switched virtual interface routing
• C. HSRP routing
• D. Router-on-a-stick

18. A client's DHCP lease is about to expire. At what point in the DHCP lease lifecycle does the client first attempt unicast renewal directly with the original DHCP server?

• A. Immediately upon receiving the lease, before any time has elapsed
• B. At approximately 50% of the lease duration (the T1 timer)
• C. Only after the lease has fully expired
• D. At exactly 100% of the lease duration

19. An organization configures NAT overload (PAT) on its edge router so that all internal hosts share a single public IP address. How does the router distinguish return traffic belonging to different internal hosts?

• A. It relies on the internal hosts' hostnames advertised via DNS
• B. It uses unique source port numbers assigned per translated session, tracked in the NAT translation table
• C. It uses the source MAC address embedded in the IP header
• D. It assigns a different public IP to each session automatically

20. A network administrator wants all switches and routers to synchronize their clocks to a common accurate time source for consistent log timestamps. Which protocol accomplishes this?

• A. SNMP
• B. NTP (Network Time Protocol)
• C. CDP
• D. TFTP

21. First Hop Redundancy Protocols (FHRPs) like HSRP provide which primary benefit to hosts on a LAN segment?

• A. Faster DNS resolution for internal hosts
• B. A virtual default gateway IP that remains reachable even if the active router fails
• C. Automatic VLAN tagging on access ports
• D. Compression of Layer 2 broadcast traffic

22. A security team wants to restrict inbound traffic to only allow TCP port 443 to a specific web server, while denying all other inbound traffic to that host. Which tool is most appropriate to implement this on a Cisco router?

• A. A standard ACL matching only source addresses
• B. An extended ACL matching destination IP and destination port 443
• C. Port security limiting MAC addresses per switchport
• D. DHCP snooping trust configuration

23. Which statement accurately describes the security purpose of DHCP snooping on a switch?

• A. It encrypts DHCP traffic between clients and servers
• B. It load-balances DHCP requests across multiple servers
• C. It builds a binding table of trusted IP-to-MAC-to-port mappings and blocks DHCP responses from untrusted ports, mitigating rogue DHCP servers
• D. It automatically assigns static IP addresses to prevent DHCP use entirely

24. An organization wants to enforce that only known, authorized MAC addresses can transmit traffic on specific access ports, and that the switch should disable the port if a violation occurs. Which feature should be configured?

• A. BPDU filtering
• B. Port security with a violation mode of shutdown
• C. Root guard
• D. 802.1Q trunking

25. Which best describes the difference between authentication and authorization in an AAA (Authentication, Authorization, Accounting) framework?

• A. Authentication verifies who a user is; authorization determines what that user is permitted to do
• B. Authentication only applies to wireless networks, authorization only to wired networks
• C. Authorization verifies identity; authentication determines permitted actions
• D. Authentication and authorization are the same process performed twice for redundancy

26. A company wants remote employees to securely access internal resources over the public internet as if they were on the local network. Which technology is designed for this purpose?

• A. A VPN (Virtual Private Network) using protocols such as IPsec
• B. VLAN trunking between remote sites
• C. Spanning Tree Protocol
• D. CDP neighbor discovery

27. Which wireless security standard is considered insecure and should be avoided due to fundamentally broken encryption key handling?

• A. WPA2 with 802.1X
• B. WPA3-Enterprise
• C. WEP (Wired Equivalent Privacy)
• D. WPA2-AES (CCMP)

28. A network automation script needs to retrieve structured configuration data from a router and modify a specific interface's description without manually parsing free-form CLI text output. Which approach is best suited for this task?

• A. Screen-scraping 'show running-config' output with regular expressions over an SSH session
• B. Using a model-driven API such as RESTCONF or NETCONF with structured data formats like YANG/JSON
• C. Manually telnetting into the device and typing commands interactively
• D. Relying solely on SNMP traps for configuration changes

29. In network automation, what is the primary advantage of a declarative configuration management approach (e.g., stating desired end-state) over an imperative approach (e.g., a sequence of CLI commands)?

• A. Declarative approaches only work with proprietary Cisco hardware
• B. Declarative approaches cannot be version controlled
• C. Declarative approaches let the engineer define the desired end state, and the tool determines how to achieve and maintain it, improving consistency and idempotency
• D. Declarative approaches require the engineer to specify every step needed to reach the end state

30. A DevOps team wants to represent their network topology and VLAN assignments as version-controlled text files that automatically generate device configurations. Which practice does this describe?

• A. Infrastructure as Code (IaC)
• B. Port mirroring
• C. Spanning Tree PortFast
• D. Static NAT translation

31. Which data format is most commonly used by modern network automation tools (e.g., Ansible playbooks) due to its human-readable, indentation-based structure?

• A. BGP MRT format
• B. YAML
• C. 802.1Q tag format
• D. Binary ASN.1

32. A candidate is preparing to schedule the CCNA 200-301 exam and wants to know how the exam is typically delivered. Which statement is accurate?

• A. It can only be taken at a Pearson VUE Authorized Test Center and never remotely
• B. It is delivered through Pearson VUE, either at an authorized test center or online via the OnVUE proctored service
• C. It is self-graded with no proctoring required
• D. It is delivered exclusively through a Cisco-owned testing platform unrelated to Pearson VUE

33. A candidate wants to take the CCNA 200-301 exam remotely from home using OnVUE. What is the minimum internet connection speed required for this option?

• A. 1 Mbps download and 1 Mbps upload
• B. 6 Mbps download and 2 Mbps upload
• C. 25 Mbps download and 10 Mbps upload
• D. No minimum speed is required, only a stable connection

34. After passing the CCNA 200-301 exam, how long does the resulting certification remain valid before recertification is required?

• A. 5 years
• B. 3 years
• C. 1 year
• D. 2 years

35. A candidate reviewing the CCNA 200-301 exam blueprint wants to prioritize study time toward the domain with the greatest weight on the exam. Which domain should receive the most attention based on official weighting?

• A. Security Fundamentals
• B. Network Access
• C. IP Connectivity
• D. Automation and Programmability

36. Two switches are connected by two physical links that must act as one logical link without spanning tree blocking either. What is configured?

• A. Two separate VLANs, one per link
• B. BPDU guard on both interfaces
• C. An EtherChannel bundling the links, which spanning tree then treats as a single logical interface
• D. Portfast on both interfaces to skip spanning tree

37. A switch port connects to a single workstation and takes about thirty seconds to begin forwarding after link-up. What addresses this?

• A. Enabling PortFast so the port transitions to forwarding immediately, which is safe only where no switch will be connected
• B. Disabling spanning tree globally on the switch
• C. Configuring the port as a trunk
• D. Increasing the port's speed setting

38. Two OSPF routers on the same Ethernet segment remain stuck in the two-way state with each other. What does this indicate?

• A. Normal behaviour between two DROther routers, which form full adjacency only with the designated and backup designated routers
• B. A mismatch in the hello and dead interval timers
• C. A mismatch in the area identifier between the neighbours
• D. An authentication failure between the neighbours

39. An OSPF designated router election occurs on a segment. What determines the winner?

• A. The router with the most interfaces in the area
• B. The lowest router ID, with priority ignored
• C. The router that booted most recently
• D. The highest interface priority, with the highest router ID breaking a tie, and priority zero excluding a router from the election

40. A router learns the same destination network through OSPF and through a static route. Which is installed in the routing table?

• A. The static route, because administrative distance is compared before metric and static routes have a lower default distance
• B. The OSPF route, because it is dynamically maintained
• C. Both, load-balanced equally
• D. Neither, because the conflict causes both to be discarded

41. An access control list is written to match the 192.168.8.0/22 range. Which wildcard mask is correct?

• A. 0.0.3.255
• B. 0.0.255.255
• C. 255.255.252.0
• D. 0.0.0.255

42. A standard access control list is applied to filter traffic. Where should it be placed and why?

• A. Close to the destination, because a standard list matches only the source address and placing it near the source would block that source's traffic to every destination
• B. Close to the source, to discard unwanted traffic as early as possible
• C. On every router in the path for consistency
• D. Placement has no effect on the outcome

43. An access control list is configured with several permit statements and no deny statement. Traffic not matching any permit is dropped. Why?

• A. An implicit deny any exists at the end of every access list, so anything not explicitly permitted is denied
• B. The router defaults to denying all traffic on any interface with a list applied
• C. The list was applied in the wrong direction
• D. The permit statements were entered in the wrong order

44. Many internal hosts share a single public address for internet access. Which translation method is in use?

• A. Proxy ARP, which answers ARP requests on behalf of another host
• B. Static NAT, which maps one inside address to one outside address permanently
• C. Port address translation, which multiplexes many inside addresses onto one outside address by tracking source ports
• D. Dynamic NAT, which maps inside addresses to a pool one to one

45. Clients on a subnet with no local DHCP server must obtain addresses from a central server. What must be configured on the router interface?

• A. A helper address forwarding the broadcast DHCP discovery as a unicast to the server
• B. A static route to the DHCP server's subnet
• C. An access list permitting DHCP traffic
• D. A secondary IP address on the interface

46. A switch port configured with port security detects a violation. What does the default violation mode do?

• A. Shutdown, placing the port into an error-disabled state requiring manual or automatic recovery before it forwards again
• B. Protect, silently discarding frames from unknown addresses
• C. Restrict, discarding frames and incrementing a counter with notification
• D. Permit, logging the event and continuing to forward

47. A trunk link carries VLANs 10, 20 and 30, and VLAN 1 is the native VLAN. How is native VLAN traffic transmitted?

• A. Untagged, while the other VLANs are tagged, and a native VLAN mismatch between the two ends merges those VLANs
• B. Tagged like all other VLANs on the trunk
• C. Not carried at all across a trunk
• D. Carried on a separate physical link automatically

48. Hosts in VLAN 10 and VLAN 20 must communicate. What is required?

• A. A layer 3 device routing between the VLANs, whether a router subinterface or a switched virtual interface on a multilayer switch
• B. A trunk link between the two access switches
• C. Placing both VLANs on the same physical switch
• D. Enabling spanning tree on both VLANs

49. A wireless deployment uses lightweight access points and a controller. What protocol carries traffic between them?

• A. CAPWAP, which tunnels both control and data traffic between the access point and the controller
• B. SNMP, which carries management polling
• C. RADIUS, which carries authentication requests
• D. NTP, which carries time synchronization

50. A wireless network uses WPA2-Enterprise. What differs from WPA2-Personal?

• A. Each user authenticates individually through 802.1X against a RADIUS server rather than sharing a pre-shared key
• B. Enterprise uses a longer pre-shared key
• C. Enterprise disables encryption in favour of authentication
• D. Personal supports more simultaneous clients

51. An IPv6 address begins with FE80. What type of address is this and what is its scope?

• A. A link-local address, valid only on the local link and not routable beyond it
• B. A global unicast address routable across the internet
• C. A multicast address delivered to a group
• D. A unique local address routable within an organization

52. A network engineer retrieves device configuration through a REST API returning JSON. What characterizes this data format?

• A. Key-value pairs with nested objects and arrays, parsed natively by most languages, using braces for objects and square brackets for arrays
• B. Fixed-width columns with positional field meaning
• C. Tag-delimited markup requiring a schema to parse
• D. Binary encoding requiring a vendor-specific decoder

53. A team adopts a configuration management tool that describes the desired device state rather than the commands to reach it. What is this approach called?

• A. Declarative configuration, where the tool determines the actions needed to converge the device on the described state
• B. Imperative configuration, where each command is specified in order
• C. Manual configuration through the command line
• D. Reactive configuration triggered by device alerts

54. A controller-based network architecture separates control from forwarding. What role does the northbound interface play?

• A. It exposes the controller's capabilities to applications and orchestration systems, typically as a REST API
• B. It carries configuration from the controller down to network devices
• C. It connects the controller to the internet service provider
• D. It synchronizes time across the control plane

55. A router's syslog output must be sent to a central collector with accurate timestamps. Which two configurations are needed?

• A. A syslog server destination and NTP synchronization, since correlated analysis depends on consistent time across devices
• B. A syslog destination alone, since devices timestamp independently
• C. SNMP community strings and an access list
• D. A DHCP pool and a default route

56. SNMP is configured for monitoring. Which version should be selected and why?

• A. Any version, since SNMP traffic is confined to the management network
• B. Version 1, because it is the most widely supported
• C. Version 2c, because it adds encryption to version 1
• D. Version 3, because it provides authentication and encryption, whereas earlier versions transmit community strings in clear text

57. Quality of service is applied on a WAN link carrying voice and bulk data. Which treatment suits voice?

• A. A low-latency priority queue with policing, since voice needs bounded delay and jitter and gains nothing from buffering
• B. The largest available buffer, so no voice packet is ever dropped
• C. The same treatment as bulk data for fairness
• D. Shaping to delay voice until bulk transfers complete

58. A network engineer must verify that a routing change did not remove reachability to a remote subnet. Which verification is most direct?

• A. Checking the routing table for the expected prefix and confirming end-to-end reachability from a host in the affected subnet
• B. Confirming the interface counters have not incremented
• C. Reviewing the device's configuration file for syntax errors
• D. Verifying the device's uptime is unchanged

59. A first hop redundancy protocol is configured on two routers serving a subnet. What do clients use as their default gateway?

• A. A virtual IP address shared between the routers, which the active router answers and the standby assumes on failure
• B. The physical address of the active router, reconfigured on clients when it fails
• C. Both physical addresses, alternated by the client
• D. The subnet broadcast address

60. A device management plane must be protected. Which practice applies to virtual terminal lines?

• A. Restricting access with an access class, requiring SSH rather than Telnet, and applying an idle timeout
• B. Leaving them open so administrators can always connect in an emergency
• C. Using a shared account so credentials do not need distribution
• D. Disabling logging on management sessions to reduce noise

61. Authentication for device administrators is centralized. What does AAA provide beyond a single login?

• A. Encryption of all traffic through the device
• B. Authentication of identity, authorization of permitted commands, and accounting recording what was executed
• C. Only authentication, with the other functions handled locally
• D. Only accounting of session durations

62. DHCP snooping is enabled on an access switch. What attack does it mitigate?

• A. A rogue DHCP server offering addresses and a malicious default gateway, by permitting DHCP responses only from trusted ports
• B. A denial of service flood against the switch's CPU
• C. Unauthorized physical access to the wiring closet
• D. Password guessing against the switch management interface

63. An interface shows a high count of cyclic redundancy check errors. What class of problem does this indicate?

• A. A physical layer problem such as a damaged cable, faulty transceiver or electrical interference corrupting frames in transit
• B. A routing protocol misconfiguration
• C. An access list denying the traffic
• D. Insufficient bandwidth on the link

64. An interface shows late collisions on a full-duplex link. What is the likely cause?

• A. A duplex mismatch, where one end operates half duplex and the other full duplex
• B. An excessively long cable within specification
• C. A VLAN misconfiguration on the port
• D. An outdated routing table entry

65. A network diagram must be validated against reality before a change. Which device feature helps discover directly connected neighbours?

• A. A layer 2 discovery protocol reporting neighbouring devices, their platform, and the connecting ports on each side
• B. The routing table, which lists reachable networks
• C. The MAC address table, which lists learned addresses per port
• D. The DHCP binding table, which lists assigned leases

66. An engineer studying the TCP/IP model wants to know which single layer of that model maps to the presentation and session responsibilities described by the OSI reference model. Which TCP/IP layer absorbs those functions?

• A. Internet
• B. Transport
• C. Network access
• D. Application

67. While segmenting an application transfer, host Aria-PC adds a sequence number and destination port to the data before handing it down the stack. Which protocol data unit has Aria-PC just created?

• A. A packet
• B. A segment
• C. A frame
• D. A bit stream

68. A consultant reviewing an addressing plan notices a point-to-point WAN link configured as 10.203.113.4/30. Which two addresses on that link can actually be assigned to the router interfaces?

• A. 10.203.113.6 and 10.203.113.7
• B. 10.203.113.4 and 10.203.113.7
• C. 10.203.113.4 and 10.203.113.5
• D. 10.203.113.5 and 10.203.113.6

69. A NOC technician can ping the default gateway from workstation PC-14 but cannot load an internal web application, and a packet capture shows the TCP three-way handshake completing followed by an HTTP 500 response. At which layer of the OSI model is the fault most likely occurring?

• A. Network layer
• B. Data link layer
• C. Application layer
• D. Transport layer

70. A frame arrives at router Edge-R2, which strips the Ethernet header, examines the destination IPv4 address, and forwards the packet out a serial interface with a new Layer 2 encapsulation. Which OSI layer is Edge-R2 using to make its forwarding decision?

• A. Data link layer
• B. Physical layer
• C. Session layer
• D. Network layer

71. A switch named AccessSw-3 floods a received unicast frame out every port in the same VLAN except the ingress port. What causes this behavior?

• A. The destination MAC address is not in the switch MAC address table
• B. The frame failed its frame check sequence validation
• C. Spanning tree has placed all other ports in a blocking state
• D. The destination IP address is outside the local subnet

72. Two directly connected hosts on the same subnet can exchange ARP replies, but a protocol analyzer shows every TCP connection attempt between them being reset immediately by the receiving host. Which layer should the engineer investigate first?

• A. Layer 2, because the switch has likely learned the wrong MAC address
• B. Layer 1, because the cable is probably producing late collisions
• C. Layer 3, because the subnet mask on one host must be wrong
• D. Layer 4, because a host firewall may be rejecting the destination port

73. A technician must connect two buildings 320 meters apart with a link that is immune to electrical interference from a nearby industrial plant. Which cabling choice satisfies both requirements?

• A. Multimode fiber-optic cable
• B. Category 6 UTP copper
• C. Shielded twisted-pair copper
• D. Coaxial cable

74. The counters on interface GigabitEthernet0/1 of switch Dist-A show a steadily increasing number of CRC errors and input errors, while output errors remain at zero. What is the most likely cause?

• A. An MTU mismatch with the neighboring device
• B. A speed setting that is higher than the attached device supports
• C. A duplex mismatch causing the interface to defer transmissions
• D. A damaged cable or failing transceiver corrupting inbound frames

75. A campus uplink is described as running 1000BASE-T. Which statement about this link is accurate?

• A. It runs gigabit Ethernet over single-mode fiber up to 5 kilometers
• B. It runs gigabit Ethernet over four pairs of twisted-pair copper up to 100 meters
• C. It runs 100 megabit Ethernet over two pairs of copper
• D. It runs 10 gigabit Ethernet over short-reach multimode fiber

76. A network engineer sees the message '%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/2, changed state to down' while the physical interface status remains up. What does this combination indicate?

• A. The interface was administratively disabled by a configuration change
• B. The physical layer is functional but a Layer 2 problem such as keepalive or encapsulation failure exists
• C. The cable is unplugged at the far end of the link
• D. The interface hardware has failed and must be replaced

77. A small office uses power over Ethernet to run wireless access points. The facilities team asks why the new AP model will not boot on the old switch even though the cable tests clean. Which explanation is most likely?

• A. The switch port must be configured as a trunk before PoE will activate
• B. PoE cannot pass through patch panels, so the AP must connect directly
• C. The AP requires a crossover cable instead of a straight-through cable
• D. The AP draws more power than the switch port's PoE standard can supply

78. A branch office is assigned the network 172.16.4.0/26 for its workstations. How many usable host addresses does this subnet provide, and what is its broadcast address?

• A. 64 usable hosts with broadcast address 172.16.4.64
• B. 62 usable hosts with broadcast address 172.16.4.63
• C. 30 usable hosts with broadcast address 172.16.4.31
• D. 126 usable hosts with broadcast address 172.16.4.127

79. Server team member Priya configures a host with the address 172.31.99.201 and mask 255.255.240.0. Which network and broadcast addresses apply to this host?

• A. Network 172.31.96.0 and broadcast 172.31.111.255
• B. Network 172.31.99.0 and broadcast 172.31.99.255
• C. Network 172.31.96.0 and broadcast 172.31.103.255
• D. Network 172.31.64.0 and broadcast 172.31.127.255

80. A VLSM design must carve a subnet for a warehouse segment that will hold 500 devices while wasting as few addresses as possible. Which prefix length should the designer choose?

• A. /24, which supplies 254 usable addresses
• B. /23, which supplies 510 usable addresses
• C. /25, which supplies 126 usable addresses
• D. /22, which supplies 1022 usable addresses

81. Help desk staff report that host 10.44.17.66/28 cannot reach host 10.44.17.81/28 without a router even though both plug into the same switch. Why is a router required?

• A. The hosts are in the same subnet but the switch is blocking local traffic
• B. Addresses ending in .66 and .81 are both broadcast addresses and cannot be assigned
• C. A /28 mask never allows two hosts to communicate without a router
• D. The hosts are in different subnets: .66 belongs to 10.44.17.64/28 and .81 belongs to 10.44.17.80/28

82. An ISP delegates 203.0.113.0/25 to a customer who subnets it into equal /27 blocks for four small departments. Which statement about the resulting design is correct?

• A. The /25 cannot be divided into /27 subnets because the boundaries do not align
• B. The /25 yields exactly four /27 subnets, each with 30 usable addresses
• C. The /25 yields four /27 subnets, each with 62 usable addresses
• D. The /25 yields eight /27 subnets, each with 30 usable addresses

83. Network operations needs the full range of addresses that a monitoring server may see from the subnet 10.10.32.0/21. Which range of usable addresses should they whitelist?

• A. 10.10.32.1 through 10.10.47.254
• B. 10.10.32.1 through 10.10.39.254
• C. 10.10.32.1 through 10.10.32.254
• D. 10.10.33.1 through 10.10.40.254

84. An engineer at Helios Logistics wants a single summary route covering the four branch networks 10.4.0.0/16, 10.5.0.0/16, 10.6.0.0/16, and 10.7.0.0/16 without including any other space. Which summary should be advertised?

• A. 10.4.0.0/16
• B. 10.0.0.0/13
• C. 10.4.0.0/14
• D. 10.4.0.0/15

85. A junior admin claims that assigning 192.168.7.191 to a printer in subnet 192.168.7.160/27 will work fine. How should the senior engineer respond?

• A. The address must not be used because it is the broadcast address of that subnet
• B. The address is fine because printers ignore broadcast traffic anyway
• C. The address must not be used because it is the network address of that subnet
• D. The address is fine because only .255 addresses are reserved for broadcast

86. During an audit, an engineer finds a host configured as 172.19.200.77 with mask 255.255.248.0 that cannot reach its gateway at 172.19.196.1. What is the root cause?

• A. The host address is invalid because .77 is reserved in a /21 network
• B. The mask 255.255.248.0 is not a legal subnet mask
• C. The gateway and host are in the same subnet, so the fault must be physical
• D. The gateway address lies outside the host's subnet, which spans 172.19.200.0 through 172.19.207.255

87. A network designer must write the IPv6 address 2001:0db8:0000:0000:00a9:0000:0000:0930 in its correct fully compressed form. Which representation is valid?

• A. 2001:db8:0:0:a9::930
• B. 2001:db8::a9::930
• C. 2001:db8::a9:0:0:930
• D. 2001:db8::a9:0:0:93

88. Host Beacon-7 boots on an IPv6 network and automatically gives itself an address beginning with fe80. What kind of address is this and how far can it communicate?

• A. A link-local address usable only on the local link and never routed
• B. A unique local address routable inside the organization only
• C. A global unicast address routable across the internet
• D. A multicast address used to reach all routers on the link

89. An engineer enables SLAAC on VLAN 40. Describe how a client workstation on that VLAN obtains a global IPv6 address.

• A. It learns the prefix from a router advertisement and generates its own interface identifier
• B. It asks the DNS server to allocate an unused address from the zone file
• C. It copies the address of the default router and increments the final bit
• D. It broadcasts a DHCPDISCOVER and receives a full address from a DHCPv6 server

90. Before using an address produced by autoconfiguration, an IPv6 host sends a neighbor solicitation targeted at its own tentative address. What is the host doing?

• A. Registering the address with the local router's neighbor table
• B. Advertising the address so switches can update their MAC tables
• C. Requesting a prefix delegation from the upstream DHCPv6 server
• D. Performing duplicate address detection to confirm no other node uses the address

91. A multinational firm wants internal-only IPv6 addressing for a lab that must never be routed on the public internet, while avoiding conflicts if labs merge later. Which address block fits this purpose?

• A. Multicast addresses from ff00::/8
• B. Unique local addresses from fc00::/7
• C. Link-local addresses from fe80::/10
• D. Global unicast addresses from 2000::/3

92. A packet capture on an IPv6 segment shows traffic to ff02::1 and ff02::2. What do these two destinations represent?

• A. The loopback address and the unspecified address, respectively
• B. The solicited-node group and the DHCPv6 server group, respectively
• C. Two anycast addresses assigned to redundant gateways
• D. All nodes on the link and all routers on the link, respectively

93. A media startup streams live sports commentary where an occasional lost packet is acceptable but added delay is not. The developers also need application-level framing with no retransmission. Which transport protocol matches these needs?

• A. UDP, because it avoids connection setup, acknowledgments, and retransmission delays
• B. TCP, because its sequencing guarantees the commentary arrives in order
• C. UDP, because it retransmits lost datagrams faster than TCP does
• D. TCP, because its window scaling eliminates latency on long paths

94. During a TCP connection setup between client Nova-PC and a database server, the client sends a segment with the SYN flag and an initial sequence number of 4820. What does the server send in the second step of the handshake?

• A. A segment with the RST flag set and its own initial sequence number
• B. A segment with the FIN flag set to complete the exchange
• C. A segment with SYN and ACK flags set and an acknowledgment number of 4821
• D. A segment with only the ACK flag set acknowledging sequence 4820

95. An application vendor complains that its transfers slow down whenever the network drops packets, while a colleague's UDP-based telemetry keeps a constant rate. What TCP mechanism explains the slowdown?

• A. Congestion control shrinks the sending window when segment loss is detected
• B. The urgent pointer forces retransmitted data ahead of new data
• C. The push flag suspends transmission until the receiver empties its buffer
• D. TCP checksums require every segment to be verified twice

96. A firewall administrator must permit inbound requests to a server running HTTPS, plus zone transfers and standard queries for the DNS service on the same box. Which port and protocol set is correct?

• A. TCP 443 for HTTPS, with DNS using UDP 53 exclusively for every operation
• B. TCP 443 for HTTPS, with DNS using UDP 53 for queries and TCP 53 for zone transfers
• C. TCP 80 for HTTPS, with DNS using UDP 69 for queries
• D. UDP 443 for HTTPS, with DNS using TCP 53 for all traffic

97. Two applications on the same laptop, a browser and a mail client, hold simultaneous connections to the same remote server address. How does the laptop's TCP/IP stack keep the returning traffic separated?

• A. The server tags each stream with a distinct VLAN identifier
• B. Each application is assigned its own MAC address for the session
• C. The stack alternates delivery between the applications in round-robin order
• D. Each connection uses a different local port number, so the socket tuples remain unique

98. A coffee shop deploys three access points on the 2.4 GHz band and users report severe interference. The APs are set to channels 2, 5, and 8. What should the engineer change?

• A. Raise the transmit power on all three APs so clients hear them more clearly
• B. Move the APs to channels 1, 6, and 11, the only nonoverlapping 2.4 GHz channels
• C. Set all three APs to channel 6 so they share one clean frequency
• D. Enable channel bonding to combine the three channels into one wide channel

99. A site survey report notes that the 5 GHz band was chosen for a dense office deployment instead of 2.4 GHz. Which characteristic of 5 GHz justifies that choice?

• A. It supports only one client per channel, guaranteeing dedicated bandwidth
• B. It is immune to interference from radar and other outdoor systems
• C. It offers many more nonoverlapping channels, allowing dense AP placement with less co-channel interference
• D. It penetrates walls and floors better than 2.4 GHz, extending coverage

100. A wireless engineer explains that every SSID broadcast by an access point radio is paired with a unique MAC-like identifier used in frame addressing. What is this identifier called?

• A. The ESSID
• B. The BSSID
• C. The distribution system identifier
• D. The radio MIB handle

101. Guests in a hotel lobby roam between two access points that advertise the same WLAN name and security settings while wired together through the LAN. What 802.11 topology does this describe?

• A. An ad hoc mesh network
• B. An extended service set
• C. A point-to-point wireless bridge
• D. An independent basic service set

102. Employees complain of slow Wi-Fi in a conference room even though signal strength is excellent. The engineer finds a legacy 802.11b barcode scanner associated to the same 2.4 GHz radio. Why can one slow device degrade the whole cell?

• A. Legacy clients force the AP to disable all security, causing retransmissions
• B. Airtime is shared, so slow-rate transmissions occupy the channel far longer for the same data
• C. The scanner's traffic is copied to every other client as broadcast frames
• D. The AP reserves half of its power budget for the oldest associated client

103. A data center runs a hypervisor installed directly on server hardware with no underlying operating system, hosting a dozen guest machines. Which virtualization model is in use?

• A. Operating-system-level containers
• B. A type 1 bare-metal hypervisor
• C. Hardware emulation through a terminal server
• D. A type 2 hosted hypervisor

104. A developer notes that her application ships as containers rather than virtual machines. Compared with VMs, what is a defining property of containers?

• A. They share the host operating system kernel instead of each carrying a full guest OS
• B. They each boot their own dedicated kernel for stronger hardware isolation
• C. They cannot be assigned individual IP addresses on the network
• D. They require a type 1 hypervisor to schedule their CPU time

105. Traffic between two virtual machines on the same physical host reaches its destination without ever leaving the server. What component makes this possible?

• A. The physical top-of-rack switch hairpins the frames back into the host
• B. The guest operating systems exchange memory pages directly without networking
• C. A virtual switch running in the hypervisor connects the VMs' virtual NICs
• D. A VLAN trunk between the VMs eliminates the need for switching

106. A service provider must let two customers with overlapping 10.0.0.0/8 addressing share one physical router while keeping their routes completely separate. Which technology accomplishes this?

• A. Static NAT translating one customer's entire address space at every hop
• B. Virtual routing and forwarding instances that give each customer an isolated routing table
• C. Proxy ARP configured on the shared customer-facing interfaces
• D. A second loopback interface dedicated to the overlapping prefixes

107. An operations team moves a workload from a single physical server to a virtual machine on a shared cluster and wants to understand the main resource trade-off. Which statement is accurate?

• A. The virtual machine will always run faster because virtualization removes the operating system layer
• B. Virtualization removes the need for network configuration inside the guest
• C. The hypervisor introduces a small overhead, but the cluster gains flexibility such as live migration and higher hardware utilization
• D. Each virtual machine must be assigned a whole physical CPU socket to function

108. Finance users on switch AccessSw-9 sit in VLAN 30 and engineering users sit in VLAN 45. A finance workstation tries to ping an engineering workstation attached to the same switch and fails. What is required for this communication to succeed?

• A. Both VLANs must be added to the switch's allowed list on every access port
• B. The workstations must share a common default VLAN membership first
• C. A Layer 3 device must route between VLAN 30 and VLAN 45
• D. The switch needs a second uplink so the VLANs can bridge through it

109. A technician issues 'show vlan brief' on switch Warehouse-Sw and sees port Gi0/7 listed under VLAN 1 even though the port was supposed to serve VLAN 120. The VLAN 120 line is missing entirely from the output. What happened?

• A. VLAN 120 was never created, so the switchport access command could not take effect
• B. The port failed authentication and fell back to the guest VLAN
• C. The port is a trunk, so it will never appear under a specific VLAN
• D. VLAN 120 exists but is hidden because it carries no traffic yet

110. A data center team needs to aggregate links between a Cisco switch and a third-party vendor's switch. Which bundling protocol should they select and why?

• A. PAgP, because it automatically detects the other vendor's hardware
• B. DTP, because it negotiates both trunking and aggregation together
• C. UDLD, because it verifies both directions of every member link
• D. LACP, because it is the IEEE standard supported across vendors

111. The design for the Brookfield campus calls for phones and PCs to share single access ports, with phone traffic isolated in its own VLAN. Which configuration accomplishes this?

• A. Configure the data VLAN with switchport access vlan and add switchport voice vlan for the phones
• B. Configure the port as a full 802.1Q trunk allowing only the two VLANs
• C. Assign both devices to the same VLAN and separate them with port security
• D. Enable a private VLAN so the phone and PC cannot see each other

112. After a maintenance window, users connected to ports Gi0/10 through Gi0/20 of switch Atrium-Sw2 lost connectivity. The interfaces show 'inactive' in status output, and the technician recalls deleting an unused VLAN from the database that evening. What is the most likely cause?

• A. The VLAN database change erased the port channel configuration
• B. The ports negotiated themselves into trunks when the VLAN was removed
• C. Deleting any VLAN resets all access ports to the default VLAN automatically
• D. The deleted VLAN was still assigned to those ports, which become inactive when their VLAN disappears

113. A security consultant recommends that switch management traffic be moved out of VLAN 1 on every access switch at Delta Freight. What is the primary reason for this practice?

• A. Switches cannot apply access lists to interfaces in VLAN 1
• B. VLAN 1 frames are always sent untagged and therefore cannot be encrypted
• C. VLAN 1 has lower forwarding priority than other VLANs in hardware
• D. VLAN 1 is the default for every port and many protocols, so separating management reduces exposure to user-side attacks

114. Switch NorthSw-1 has ports in VLANs 10, 20, and 30 but no switched virtual interfaces defined except interface VLAN 99, which carries its management address. What Layer 3 capability does this switch currently provide to attached hosts?

• A. It routes between VLANs 10, 20, and 30 using its VLAN 99 address
• B. None; it switches frames within each VLAN and hosts must use an external gateway for routing
• C. It translates VLAN tags so the three VLANs behave as one broadcast domain
• D. It proxies ARP between the VLANs so hosts believe they share a subnet

115. At a shared office park, tenants Alpha and Beta each need their broadcast traffic contained even though both connect through the same access switch stack. How do VLANs meet this requirement?

• A. VLANs limit each tenant to a fixed number of broadcasts per second
• B. VLANs compress broadcast frames so they consume negligible bandwidth
• C. Each VLAN forms a separate broadcast domain, so broadcasts from one tenant never reach the other's ports
• D. VLANs convert broadcast frames into unicasts directed at the gateway

116. A new intern asks why the output of 'show interfaces status' on switch Lakeview-A displays some ports with a specific VLAN number and others with the word 'trunk' in the VLAN column. What explains the difference?

• A. Numbered ports are Layer 3 routed ports and trunk ports are Layer 2
• B. Ports showing a number carry one access VLAN, while ports showing trunk carry multiple tagged VLANs
• C. Ports showing a number are shut down and the number is their error code
• D. The word trunk indicates the port failed VLAN assignment and defaulted

117. An 802.1Q trunk connects switches Mercury-1 and Mercury-2 with native VLAN 99 on both ends. A frame belonging to VLAN 99 is sent across this trunk. How is it transmitted?

• A. It is dropped, because native VLAN traffic is not permitted on trunks
• B. Untagged, because native VLAN traffic crosses an 802.1Q trunk without a tag
• C. With a double tag so the far switch can verify the native VLAN
• D. With a standard tag of 99 like any other VLAN's traffic

118. Switches Quartz-A and Quartz-B are joined by a trunk where Quartz-A uses native VLAN 10 and Quartz-B uses native VLAN 20. CDP is logging native VLAN mismatch messages. What operational problem can this mismatch create?

• A. Untagged frames sent from one switch are placed into a different VLAN on the other switch, merging traffic between VLANs 10 and 20
• B. The trunk link physically shuts down until the mismatch is corrected
• C. All tagged VLANs on the trunk stop forwarding while the native VLANs disagree
• D. The switches renegotiate the trunk into an access port in VLAN 1

119. A trunk between switch Cobalt-3 and a virtualization host must carry only VLANs 110, 120, and 130 and must never negotiate. Which configuration approach is correct on the switch port?

• A. Set the mode to trunk, disable DTP negotiation, and prune the allowed list to 110, 120, and 130
• B. Set the port to access mode in VLAN 110 and let the host tag 120 and 130
• C. Set the mode to dynamic desirable and list the three VLANs as native
• D. Leave the mode dynamic auto and create the three VLANs in the database

120. Interface Gi0/24 on switch Pine-1 runs dynamic auto, and the far end on switch Pine-2 is also set to dynamic auto. Both were expected to form a trunk carrying several VLANs, yet each port settled into access mode. Why?

• A. Dynamic auto is incompatible with 802.1Q and only supports untagged links
• B. Dynamic auto ports only respond to negotiation, so with neither side initiating, no trunk forms
• C. One port must be configured as native before negotiation can start
• D. Both switches must first have identical VLAN databases before trunking

121. A voice engineer reviewing 'show interfaces trunk' on switch Falcon-2 sees VLAN 150 listed under allowed VLANs but missing from the 'allowed and active' section. What does this indicate?

• A. The trunk's encapsulation rejects VLAN IDs above 128
• B. VLAN 150 is the native VLAN and is therefore listed separately
• C. VLAN 150 traffic is being rate limited due to congestion on the trunk
• D. VLAN 150 is permitted on the trunk but does not exist or is suspended on this switch

122. During a change window, an engineer types the command to set the allowed VLAN list on an existing production trunk to 'vlan 300' and immediately triggers outages for other departments. What did the engineer most likely do wrong?

• A. Created a native VLAN mismatch by allowing a VLAN below 1000
• B. Disabled spanning tree on the trunk by modifying the list
• C. Exceeded the maximum number of VLANs a single trunk supports
• D. Replaced the entire allowed list with only VLAN 300 instead of adding it with the add keyword

123. An attacker in VLAN 10 crafts frames with two 802.1Q tags, hoping a switch will strip the outer tag and forward the frame into VLAN 60 without routing. Which condition makes this VLAN hopping technique possible?

• A. The switch runs rapid spanning tree instead of legacy spanning tree
• B. The attacker's access port is in the same VLAN as the trunk's native VLAN, so the outer tag matches the untagged VLAN
• C. The trunk between switches has all VLANs in its allowed list
• D. The target VLAN 60 has no SVI configured on the switch

124. Switch Iris-1's ports Gi0/1-2 run channel-group mode active while the connected ports on switch Iris-2 run mode passive. What is the result?

• A. A static channel forms without any protocol negotiation
• B. An LACP EtherChannel forms because active initiates negotiation and passive responds
• C. No channel forms because passive ports ignore LACP entirely
• D. A PAgP channel forms because the modes are from different protocols

125. An engineer bundles four uplinks between distribution switches Summit-A and Summit-B using channel-group mode on at both ends, but sets one member port to a different speed. What is the likely outcome?

• A. The channel renegotiates to LACP to accommodate the difference
• B. The mismatched port is suspended from the bundle because member interfaces must have identical settings
• C. The entire channel fails and all four physical links shut down
• D. The bundle averages the speeds and runs all links at the combined rate

126. After building a two-link EtherChannel, an engineer notices that a single large backup flow between two servers uses only one physical member and never exceeds 1 Gbps despite the 2 Gbps bundle. Why?

• A. The servers must also bundle their NICs before the channel splits flows
• B. The second link is a hot standby that activates only if the first fails
• C. The load-balancing hash assigns each flow to one member link, so a single flow cannot span both
• D. EtherChannel reserves half the bundle for control traffic

127. The command 'show etherchannel summary' on switch Onyx-4 displays port-channel Po2 with the flags SD, and its member ports show the lowercase flag s. How should the engineer interpret this?

• A. The port channel is a Layer 2 bundle that is currently down, with members suspended
• B. The bundle is up and forwarding on all suspended members simultaneously
• C. Po2 is a Layer 3 channel operating in standby mode by design
• D. The output shows a healthy channel; those flags are informational only

128. A campus architect explains that bundling uplinks with EtherChannel between access and distribution switches has a side benefit related to spanning tree. What is that benefit?

• A. Spanning tree is disabled automatically on aggregated interfaces
• B. Spanning tree treats the bundle as one logical link, so no member is blocked and all links carry traffic
• C. The bundle becomes immune to topology changes elsewhere in the network
• D. Spanning tree converges faster because BPDUs replicate across every member

129. Four switches at Ridgeline Corp run per-VLAN spanning tree with default priorities. Switch Rid-2 has the lowest MAC address of the four. What role will Rid-2 assume and why?

• A. Root bridge, because with equal priorities the lowest MAC address wins the election
• B. Designated bridge for every segment, because low MACs get all designated roles
• C. Backup root, because MAC address is only the second tiebreaker after uptime
• D. Edge bridge, because the lowest MAC is excluded from the root election

130. An engineer wants switch Core-West to always win the spanning tree root election for VLAN 200, guarding against any new switch joining with a low MAC address. What should be configured?

• A. Lower the spanning tree priority for VLAN 200 on Core-West to a value below all other switches
• B. Raise the hello timer on Core-West so it advertises more frequently
• C. Configure all other switches with the same priority as Core-West
• D. Assign Core-West the highest priority value available for VLAN 200

131. Switch Aspen-3 has two uplinks toward the root bridge: one 1 Gbps link through a neighbor and one 10 Gbps link through a different neighbor, with all other values equal. Which port becomes the root port?

• A. The port on the 1 Gbps path, because slower links are preferred for control traffic
• B. The port on the 10 Gbps path, because its lower cumulative path cost to the root wins
• C. Whichever port has the higher interface number on Aspen-3
• D. Both ports forward and share the load toward the root

132. Users report a 30 second outage each time their PC reboots on legacy spanning tree switch ports without any optimization features. What causes this specific delay?

• A. The port must pass through listening and forwarding delay states before it forwards traffic
• B. The switch waits for the PC to complete duplicate address detection
• C. The DHCP server intentionally delays offers to newly linked ports
• D. The port negotiates its speed for 30 seconds before going active

133. A network administrator enables PortFast on interface Fa0/12 of switch Meadow-1 where a file server connects. Weeks later someone plugs a small switch into that port. What risk does this create and which feature mitigates it?

• A. A loop could form because PortFast skips the normal checks; BPDU guard should be enabled to shut the port if a BPDU arrives
• B. The port floods all VLANs; storm control must rewrite the port to access mode
• C. The server loses its VLAN because switches cannot share PortFast ports; root guard restores it
• D. Nothing changes, because PortFast automatically disables itself when a switch connects

134. In a rapid spanning tree topology, switch Birch-2's root port fails. An alternate port on Birch-2 had been discarding traffic. How does RSTP respond compared with classic 802.1D?

• A. Birch-2 floods a topology query and waits for the root to assign a new port
• B. The alternate port becomes a backup port and stays discarding permanently
• C. The alternate port transitions to root port rapidly without waiting for legacy timers
• D. Birch-2 must wait the full max-age plus two forward delays before recovery

135. Two equal /24 routes to 203.0.113.0 exist on router Aster-R1, one via next hop 10.0.0.2 and one via 10.0.0.6, both learned by OSPF with identical costs. How does Aster-R1 treat traffic to that network?

• A. It alternates between routes every thirty seconds to balance wear
• B. It uses only the route learned first and holds the second in reserve
• C. It rejects both routes until an administrator selects one manually
• D. It installs both routes and load-shares packets across the two next hops

136. An engineer examining a switch running rapid PVST+ sees a port labeled with the backup role in spanning tree output. What does the backup role indicate?

• A. The port is a redundant connection to a shared segment that the same switch already serves with a designated port
• B. The port carries BPDUs only and never user data under any condition
• C. The port takes over as root port whenever the primary experiences errors
• D. The port is the second-best path to the root through a different neighboring switch

137. A broadcast storm brings down the Pinehill office LAN. Investigators find that a contractor looped a patch cable between two wall jacks feeding the same switch, and spanning tree had been disabled for a lab test. Why did this loop escalate so severely?

• A. The looped cable doubled the switch's MAC table capacity and overflowed it
• B. Ethernet frames carry no hop count, so broadcasts circulated endlessly and multiplied until the network saturated
• C. Broadcast frames convert to multicast in loops, which switches cannot filter
• D. The loop reversed frame check sequences, causing every frame to be resent

138. Two switches, Vale-1 and Vale-2, are linked twice with no bundling configured, and spanning tree is running. A junior tech asks why 'show spanning-tree' on Vale-2 shows one of the two ports in a blocking state. What should the senior tech answer?

• A. Spanning tree intentionally blocks one redundant link to break the loop while keeping it as a failover path
• B. The blocked port has a hardware fault and should be replaced promptly
• C. The two links have mismatched native VLANs, so one link cannot forward
• D. The switch blocks the newer link until it has been up for one full day

139. A field technician connects to switch Dune-5 and needs the management IP address and platform of the directly attached upstream Cisco switch without logging into it. Which command provides this detail?

• A. show ip arp
• B. show mac address-table
• C. show cdp neighbors detail
• D. show interfaces description

140. A consultant compares autonomous access points with controller-based lightweight APs for a client with 300 sites. What is the main operational argument for the controller-based design at this scale?

• A. Configuration, RF tuning, and policy are centralized, avoiding per-AP management of thousands of devices
• B. Autonomous APs cannot support more than one SSID per radio
• C. Controller-based APs do not require PoE, simplifying cabling
• D. Lightweight APs transmit at higher power than autonomous models

141. A security audit at Harbor Bank requires that switches stop advertising device details on all ports facing user desks, while an IP phone deployment still depends on discovery information from those same ports. The phones support the IEEE standard protocol. What should the engineer do?

• A. Disable both discovery protocols globally, because phones do not use them
• B. Disable CDP on user-facing ports and rely on LLDP with appropriate TLVs where phones need discovery, controlling it per port
• C. Replace discovery with SNMP polling from the phones to the switch
• D. Leave CDP enabled everywhere, because discovery cannot be disabled per port

142. An engineer runs a neighbor discovery command on router Mesa-R1 and sees a neighbor entry naming switch Mesa-Sw3, local interface Gi0/0, and port ID Gi1/0/14. What does this tell the engineer?

• A. Gi1/0/14 is Mesa-R1's own interface renamed by the discovery protocol
• B. Mesa-R1's Gi0/0 connects directly to port Gi1/0/14 on Mesa-Sw3
• C. Mesa-Sw3 is reachable through routing but is several hops away
• D. Mesa-Sw3 is advertising a default route to Mesa-R1 on that port

143. A data center standardizes on LLDP instead of CDP across mixed-vendor racks. Which behavioral detail should the team keep in mind about LLDP?

• A. It floods advertisements through switches so devices learn distant neighbors
• B. It cannot convey management addresses, so CDP must stay on for that
• C. It transmits neighbor data only when solicited by a management station
• D. It is an IEEE standard that works across vendors but typically must be enabled on Cisco switches, where CDP runs by default

144. Bayside College deploys 240 lightweight access points managed by a pair of wireless LAN controllers. Which protocol do the APs use to communicate with their controller, and how does it operate?

• A. SNMP, which the controller uses to poll each AP's configuration once per minute
• B. GRE, which every AP negotiates with each client individually
• C. CAPWAP, which builds tunnels between each AP and the controller for control and data traffic
• D. RADIUS, which encapsulates all wireless frames inside authentication records

145. Router Cypress-R3 shows the route '172.22.0.0/16 is variably subnetted, 4 subnets, 3 masks' followed by child entries. What does this heading convey?

• A. The routing table contains multiple subnets of 172.22.0.0 with different prefix lengths, reflecting VLSM in the network design
• B. The router compressed four routes into one entry to conserve memory
• C. The network 172.22.0.0 is unstable and has changed masks three times
• D. Four routing protocols contributed one route each for this network

146. A retail chain runs controller-based Wi-Fi at headquarters, but each small store has only two APs and a WAN link that sometimes fails. Which AP mode keeps store clients working during WAN outages while still using central management when the link is up?

• A. FlexConnect mode, which locally switches traffic and keeps serving clients when the controller is unreachable
• B. Sniffer mode, which captures frames for later analysis at headquarters
• C. Rogue detector mode, which validates store APs against a local list
• D. Monitor mode, which dedicates the AP to scanning during outages

147. A wireless engineer needs to feed raw 802.11 frames from the air into a protocol analyzer running on a desktop to troubleshoot a client roaming problem. Which AP mode supports this task?

• A. Bridge mode, which relays frames between two wired segments
• B. Local mode, which serves clients while logging summary statistics
• C. FlexConnect mode, which caches frames locally during WAN failures
• D. Sniffer mode, which captures channel traffic and forwards it to a specified analyzer address

148. The Wi-Fi design for Kestrel Stadium dedicates several APs exclusively to scanning all channels for interference and unauthorized devices; they never serve clients. Which mode are these APs using?

• A. Workgroup bridge mode
• B. FlexConnect mode
• C. Local mode
• D. Monitor mode

149. A facilities team must network several wired ticket printers in a kiosk 90 meters from the nearest wiring closet, with no conduit available. The stadium already has pervasive Wi-Fi. Which wireless solution connects these wired-only devices?

• A. Create a second SSID reserved for devices without radios
• B. Set the nearest AP to sniffer mode and plug the printers into it
• C. Enable FlexConnect on the kiosk printers' built-in interfaces
• D. Configure an AP as a workgroup bridge that associates to the WLAN on behalf of the wired printers

150. During WLAN setup on a wireless LAN controller, an engineer maps a new SSID to a specific VLAN so that guest traffic exits the controller tagged for the guest network. Which controller construct makes this SSID-to-VLAN mapping?

• A. A mobility group shared between neighboring controllers
• B. A WLAN profile bound to a dynamic interface on the controller
• C. An RF profile assigned to the AP group for that building
• D. The virtual interface used for client DHCP relay

151. A client associating to the SSID 'Voyager-Corp' authenticates successfully, then receives an IP address, and its traffic appears on VLAN 220 at the core. The AP operates in local mode with a centralized controller. Where does the client's traffic enter the wired network?

• A. At the controller, because local mode tunnels all client data through CAPWAP to the controller before it is switched onto VLAN 220
• B. At the AP's access switch port, which must carry VLAN 220 as its access VLAN
• C. Directly at the client, because 802.11 frames already carry VLAN tags
• D. At the nearest Layer 3 boundary between the AP and the controller

152. Router Glacier-R1 holds these routes: 10.16.0.0/12 learned from EIGRP, 10.16.32.0/19 learned from OSPF, and 10.16.32.128/25 configured statically. A packet arrives destined for 10.16.32.200. Which route forwards it?

• A. The static route to 10.16.32.128/25, because the longest prefix match always wins
• B. The OSPF route, because dynamic routes outrank static entries
• C. The EIGRP route, because its administrative distance of 90 is the lowest
• D. The packet is dropped because three overlapping routes create ambiguity

153. Router Delta-R4 learns the exact prefix 192.168.88.0/24 from both OSPF and an external BGP peer. Which route enters the routing table and why?

• A. The route with the lower metric installs regardless of protocol
• B. The eBGP route, because its administrative distance of 20 beats OSPF's 110
• C. Both routes install and traffic is balanced across them equally
• D. The OSPF route, because interior protocols are always preferred over exterior ones

154. The output of 'show ip route' on router Fern-R2 includes the line 'O 172.30.8.0/22 [110/74] via 10.1.1.9, 00:12:44, GigabitEthernet0/1'. What do the numbers 110 and 74 represent?

• A. 110 is the route's cost and 74 is its hop count from the router
• B. 110 is the process ID and 74 is the area in which the route originated
• C. 110 is the administrative distance of OSPF and 74 is the route's metric
• D. 110 is the VLAN of the next hop and 74 is the interface index

155. A packet arrives at router Onyx-R7 destined for 198.51.77.40, and the routing table holds no matching route and no default route. What does Onyx-R7 do?

• A. Forwards the packet back to the device it came from for rerouting
• B. Floods the packet out all interfaces hoping a neighbor has a route
• C. Buffers the packet until a routing protocol learns a matching prefix
• D. Drops the packet and may send an ICMP destination unreachable message to the source

156. An engineer inspecting router Basalt-R9 sees 'S* 0.0.0.0/0 [1/0] via 198.51.100.1' in the routing table. What does this entry provide?

• A. A host route to the single address 198.51.100.1
• B. A blackhole route that discards all traffic without notification
• C. A static default route serving as the gateway of last resort for unmatched destinations
• D. A dynamically learned backbone route to the provider network

157. Router Tundra-R2 receives a packet whose destination matches both a /28 route with administrative distance 110 and a /24 route with administrative distance 1. A colleague argues the /24 wins because static routes are more trusted. How should the engineer respond?

• A. The colleague is right; administrative distance is always evaluated first
• B. The router alternates between the two routes since the criteria conflict
• C. Prefix length is compared before administrative distance, so the /28 forwards the packet despite its higher distance value
• D. Neither route is used until their administrative distances are made equal

158. A troubleshooter runs 'show ip route 10.90.4.17' on router Quill-R5 and the output names a specific route entry with its outgoing interface and next hop. What did this command do?

• A. Displayed the single best route the router would use to reach that exact destination address
• B. Displayed every route the router has ever learned for that network
• C. Created a temporary host route for that address for testing purposes
• D. Sent a probe packet to the address and recorded the path taken

159. Router Sable-R1 has a directly connected interface in 192.168.41.0/24 and also learns 192.168.41.0/24 from a routing protocol on another interface. Which route does the router use for hosts on that network?

• A. The connected route, because its administrative distance of 0 beats every learned source
• B. Both routes, splitting traffic between the local interface and the remote path
• C. The protocol route, because learned routes carry fresher information
• D. Neither, because a connected and learned duplicate forces the prefix out of the table

160. On router Marlin-R6, 'show ip route' displays 'L 10.5.5.1/32 is directly connected, GigabitEthernet0/2' just below a C entry for 10.5.5.0/24. What is the L entry?

• A. A leaked route imported from another VRF on the same device
• B. A loopback route created automatically for every physical port
• C. A local route representing the router's own interface address as a /32
• D. A legacy route retained from a previous configuration revision

161. Traffic from the Kite branch to 172.28.64.0/18 must transit a firewall at 10.9.9.5 rather than following the shorter path advertised by the WAN protocol. Assuming the branch router already learns the /18 dynamically, which mechanism forces the firewall path?

• A. Increase the bandwidth statement on the firewall-facing interface
• B. Configure the firewall to advertise a lower hop count for the network
• C. Clear the routing table so the firewall path is learned first
• D. Configure a static route for 172.28.64.0/18 via 10.9.9.5, which outranks the dynamic route by administrative distance

162. An engineer at Corvid Systems types 'ip route 10.120.8.0 255.255.248.0 172.16.99.2' on router Corvid-R1. What exactly has been configured?

• A. A default route through 172.16.99.2 for all traffic from 10.120.8.0
• B. A static route sending traffic for 10.120.8.0/21 to next-hop address 172.16.99.2
• C. A route advertisement telling neighbors that 10.120.8.0 lives at 172.16.99.2
• D. A NAT rule translating 10.120.8.0 addresses to 172.16.99.2

163. Router Heron-R2 connects to headquarters through a fiber circuit and to a backup LTE service through a second interface. The engineer configures the primary default route normally and adds 'ip route 0.0.0.0 0.0.0.0 10.200.1.1 250'. What role does the value 250 play?

• A. It defines the route's metric, making it less attractive but always active
• B. It sets the route's bandwidth in megabits for load calculation
• C. It limits the route to 250 concurrent sessions before overflow
• D. It raises the route's administrative distance so it installs only when the primary default route disappears

164. The floating static backup route on router Petrel-R1 never takes over when the primary WAN circuit degrades to 90 percent packet loss, though it works during full outages. Why does the backup fail to activate during degradation?

• A. Floating static routes activate only once per day by design
• B. Packet loss reverses the administrative distance comparison
• C. The backup route requires the primary to be manually deleted first
• D. The primary static route stays installed as long as its interface remains up, and packet loss alone does not remove it

165. A network engineer configures 'ip route 172.18.40.0 255.255.255.0 GigabitEthernet0/3' on router Osprey-R4, naming only the exit interface on this Ethernet link. What drawback should the engineer expect?

• A. The route cannot install because Ethernet interfaces require a VLAN ID
• B. The route works only for the first 100 hosts of the destination network
• C. Traffic will loop between the router and the switch on that interface
• D. The router must ARP for every destination host in the network, potentially bloating its ARP table and relying on proxy ARP

166. Routers Wren-R1 and Wren-R2 sit at opposite ends of a point-to-point link. Wren-R1 has a static route to the LAN behind Wren-R2, yet pings from Wren-R1's LAN to that remote LAN fail while pings from Wren-R1 itself succeed. What is the most likely missing piece?

• A. Wren-R1's LAN interface must be added to the static route as a source
• B. The point-to-point link must run a routing protocol for LAN-to-LAN traffic
• C. Wren-R2 lacks a return route to the LAN behind Wren-R1, so replies cannot come back
• D. Static routes only carry router-generated traffic, never LAN traffic

167. A data center team wants traffic destined for the decommissioned block 10.66.0.0/16 silently discarded at router Falcon-R8 instead of following the default route toward the firewall. Which configuration achieves this?

• A. An outbound access list on every interface denying the block
• B. Removal of the default route so the traffic has nowhere to go
• C. A route to 10.66.0.0/16 with a next hop of the router's own address
• D. A static route for 10.66.0.0/16 pointing to the Null0 interface

168. Branch router Lark-R1 needs IPv6 reachability to the corporate prefix 2001:db8:44::/48 through next hop 2001:db8:ff::1. Which statement about configuring this static route is accurate?

• A. Static routing is unavailable in IPv6 because neighbor discovery replaces it
• B. IPv6 static routes require an exit interface and cannot use next-hop addresses
• C. IPv6 routes are configured identically to IPv4 using the ip route command
• D. The command uses the ipv6 route form, and IPv6 routing must be enabled on the router for forwarding to occur

169. Routers Alder-R1 and Alder-R2 share an Ethernet segment. Alder-R1 uses hello and dead timers of 10 and 40 seconds, but a contractor set Alder-R2's hello timer to 5 seconds. What is the effect on their OSPF relationship?

• A. Alder-R2 wins the DR election because it hellos more frequently
• B. They become neighbors but the adjacency flaps every 40 seconds
• C. They never become neighbors because hello and dead intervals must match on the segment
• D. They form a neighbor relationship using the faster of the two timers

170. An engineer defines a static route on router Teal-R3 with next hop 192.0.2.77, an address that is not in any connected subnet and is itself only reachable through another route. What is this arrangement called and what does the router do with it?

• A. A recursive static route; the router performs an additional lookup to resolve the next hop's own route
• B. A summarized route; the router advertises both prefixes as one
• C. A tunneled route; the router encapsulates traffic to reach the next hop
• D. An invalid route; routers reject next hops outside connected networks

171. At Meridian Retail, the WAN engineer configures identical static routes to 10.44.0.0/16 through two different upstream next hops, both with default administrative distance. What forwarding behavior results?

• A. The routes alternate in the table every aging interval
• B. The second route overwrites the first because duplicates are not allowed
• C. Only the numerically lower next hop installs; the other is rejected
• D. Both routes install and the router load-shares traffic to that network across the two next hops

172. A junior engineer asks when a network team should favor static routing over a dynamic protocol for a site. Which scenario is the strongest fit for static routes?

• A. A service provider backbone carrying full internet routing tables
• B. A large mesh of data centers where links fail and recover frequently
• C. Any network in which routers come from more than one vendor
• D. A stub site with one uplink and a handful of stable prefixes where simplicity and predictability matter most

173. Router Dove-R2's static route to 172.29.128.0/17 uses next hop 10.31.7.2 on interface Gi0/1. That interface goes down at 02:14. What happens to the static route?

• A. It remains installed but forwards traffic through the router's other interfaces
• B. It is removed from the routing table because its next hop is no longer reachable through any connected interface
• C. It stays in the table permanently because static routes never change state
• D. It converts automatically into a floating route with higher distance

174. The operations team at Skylark Media documents that their branch default route is 'ip route 0.0.0.0 0.0.0.0 203.0.113.9' and asks what traffic this entry matches. What is the correct answer?

• A. Only traffic destined for public internet addresses
• B. Broadcast traffic that the router would otherwise discard
• C. Every destination that fails to match a more specific route in the table
• D. Only traffic sourced from the 203.0.113.0 network

175. An engineer enables OSPF on router Juniper-R3, which has loopback addresses 10.0.0.9 and 172.16.0.4 plus physical interface addresses 192.168.1.1 and 10.255.255.1, with no router-id command configured. Which router ID does OSPF select?

• A. 172.16.0.4, the highest IP address among the loopback interfaces
• B. 10.0.0.9, the lowest loopback address for stability
• C. 192.168.1.1, the highest address across all interfaces
• D. 10.255.255.1, the address of the first interface that came up

176. On the Ethernet segment shared by four OSPF routers, Cedar-R2 has priority 0, Cedar-R1 has priority 1, and Cedar-R3 and Cedar-R4 both have priority 100 with router IDs 3.3.3.3 and 4.4.4.4 respectively. Which router becomes the designated router?

• A. Cedar-R2, because priority 0 marks the most trusted router
• B. Cedar-R4, because at tied priority the higher router ID wins the DR election
• C. Cedar-R1, because the lowest nonzero priority takes the role
• D. Cedar-R3, because lower router IDs are preferred for stability

177. The command 'show ip ospf neighbor' on router Rowan-R5 lists a neighbor stuck in the EXSTART state for twenty minutes. What is the classic cause of this symptom?

• A. An MTU mismatch between the two routers' interfaces prevents database exchange from starting
• B. One router has reached its LSA limit and paused flooding
• C. The routers are in different areas and cannot synchronize
• D. The neighbor's hello interval is shorter than Rowan-R5's dead interval

178. Router Sequoia-R1 shows a neighbor in the 2WAY state on a multi-access segment and never progresses to FULL. The segment has five routers and adjacencies to two of them show FULL. Is this a problem?

• A. No; 2WAY indicates the neighbor is in a different area, which is expected
• B. Yes; 2WAY means authentication failed midway through the exchange
• C. No; non-DR routers form full adjacencies only with the DR and BDR, remaining in 2WAY with other DROTHER routers
• D. Yes; every OSPF router must reach FULL with every neighbor on the segment

179. An engineer wants OSPF on router Laurel-R2 to advertise the subnet on interface Gi0/2 while never sending hello packets out that interface, because only servers live there. Which feature accomplishes this?

• A. Configuring the interface as passive under the OSPF process
• B. Applying an inbound access list blocking protocol 89
• C. Setting the interface's OSPF priority to zero
• D. Removing the network statement that covers the interface

180. With a reference bandwidth of 100 Mbps left at default, an engineer notices OSPF assigns the same cost of 1 to both a 1 Gbps and a 10 Gbps interface on router Willow-R7. Why, and what is the fix?

• A. The interfaces share a duplex setting, which forces equal costs; setting full duplex fixes it
• B. OSPF measures only latency, not bandwidth; enabling bandwidth measurement fixes it
• C. The cost formula tops out at gigabit speeds by standard; nothing can change it
• D. Costs below 1 round up to 1, hiding the difference; raising the reference bandwidth on every OSPF router restores distinction

181. Routers Fir-R1 and Fir-R2 connect over a point-to-point serial link running OSPF. A new admin asks why 'show ip ospf neighbor' shows the FULL state without any DR or BDR listed. What is the explanation?

• A. Serial links elect their DR at the area border router instead
• B. The display omits DR information unless debugging is enabled
• C. Point-to-point network types skip the DR and BDR election because only two routers exist on the link
• D. The election failed and OSPF fell back to a direct adjacency

182. A network at Halberd Insurance runs single-area OSPFv2. The engineer types 'network 10.24.16.0 0.0.15.255 area 0' under the OSPF process on router Hal-R1. What does this statement actually control?

• A. The range of addresses OSPF may assign to new adjacencies
• B. Which remote prefixes the router will accept into its routing table
• C. The summary advertisement the router sends to other areas
• D. Which interfaces join OSPF in area 0, namely any whose address falls within 10.24.16.0 through 10.24.31.255

183. After a topology change, all routers in area 0 at Garnet Logistics run the same computation to rebuild their routing tables from the link-state database. Which algorithm are they executing, and what does each router compute?

• A. The Bellman-Ford algorithm, computing hop counts to each neighbor
• B. The shortest path first algorithm, computing a tree of least-cost paths from itself to every destination
• C. A spanning tree algorithm, electing a root router for the area
• D. The diffusing update algorithm, computing feasible successors for each route

184. An engineer needs OSPF authentication on the link between routers Aspen-Edge and Aspen-Core to prevent a rogue device from forming an adjacency. Which statement about enabling authentication is true?

• A. Only the DR needs the key because it relays all adjacency requests
• B. Both ends of the link must use the same authentication type and key, or the adjacency will not form
• C. Enabling authentication forces the network type to point-to-point
• D. Authentication is negotiated automatically once either side enables it

185. Router Tamarack-R4's OSPF adjacency to a neighbor repeatedly cycles between FULL and DOWN roughly every 40 seconds, and pings across the link show intermittent loss. The timers match on both ends. What is the most probable cause?

• A. An unstable link is dropping hellos long enough for the dead timer to expire, tearing down and rebuilding the adjacency
• B. OSPF areas renumber automatically during instability
• C. The neighbor's router ID changes on every hello, forcing resets
• D. A duplicate router ID exists elsewhere in a different area, which is harmless

186. A review of router Basil-R2's configuration shows 'ip ospf 10 area 0' entered directly on interface Gi0/1 rather than a network statement under the routing process. What does this configuration do?

• A. It advertises a tenth of the interface's bandwidth into area 0
• B. It limits the interface to ten adjacencies in area 0
• C. It enables OSPF process 10 on that specific interface and places it in area 0, an alternative to network statements
• D. It is invalid because OSPF can only be enabled under the process

187. Two OSPF routers on the Foxglove LAN segment have formed a FULL adjacency. Router Fox-R1 then receives a new LSA from a downstream neighbor. What does Fox-R1 do with it?

• A. Installs it in its link-state database and floods it to other neighbors so all routers converge on identical databases
• B. Converts it into a distance-vector update before propagating it
• C. Forwards it only to the router that originated the network's routing table
• D. Holds it until the next scheduled thirty-minute database refresh

188. The command 'show ip ospf interface Gi0/0' on router Nettle-R6 reports 'State DROTHER, Priority 0'. What do these values reveal about this router on the attached segment?

• A. It is the designated router but is advertising modestly
• B. It has been elected as the segment's backup designated router
• C. Its adjacencies are administratively suspended pending priority change
• D. It cannot become the DR or BDR because its priority is zero, so it remains an ordinary router on the segment

189. Routers Yarrow-R1 and Yarrow-R2 have matching timers and areas but fail to form an OSPF adjacency across a LAN. Yarrow-R1's interface is 10.8.4.1/24 while Yarrow-R2's was fat-fingered as 10.8.5.2/24. Why does the adjacency fail?

• A. The mismatched addresses trigger a duplicate router ID condition
• B. The interfaces are in different subnets, and OSPF requires neighbors on a broadcast segment to share one subnet
• C. OSPF cannot run between addresses whose third octets differ by exactly one
• D. Adjacency requires the lower address to initiate, which failed here

190. An engineer runs 'show ip protocols' on router Clover-R3 and sees OSPF process 7 with router ID 172.16.255.1 and two network statements. Later the engineer adds a loopback with a higher address, but the router ID remains 172.16.255.1 even after saving. Why?

• A. The new loopback must first be advertised into OSPF before it is eligible
• B. The router ID is chosen when the process starts and is retained until the process restarts or is cleared
• C. Router IDs can only change during a maintenance window flag set on the process
• D. Saved configurations lock the router ID permanently on the platform

191. At Ironbark Freight, the OSPF design keeps every router and every interface in area 0. A director asks what limits this single-area design has as the network grows to hundreds of routers. What is the accurate answer?

• A. Every topology change triggers SPF recalculation on all routers and the shared database grows large, increasing CPU and memory load
• B. Routers in one area cannot summarize their own connected routes to each other
• C. Area 0 cannot contain redundant links, limiting resilience
• D. Single-area OSPF stops forming adjacencies after fifty routers by specification

192. Router Primrose-R1 must advertise its default route into OSPF so branch routers learn their exit path. The engineer adds 'default-information originate' under the process. Under what condition will Primrose-R1 advertise the default?

• A. Only if the router is elected DR on at least one segment
• B. Immediately and unconditionally, because the command forces advertisement
• C. Only while Primrose-R1 itself has a default route in its routing table, unless the always keyword is added
• D. Only after every neighbor reaches the FULL state on all interfaces

193. A capture on the Mulberry LAN shows OSPF packets addressed to 224.0.0.5 and others to 224.0.0.6. Which routers process each address?

• A. Both addresses reach all routers; the second is a retransmission channel
• B. All OSPF routers listen to 224.0.0.5, while 224.0.0.6 is processed by the DR and BDR
• C. 224.0.0.5 reaches only the DR, and 224.0.0.6 reaches all routers
• D. 224.0.0.5 is used in area 0 and 224.0.0.6 in all other areas

194. A log review at Whimbrel Data shows a message tagged with severity 0 arriving overnight. How should the on-call engineer interpret this severity?

• A. As a warning about elevated interface utilization
• B. As an informational notice about a routine configuration save
• C. As an emergency indicating the system is unusable, the most severe syslog level defined
• D. As a debug message produced by a technician's troubleshooting session

195. Hosts on the 10.50.20.0/24 LAN at Copperfield Labs use gateway 10.50.20.1, which is a virtual address answered by whichever of routers Cop-R1 and Cop-R2 is active under HSRP. Cop-R1 fails at noon. What do the hosts experience?

• A. Nothing at all, because hosts always maintain sessions to both routers simultaneously
• B. A brief interruption at most, because Cop-R2 takes over the virtual IP and virtual MAC without any host reconfiguration
• C. A full outage until each host times out its ARP cache and rediscovers a gateway
• D. A permanent outage until DHCP renews the hosts' leases with the new gateway

196. A capture on VLAN 70 shows periodic packets from 10.7.0.2 and 10.7.0.3 to multicast 224.0.0.102 with a destination MAC of 0000.0c9f.f046. The gateway address 10.7.0.1 resolves to that same virtual MAC style. Which protocol is running?

• A. GLBP, identifiable by its per-host round-robin of physical MACs
• B. HSRP version 2, which uses multicast 224.0.0.102 and virtual MACs in the 0000.0c9f.fxxx range
• C. VRRP, which always uses MAC addresses beginning 0000.5e00.01
• D. Proxy ARP, since multicast hellos are not used by any FHRP

197. Routers Nickel-R1 (priority 110) and Nickel-R2 (priority 100) run HSRP for VLAN 15. Nickel-R1 reboots for maintenance and, upon returning, never resumes the active role even though its priority is higher. Why?

• A. Nickel-R2 automatically raised its own priority upon becoming active
• B. HSRP priorities reset to zero after any reboot and must be reconfigured
• C. Preemption is disabled by default in HSRP, so the current active router keeps the role regardless of priority
• D. The virtual address moved permanently to Nickel-R2's physical interface

198. An architect compares first-hop redundancy options for a customer that insists on an open standard supported by several router vendors. Which protocol satisfies the requirement, and what is one behavioral difference from Cisco's proprietary option?

• A. GLBP, which is standards-based and disables preemption entirely
• B. VRRP, which is standards-based and enables preemption by default unlike HSRP
• C. LACP, which provides gateway redundancy across vendors
• D. HSRP, which became an open standard in its second version

199. A network automation course at Serin Institute explains why REST APIs are described as stateless. Which statement captures the meaning?

• A. Clients may only call the API once per authentication lifetime
• B. The server refuses concurrent requests from multiple clients
• C. The API forgets all device data after every call, requiring database rebuilds
• D. Each request carries everything the server needs, and the server retains no client session between requests

200. A design review at Larkspur Bank notes that with HSRP, the standby router's uplink bandwidth sits idle for VLAN 30's outbound traffic. Which FHRP addresses this concern, and how?

• A. HSRP version 2, which doubles the virtual MAC space for two active routers
• B. VRRP, which broadcasts every packet to both routers for parallel forwarding
• C. No FHRP can use more than one gateway; only routing protocols balance load
• D. GLBP, which answers ARP requests with different virtual MACs so hosts spread traffic across multiple forwarding gateways