CCNA 2026 Practice Test – 906 Free Exam Questions with Answers

Correct answer: D. Each device is separated by the same number of hops.

In a spine-and-leaf topology, every leaf switch connects to every spine switch, ensuring consistent latency because any two devices are separated by the same number of hops. Options mentioning Spanning Tree Protocol or variable latency act as traps, as modern designs avoid such inefficiencies.

Correct answer: D. 0000.5E00.0101

Virtual Router Redundancy Protocol version three uses a dedicated virtual MAC address format of zero zero zero zero dot five E zero zero dot zero one X X. The X X represents the group number in hexadecimal, making group one end in zero one.

Correct answer: B. FlexConnect with local switching enabled

FlexConnect with local switching enabled allows wireless client traffic to terminate locally at the branch office instead of traversing a WAN link. This mode also provides access point survivability, allowing the device to operate independently if the controller is unreachable.

Correct answer: B. SAE password-based key exchange

WPA three replaces the vulnerable four-way handshake with Simultaneous Authentication of Equals, also known as SAE. This password-based key exchange provides robust protection against offline dictionary attacks, which is a major security improvement over previous versions.

Correct answer: D. firewall

A firewall segregates a network into separate security zones, such as inside, outside, or DMZ, and strictly controls traffic between them. Switches and access points provide connectivity, while an intrusion prevention system strictly monitors for attacks.

Correct answer: D. In the binding database

A switch maintains DHCP snooping information in the binding database. This database tracks IP-to-MAC address bindings, VLAN, and port, and it is used to validate DHCP messages and enforce security features like Dynamic ARP Inspection.

Correct answer: A. hypervisor

The hypervisor abstracts and manages the underlying physical hardware resources such as CPU, memory, and storage for virtual machines. An operating system runs applications, while the CPU and enclosure are physical hardware components.

Correct answer: A. to create or fully replace a resource at a specified URI

The PUT method creates or completely replaces a resource at a specific URI. It is idempotent, meaning repeated identical requests yield the same result. Displaying a website or performing read-only operations relies on methods like GET.

Correct answer: C. 1, 6, 11

Channels 1, 6, and 11 are the three non-overlapping channels in the 2.4-GHz band using DSSS. These channels are spaced far enough apart to prevent frequency overlap, unlike the other listed options.

Correct answer: D. compare the destination IP address to the IP routing table

The data plane handles actual packet forwarding by comparing the destination IP to the routing table. Control plane functions like OSPF routing and NETCONF configuration changes build the tables used for forwarding.

Correct answer: A. It exchanges routing table information.

The control plane builds and maintains the routing table by exchanging network routing information using protocols like OSPF or BGP. Forwarding traffic and looking up egress interfaces are data plane functions.

Correct answer: B. After the cable is connected, the interface is available faster to send and receive user data.

PortFast allows an access port to bypass the listening and learning states of STP, transitioning immediately to the forwarding state. This significantly reduces the time before the interface can send and receive user traffic, such as during DHCP negotiation.

Correct answer: D. marking

Marking modifies specific fields in the packet header to indicate the class of service. Classification identifies the traffic, but only marking actually changes the packet header to define the per-hop behavior for downstream devices.

Correct answer: D. FF00::/12

IPv6 multicast traffic uses the FF00::/12 address block to send packets to a group of interfaces. Global unicast uses 2000::/3, unique local uses FC00::/7, and link-local uses FE80::/10.

Correct answer: B. discarding state and provides a backup path for a designated port on the same LAN segment

A backup port in Rapid PVST+ provides a backup path for a designated port on the same LAN segment. It remains in the discarding state until the designated port fails, while an alternate port backs up the root port.

Correct answer: D. destination MAC address

When forwarding a frame, a switch examines the destination MAC address and searches the CAM table for a matching entry. The source MAC address is only used during the MAC learning process, not the forwarding lookup.

Correct answer: D. HTTP

Application layer protocols like HTTP enable client applications to communicate with server applications. Lower layer protocols like TCP and IP provide reliable transport and logical addressing underneath.

Correct answer: D. overload

The overload keyword enables Port Address Translation, allowing multiple inside hosts to share one public IP address. It differentiates sessions by assigning unique Layer 4 source port numbers to each connection.

Correct answer: D. console

A console connection provides direct, out-of-band management access without needing an IP address. The mention of a missing dial-up number eliminates the AUX port, leaving the console port as the only option for initial configuration.

Correct answer: D. ip helper-address 192.168.10.1

The IP helper address command is configured on a router interface to forward UDP broadcasts, including DHCP requests, to a server on a different subnet. Static routes and default gateways do not forward local broadcasts.

Correct answer: B. 10.0.0.0/8

The 10.0.0.0/8 block is an RFC 1918 private address range used for internal enterprise networks. The 100.64.0.0/10 block is for carrier grade NAT, and 192.0.2.0/24 is a documentation block.

Correct answer: B. Authentication verifies the identity of a person accessing a network, and authorization determines what resource a user can access.

Authentication verifies the identity of a user or device, while authorization determines what resources that validated entity is allowed to access. Be careful not to confuse authorization with accounting, which tracks user activity.

Correct answer: C. physical access control

Implementing badge authentication to restrict building entry is a form of physical access control. User awareness and training are administrative controls, whereas vulnerability verification is a network scanning process.

Correct answer: C. show ip dhcp binding

The show IP DHCP binding command displays the active DHCP bindings, including assigned IP addresses, client MAC addresses, and lease expirations. Use the pool command to view configured ranges rather than active leases.

Correct answer: A. transport input telnet ssh

Under VTY line configuration mode, the transport input telnet ssh command explicitly permits both protocols for remote management. If you only specify Telnet, the router will drop SSH sessions, violating the requirement.

Correct answer: C. restrict

Port security restrict mode drops unauthorized traffic while generating log messages and SNMP traps. Protect mode drops traffic silently without sending traps, and shutdown mode immediately disables the interface.

Correct answer: B. 8

Wi-Fi Protected Access version two requires a pre-shared key of at least eight ASCII characters. Anything shorter will be rejected by the wireless controller configuration, establishing the minimum secure baseline.

Correct answer: D. It is the port on a switch with the lowest cost to reach the root bridge.

In Spanning Tree Protocol, the root port is the interface on a non-root switch with the lowest cumulative path cost to the root bridge. Options mentioning the highest priority or ports on the root bridge itself describe designated ports instead.

Correct answer: D. IP SLA responder

Measuring UDP jitter requires an IP SLA responder enabled on the destination device to timestamp packets and return them. Protocols like Cisco Discovery Protocol and LLDP are for neighbor discovery, not active network monitoring.

Correct answer: C. There is limited unique address space, and traffic on the new subnet will stay local within the organization.

Private IPv4 addressing is appropriate when unique public address space is limited and traffic remains internal to the organization. Options involving internet routing or external transit typically require unique public addresses or careful NAT traversal to function correctly.

Correct answer: C. determining network paths and programming forwarding behavior

An SDN controller centralizes the control plane by determining network paths and programming forwarding behaviors on devices. It does not physically forward packets, as the actual data plane hardware handles the packet movement across the network.

Correct answer: A. default gateway failure

First Hop Redundancy Protocols protect against default gateway failures by allowing multiple routers to share a virtual IP address. If the active router fails, a standby router takes over, preventing Layer 3 connectivity loss without requiring host reconfiguration.

Correct answer: C. listening and learning

Enabling PortFast bypasses the listening and learning states, causing the port to transition immediately to forwarding. This feature is intended for access ports connected to end hosts to prevent DHCP timeout issues during the spanning tree convergence process.

Correct answer: D. UDP operates without acknowledgments, while TCP uses acknowledgments to ensure reliable delivery

TCP uses acknowledgments, sequencing, and retransmissions to ensure reliable, ordered data delivery for applications requiring extensive error checking. UDP is a connectionless protocol that operates without these reliability mechanisms, dropping packets under heavy load.

Correct answer: A. southbound

Southbound APIs are used to communicate between the SDN controller and the network infrastructure devices in the data plane. Northbound APIs are used for the controller to communicate with upper-level applications and management programs instead.

Correct answer: A. trunk

FlexConnect local switching with VLAN tagging requires an 802.1Q trunk port on the switch to carry multiple tagged VLANs. The access, LAG, and EtherChannel options are incorrect because a standard access port only carries a single untagged VLAN.

Correct answer: A. Ansible

Ansible uses SSH, which operates over TCP port 22 by default, to communicate with managed nodes. It is agentless, making port 22 the standard transport for its operations. Puppet and Chef use agents that typically communicate over ports 8140 and 443.

Correct answer: D. 00:00:0c:07:ac:0e

HSRP version 1 uses a virtual MAC address format of 0000.0c07.acXX, where XX represents the group number in hexadecimal. Group 14 in decimal converts to 0e in hexadecimal. The distractors either use the wrong OUI or fail to convert the group number properly.

Correct answer: D. It generates one spanning-tree instance for each VLAN.

Rapid PVST+ generates one spanning-tree instance for each VLAN. This allows faster convergence and supports load balancing across multiple links while maintaining a loop-free Layer 2 topology. The other options are incorrect because they either violate loop prevention or describe MST features.

Correct answer: B. switchport mode dynamic desirable

The switchport mode dynamic desirable command enables Dynamic Trunking Protocol and actively attempts to negotiate trunk formation with the neighboring switch. The dynamic auto mode is a trap because it only passively waits for the neighbor to initiate the negotiation.

Correct answer: C. TCP is used when data reliability is critical, and UDP is used when missing packets are acceptable.

TCP is preferred when data reliability is critical, using acknowledgments and retransmissions to ensure guaranteed delivery. UDP is used when occasional packet loss is acceptable, such as in voice or video streaming. The distractors incorrectly associate low latency or dropped data with TCP.

Correct answer: C. stores and forwards frames in a buffer and uses error checking

Store-and-forward switching receives the entire frame, stores it in a buffer, performs error checking like verifying the Frame Check Sequence, and then forwards it if valid. The trap options misrepresent switching behavior, as switches dynamically learn MACs and never rewrite them.

Correct answer: C. The user enters a user name and password, and then clicks a notification in an authentication app on a mobile device.

Multifactor authentication requires combining two different factors, such as something you know and something you have. Using a password plus a mobile authenticator app notification fits this rule, while merely re-entering credentials does not.

Correct answer: D. ip address dhcp

The ip address dhcp command allows a router interface to obtain an IP address dynamically from a service provider. The other options configure static routing or default gateways, which do not dynamically acquire an IP address.

Correct answer: B. data

The data plane, also known as the forwarding plane, handles the actual switching and forwarding of traffic through a network device. The control plane builds the routing tables, but the data plane executes the forwarding decisions.

Correct answer: B. TACACS+ separates authentication, authorization, and accounting, while RADIUS combines authentication and authorization.

TACACS plus separates authentication, authorization, and accounting into independent processes for granular control. RADIUS combines authentication and authorization, and it only encrypts the password, unlike TACACS plus which encrypts the entire payload.

Correct answer: B. The installed agent on the device connects to the Chef Infra Server and pulls its required configuration from the cookbook.

Chef uses a pull-based model where an installed agent on the device connects to the central server to retrieve its configuration. This is a key distinction from push-based automation tools, as the client initiates the configuration request.

Correct answer: D. SSH

Secure Shell provides encrypted remote command-line access to network devices. Telnet sends traffic in cleartext, and HTTP or HTTPS are used for web-based graphical interfaces, so they can be eliminated.

Correct answer: B. HTTPS

Enabling HTTPS prompts a Wireless LAN Controller to generate a local self-signed SSL certificate for secure graphical access. HTTP lacks encryption, while RADIUS and TACACS+ handle authentication rather than web certificates.

Correct answer: D. The floating static route must have a higher administrative distance than the primary route so it is used as a backup

A floating static route is assigned a higher administrative distance than the primary route so it stays inactive until the primary fails. This ensures the backup path only installs when the preferred path disappears.

Correct answer: B. interface vlan 2000 ipv6 address fd00::1234:2343/64

IPv6 Unique Local Addresses use the FD00::/8 prefix for locally assigned addresses and are not routable on the public Internet. The FE80::/10 range is for link-local communication, while FF00::/8 designates multicast traffic.

Correct answer: B. PortFast

PortFast allows an access port to bypass the listening and learning states and transition directly to forwarding. The other features are loop prevention mechanisms. BPDU Guard, Root Guard, and Loop Guard restrict or block ports rather than speeding up their transition.

Correct answer: B. SSH

Secure Shell encrypts the management session, protecting credentials and command output. It is the preferred secure remote access method for network devices. Telnet and TFTP send data in cleartext, exposing sensitive information to interception.

Correct answer: C. default-router 192.168.20.253

In a slash twenty-four network, the last usable address is two fifty-four, making the next-to-last usable address two fifty-three. The default-router command configures the gateway distributed to DHCP clients. The ip default-gateway command is only used on the local device.

Correct answer: B. to configure an interface as a DHCP client

The IP address DHCP command is configured under an interface and instructs that interface to obtain its IP address dynamically from a DHCP server. Helper and relay commands are incorrect because they forward client requests rather than requesting an address for the router itself.

Correct answer: B. It immediately puts the port into the forwarding state when the link comes up.

The spanning-tree portfast command causes an access port to transition immediately to the forwarding state when the link becomes active, bypassing the listening and learning states. This affects only the local port and does not speed up spanning-tree recalculations across the network.

Correct answer: C. 802.1x

IEEE 802.1X provides port-based network access control and authenticates users or devices before granting network access. The other options are incorrect because they mitigate Layer 2 spoofing or VLAN hopping rather than enforcing identity-based security.

Correct answer: B. DHCP

Dynamic Host Configuration Protocol provides IP configuration information to Windows workstations, including the IP address, subnet mask, default gateway, and DNS server addresses. The other options are incorrect because they handle routing, monitoring, or name resolution rather than dynamic address assignment.

Correct answer: B. It is an asymmetric encryption algorithm.

RSA is an asymmetric encryption algorithm that uses a pair of keys, allowing secure communication without sharing a secret key in advance. The other options are incorrect because they describe symmetric encryption, which requires both sides to share an identical secret key.

Correct answer: C. Data plane

The data plane is responsible for actually forwarding user traffic based on MAC and IP routing tables. Remember that the control plane makes the decisions, but the data plane performs the actual work of moving the packets.

Correct answer: D. makes forwarding decisions based on MAC addresses

A Layer 2 switch makes forwarding decisions based on destination MAC addresses. Each switch port represents a separate collision domain, and communication between different VLANs requires routing, disproving the single broadcast domain distractor.

Correct answer: B. policing

Policing enforces a configured traffic rate by dropping or marking packets that exceed the defined bit rate. Shaping delays excess traffic using queues, while CBWFQ and LLQ manage active queue scheduling.

Correct answer: A. ip helper-address 172.16.32.15

A router interface requires the IP helper address command to forward DHCP broadcast requests to a server on a different subnet. Configuring a default gateway or forward protocol does not directly relay DHCP DISCOVER messages across broadcast domains.

Correct answer: A. associates the MAC address with the port on which it is received

MAC learning occurs when a switch examines the source MAC address of an incoming frame and associates it with the ingress port. Switches do not rewrite MAC addresses during learning, nor do they use ARP requests to populate the CAM table.

Correct answer: C. switchport port-security violation restrict

The restrict violation mode drops unauthorized traffic while incrementing the violation counter and sending SNMP traps. Protect mode drops frames silently without incrementing the counter, while shutdown mode immediately error disables the interface.

Correct answer: C. management interface

The management interface on a Cisco wireless LAN controller is the default source IP address for CAPWAP packets exchanged with access points. The other options are either not valid WLC interfaces or do not handle CAPWAP tunnel termination.

Correct answer: D. show standby

The show standby command displays HSRP group details, including the configured priority, active state, and virtual IP address. Show sessions displays management connections, and show interfaces does not provide first hop redundancy protocol states.

Correct answer: A. It queues excess traffic

Traffic shaping regulates outbound bandwidth by buffering excess packets in a queue to smooth out traffic bursts. This is different from marking or organizing packets, and it avoids dropping packets like policing does.

Correct answer: B. on the router closest to the client

The IP helper address must be configured on the router interface connected to the client to forward local broadcast requests. The router then forwards these packets as unicast to the remote server.

Correct answer: D. forwarding

Enabling PortFast causes an access port to bypass the listening and learning states and transition immediately to forwarding. This prevents initial delay issues for end devices requesting addresses.

Correct answer: C. 192.168.0.0/25 as summary and 192.168.0.0/27 for each floor

A slash twenty-seven subnet provides thirty usable addresses, which supports the largest floor without waste. Four of these subnets combine efficiently into a single slash twenty-five summary route.

Correct answer: D. FF00::/8

FF00::/8 defines IPv6 multicast addresses, which deliver packets to a group of interfaces that have joined the multicast group. The other options represent global unicast, unique local, and link-local addresses, which are used for standard one-to-one communication.

Correct answer: D. ipv6 address 2001:EB8:C1:2200:1::331/64

IPv6 address compression removes leading zeros within each 16-bit hextet. You can also replace one contiguous block of zeroes with a double colon to get the shortest valid representation.

Correct answer: D. switchport priority extend trust

The switchport priority extend trust command instructs the switch to trust the CoS value of traffic received from the access port of the IP phone. Other options rewrite the priority to a fixed value or apply to voice VLAN tagging.

Correct answer: D. service port

The service port is a dedicated out-of-band management interface on a Cisco Wireless LAN Controller. It provides a separate path for administrative tasks independent of production traffic, whereas the management interface handles in-band communication.

Correct answer: B. management interface

The management interface is the default in-band interface used for device administration and CAPWAP control traffic between the controller and access points. The service port is reserved for out-of-band management, making it incorrect here.

Correct answer: A. SYN flood

A SYN flood attack exploits the TCP three-way handshake by sending SYN requests without completing the connection. The term half-open TCP resources is the key exam cue that eliminates reflection and amplification attacks.

Correct answer: B. by reducing packet loss

Quality of service optimizes voice traffic by prioritizing packets to reduce packet loss, latency, and jitter. While it does differentiate traffic types, the direct optimization goal for voice is minimizing dropped packets.

Correct answer: A. correlates user activity with network events

A Next Generation Intrusion Prevention System provides contextual awareness by correlating network events with user identity. Options involving MAC forwarding or RADIUS enforcement describe switches or authentication servers, not IPS features.

Correct answer: E. RIP

Routing Information Protocol, or RIP, is a classic distance vector protocol. EIGRP is often called an advanced distance vector protocol, while OSPF and IS-IS are link-state protocols, eliminating those choices.

Correct answer: B. The hypervisor can virtualize physical components including CPU, memory, and storage

A hypervisor provides virtualization by abstracting physical hardware components including CPU, memory, and storage. A single hypervisor supports multiple virtual machines, eliminating the option claiming it supports only one virtual machine.

Correct answer: B. ip address 192.168.0.1 255.255.254.0

A 23-bit subnet mask provides 510 usable host addresses, efficiently covering the roughly 320 users while avoiding excessive waste. Because this is configured on a Switched Virtual Interface, it must use a valid host IP address rather than the network identifier.

Correct answer: C. ip address 192.168.32.30 255.255.255.224

Borrowing three bits creates a 27-bit mask, yielding exactly eight subnets with thirty usable hosts each. The first subnet ranges from zero to thirty-one, making thirty the last valid assignable host address for that interface.

Correct answer: A. 802.3ad

The 802.3ad standard defines Link Aggregation, allowing multiple physical interfaces to bundle into one logical interface. When a wireless LAN controller uses multiple ports with a single IP address, LAG must be enabled so they act as one logical path.

Correct answer: A. restricts unauthorized users from viewing clear-text passwords in the running configuration

The service password-encryption command encrypts plaintext passwords, such as line passwords, within the running configuration to restrict casual viewing. The encryption uses a weak Type 7 algorithm, but it prevents unauthorized users from easily reading stored credentials.

Correct answer: A. to set the severity of syslog messages from each device

Configuring different syslog levels on network devices allows administrators to set the severity of messages each device generates and sends. This helps prioritize alerts and manage monitoring effectively. The other options describe unrelated syslog features like rate-limiting or message identification.

Correct answer: D. on hosts that communicate only with other internal hosts

Private IPv4 addressing is designed for internal hosts that communicate only with other internal hosts. The public-facing and external streaming options fail because RFC 1918 addresses are not routable across the Internet.

Correct answer: D. show logging

The show logging command displays buffered system log messages, which frequently include routing protocol events and errors. The other choices only display current protocol states, such as neighbor adjacencies, rather than historical system logs.

Correct answer: A. An individual IPv6 unicast address is supported on a single interface on one node, but an IPv6 anycast address is assigned to a group of interfaces on multiple nodes.

An IPv6 unicast address uniquely identifies a single interface on one node, whereas an anycast address is assigned to multiple interfaces, typically on different nodes. The routing protocol directs traffic to the nearest node, making it distinct from one-to-one unicast delivery.

Correct answer: B. a DHCP Relay Agent

A DHCP relay agent forwards broadcast DHCPDISCOVER messages from clients to a server on a different subnet. Because routers block broadcast traffic by default, configuring an IP helper address is required to forward these messages as unicast across the network boundary.

Correct answer: B. PortFast

PortFast is a Spanning Tree Protocol enhancement configured on access ports to bypass the listening and learning states. This allows end devices to access the network immediately without waiting for the standard convergence timer to expire.

Correct answer: C. Frames are sent to every port on the switch in the same VLAN except from the originating port.

When a switch floods frames for unknown unicast or broadcast traffic, it forwards them out every port within the same VLAN except the receiving port. This action confines traffic to its assigned broadcast domain and prevents network loops.

Correct answer: D. WPA2 + AES

WPA2 with AES provides the strongest encryption combination by using the Advanced Encryption Standard for robust data confidentiality. Older protocols like WEP or WPA with TKIP are legacy standards with known vulnerabilities and should be avoided.

Correct answer: D. wireless management

The wireless management interface serves as the default in-band management interface for Cisco Wireless LAN Controllers. It handles management traffic and CAPWAP control communications, distinguishing it from the out-of-band service port.

Correct answer: D. It regulates the rate of traffic by buffering and smoothing bursts.

Traffic shaping regulates data transmission speeds by buffering excess packets to smooth out network bursts. This differs from traffic policing, which avoids queuing delays by immediately dropping packets that exceed the configured rate limit.

Correct answer: B. 172.28.0.0/16

RFC 1918 private IPv4 addresses allow internal devices to communicate without internet routing. The 172.28 network falls within the private 172.16 range, whereas the other options are public addresses.

Correct answer: B. unique local

Unique local IPv6 addresses are designed for internal routing across multiple subnets without internet routability. Link-local traffic stays on the local subnet, and global unicast addresses route publicly.

Correct answer: C. It causes the router to send all messages to the syslog server

The logging trap debug command sets the syslog severity threshold to level seven, capturing all messages from zero to seven. Because debug is the lowest severity, the router forwards every syslog message to the server.

Correct answer: C. Makes a routing decision

Software-Defined Networking centralizes the control plane by moving routing decisions to the SDN controller. Individual network nodes simply act as data plane devices, forwarding traffic based on controller-programmed flow tables.

Correct answer: C. The AP-Manager with the fewest number of APs is used by the AP to join.

When multiple AP-Manager interfaces exist, the controller balances the load by assigning the access point to the one with the fewest joined devices. This ensures optimal controller resource utilization across the network.

Correct answer: C. private

Private IPv4 addresses conserve globally unique public addresses by allowing internal reuse. Combined with network address translation, organizations can connect many private devices using just a few public IP addresses.

Correct answer: A. It uses two separate connections for control and data traffic.

File Transfer Protocol uses two separate TCP connections for control and data traffic. The control connection manages commands, while the data connection transfers files. Distractors describing UDP port 69 or no authentication actually apply to TFTP.

Correct answer: B. LACP

Link Aggregation Control Protocol is required to dynamically negotiate EtherChannel bundles when interfaces are placed in active mode. Cisco virtual PortChannel is a Nexus feature, while 802.1Q provides VLAN tagging rather than link negotiation.

Correct answer: A. The hub forwards the frame to all ports, and a switch forwards the frame to the known destination.

A hub operates at Layer 1 and simply repeats incoming electrical signals to all other ports, ignoring MAC addresses. A switch operates at Layer 2 and selectively forwards frames out the specific destination port based on its MAC address table.

Correct answer: B. 6 to 4 tunneling

Six to four tunneling encapsulates IPv6 packets inside IPv4 packets, allowing IPv6 traffic to traverse an IPv4 network. Dual-stack is incorrect because it requires both protocols to run natively rather than tunneling one over the other.

Correct answer: B. REST API

A REST API is commonly used as a northbound interface in SDN architectures, enabling communication between the controller and applications. Southbound APIs like OpenFlow are incorrect because they communicate downward with network devices instead of upward with applications.

Correct answer: D. lldp reinit 5

The LLDP reinit command sets the reinitialization delay to five seconds, specifying the wait time before LLDP initializes on an interface. The timer and holdtime commands are incorrect because they control update frequency and cache retention rather than the initialization delay.

Correct answer: A. { "key": "value" }

In JSON, a dictionary or hash is represented using curly braces with key-value pairs. The bracket syntax is incorrect because it represents an array, which is an ordered list of values rather than a mapped collection of keys and values.

Correct answer: C. configure ports in a black hole VLAN

Unused ports should be assigned to an unused black hole VLAN to isolate them from production traffic completely. Avoid the native VLAN because default configurations leave it vulnerable to management access and tagging exploits.

Correct answer: D. tunnel

IPsec tunnel mode encrypts the entire original IP packet, including the original header and payload, before encapsulating it with a new header. Transport mode leaves the original IP header exposed, which makes it suitable only for host-to-host connections.

Correct answer: B. port security violation

A port security violation triggers the error-disabled state as a protective mechanism to block unauthorized access. A standard shutdown command administratively disables an interface, while an empty port or latency simply results in a down or degraded status.

Correct answer: D. to limit the bandwidth that a flow can use

Traffic shaping limits the bandwidth of a flow by buffering excess packets to enforce a steady transmission rate. Unlike policing, which drops or marks excess traffic immediately, shaping actively delays packets to smooth out network bursts.

Correct answer: A. allows two or more routers to act as a default gateway

VRRP allows multiple routers to share a virtual IP address to act as a single default gateway for high availability. It is an open standard protocol, which effectively eliminates the proprietary distractor, and it relies on a configured virtual IP rather than dynamic assignment.

Correct answer: A. enable Band Select

Band Select steers dual-band clients away from the congested 2.4-GHz band by delaying probe responses. The other options manage power, multicast delivery, or authentication rather than frequency steering.

Correct answer: B. hypervisor

A hypervisor is the software layer that virtualizes physical hardware resources, enabling virtual machines to run on a host. Routers, switches, and cables are physical components that do not provide this specific hardware abstraction layer.

Correct answer: D. associates a name to a WLAN

A Service Set Identifier logically associates a name to a wireless LAN so client devices can identify and select the correct network. It does not inherently enforce security policies, prompt for login credentials, or require specific character combinations.

Correct answer: D. allows the users to access company internal network resources through a secure tunnel

A remote access VPN allows individual users to securely access company internal network resources through an encrypted tunnel. A site to site VPN connects branch offices, while remote access is designed for individual client devices connecting externally.

Correct answer: D. prevents the interception of data as it transits a network

Encryption in wireless networks protects transmitted data by encoding it, which prevents the interception of readable data as it transits a network. It does not prevent spyware on local devices or actively detect zero day network attacks.

Correct answer: B. network functionality

Network functionality manages communication between virtualized services and physical network interfaces using virtual switches. Hardware provides the physical compute resources, while the virtual machine is the isolated guest environment itself.

Correct answer: A. partial mesh

A partial mesh topology provides a practical balance of simplicity, cost, and availability. It offers redundancy for critical sites without the high expense and complexity of a full mesh network.

Correct answer: B. a host that is configured to request an IP address automatically

A Dynamic Host Configuration Protocol client is any host configured to request an IP address automatically. The server allocates the addresses, but the client initiates the request.

Correct answer: C. access

When an autonomous access point uses a single Service Set Identifier, all client and management traffic shares one VLAN. Therefore, an access port is required because it does not use 802.1Q tagging.

Correct answer: C. C. The NMS software must be loaded with the MIB associated with the trap.

A Network Management System must load the appropriate Management Information Base to properly interpret and handle incoming traps. Without the correct file, the system cannot translate the numeric data into readable text.

Correct answer: D. access ports

PortFast is designed specifically for Layer 2 access ports connected to end devices. It can be enabled directly on these ports to bypass spanning-tree states, unlike trunk or routed ports.

Correct answer: A. is used without allocation from a regional internet authority

Private IPv4 addresses do not require allocation from a Regional Internet Registry. They can be used internally by any organization. They do not provide unlimited ranges or automatically reduce router forwarding tables.

Correct answer: B. It provides shared applications to end users.

A server provides shared applications, services, or data to end users or client devices. Routers, not servers, route traffic between Layer 3 devices or separate security zones.

Correct answer: A. floods unknown destinations to all ports except the receiving port

When a switch receives a frame with an unknown destination MAC, it floods unknown destinations to all ports except the receiving port. Switches do not rewrite MAC addresses or forward frames with CRC errors.

Correct answer: B. lightweight

Lightweight mode enables an access point to be centrally managed by a Cisco Wireless LAN Controller using the CAPWAP protocol. Autonomous and bridge modes operate independently, which eliminates them as options for centralized controller-based management.

Correct answer: B. It produces an effective level of error-free network traffic using CRCs.

Store-and-forward switching receives the full frame and verifies the frame check sequence using cyclic redundancy checks. Cut-through forwarding eliminates this error checking to reduce latency, which confirms the correct benefit of error-free traffic.

Correct answer: D. digital certificates

Digital certificates provide certificate-based authentication, allowing enterprise devices to authenticate securely to the network without traditional passwords. This method is commonly implemented in enterprise environments for device authentication using 802.1X.

Correct answer: C. Accessed over the Internet

Public cloud resources are accessed over the Internet, allowing external users to consume services from virtually any location without dedicated infrastructure. Dedicated WAN connections and physical servers describe private or on-premises deployments instead.

Correct answer: B. Allow multiple VLANs to be used in the data path.

A trunk port allows multiple VLANs to traverse a single physical link using IEEE 802.1Q tagging. This configuration is required for the data path so traffic from multiple WLANs mapped to different VLANs can cross the switch connection.

Correct answer: D. using the WLC GUI via HTTPS

Lightweight access points are centrally managed through the Wireless LAN Controller. Secure management is performed by accessing the controller GUI using HTTPS, which then pushes configurations to the access points via secure CAPWAP tunnels.

Correct answer: C. Looks up an egress interface in the forwarding information base.

The data plane is responsible for moving packets and relies on the forwarding information base to determine the proper egress interface. While forwarding traffic to the next hop is the ultimate result, the exact lookup action specifically defines the hardware plane.

Correct answer: D. frame forwarding

Frame forwarding is the switching function that sends traffic out the specific port associated with a known destination MAC address. Flooding occurs when the destination MAC address is unknown, sending traffic out all ports.

Correct answer: D. GRE over IPsec

Generic Routing Encapsulation over IPsec allows multicast traffic to traverse remote sites while supporting encryption. Standard IPsec alone cannot natively encapsulate multicast broadcasts, so generic routing encapsulation is combined with it for secure transport.

Correct answer: B. DNS lookup

DNS lookup resolves a device hostname to an IP address, allowing a Telnet connection by name. Without DNS, you would need to know the exact IP address, and syslog or NTP serve different network functions.

Correct answer: D. data port

A Wireless LAN Controller uses its data port to connect to the switch and carry normal access point traffic. While the service port handles out-of-band management, the data port manages CAPWAP and client data traffic.

Correct answer: B. safeguards against brute force attacks with SAE

WPA3 introduces Simultaneous Authentication of Equals to replace WPA2 pre-shared keys, safeguarding networks against offline brute-force attacks. Protected Management Frames are mandatory in WPA3, making the optional negotiation distractor incorrect.

Correct answer: D. trunk

In local mode, a lightweight access point uses a trunk port to support multiple VLANs for client traffic and management. While link aggregation is often supported for redundancy, the fundamental port type required to carry the various VLANs is a trunk.

Correct answer: A. allows multiple companies to each use the same addresses without conflicts

Private IPv4 address ranges allow multiple companies to reuse the same addresses internally without global routing conflicts. Remember that private addresses require Network Address Translation to access the internet, eliminating the distractors about direct connections.

Correct answer: D. Link Layer Discovery Protocol (LLDP)

Link Layer Discovery Protocol Media Endpoint Discovery is the IEEE standard used to negotiate Power over Ethernet parameters. Cisco Discovery Protocol is a proprietary alternative, so the exam rule favoring open standards eliminates it here.

Correct answer: A. different nonoverlapping channels

Deploying access points on different nonoverlapping channels minimizes co-channel interference in the 2.4 GHz band. Overlapping channels or reusing the same channel degrades performance due to contention, which is why channel 1, 6, and 11 are typically leveraged.

Correct answer: D. 2002:db84:3f30:ca84:be76:2/64

Anycast addresses are allocated from the global unicast address space, which starts with 2000::/3. Multicast uses FF00::/8, and link-local uses FE80::/10, so both are invalid for global anycast routing.

Correct answer: C. A routing instance has flapped.

Notice-level syslog messages indicate significant but normal operational events, such as a routing instance flapping. A debug operation runs at debugging level, while device restarts typically trigger emergency or alert messages.

Correct answer: C. They provide minimal interruption to services by being hot-swappable

Both copper and fiber Small Form-factor Pluggable modules are hot-swappable, allowing replacement without powering down the device. The other options are invalid because SFPs operate at gigabit speeds and are media-specific.

Correct answer: A. portfast

PortFast allows an access port to bypass listening and learning states, transitioning immediately to the forwarding state. UplinkFast is used for redundant uplink recovery on root ports, not for edge devices like servers.

Correct answer: C. passive client

The passive client feature allows wireless controllers to learn the IP addresses of static clients. Controllers normally rely on DHCP snooping to map IP and MAC addresses, meaning static clients fail to communicate without this feature enabled.

Correct answer: A. offers anonymous user login ability

Trivial File Transfer Protocol provides a lightweight method for anonymous file transfers without requiring authentication. It relies on a single UDP connection, eliminating the secure TCP options that describe File Transfer Protocol.

Correct answer: C. UTF-8

JavaScript Object Notation text must be encoded using Unicode, with UTF-8 established as the standard encoding. This ensures efficient data serialization and backward compatibility with ASCII, which is expected for modern programmability and API integration.

Correct answer: C. The switch port mode must be set to trunk.

A locally switched FlexConnect AP requires a trunk port when management and client VLANs differ. The trunk allows multiple tagged VLANs to traverse the single physical link. Distractors fail because disabling 802.1Q or forcing LAG does not enable the necessary multiple VLAN tagging.

Correct answer: A. loads configuration files on systems without data storage devices

Trivial File Transfer Protocol provides a lightweight method to transfer files, often loading configurations or images onto diskless systems using UDP port 69. The distractors mention encryption, authentication, and secure access, which TFTP simply does not provide.

Correct answer: A. They enable communication between the controller and the network device.

Southbound APIs enable communication between the software defined networking controller and the underlying network devices. Northbound APIs flow upward to applications, which quickly eliminates the option mentioning applications.

Correct answer: A. The scope of an IPv6 link-local address is limited to a directly attached interface, but an IPv6 unique local address is used throughout a company site or network.

An IPv6 link-local address is automatically configured and limited strictly to the local link, while a unique local address routes internally across an organization. The distractors can be eliminated because link-local traffic is never routed globally.

Correct answer: A. Cisco DNA Center supports deployment with a single pane of glass.

Cisco DNA Center centralizes network management through a single pane of glass, streamlining device design and provisioning. The platform focuses strictly on Cisco devices, which eliminates the distractor claiming third-party zero-touch provisioning support.

Correct answer: A. resource limitations, such as the number of CPU cores and the amount of memory

Before deploying virtual machines, administrators must evaluate host resource capacity, including CPU cores and RAM. The remaining options focus on physical hardware peripherals or generalized data center placement, which are not the primary technical constraints for virtualization.

Correct answer: C. Enable the Allow AAA Override.

Enabling AAA Override allows the WLC to accept dynamic VLAN assignments from Cisco ISE based on user credentials. Without this feature enabled, the controller ignores authorization attributes returned by the RADIUS server, and clients are placed into their default interface VLAN.

Correct answer: D. source-destination MAC address

Source-destination MAC load balancing is recommended for WLCs because CAPWAP tunnels encapsulate traffic at Layer 2. Using IP-based hashing would incorrectly map all controller traffic to a single link since the packets share the same IP headers.

Correct answer: E. interface vlan 1148 · F. ip address 10.70.148.1 255.255.254.0

The first usable IP of a valid subnet boundary must be assigned to the VLAN interface. Here, a /23 mask correctly supports the 472-host requirement, while a /27 mask supports the 24-host requirement. Other options fail due to incorrect network boundaries or violating the longest subnet mask rule.

Correct answer: B. B. between the SDN controller and switches and routers on the network

A southbound application programming interface facilitates communication between the control plane and infrastructure devices like switches and routers. Northbound APIs handle communication between the controller and applications, easily eliminating those distractors.

Correct answer: B. B. ip address 10.10.10.1 255.255.252.0

The subnet mask 255.255.252.0 provides 1022 usable host addresses, making it the smallest available block that supports 600 hosts. Exam rules dictate choosing the smallest subnet that meets host requirements to strictly limit wasted IP address space.

Correct answer: C. C. man-in-the-middle

Dynamic ARP inspection mitigates man-in-the-middle attacks by validating ARP packets against a trusted DHCP snooping binding table. Distractors like DDoS or worms operate at different network layers, making man-in-the-middle the only correct target for Layer 2 ARP spoofing.

Correct answer: B. B. Telnet

Telnet provides remote command-line access but transmits all data in clear text, making it an unsecured protocol. SSH provides encrypted access, while console connections are physical and Bash is a local shell rather than a remote protocol.

Correct answer: D. D. access → distribution → core → distribution → access

In a three-tier campus design, traffic moves from the access layer to the distribution layer, crosses the core, and routes back down the remote distribution and access layers. The hierarchical structure requires this path when traversing separate switch blocks.

Correct answer: D. D. SSH

Secure Shell uses TCP port 22 by default to provide encrypted remote management access. Telnet uses port 23, while HTTP and HTTPS use ports 80 and 443 respectively, making SSH the clear match.

Correct answer: B. B. TCP requires the connection to be established before transmitting data. UDP transmits data at a higher rate without ensuring packet delivery.

TCP is a connection-oriented protocol requiring a handshake to provide reliable data delivery. UDP is connectionless and sacrifices delivery guarantees for lower overhead and faster transmission.

Correct answer: B. B. read

The HTTP GET method retrieves data without modifying it, corresponding directly to the Read operation in CRUD. The Create, Update, and Delete operations map to HTTP POST, PUT, PATCH, or DELETE methods.

Correct answer: B. B. Inform

SNMP Inform messages require an acknowledgment from the manager to confirm delivery. Traps are asynchronous notifications sent without expecting a response.

Correct answer: C. C. sent to the port identified for the known MAC address

A switch forwards frames directly to the port associated with the known destination MAC address. Unknown unicast frames are flooded out all active ports except the receiving port.

Correct answer: D. D. PAT

Port Address Translation maps multiple inside local addresses to a single inside global address using unique Layer 4 port numbers. Static and dynamic NAT map one-to-one without sharing ports, so they fail this requirement.

Correct answer: B. B. firewall

A firewall enforces network security by explicitly permitting or denying traffic based on configured rule sets. While switches and controllers direct traffic, they rely on standard forwarding logic rather than strict security policies.

Correct answer: D. D. control layer and the infrastructure layer

In software-defined networking, the southbound interface connects the control layer to the infrastructure layer. This boundary defines where centralized controllers push forwarding instructions down to distributed data plane hardware.

Correct answer: B. B. It uses a shared virtual MAC and a virtual IP address to a group of routers that serve as the default gateway for hosts on a LAN.

Hot Standby Router Protocol provides first hop redundancy by sharing a virtual IP and MAC address among multiple routers. Hosts use this virtual gateway seamlessly, ignoring whether the active or standby router currently handles forwarding.

Correct answer: C. C. flexconnect

FlexConnect allows an access point to locally switch client traffic if it loses connectivity to the WLC. This enables continued wireless service in branch deployments even if the WAN link to the controller fails.

Correct answer: A. A. service password-encryption

The global command service password-encryption encrypts all plaintext passwords in the running configuration, including line passwords. This provides a basic level of protection against casual viewing of weakly stored credentials.

Correct answer: D. D. straight-through

A straight-through cable maintains the same pinout on both ends and connects unlike devices such as a router to a switch. Because one device transmits on pins one and two while the other receives, no crossover is required.

Correct answer: D. D. VLAN tagging

VLAN tagging, specifically using IEEE 802.1Q, inserts a tag into the Ethernet frame to identify the VLAN. This allows multiple VLANs to traverse the same physical trunk port while strictly maintaining traffic separation.

Correct answer: B. B. Unlike autonomous access points, lightweight access points require a WLC to implement remote firmware updates.

Lightweight access points depend on a Wireless LAN Controller to receive and manage firmware updates. The controller distributes the appropriate image to associated access points, whereas autonomous APs are upgraded individually.

Correct answer: C. C. It sends the traffic via prefix 172.31.0.0/25.

Routers use the longest prefix match rule to select the most specific route in the routing table. The /25 prefix has the longest subnet mask, making it the preferred path over the /16 and /24 routes, as it represents the most exact destination network.

Correct answer: D. D. switch(config)#lldp port-description

Link Layer Discovery Protocol TLV advertisement settings, such as sending the port description, are configured globally. The correct command must be executed in global configuration mode, which eliminates the interface and line configuration modes as valid options.

Correct answer: C. C. Virtual Extensible LAN (VXLAN)

Virtual Extensible Local Area Network, or VXLAN, is the data-plane encapsulation protocol used in Software-Defined Access to create overlay networks. VXLAN encapsulates Layer 2 frames inside UDP packets, providing scalable segmentation across the fabric.

Correct answer: D. D. It allows the core and distribution layers to run as a single combined layer.

A collapsed-core network topology combines the core and distribution layers into a single logical tier. This design is typically implemented in smaller campus networks to reduce hardware costs and configuration complexity while maintaining adequate performance.

Correct answer: C. C. They are used with NAT to preserve public IPv4 addresses.

RFC 1918 private IP addresses are used internally within a network and must be translated using Network Address Translation to access the internet. This translation process allows multiple internal devices to share a single public IP address, preserving the limited IPv4 space.

Correct answer: B. B. provides a redundant default gateway for hosts on a subnet

First Hop Redundancy Protocols provide gateway redundancy by allowing multiple routers to share a single virtual IP address. If the active default gateway fails, another router assumes the virtual IP, ensuring continuous network access for hosts without requiring reconfiguration.

Correct answer: C. C. The controller must be rebooted after enabling or reconfiguring LAG

Enabling, disabling, or reconfiguring Link Aggregation on a Wireless LAN Controller requires a reboot to apply the physical port changes. Interface assignments are negotiated automatically when Link Aggregation is active.

Correct answer: A. A. show ip route

The show ip route command displays the active IPv4 routing table, including connected, static, and dynamic routes. The show ip interface brief command only displays interface statuses, not routing logic.

Correct answer: A. A. Users experience poor wireless network performance.

Overlapping Wi-Fi channels cause adjacent-channel interference, resulting in packet retransmissions and poor network performance. Proper channel planning, like using channels one, six, and eleven, mitigates this degradation.

Correct answer: D. D. WPA3

WPA3 uses Simultaneous Authentication of Equals to provide Perfect Forward Secrecy. Older protocols like WPA2 lack this feature, making them vulnerable to offline dictionary attacks if the passphrase is compromised.

Correct answer: D. D. Marking

Marking modifies the Type of Service field in the IPv4 header to assign a specific class of service. Classification only identifies traffic, while policing and shaping manage traffic flow without altering headers.

Correct answer: D. D. SNMP

The Simple Network Management Protocol uses an agent-based model to collect performance data and troubleshoot devices. The manager queries these agents, distinguishing it from file transfer or unrelated protocols.

Correct answer: D. D. control plane

The control plane manages routing decisions and builds routing tables. In Software-Defined Networking, this plane is centralized within a controller, which programs the underlying data plane devices.

Correct answer: D. D. when the subnet must be routable over the internet

Global unicast IPv6 addresses are publicly routable on the internet. Unique local addresses function similarly to private IPv4 ranges and are not routed externally, making internet routability the deciding factor.

Correct answer: B. B. TCP provides flow control to avoid overwhelming a receiver by sending too many packets at once, UDP sends packets to the receiver in a continuous stream without checking.

TCP uses flow control mechanisms like windowing to prevent overwhelming a receiver. UDP operates as a continuous, connectionless stream without these reliability checks, clearly distinguishing the two protocols.

Correct answer: C. C. It dynamically learns source MAC addresses and builds a MAC address table to enable frame forwarding

MAC address learning dynamically records source addresses and their ingress ports to build a MAC address table. This enables efficient unicast frame forwarding instead of flooding, defining core switch operation.

Correct answer: D. D. infrastructure-as-a-service

Infrastructure as a Service provides virtualized computing resources where customers install their own operating systems. Platform and Software as a Service limit this control, making infrastructure the required model.

Correct answer: B. B. Emergency

Syslog level zero, known as Emergency, indicates the system is completely unusable. The lower the numerical value in syslog, the higher the severity, making Emergency more critical than Alert or Critical.

Correct answer: C. C. trunk

A trunk port is required when multiple VLANs must traverse a single physical interface. Because the autonomous access point maps two VLANs to its wireless networks, the switch port must carry tagged traffic for both VLANs.

Correct answer: D. D. discarding

In Rapid Spanning Tree, the discarding state replaces the traditional blocking and listening states. A port in this state does not forward data frames or learn MAC addresses, but it still processes BPDUs to maintain loop-free topology.

Correct answer: C. C. Assign a DNS domain name.

Generating an RSA key pair requires a hostname and a DNS domain name to create the crypto identity. While configuring VTY access is necessary for remote login, the key generation itself strictly requires the domain name.

Correct answer: B. B. on

Setting the channel group mode to on forces the interface to form an EtherChannel without using any negotiation protocol. Both sides must be manually configured with this mode for the bundle to form successfully.

Correct answer: D. D. The highest up/up physical interface IP address is selected as the router ID.

If no router ID is manually configured and no loopback interfaces exist, OSPF automatically selects the highest IP address on an active physical interface. The protocol selects the highest IP address rather than modifying it or failing to run.

Correct answer: D. D. tunnel

Tunnel mode encapsulates the entire original IP packet within a new packet with a separate outer header. This is necessary when the security termination points differ from the actual traffic source and destination, which is common in site-to-site VPNs.

Correct answer: D. D. It floods the frame unchanged across all remaining ports in the incoming VLAN.

When a switch receives a frame with an unknown destination MAC address, it treats it as unknown unicast and floods it unchanged. This forwarding occurs out all other ports within the incoming VLAN except the receiving port.

Correct answer: A. A. FTP

File Transfer Protocol requires a username and password before allowing file transfers. When backing up a router configuration using commands such as copy running-config ftp, the router prompts for credentials, unlike simpler protocols like TFTP.

Correct answer: B. B. Encryption is not enabled by default and must be explicitly configured.

Mobility tunnels between Wireless LAN Controllers are not encrypted by default. If encryption is required for inter-controller roaming across untrusted networks, it must be explicitly enabled rather than being an automatic default behavior.

Correct answer: D. D. protects against brute force attacks

Wi-Fi Protected Access version three implements Simultaneous Authentication of Equals, which protects against offline brute-force attacks on passwords. This ensures that captured handshakes cannot be used for efficient offline dictionary attacks, a major improvement over previous versions.

Correct answer: A. A. small and needs to reduce networking costs

A collapsed-core architecture combines the core and distribution layers into a single tier, reducing hardware and operational costs. This design fits small organizations needing simplicity rather than large or rapidly growing networks that require the scalability of a three-tier model.

Correct answer: C. C. REST

Representational State Transfer uses standard HTTP methods like GET and POST to exchange data between applications on separate hosts. OpenFlow relies on a dedicated secure channel, whereas OpenStack manages virtual infrastructure rather than direct HTTP data transfers.

Correct answer: B. B. For small networks with minimal need for growth

Engineers implement a collapsed-core architecture for small networks with minimal growth requirements to reduce cost and complexity. Large networks or multi-site deployments require a full three-tier design to handle scaling and high availability.

Correct answer: A. A. manually implement trunk ports and disable DTP

VLAN hopping attacks are mitigated by manually configuring trunk ports and disabling Dynamic Trunking Protocol. Disabling DTP prevents rogue devices from automatically negotiating a trunk link to access unauthorized VLANs.

Correct answer: C. C. It is when a new network vulnerability is discovered before a fix is available.

A zero-day exploit targets a newly discovered vulnerability for which no patch or vendor fix is currently available. Attack options describing traffic saturation, SQL injection, or man-in-the-middle attacks represent different types of network threats.

Correct answer: D. D. Forwarding traffic to the next hop

The data plane is responsible for forwarding traffic to the next hop based on the forwarding information base. The control plane handles routing decisions and exchanging routing table information.

Correct answer: D. D. to protect against default gateway failures

First Hop Redundancy Protocols protect against default gateway failures by allowing multiple routers to share a virtual IP address. Options describing switch stacking, load-sharing, or loop prevention target different network features like VSS, EtherChannel, and Spanning Tree.

Correct answer: D. D. channels 1, 6, and 11

Channels one, six, and eleven are the only standard nonoverlapping channels in the two point four gigahertz band within the United States. Channel fourteen is restricted to Japan, while the other combinations either overlap or are nonstandard.

Correct answer: B. B. any interference that is not Wi-Fi traffic that degrades the desired signal

Wi-Fi noise is defined as any non-Wi-Fi interference that degrades the desired wireless signal, such as microwaves or Bluetooth devices. Options mentioning co-channel interference or signal-to-noise ratios confuse noise sources with related metrics.

Correct answer: A. A. IPsec

IP Security, or IPsec, is responsible for encrypting and transporting user data across a site-to-site VPN tunnel. Internet Key Exchange versions one and two handle session negotiation, while MD5 provides integrity checking.

Correct answer: C. C. anycast address

An anycast address shares the format of a unicast address but is assigned to multiple devices, routing traffic to the nearest node. Multicast is strictly one-to-many, while global and link-local addresses identify single interfaces.

Correct answer: A. A. Forward secrecy and SAE in personal mode for secure initial key exchange

WPA3 implements Simultaneous Authentication of Equals for personal mode, providing forward secrecy and a secure initial key exchange. TKIP is an obsolete WPA feature, while AES encryption applies to multiple generations.

Correct answer: D. D. Set the AP Class Type to Friendly.

When a wireless LAN controller detects a legitimate autonomous access point as a rogue, the alarms must be stopped by classifying its MAC address as friendly. Manual containment is a mitigation action used against actual threats.

Correct answer: D. D. control

Software-defined networking centralizes the control plane within an SDN controller, which programs the data plane to make forwarding decisions. The application and data planes remain distributed across the network devices.

Correct answer: D. D. Controller-based networks centralize all important control-plane functions, and traditional networks distribute control-plane functions.

Controller-based networks centralize the control plane, whereas traditional networks distribute control plane intelligence across individual devices. Traditional networking forces every device to build its own forwarding tables independently, which increases operational overhead.

Correct answer: D. D. Data plane

The data plane, also called the forwarding plane, handles the actual physical forwarding of user-generated traffic based on programming from the control plane. Management and control planes operate independently and do not process user packets directly.

Correct answer: C. C. Reduce inconsistencies in the network configuration.

Network automation enforces standardized, repeatable configurations which directly reduces human error and configuration drift across devices. The other options describe negative outcomes or traditional manual approaches that automation specifically aims to eliminate.

Correct answer: C. C. application-facing interface for GET, POST, PUT, and DELETE methods

A northbound application programming interface is application-facing, allowing external programs to communicate with the controller using HTTP methods. Southbound interfaces face the network elements, eliminating the other options.

Correct answer: A. A. Core and distribution

A collapsed core architecture combines the core and distribution layers into a single tier to reduce hardware costs and complexity. The access layer remains separate, creating a simplified two-tier network design.

Correct answer: C. C. R1(config)# username engineer2 algorithm-type scrypt secret test2021

The scrypt hashing algorithm provides the strongest resistance against brute-force attacks for local user accounts on Cisco devices. Type 5 and Type 7 passwords rely on older, weaker encryption or hashing methods, making them less secure.

Correct answer: D. D. traffic shaping

Traffic shaping buffers excess packets to smooth traffic flow and transmits them later when bandwidth is available. Traffic policing drops packets immediately when the configured rate is exceeded.

Correct answer: C. C. The logging level defines the severity of a particular message.

Syslog severity levels range from zero to seven and define the importance of a specific message. By default, devices send level zero through level six messages to local logging destinations.

Correct answer: A. A. MAC address aging

MAC address aging removes stale entries from the MAC address table after a period of inactivity. This automated process prevents the table from filling up with inactive devices.

Correct answer: B. B. TACACS+

TACACS+ separates authentication, authorization, and accounting into distinct processes. RADIUS is typically preferred for wireless networks, but it combines authorization and authentication, making TACACS+ the correct choice for independent control.

Correct answer: B. B. The port priority

Spanning Tree Protocol uses the port ID as a tiebreaker when path costs are equal. By lowering the port priority value on a specific interface, you can force it to become the preferred forwarding port.

Correct answer: A. A. Only controller-based networks decouple the control plane and the data plane.

Controller-based networks decouple the control plane from the data plane, allowing centralized management of forwarding tables. Traditional networks keep these planes coupled on each individual device, so this separation is unique to controller architectures.

Correct answer: A. A. ARP

Address Resolution Protocol maps a known IPv4 address to the corresponding Layer 2 MAC address on a local broadcast domain. Hosts use ARP before sending Ethernet frames when they know the destination IP but need the destination MAC.

Correct answer: D. D. SSH

Ansible uses SSH by default to securely connect to managed nodes and push modules for execution. SSH provides encrypted communication and authentication between the control node and managed network devices.

Correct answer: C. C. They are case sensitive.

Service Set Identifiers are case sensitive, meaning uppercase and lowercase letters create different network names. Wireless clients must match the SSID exactly to associate with the correct wireless network.

Correct answer: A. A. It divides the control-plane and data-plane functions.

Disaggregation in controller-based networking separates the control plane from the data plane. The centralized controller manages network intelligence while the underlying forwarding devices handle packet routing.

Correct answer: B. B. protect traffic on open networks

Opportunistic Wireless Encryption protects traffic on open Wi-Fi networks without requiring passwords. It uses individualized encryption keys between the client and access point to prevent eavesdropping while maintaining easy access.

Correct answer: A. A. They route traffic between devices in different VLANs.

A Layer 3 switch routes traffic between different VLANs using switched virtual interfaces or routed ports. Standard switching relies on MAC addresses to move frames within the same broadcast domain, eliminating the other choices.

Correct answer: D. D. FTP

File Transfer Protocol uses TCP port 21 for control and TCP port 20 for active data transfers. Since the firewall explicitly permits these ports, FTP is the correct choice over TFTP or application protocols.

Correct answer: D. D. It identifies a wireless network for a mobile device to connect.

The service-set identifier, or SSID, identifies a specific wireless LAN that a mobile or wireless client device can discover and join. The SSID allows clients to distinguish between multiple wireless networks within range and select the appropriate WLAN for association.

Correct answer: A. A. NAT pool

A NAT pool is a defined range of public IP addresses made available for translation. When dynamic NAT is configured, the router selects an available address from this pool to translate inside local addresses.

Correct answer: D. D. to reduce interference

Nonoverlapping channels are utilized to reduce co-channel and adjacent-channel interference in wireless networks. In the 2.4 GHz band, channels one, six, and eleven are commonly used because their frequencies do not overlap.

Correct answer: A. A. It is a Cisco-proprietary protocol.

Cisco Discovery Protocol is a Cisco-proprietary protocol used to share information between directly connected Cisco devices. This exclusivity is its primary differentiator from the standards-based alternative, Link Layer Discovery Protocol.

Correct answer: A. A. Local AP mode creates two CAPWAP tunnels per AP to the WLC

In local mode, an access point establishes two CAPWAP tunnels to the wireless LAN controller for control and data traffic. FlexConnect allows local switching at the edge, eliminating the need to bridge all client traffic back to the controller.

Correct answer: A. A. lightweight mode

Lightweight mode relies on a centralized Wireless LAN Controller for management and roaming. Autonomous mode operates independently without a controller, eliminating the other options.

Correct answer: A. A. auto

Power over Ethernet auto mode detects compliant devices and automatically supplies power within the budget. Static mode applies power continuously without verifying the actual device requirements.

Correct answer: C. C. inside global

Inside global represents the public IP address used to represent an internal host after translation. Inside local refers to the private address before translation, helping you eliminate related distractors.

Correct answer: A. A. physical access control

Physical access control restricts facility entry using measures like badge readers. Role-based access control strictly governs logical network permissions, not physical door entry, eliminating that distractor.

Correct answer: A. A. a Layer 3 device to perform inter-VLAN routing

Inter-VLAN routing requires a Layer 3 device, such as a router or multilayer switch, to forward traffic between separate subnets. Trunk links merely pass VLAN traffic; they do not route between them.

Correct answer: C. C. forwards frames only out the port associated with the destination MAC address

A Layer 2 switch forwards known unicast frames only out the specific port mapped to the destination MAC address. It floods unknown unicast frames out all active access and trunk ports instead.

Correct answer: B. B. Personal

WPA Personal mode, also known as WPA-PSK, uses a Pre-Shared Key for authentication. WPA Enterprise uses a RADIUS server, which distinguishes it from the Personal mode required by the prompt.

Correct answer: B. B. config network secureweb enable

The command config network secureweb enable activates HTTPS access on a Cisco Wireless LAN Controller. The other commands either enable insecure protocols like Telnet or handle unrelated certificate generation.

Correct answer: B. B. update

The Update operation modifies existing data within a table or view. Create inserts new records, while Read retrieves them, making Update the standard choice for editing existing database entries.

Correct answer: B. B. 802.1x

IEEE 802.1X provides port-based network access control, requiring authentication before granting access. It integrates with RADIUS servers to enforce posture checks, blocking noncompliant devices from connecting.

Correct answer: C. C. low-latency queuing

Low-Latency Queuing provides strict priority scheduling for delay-sensitive interactive voice and video. Expedited forwarding is a marking behavior, not a scheduling mechanism, making Low-Latency Queuing the operational configuration.

Correct answer: A. A. R1(config)#ip nat inside source static 10.1.1.1 209.165.200.225

The command for static NAT maps the inside local address to the inside global address. The correct syntax places the private address first, followed by the public address, eliminating the outside source distractors.

Correct answer: D. D. Enable the Protected Management Frame service and set the Comeback timer to 10.

Protected Management Frames, or PMF, prevents spoofing of wireless association requests. Enabling this service activates the Comeback timer, which forces clients to wait a specified interval before retrying an association request.

Correct answer: A. A. to monitor and manage network devices using a UDP underlay that operates on the application layer

Simple Network Management Protocol operates at the application layer to monitor and manage network devices. It relies on UDP as its transport protocol, ruling out the TCP, SSL, and SSH distractors.

Correct answer: D. D. hardware resources

A hypervisor abstracts physical hardware resources like CPU and memory, distributing them among multiple virtual machines. This resource sharing is the foundational concept of virtualization.

Correct answer: C. C. simplicity of configuration

A point-to-point leased line offers simplicity of configuration because it provides a direct, dedicated connection between two endpoints. This removes complex multipoint routing considerations, though costs are typically higher.

Correct answer: C. C. metric

When multiple routes are learned through the same routing protocol, the router uses the metric to select the best path. Administrative distance is the tie-breaker only when the same route is learned from two entirely different routing protocols.

Correct answer: C. C. Cisco DNA Center leverages APIs, and traditional campus management requires manual data gathering.

Cisco DNA Center provides programmability and automation through REST-based application programming interfaces. Traditional campus management relies heavily on manual command-line configuration and fragmented data collection, which the platform streamlines.

Correct answer: C. C. Configure EIGRP variance to 2

EIGRP uses the variance command to support unequal-cost load balancing. By configuring a variance of two, the router multiplies the best metric, allowing feasible successors with metrics up to that higher threshold to be installed in the routing table.

Correct answer: A. A. It uses the bandwidth and delay values of the path to calculate the route metric.

By default, EIGRP calculates its composite metric using the minimum bandwidth and cumulative delay along the path. Other K-values that incorporate reliability and load are disabled by default, isolating bandwidth and delay as the primary factors.

Correct answer: D. D. Spanning-tree fails to detect a switching loop increasing the likelihood of broadcast storms.

Enabling PortFast on a switch-to-switch link causes the port to bypass listening and learning states and immediately transition to forwarding. This bypasses normal spanning-tree protections, which increases the risk of catastrophic broadcast storms.

Correct answer: C. C. 255.255.255.0

Applying a 24-bit mask places both IP addresses in the same local subnet. Without a router routing traffic between subnets, hosts must share an identical subnet mask to communicate directly.

Correct answer: B. B. firewall

A firewall enforces security policies by inspecting and filtering traffic between trusted and untrusted networks. While routers can use access control lists, dedicated firewalls are designed specifically to protect internal networks from internet threats.

Correct answer: A. A. management

The Association Response frame is defined as a management frame in the IEEE 802.11 standard. Management frames handle establishing and maintaining wireless communication, whereas control frames assist with delivery and data frames carry traffic.

Correct answer: A. A. policing

Traffic policing is typically implemented by an ISP at the network edge to enforce a customer's committed information rate. When traffic exceeds the contracted bandwidth, policing drops or remarks excess packets immediately.

Correct answer: C. C. DHCPOFFER

A Dynamic Host Configuration Protocol Offer is sent by a server in response to a client's Discover message. If multiple Offer messages are received from different sources, it indicates the presence of a spurious rogue server on the network.

Correct answer: D. D. It provides orchestration and network automation services.

A northbound Application Programming Interface provides the interface between the Software Defined Networking controller and higher-level applications. This interface enables programmability by exposing controller capabilities to external orchestration and automation services.

Correct answer: D. D. services are provided by a public, private, or hybrid deployment

Cloud-based network topologies deliver services through public, private, or hybrid cloud deployments. The other options describe on-premises physical hardware or specific access methods rather than true cloud deployment models.

Correct answer: A. A. personal 10-digit PIN and RSA certificate

Multifactor authentication requires combining two different factor categories, such as something you know and something you have. A personal identification number and a digital RSA certificate perfectly satisfy this requirement.

Correct answer: B. B. CDP can still operate and may advertise another IP address configured on the neighboring device

Cisco Discovery Protocol operates at Layer 2 and does not require an IP address on the connected interface to function. If the neighboring device has another Layer 3 address configured elsewhere, the protocol can still advertise it.

Correct answer: A. A. OfficeExtend allows a personal SSID to be configured on the AP, and FlexConnect does not provide this capability

OfficeExtend mode supports a personal SSID for teleworkers to separate home and corporate traffic. FlexConnect is designed for branch offices to locally switch traffic, but it does not provide this personal SSID capability.

Correct answer: A. A. offers predictable latency of the traffic path between end devices

Spine-and-leaf architecture provides predictable latency between endpoints because every leaf connects to every spine. This consistent hop count eliminates the variable latency found in traditional three-tier designs.

Correct answer: B. B. filters and rate-limits DHCP messages on untrusted ports

DHCP snooping filters DHCP messages and applies rate limits on untrusted ports to prevent rogue servers and starvation attacks. The other options describe unrelated functions like VLAN propagation or packet forwarding.

Correct answer: C. C. password complexity enable

The password complexity enable command must be issued first to activate password enforcement rules on a Cisco device. Only after this global feature is enabled can you configure specific restrictions like blocking manufacturer names.

Correct answer: A. A. Port security

Port security is the feature used to restrict exactly how many MAC addresses can be dynamically learned or statically configured on a switch port. BPDU Guard and Dynamic ARP Inspection mitigate different threats but do not limit MAC address learning.

Correct answer: C. C. OpenFlow

OpenFlow is the primary southbound protocol used by a software-defined networking controller to communicate directly with underlying infrastructure. While REST APIs are heavily used for northbound communication, OpenFlow specifically handles programming the data plane.

Correct answer: B. B. lowest path cost to the toot bridge

During root port selection, every non-root switch first looks for the path with the lowest total cost to the root bridge. Tiebreakers like the neighbor bridge ID are only evaluated when multiple paths share the exact same cumulative cost.

Correct answer: A. A. snmp-server user

The correct answer proves that SNMP version three relies on the User-based Security Model. The other commands are generic to older versions or merely enable notifications, whereas defining a specific user implies authentication and encryption.

Correct answer: A. A. an authoritative DNS server

The authoritative DNS server is the definitive source that holds the actual records for a specific domain. Local caches might provide previously resolved answers, but the authoritative server gives the final and trusted response.

Correct answer: C. C. decreases overall network complexity

Centralizing the control plane in software-defined networking decreases overall network complexity by allowing centralized management and consistent policy enforcement. Offloading virtual machines is a server concept, and cost reduction is a secondary benefit.

Correct answer: A. A. PortFast

PortFast allows an access port to bypass the listening and learning states, transitioning immediately to forwarding. BackboneFast and UplinkFast handle indirect and direct link failures, not initial device connections.

Correct answer: A. A. In IPsec tunnel mode, the entire original IP datagram is encrypted.

In IPsec tunnel mode, the entire original IP packet is encapsulated and encrypted. Transport mode only encrypts the payload, making the other options incorrect for site-to-site VPN design.

Correct answer: D. D. southbound interface

The southbound interface enables communication between the SDN controller and network devices to program forwarding behavior. Northbound interfaces connect the controller to upper-level applications and management programs.

Correct answer: B. B. Router IP address

HSRP default elections are decided by the highest IP address because all routers share the default priority of one hundred. If priorities are manually changed, the highest priority wins.

Correct answer: A. A. logging trap 5

Syslog severity level five includes notification messages and all higher-severity levels down to zero. The logging trap command sets this threshold, ensuring warnings, errors, and emergencies are forwarded to the server.

Correct answer: A. A. Provide data services faster.

Network automation deploys configurations and provisions services faster by reducing manual intervention and repetitive tasks. While other options provide technical features, accelerating service delivery is the primary business driver for adopting automation.

Correct answer: B. B. TCP establishes a connection prior to sending data, and UDP sends immediately

Transmission Control Protocol establishes a session using a three-way handshake before sending data, whereas User Datagram Protocol sends data immediately without a connection. This connection state difference distinguishes reliable from best-effort delivery.

Correct answer: D. D. It is used in place of 802.11b/g when many nonoverlapping channels are required

The 802.11a standard operates in the 5 GHz band, providing significantly more non-overlapping channels than 2.4 GHz. The 2.4 GHz band is highly susceptible to interference from common devices like microwaves.

Correct answer: C. C. switchport mode trunk switchport trunk encapsulation dot1q switchport trunk allowed vlans 1-10

The switchport mode trunk command combined with dot1q encapsulation meets the industry-standard requirement. The trunk allowed vlans command restricts traffic to the specified VLANs, filtering the rest.

Correct answer: C. C. The Layer 2 switch floods packets to all ports except the receiving port in the given VLAN.

When a switch receives a frame with an unknown unicast destination MAC, it floods the frame to all ports in the same VLAN except the receiving port. This ensures the frame reaches its intended destination if it exists on the local segment.

Correct answer: C. C. config serial timeout 0

The command config serial timeout zero disables the inactivity timeout for the console session on a wireless LAN controller. This configuration prevents the system from automatically logging out a connected serial user.

Correct answer: A. A. conserve public IPv4 addressing

RFC 1918 defined private IPv4 address ranges to conserve public IPv4 addressing. By allowing organizations to reuse internal addresses that are not routed on the internet, global public IPv4 consumption was significantly reduced.

Correct answer: C. C. identifies the type of traffic that will receive a particular treatment

The purpose of classifying network traffic in Quality of Service is to identify the type of traffic so that it can receive the appropriate treatment like priority queuing. The distractors incorrectly describe the subsequent steps of matching, servicing, and marking.

Correct answer: A. A. user awareness

This scenario describes a user awareness program where the company intentionally sends simulated phishing links. These programs are designed to train employees to recognize potentially malicious emails and improve security behavior without causing real harm.

Correct answer: B. B. Straight-through

A router Ethernet port and a switch port traditionally use opposite transmit and receive pin pairs. Therefore, a straight-through cable is required to connect them when automatic medium-dependent interface crossover is not in play.

Correct answer: D. D. Lack of available publicly routable unique IPv4 address

Private IPv4 addressing was defined to solve the shortage of publicly routable unique IPv4 addresses. By allowing internal address reuse, organizations conserve their limited public IP space. Options mentioning IPv5 or security protocols are invalid distractors.

Correct answer: A. A. TKIP/MIC encryption

Temporal Key Integrity Protocol and Message Integrity Check encryption are core features of WPA, designed to replace vulnerable WEP encryption. Preshared keys are a WPA mode, not a structural feature, while eighty-two point one x applies to enterprise security.

Correct answer: C. C. configure switchport mode dynamic auto

Configuring switchport mode dynamic auto allows a switch port to become a trunk if the neighboring switch is actively set to trunk or desirable mode. Dynamic auto will never actively initiate trunk negotiations, relying entirely on the neighbor to start the process.

Correct answer: D. D. One functional physical port is needed to pass client traffic.

When link aggregation is enabled on a wireless controller, only one functional physical port is required to pass client traffic. The other options present strict configuration requirements or bandwidth limitations that do not exist.

Correct answer: C. C. Transport

IPsec transport mode encrypts only the payload of an IP packet, leaving the original header intact. Tunnel mode encapsulates the entire original packet and adds a new IP header.

Correct answer: C. C. Assign all access ports to VLANs other than the native VLAN

Placing access ports in a voice or data VLAN separate from the native VLAN mitigates double-tagged VLAN hopping attacks. Dynamic ARP inspection specifically prevents spoofing attacks rather than VLAN hopping manipulations.

Correct answer: A. A. switch(config)#spanning-tree portfast default

The spanning-tree portfast default command globally enables PortFast on all access ports, allowing them to bypass listening and learning states. Option B only configures BPDU Guard, while the interface-level commands in C and D do not apply the global setting required.

Correct answer: A. A. frame flooding

When a switch receives a frame with an unknown destination MAC address, it forwards that frame out all ports within the same VLAN except the receiving port. This process is known as unknown unicast flooding, or simply frame flooding.

Correct answer: A. A. It records the source MAC address of incoming frames and associates it with the ingress port.

A switch dynamically builds its MAC address table by examining the source MAC address of incoming frames. It then maps that source address to the specific ingress port, allowing the switch to intelligently forward future traffic.

Correct answer: A. A. authentication

Authentication verifies the identity of communicating parties, preventing attackers from successfully impersonating a legitimate endpoint in a man-in-the-middle attack. Authorization, anti-replay, and accounting are secondary controls that assume identity has already been established.

Correct answer: A. A. STP

Spanning Tree Protocol can delay a workstation from receiving a DHCP address while a switch port transitions through listening and learning states. Configuring PortFast on access ports bypasses this delay.

Correct answer: B. B. An interface line has changed status

Syslog notice level corresponds to severity level five, which typically captures significant but normal operational events like an interface line changing status. Lower severity numbers denote more critical system emergencies that require immediate administrative intervention.

Correct answer: A. A. NETCONF

NETCONF is a network management protocol that uses remote procedure calls to push configuration changes over a secure SSH session. RESTCONF would be the alternative option, but it operates over standard HTTP methods instead of SSH.

Correct answer: A. A. 1 Hz signal

A one hertz signal completes one cycle per second, resulting in exactly sixty cycles over a full minute. Higher frequencies complete millions or billions of cycles, making them incorrect for this basic networking math concept.

Correct answer: C. C. They use automation to centralize network-management tasks.

Using automation to centralize traditional network-management tasks drastically reduces repetitive manual configurations and minimizes human error. Simply installing monitoring software or adding personnel does not inherently streamline the actual maintenance operations.

Correct answer: B. B. control plane

The control plane builds the routing and MAC tables that feed the data plane. Avoid choosing the data plane, because it only forwards traffic based on those precomputed tables.

Correct answer: C. C. full mesh

A full mesh topology provides multiple redundant paths between all sites by directly connecting every node. This ensures maximum reliability because traffic can immediately reroute if a single link fails.

Correct answer: B. B. ntp master

The NTP master command configures a device to act as an authoritative NTP server. This allows it to provide time synchronization to other network clients even without an external clock source.

Correct answer: D. D. SNMPv3

Simple Network Management Protocol version three provides authentication and encryption features. This offers the highest security for device monitoring by protecting the confidentiality and integrity of management traffic.

Correct answer: D. D. show ip ospf database

The show ip ospf database command displays the OSPF link-state database. This proves the correct answer because it lists all link-state advertisements known to the router.

Correct answer: D. D. Full

The Full state confirms that OSPF routers have fully synchronized their link-state databases. The 2-way state only indicates neighbor discovery and is used between non-designated routers.

Correct answer: B. B. The switch floods the frame to all ports in the VLAN except the port that received the frame.

When a destination MAC address ages out of the CAM table, the switch loses the forwarding entry and treats the frame as unknown unicast. It floods the frame to all ports within the same VLAN except the ingress port.

Correct answer: A. A. Authentication identifies and verifies a user who is attempting to access a system, and authorization controls the tasks the user performs.

Authentication proves identity, while authorization defines permitted actions for verified users. Incorrect options confuse accounting with authorization or mix password validation tasks incorrectly.

Correct answer: C. C. It is the best path to the root from a nonroot switch.

In spanning tree protocol, the root port on a nonroot switch provides the lowest cost path to the root bridge. The root port is actively forwarding, which eliminates failover or disabled options.

Correct answer: B. B. point-to-point

OSPF defaults to the point-to-point network type on serial interfaces using PPP encapsulation. This network type skips the DR and BDR election process, which eliminates the broadcast and nonbroadcast options.

Correct answer: C. C. It associates the source MAC address with the LAN port on which it was received and saves it to the MAC address table.

Switches dynamically learn MAC addresses by examining incoming frames. The switch records the source MAC address and ingress port in the MAC address table, allowing future frames destined for that address to be forwarded.

Correct answer: A. A. lldp run

The command lldp run is entered in global configuration mode to enable Link Layer Discovery Protocol globally on a Cisco device. The other commands either apply to CDP or are used for specific interface-level configurations.

Correct answer: D. D. ip helper-address

The ip helper-address command is configured on a router interface to forward local DHCP broadcast messages to a remote server. The ip dhcp pool command creates a local server, while the other options do not provide relay functionality.

Correct answer: C. C. administrative distance

A router uses administrative distance to select the best path when multiple routing protocols advertise the same destination. The metric only breaks ties within the same routing protocol, not across different sources.

Correct answer: A. A. It eliminates the need to configure each access point individually.

A wireless LAN controller eliminates the need to configure each lightweight access point individually by providing centralized management. The controller does not manage autonomous access points in this architecture.

Correct answer: A. A. 0000.5E00.010a

Virtual Router Redundancy Protocol uses a standardized MAC address prefix of 0000.5E00.01, with the last byte representing the group number. Option A matches this pattern exactly, while the others belong to HSRP or other protocols.

Correct answer: C. C. route with the lowest administrative distance

When a router learns the exact same network from multiple routing protocols, it selects the route with the lowest administrative distance. Metrics like cost or hop count only compare paths learned from a single routing protocol.

Correct answer: D. D. 6

Syslog severity level six corresponds to informational messages, which provide routine operational data about the system. Lower levels like zero or two represent much more critical emergencies and warnings.

Correct answer: C. C. A leaf switch can be added with connections to every spine switch.

A spine-and-leaf architecture scales horizontally by adding a leaf switch that connects to every spine switch. This maintains consistent latency and equal-cost multipath routing while avoiding the bottleneck of adding spines.

Correct answer: D. D. forwarding remote client/server traffic

The data plane is responsible for forwarding actual user traffic between interfaces based on routing and MAC tables. Control plane processes like SSH, OSPF hellos, and spanning-tree elections manage the router state.

Correct answer: B. B. a wireless LAN controller

A wireless LAN controller provides centralized management of authentication, security policies, and client roaming across multiple lightweight access points. Lightweight APs handle the radio frequency but rely on the controller.

Correct answer: B. B. Internal EIGRP

When multiple routing protocols learn the same route, the router installs the route with the lowest administrative distance. Internal EIGRP has a default AD of 90, beating OSPF at 110 and RIP at 120.

Correct answer: A. A. biometric

Biometric authentication requires a physical characteristic such as a fingerprint or retina scan. This represents the something you are authentication factor. Multifactor combines several methods rather than relying on a physical trait.

Correct answer: A. A. It allows and denies ingress and egress traffic.

A firewall enforces security policies by explicitly allowing or denying inbound and outbound traffic. Modern firewalls typically use stateful inspection, which eliminates the stateless option, and they do not act as default gateways.

Correct answer: D. D. manifests and modules

Puppet relies on manifests and modules to enforce configuration state. You can eliminate Chef and Ansible traps, because they use cookbooks and playbooks respectively.

Correct answer: A. A. VRRP

VRRP is the open standard protocol that ensures traffic continues if the default gateway fails. You must eliminate HSRP and GLBP, because those are Cisco proprietary protocols.

Correct answer: D. D. provide an application that is transmitted over HTTP

A web server hosts and delivers web applications or content to clients using HTTP. The other options describe email, FTP, and authentication servers, which serve completely different primary purposes.

Correct answer: B. B. crypto key generate rsa

The crypto key generate rsa command is used to generate the RSA key pair required for SSH on a Cisco device. SSH relies on these keys for encryption and secure remote access.

Correct answer: B. B. a port security violation

A port security violation places a port into an err-disabled state to protect the network. Avoid choosing shutdown, because an administrator issues that command rather than the switch.

Correct answer: D. D. user awareness training

User awareness training directly addresses the human factor exploited in phishing attacks. Technical controls like software firewalls or email patches cannot fully mitigate a user willingly clicking a malicious link.

Correct answer: A. A. Discovery response

When an access point attempts to join a controller, it first sends a CAPWAP discovery request. The controller then replies from its AP-manager interface with a discovery response.

Correct answer: D. D. Port blocking

Spanning Tree Protocol prevents Layer 2 loops by placing redundant switch ports into a blocking state. This ensures only one active forwarding path exists between network segments, preventing continuous frame circulation.