In an Ethernet LAN,
before transmitting, a computer first listens to the network media. If the media is idle, the computer
sends its data. If the media is not idle (another station is talking), the computer must wait for some
time.
When a station transmits, the signal is referred to as a carrier. Carrier Sense means that before a
station can send data onto an Ethernet wire, it have to listen to see if another “carrier” (of another
station) is present. If another station is talking, this station will wait until there is no carrier present.
Multiple Access means that stations can access the network at any time. It is opposed to Token-Ring
network where a station must have the “token” so that it can send data.
Although Carrier Sense help two stations not send data at the same time but sometimes two stations
still send data at the same time! This is because two stations listen for network traffic, hear none, and
transmit simultaneously -> a collision occurs and both stations must retransmit at some later
time. Collision Detection is the ability of the media to detect collisions to know that they must
retransmit.
+ A device that wants to send a frame must wait until the LAN is silent (no one is “talking”)
+ If a collision still occurs, the devices that caused the collision wait a random amount of time and
then try to send data again.
Note: A switch separates each station into its own collision domain. It means that station can send
data without worrying its data is collided with the data of other stations. It is as opposed to a hub
which can cause collision between stations connected to it.
Only two commands “show interfaces” and “show ip interface brief” reveal the status of router
interfaces (up/up, for example).
Explanation
HTTP is based on TCP connection so a TCP connection must be established first between the
workstation and the web server.
Question 4
Explanation
Hubs do not separate collision domains so if hub is used in the topology above, we will have only 1
collision domain. Switches do separate collision domains so if hubs are replaced by switches, we would
have 22 collision domains (19 collision domains for hosts and 3 collision domains among three
switches. Please notice that the WAN (serial) connection is not counted as a collision (or broadcast)
domain.
Question 5
Explanation
A broadcast storm can cause congestion within a network. For more information about broadcast
storm please read my STP tutorial.
Question 6
Explanation
Before a host can send ICMP (ping) packets to another device, it needs to learn the MAC address of
the destination device so it first sends out an ARP Request. In fact, the first ping packet is dropped
because the router cannot create a complete packet without learning the destination MAC address.
Question 7
Explanation
Question 8
Question 9
Question 10
Explanation
Full-duplex communication allows both sending and receiving of data simultaneously. Switches provide
full-duplex communication capability. Half-duplex communication only allows data transmission in only
one direction at a time (either sending or receiving).
Explanation
Only a router or a Layer 3 switch can mitigate a broadcast storm because they separate broadcast
domains -> B and D are correct.
Question 2
Explanation
AREA 1 has “multiple collision domains” so Network Device A must be a device operating in Layer 2 or
above (a router or switch) -> A & E are correct.
AREA 2 only has “single collision domain” so Network Device B must be a device operating in Layer 1
(a hub or repeater) -> D is correct.
Question 3
Explanation
The “Ctrl-Shift-6” and “x” is used to suspend the telnet session. In this case, the telnet session from
Router1 to Router2 will be suspended.
If we enter the keyword “resume”, Router1 will try to resume the telnet session to Router2 (you will
see the line [Resuming connection 1 to 192.168.9.2 … ]) and we will get back the Router2>
prompt.
Question 4
Explanation
In the topology above only routers and switches are used so for each link we have one collision
domains. In the picture below each pink ellipse represents for one collision domain.
Question 5
Explanation
Star topology is the most popular topology for the network which allows all traffic to flow through a
central device.
Question 6
Question 7
Explanation
Carrier Sense Multiple Access with Collision Detection (CSMA/CD) is the LAN access method used in
Ethernet. When a device wants to gain access to the network, it checks to see if the network is free. If
the network is not free, the device waits a random amount of time before retrying. If the network is
free and two devices access the line at exactly the same time, their signals collide. When the collision
is detected, they both back off and wait a random amount of time before retrying.
CSMA/CD is used with devices operating in half-duplex mode only. CSMA/CD helps devices connecting
to half-duplex switch ports operate correctly.
Question 8
Explanation
Ethernet frame size refers to the whole Ethernet frame, including the header and the trailer while MTU
size refers only to Ethernet payload. Baby giant frames refer to Ethernet frame size up to 1600 bytes,
and jumbo frame refers to Ethernet frame size up to 9216 bytes (according to this
link: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-4000-series-switches/29805-
175.html)
For example, standard Ethernet frame MTU is 1500 bytes. This does not include the Ethernet header
and Cyclic Redundancy Check (CRC) trailer, which is 18 bytes in length, to make the total Ethernet
frame size of 1518.
So according to strict definition, MTU size of 1600 cannot be classified as baby giant frames as the
whole Ethernet frames will surely larger than 1600 -> Answer C is not correct.
Answer D is a better choice as the MTU is 1518, so the whole Ethernet frame would be 1536 (1518 +
18 Ethernet header and CRC trailer). This satisfies the requirement of baby giant frames “Baby giant
frames refer to Ethernet frame size up to 1600 bytes”.
Question 9
Question 10
Question 11
Explanation
To remember which type of cable you should use, follow these tips:
For example: we use straight-through cable to connect switch to router, switch to host, hub to host,
hub to server… and we use crossover cable to connect switch to switch, switch to hub, router to
router, host to host… )
Notice in this question, connecting to the Frame Relay means connecting to another router. Also we
must use serial cable (or Fiber Optic cable) because the distance to the Frame Relay is far so we can’t
use Ethernet cables.
Rollover cable can be used to connect a computer terminal to a network router’s console port. This is
often used when we turn on the router for the first time.
Question 12
Question 13
Question 14
Question 15
Explanation
Both switch and router separate collision domains. In other words, each port of the switch and router
creates one collision domain so we have 15 collision domains in this topology.
Question 1
Question 2
Explanation
CDP runs at Layer 2 (Data Link) of the OSI model -> E is correct.
Question 3
Explanation
SMTP stands for Simple Mail Transfer Protocol. It’s a set of communication guidelines that allow
software to transmit email over the Internet while File Transfer Protocol (FTP) is a standard network
protocol used to transfer files from one host to another host over TCP-based network.
Note: Simple Network Management Protocol (SNMP) uses UDP as the transport protocol for passing
data between managers and agents. SNMP uses UDP to help reduce the impact on your network’s
performance. Although SNMP can be configured to run on TCP but we should only do it in special
situations. SNMP uses the UDP port 161 for sending and receiving requests, and port 162 for receiving
traps from managed devices.
DNS work on both the TCP and UDP protocols. DNS uses TCP for zone exchanges between servers and
UDP when a client is trying to
resolve a hostname to an IP address. Therefore in most cases we say “DNS uses UDP”.
Question 4
Explanation
The primary function of an access-layer is to provide network access to the end user.
The hardware and software attributes of the access layer that support high availability include security
services for additional security against unauthorized access to the network through the use of tools
such as 802.1x, port security, DHCP snooping, Dynamic ARP Inspection, and IP Source Guard.
Question 5
Explanation
The picture below compares the two TCP/IP and OSI models:
Question 6
Explanation
Transmission Control Protocol (TCP) has all the features mentioned above and TCP resides in
Transport Layer (Layer 4) of the OSI model.
Flow control: A methodology used to ensure that receiving units are not overwhelmed with data from
sending devices when buffers at a receiving unit are full, a message is transmitted to the sending unit
to temporarily halt trans-missions until all the data in the receiving buffer has been processed and the
buffer is again ready for action.
Sequencing: is used to number segments before sending so they can be put back together again in
the correct order at the receiving side.
Acknowledgment: When the receiver gets the data, it sends a response telling the sender that the
data have been safely arrived.
Question 7
Explanation
In CCNA, the popular devices operate in Layer 1 are hub and repeater.
Question 8
Question 9
Explanation
Three types of flow control are buffering, windowing & congestion avoidance:
+ Buffering: If a device receives packets too quickly for it to handle then it can store them in a
memory section called a buffer and proceed them later.
+ Windowing: a window is the quantity of data segments that the transmitting device is allowed to
send without receiving an acknowledgment for them. For example:
With the window size of 1, the sending device sends 1 segment and the receiving device must reply
with 1 ACK before the sending device can send the next segment. This “waiting” takes some time.
By increasing the window size to 3, the sending device will send up to 3 segments before waiting an
ACK -> helps reduce the waiting time.
+ Congestion avoidance: lower-priority traffic can be discarded when the network is overloaded ->
minimize delays.
Question 2
Question 3
Explanation
HTTP is based on TCP connection so a TCP connection must be established first between the
workstation and the web server.
Question 4
Explanation
Before two computers can communicate over TCP, they must synchronize their initial sequence
numbers (ISN) -> B is correct.
TCP uses a sequence number to identify each byte of data. The sequence number identifies the order
of the bytes sent from each computer so that the data can be reconstructed in order, regardless of
any fragmentation, disordering, or packet loss that may occur during transmission -> D is correct.
Question 5
Question 6
Explanation
Each port on a switch is a collision domain while each VLAN is a broadcast domain because broadcast
is only forwarded within that VLAN so we have 48 collision domains and 4 broadcast domains on this
switch (if all ports are used).
Question 2
Question 3
Explanation
When a switch receives a frame, it first checks for the destination MAC address and tries to find a
matching entry in its MAC address table. If found, the switch then forwards that frame on the
corresponding port associated with that MAC address. If no entry is found, the switch will flood that
frame out of all (active) ports except the port that sent it.
Question 4
Question 5
Question 6
Explanation
A hub is not as “intelligent” as a switch because a hub does not try to remember anything passing to
it. It just floods out all the ports (except the one that sent it) when it receives a frame.
Question 7
Explanation
When a switch receives a frame, it first checks for the destination MAC address and tries to find a
matching entry in its MAC address table. If found, the switch then forwards that frame on the
corresponding port associated with that MAC address. If no entry is found, the switch will flood that
frame out of all active ports except the port that sent it. In this case, the destination MAC address
0000.00dd.dddd has not been in the MAC address table so the switch will flood the frame out all of its
ports except fa0/0 (the port that it received the frame) -> D is correct.
Also, the switch learns that the MAC address 0000.00aa.aaaa is received on fa0/0 -> the switch adds
0000.00aa.aaaa and its corresponding port fa0/0 to the MAC address table -> A is correct.
Question 8
Explanation
The destination MAC address is ffff.ffff.ffff so this is a broadcast frame so the switch will forward the
frame out all active switch ports except for port fa0/0.
Question 9
Explanation
In this case the destination MAC address has been learned so the switch just forwards the frame to
the corresponding port. It also learn that the source MAC address of host A has not been existed in
the MAC address table so it will add it (and port fa0/3) to its MAC address table.
Question 10
Question 11
Question 12
Question 13
Explanation
The system LED shows whether the system is receiving power and functioning properly. Below lists
the LED colors and meanings:
Color System Status
(Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/hardware/installation/guide
/hgovrev.html)
Question 14
Explanation
In this case the destination MAC address has been learned so the switch just forwards the frame to
the corresponding port. It also learn that the source MAC address of host A has not been existed in
the MAC address table so it will add it (and port fa0/3) to its MAC address table.
Question 2
Question 3
Explanation
All ports on a Layer 2 switch are in the same broadcast domain. Only router ports separate broadcast
domains.
Question 4
Explanation
When you connect an IP phone to a switch using a trunk link, it can cause high CPU utilization in the
switches. As all the VLANs for a particular interface are trunked to the phone, it increases the number
of STP instances the switch has to manage. This increases the CPU utilization. Trunking also causes
unnecessary broadcast / multicast / unknown unicast traffic to hit the phone link.
In order to avoid this, remove the trunk configuration and keep the voice and access VLAN configured
along with Quality of Service (QoS). Technically, it is still a trunk, but it is called a Multi-VLAN
Access Port (MVAP). Because voice and data traffic can travel through the same port, you should
specify a different VLAN for each type of traffic. You can configure a switch port to forward voice and
data traffic on different VLANs. Configure IP phone ports with a voice VLAN configuration. This
configuration creates a pseudo trunk, but does not require you to manually prune the unnecessary
VLANs.
The voice VLAN feature enables access ports to carry IP voice traffic from an IP phone. You can
configure a voice VLAN with the “switchport voice vlan …” command under interface mode. The full
configuration is shown below:
Switch(config)#interface fastethernet0/1
Switch(config-if)#switchport mode access
Switch(config-if)#switchport access vlan 10
Switch(config-if)#switchport voice vlan 20
Reference: http://www.cisco.com/c/en/us/support/docs/switches/catalyst-4500-series-
switches/69632-configuring-cat-ip-phone.html
Question 5
Explanation
When a switch receives a frame, it first checks for the destination MAC address and tries to find a
matching entry in its MAC address table. If found, the switch then forwards that frame on the
corresponding port associated with that MAC address. If no entry is found, the switch will flood that
frame out of all (active) ports except the port that sent it.
Question 6
Explanation
The system LED shows whether the system is receiving power and functioning properly. Below lists
the LED colors and meanings:
(Reference: http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/hardware/installation/guide
/hgovrev.html)
Question 7
Explanation
Question 8
Explanation
When a switch receives a frame, it first checks for the destination MAC address and tries to find a
matching entry in its MAC address table. If found, the switch then forwards that frame on the
corresponding port associated with that MAC address. If no entry is found, the switch will flood that
frame out of all active ports except the port that sent it. In this case, the destination MAC address
0000.00dd.dddd has not been in the MAC address table so the switch will flood the frame out all of its
ports except fa0/0 (the port that it received the frame) -> D is correct.
Also, the switch learns that the MAC address 0000.00aa.aaaa is received on fa0/0 -> the switch adds
0000.00aa.aaaa and its corresponding port fa0/0 to the MAC address table -> A is correct.
Question 9
Explanation
In short, TCAM (Ternary Content Addressable Memory) is used for faster IP look up while ARP table is
Layer3 address to Layer2 address resolution so they are not correct.
The Content Addressable Memory (CAM) table on a switch keeps track of MAC addresses and on what
port they appear, along with some other stuff like age. When a device that’s plugged into a particular
port sends a frame to the switch, the switch makes note of the source MAC and the port and checks
the CAM table. Notice that the CAM table is built on the source MAC addresses (while the destination
MAC addresses are ignored).
Explanation
A broadcast storm can cause congestion within a network. For more information about broadcast
storm please read my STP tutorial.
Question 2
Explanation
The primary function of an access-layer is to provide network access to the end user.
The hardware and software attributes of the access layer that support high availability include security
services for additional security against unauthorized access to the network through the use of tools
such as 802.1x, port security, DHCP snooping, Dynamic ARP Inspection, and IP Source Guard.
Explanation
With the configuration above, when we type “do show vlan” we would not see VLAN 10 in the VLAN
database because it has not been created yet. VLAN 10 is only created when we exits VLAN
configuration mode (with “exit” command).
Question 2
Explanation
Control plane traffic (like CDP, VTP, STP…) runs on VLAN 1 by default. They are not blocked on the
native VLAN -> Answer C is not correct.
If the answer says “the native VLAN should be set so that no real traffic running on it for security
reasons” then it is correct but the native VLAN is not typically disabled -> Answer D is not correct.
CDP runs on VLAN 1 by default and the native VLAN is also VLAN 1 by default so answer A is the best
choice here.
Question 3
Explanation
IEEE 802.1Q is the networking standard that supports virtual LANs (VLANs) on an Ethernet network.
When a frame enters the VLAN-aware portion of the network (a trunk link, for example), a VLAN ID
tag is added to represent the VLAN membership of that frame. The picture below shows how VLAN tag
is added and removed while going through the network.
Question 4
Question 5
Explanation
The VLANs 0 and 4095 are reserved by the IEEE 802.1Q standard and you cannot create, delete, or
modify them so they are the correct answers.
Note:
+ VLAN 0 and 4095 are reserved for system use only. You cannot see or use these VLANs.
+ VLAN 1 and VLANs 1002-1005 are default VLANs. Default VLANs are created automatically and
cannot be configured or deleted by users.
+ VLAN 2 to 1001 are normal VLANs. You can create, use and delete them.
+ VLAN 1002 to 1005 are normal VLANs too but Cisco reserved for FDDI an Token Ring. You cannot
delete these VLANs.
+ VLAN 1006 to 4094 are extended VLANs (for Ethernet VLANs only)
Question 6
Explanation
By default, port security limits the MAC address that can connect to a switch port to one. If the
maximum number of MAC addresses is reached, when another MAC address attempting to access the
port a security violation occurs.
Question 2
Explanation
Shutdown is the default switch port port-security violation mode. When in this mode, the switch will
automatically force the switchport into an error disabled (err-disable) state when a violation occurs.
While in this state, the switchport forwards no traffic. The switchport can be brought out of this error
disabled state by issuing the errdisable recovery cause CLI command or by disabling and re-enabling
the switchport.
Question 3
Question 4
Question 5
Explanation
When packets travel through many routers, the source and destination IP addresses do not change
but the source and destination MAC do change.
Question 2
Explanation
The output above is unclear. Normally when we use this command we can see the type of serial
connection on this interface, for example “V.35 DCE cable. Below is an example of the same command
as above:
but in this case we only get “V.35 cable”. So in fact we are not sure about the answer C. But the
output above also does not have any information to confirm other answers are correct or not.
Just for your information, the V.35 male and V.35 female cable are shown below:
Question 3
Question 4
Question 5
Explanation
The outputs of “show protocols” and “show ip interface” are shown below:
Global values:
Internet Protocol routing is enabled
Serial0/0 is up, line protocol is down
Internet address is 10.1.1.1/30
Serial0/1 is up, line protocol is down
Internet address is 209.65.200.225/30
Serial0/2 is up, line protocol is down
Serial0/3 is up, line protocol is down
NVI0 is up, line protocol is up
Interface is unnumbered. Using address of NVI0 (0.0.0.0)
Loopback0 is up, line protocol is up
Internet address is 10.1.10.1/32
Loopback1 is up, line protocol is up
Internet address is 10.1.2.1/27
Loopback6 is up, line protocol is up
Question 6
Explanation
The “Ctrl-Shift-6” and “x” is used to suspend the telnet session. In this case, the telnet session from
Router1 to Router2 will be suspended.
If we enter the keyword “resume”, Router1 will try to resume the telnet session to Router2 (you will
see the line [Resuming connection 1 to 192.168.9.2 … ]) and we will get back the Router2>
prompt.
Question 7
Explanation
The Layer 2 information (source and destination MAC) would be changed when passing through each
router. The Layer 3 information (source and destination IP addresses) remains unchanged.
Question 8
Explanation
When packets travel through many routers, the source and destination IP addresses do not change
but the source and destination MAC do change.
Question 9
Explanation
Change the configuration register to 0x2142. With this setting when that router reboots, it bypasses
the startup-config and no password is required.
Question 10
Explanation
Each interface on a router must be in a different network. If two interfaces are in the same network,
the router will not accept it and show error when the administrator assigns it.
Question 2
Question 3
Question 4
Question 5
Explanation
From the output of the “show version” command, we learn that there are only 2 FastEthernet
interfaces (2 FastEthernet/IEEE 802.3 interfaces) and this router does not have any Ethernet interface
so an error will occur when we enter the “interface e0” command.
Question 6
Question 7
Question 8
Question 9
Question 10
Explanation
The “exec-timeout” command is used to configure the inactive session timeout on the console port or
the virtual terminal. The syntax of this command is:
Therefore we need to use the “exec-timeout 30” command to set the user inactivity timer to 30
minutes. To set the user inactivity timer to 30 seconds we use the “exec-timeout 0 30”.
Question 11
Explanation
On each router interface we can only assign one primary IPv4 address (but we can assign many IPv6
addresses).
Question 2
Explanation
ACL Logging means to use the “log” or “log-input” parameters at the end of the ACL statements. For
example: “access-list 100 deny icmp any any echo reply log-input”. In either situation, remember that
using either of these two parameters disables CEF switching, which seriously impacts the performance
of the router.
Explanation
CDP runs at Layer 2 so it can recognize a switch (if that switch also runs CDP).
Question 2
Explanation
Cisco Discovery Protocol (CDP) is a proprietary protocol of Cisco so if you can see the VoIP phone via
the “show cdp neighbors” command on a Cisco switch then that phone is from Cisco.
Question 3
Explanation
CDP runs at Layer 2 (Data Link) of the OSI model -> E is correct.
Question 4
Explanation
File Transfer Protocol (FTP) is a standard network protocol used to transfer files from one host to
another host over TCP-based network, such as the Internet.
Question 2
Explanation
Cisco Discovery Protocol (CDP) is a proprietary protocol of Cisco so if you can see the VoIP phone via
the “show cdp neighbors” command on a Cisco switch then that phone is from Cisco.
Question 3
Explanation
User Datagram Protocol (UDP) provides a connectionless datagram service that offers best-effort
delivery, which means that UDP does not guarantee delivery or verify sequencing for any datagrams.
UDP is typically used by programs that transmit small amounts of data at one time or have real-time
requirements (voice, for example).
Question 4
Explanation
CDP is a device discovery protocol that runs over Layer 2. We can view the CDP information with
the show cdp neighbors command (thus the provided information is at layer 2), notice this
command only shows information about directly connected devices. The output of the show cdp
neighborscommand is shown below:
Question 5
Explanation
After resolving a browser URL to an IP address (via DNS server), the workstation must learn the MAC
address of the server so that it can create a complete packet (a complete packet requires destination
MAC and IP address, source MAC and IP address). Therefore the workstation must use ARP to find out
the MAC address from the IP address.
Question 6
Explanation
Before two computers can communicate over TCP, they must synchronize their initial sequence
numbers (ISN) -> B is correct.
TCP uses a sequence number to identify each byte of data. The sequence number identifies the order
of the bytes sent from each computer so that the data can be reconstructed in order, regardless of
any fragmentation, disordering, or packet loss that may occur during transmission -> D is correct.
Question 7
Explanation
CDP runs at Layer 2 in the OSI model and it does not need an IP address to run -> C & D are not
correct.
Question 8
Explanation
Tracert (or traceroute) is used to trace the path between the sender and the destination host.
Traceroute works by sending packets with gradually increasing Time-to-Live (TTL) value, starting with
TTL value = 1. The first router receives the packet, decrements the TTL value and drops the packet
because it then has TTL value zero. The router sends an ICMP Time Exceeded message back to the
source. The next set of packets are given a TTL value of 2, so the first router forwards the packets,
but the second router drops them and replies with ICMP Time Exceeded. Proceeding in this way,
traceroute uses the returned ICMP Time Exceeded messages to build a list of routers that packets
traverse, until the destination is reached and returns an ICMP Echo Reply message -> C is correct.
Note: The TRACERT command on Windows Operating System uses ICMP while MAC OS X and Linux
TRACEROUTE use UDP.
Question 9
Question 10
ICND1 – IP Address
June 16th, 20174 comments
Question 1
Explanation
The RFC 1518 is Classless Interdomain Routing (CIDR). CIDR is a mechanism developed to help
alleviate the problem of exhaustion of IP addresses and growth of routing tables.
+ With the classful routing system, individual networks were either limited to 254 hosts (/24) or
65,534 hosts (/16). For many network enterprises, 254 hosts were not enough and 65,534 were too
large to be used efficiently.
+ Routing information overload. The size and rate of growth of the routing tables in Internet routers is
beyond the ability of current software (and people) to effectively manage.
+ Eventual exhaustion of IP network numbers.
In contrast to classful routing, which categorizes addresses into one of three blocks, CIDR allows for
blocks of IP addresses to be allocated to Internet service providers. The blocks are then split up and
assigned to the provider’s customers.
According to the CIDR standard, the first part of an IP address is a prefix, which identifies the
network. The prefix is followed by the host identifier so that information packets can be sent to
particular computers within the network. A CIDR address includes the standard 32-bit IP address and
also the network prefix. For example, a CIDR address of 200.1.45.2/26, the “/26” indicates the first
26 bits are used to identify the unique network, leaving the remaining bits to identify the specific
hosts.
Therefore, instead of assigning the whole block of a class B or C address, now smaller blocks of a class
can be assigned. For example, instead of assigning a whole block of 200.1.45.0/24, a smaller block,
like 200.1.45.0/27 or 200.1.45.32/27, can be assigned.
In fact, CIDR is specified in RFCs 1518,1519 and 1520 so answer “RFC 1519” is also acceptable.
Question 2
Explanation
In order to send traffic to multiple devices (not all) across different subnets we need to use multicast
addresses, which are in the range 224.0.0.0 through 239.255.255.255 -> D is correct.
Question 3
Question 4
Question 5
Question 6
Question 7
ICND1 – Subnetting
June 15th, 2017104 comments
Note: If you are not sure about Subnetting, please read my Subnetting Made Easy tutorial.
Question 1
Explanation
In fact we don’t need to find out the broadcast address because the question only asks about subnet
address (network address).
Question 2
Explanation
Question 3
Explanation
Question 4
Explanation
Therefore only 10.1.168.0, 10.1.174.255 and 10.1.160.255 are in this range. Please notice
10.1.174.255 is not a broadcast address and can be assigned to host.
Question 5
Explanation
Question 6
Explanation
In all the answers above, only answer C and D are in the same subnet.
Question 7
Explanation
Therefore the first usable IP address is 192.168.20.25 (assigned to the router) and the last usable IP
address is 192.168.20.30 (assigned to the sales server). The IP address of the router is also the
default gateway of the sales server.
Question 8
Explanation
The number of valid host IP addresses depends on the number of bits 0 left in the subnet mask. With
a /30 subnet mask, only two bits 0 left (/30 = 11111111.11111111.11111111.11111100) so the
number of valid host IP addresses is 22 – 2 = 2. Also please notice that the /30 subnet mask is a
popular subnet mask used in the connection between two routers because we only need two IP
addresses. The /30 subnet mask help save IP addresses for other connections. An example of the use
of /30 subnet mask is shown below:
Question 9
Explanation
-> The lowest (first assignable) host address is 10.16.2.1 and the broadcast address of the subnet is
10.16.3.255 255.255.254.0
Question 10
Explanation
ICND1 – Subnetting 2
June 15th, 201725 comments
Note: If you are not sure about Subnetting, please read my Subnetting Made Easy tutorial.
Question 1
Explanation
AREA 1 has 500 users but it uses class C which only supports 254 users (from 192.168.1.1 to
192.168.1.254)-> A is correct.
AREA 3 also uses class C and as mentioned above it supports 254 users so it is enough for 200 users -
> B is incorrect.
In AREA 2 there are only 60 users < 64 = 26 so we can use a subnet mask which has 6 bits 0 -> /26.
Of course we can use larger subnets (like /25) for future expansion -> C is correct.
A large network should never use a single network-wide mask. It should be some different subnet
masks to make the network flexible and easy to be summarized -> D is incorrect.
For router-to-router connection we should use a subnet mask of /30 which supports 2 hosts per
subnet. This subnet mask is ideal for router-to-router connection -> E is correct.
There is no limit for IP to function if we know how to organize our network -> F is incorrect.
Question 2
Explanation
The maximum number of hosts in this question is 50 hosts so we have to use /26 subnet mask or
above.
Question 3
Explanation
To support 300 workstations in a single broadcast domain, we need to use a subnet mask which
supports 512 hosts = 29 -> /23 or 255.255.254.0 in decimal form -> A is correct.
If we use 48-port switches we need 300/48 = 6.25 -> seven 48-port switches are enough because we
also need trunking between them -> D is correct.
We only need one router interface and it is connected with one of seven switches -> E is correct.
Question 4
Explanation
/19 = 255.255.224.0. The fast way to find out this subnet mask is to remember /16 = 255.255.0.0
and we need 3 more bits 1 for 3rd octet: 1110 0000 which is 224.
Question 5
Question 6
Explanation
-> The lowest (first assignable) host address is 10.16.2.1 and the broadcast address of the subnet is
10.16.3.255 255.255.254.0
Question 7
Explanation
Increment: 32
Question 8
Question 9
Question 10
Question 11
Explanation
The IP address of host B must be in the range of 192.168.10.32/28 subnet, which ranges from
192.168.10.32 to 192.168.10.47 (Increment: 16), except the IP addresses of 192.168.10.32,
192.168.10.46 (which are the network and broadcast addresses of the subnet), 192.168.10.33,
192.168.10.34 (which have been assigned to the interface’s router and the switch). Therefore there
are only two IP addresses of 192.168.10.38 & 192.168.10.46.
Question 12
Question 13
Question 14
Question 15
Explanation
From the /28 we can find all information we need:
In fact we don’t need to find out the broadcast address because the question only asks about subnet
address (network address).
ICND1 – IP Routing
June 14th, 201755 comments
Note: The ICND1 exam requires candidates to understand basic knowledge of dynamic routing
protocols (RIP, EIGRP, OSPF).
Question 1
Question 2
Explanation
By default, Cisco routers do not forward broadcast address. So what will happen if your PC does not in
the same LAN with DHCP Server? Your PC (also a DHCP Client) will broadcast a packet but it is
dropped by the router -> Your PC cannot get the IP from DHCP Server. So the “ip helper-address”
command enables the DHCP broadcast to be forwarded to the DHCP server. For example, the IP
address of your DHCP Server is 10.10.10.254 then we can type in the interface connecting with the
DHCP Client (fa0/0 in this case) this command: “ip helper-address 10.10.10.254”.
Note: When a client boots up for the first time, it transmits a DHCPDISCOVER message on its local
physical subnet. Because the client has no way of knowing the subnet to which it belongs, the
DHCPDISCOVER is an all-subnets broadcast (destination IP address of 255.255.255.255, which is a
layer 3 broadcast address). The client does not have a configured IP address, so the source IP address
of 0.0.0.0 is used.
Question 3
Explanation
Routers do not look to the destination MAC address to forward packet. It will find the next destination
MAC address itself to replace the old destination MAC address of the received packet.
Hubs do not care about MAC addresses, it just flood the frames out of all its port except the port that
sent it.
Therefore only three switches in the exhibit above use destination MAC address to determine the next
hops.
Question 4
Explanation
The destination MAC address at point A must be the MAC address of the interface fa0/0 of Toronto
router -> E is correct.
Question 5
Explanation
Therefore the purpose of this command is to send any packets with destination IP address in the
range of 192.168.100.160/27 subnet to 192.168.10.2. In fact, answer C is a bit weird when saying
“host 192.168.100.160” because 192.168.100.160 is the network address in this case and it cannot
be assigned to a host. But answer C is the most suitable answer for this question.
Question 6
Question 7
Explanation
After receiving a packet, the router will keep the source and destination IP addresses while change the
source MAC address (to the MAC address of its outgoing interface) and the destination MAC address
(to the MAC address of the next-hop interface). Therefore when the packet reaches host B, the source
MAC address must be the MAC address of the outgoing interface of R1.
Question 8
Explanation
Host A knows the IP address of Host B but it does not know the MAC address of host B, so it have to
create an ARP Request (which is a broadcast frame) to ask for the MAC address of host B. When
Router1 receives this ARP Request, it answers with its own MAC address.
Question 9
Question 10
Explanation
Along the routing path, the source and destination IP address will not change so the source IP will
always be 10.1.1.16.
ICND1 – IP Routing 2
June 14th, 201755 comments
Note: The ICND1 exam requires candidates to understand basic knowledge of dynamic routing
protocols (RIP, EIGRP, OSPF).
Question 1
Explanation
After receiving a packet, the router will keep the source and destination IP addresses (10.1.3.3 and
10.1.2.2, respectively) while change the source MAC address (to the MAC address of its outgoing
interface) and the destination MAC address (to the MAC address of the next-hop interface). Therefore
when the packet leaves Router1, the source MAC address must be the MAC address of the outgoing
interface of Router1 (0000.000c.0124) and the destination MAC address must be the MAC of fa0/1 of
R2 (0000.000c.0123).
Question 2
Explanation
A static route with 0.0.0.0 0.0.0.0 will become a default route. The default route means: “send all
traffic to this IP address”. So the default route “ip route 0.0.0.0 0.0.0.0 172.16.2.2” will send all traffic
to 172.16.2.2.
Question 3
Explanation
The Administrative Distance (AD) parameter must be put at the end of the “ip route” command. The
default AD is 1.
Question 4
Explanation
This router only have directly connected networks (symbolized by letter “C”) and one default route out
of Serial0/0. Maybe this is a stub router with only one connection to the Headquarter or to the
Internet.
Question 5
Explanation
In this topology, R2 is a stub router with only one connection to the HQ network so the best way to
configure routing is to set a static route (default route) to R1.
Question 6
Explanation
Host A is in a different subnet of SW-A so SW-A does not know how to send data to host A so it needs
to be assigned with a default gateway. The command to assign a default gateway to a switch is “ip
default-gateway “. Please notice this command only has effect when “ip routing” is disabled on SW-A.
Question 7
Explanation
The default gateway of Host A should be the connected interface of the router, except host A is
connected with a Layer 3 switch. In this case, Switch A is a pure Layer 2 switch and Switch A IP
address is just for management purpose.
Question 8
Question 9
Question 10
Explanation
The administrative distance of each protocol is compared to see if that route is better or not.
Question 11
Explanation
Letter “D” is used to symbolize for EIGRP (with a default AD of 90). Letter “E” is not used for EIGRP
because it has been used for Exterior Gateway Protocol (EGP) which is a obsolete routing protocol
now.
ICND1 – IP Routing 3
June 14th, 2017No comments
Note: The ICND1 exam requires candidates to understand basic knowledge of dynamic routing
protocols (RIP, EIGRP, OSPF).
Question 1
Question 2
Explanation
The Administrative Distance (AD) of popular routing protocols is shown below. You should learn them
by heart:
The smaller the AD is, the better it is. The router will choose the routing protocol with smallest AD.
Question 3
Question 4
Question 5
Question 6
Explanation
After resolving a browser URL to an IP address (via DNS server), the workstation must learn the MAC
address of the server so that it can create a complete packet (a complete packet requires destination
MAC and IP address, source MAC and IP address). Therefore the workstation must use ARP to find out
the MAC address from the IP address.
Question 7
Explanation
In this topology, R2 is a stub router with only one connection to the HQ network so the best way to
configure routing is to set a static route (default route) to R1.
Question 8
Question 9
Question 10
Explanation
Link-state protocol uses hello packets to discover neighbors and establish adjacencies. After that, the
routers begin sending out LSAs to every neighbor (each received LSA is copied and forwarded to every
neighbor except the one that sent the LSA)
Question 11
Explanation
When one route is advertised by more than one routing protocol, the router will choose to use the
routing protocol which has lowest Administrative Distance. The Administrative Distances of popular
routing protocols are listed below:
ICND1 – IP Routing 4
June 14th, 20171 comment
Note: The ICND1 exam requires candidates to understand basic knowledge of dynamic routing
protocols (RIP, EIGRP, OSPF).
Question 1
Question 2
Question 3
Explanation
RIP version 1 updates are broadcasts, and RIP version 2 updates are multicast to 224.0.0.9 -> B is
not correct.
RIP v1 is a classful routing protocol but RIP v2 is a classless routing protocol -> C is correct.
RIPv1 and RIPv2 have the same default administrative distance of 120 -> D is not correct.
RIPv2 is a classless routing protocol so it does send the subnet mask in updates -> F is not correct.
Question 4
Explanation
Host1 can ping the Serial interface of R2 because R1 has the network of 192.168.1.4/30 as directly
connected route. But R1 does not know how to route to the network of Host2 (192.168.1.128/26) so
R1 will drop that ping without trying to send it out S0/0 interface. To make the ping work, we have to
configure a route pointing to that network (for example: ip route 192.168.1.128 255.255.255.192
s0/0 on R1).
Question 5
Explanation
The route 192.168.5.0/24 currently has the metric of 15 so this router will add 1 hop count before
sending out to its neighboring router. With RIP, a metric of 16 means that network is down -> it will
not be installed in the routing table of the neighboring router.
Question 6
Question 7
Explanation
The passive interface only prevents routing updates from being sent and received on that interface. It
does not affect the default route. But if we configure a default route like this:
Then if the next-hop address is down (unreachable) then this default route would be removed from
the routing table.
Question 8
Question 1
Question 2
Question 3
Explanation
Answer A and C are obviously correct. For answer E, it allows extensive control of routing updates via
Link-State Advertisement (LSA). Administrators can filter these LSAs to meet their requirements
easily.
Question 4
Explanation
A is not correct because the backbone area of OSPF is always Area 0.
B is not correct because R1 or R3 must be the DR or BDR -> it has to establish neighbor adjacency
with the other.
C is not correct because OSPF neighbor relationship is not established based on static routing. It uses
multicast address 224.0.0.5 to establish OSPF neighbor relationship.
E is not correct because configure EIGRP on these routers (with a lower administrative distance) will
force these routers to run EIGRP, not OSPF.
D and F are correct because these entries must match on neighboring routers:
Question 5
Question 6
Explanation
The highest IP address of all loopback interfaces will be chosen -> Loopback 0 will be chosen as the
router ID.
Question 7
Explanation
OSPF uses a metric referred to as cost. The cost of the entire path is the sum of the costs of the
outgoing interfaces along the path. Cisco uses a simple formula to calculate OSPF cost:
Therefore, a 100 Mbps FastEthernet interface will have the cost of 10 8 / 100,000,000 (bps) = 1
Note: Cost for interfaces with bandwidth equal or larger than 10^8 bps is normalized to 1 so a 1Gbps
interface will also have OSPF cost of 1.
For “O 192.168.12.240 /30 [110/128] via 192.168.12.233, 00:35:36, Serial0″ line, the first number in
the brackets is the administrative distance of the information source; the second number is the metric
for the route -> In this case the second number is the OSPF cost.
Question 8
Explanation
There are 2 segments on the topology above which are separated by Corp-3 router. Each segment will
have a DR so we have 2 DRs.
To select which router will become DR they will compare their router-IDs. The router with highest
(best) router-ID will become DR. The router-ID is chosen in the order below:
+ If a loopback interface is not defined, the highest IP address of all active router’s physical interfaces
will be chosen.
In this question, the IP addresses of loopback interfaces are not mentioned so we will consider IP
addresses of all active router’s physical interfaces. Router Corp-4 (10.1.40.40) & Branch-2
(10.2.20.20) have highest “active” IP addresses so they will become DRs.
Question 9
Question 10
Explanation
We can use the “lease” command to specify the duration of the lease: lease {days [hours][minutes] |
infinite}
Question 2
Question 3
Explanation
The local router in this case is called a DHCP server. The main purpose of a DHCP server is to assign
IP addresses to the clients. Besides that, a DHCP server can also specify the IP address of the DNS
server and specify the domain name for the clients.
ICND1 – NAT/PAT
June 11th, 201738 comments
Note: If you are not sure about NAT/PAT, please read my Network Address Translation NAT Tutorial.
Question 1
Explanation
Port Address Translation (PAT) can support thousands of users connect to the Internet using only one
real global IP address. With PAT, each computer will be assigned a separate port number so that the
router can identify which computer should receive the return traffic.
Question 2
Explanation
The keyword “overload” specifies we are using NAT Overload (PAT) in which multiple internal hosts will
use only one IP address to access external network resources.
Question 3
Explanation
On the interface connecting to the Internet of the router we have to use the command “ip nat outside”
for NAT to work. It identifies that interface as the outside interface.
Question 4
Explanation
Static NAT: Designed to allow one-to-one mapping between local and global addresses. This flavor
requires you to have one real Internet IP address for every host on your network
Dynamic NAT: Designed to map an unregistered IP address to a registered IP address from a pool of
registered IP addresses. You don’t have to statically configure your router to map an inside to an
outside address as in static NAT, but you do have to have enough real IP addresses for everyone who
wants to send packets through the Internet. With dynamic NAT, you can configure the NAT router with
more IP addresses in the inside local address list than in the inside global address pool. When being
defined in the inside global address pool, the router allocates registered public IP addresses from the
pool until all are allocated. If all the public IP addresses are already allocated, the router discards the
packet that requires a public IP address.
In this question we only want to translate a single inside address to a single outside address so static
NAT should be used.
Question 5
Explanation
When we specify a NAT “inside” interface (via the “ip nat inside” command under interface mode), we
are specifying the source IP addresses. Later in the “ip nat” command under global configuration
mode, we will specify the access or route map for these source addresses.
after the keyword “source” we need to specify one of the three keywords:
+ list: specify access list describing local addresses (but this command does not require an “inside”
interface to be configured)
+ route-map: specify route-map
+ static: specify static local -> global mapping
Question 6
Question 7
Question 8
Question 9
Explanation
After configuring all the requirements for NAT, we need to apply them to “source interface” and
“outgoing” interface by going to the appropriate interfaces and type the “ip nat inside” and “ip nat
outside” commands.
Question 10
Question 11
Explanation
The command ip nat inside source list 90 interface ethernet 0/0 overload means:
Question 12
Explanation
The “ip nat inside” command can be applied to an interface to indicate this interface is the source NAT.
Question 13
Explanation
The outputs of the two commands “show ip nat statistics” and “show ip nat translation” are shown
below:
Total doors: 0
Appl doors: 0
Normal doors: 0
Queued Packets: 0
Router#show ip nat translation
Pro Inside global Inside local Outside local Outside global
icmp 201.15.3.5:628 10.1.1.7:628 201.15.3.17:628 201.15.3.17:628
icmp 201.15.3.5:629 10.1.1.7:629 201.15.3.6:629 201.15.3.6:629
icmp 201.15.3.5:610 10.1.1.8:610 201.15.3.17:610 201.15.3.17:610
icmp 201.15.3.5:611 10.1.1.8:611 201.15.3.6:611 201.15.3.6:611
icmp 201.15.3.5:727 10.1.1.17:727 201.15.3.17:727 201.15.3.17:727
icmp 201.15.3.5:728 10.1.1.17:728 201.15.3.6:728 201.15.3.6:728
icmp 201.15.3.5:633 10.1.1.21:633 201.15.3.17:633 201.15.3.17:633
icmp 201.15.3.5:634 10.1.1.21:634 201.15.3.6:634 201.15.3.6:634
icmp 201.15.3.5:480 10.2.2.1:480 201.15.3.17:480 201.15.3.17:480
icmp 201.15.3.5:481 10.2.2.1:481 201.15.3.6:481 201.15.3.6:481
icmp 201.15.3.5:840 10.10.123.2:840 201.15.3.17:840 201.15.3.17:840
icmp 201.15.3.5:841 10.10.123.2:841 201.15.3.6:841 201.15.3.6:841
icmp 201.15.3.5:578 10.10.123.3:578 201.15.3.17:578 201.15.3.17:578
icmp 201.15.3.5:579 10.10.123.3:579 201.15.3.6:579 201.15.3.6:579
icmp 201.15.3.5:595 192.168.1.1:595 201.15.3.17:595 201.15.3.17:595
icmp 201.15.3.5:596 192.168.1.1:596 201.15.3.6:596 201.15.3.6:596
From that we can see the correct answer should be “show ip nat statistics”.
Question 14
ICND1 – Troubleshooting
June 10th, 201757 comments
Question 1
Question 2
Question 3
Explanation
The ports on the switch are not up indicating it is a layer 1 (physical) problem so we should check
cable type, power and how they are plugged in.
Question 4
Question 5
Question 6
Question 7
Question 8
Question 9
Explanation
Question 10
Question 11
ICND1 – Troubleshooting 2
June 10th, 201710 comments
Question 1
Question 2
Question 3
Question 4
Question 5
Explanation
A late collision is defined as any collision that occurs after the first 512 bits of the frame have been
transmitted. The usual possible causes are full-duplex/half-duplex mismatch, exceeded Ethernet cable
length limits, or defective hardware such as incorrect cabling, non-compliant number of hubs in the
network, or a bad NIC.
Late collisions should never occur in a properly designed Ethernet network. They usually occur when
Ethernet cables are too long or when there are too many repeaters in the network.
Reference: https://www.cisco.com/en/US/docs/internetworking/troubleshooting/guide/tr1904.html
Explanation
+ Static IPv6: The IPv6 address, subnet prefix length and default gateway are configured manually
in the system configuration file.
+ Dynamic Host Configuration Protocol for IPv6 (DHCPv6): this mode requires a DHCPv6 server
in your LAN. This is the most used mode for IPv6 assignment. There are two methods of DHCPv6:
– stateless mode: Only extended information, such as primary and optional secondary DNS server, is
obtained from a DHCPv6 server. IPv6 address is not assigned, so the IPv6 address from the Ethernet
configuration is set for a Static address of Ethernet interface.
– stateful mode: DHCPv6 server maintains a database of leased IPv6 addresses, and assigns to the
client an unused IPv6 address. The DHCPv6 server specifies also a primary and optional secondary
DNS server. The DNS server is used to resolve the IP address for a known host name.
+ IPv6 Stateless Address Autoconfiguration (SLAAC): provides the ability to address a host
based on a network prefix that is advertised from a local network router via Router Advertisements
(RA). Notice that with this mode, the device which requires an IPV6 always receive a dynamic IPv6
address.
The question asks about “stateless assignment of IPv6 addresses” which means stateless mode of
DHCPv6.
Question 2
Explanation
According to the official IANA website “Users are assigned IP addresses by Internet service providers
(ISPs). ISPs obtain allocations of IP addresses from a local Internet registry (LIR) or National Internet
Registry (NIR), or from their appropriate Regional Internet Registry
(RIR): https://www.iana.org/numbers
Question 3
Explanation
To run IPv6 on an interface we have to configure an IPv6 on that interface somehow -> A is correct.
IPv6 must be enabled first but with the “ipv6 unicast-routing”, not “ipv6 enable” command -> D is not
correct.
Question 4
Question 5
Question 6
Explanation
Leading zeros in IPv6 are optional do that 05C7 equals 5C7 and 0000 equals 0 -> D is not correct.
Question 7
Question 8
Question 9
Question 10
Explanation
Answers B E F are correct because A and B are the short form of 0:0:0:0:192:168:0:1 and
2002:c0a8:0101:0:0:0:0:0042 while C are normal IPv6 address.
Answer A is correct because “::” is named the “unspecified” address and is typically used in the source
field of a datagram that is sent by a device that seeks to have its IP address configured.
Answer C is not correct because a global-unicast IPv6 address is started with binary 001, denoted as
2000::/3 in IPv6 and it also known as an aggregatable global unicast address. The 2000:: (in
particular, 2000::/3) is just a prefix and is not a valid IPv6 address.
In fact answer D is acceptable but it is considered the network portion of an IPv6 address so it is a
worse choice than others.
Question 2
Explanation
E is not correct because of anycast addresses which are indistinguishable from normal unicast
addresses. You can think of anycast addresses like this: “send it to nearest one which have this
address”. An anycast address can be assigned to many interfaces and the first interface receives the
packet destined for this anycast address will proceed the packet. A benefit of anycast addressing is the
capability to share load to multiple hosts. An example of this benefit is if you are a Television provider
with multiple servers and you want your users to use the nearest server to them then you can use
anycast addressing for your servers. When the user initiates a connection to the anycast address, the
packet will be routed to the nearest server (the user does not have to specify which server they want
to use).
Question 3
Question 4
Question 5
Explanation
“6to4 tunneling” is a technique which enables encapsulation of IPv6 packets into IPv4 for transport
across an IPv4 network.
Question 6
Explanation
The IPv4 and IPv6 headers are shown below for your comparison. As we can see the Flow Label, Hop
Limit, Traffic Class fields are all new but in fact Hop Limit in IPv6 is same as Time to live (TTL) in IPv4.
Traffic Class is the equivalent of the DiffServ/DSCP portion of the IPv4 packet (in “Type of service”
field) which carries the QoS markings of the packet. Just like in IPv4 the first 6 bits are designated for
the DSCP value, and the next 2 bits are for ECN (Explicit Congestion Notifications) capable devices.
Flow-Label: This 20-bit field provides a special service for real-time applications. It can be used to
inform routers and switches to maintain the same path for the packet flow so that packets are not
reordered.
IPv4 Header fields
IPv6 eliminates the Header Checksum field, which handles error checking in IPv4.
Question 7
Explanation
A IPv6 Unique Local Address is an IPv6 address in the block FC00::/7. It is the approximate IPv6
counterpart of the IPv4 private address. It is not routable on the global Internet. Therefore FC00::/7 is
equivalent to 1111 1100 0000 0000::/7 in binary notation.
Note: In the past, Site-local addresses (FEC0::/10) are equivalent to private IP addresses in IPv4 but
now they are deprecated.
If you want your system to become an authoritative NTP server from which other internal routers or
machines can synchronise, you can achieve this with the “ntp master” command.
Note: Use the “ntp server” to form an association with a NTP server.
Question 2
Explanation
NTP uses a stratum to describe the distance between a network device and an authoritative time
source:
+ A stratum 1 time server is directly attached to an authoritative time source (such as a radio or
atomic clock or a GPS time source).
+ A stratum 2 NTP server receives its time through NTP from a stratum 1 time server.
Question 3
Explanation
There is no document saying the default mode of NTP is server so we assume answer A is not correct.
If the network has “ntp master” configured and it cannot reach any clock with a lower stratum
number, the system claims to be synchronized at the configured stratum number, and other systems
synchronize to it via NTP. By default, the master clock function is disabled. When enabled, the default
stratum is 8 -> Answer C is not correct.
NTP sets the source IP address for all NTP packets based on the address of the interface through
which the NTP packet are sent. But there is no correct answer so maybe answer D is the best choice.
Explanation
If we don’t specify the MAC address (like in this question) then the switch will dynamically learn the
attached MAC Address and place it into your running-configuration.
Question 2
Explanation
The “service password-encryption” command encrypts passwords used by “enable password” global
configuration command, as well as the password line configuration command (VTY, console) that are
saved in the router configuration file.
Note: The secret password (configured by the command “enable secret fortress”) is always encrypted
even if the “service password-encryption” command is not used.
Also, the “service password-encryption” command encrypts both current and future passwords.
Question 3
Question 4
Explanation
By configuring the port connected with the directory PC as access port the network administrator will
mitigate a lot of security issues because access port does not have as much privilege as a trunk port -
> C is correct.
The port security feature can also help mitigate security issue because it can learn the MAC address of
the directory PC. When another laptop is plugged into the port, the switch will automatically block or
shut down that port (if suitable configuration is used) -> A is correct. But nowadays a hacker can fake
the MAC address of the directory PC.
By statically assigning the MAC address to the address table, only that MAC address can access to the
network -> F is correct.
Question 5
Explanation
The “service password-encryption” command encrypts passwords used by “enable password” global
configuration command, as well as the password line configuration command (VTY, console) that are
saved in the router configuration file.
The “service password-encryption” command encrypts both current and future passwords.
Question 6
Explanation
The command to configure port security on a switch is (in interface configuration mode):
In this case we will type the server MAC address. That MAC address will be stored in the address
table, and added to the switch running configuration.
Note: If we don’t specify the MAC address then the switch will dynamically learn the attached MAC
Address and place it into your running-configuration
Question 7
Explanation
In the configuration above we have three passwords:
The two first “enable secret” and “enable password” are used to set password for entering privilege
mode (an example of privilege mode: Router#). Both of them will be stored in the running
configuration. But the password in “enable secret” command is always encrypted using MD5 hash
while the password in “enable password” is in plain text.
Note: If you want to encrypt “enable password” you can use the command “service password-
encryption” but it will be encrypted with a very basic form of encryption called vigenere cipher, which
is very weak.
When you configure both an enable and a secret password, the secret password will be used -> B is
correct.
Question 8
Explanation
All other answers are not recommended for a network security plan so only B is the correct answer.
Question 9
Question 10
Explanation
Tracert (or traceroute) is used to trace the path between the sender and the destination host.
Traceroute works by sending packets with gradually increasing Time-to-Live (TTL) value, starting with
TTL value = 1. The first router receives the packet, decrements the TTL value and drops the packet
because it then has TTL value zero. The router sends an ICMP Time Exceeded message back to the
source. The next set of packets are given a TTL value of 2, so the first router forwards the packets,
but the second router drops them and replies with ICMP Time Exceeded. Proceeding in this way,
traceroute uses the returned ICMP Time Exceeded messages to build a list of routers that packets
traverse, until the destination is reached and returns an ICMP Echo Reply message -> C is correct.
Note: The TRACERT command on Windows Operating System uses ICMP while MAC OS X and Linux
TRACEROUTE use UDP.
Question 2
Explanation
The output above is unclear. Normally when we use this command we can see the type of serial
connection on this interface, for example “V.35 DCE cable. Below is an example of the same command
as above:
RouterA#show controllers serial 0
HD unit 0, idb = 0xECA4C, driver structure at 0xF1EC8
buffer size 1524 HD unit 0, V.35 DTE cable
cpb = 0x62, eda = 0x403C, cda = 0x4050
RX ring with 16 entries at 0x624000
00 bd_ptr=0x4000 pak=0x0F5704 ds=0x62FFB8 status=80 pak_size=22
Or
but in this case we only get “V.35 cable”. So in fact we are not sure about the answer C. But the
output above also does not have any information to confirm other answers are correct or not.
Just for your information, the V.35 male and V.35 female cable are shown below:
Question 3
Question 4
Question 5
Explanation
The ping command first sends an echo request packet to an address, then waits for a reply. The ping
is successful only if:
+ The echo request gets to the destination, and
+ The destination is able to get an echo reply back to the source within a predetermined time called a
timeout. The default value of this timeout is two seconds on Cisco routers.
(Reference: http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-
121-mainline/12778-ping-traceroute.html)
Explanation
Many Cisco access points offer single or double (dual) radio (2.4 and 5.0 GHz).
Note: The wireless controller automates wireless configuration and management functions. It does not
connect directly to users.
+ ARP: A PC sends packets to the default gateway IP address the first time since the PC turned on.
+ ICMP: The network administrator is checking basic IP connectivity from a workstation to a server.
+ DNS: The TCP/IP protocol stack must find an IP address for packets destined for a URL.
+ DHCP: A network device will automatically assign IP addresses to workstations.
Question 2
Question 3
Question 4
service password-encryption encrypt all clear text passwords
Question 5