MOD 11-13 ( IP ADDRESSING ) 25.

25. Given IPv6 address prefix 2001:db8::/48, what will be the last subnet that is created if the subnet
22. Which address is a valid IPv6 link-local unicast address? prefix is changed to /52?

●​ FEC8:1::FFFF ●​ 2001:db8:0:f00::/52
●​ FD80::1:1234 ●​ 2001:db8:0:8000::/52
●​ FE80::1:4545:6578:ABC1 ●​ 2001:db8:0:f::/52
●​ FE0A::100:7788:998F ●​ 2001:db8:0:f000::/52
●​ FC90:5678:4251:FFFF
Explanation: Prefix 2001:db8::/48 has 48 network bits. If we subnet to a /52, we are moving the
Explanation: IPv6 LLAs are in the fe80::/10 range. The /10 indicates that the first 10 bits are 1111 network boundary four bits to the right and creating 16 subnets. The first subnet is 2001:db8::/52 the
1110 10xx xxxx. The first hextet has a range of 1111 1110 1000 0000 (fe80) to 1111 1110 1011 1111 last subnet is 2001:db8:0:f000::/52.
(febf).
26. Consider the following range of addresses:
23. Which of these addresses is the shortest abbreviation for the IP address:​
2001:0DB8:BC15:00A0:0000::​
3FFE:1044:0000:0000:00AB:0000:0000:0057?
2001:0DB8:BC15:00A1:0000::​
●​ 3FFE:1044::AB::57 2001:0DB8:BC15:00A2:0000::​
●​ 3FFE:1044::00AB::0057 …​
●​ 3FFE:1044:0:0:AB::57 2001:0DB8:BC15:00AF:0000::
●​ 3FFE:1044:0:0:00AB::0057
The prefix-length for the range of addresses is /60 .
●​ 3FFE:1044:0000:0000:00AB::57
●​ 3FFE:1044:0000:0000:00AB::0057
Explanation: All the addresses have the part 2001:0DB8:BC15:00A in common. Each number or
letter in the address represents 4 bits, so the prefix-length is /60.
Explanation: The rules for reducing the notation of IPv6 addresses are:​
1. Omit any leading 0s (zeros) in any hextet.​
27. What type of IPv6 address is FE80::1?
2. Replace any single, contiguous string of one or more 16-bit hextets consisting of all zeros with a
double colon (::) .​ ●​ loopback
3. The double colon (::) can only be used once within an address. ●​ link-local
●​ multicast
24. A network administrator has received the IPv6 prefix 2001:DB8::/48 for subnetting. Assuming the ●​ global unicast
administrator does not subnet into the interface ID portion of the address space, how many subnets
can the administrator create from the /48 prefix? Explanation: Link-local IPv6 addresses start with FE80::/10, which is any address from FE80:: to
FEBF::. Link-local addresses are used extensively in IPv6 and allow directly connected devices to
●​ 16
communicate with each other on the link they share.
●​ 256
●​ 4096 28. Refer to the exhibit. A company is deploying an IPv6 addressing scheme for its network. The
●​ 65536 company design document indicates that the subnet portion of the IPv6 addresses is used for the
new hierarchical network design, with the site subsection to represent multiple geographical sites of
Explanation: With a network prefix of 48, there will be 16 bits available for subnetting because the
the company, the sub-site section to represent multiple campuses at each site, and the subnet section
interface ID starts at bit 64. Sixteen bits will yield 65536 subnets.
to indicate each network segment separated by routers. With such a scheme, what is the maximum
number of subnets achieved per sub-site?
 ●​ 2001:DB8:BC15:A:12

Explanation: The network portion, or prefix, of an IPv6 address is identified through the prefix length.
A /64 prefix length indicates that the first 64 bits of the IPv6 address is the network portion. Hence the
prefix is 2001:DB8:BC15:A.

31. An IPv6 enabled device sends a data packet with the destination address of FF02::1. What is the
target of this packet?​

●​ the one IPv6 device on the link that has been uniquely configured with this address
●​ all IPv6 enabled devices on the local link​or network
​ ●​ only IPv6 DHCP servers​
Refer to the exhibit. A company is deploying an IPv6 addressing scheme for its network. The ●​ only IPv6 configured routers
company design document indicates that the subnet portion of the IPv6 addresses is used for the
new hierarchical network design, with the site subsection to represent multiple geographical sites of Explanation: This address is one of the assigned IPv6 multicast addresses. Packets addressed to
the company, the sub-site section to represent multiple campuses at each site, and the s ubnet FF02::1 are for all IPv6 enabled devices on the link or network. FF02::2 is for all IPv6 routers that
section to indicate each network segment separated by routers. With such a scheme, what is the exist on the network.
maximum number of subnets achieved per sub-site ?
32. Match the IPv6 address with the IPv6 address type. (Not all options are used.)
●​ 0
●​ 4
●​ 16
●​ 256

Explanation: Because only one hexadecimal character is used to represent the subnet, that one
character can represent 16 different values 0 through F.

29. What is used in the EUI-64 process to create an IPv6 interface ID on an IPv6 enabled interface?

●​ the MAC address of the IPv6 enabled interface

●​ a randomly generated 64-bit hexadecimal address
●​ an IPv6 address that is provided by a DHCPv6 server
●​ an IPv4 address that is configured on the interface
Place the options in the following order:
Explanation: The EUI-64 process uses the MAC address of an interface to construct an interface ID
(IID). Because the MAC address is only 48 bits in length, 16 additional bits (FF:FE) must be added to ::1 loopback
the MAC address to create the full 64-bit interface ID.

30. What is the prefix for the host address 2001:DB8:BC15:A:12AB::1/64?

FF02::1 all node multicast
●​ 2001:DB8:BC15
●​ 2001:DB8:BC15:A
●​ 2001:DB8:BC15:A:1
 Explanation: Multicast, anycast, and unicast are types of IPv6 addresses. There is no broadcast
FF02::1:FFAE:F85F solicited node multicast
address in IPv6. Loopback and link-local are specific types of unicast addresses.

36. Which service provides dynamic global IPv6 addressing to end devices without using a server
2001:DB8::BAF:3F57:FE94 global unicast that keeps a record of available IPv6 addresses?

●​ stateful DHCPv6
●​ SLAAC
Explanation: FF02::1:FFAE:F85F is a solicited node multicast address.​ ●​ static IPv6 addressing
2001:DB8::BAF:3F57:FE94 is a global unicast address.​ ●​ stateless DHCPv6
FF02::1 is the all node multicast address. Packets sent to this address will be received by all IPv6
hosts on the local link.​ Explanation: Using stateless address autoconfiguration (SLAAC), a PC can solicit a router and
::1 is the IPv6 loopback address.​ receive the prefix length of the network. From this information the PC can then create its own IPv6
There are no examples of link local or unique local addresses provided. global unicast address.

33. Which IPv6 prefix is reserved for communication between devices on the same link? 37. Which protocol supports Stateless Address Autoconfiguration (SLAAC) for dynamic assignment of
IPv6 addresses to a host?
●​ FC00::/7
●​ 2001::/32 ●​ ARPv6
●​ FE80::/10 ●​ DHCPv6
●​ FDFF::/7 ●​ ICMPv6
●​ UDP
Explanation: IPv6 link-local unicast addresses are in the FE80::/10 prefix range and are not routable.
They are used only for communications between devices on the same link. Explanation: SLAAC uses ICMPv6 messages when dynamically assigning an IPv6 address to a host.
DHCPv6 is an alternate method of assigning IPv6 addresses to a host. ARPv6 does not exist.
34. Which type of IPv6 address refers to any unicast address that is assigned to multiple hosts? Neighbor Discovery Protocol (NDP) provides the functionality of ARP for IPv6 networks. UDP is the
transport layer protocol used by DHCPv6.
●​ unique local
●​ global unicast 38. Three methods allow IPv6 and IPv4 to co-exist. Match each method with its description. (Not all
●​ link-local options are used.)​
●​ anycast

Explanation: The IPv6 specifications include anycast addresses. An anycast address is any unicast
IPv6 address that is assigned to multiple devices.

35. What are two types of IPv6 unicast addresses? (Choose two.)

●​ multicast
●​ loopback
●​ link-local
●​ anycast
●​ broadcast
 ​
Place the options in the following order:

The IPv4 packets and IPv6 packets coexist in the same network. dual-stack

The IPv6 packet is transported inside an IPv4 packet. tunneling ●​ PC2

●​ R1
●​ SW2
IPv6 packets are converted into IPv4 packets, and vice versa. translation ●​ R2
●​ SW1

39. A technician uses the ping [Link] command. What is the technician testing? Explanation: Tracert is used to trace the path a packet takes. The only successful response was
from the first device along the path on the same LAN as the sending host. The first device is the
●​ the TCP/IP stack on a network host default gateway on router R1. The administrator should therefore start troubleshooting at R1.
●​ connectivity between two adjacent Cisco devices
●​ connectivity between a PC and the default gateway 41. Which protocol is used by the traceroute command to send and receive echo-requests and
●​ connectivity between two PCs on the same network echo-replies?
●​ physical connectivity of a particular PC and the network
●​ SNMP
40. Refer to the exhibit. An administrator is trying to troubleshoot connectivity between PC1 and PC2
●​ ICMP
and uses the tracert command from PC1 to do it. Based on the displayed output, where should the
●​ Telnet
administrator begin troubleshooting?
●​ TCP

Explanation: Traceroute uses the ICMP (Internet Control Message Protocol) to send and receive
echo-request and echo-reply messages.
42. Which ICMPv6 message is sent when the IPv6 hop limit field of a packet is decremented to zero Explanation: When sending an echo request message, a router will use the IP address of the exit
and the packet cannot be forwarded? interface as the source IP address. This default behavior can be changed by using an extended ping
and specifying a specific source IP address.
●​ network unreachable
●​ time exceeded 46. Match each description with an appropriate IP address. (Not all options are used.)
●​ protocol unreachable
●​ port unreachable

Explanation: ICMPv6 uses the hop limit field in the IPv6 packet header to determine if the packet has
expired. If the hop limit field has reached zero, a router will send a time exceeded message back
towards the source indicating that the router cannot forward the packet.

43. A user executes a traceroute over IPv6. At what point would a router in the path to the destination
device drop the packet?

●​ when the value of the Hop Limit field reaches 255

●​ when the value of the Hop Limit field reaches zero
●​ when the router receives an ICMP time exceeded message
●​ when the target host responds with an ICMP echo reply message

Explanation: When a traceroute is performed, the value in the Hop Limit field of an IPv6 packet
determines how many router hops the packet can travel. Once the Hop Limit field reaches a value of
zero, it can no longer be forwarded and the receiving router will drop the packet. Place the options in the following order:

44. What is the purpose of ICMP messages? a link-local address [Link]

●​ to inform routers about network topology changes
●​ to ensure the delivery of an IP packet
●​ to provide feedback of IP packet transmissions a TEST-NET address [Link]
●​ to monitor the process of a domain name to IP address resolution

Explanation: The purpose of ICMP messages is to provide feedback about issues that are related to
an experimental address [Link]
the processing of IP packets.

45. What source IP address does a router use by default when the traceroute command is issued?
a private address [Link]
●​ the highest configured IP address on the router
●​ a loopback IP address
●​ the IP address of the outbound interface
a loopback address [Link]
●​ the lowest configured IP address on the router
Explanation: Link-Local addresses are assigned automatically by the OS environment and are What are the three IPv6 addresses displayed when the route from PC1 to PC2 is traced? (Choose
located in the block [Link]/16. The private addresses ranges are [Link]/8, [Link]/12, and three.)
[Link]/16. TEST-NET addresses belong to the range [Link]/24. The addresses in the block
[Link] to [Link] are reserved as experimental addresses. Loopback addresses belong ●​ 2001:DB8:1:1::1
to the block [Link]/8. ●​ 2001:DB8:1:1::A
●​ 2001:DB8:1:2::2
47. A user issues a ping [Link] command and receives a response that includes a code of ●​ 2001:DB8:1:2::1
1. What does this code represent? ●​ 2001:DB8:1:3::1
●​ 2001:DB8:1:3::2
●​ host unreachable ●​ 2001:DB8:1:4::1
●​ protocol unreachable
●​ port unreachable Explanation: Using the ipv6config command on PC2 displays the IPv6 address of PC2, which is
●​ network unreachable 2001:DB8:1:4::A. The IPV6 link-local address, FE80::260:70FF:FE34:6930, is not used in route
tracing. Using the tracert 2001:DB8:1:4::A command on PC1 displays four addresses:
48. Which subnet would include the address [Link] as a usable host address?
2001:DB8:1:1::1, 2001:DB8:1:2::1 , 2001:DB8:1:3::2, and 2001:DB8:1:4::A.
●​ [Link]/26
●​ [Link]/27 50. A host is transmitting a broadcast. Which host or hosts will receive it?
●​ [Link]/28
●​ all hosts in the same subnet
●​ [Link]/29
●​ a specially defined group of hosts
●​ the closest neighbor on the same network
Explanation: For the subnet of [Link]/26, there are 6 bits for host addresses, yielding 64
●​ all hosts on the Internet
possible addresses. However, the first and last subnets are the network and broadcast addresses for
this subnet. Therefore, the range of host addresses for this subnet is [Link] to [Link].
Explanation: A broadcast is delivered to every host that has an IP address within the same network.
The other subnets do not contain the address [Link] as a valid host address.
51. A host is transmitting a unicast. Which host or hosts will receive it?
49. Open the PT Activity. Perform the tasks in the activity instructions and then answer the question.
●​ one specific host
●​ a specially defined group of hosts
●​ all hosts on the Internet
●​ the closest neighbor on the same network
52. A user issues a ping 2001:db8:FACE:39::10 command and receives a response that includes a
code of 3. What does this code represent?

●​ address unreachable
●​ network unreachable
●​ host unreachable
●​ protocol unreachable
53. A host is transmitting a multicast. Which host or hosts will receive it?

●​ a specially defined group of hosts

●​ the closest neighbor on the same network
 ●​ one specific host ●​ 2001:db8:1::ab8:0:1
●​ directly connected network devices ●​ 2001:db8::ab8:1:0:1000
●​ 2001:db8:0:1::8:1
60. Which is the compressed format of the IPv6 address
2001:0db8:0000:0000:0000:a0b0:0008:0001? 66. Which is the compressed format of the IPv6 address fe80:0000:0000:0000:0220:0b3f:f0e0:0029?

●​ 2001:db8::a0b0:8:1 ●​ fe80::220:b3f:f0e0:29
●​ 2001:db8::ab8:1:0:1000 ●​ fe80:9ea:0:2200::fe0:290
●​ 2001:db80:0:1::80:1 ●​ fe80:9ea0::2020:0:bf:e0:9290
●​ 2001:db80:::1::80:1 ●​ fe80:9ea0::2020::bf:e0:9290
61. Which is the compressed format of the IPv6 address fe80:09ea:0000:2200:0000:0000:0fe0:0290? 67. Which is the compressed format of the IPv6 address
2001:0db8:0000:0000:0000:a0b0:0008:0001?
●​ fe80:9ea:0:2200::fe0:290
●​ fe80:9:20::b000:290 ●​ 2001:db8::a0b0:8:1
●​ fe80:9ea0::2020:0:bf:e0:9290 ●​ 2001:db8::ab8:1:0:1000
●​ fe80:9ea0::2020::bf:e0:9290 ●​ 2001:db80:0:1::80:1
●​ 2001:db8:0:1::8:1
62. Which is the compressed format of the IPv6 address
2002:0042:0010:c400:0000:0000:0000:0909? 68. Which is the compressed format of the IPv6 address
2002:0042:0010:c400:0000:0000:0000:0909?
●​ 2002:42:10:c400::909
●​ 200:420:110:c4b::910:0:90 ●​ 2002:42:10:c400::909
●​ 2002:4200::25:1090:0:99 ●​ 2002:4200::25:1090:0:99
●​ 2002:42::25:1090:0:99 ●​ 2002:420:c4:1008:25:190::990
●​ 2002:42::25:1090:0:99
63. Which is the compressed format of the IPv6 address
2001:0db8:0000:0000:0ab8:0001:0000:1000? 69. Which is the compressed format of the IPv6 address fe80:09ea:0000:2200:0000:0000:0fe0:0290?

●​ 2001:db8::ab8:1:0:1000 ●​ fe80:9ea:0:2200::fe0:290
●​ 2001:db8::a0b0:8:1 ●​ fe80:9ea0::2020:0:bf:e0:9290
●​ 2001:db8:1::ab8:0:1 ●​ fe80::220:b3f:f0e0:29
●​ 2001:db8:0:1::8:1 ●​ fe80::0220:0b3f:f0e0:0029
64. Which is the compressed format of the IPv6 address 70. A user issues a ping 2001:db8:FACE:39::10 command and receives a response that includes a
2002:0420:00c4:1008:0025:0190:0000:0990? code of 2. What does this code represent?

●​ 2002:420:c4:1008:25:190::990 ●​ beyond scope of the source address

●​ 2002:42:10:c400::909 ●​ communication with the destination administratively prohibited
●​ 2002:4200::25:1090:0:99 ●​ address unreachable
●​ 2002:42::25:1090:0:99 ●​ no route to destination
65. Which is the compressed format of the IPv6 address 71. A user issues a ping [Link] command and receives a response that includes a code of
2001:0db8:0000:0000:0000:a0b0:0008:0001? 1. What does this code represent?

●​ 2001:db8::a0b0:8:1 ●​ host unreachable

 ●​ beyond scope of the source address 77. A user issues a ping 2001:db8:FACE:39::10 command and receives a response that includes a
●​ address unreachable code of 2. What does this code represent?
●​ communication with the destination administratively prohibited
●​ beyond scope of the source address
72. A user issues a ping fe80:65ab:dcc1::100 command and receives a response that includes a ●​ host unreachable
code of 3. What does this code represent? ●​ protocol unreachable
●​ network unreachable
●​ address unreachable
●​ communication with the destination administratively prohibited
●​ beyond scope of the source address
●​ no route to destination
73. A user issues a ping [Link] command and receives a response that includes a code of 0.
What does this code represent?

●​ network unreachable
●​ protocol unreachable
●​ port unreachable
●​ host unreachable
74. A user issues a ping fe80:65ab:dcc1::100 command and receives a response that includes a
code of 4. What does this code represent?​
A user issues a ping fe80:65ab:dcc1::100 command and receives a response that includes a code of
4. What does this code represent?

●​ port unreachable
●​ host unreachable
●​ protocol unreachable
●​ network unreachable
75. A user issues a ping [Link] command and receives a response that includes a code of 0.
What does this code represent?

●​ network unreachable
●​ protocol unreachable
●​ port unreachable
●​ host unreachable
76. A user issues a ping 2001:db8:3040:114::88 command and receives a response that includes a
code of 4. What does this code represent?

●​ port unreachable
●​ host unreachable
●​ protocol unreachable
●​ network unreachable
MOD 14-15 ( TRANSPORT AND APPLICATION LAYER )
1. Which action is performed by a client when establishing communication with a server via the use of 6. Which factor determines TCP window size?
UDP at the transport layer? ●​ the amount of data to be transmitted
●​ the number of services included in the TCP segment
●​ The client sets the window size for the session. ●​ the amount of data the destination can process at one time
●​ The client sends an ISN to the server to start the 3-way handshake. ●​ the amount of data the source is capable of sending at one time
●​ The client randomly selects a source port number.
●​ The client sends a synchronization segment to begin the session. Explanation: Window is the number of bytes that the sender will send prior to expecting an
acknowledgement from the destination device. The initial window is agreed upon during the session
2. Which transport layer feature is used to guarantee session establishment?
startup via the three-way handshake between source and destination. It is determined by how much
●​ UDP ACK flag data the destination device of a TCP session is able to accept and process at one time.
●​ TCP 3-way handshake
●​ UDP sequence number 7. What does a client do when it has UDP datagrams to send?
●​ TCP port number
●​ It just sends the datagrams.
3. What is the complete range of TCP and UDP well-known ports? ●​ It queries the server to see if it is ready to receive data.
●​ It sends a simplified three-way handshake to the server.
●​ 0 to 255 ●​ It sends to the server a segment with the SYN flag set to synchronize the conversation.
●​ 0 to 1023
●​ 256 – 1023 Explanation: When a client has UDP datagrams to send, it just sends the datagrams.
●​ 1024 – 49151
8. Which three fields are used in a UDP segment header? (Choose three.)
4. What is a socket?
●​ Window Size
●​ the combination of the source and destination IP address and source and destination
●​ Length
Ethernet address
●​ Source Port
●​ the combination of a source IP address and port number or a destination IP address and
●​ Acknowledgment Number
port number
●​ Checksum
●​ the combination of the source and destination sequence and acknowledgment numbers
●​ Sequence Number
●​ the combination of the source and destination sequence numbers and port numbers
5. A PC is downloading a large file from a server. The TCP window is 1000 bytes. The server is Explanation: A UDP header consists of only the Source Port, Destination Port, Length, and
sending the file using 100-byte segments. How many segments will the server send before it requires Checksum fields. Sequence Number, Acknowledgment Number, and Window Size are TCP header
an acknowledgment from the PC? fields.

●​ 1 segment 9. What are the two roles of the transport layer in data communication on a network? (Choose two.)
●​ 10 segments
●​ 100 segments ●​ identifying the proper application for each communication stream
●​ 1000 segments ●​ tracking the individual communication between applications on the source and
destination hosts
Explanation: With a window of 1000 bytes, the destination host accepts segments until all 1000 bytes ●​ providing frame delimiting to identify bits making up a frame
of data have been received. Then the destination host sends an acknowledgment. ●​ performing a cyclic redundancy check on the frame for errors
 ●​ providing the interface between applications and the underlying network over which 14. Which flag in the TCP header is used in response to a received FIN in order to terminate
messages are transmitted connectivity between two network devices?
●​ FIN
Explanation: The transport layer has several responsibilities. The primary responsibilities include the ●​ ACK
following: ●​ SYN
●​ RST
●​ Tracking the individual communication streams between applications on the source and
destination hosts Explanation: In a TCP session, when a device has no more data to send, it will send a segment with
●​ Segmenting data at the source and reassembling the data at the destination the FIN flag set. The connected device that receives the segment will respond with an ACK to
●​ Identifying the proper application for each communication stream through the use of acknowledge that segment. The device that sent the ACK will then send a FIN message to close the
port numbers connection it has with the other device. The sending of the FIN should be followed with the receipt of
an ACK from the other device.​
10. What information is used by TCP to reassemble and reorder received segments?

●​ port numbers 15. Which protocol or service uses UDP for a client-to-server communication and TCP for
●​ sequence numbers server-to-server communication?
●​ acknowledgment numbers ●​ HTTP
●​ fragment numbers ●​ FTP
●​ DNS
Explanation: At the transport layer, TCP uses the sequence numbers in the header of each TCP ●​ SMTP
segment to reassemble the segments into the correct order.
Explanation: Some applications may use both TCP and UDP. DNS uses UDP when clients send
requests to a DNS server, and TCP when two DNS serves directly communicate.
11. What important information is added to the TCP/IP transport layer header to ensure
communication and connectivity with a remote network device? 16. What is a characteristic of UDP?
●​ timing and synchronization
●​ destination and source port numbers ●​ UDP datagrams take the same path and arrive in the correct order at the destination.​
●​ destination and source physical addresses ●​ Applications that use UDP are always considered unreliable.​
●​ destination and source logical network addresses ●​ UDP reassembles the received datagrams in the order they were received.
●​ UDP only passes data to the network when the destination is ready to receive the data.
Explanation: The destination and source port numbers are used to identify exactly which protocol and
process is requesting or responding to a request. Explanation: UDP has no way to reorder the datagrams into their transmission order, so UDP simply
reassembles the data in the order it was received and forwards it to the application.​
12. Which two characteristics are associated with UDP sessions? (Choose two.)
17. What kind of port must be requested from IANA in order to be used with a specific application?
●​ Destination devices receive traffic with minimal delay.
●​ Transmitted data segments are tracked. ●​ registered port
●​ Destination devices reassemble messages and pass them to an application. ●​ private port
●​ Received data is unacknowledged. ●​ dynamic port
●​ Unacknowledged data packets are retransmitted. ●​ source port
Explanation: Registered ports (numbers 1024 to 49151) are assigned by IANA to a requesting entity Explanation: The sequence number and window fields are included in the TCP header but not in the
to use with specific processes or applications. These processes are primarily individual applications UDP header.
that a user has chosen to install, rather than common applications that would receive a well-known
port number. For example, Cisco has registered port 1985 for its Hot Standby Routing Protocol 21. Which field in the TCP header indicates the status of the three-way handshake process?
(HSRP) process.​
●​ window
18. Which three application layer protocols use TCP? (Choose three.) ●​ reserved
●​ checksum
●​ SMTP ●​ control bits
●​ FTP
●​ SNMP Explanation: The value in the control bits field of theTCP header indicates the progress and status of
●​ HTTP the connection.
●​ TFTP
●​ DHCP 22. Why does HTTP use TCP as the transport layer protocol?

●​ to ensure the fastest possible download speed

Explanation: Some protocols require the reliable data transport that is provided by TCP. In addition,
●​ because HTTP is a best-effort protocol
these protocols do not have real time communication requirements and can tolerate some data loss
●​ because transmission errors can be tolerated easily
while minimizing protocol overhead. Examples of these protocols are SMTP, FTP, and HTTP.
●​ because HTTP requires reliable delivery
19. Which three statements characterize UDP? (Choose three.)
Explanation: When a host requests a web page, transmission reliability and completeness must be
●​ UDP provides basic connectionless transport layer functions. guaranteed. Therefore, HTTP uses TCP as its transport layer protocol.
●​ UDP provides connection-oriented, fast transport of data at Layer 3.
●​ UDP relies on application layer protocols for error detection.
●​ UDP is a low overhead protocol that does not provide sequencing or flow control 23. Which two types of applications are best suited for UDP? (Choose two.)
mechanisms. ●​ applications that need data flow control
●​ UDP relies on IP for error detection and recovery. ●​ applications that require reliable delivery
●​ UDP provides sophisticated flow control mechanisms. ●​ applications that handle reliability themselves
●​ applications that need the reordering of segments
Explanation: UDP is a simple protocol that provides the basic transport layer functions. It has much ●​ applications that can tolerate some data loss, but require little or no delay
lower overhead than TCP because it is not connection-oriented and does not offer the sophisticated
retransmission, sequencing, and flow control mechanisms that provide reliability. Explanation: Applications that can tolerate some data loss, require a simple request and reply, and
handle reliability themselves are best suited for UDP. UDP has low overhead and no requirement of
reliability. TCP provides services for reliability, controlling data flow, and the reordering of segments.
20. Which two fields are included in the TCP header but not in the UDP header? (Choose two.)
●​ window 24. How are port numbers used in the TCP/IP encapsulation process?
●​ checksum ●​ Source port numbers and destination port numbers are not necessary when UDP is the
●​ source port transport layer protocol being used for the communication.
●​ destination port ●​ Source port and destination port numbers are randomly generated.
●​ sequence number ●​ If multiple conversations occur that are using the same service, the source port number
is used to track the separate conversations.
●​ Destination port numbers are assigned automatically and cannot be changed.
Explanation: Both UDP and TCP use port numbers to provide a unique identifier for each ●​ The destination IP address is [Link].
conversation. Source port numbers are randomly generated and are used to track different ●​ The message comes from a server offering an IP address.
conversations. Destination port numbers identify specific services by using either a default port ●​ The message comes from a client seeking an IP address.
number for the service or a port number that is assigned manually by a system administrator. ●​ All hosts receive the message, but only a DHCP server replies.
●​ Only the DHCP server receives the message.
25. In what two situations would UDP be better than TCP as the preferred transport protocol?
(Choose two.) Explanation: When a host configured to use DHCP powers up on a network it sends a
DHCPDISCOVER message. FF-FF-FF-FF-FF-FF is the L2 broadcast address. A DHCP server
●​ when applications need to guarantee that a packet arrives intact, in sequence, and replies with a unicast DHCPOFFER message back to the host.
unduplicated
●​ when a faster delivery mechanism is needed 28. Which two protocols may devices use in the application process that sends email? (Choose two.)
●​ when delivery overhead is not an issue
●​ when applications do not need to guarantee delivery of the data ●​ HTTP
●​ when destination port numbers are dynamic ●​ SMTP
●​ POP
Explanation: UDP is a very simple transport layer protocol that does not guarantee delivery. Devices ●​ IMAP
on both ends of the conversation are not required to keep track of the conversation. UDP is used as ●​ DNS
the transport protocol for applications that need a speedy, best-effort delivery. ●​ POP3

26. What are three responsibilities of the transport layer? (Choose three.) Explanation: POP, POP3, and IMAP are protocols that are used to retrieve email from servers. SMTP
is the default protocol that is used to send email. DNS may be used by the sender email server to find
●​ meeting the reliability requirements of applications, if any the address of the destination email server.
●​ multiplexing multiple communication streams from many users or applications on the
same network 29. What is true about the Server Message Block protocol?
●​ identifying the applications and services on the client and server that should handle
transmitted data ●​ Different SMB message types have a different format.
●​ directing packets towards the destination network ●​ Clients establish a long term connection to servers.
●​ formatting data into a compatible form for receipt by the destination devices ●​ SMB messages cannot authenticate a session.
●​ conducting error detection of the contents in frames ●​ SMB uses the FTP protocol for communication.

Explanation: The transport layer has several responsibilities. Some of the primary responsibilities Explanation: The Server Message Block protocol is a protocol for file, printer, and directory sharing.
include the following:​ Clients establish a long term connection to servers and when the connection is active, the resources
Tracking the individual communication streams between applications on the source and destination can be accessed. Every SMB message has the same format. The use of SMB differs from FTP
hosts​ mainly in the length of the sessions. SMB messages can authenticate sessions.
Segmenting data at the source and reassembling the data at the destination​
Identifying the proper application for each communication stream through the use of port numbers​ 30. What is the function of the HTTP GET message?
Multiplexing the communications of multiple users or applications over a single network​ ●​ to request an HTML page from a web server
Managing the reliability requirements of applications ●​ to send error information from a web server to a web client
●​ to upload content to a web server from a web client
●​ to retrieve client email from an email server using TCP port 110
27. Which three statements describe a DHCP Discover message? (Choose three.)
●​ The source MAC address is 48 ones (FF-FF-FF-FF-FF-FF). Explanation: There are three common HTTP message types:
 ●​ GET – used by clients to request data from the web server ●​ client-based
●​ POST – used by clients to upload data to a web server ●​ master-slave
●​ PUT – used by clients to upload data to a web server ●​ point-to-point

Explanation: In a peer-to-peer networking model, data is exchanged between two network devices
31. Which OSI layer provides the interface between the applications used to communicate and the
without the use of a dedicated server. Peer-to-peer applications such as Shareaz, eDonkey, and
underlying network over which messages are transmitted?
Bitcoin allow one network device to assume the role of server, while one or more other network
●​ application devices assume the role of client using the peer-to-peer application.
●​ presentation
●​ session 35. What is a common protocol that is used with peer-to-peer applications such as WireShare,
●​ transport Bearshare, and Shareaza?

●​ Ethernet
Explanation: The application layer is the layer that is closest to the end user and provides the
●​ Gnutella
interface between the underlying network and the applications used to communicate.
●​ POP
32. Which networking model is being used when an author uploads one chapter document to a file ●​ SMTP
server of a book publisher?
Explanation: The Gnutella protocol is used when one user shares an entire file with another user. A
●​ peer-to-peer person would load a Gnutella-based application such as gtk-gnutella or WireShare and use that
●​ master-slave application to locate and access resources shared by others.
●​ client/server
●​ point-to-point
36. What is a key characteristic of the peer-to-peer networking model?
Explanation: In the client/server network model, a network device assumes the role of server in order ●​ wireless networking
to provide a particular service such as file transfer and storage. In the client/server network model, a ●​ social networking without the Internet
dedicated server does not have to be used, but if one is present, the network model being used is the ●​ network printing using a print server
client/server model. In contrast, a peer-to-peer network does not have a dedicated server. ●​ resource sharing without a dedicated server

33. What do the client/server and peer-to-peer network models have in common? Explanation: The peer-to-peer (P2P) networking model allows data, printer, and resource sharing
without a dedicated server.​​
●​ Both models have dedicated servers.
●​ Both models support devices in server and client roles. 37. The application layer of the TCP/IP model performs the functions of what three layers of the OSI
●​ Both models require the use of TCP/IP-based protocols. model? (Choose three.)
●​ Both models are used only in the wired network environment.
●​ physical
Explanation: In both the client/server and peer-to-peer network models, clients and servers exist. In ●​ session
peer-to-peer networks, no dedicated server exists, but a device can assume the server role to provide ●​ network
information to a device serving in the client role. ●​ presentation
●​ data link
34. In what networking model would eDonkey, eMule, BitTorrent, Bitcoin, and LionShare be used? ●​ transport
●​ application
●​ peer-to-peer
Explanation: The network access layer of the TCP/IP model performs the same functions as the Explanation: SMB and FTP are client/server protocols that are used for file transfer. SMB allows the
physical and data link layers of the OSI model. The internetwork layer equates to the network layer of connecting device to access resources as if they were on the local client device. SMB and FTP use
the OSI model. The transport layers are the same in both models. The application layer of the TCP/IP the TCP protocol for connection establishment and they can transfer data in both directions. FTP
model represents the session, presentation, and application layers of the OSI model.​ requires two connections between the client and the server, one for commands and replies, the other
for the actual file transfer.
38. What is an example of network communication that uses the client-server model?
41. A manufacturing company subscribes to certain hosted services from its ISP. The services that
●​ A user uses eMule to download a file that is shared by a friend after the file location is are required include hosted world wide web, file transfer, and e-mail. Which protocols represent these
determined. three key applications? (Choose three.)
●​ A workstation initiates an ARP to find the MAC address of a receiving host.
●​ A user prints a document by using a printer that is attached to a workstation of a ●​ FTP
coworker. ●​ HTTP
●​ A workstation initiates a DNS request when the user types [Link] in the ●​ DNS
address bar of a web browser. ●​ SNMP
●​ DHCP
Explanation: When a user types a domain name of a website into the address bar of a web browser, a ●​ SMTP
workstation needs to send a DNS request to the DNS server for the name resolution process. This
request is a client/server model application. The eMule application is P2P. Sharing a printer on a Explanation: The ISP uses the HTTP protocol in conjunction with hosting web pages, the FTP
workstation is a peer-to-peer network. Using ARP is just a broadcast message sent by a host. protocol with file transfers, and SMTP with e-mail. DNS is used to translate domain names to IP
addresses. SNMP is used for network management traffic. DHCP ic commonly used to manage IP
39. Which layer in the TCP/IP model is used for formatting, compressing, and encrypting data? addressing.

●​ internetwork
●​ session 42. Which application layer protocol uses message types such as GET, PUT, and POST?
●​ presentation ●​ DNS
●​ application ●​ DHCP
●​ network access ●​ SMTP
●​ HTTP
Explanation: The application layer of the TCP/IP model performs the functions of three layers of the
●​ POP3
OSI model – application, presentation, and session. The application layer of the TCP/IP model is the
layer that provides the interface between the applications, is responsible for formatting, compressing, Explanation: The GET command is a client request for data from a web server. A PUT command
and encrypting data, and is used to create and maintain dialogs between source and destination uploads resources and content, such as images, to a web server. A POST command uploads data
applications. files to a web server.

40. What is an advantage of SMB over FTP?​ 43. What type of information is contained in a DNS MX record?
●​ Only with SMB can data transfers occur in both directions. ●​ the FQDN of the alias used to identify a service
●​ Only SMB establishes two simultaneous connections with the client, making the data ●​ the IP address for an FQDN entry
transfer faster.​ ●​ the domain name mapped to mail exchange servers
●​ SMB is more reliable than FTP because SMB uses TCP and FTP uses UDP.​ ●​ the IP address of an authoritative name server
●​ SMB clients can establish a long-term connection to the server.​
Explanation: MX, or mail exchange messages, are used to map a domain name to several mail Explanation: Peer-to-peer networks have decentralized resources because every computer can serve
exchange servers that all belong to the same domain. as both a server and a client. One computer might assume the role of server for one transaction while
acting as a client for another transaction. Peer-to-peer networks can share resources among network
44. Which three protocols operate at the application layer of the TCP/IP model? (Choose three.) devices without the use of a dedicated server.

●​ ARP 48. Which scenario describes a function provided by the transport layer?
●​ TCP
●​ UDP ●​ A student is using a classroom VoIP phone to call home. The unique identifier burned
●​ FTP into the phone is a transport layer address used to contact another network device on
●​ POP3 the same network.
●​ DHCP ●​ A student is playing a short web-based movie with sound. The movie and sound are
encoded within the transport layer header.
Explanation: FTP, DHCP, and POP3 are application layer protocols. TCP and UDP are transport layer ●​ A student has two web browser windows open in order to access two web sites. The
protocols. ARP is a network layer protocol. transport layer ensures the correct web page is delivered to the correct browser window.
●​ A corporate worker is accessing a web server located on a corporate network. The
45. Which protocol is used by a client to communicate securely with a web server? transport layer formats the screen so the web page appears properly no matter what
●​ SMTP device is being used to view the web site.
●​ SMB
Explanation: The source and destination port numbers are used to identify the correct application and
●​ IMAP
window within that application.
●​ HTTPS
49. Which three layers of the OSI model provide similar network services to those provided by the
Explanation: HTTPS is a secure form of HTTP used to access web content hosted by a web server.
application layer of the TCP/IP model? (Choose three.)
46. Which applications or services allow hosts to act as client and server at the same time? ●​ physical layer
●​ client/server applications ●​ session layer
●​ email applications ●​ transport layer
●​ P2P applications ●​ application layer
●​ authentication services ●​ presentation layer
●​ data link layer
Explanation: P2P applications allow the clients to behave as servers if needed. When using
authentication services, email exchange, and client/server applications, one host acts as server and Explanation: The three upper layers of the OSI model, the session, presentation, and application
the other acts as client at all times. layers, provide application services similar to those provided by the TCP/IP model application layer.
Lower layers of the OSI model are more concerned with data flow.

47. What are two characteristics of peer-to-peer networks? (Choose two.) 50. A PC that is communicating with a web server has a TCP window size of 6,000 bytes when
●​ scalability sending data and a packet size of 1,500 bytes. Which byte of information will the web server
●​ one way data flow acknowledge after it has received two packets of data from the PC?
●​ decentralized resources ●​ 3001
●​ centralized user accounts ●​ 6001
●​ resource sharing without a dedicated server ●​ 4500
 ●​ 6000 56. A client creates a packet to send to a server. The client is requesting HTTP service. What number
will be used as the destination port number in the sending packet?
51. A PC that is communicating with a web server has a TCP window size of 6,000 bytes when
sending data and a packet size of 1,500 bytes. Which byte of information will the web server ●​ 80
acknowledge after it has received three packets of data from the PC? ●​ 67
●​ 53
●​ 4501
●​ 69
●​ 6001
●​ 6000 57. A client creates a packet to send to a server. The client is requesting POP3 service. What number
●​ 4500 will be used as the destination port number in the sending packet?
52. A PC that is communicating with a web server has a TCP window size of 6,000 bytes when ●​ 110
sending data and a packet size of 1,500 bytes. Which byte of information will the web server ●​ 67
acknowledge after it has received four packets of data from the PC? ●​ 53
●​ 69
●​ 6001
●​ 443
●​ 3001
●​ 161
●​ 1501
●​ 80
●​ 1500
58. A client creates a packet to send to a server. The client is requesting telnet service. What number
53. A client creates a packet to send to a server. The client is requesting TFTP service. What number
will be used as the destination port number in the sending packet?
will be used as the destination port number in the sending packet?
●​ 23
●​ 69
●​ 443
●​ 67
●​ 161
●​ 53
●​ 110
●​ 80
59. A client creates a packet to send to a server. The client is requesting SNMP service. What
54. A client creates a packet to send to a server. The client is requesting FTP service. What number
number will be used as the destination port number in the sending packet?
will be used as the destination port number in the sending packet?
●​ 161
●​ 21
●​ 443
●​ 69
●​ 110
●​ 67
●​ 80
●​ 80
60. A client creates a packet to send to a server. The client is requesting SMTP service. What number
55. A client creates a packet to send to a server. The client is requesting SSH service. What number
will be used as the destination port number in the sending packet?
will be used as the destination port number in the sending packet?
●​ 25
●​ 22
●​ 443
●​ 69
●​ 161
●​ 67
●​ 110
●​ 80
61. A client creates a packet to send to a server. The client is requesting HTTPS service. What
number will be used as the destination port number in the sending packet?
 ●​ 443
security policy The network administrator did not fully consider the implications
●​ 161
weakness of unauthorized users accessing the network.
●​ 110
●​ 80

configuration When implementing an access list on a router, a network

weakness engineer did not filter a type of malicous traffic.
MOD 16-17 (BUILDING AND SECURING SMALL NETWORK)

1. Which component is designed to protect against unauthorized communications to and from a technological A nework engineer is examining the operating system of a
computer? weakness network device for vulnerabilities.
●​ security center
●​ port scanner
●​ antimalware Explanation: An employee who is trying to guess the password of another user exemplifies not a
●​ antivirus weakness but an attack.
●​ firewall
6. Match the type of information security threat to the scenario. (Not all options are used.)​
2. Which command will block login attempts on RouterA for a period of 30 seconds if there are 2
failed login attempts within 10 seconds?

●​ RouterA(config)# login block-for 10 attempts 2 within 30

●​ RouterA(config)# login block-for 30 attempts 2 within 10
●​ RouterA(config)# login block-for 2 attempts 30 within 10
●​ RouterA(config)# login block-for 30 attempts 10 within 2
3. What is the purpose of the network security accounting function?

●​ to require users to prove who they are

●​ to determine which resources a user can access
●​ to keep track of the actions of a user
●​ to provide challenge and response questions
4. What type of attack may involve the use of tools such as nslookup and fping?

●​ access attack
●​ reconnaissance attack Explanation:​
●​ denial of service attack After an intruder gains access to a network, common network threats are as follows:
●​ worm attack
●​ Information theft
5. Match each weakness with an example. (Not all options are used.)
●​ Identity theft
●​ Data loss or manipulation
●​ Disruption of service
Place the options in the following order:
Cracking the password for a known username is a type of access attack. ●​ SQL injection (SQLi) – Threat actors uses a flaw in the Structured Query Language
(SQL) application that allows them to have access to modify the data or gain
7. Which example of malicious code would be classified as a Trojan horse? administrative privileges.
●​ Routing attack – A threat actor could either place a rogue routing device on the network
●​ malware that was written to look like a video game
or modify routing packets to manipulate routers to send all packets to the chosen
●​ malware that requires manual user intervention to spread between systems
destination of the threat actor. The threat actor could then drop specific packets, known
●​ malware that attaches itself to a legitimate program and spreads to other programs
as selective forwarding, or drop all packets, known as a sinkhole attack.
when launched
●​ malware that can automatically spread from one system to another by exploiting a
vulnerability in the target 10. Which type of attack involves an adversary attempting to gather information about a network to
identify vulnerabilities?
Explanation: A Trojan horse is malicious code that has been written specifically to look like a
legitimate program. This is in contrast to a virus, which simply attaches itself to an actual legitimate ●​ reconnaissance
program. Viruses require manual intervention from a user to spread from one system to another, while ●​ DoS
●​ dictionary
a worm is able to spread automatically between systems by exploiting vulnerabilities on those
●​ man-in-the-middle
devices.

8. What is the difference between a virus and a worm? Explanation: Reconnaissance is a type of attack where the intruder is looking for wireless network
vulnerabilities.
●​ Viruses self-replicate but worms do not.
●​ Worms self-replicate but viruses do not. 11. Match the description to the type of firewall filtering. (Not all options are used.)​
●​ Worms require a host file but viruses do not.
●​ Viruses hide in legitimate programs but worms do not.

Explanation: Worms are able to self-replicate and exploit vulnerabilities on computer networks without
user participation.

9. Which attack involves a compromise of data that occurs between two end points?

●​ denial-of-service
●​ man-in-the-middle attack
●​ extraction of security parameters
●​ username enumeration

Explanation: Threat actors frequently attempt to access devices over the internet through
communication protocols. Some of the most popular remote exploits are as follows:

●​ Man-In-the-middle attack (MITM) – The threat actor gets between devices in the
system and intercepts all of the data being transmitted. This information could simply
be collected or modified for a specific purpose and delivered to its original destination.
●​ Eavesdropping attack – When devices are being installed, the threat actor can intercept
data such as security keys that are used by constrained devices to establish
communications once they are up and running.
 Explanation: The login block-for command sets a limit on the maximum number of failed login
attempts allowed within a defined period of time. If this limit is exceeded, no further logins are allowed
Explanation: Stateful packet inspection: Prevents or allows access based on whether the traffic is in for the specified period of time. This helps to mitigate brute-force password cracking since it will
response to requests from internal hosts.​ significantly increase the amount of time required to crack a password. The exec-timeout command
URL filtering: Prevents or allows access based on web addresses or keywords.​ specifies how long the session can be idle before the user is disconnected. The service
Application filtering: Prevents or allows access based on the port numbers used in the request.​ password-encryption command encrypts the passwords in the running configuration. The banner
Packet filtering: Prevents or allows access based on the IP or MAC addresses of the source and motd command displays a message to users who are logging in to the device.
destination.
15. Identify the steps needed to configure a switch for SSH. The answer order does not matter. (Not
12. What is the purpose of the network security authentication function? all options are used.)

●​ to require users to prove who they are

●​ to determine which resources a user can access
●​ to keep track of the actions of a user
●​ to provide challenge and response questions

Explanation: Authentication, authorization, and accounting are network services collectively known as
AAA. Authentication requires users to prove who they are. Authorization determines which resources
the user can access. Accounting keeps track of the actions of the user.

13. Which firewall feature is used to ensure that packets coming into a network are legitimate
responses to requests initiated from internal hosts?

●​ stateful packet inspection

●​ URL filtering
●​ application filtering
●​ packet filtering
ITN (Version 7.00) – Building and Securing a Small Network Exam
Explanation: Stateful packet inspection on a firewall checks that incoming packets are actually
legitimate responses to requests originating from hosts inside the network. Packet filtering can be Explanation: The login and password cisco commands are used with Telnet switch configuration, not
used to permit or deny access to resources based on IP or MAC address. Application filtering can SSH configuration.
permit or deny access based on port number. URL filtering is used to permit or deny access based on
URL or on keywords. 16. What feature of SSH makes it more secure than Telnet for a device management connection?

14. When applied to a router, which command would help mitigate brute-force password attacks ●​ confidentiality with IPsec
against the router? ●​ stronger password requirement
●​ random one-time port connection
●​ exec-timeout 30 ●​ login information and data encryption
●​ service password-encryption
●​ banner motd $Max failed logins = 5$ Explanation: Secure Shell (SSH) is a protocol that provides a secure management connection to a
●​ login block-for 60 attempts 5 within 60 remote device. SSH provides security by providing encryption for both authentication (username and
password) and the transmitted data. Telnet is a protocol that uses unsecure plaintext transmission.
SSH is assigned to TCP port 22 by default. Although this port can be changed in the SSH server ●​ designing a network to use multiple virtual devices to ensure that all traffic uses the best
configuration, the port is not dynamically changed. SSH does not use IPsec. path through the internetwork
●​ designing a network to use multiple paths between switches to ensure there is no single
17. What is the advantage of using SSH over Telnet? point of failure

●​ SSH is easier to use. Explanation: Redundancy attempts to remove any single point of failure in a network by using multiple
●​ SSH operates faster than Telnet. physically cabled paths between switches in the network.
●​ SSH provides secure communications to access hosts.
●​ SSH supports authentication for a connection request. 21. A network administrator is upgrading a small business network to give high priority to real-time
applications traffic. What two types of network services is the network administrator trying to
Explanation: SSH provides a secure method for remote access to hosts by encrypting network traffic accommodate? (Choose two.)
between the SSH client and remote hosts. Although both Telnet and SSH request authentication
before a connection is established, Telnet does not support encryption of login credentials. ●​ voice
●​ video
18. What is the role of an IPS? ●​ instant messaging
●​ FTP
●​ detecting and blocking of attacks in real time
●​ SNMP
●​ connecting global threat information to Cisco network security devices
●​ authenticating and validating traffic Explanation: Streaming media, such as video, and voice traffic, are both examples of real-time traffic.
●​ filtering of nefarious websites Real-time traffic needs higher priority through the network than other types of traffic because it is very
sensitive to network delay and latency.
Explanation: An intrusion prevention system (IPS) provides real-time detection and blocking of
attacks. 22. What is the purpose of a small company using a protocol analyzer utility to capture network traffic
on the network segments where the company is considering a network upgrade?
19. A user is redesigning a network for a small company and wants to ensure security at a
reasonable price. The user deploys a new application-aware firewall with intrusion detection ●​ to identify the source and destination of local network traffic
capabilities on the ISP connection. The user installs a second firewall to separate the company ●​ to capture the Internet connection bandwidth requirement
network from the public network. Additionally, the user installs an IPS on the internal network of the ●​ to document and analyze network traffic requirements on each network segment
company. What approach is the user implementing? ●​ to establish a baseline for security analysis after the network is upgraded
●​ attack based Explanation: An important prerequisite for considering network growth is to understand the type and
●​ risk based amount of traffic that is crossing the network as well as the current traffic flow. By using a protocol
●​ structured analyzer in each network segment, the network administrator can document and analyze the network
●​ layered traffic pattern for each segment, which becomes the base in determining the needs and means of the
network growth.
Explanation: Using different defenses at various points of the network creates a layered approach.

20. What is an accurate description of redundancy?

●​ configuring a router with a complete MAC address database to ensure that all frames
can be forwarded to the correct destination
●​ configuring a switch with proper security to ensure that all traffic forwarded through an
interface is filtered
23. Refer to the exhibit. An administrator is testing connectivity to a remote device with the IP address ●​ ‘!’ indicates that the ping was unsuccessful and that the device may have issues finding
[Link]. What does the output of this command indicate?​ a DNS server.
●​ ‘U’ may indicate that a router along the path did not contain a route to the destination
address and that the ping was unsuccessful.
●​ ‘.’ indicates that the ping was successful but the response time was longer than normal.
●​ A combination of ‘.’ and ‘!’ indicates that a router along the path did not have a route to
the destination address and responded with an ICMP unreachable message.​

Explanation: The most common indicators of a ping issued from the Cisco IOS are “!”, “.”, and “U”.
The “!” indicates that the ping completed successfully, verifying connectivity at Layer 3. The “.” may
●​ Connectivity to the remote device was successful.
indicate that a connectivity problem, routing problem, or device security issue exists along the path
●​ A router along the path did not have a route to the destination.
and that an ICMP destination unreachable message was not provided. The “U” indicates that a router
●​ A ping packet is being blocked by a security device along the path.
along the path may not have had a route to the destination address, and that it responded with an
●​ The connection timed out while waiting for a reply from the remote device.
ICMP unreachable message.
Explanation: In the output of the ping command, an exclamation mark (!) indicates a response was
27. A user reports a lack of network connectivity. The technician takes control of the user machine
successfully received, a period (.) indicates that the connection timed out while waiting for a reply, and
and attempts to ping other computers on the network and these pings fail. The technician pings the
the letter “U” indicates that a router along the path did not have a route to the destination and sent an
default gateway and that also fails. What can be determined for sure by the results of these tests?
ICMP destination unreachable message back to the source.
●​ The NIC in the PC is bad.
24. Which method is used to send a ping message specifying the source address for the ping? ●​ The TCP/IP protocol is not enabled.
●​ The router that is attached to the same network as the workstation is down.
●​ Issue the ping command from within interface configuration mode.
●​ Nothing can be determined for sure at this point.
●​ Issue the ping command without specifying a destination IP address.
●​ Issue the ping command without extended commands.
Explanation: In networks today, a failed ping could mean that the other devices on the network are
●​ Issue the ping command after shutting down un-needed interfaces.
blocking pings. Further investigation such as checking network connectivity from other devices on the
same network is warranted.
Explanation: By issuing the ping command without a destination IP address in privileged EXEC mode,
the Cisco IOS enters extended ping mode. This allows the user to implement extended commands
28. A network technician issues the C:> tracert -6 [Link] command on a Windows PC. What
which include source IP address.​
is the purpose of the -6 command option?
25. A network engineer is analyzing reports from a recently performed network baseline. Which ●​ It forces the trace to use IPv6.
situation would depict a possible latency issue? ●​ It limits the trace to only 6 hops.
●​ It sets a 6 milliseconds timeout for each replay.
●​ a change in the bandwidth according to the show interfaces output
●​ It sends 6 probes within each TTL time period.
●​ a next-hop timeout from a traceroute
●​ an increase in host-to-host ping response times
Explanation: The -6 option in the command C:> tracert -6 [Link] is used to force the trace to
●​ a change in the amount of RAM according to the show version output
use IPv6.
Explanation: While analyzing historical reports an administrator can compare host-to-host timers from
29. Why would a network administrator use the tracert utility?
the ping command and depict possible latency issues.​
●​ to determine the active TCP connections on a PC
26. Which statement is true about Cisco IOS ping indicators?​
 ●​ to check information about a DNS name in the DNS server Explanation: The value of the configuration register can be verified with the show version command.
●​ to identify where a packet was lost or delayed on a network
●​ to display the IP address, default gateway, and DNS server address for a PC 33. Which command should be used on a Cisco router or switch to allow log messages to be
displayed on remotely connected sessions using Telnet or SSH?
Explanation: The tracert utility is used to identify the path a packet takes from source to destination.
Tracert is commonly used when packets are dropped or not reaching a specific destination. ●​ debug all
●​ logging synchronous
30. A ping fails when performed from router R1 to directly connected router R2. The network ●​ show running-config​
administrator then proceeds to issue the show cdp neighbors command. Why would the network ●​ terminal monitor
administrator issue this command if the ping failed between the two routers?
Explanation: The terminal monitor command is very important to use when log messages
●​ The network administrator suspects a virus because the ping command did not work. appear. Log messages appear by default when a user is directly consoled into a Cisco device, but
●​ The network administrator wants to verify Layer 2 connectivity. require the terminal monitor command to be entered when a user is accessing a network device
●​ The network administrator wants to verify the IP address configured on router R2. remotely.
●​ The network administrator wants to determine if connectivity can be established from a
non-directly connected network. 34. Which command can an administrator issue on a Cisco router to send debug messages to the vty
lines?
Explanation: The show cdp neighbors command can be used to prove that Layer 1 and Layer 2
connectivity exists between two Cisco devices. For example, if two devices have duplicate IP ●​ terminal monitor
addresses, a ping between the devices will fail, but the output of show cdp neighbors will be ●​ logging console
successful. The show cdp neighbors detail could be used to verify the IP address of the directly ●​ logging buffered
connected device in case the same IP address is assigned to the two routers. ●​ logging synchronous

31. A network engineer is troubleshooting connectivity issues among interconnected Cisco routers Explanation: Debug messages, like other IOS log messages, are sent to the console line by default.
and switches. Which command should the engineer use to find the IP address information, host Sending these messages to the terminal lines requires the terminal monitor command.
name, and IOS version of neighboring network devices?
35. By following a structured troubleshooting approach, a network administrator identified a network
●​ show version issue after a conversation with the user. What is the next step that the administrator should take?
●​ show ip route
●​ show interfaces ●​ Verify full system functionality.
●​ show cdp neighbors detail ●​ Test the theory to determine cause.
●​ Establish a theory of probable causes.
Explanation: The show cdp neighbors detail command reveals much information about neighboring ●​ Establish a plan of action to resolve the issue.
Cisco devices, including the IP address, the capabilities, host name, and IOS version. The show
interfaces and show version commands display information about the local device. Explanation: A structured network troubleshooting approach should include these steps in sequence:

32. What information about a Cisco router can be verified using the show version command? 1.​ Identify the problem.
2.​ Establish a theory of probable causes.
●​ the routing protocol version that is enabled 3.​ Test the theory to determine cause.
●​ the value of the configuration register 4.​ Establish a plan of action to resolve the issue.
●​ the operational status of serial interfaces 5.​ Verify full system functionality and implement preventive measures.
●​ the administrative distance used to reach networks 6.​ Document findings, actions, and outcomes.
36. Users are complaining that they are unable to browse certain websites on the Internet. An uses when communicating with remote networks?​
administrator can successfully ping a web server via its IP address, but cannot browse to the domain
name of the website. Which troubleshooting tool would be most useful in determining where the
problem is?

●​ netstat
●​ tracert
●​ nslookup
●​ ipconfig
●​ traceroute
Explanation: The nslookup command can be used to look up information about a particular DNS ●​ show cdp neighbors
name in the DNS server. The information includes the IP address of the DNS server being used as ●​ Telnet
well as the IP address associated with the specified DNS name. This command can help verify the ●​ an extended ping
DNS that is used and if the domain name to IP address resolution works.
Explanation: An extended ping allows an administrator to select specific ping features. For example in
37. An employee complains that a Windows PC cannot connect to the Internet. A network technician this situation, the network administrator could do an extended ping and specify a source address of
issues the ipconfig command on the PC and is shown an IP address of [Link]. Which two the gigabit Ethernet port on the router. The destination address would be the IP address of host H1. If
conclusions can be drawn? (Choose two.) the ping succeeds connectivity exists from the Ethernet router interface on R2 to device H1.
●​ The PC cannot contact a DHCP server.
●​ The DNS server address is misconfigured.
●​ The default gateway address is not configured. 39. Refer to the exhibit. Baseline documentation for a small company had ping round trip time
●​ The PC is configured to obtain an IP address automatically. statistics of 36/97/132 between hosts H1 and H3. Today the network administrator checked
●​ The enterprise network is misconfigured for dynamic routing. connectivity by pinging between hosts H1 and H3 that resulted in a round trip time of
1458/2390/6066. What does this indicate to the network administrator?​
Explanation: When a Windows PC is configured to obtain an IP address automatically, the PC will try
to obtain an IP address from a DHCP server. When the PC cannot contact a DHCP server, Windows
will automatically assign an address belonging to the [Link]/16 range.

38. Refer to the exhibit. Host H3 is having trouble communicating with host H1. The network
administrator suspects a problem exists with the H3 workstation and wants to prove that there is no
problem with the R2 configuration. What tool could the network administrator use on router R2 to
prove that communication exists to host H1 from the interface on R2, which is the interface that H3
●​ Connectivity between H1 and H3 is fine.
●​ H3 is not connected properly to the network.
●​ Something is causing interference between H1 and R1.
●​ Performance between the networks is within expected parameters.
●​ Something is causing a time delay between the networks.
Explanation: Ping round trip time statistics are shown in milliseconds. The larger the number the more 43. When configuring SSH on a router to implement secure network management, a network
delay. A baseline is critical in times of slow performance. By looking at the documentation for the engineer has issued the login local and transport input ssh line vty commands. What three additional
performance when the network is performing fine and comparing it to information when there is a configuration actions have to be performed to complete the SSH configuration? (Choose three.)
problem, a network administrator can resolve problems faster.
●​ Set the user privilege levels.
40. Which network service automatically assigns IP addresses to devices on the network? ●​ Generate the asymmetric RSA keys.
●​ Configure the correct IP domain name.
●​ DHCP ●​ Configure role-based CLI access.
●​ Telnet ●​ Create a valid local username and password database.
●​ DNS ●​ Manually enable SSH after the RSA keys are generated.
●​ traceroute
Explanation: SSH is automatically enabled after the RSA keys are generated. Setting user privilege
Explanation: Dynamic Host Configuration Protocol (DHCP) can be used to allow end devices to levels and configuring role-based CLI access are good security practices but are not a requirement of
automatically configure IP information, such as their IP address, subnet mask, DNS server, and implementing SSH.
default gateway. The DNS service is used to provide domain name resolution, mapping hostnames to
IP addresses. Telnet is a method for remotely accessing a CLI session of a switch or router. 44. What is considered the most effective way to mitigate a worm attack?
Traceroute is a command used to determine the path a packet takes as it traverses the network.
●​ Change system passwords every 30 days.
41. Which command can an administrator execute to determine what interface a router will use to ●​ Ensure that all systems have the most current virus definitions.
reach remote networks? ●​ Ensure that AAA is configured in the network.
●​ Download security updates from the operating system vendor and patch all vulnerable
●​ show arp systems.
●​ show interfaces
●​ show ip route Explanation: Because worms take advantage of vulnerabilities in the system itself, the most effective
●​ show protocols way to mitigate worm attacks is to download security updates from the operating system vendor and
patch all vulnerable systems.
Explanation: The show ip route command is used to display the IP routing table of the router. The IP
routing table will show a list of known local and remote networks and the interfaces that the router will 45. Which statement describes the ping and tracert commands?
use to reach those networks.
●​ Tracert shows each hop, while ping shows a destination reply only.
42. On which two interfaces or ports can security be improved by configuring executive timeouts? ●​ Tracert uses IP addresses; ping does not.
(Choose two.) ●​ Both ping and tracert can show results in a graphical display.
●​ Ping shows whether the transmission is successful; tracert does not.
●​ Fast Ethernet interfaces
●​ console ports Explanation: The ping utility tests end-to-end connectivity between the two hosts. However, if the
●​ serial interfaces message does not reach the destination, there is no way to determine where the problem is located.
●​ vty ports On the other hand, the traceroute utility (tracert in Windows) traces the route a message takes from
●​ loopback interfaces its source to the destination. Traceroute displays each hop along the way and the time it takes for the
message to get to that network and back.
Explanation: Executive timeouts allow the Cisco device to automatically disconnect users after they
have been idle for the specified time. Console, vty, and aux ports can be configured with executive
timeouts.
46. A technician is to document the current configurations of all network devices in a college, ●​ It is weak since it uses easily found personal information.
including those in off-site buildings. Which protocol would be best to use to securely access the ●​ It is weak since it is a word that is easily found in the dictionary.
network devices?
49. An administrator decides to use “pR3s!d7n&0” as the password on a newly installed router. Which
●​ FTP statement applies to the password choice?
●​ HTTP
●​ It is strong because it uses a minimum of 10 numbers, letters and special characters.
●​ SSH
●​ It is weak because it is often the default password on new devices.
●​ Telnet
●​ It is weak since it uses easily found personal information.
●​ It is weak since it is a word that is easily found in the dictionary.
Explanation: Telnet sends passwords and other information in clear text, while SSH encrypts its data.
FTP and HTTP do not provide remote device access for configuration purposes. 50. An administrator decides to use “5$7*4#033!” as the password on a newly installed router. Which
statement applies to the password choice?
47. Open the PT Activity. Perform the tasks in the activity instructions and then answer the question.
●​ It is strong because it contains 10 numbers and special characters.
●​ It is weak because it is often the default password on new devices.
●​ It is weak since it uses easily found personal information.
●​ It is strong because it uses a minimum of 10 numbers, letters and special characters.
51. An administrator decides to use “pR3s!d7n&0” as the password on a newly installed router. Which
statement applies to the password choice?

●​ It is strong because it uses a minimum of 10 numbers, letters and special characters.

●​ It is weak since it is a word that is easily found in the dictionary.
●​ It is strong because it uses a passphrase.
●​ It is strong because it contains 10 numbers and special characters.
52. An administrator decides to use “12345678!” as the password on a newly installed router. Which
Which command has to be configured on the router to complete the SSH configuration? statement applies to the password choice?
●​ service password-encryption ●​ It is weak because it uses a series of numbers or letters.
●​ transport input ssh ●​ It is strong because it uses a passphrase.
●​ enable secret class ●​ It is weak since it is a word that is easily found in the dictionary.
●​ ip domain-name [Link] ●​ It is strong because it uses a minimum of 10 numbers, letters and special characters.

Explanation: The missing command to complete the SSH configuration is transport input ssh in line 53. An administrator decides to use “admin” as the password on a newly installed router. Which
vty 0 4 [Link] commands service password-encryption and enable secret class do configure statement applies to the password choice?
secure features on the router, but are not required to configure SSH. The command ip domain-name
●​ It is weak because it is often the default password on new devices.
[Link] is not required because the command ip domain-name [Link] has been used.
●​ It is strong because it uses a passphrase.
48. An administrator decides to use “WhatAreyouwaiting4” as the password on a newly installed ●​ It is strong because it uses a minimum of 10 numbers, letters and special characters.
router. Which statement applies to the password choice? ●​ It is strong because it contains 10 numbers and special characters.
54. An administrator decides to use “Feb121978” as the password on a newly installed router. Which
●​ It is strong because it uses a passphrase.
statement applies to the password choice?
●​ It is weak because it is often the default password on new devices.
 ●​ It is weak because it uses easily found personal information. 59. Students who are connected to the same switch are having slower than normal response times.
●​ It is strong because it uses a passphrase. The administrator suspects a duplex setting issue. What is the best command to use to accomplish
●​ It is weak since it is a word that is easily found in the dictionary. the task?
●​ It is strong because it uses a minimum of 10 numbers, letters and special characters.
●​ show interfaces
55. An administrator decides to use “password” as the password on a newly installed router. Which ●​ ipconfig getifaddr en0
statement applies to the password choice? ●​ copy running-config startup-config
●​ show ip nat translations
●​ It is weak because it is a commonly used password.
●​ It is weak since it is a word that is easily found in the dictionary. 60. A user wants to know the IP address of the PC. What is the best command to use to accomplish
●​ It is strong because it uses a passphrase. the task?
●​ It is strong because it uses a minimum of 10 numbers, letters and special characters.
●​ ipconfig
56. An administrator decides to use “RobErT” as the password on a newly installed router. Which ●​ copy running-config startup-config
statement applies to the password choice? ●​ show interfaces
●​ show ip nat translations
●​ It is weak since it uses easily found personal information.
●​ It is strong because it uses a passphrase. 61. A student wants to save a router configuration to NVRAM. What is the best command to use to
●​ It is strong because it uses a minimum of 10 numbers, letters and special characters. accomplish the task?
●​ It is strong because it contains 10 numbers and special characters.
●​ copy running-config startup-config
57. An administrator decides to use “Elizabeth” as the password on a newly installed router. Which ●​ show interfaces
statement applies to the password choice? ●​ show ip nat translations
●​ show ip route
●​ It is weak because it uses easily found personal information.
●​ It is strong because it uses a passphrase. 62. A support technician needs to know the IP address of the wireless interface on a MAC. What is
●​ It is weak since it is a word that is easily found in the dictionary. the best command to use to accomplish the task?
●​ It is strong because it uses a minimum of 10 numbers, letters and special characters.
●​ ipconfig getifaddr en0
Explanation: Rules for strong passwords:​ ●​ copy running-config startup-config
* minimum of 8 characters, preferably 10.​ ●​ show interfaces
* use complex combinations of numbers, special characters, and upper and lower case letters.​ ●​ show ip nat translations
* avoid repetition, common dictionary words, letter or number sequences.​ 63. A network technician is troubleshooting an issue and needs to verify all of the IPv6 interface
* avoid names of children, relatives, pets, birthdays, or any easily identifiable personal information.​ addresses on a router. What is the best command to use to accomplish the task?
* can be created by misspelling words or replacing vowels with numbers or special characters.
●​ show ipv6 interface
58. A network technician is troubleshooting an issue and needs to verify the IP addresses of all ●​ show interfaces
interfaces on a router. What is the best command to use to accomplish the task? ●​ show ip nat translations
●​ show ip route
●​ show ip interface brief
●​ nslookup 64. A teacher is having difficulties connecting his PC to the classroom network. He needs to verify
●​ ipconfig getifaddr en0 that a default gateway is configured correctly. What is the best command to use to accomplish the
●​ show ip route task?
 ●​ ipconfig
●​ copy running-config startup-config
●​ show interfaces
●​ show ip nat translations
65. Only employees connected to IPv6 interfaces are having difficulty connecting to remote networks.
The analyst wants to verify that IPv6 routing has been enabled. What is the best command to use to
accomplish the task?

●​ show running-config
●​ show interfaces
●​ copy running-config startup-config
●​ show ip nat translations
66. An administrator is troubleshooting connectivity issues and needs to determine the IP address of
a website. What is the best command to use to accomplish the task?

●​ nslookup
●​ show ipv6 route
●​ show ipv6 interface
●​ copy startup-config running-config
67. What is a characteristic of UDP?

●​ UDP datagrams take the same path and arrive in the correct order at the destination.​
●​ Applications that use UDP are always considered unreliable.​
●​ UDP reassembles the received datagrams in the order they were received.
●​ UDP only passes data to the network when the destination is ready to receive the data.
FINAL EXAM Explain:​
A DNS server stores records that are used to resolve IP addresses to host names. Some DNS record
1. Which two traffic types use the Real-Time Transport Protocol (RTP)? (Choose two.) types include the following:

●​ video A – an end device IPv4 address​

●​ web NS – an authoritative name server​
●​ file transfer AAAA – an end device IPv6 address​
●​ voice MX – a mail exchange record
●​ peer to peer
5. What are proprietary protocols?
2. Which wireless technology has low-power and data rate requirements making it popular in home
automation applications? ●​ protocols developed by private organizations to operate on any vendor hardware
●​ protocols that can be freely used by any organization or vendor
●​ ZigBee ●​ protocols developed by organizations who have control over their definition and
●​ LoRaWAN operation
●​ 5G ●​ a collection of protocols known as the TCP/IP protocol suite
●​ Wi-Fi
Explain:​
Explanation: ZigBee is an IEEE 802.15.4 wireless standard designed for creating personal-area Proprietary protocols have their definition and operation controlled by one company or vendor. Some
networks. Low energy, power, and data rate requirements make Zigbee a popular protocol for of them can be used by different organizations with permission from the owner. The TCP/IP protocol
connecting home automation devices. suite is an open standard, not a proprietary protocol.
3. Which layer of the TCP/IP model provides a route to forward messages through an internetwork? 6. What service is provided by DNS?
●​ application ●​ Resolves domain names, such as [Link], into IP addresses.
●​ network access ●​ A basic set of rules for exchanging text, graphic images, sound, video, and other
●​ internet multimedia files on the web.
●​ transport ●​ Allows for data transfers between a client and a file server.
●​ Uses encryption to secure the exchange of text, graphic images, sound, and video on
Explain:​
the web.
The OSI model network layer corresponds directly to the internet layer of the TCP/IP model and is
used to describe protocols that address and route messages through an internetwork. 7. A client packet is received by a server. The packet has a destination port number of 110. What
service is the client requesting?
4. Which type of server relies on record types such as A, NS, AAAA, and MX in order to provide
services? ●​ DNS
●​ DHCP
●​ DNS ●​ SMTP
●​ email ●​ POP3
●​ file
8. What command can be used on a Windows PC to see the IP configuration of that computer?
●​ web
●​ show ip interface brief
●​ ping
●​ show interfaces
 ●​ ipconfig
9. A wired laser printer is attached to a home computer. That printer has been shared so that other
computers on the home network can also use the printer. What networking model is in use?

●​ client-based
●​ master-slave
●​ point-to-point
●​ peer-to-peer (P2P)

Explanation: Peer-to-peer (P2P) networks have two or more network devices that can share
resources such as printers or files without having a dedicated server.

10. What characteristic describes a virus?

●​ a network device that filters access and traffic coming into a network
13. Refer to the exhibit. If Host1 were to transfer a file to the server, what layers of the TCP/IP model
●​ the use of stolen credentials to access private data
would be used?​
●​ an attack that slows or crashes a device or network service
●​ malicious software or code running on an end device
11. Three bank employees are using the corporate network. The first employee uses a web browser
to view a company web page in order to read some announcements. The second employee accesses
the corporate database to perform some financial transactions. The third employee participates in an
important live audio conference with other corporate managers in branch offices. If QoS is
implemented on this network, what will be the priorities from highest to lowest of the different data
types?

●​ financial transactions, web page, audio conference

●​ audio conference, financial transactions, web page
●​ financial transactions, audio conference, web page
●​ audio conference, web page, financial transactions ●​ only application and Internet layers
●​ only Internet and network access layers
Explanation: QoS mechanisms enable the establishment of queue management strategies that
●​ only application, Internet, and network access layers
enforce priorities for different categories of application data. Thus, this queuing enables voice data to
●​ application, transport, Internet, and network access layers
have priority over transaction data, which has priority over web data.
●​ only application, transport, network, data link, and physical layers
●​ application, session, transport, network, data link, and physical layers
12. Match the description to the IPv6 addressing component. (Not all options are used.)
Explanation: The TCP/IP model contains the application, transport, internet, and network access
layers. A file transfer uses the FTP application layer protocol. The data would move from the
application layer through all of the layers of the model and across the network to the file server.

14. Match the characteristic to the forwarding method. (Not all options are used.)
 Explanation: The default gateway for host H1 is the router interface that is attached to the LAN that
H1 is a member of. In this case, that is the G0/0 interface of R1. H1 should be configured with the IP
Cut-through Store-and-forward address of that interface in its addressing settings. R1 will provide routing services to packets from H1
that need to be forwarded to remote networks.

16. What service is provided by Internet Messenger?

low latency always stores the entire frame
●​ An application that allows real-time chatting among remote users.
●​ Allows remote access to network devices and servers.
●​ Resolves domain names, such as [Link], into IP addresses.
may forward runt frames checks the CRC before forwarding ●​ Uses encryption to provide secure remote access to network devices and servers.
18. Refer to the exhibit. Which protocol was responsible for building the table that is shown?​
begins forwarding when the destination address checks the frame length before
is received forwarding

Explanation: A store-and-forward switch always stores the entire frame before forwarding, and checks
its CRC and frame length. A cut-through switch can forward frames before receiving the destination
address field, thus presenting less latency than a store-and-forward switch. Because the frame can
begin to be forwarded before it is completely received, the switch may transmit a corrupt or runt
frame. All forwarding methods require a Layer 2 switch to forward broadcast frames.
●​ DHCP
15. Refer to the exhibit. The IP address of which device interface should be used as the default
●​ ARP
gateway setting of host H1?​
●​ DNS
●​ ICMP

Explanation: The table that is shown corresponds to the output of the arp -a command, a command
that is used on a Windows PC to display the ARP table.

19. A network administrator notices that some newly installed Ethernet cabling is carrying corrupt and
distorted data signals. The new cabling was installed in the ceiling close to fluorescent lights and
electrical equipment. Which two factors may interfere with the copper cabling and result in signal
distortion and data corruption? (Choose two.)

●​ crosstalk
●​ extended length of cabling
●​ R1: S0/0/0 ●​ RFI​
●​ R2: S0/0/1 ●​ EMI
●​ R1: G0/0 ●​ signal attenuation
●​ R2: S0/0/0
20. A host is trying to send a packet to a device on a remote LAN segment, but there are currently no 26. A technician with a PC is using multiple applications while connected to the Internet. How is the
mappings in its ARP cache. How will the device obtain a destination MAC address?​ PC able to keep track of the data flow between multiple application sessions and have each
(A host is trying to send a packet to a device on a remote LAN segment, but there are currently no application receive the correct packet flows?
mappings in the ARP cache. How will the device obtain a destination MAC address?)
●​ The data flow is being tracked based on the destination MAC address of the technician
●​ It will send the frame and use its own MAC address as the destination. PC.
●​ It will send an ARP request for the MAC address of the destination device. ●​ The data flow is being tracked based on the source port number that is used by each
●​ It will send the frame with a broadcast MAC address. application.
●​ It will send a request to the DNS server for the destination MAC address. ●​ The data flow is being tracked based on the source IP address that is used by the PC of
●​ It will send an ARP request for the MAC address of the default gateway. the technician.
●​ The data flow is being tracked based on the destination IP address that is used by the
22. A client packet is received by a server. The packet has a destination port number of 53. What
PC of the technician.
service is the client requesting?

●​ DNS Explanation:​
●​ NetBIOS (NetBT) The source port number of an application is randomly generated and used to individually keep track
●​ POP3 of each session connecting out to the Internet. Each application will use a unique source port number
●​ IMAP to provide simultaneous communication from multiple applications through the Internet.

23. A network administrator is adding a new LAN to a branch office. The new LAN must support 25 27. A network administrator is adding a new LAN to a branch office. The new LAN must support 61
connected devices. What is the smallest network mask that the network administrator can use for the connected devices. What is the smallest network mask that the network administrator can use for the
new network? new network?

●​ [Link] ●​ [Link]
●​ [Link] ●​ [Link]
●​ [Link] ●​ [Link]
●​ [Link] ●​ [Link]
24. What characteristic describes a Trojan horse? 28. Refer to the exhibit. Match the network with the correct IP address and prefix that will satisfy the
usable host addressing requirements for each network. (Not all options are used.)​
●​ malicious software or code running on an end device
●​ an attack that slows or crashes a device or network service
●​ the use of stolen credentials to access private data
●​ a network device that filters access and traffic coming into a network
25. What service is provided by HTTPS?

●​ Uses encryption to provide secure remote access to network devices and servers.
●​ Resolves domain names, such as [Link], into IP addresses.
●​ Uses encryption to secure the exchange of text, graphic images, sound, and video on
the web.
●​ Allows remote access to network devices and servers.
 30. Match the application protocols to the correct transport protocols.​

31. What service is provided by SMTP?

●​ Allows clients to send email to a mail server and the servers to send email to other
servers.
ITN (Version 7.00) – ITNv7 Final Exam ●​ Allows remote access to network devices and servers.
●​ Uses encryption to provide secure remote access to network devices and servers.
Explanation:​
●​ An application that allows real-time chatting among remote users.
Network A needs to use [Link] /25 which yields 128 host addresses.​
Network B needs to use [Link] /26 which yields 64 host addresses.​ 32. Which scenario describes a function provided by the transport layer?
Network C needs to use [Link] /27 which yields 32 host addresses.​
●​ A student is using a classroom VoIP phone to call home. The unique identifier burned
Network D needs to use [Link] /30 which yields 4 host addresses.
into the phone is a transport layer address used to contact another network device on
29. What characteristic describes a DoS attack? the same network.
●​ A student is playing a short web-based movie with sound. The movie and sound are
●​ the use of stolen credentials to access private data encoded within the transport layer header.
●​ a network device that filters access and traffic coming into a network ●​ A student has two web browser windows open in order to access two web sites. The
●​ software that is installed on a user device and collects information about the user transport layer ensures the correct web page is delivered to the correct browser window.
●​ an attack that slows or crashes a device or network service ●​ A corporate worker is accessing a web server located on a corporate network. The
transport layer formats the screen so the web page appears properly no matter what
device is being used to view the web site.

Explain:​
The source and destination port numbers are used to identify the correct application and window
within that application.

[Link] to the exhibit. Host B on subnet Teachers transmits a packet to host D on subnet Students.
Which Layer 2 and Layer 3 addresses are contained in the PDUs that are transmitted from host B to
the router?​
 35. Refer to the exhibit. An administrator is trying to configure the switch but receives the error
message that is displayed in the exhibit. What is the problem?​

●​ The entire command, configure terminal, must be used.

●​ The administrator is already in global configuration mode.
​ ●​ The administrator must first enter privileged EXEC mode before issuing the command.
Layer 2 destination address = 00-00-0c-94-36-ab​ ●​ The administrator must connect via the console port to access global configuration
Layer 2 source address = 00-00-0c-94-36-bb​ mode.
Layer 3 destination address = [Link]​ 36. Which two protocols operate at the top layer of the TCP/IP protocol suite? (Choose two.)
Layer 3 source address = [Link]
●​ TCP
Layer 2 destination address = 00-00-0c-94-36-dd​ ●​ IP
Layer 2 source address = 00-00-0c-94-36-bb​ ●​ UDP
Layer 3 destination address = [Link]​ ●​ POP
Layer 3 source address = [Link] ●​ DNS
●​ Ethernet
Layer 2 destination address = 00-00-0c-94-36-cd​
Layer 2 source address = 00-00-0c-94-36-bb​ 37. A company has a file server that shares a folder named Public. The network security policy
Layer 3 destination address = [Link]​ specifies that the Public folder is assigned Read-Only rights to anyone who can log into the server
Layer 3 source address = [Link] while the Edit rights are assigned only to the network admin group. Which component is addressed in
the AAA network service framework?
Layer 2 destination address = 00-00-0c-94-36-ab​
Layer 2 source address = 00-00-0c-94-36-bb​ ●​ automation
Layer 3 destination address = [Link]​ ●​ accounting
Layer 3 source address = [Link] ●​ authentication
●​ authorization
34. What does the term “attenuation” mean in data communication?
After a user is successfully authenticated (logged into the server), the authorization is the process of
●​ strengthening of a signal by a networking device
determining what network resources the user can access and what operations (such as read or edit)
●​ leakage of signals from one cable pair to another
the user can perform.
●​ time for a signal to reach its destination
●​ loss of signal strength as distance increases 38. What three requirements are defined by the protocols used in network communcations to allow
message transmission across a network? (Choose three.)
Explanation: Data is transmitted on copper cables as electrical pulses. A detector in the network
interface of a destination device must receive a signal that can be successfully decoded to match the ●​ message size
signal sent. However, the farther the signal travels, the more it deteriorates. This is referred to as ●​ message encoding
signal attenuation. ●​ connector specifications
●​ media selection
●​ delivery options
 ●​ end-device installation Explanation: When terminated improperly, each cable is a potential source of physical layer
performance degradation.
39. What are two characteristics of IP? (Choose two.)

●​ does not require a dedicated end-to-end connection 42. Which subnet would include the address [Link] as a usable host address?
●​ operates independently of the network media
●​ [Link]/26
●​ retransmits packets if errors occur
●​ [Link]/27
●​ re-assembles out of order packets into the correct order at the receiver end ●​ [Link]/28
●​ guarantees delivery of packets
●​ [Link]/29
Explain:​
Explanation: For the subnet of [Link]/26, there are 6 bits for host addresses, yielding 64
The Internet Protocol (IP) is a connectionless, best effort protocol. This means that IP requires no
possible addresses. However, the first and last subnets are the network and broadcast addresses for
end-to-end connection nor does it guarantee delivery of packets. IP is also media independent, which
this subnet. Therefore, the range of host addresses for this subnet is [Link] to [Link].
means it operates independently of the network media carrying the packets.
The other subnets do not contain the address [Link] as a valid host address.
40. An employee of a large corporation remotely logs into the company using the appropriate 43. Refer to the exhibit. On the basis of the output, which two statements about network connectivity
username and password. The employee is attending an important video conference with a customer
are correct? (Choose two.)​
concerning a large sale. It is important for the video quality to be excellent during the meeting. The
employee is unaware that after a successful login, the connection to the company ISP failed. The
secondary connection, however, activated within seconds. The disruption was not noticed by the
employee or other employees.​
What three network characteristics are described in this scenario? (Choose three.)

●​ security
●​ quality of service
●​ scalability
●​ powerline networking
●​ integrity ●​ This host does not have a default gateway configured.
●​ fault tolerance ●​ There are 4 hops between this device and the device at [Link].
●​ There is connectivity between this device and the device at [Link].
Explanation: Usernames and passwords relate to network security. Good quality video, to support ●​ The connectivity between these two hosts allows for videoconferencing calls.
video conferencing, relates to prioritizing the video traffic with quality of service (QoS). The fact that a ●​ The average transmission time between the two hosts is 2 milliseconds.
connection to an ISP failed and was then restored but went unnoticed by employees relates to the
fault tolerant design of the network. Explain:​
The output displays a successful Layer 3 connection between a host computer and a host at
41. What are two common causes of signal degradation when using UTP cabling? (Choose two.) [Link]. It can be determined that 4 hops exist between them and the average transmission
●​ improper termination time is 1 milliseconds. Layer 3 connectivity does not necessarily mean that an application can run
●​ low-quality shielding in cable between the hosts.
●​ installing cables in conduit
44. Which two statements describe how to assess traffic flow patterns and network traffic types using
●​ low-quality cable or connectors
a protocol analyzer? (Choose two.)
●​ loss of light over long distances
 ●​ Capture traffic on the weekends when most employees are off work.
●​ Capture traffic during peak utilization times to get a good representation of the different
traffic types.
●​ Only capture traffic in the areas of the network that receive most of the traffic such as the
data center.
●​ Perform the capture on different network segments.
●​ Only capture WAN traffic because traffic to the web is responsible for the largest amount
of traffic on a network.

Explanation: Traffic flow patterns should be gathered during peak utilization times to get a good ●​ nothing, because the router has a route to the destination network
representation of the different traffic types. The capture should also be performed on different network ●​ open the header and use it to determine whether the data is to be sent out S0/0/0
segments because some traffic will be local to a particular segment. ●​ open the header and replace the destination MAC address with a new one
●​ remove the Ethernet header and configure a new Layer 2 header before sending it out
45. What is the consequence of configuring a router with the ipv6 unicast-routing global configuration S0/0/0
command?​
Explanation: When PC1 forms the various headers attached to the data one of those headers is the
●​ All router interfaces will be automatically activated. Layer 2 header. Because PC1 connects to an Ethernet network, an Ethernet header is used. The
●​ The IPv6 enabled router interfaces begin sending ICMPv6 Router Advertisement source MAC address will be the MAC address of PC1 and the destination MAC address will be that of
messages. G0/0 on R1. When R1 gets that information, the router removes the Layer 2 header and creates a
●​ Each router interface will generate an IPv6 link-local address.​ new one for the type of network the data will be placed onto (the serial link).
●​ It statically creates a global unicast address on this router.​
48. What will happen if the default gateway address is incorrectly configured on a host?
46. Which three layers of the OSI model map to the application layer of the TCP/IP model? (Choose
three.) ●​ The host cannot communicate with other hosts in the local network.
●​ The host cannot communicate with hosts in other networks.
●​ application
●​ A ping from the host to [Link] would not be successful.
●​ network
●​ The host will have to use ARP to determine the correct address of the default gateway.
●​ data link
●​ The switch will not forward packets initiated by the host.
●​ session
●​ presentation 49. What are two features of ARP? (Choose two.)
●​ transport
●​ When a host is encapsulating a packet into a frame, it refers to the MAC address table
Explanation: The TCP/IP model consists of four layers: application, transport, internet, and network to determine the mapping of IP addresses to MAC addresses.
access. The OSI model consists of seven layers: application, presentation, session, transport, ●​ An ARP request is sent to all devices on the Ethernet LAN and contains the IP address
network, data link, and physical. The top three layers of the OSI model: application, presentation, and of the destination host and its multicast MAC address.
session map to the application layer of the TCP/IP model. ●​ If a host is ready to send a packet to a local destination device and it has the IP address
but not the MAC address of the destination, it generates an ARP broadcast.
47. Refer to the exhibit. If PC1 is sending a packet to PC2 and routing has been configured between ●​ If no device responds to the ARP request, then the originating node will broadcast the
the two routers, what will R1 do with the Ethernet frame header attached by PC1? data packet to all devices on the network segment.
●​ If a device receiving an ARP request has the destination IPv4 address, it responds with
an ARP reply.
50. A network administrator is adding a new LAN to a branch office. The new LAN must support 90 ●​ tracert
connected devices. What is the smallest network mask that the network administrator can use for the ●​ ipconfig
new network? ●​ netstat
●​ nslookup
●​ [Link]
●​ [Link] Explain:​
●​ [Link] Traceroute (tracert) is a utility that generates a list of hops that were successfully reached along the
●​ [Link] path from source to [Link] list can provide important verification and troubleshooting
51. What are two ICMPv6 messages that are not present in ICMP for IPv4? (Choose two.) information. The ipconfig utility is used to display the IP configuration settings on a Windows PC. The
Netstat utility is used to identify which active TCP connections are open and running on a networked
●​ Neighbor Solicitation host. Nslookup is a utility that allows the user to manually query the name servers to resolve a given
●​ Destination Unreachable host name. This utility can also be used to troubleshoot name resolution issues and to verify the
●​ Host Confirmation current status of the name servers.
●​ Time Exceeded
●​ Router Advertisement 55. Which two functions are performed at the LLC sublayer of the OSI Data Link Layer to facilitate
●​ Route Redirection Ethernet communication? (Choose two.)

52. A client packet is received by a server. The packet has a destination port number of 80. What ●​ implements CSMA/CD over legacy shared half-duplex media
service is the client requesting? ●​ enables IPv4 and IPv6 to utilize the same physical medium
●​ integrates Layer 2 flows between 10 Gigabit Ethernet over fiber and 1 Gigabit Ethernet
●​ DHCP
over copper
●​ SMTP
●​ implements a process to delimit fields within an Ethernet 2 frame
●​ DNS
●​ places information in the Ethernet frame that identifies which network layer protocol is
●​ HTTP
being encapsulated by the frame
53. What is an advantage for small organizations of adopting IMAP instead of POP?
Other case:
●​ POP only allows the client to store messages in a centralized way, while IMAP allows
●​ responsible for internal structure of Ethernet frame
distributed storage.
●​ applies source and destination MAC addresses to Ethernet frame
●​ Messages are kept in the mail servers until they are manually deleted from the email
●​ handles communication between upper layer networking software and Ethernet NIC
client.
hardware
●​ When the user connects to a POP server, copies of the messages are kept in the mail
●​ adds Ethernet control information to network protocol data
server for a short time, but IMAP keeps them for a long time.
●​ implements trailer with frame check sequence for error detection
●​ IMAP sends and retrieves email, but POP only retrieves email.
Other case:
Explanation: IMAP and POP are protocols that are used to retrieve email messages. The advantage
of using IMAP instead of POP is that when the user connects to an IMAP-capable server, copies of ●​ integrates Layer 2 flows between 10 Gigabit Ethernet over fiber and 1 Gigabit Ethernet
the messages are downloaded to the client application. IMAP then stores the email messages on the over copper
server until the user manually deletes those messages. ●​ places information in the Ethernet frame that identifies which network layer protocol is
being encapsulated by the frame
54. A technician can ping the IP address of the web server of a remote company but cannot ●​ implements CSMA/CD over legacy shared half-duplex media
successfully ping the URL address of the same web server. Which software utility can the technician ●​ adds Ethernet control information to network protocol data
use to diagnose the problem? ●​ applies source and destination MAC addresses to Ethernet frame
Other case: ●​ The SSH client on the switch is enabled.
●​ The switch requires a username/password combination for remote access.
●​ enables IPv4 and IPv6 to utilize the same physical medium ●​ Communication between the switch and remote users is encrypted.
●​ adds Ethernet control information to network protocol data ●​ The switch requires remote connections via a proprietary client software.
●​ applies source and destination MAC addresses to Ethernet frame
●​ responsible for the internal structure of Ethernet frame Explanation: The transport input ssh command when entered on the switch vty (virtual terminal lines)
●​ implements trailer with frame check sequence for error detection will encrypt all inbound controlled telnet connections.
Other case:
58. Match the type of threat with the cause. (Not all options are used.)
●​ enables IPv4 and IPv6 to utilize the same physical medium
●​ applies source and destination MAC addresses to Ethernet frame
●​ integrates Layer 2 flows between 10 Gigabit Ethernet over fiber and 1 Gigabit Ethernet
over copper
●​ handles communication between upper layer networking software and Ethernet NIC
hardware
●​ responsible for internal structure of Ethernet frame

Explanation: The data link layer is actually divided into two sublayers:

+ Logical Link Control (LLC): This upper sublayer defines the software processes that provide
services to the network layer protocols. It places information in the frame that identifies which network
layer protocol is being used for the frame. This information allows multiple Layer 3 protocols, such as
IPv4 and IPv6, to utilize the same network interface and media.​ voltage spikes, insufficient supply voltage (brownouts),
+ Media Access Control (MAC): This lower sublayer defines the media access processes performed electrical threats
unconditioned power (noise), and total power loss
by the hardware. It provides data link layer addressing and delimiting of data according to the
physical signaling requirements of the medium and the type of data link layer protocol in use.

56. The global configuration command ip default-gateway [Link] is applied to a switch. What is physical damage to servers, routers, switches, cabling plant, and
hardware threats
the effect of this command? workstations

●​ The switch can communicate with other hosts on the [Link] network.
●​ The switch can be remotely managed from a host on another network. environmental temperature extremes (too hot or too cold) or humidity extremes
●​ The switch is limited to sending and receiving frames to and from the gateway threats (too wet or too dry)
[Link].
●​ The switch will have a management interface with the address [Link].

Explanation: A default gateway address is typically configured on all devices to allow them to poor handling of key electrical components (electrostatic
communicate beyond just their local [Link] a switch this is achieved using the command ip maintenance threats discharge), lack of critical spare parts, poor cabling, and poor
default-gateway <ip address>. labeling

57. What happens when the transport input ssh command is entered on the switch vty lines?
59. A disgruntled employee is using some free wireless networking tools to determine information Explanation: ARP requests are sent as broadcasts:​
about the enterprise wireless networks. This person is planning on using this information to hack the (1) All nodes will receive them, and they will be processed by software, interrupting the CPU.​
wireless network. What type of attack is this? (2) The switch forwards (floods) Layer 2 broadcasts to all ports.

●​ DoS A switch does not change its MAC table based on ARP request or reply messages. The switch
●​ access populates the MAC table using the source MAC address of all frames. The ARP payload is very small
●​ reconnaissance and does not overload the switch.
●​ Trojan horse
63. A group of Windows PCs in a new subnet has been added to an Ethernet network. When testing
Explanation: A reconnaissance attack is the unauthorized discovery and documentation of various the connectivity, a technician finds that these PCs can access local network resources but not the
computing networks, network systems, resources, applications, services, or vulnerabilities. Internet resources. To troubleshoot the problem, the technician wants to initially confirm the IP
address and DNS configurations on the PCs, and also verify connectivity to the local router. Which
60. What service is provided by HTTP? three Windows CLI commands and utilities will provide the necessary information? (Choose three.)
●​ Uses encryption to secure the exchange of text, graphic images, sound, and video on ●​ netsh interface ipv6 show neighbor
the web. ●​ arp -a
●​ Allows for data transfers between a client and a file server. ●​ tracert
●​ An application that allows real-time chatting among remote users. ●​ ping
●​ A basic set of rules for exchanging text, graphic images, sound, video, and other ●​ ipconfig
multimedia files on the web. ●​ nslookup
61. A client packet is received by a server. The packet has a destination port number of 67. What ●​ telnet
service is the client requesting? 64. During the process of forwarding traffic, what will the router do immediately after matching the
●​ FTP destination IP address to a network on a directly connected routing table entry?
●​ DHCP ●​ analyze the destination IP address
●​ Telnet ●​ switch the packet to the directly connected interface
●​ SSH ●​ look up the next-hop address for the packet
62. What are two problems that can be caused by a large number of ARP request and reply ●​ discard the traffic after consulting the route table
messages? (Choose two.)
Explanation: A router receives a packet on an interface and looks at the destination IP address. It
●​ Switches become overloaded because they concentrate all the traffic from the attached consults its routing table and matches the destination IP address to a routing table entry. The router
subnets. then discovers that it has to send the packet to the next-hop address or out to a directly connected
●​ The ARP request is sent as a broadcast, and will flood the entire subnet. interface. When the destination address is on a directly connected interface, the packet is switched
●​ The network may become overloaded because ARP reply messages have a very large over to that interface.
payload due to the 48-bit MAC address and 32-bit IP address that they contain.
●​ A large number of ARP request and reply messages may slow down the switching 65. What characteristic describes antispyware?
process, leading the switch to make many changes in its MAC table.
●​ applications that protect end devices from becoming infected with malicious software
●​ All ARP request messages must be processed by all nodes on the local network.
●​ a network device that filters access and traffic coming into a network
●​ software on a router that filters traffic based on IP addresses or applications
●​ a tunneling protocol that provides remote users with secure access into the network of
an organization
66. A network administrator needs to keep the user ID, password, and session contents private when 70. A network administrator is adding a new LAN to a branch office. The new LAN must support 4
establishing remote CLI connectivity with a switch to manage it. Which access method should be connected devices. What is the smallest network mask that the network administrator can use for the
chosen? new network?

●​ Telnet ●​ [Link]
●​ AUX ●​ [Link]
●​ SSH ●​ [Link]
●​ Console ●​ [Link]
67. What are the two most effective ways to defend against malware? (Choose two.) 71. What service is provided by POP3?

●​ Implement a VPN. ●​ Retrieves email from the server by downloading the email to the local mail application of
●​ Implement network firewalls. the client.
●​ Implement RAID. ●​ An application that allows real-time chatting among remote users.
●​ Implement strong passwords. ●​ Allows remote access to network devices and servers.
●​ Update the operating system and other application software. ●​ Uses encryption to provide secure remote access to network devices and servers.
●​ Install and update antivirus software.
72. What two security solutions are most likely to be used only in a corporate environment? (Choose
two.)
Explanation: A cybersecurity specialist must be aware of the technologies and measures that are
used as countermeasures to protect the organization from threats and vulnerabilities. ●​ antispyware
●​ virtual private networks
68. Which type of security threat would be responsible if a spreadsheet add-on disables the local
●​ intrusion prevention systems
software firewall?
●​ strong passwords
●​ brute-force attack ●​ antivirus software
●​ Trojan horse 73. What characteristic describes antivirus software?
●​ DoS
●​ buffer overflow ●​ applications that protect end devices from becoming infected with malicious software
●​ a network device that filters access and traffic coming into a network
Explanation: A Trojan horse is software that does something harmful, but is hidden in legitimate ●​ a tunneling protocol that provides remote users with secure access into the network of
software code. A denial of service (DoS) attack results in interruption of network services to users, an organization
network devices, or applications. A brute-force attack commonly involves trying to access a network ●​ software on a router that filters traffic based on IP addresses or applications
device. A buffer overflow occurs when a program attempts to store more data in a memory location
74. What mechanism is used by a router to prevent a received IPv4 packet from traveling endlessly
than it can hold.
on a network?
69. Which frame field is created by a source node and used by a destination node to ensure that a
●​ It checks the value of the TTL field and if it is 0, it discards the packet and sends a
transmitted data signal has not been altered by interference, distortion, or signal loss?
Destination Unreachable message to the source host.
●​ User Datagram Protocol field ●​ It checks the value of the TTL field and if it is 100, it discards the packet and sends a
●​ transport layer error check field Destination Unreachable message to the source host.
●​ flow control field ●​ It decrements the value of the TTL field by 1 and if the result is 0, it discards the packet
●​ frame check sequence field and sends a Time Exceeded message to the source host.
●​ error correction process field
 ●​ It increments the value of the TTL field by 1 and if the result is 100, it discards the packet ●​ integrates Layer 2 flows between 10 Gigabit Ethernet over fiber and 1 Gigabit Ethernet
and sends a Parameter Problem message to the source host. over copper
●​ enables IPv4 and IPv6 to utilize the same physical medium
75. A client packet is received by a server. The packet has a destination port number of 69. What
●​ handles communication between upper layer networking software and Ethernet NIC
service is the client requesting?
hardware
●​ DNS ●​ adds Ethernet control information to network protocol data
●​ DHCP ●​ implements CSMA/CD over legacy shared half-duplex media
●​ SMTP Case 4:
●​ TFTP
●​ applies delimiting of Ethernet frame fields to synchronize communication between nodes
76. An administrator defined a local user account with a secret password on router R1 for use with
●​ places information in the Ethernet frame that identifies which network layer protocol is
SSH. Which three additional steps are required to configure R1 to accept only encrypted SSH
being encapsulated by the frame
connections? (Choose three.)
●​ adds Ethernet control information to network protocol data
●​ Configure DNS on the router. ●​ implements trailer with frame check sequence for error detection
●​ Generate two-way pre-shared keys. ●​ handles communication between upper layer networking software and Ethernet NIC
●​ Configure the IP domain name on the router. hardware
●​ Generate the SSH keys. Case 5:
●​ Enable inbound vty SSH sessions.
●​ Enable inbound vty Telnet sessions. ●​ applies delimiting of Ethernet frame fields to synchronize communication between nodes
●​ applies source and destination MAC addresses to Ethernet frame
77. Which two functions are performed at the MAC sublayer of the OSI Data Link Layer to facilitate
●​ places information in the Ethernet frame that identifies which network layer protocol is
Ethernet communication? (Choose two.)
being encapsulated by the frame
●​ handles communication between upper layer networking software and Ethernet NIC ●​ handles communication between upper layer networking software and Ethernet NIC
hardware hardware
●​ implements trailer with frame check sequence for error detection ●​ adds Ethernet control information to network protocol data
●​ places information in the Ethernet frame that identifies which network layer protocol is 78. An IPv6 enabled device sends a data packet with the destination address of FF02::2. What is the
being encapsulated by the frame target of this packet?​
●​ implements a process to delimit fields within an Ethernet 2 frame
●​ adds Ethernet control information to network protocol data ●​ all IPv6 enabled devices on the local link​
●​ all IPv6 DHCP servers​
Case 2:
●​ all IPv6 enabled devices across the network​
●​ places information in the Ethernet frame that identifies which network layer protocol is ●​ all IPv6 configured routers on the local link​
being encapsulated by the frame
●​ adds Ethernet control information to network protocol data Explanation: FF02::2 identifies all IPv6 routers that exist on the link or network. FF02::1 is the target
●​ responsible for internal structure of Ethernet frame for all IPv6 enabled devices on the link or network.​
●​ enables IPv4 and IPv6 to utilize the same physical medium
79. What are the three parts of an IPv6 global unicast address? (Choose three.)
●​ implements trailer with frame check sequence for error detection
Case 3: ●​ subnet ID
●​ subnet mask
●​ broadcast address
 ●​ global routing prefix ●​ provides delivery of data between two applications
●​ interface ID ●​ provides for the exchange of frames over a common local media
84. What is the purpose of the TCP sliding window?
Explanation: The general format for IPv6 global unicast addresses includes a global routing prefix, a
subnet ID, and an interface ID. The global routing prefix is the network portion of the address. A ●​ to ensure that segments arrive in order at the destination
typical global routing prefix is /48 assigned by the Internet provider. The subnet ID portion can be ●​ to end communication when data transmission is complete
used by an organization to create multiple subnetwork numbers. The interface ID is similar to the host ●​ to inform a source to retransmit data from a specific point forward
portion of an IPv4 address. ●​ to request that a source decrease the rate at which it transmits data

80. A network administrator is designing the layout of a new wireless network. Which three areas of Explanation: The TCP sliding window allows a destination device to inform a source to slow down the
concern should be accounted for when building a wireless network? (Choose three.) rate of transmission. To do this, the destination device reduces the value contained in the window
field of the segment. It is acknowledgment numbers that are used to specify retransmission from a
●​ extensive cabling
specific point forward. It is sequence numbers that are used to ensure segments arrive in order.
●​ mobility options
Finally, it is a FIN control bit that is used to end a communication session.
●​ packet collision
●​ interference
85. What characteristic describes spyware?
●​ security
●​ coverage area ●​ a network device that filters access and traffic coming into a network
●​ software that is installed on a user device and collects information about the user
Explanation: The three areas of concern for wireless networks focus on the size of the coverage area, ●​ an attack that slows or crashes a device or network service
any nearby interference, and providing network security. Extensive cabling is not a concern for ●​ the use of stolen credentials to access private data
wireless networks, as a wireless network will require minimal cabling for providing wireless access to
hosts. Mobility options are not a component of the areas of concern for wireless networks. 86. Which switching method drops frames that fail the FCS check?

●​ store-and-forward switching
81. A new network administrator has been asked to enter a banner message on a Cisco device. What
●​ borderless switching
is the fastest way a network administrator could test whether the banner is properly configured?
●​ ingress port buffering
●​ Enter CTRL-Z at the privileged mode prompt. ●​ cut-through switching
●​ Exit global configuration mode.
87. Which range of link-local addresses can be assigned to an IPv6-enabled interface?
●​ Power cycle the device.
●​ Reboot the device. ●​ FEC0::/10
●​ Exit privileged EXEC mode and press Enter . ●​ FDEE::/7
●​ FE80::/10
82. What method is used to manage contention-based access on a wireless network?
●​ FF00::/8
●​ token passing
●​ CSMA/CA Explain:​
●​ priority ordering Link-local addresses are in the range of FE80::/10 to FEBF::/10. The original IPv6 specification
●​ CSMA/CD defined site-local addresses and used the prefix range FEC0::/10, but these addresses were
deprecated by the IETF in favor of unique local addresses. FDEE::/7 is a unique local address
83. What is a function of the data link layer? because it is in the range of FC00::/7 to FDFF::/7. IPv6 multicast addresses have the prefix FF00::/8.
●​ provides the formatting of data
88. What service is provided by FTP?
●​ provides end-to-end delivery of data between hosts
 ●​ A basic set of rules for exchanging text, graphic images, sound, video, and other ●​ Change the seventh bit of the MAC address from a binary 0 to a binary 1 which
multimedia files on the web. changes the hex C, into a hex E.
●​ An application that allows real-time chatting among remote users. ●​ Insert hex digits FFFE into the middle of the address.
●​ Allows for data transfers between a client and a file server. ●​ Rewrite the address in IPv6 format.
●​ Uses encryption to secure the exchange of text, graphic images, sound, and video on
the web. The three steps, when complete, give the interface ID of 1E6F:65FF:FEC2:BDF8.
89. A user is attempting to access [Link] without success. Which two configuration
values must be set on the host to allow this access? (Choose two.) 92. Refer to the exhibit. PC1 issues an ARP request because it needs to send a packet to PC2. In
this scenario, what will happen next?​
●​ DNS server
●​ source port number
●​ HTTP server
●​ source MAC address
●​ default gateway
90. Which two statements accurately describe an advantage or a disadvantage when deploying NAT
for IPv4 in a network? (Choose two.)

●​ NAT adds authentication capability to IPv4.

●​ NAT introduces problems for some applications that require end-to-end connectivity.
●​ NAT will impact negatively on switch performance.
●​ NAT provides a solution to slow down the IPv4 address depletion. ●​ SW1 will send an ARP reply with the SW1 Fa0/1 MAC address.​
●​ NAT improves packet handling. ●​ SW1 will send an ARP reply with the PC2 MAC address.​
●​ NAT causes routing tables to include more information. ●​ PC2 will send an ARP reply with the PC2 MAC address.
●​ RT1 will send an ARP reply with the RT1 Fa0/0 MAC address.​
Explanation: Network Address Translation (NAT) is a technology that is implemented within IPv4 ●​ RT1 will send an ARP reply with the PC2 MAC address.​
networks. One application of NAT is to use private IP addresses inside a network and use NAT to
share a few public IP addresses for many internal hosts. In this way it provides a solution to slow Explain: When a network device wants to communicate with another device on the same network, it
down the IPv4 address depletion. However, since NAT hides the actual IP addresses that are used by sends a broadcast ARP request. In this case, the request will contain the IP address of PC2. The
end devices, it may cause problems for some applications that require end-to-end connectivity. destination device (PC2) sends an ARP reply with its MAC address.

91. What would be the interface ID of an IPv6 enabled interface with a MAC address of 93. What service is provided by BOOTP?
1C-6F-65-C2-BD-F8 when the interface ID is generated by using the EUI-64 process?
●​ Uses encryption to secure the exchange of text, graphic images, sound, and video on
●​ 0C6F:65FF:FEC2:BDF8 the web.
●​ 1E6F:65FF:FEC2:BDF8 ●​ Allows for data transfers between a client and a file server.
●​ C16F:65FF:FEC2:BDF8 ●​ Legacy application that enables a diskless workstation to discover its own IP address
●​ 106F:65FF:FEC2:BDF8 and find a BOOTP server on the network.
●​ A basic set of rules for exchanging text, graphic images, sound, video, and other
Explanation: To derive the EUI-64 interface ID by using the MAC address 1C-6F-65-C2-BD-F8, three multimedia files on the web.
steps are taken.
94. What characteristic describes adware?
 ●​ a network device that filters access and traffic coming into a network 97. What are two primary responsibilities of the Ethernet MAC sublayer? (Choose two.)
●​ software that is installed on a user device and collects information about the user
●​ the use of stolen credentials to access private data ●​ error detection
●​ an attack that slows or crashes a device or network service ●​ frame delimiting
●​ accessing the media
95. When a switch configuration includes a user-defined error threshold on a per-port basis, to which ●​ data encapsulation
switching method will the switch revert when the error threshold is reached? ●​ logical addressing
●​ cut-through 98. Refer to the exhibit. What three facts can be determined from the viewable output of the show ip
●​ store-and-forward interface brief command? (Choose three.)​
●​ fast-forward
●​ fragment-free
96. Match a statement to the related network model. (Not all options are used.)

●​ Two physical interfaces have been configured.

●​ The switch can be remotely managed.
●​ One device is attached to a physical interface.
●​ Passwords have been configured on the switch.
●​ Two devices are attached to the switch.
●​ The default SVI has been configured.
ITN (Version 7.00) – ITNv7 Final Exam
Explain:​
Place the options in the following order:peer-to-peer network​ Vlan1 is the default SVI. Because an SVI has been configured, the switch can be configured and
[+] no dedicated server is required​ managed remotely. FastEthernet0/0 is showing up and up, so a device is connected.
[+] client and server roles are set on a per request basis​
peer-to-peer aplication​
[#] requires a specific user interface​
[#] a background service is required

Explain:​
Peer-to-peer networks do not require the use of a dedicated server, and devices can assume both
client and server roles simultaneously on a per request basis. Because they do not require formalized
accounts or permissions, they are best used in limited situations. Peer-to-peer applications require a
user interface and background service to be running, and can be used in more diverse situations.
99. Match each type of frame field to its function. (Not all options are used.)​ 101. Match the firewall function to the type of threat protection it provides to the network. (Not all
options are used.)​

prevents access by port number application filtering

prevents access based on IP or MAC address packet filtering

addressing This field helps to direct the frame toward its destination.

prevents unsolicited incoming sessions stateful packet inspection

error detection This field checks if the frame has been damaged during the transfer.

prevents access to websites URL filtering

type This field is used by the LLC to identify the Layer 3 protocol.

Explain:Firewall products come packaged in various forms. These products use different techniques
frame start This field identifies the beginning of a frame. for determining what will be permitted or denied access to a network. They include the following:

+ Packet filtering – Prevents or allows access based on IP or MAC addresses​

100. What is the subnet ID associated with the IPv6 address 2001:DA48:FC5:A4:3D1B::1/64? + Application filtering – Prevents or allows access by specific application types based on port
numbers​
●​ 2001:DA48::/64​
+ URL filtering – Prevents or allows access to websites based on specific URLs or keywords​
●​ 2001:DA48:FC5::A4:/64​
+ Stateful packet inspection (SPI) – Incoming packets must be legitimate responses to requests from
●​ 2001:DA48:FC5:A4::/64​
internal hosts. Unsolicited packets are blocked unless permitted specifically. SPI can also include the
●​ 2001::/64
capability to recognize and filter out specific types of attacks, such as denial of service (DoS)
102. Users are reporting longer delays in authentication and in accessing network resources during PCs – 20 addresses needed​
certain time periods of the week. What kind of information should network engineers check to find out Printers – 2 addresses needed​
if this situation is part of a normal network behavior? Scanners – 2 addresses needed

●​ syslog records and messages The network administrator has deemed that [Link]/24 is to be the network used at this site.
●​ the network performance baseline Which single subnet mask would make the most efficient use of the available addresses to use for the
●​ debug output and packet captures four subnetworks?
●​ network configuration files
●​ [Link]
103. How does the service password-encryption command enhance password security on Cisco ●​ [Link]
routers and switches? ●​ [Link]
●​ [Link]
●​ It requires encrypted passwords to be used when connecting remotely to a router or
●​ [Link]
switch with Telnet.
●​ [Link]
●​ It encrypts passwords that are stored in router or switch configuration files.
●​ It requires that a user type encrypted passwords to gain console access to a router or 106. What characteristic describes identity theft?
switch.
●​ It encrypts passwords as they are sent across the network. ●​ the use of stolen credentials to access private data
●​ software on a router that filters traffic based on IP addresses or applications
Explain: The service password-encryption command encrypts plaintext passwords in the ●​ software that identifies fast-spreading threats
configuration file so that they cannot be viewed by unauthorized users. ●​ a tunneling protocol that provides remote users with secure access into the network of
an organization
104. Which two statements are correct in a comparison of IPv4 and IPv6 packet headers? (Choose
107. A network administrator is adding a new LAN to a branch office. The new LAN must support 200
two.)
connected devices. What is the smallest network mask that the network administrator can use for the
●​ The Source Address field name from IPv4 is kept in IPv6. new network?
●​ The Version field from IPv4 is not kept in IPv6.
●​ [Link]
●​ The Destination Address field is new in IPv6.
●​ [Link]
●​ The Header Checksum field name from IPv4 is kept in IPv6.
●​ [Link]
●​ The Time-to-Live field from IPv4 has been replaced by the Hop Limit field in IPv6.
●​ [Link]
Explanation: The IPv6 packet header fields are as follows: Version, Traffic Class, Flow Label, Payload 108. What are three commonly followed standards for constructing and installing cabling? (Choose
Length, Next Header, Hop Limit, Source Address, and Destination Address. The IPv4 packet header three.)
fields include the following: Version, Differentiated Services, Time-to-Live, Protocol, Source IP
Address, and Destination IP Address. Both versions have a 4-bit Version field. Both versions have a ●​ cost per meter (foot)
Source (IP) Address field. IPv4 addresses are 32 bits; IPv6 addresses are 128 bits. The Time-to-Live ●​ cable lengths
or TTL field in IPv4 is now called Hop Limit in IPv6, but this field serves the same purpose in both ●​ connector color
versions. The value in this 8-bit field decrements each time a packet passes through any router. ●​ pinouts
When this value is 0, the packet is discarded and is not forwarded to any other router. ●​ connector types
●​ tensile strength of plastic insulator
105. A network administrator wants to have the same network mask for all networks at a particular
109. Refer to the exhibit. What is wrong with the displayed termination?
small site. The site has the following networks and number of devices:​
IP phones – 22 addresses​
 IP address MAC address

contained in the Layer 3 header contained in the Layer 2 header

separated into a network portion and a unique separated into OUI and a unique
identifier identifier

●​ The woven copper braid should not have been removed.

●​ The wrong type of connector is being used. 32 or 128 bits 48 bits
●​ The untwisted length of each wire is too long.
●​ The wires are too thick for the connector that is used.
111. A client packet is received by a server. The packet has a destination port number of 143. What
Explanation: When a cable to an RJ-45 connector is terminated, it is important to ensure that the service is the client requesting?
untwisted wires are not too long and that the flexible plastic sheath surrounding the wires is crimped
●​ IMAP
down and not the bare wires. None of the colored wires should be visible from the bottom of the jack.
●​ FTP
110. Match the characteristic to the category. (Not all options are used.)​ ●​ SSH
●​ Telnet
112. What are two characteristics shared by TCP and UDP? (Choose two.)

●​ default window size

●​ connectionless communication
●​ port numbering
●​ 3-way handshake
●​ ability to to carry digitized voice
●​ use of checksum

Explain:​
Both TCP and UDP use source and destination port numbers to distinguish different data streams
and to forward the right data segments to the right applications. Error checking the header and data is
done by both protocols by using a checksum calculation to determine the integrity of the data that is
received. TCP is connection-oriented and uses a 3-way handshake to establish an initial connection.
TCP also uses window to regulate the amount of traffic sent before receiving an acknowledgment.
UDP is connectionless and is the best protocol for carry digitized VoIP signals.
113. Refer to the exhibit. Which two network addresses can be assigned to the network containing 10 ●​ IP address
hosts? Your answers should waste the fewest addresses, not reuse addresses that are already ●​ MAC address
assigned, and stay within the [Link]/24 range of addresses. (Choose two.) ●​ RJ-45 port
●​ TCP/IP protocol stack
116. A network administrator is adding a new LAN to a branch office. The new LAN must support 10
connected devices. What is the smallest network mask that the network administrator can use for the
new network?

●​ [Link]
●​ [Link]
●​ [Link]
●​ [Link]
117. What technique is used with UTP cable to help protect against signal interference from
crosstalk?

●​ wrapping a foil shield around the wire pairs

●​ twisting the wires together into pairs
●​ terminating the cable with special grounded connectors
●​ encasing the cables within a flexible plastic sheath
●​ [Link]/28
●​ [Link]/28 Explanation: To help prevent the effects of crosstalk, UTP cable wires are twisted together into pairs.
●​ [Link]/27 Twisting the wires together causes the magnetic fields of each wire to cancel each other out.
●​ [Link]/27
118. Refer to the exhibit. The network administrator has assigned the LAN of LBMISS an address
●​ [Link]/27
range of [Link]. This address range has been subnetted using a /29 prefix. In order to
●​ [Link]/28
accommodate a new building, the technician has decided to use the fifth subnet for configuring the
Explanation: Addresses [Link] through [Link] are taken for the leftmost network. new network (subnet zero is the first subnet). By company policies, the router interface is always
Addresses 192 through 199 are used by the center network. Because 4 host bits are needed to assigned the first usable host address and the workgroup server is given the last usable host
accommodate 10 hosts, a /28 mask is needed. [Link]/28 is not a valid network number. Two address. Which configuration should be entered into the properties of the workgroup server to allow
subnets that can be used are [Link]/28 and [Link]/28. connectivity to the Internet?​

114. A client packet is received by a server. The packet has a destination port number of 21. What
service is the client requesting?

●​ FTP
●​ LDAP
●​ SLP
●​ SNMP
115. What attribute of a NIC would place it at the data link layer of the OSI model?

●​ attached Ethernet cable

 ●​ IP address: [Link] subnet mask: [Link], default gateway: 120. Match a statement to the related network model. (Not all options are used.)
[Link]
●​ IP address: [Link] subnet mask: [Link], default gateway:
[Link]
●​ IP address: [Link] subnet mask: [Link], default gateway:
[Link]
●​ IP address: [Link] subnet mask: [Link], default gateway:
[Link]
●​ IP address: [Link] subnet mask: [Link], default gateway: [Link]

Explain:​
Using a /29 prefix to subnet [Link] results in subnets that increment by 8:​
[Link] (1)​
[Link] (2)​
[Link] (3)​
[Link] (4)​
[Link] (5) ITN (Version 7.00) – ITNv7 Final Exam
Place the options in the following order:peer-to-peer network​
119. Refer to the exhibit. The switches are in their default configuration. Host A needs to [+] no dedicated server is required​
communicate with host D, but host A does not have the MAC address for its default gateway. Which [+] client and server roles are set on a per request basis​
network hosts will receive the ARP request sent by host A?​ peer-to-peer aplication​
[#] requires a specific user interface​
[#] a background service is required

Explain:​
Peer-to-peer networks do not require the use of a dedicated server, and devices can assume both
client and server roles simultaneously on a per request basis. Because they do not require formalized
accounts or permissions, they are best used in limited situations. Peer-to-peer applications require a
user interface and background service to be running, and can be used in more diverse situations.

●​ only host D 121. Refer to the exhibit. A network engineer has been given the network address of [Link]
●​ only router R1 and a subnet mask of [Link] to subnet across the four networks shown. How many total
●​ only hosts A, B, and C
●​ only hosts A, B, C, and D
●​ only hosts B and C
●​ only hosts B, C, and router R1

Explain:​
Since host A does not have the MAC address of the default gateway in its ARP table, host A sends
an ARP broadcast. The ARP broadcast would be sent to every device on the local network. Hosts B,
C, and router R1 would receive the broadcast. Router R1 would not forward the message.
host addresses are unused across all four subnets?​ ●​ Uses encryption to provide secure remote access to network devices and servers.
126. Match the header field with the appropriate layer of the OSI model. (Not all options are used.)​

●​ 88
●​ 200
●​ 72
●​ 224
●​ 158
123. A client packet is received by a server. The packet has a destination port number of 22. What
service is the client requesting?

●​ SSH
●​ SMB/CIFS
●​ HTTPS Layer 2 Layer 3 Layer 4
●​ SLP
124. What characteristic describes an IPS?
802.2 header source IP address destination port number
●​ a tunneling protocol that provides remote users with secure access into the network of
an organization
●​ a network device that filters access and traffic coming into a network
●​ software that identifies fast-spreading threats FCS (frame check sequence) TTL Acknowledgement number
●​ software on a router that filters traffic based on IP addresses or applications

Explanation: IPS – An intrusion prevention system (IPS) monitors incoming and outgoing traffic destination MAC address
looking for malware, network attack signatures, and more. If it recognizes a threat, it can immediately
stop it.
127. Refer to the exhibit. The switches have a default configuration. Host A needs to communicate
125. What service is provided by DHCP? with host D, but host A does not have the MAC address for the default gateway. Which network
devices will receive the ARP request sent by host A?
●​ An application that allows real-time chatting among remote users.
●​ Allows remote access to network devices and servers.
●​ Dynamically assigns IP addresses to end and intermediary devices.
 ●​ neighbor solicitations
●​ echo requests
●​ neighbor advertisements
●​ echo replies
●​ router solicitations
●​ router advertisements
130. A client is using SLAAC to obtain an IPv6 address for its interface. After an address has been
generated and applied to the interface, what must the client do before it can begin to use this IPv6
address?

●​ It must send a DHCPv6 INFORMATION-REQUEST message to request the address of

the DNS server.
i360201v3n1_275353.png ●​ It must send a DHCPv6 REQUEST message to the DHCPv6 server to request
permission to use this address.
●​ only host D
●​ It must send an ICMPv6 Router Solicitation message to determine what default gateway
●​ only hosts A, B, C, and D
it should use.
●​ only hosts B and C
●​ It must send an ICMPv6 Neighbor Solicitation message to ensure that the address is not
●​ only hosts B, C, and router R1
already in use on the network.
●​ only hosts A, B, and C
●​ only router R1 131. Two pings were issued from a host on a local network. The first ping was issued to the IP
address of the default gateway of the host and it failed. The second ping was issued to the IP address
Explanation: Because host A does not have the MAC address of the default gateway in the ARP of a host outside the local network and it was successful. What is a possible cause for the failed ping?
table, host A sends an ARP broadcast. The ARP broadcast would be sent to every device on the
local network. Hosts B, C, and router R1 would receive the broadcast. Router R1 would not forward ●​ The default gateway is not operational.
the message. ●​ The default gateway device is configured with the wrong IP address.
●​ Security rules are applied to the default gateway device, preventing it from processing
128. Which wireless technology has low-power and low-data rate requirements making it popular in ping requests.
IoT environments? ●​ The TCP/IP stack on the default gateway is not working properly.

●​ Bluetooth 132. An organization is assigned an IPv6 address block of 2001:db8:0:ca00::/56. How many subnets
●​ Zigbee can be created without using bits in the interface ID space?
●​ WiMAX
●​ 256
●​ Wi-Fi
●​ 512
●​ 1024
Explanation: Zigbee is a specification used for low-data rate, low-power communications. It is
●​ 4096
intended for applications that require short-range, low data-rates and long battery life. Zigbee is
typically used for industrial and Internet of Things (IoT) environments such as wireless light switches 133. What subnet mask is needed if an IPv4 network has 40 devices that need IP addresses and
and medical device data collection. address space is not to be wasted?

129. What two ICMPv6 message types must be permitted through IPv6 access control lists to allow ●​ [Link]
resolution of Layer 3 addresses to Layer 2 MAC addresses? (Choose two.) ●​ [Link]
●​ [Link]
 ●​ [Link] ●​ Technology is integrated into every-day appliances allowing them to interconnect with
●​ [Link] other devices, making them more ‘smart’ or automated.
●​ Network capabilities are extended without requiring investment in new infrastructure,
Explanation: In order to accommodate 40 devices, 6 host bits are needed. With 6 bits, 64 addresses personnel, or software.
are possible, but one address is for the subnet number and one address is for a broadcast. This ●​ End users have the freedom to use personal tools to access information and
leaves 62 addresses that can be assigned to network devices. The mask associated with leaving 6 communicate across a business network.
host bits for addressing is [Link]. ●​ Home networking uses existing electrical wiring to connect devices to the network
wherever there is an electrical outlet, saving the cost of installing data cables.
134. Refer to the exhibit. If host A sends an IP packet to host B, what will the destination address be
in the frame when it leaves host A? Explanation: Cloud computing extends IT’s capabilities without requiring investment in new
infrastructure, training new personnel, or licensing new software. These services are available
on-demand and delivered economically to any device anywhere in the world without compromising
security or function. BYOD is about end users having the freedom to use personal tools to access
information and communicate across a business or campus network. Smart home technology is
integrated into every-day appliances allowing them to interconnect with other devices, making them
more ‘smart’ or automated. Powerline networking is a trend for home networking that uses existing
electrical wiring to connect devices to the network wherever there is an electrical outlet, saving the
cost of installing data cables.

136. Which two statements are correct about MAC and IP addresses during data transmission if NAT
is not involved? (Choose two.)

●​ Destination IP addresses in a packet header remain constant along the entire path to a
target host.
●​ DD:DD:DD:DD:DD:DD ●​ Destination MAC addresses will never change in a frame that goes across seven
●​ [Link] routers.
●​ CC:CC:CC:CC:CC:CC ●​ Every time a frame is encapsulated with a new destination MAC address, a new
●​ [Link] destination IP address is needed.
●​ BB:BB:BB:BB:BB:BB ●​ Destination and source MAC addresses have local significance and change every time a
●​ AA:AA:AA:AA:AA:AA frame goes from one LAN to another.
●​ A packet that has crossed four routers has changed the destination IP address four
Explain:​ times.
When a host sends information to a distant network, the Layer 2 frame header will contain a source 137. What is one main characteristic of the data link layer?
and destination MAC address. The source address will be the originating host device. The destination
address will be the router interface that connects to the same network. In the case of host A sending ●​ It generates the electrical or optical signals that represent the 1 and 0 on the media.
information to host B, the source address is AA:AA:AA:AA:AA:AA and the destination address is the ●​ It converts a stream of data bits into a predefined code.
MAC address assigned to the R2 Ethernet interface, BB:BB:BB:BB:BB:BB. ●​ It shields the upper layer protocol from being aware of the physical medium to be used
in the communication.
135. What is a benefit of using cloud computing in networking? ●​ It accepts Layer 3 packets and decides the path by which to forward the packet to a
remote network.
138. What are three characteristics of the CSMA/CD process? (Choose three.)
 ●​ The device with the electronic token is the only one that can transmit after a collision. 141. What are two functions that are provided by the network layer? (Choose two.)
●​ A device listens and waits until the media is not busy before transmitting.
●​ After detecting a collision, hosts can attempt to resume transmission after a random time ●​ directing data packets to destination hosts on other networks
delay has expired. ●​ placing data on the network medium
●​ All of the devices on a segment see data that passes on the network medium. ●​ carrying data between processes that are running on source and destination hosts
●​ A jam signal indicates that the collision has cleared and the media is not busy. ●​ providing dedicated end-to-end connections
●​ Devices can be configured with a higher transmission priority. ●​ providing end devices with a unique network identifier

Explanation: The Carrier Sense Multiple Access/Collision Detection (CSMA/CD) process is a Explanation: The network layer is primarily concerned with passing data from a source to a
contention-based media access control mechanism used on shared media access networks, such as destination on another network. IP addresses supply unique identifiers for the source and destination.
Ethernet. When a device needs to transmit data, it listens and waits until the media is available The network layer provides connectionless, best-effort delivery. Devices rely on higher layers to
(quiet), then it will send data. If two devices transmit at the same time, a collision will occur. Both supply services to processes.
devices will detect the collision on the network. When a device detects a collision, it will stop the data
142. Which two statements describe features of an IPv4 routing table on a router? (Choose two.)​
transmission process, wait for a random amount of time, then try again.
●​ Directly connected interfaces will have two route source codes in the routing table: C
139. Which information does the show startup-config command display? and S .
●​ the IOS image copied into RAM ●​ If there are two or more possible routes to the same destination, the route associated
●​ the bootstrap program in the ROM with the higher metric value is included in the routing table.
●​ the contents of the current running configuration file in the RAM ●​ The netstat -r command can be used to display the routing table of a router.​
●​ the contents of the saved configuration file in the NVRAM ●​ The routing table lists the MAC addresses of each active interface.
●​ It stores information about routes derived from the active router interfaces.
Explain:​ ●​ If a default static route is configured in the router, an entry will be included in the routing
The show startup-config command displays the saved configuration located in NVRAM. The show table with source code S .
running-config command displays the contents of the currently running configuration file located in Other case:
RAM.​
●​ The netstat -r command can be used to display the routing table of a router.​
140. Which two commands can be used on a Windows host to display the routing table? (Choose ●​ The routing table stores information about routes derived from the active router
two.) interfaces.
●​ The routing table lists the MAC addresses of each active interface.
●​ netstat -s
●​ Directly connected interfaces will have two route source codes in the routing table: C
●​ route print
and S .
●​ show ip route
●​ If a default static route is configured in the router, an entry will be included in the routing
●​ netstat -r
table with source code S
●​ tracert
Explanation: The show ip route command is used to display the routing table of the router. In IPv4,
Explain:​
directly connected interfaces will have one source code:C. The routing table stores information about
On a Windows host, the route print or netstat -r commands can be used to display the host routing
directly connected routes and remote routes. An entry in the routing table with a source code of S is
table. Both commands generate the same output. On a router, the show ip route command is used to
included if a default static route is configured on the router.
display the routing table. The netstat –s command is used to display per-protocol statistics. The
tracert command is used to display the path that a packet travels to its destination. 143. What characteristic describes a VPN?
 ●​ software on a router that filters traffic based on IP addresses or applications
the process of converting information from one format into
●​ software that identifies fast-spreading threats message encoding
another acceptable for transmission
●​ a tunneling protocol that provides remote users with secure access into the network of
an organization
●​ a network device that filters access and traffic coming into a network 146. A user sends an HTTP request to a web server on a remote network. During encapsulation for
144. Why would a Layer 2 switch need an IP address? this request, what information is added to the address field of a frame to indicate the destination?

●​ to enable the switch to send broadcast frames to attached PCs ●​ the network domain of the destination host
●​ to enable the switch to function as a default gateway ●​ the IP address of the default gateway
●​ to enable the switch to be managed remotely ●​ the MAC address of the destination host
●​ to enable the switch to receive frames from attached PCs ●​ the MAC address of the default gateway

Explanation: A switch, as a Layer 2 device, does not need an IP address to transmit frames to Explanation: A frame is encapsulated with source and destination MAC addresses. The source
attached devices. However, when a switch is accessed remotely through the network, it must have a device will not know the MAC address of the remote host. An ARP request will be sent by the source
Layer 3 address. The IP address must be applied to a virtual interface rather than to a physical and will be responded to by the router. The router will respond with the MAC address of its interface,
interface. Routers, not switches, function as default gateways. the one which is connected to the same network as the source.

145. Match each description to its corresponding term. (Not all options are used.) 147. What is an advantage to using a protocol that is defined by an open standard?

●​ A company can monopolize the market.

●​ The protocol can only be run on equipment from a specific vendor.
●​ An open standard protocol is not controlled or regulated by standards organizations.
●​ It encourages competition and promotes choices.

Explain:​
A monopoly by one company is not a good idea from a user point of view. If a protocol can only be
run on one brand, it makes it difficult to have mixed equipment in a network. A proprietary protocol is
not free to use. An open standard protocol will in general be implemented by a wide range of vendors.

148. Data is being sent from a source PC to a destination server. Which three statements correctly
message the process of placing one message format inside another describe the function of TCP or UDP in this situation? (Choose three.)
encapsulation message format
●​ The source port field identifies the running application or service that will handle data
returning to the PC.
●​ The TCP process running on the PC randomly selects the destination port when
the process of breaking up a long message into individual
message sizing establishing a session with the server.
pieces before being sent over the network
●​ UDP segments are encapsulated within IP packets for transport across the network.
●​ The UDP destination port number identifies the application or service on the server
which will handle the data.
●​ TCP is the preferred protocol when a function requires lower network overhead.
●​ The TCP source port number identifies the sending host on the network.
Explanation: Layer 4 port numbers identify the application or service which will handle the data. The
source port number is added by the sending device and will be the destination port number when the
requested information is returned. Layer 4 segments are encapsulated within IP packets. UDP, not
TCP, is used when low overhead is needed. A source IP address, not a TCP source port number,
identifies the sending host on the network. Destination port numbers are specific ports that a server
application or service monitors for requests.

149. Match each description with the corresponding TCP mechanism. (Not all options are used.)​

●​ [Link]
●​ [Link]
●​ [Link]
●​ [Link]
●​ [Link]

Explanation: The largest subnet in the topology has 100 hosts in it so the subnet mask must have at
least 7 host bits in it (27-2=126). [Link] has 8 hosts bits, but this does not meet the
requirement of providing the maximum number of subnets.
number of bytes a destination device can accept and process
window size
at one time 151. A network administrator wants to have the same subnet mask for three subnetworks at a small
site. The site has the following networks and numbers of devices:

Subnetwork A: IP phones – 10 addresses

used to identify missing segments of data sequence numbers
Subnetwork B: PCs – 8 addresses

Subnetwork C: Printers – 2 addresses

method of managing segments of data loss retransmission
What single subnet mask would be appropriate to use for the three subnetworks?

●​ [Link]
received by a sender before transmitting more segments in a
acknowledgment ●​ [Link]
session
●​ [Link]
●​ [Link]
150. Refer to the exhibit. A company uses the address block of [Link]/16 for its network. What Explain:​
subnet mask would provide the maximum number of equal size subnets while providing enough host If the same mask is to be used, then the network with the most hosts must be examined for number
addresses for each subnet in the exhibit?
of hosts. Because this is 10 hosts, 4 host bits are needed. The /28 or [Link] subnet mask descriptions and speed and duplex settings, use the command show running-config interface.
would be appropriate to use for these networks. ​ Next-hop addresses are displayed in the routing table with the command show ip route, and the MAC
address of an interface can be seen with the command show interfaces.
152. Match each item to the type of topology diagram on which it is typically identified. (Not all options
are used.)​ 154. A user is complaining that an external web page is taking longer than normal to [Link] web
page does eventually load on the user machine. Which tool should the technician use with
administrator privileges in order to locate where the issue is in the network?

●​ ping
●​ nslookup
●​ tracert
●​ ipconfig /displaydns

Explanation: The Command Prompt command tracert will map the path from the PC to the web
server and measure transit delays of packets across the network.

155. Which value, that is contained in an IPv4 header field, is decremented by each router that
physical topology diagram logical topology diagram receives a packet?

●​ Header Length
●​ Differentiated Services
location of a desktop PC in a classroom IP address of a server
●​ Time-to-Live
●​ Fragment Offset

path of cables that connect rooms to wiring closets Explanation: When a router receives a packet, the router will decrement the Time-to-Live (TTL) field
by one. When the field reaches zero, the receiving router will discard the packet and will send an
ICMP Time Exceeded message to the sender.
A logical topology diagram typically depicts the IP addressing scheme and groupings of devices and
ports. A physical topology diagram shows how those devices are connected to each other and the 156. A network technician is researching the use of fiber optic cabling in a new technology center.
network, focusing on the physical locations of intermediary devices, configured ports, and cabling. Which two issues should be considered before implementing fiber optic media? (Choose two.)

153. What two pieces of information are displayed in the output of the show ip interface brief ●​ Fiber optic cabling requires different termination and splicing expertise from what copper
command? (Choose two.) cabling requires.
●​ Fiber optic cabling requires specific grounding to be immune to EMI.
●​ IP addresses ●​ Fiber optic cabling is susceptible to loss of signal due to RFI.
●​ interface descriptions ●​ Fiber optic cable is able to withstand rough handling.
●​ MAC addresses ●​ Fiber optic provides higher data capacity but is more expensive than copper cabling.
●​ next-hop addresses
●​ Layer 1 statuses Explanation: Fiber optic media is more expensive than copper cabling used over the same distance.
●​ speed and duplex settings Fiber optic cables use light instead of an electrical signal, so EMI and RFI are not issues. However,
fiber optic does require different skills to terminate and splice.
Explanation: The command show ip interface brief shows the IP address of each interface, as well as
the operational status of the interfaces at both Layer 1 and Layer 2. In order to see interface
157. Match each description with an appropriate IP address. (Not all options are used.)​ 159. Users report that the network access is slow. After questioning the employees, the network
administrator learned that one employee downloaded a third-party scanning program for the printer.
What type of malware might be introduced that causes slow performance of the network?

●​ virus
●​ worm
●​ phishing
●​ spam

an experimental address [Link]

a link-local address [Link]

a public address [Link]

a loopback address [Link]

158. A user is executing a tracert to a remote device. At what point would a router, which is in the
path to the destination device, stop forwarding the packet?

●​ when the router receives an ICMP Time Exceeded message

●​ when the RTT value reaches zero
●​ when the host responds with an ICMP Echo Reply message
●​ when the value in the TTL field reaches zero
●​ when the values of both the Echo Request and Echo Reply messages reach zero

Explain:​
When a router receives a traceroute packet, the value in the TTL field is decremented by 1. When the
value in the field reaches zero, the receiving router will not forward the packet, and will send an ICMP
Time Exceeded message back to the source.