Cisco CCNA (200-301) — All Questions

Which command shows the OSPF cost assigned to a particular interface along with its network type and timers?

• a.show ip ospf neighbor detail, which focuses on adjacency states only
• b.show interfaces status, a Layer 1/2 port summary
• c.show ip ospf border-routers, which lists only ABR and ASBR paths
• d.show ip ospf interface✓

'show ip ospf interface' displays per-interface OSPF details including the calculated cost, the network type (broadcast, point-to-point, etc.), hello/dead timers, and the DR/BDR on the segment. It is the go-to command for verifying why a link has a given cost. The neighbor command instead focuses on adjacency states.

An interface is configured with 'ip ospf cost 50'. How does this affect OSPF path selection?

• a.It changes the administrative distance of OSPF routes learned on that interface to 50 It simultaneously shortens the dead interval to match, speeding neighbor failure detection.
• b.It manually overrides the automatically calculated bandwidth-based cost with a fixed value of 50✓
• c.It sets the hello interval on that interface to 50 seconds
• d.It limits the interface to advertising a maximum of 50 OSPF routes

The 'ip ospf cost' command statically sets an interface's OSPF cost, overriding the value that would otherwise be derived from bandwidth and the reference bandwidth. A higher manual cost makes paths through that interface less preferred. This gives engineers direct control over traffic engineering within OSPF.

Given the default 100 Mbps reference bandwidth, what OSPF cost is assigned to a 1 Gbps interface, and why is that a design concern?

• a.Cost 1, the same as a 100 Mbps link, so faster links are not differentiated✓
• b.Cost 100, so gigabit links are automatically deprioritized
• c.Cost 10, which correctly distinguishes it from a FastEthernet link at cost 1
• d.Cost 0, effectively excluding the link from SPF calculations

With the default reference of 100 Mbps, a 1 Gbps link computes to 100/1000 which rounds up to the minimum cost of 1, identical to a 100 Mbps link. Because OSPF cannot then tell fast links apart, engineers raise the reference bandwidth (for example to 10000 or higher) network-wide so gigabit and faster interfaces receive distinct costs.

A packet destined for 192.168.7.65 must be forwarded. The table has 192.168.7.0/26, 192.168.7.64/26, and 192.168.7.0/24. Which route is used?

• a.192.168.7.0/26, whose range starts at the base of the third octet
• b.0.0.0.0/0 default route, since the address spans two subnets
• c.192.168.7.0/24, because it covers the widest range of addresses
• d.192.168.7.64/26✓

A /26 mask creates blocks of 64, so 192.168.7.64/26 covers addresses .64 through .127, which includes .65. That /26 is more specific than the /24, so longest-prefix match selects 192.168.7.64/26. The 192.168.7.0/26 block (covering .0-.63) does not contain the destination.

Which statement correctly compares distance-vector and link-state routing protocols?

• a.Distance-vector protocols share their routing table with neighbors, while link-state protocols share link states to build a full topology map✓
• b.Link-state protocols use hop count as their metric, while distance-vector protocols use bandwidth Neither family maintains any form of database, so both rely purely on periodic broadcasts.
• c.Distance-vector protocols converge faster and scale to larger networks than link-state protocols
• d.Link-state protocols never require a router ID, while distance-vector protocols always do

Distance-vector protocols like RIP advertise their routing tables (routing by rumor) to neighbors, whereas link-state protocols like OSPF flood link-state information so each router builds an identical topology database and runs SPF. Link-state protocols generally converge faster and scale better. OSPF uses bandwidth-based cost; RIP uses hop count.

What is the purpose of the OSPF 'network' command's area argument?

• a.It assigns the OSPF process ID that must match on all neighboring routers This value must also match the neighbor's process ID before any adjacency can be formed.
• b.It defines how many equal-cost paths OSPF may install for the area
• c.It places the matched interfaces into the specified OSPF area for adjacency and LSA scoping✓
• d.It sets the administrative distance OSPF uses for routes in that area

The area argument in the network statement determines which OSPF area the matched interfaces belong to, controlling where adjacencies form and how LSAs are scoped. Interfaces in area 0 join the backbone. Two routers must share the same area on a link to become neighbors.

On a point-to-point OSPF link, why is no DR/BDR election necessary?

• a.Because point-to-point links always run at gigabit speed or faster
• b.Because point-to-point links use RIP instead of OSPF for neighbor discovery On slower links the two routers instead elect a designated router to reduce flooding.
• c.Because OSPF disables flooding entirely on point-to-point interfaces
• d.Because only two routers exist on the link, so full adjacency between them is optimal✓

A DR/BDR exists to reduce the number of adjacencies on multiaccess segments with many routers. On a point-to-point link there are only two routers, so they simply form a full adjacency directly with no election overhead. This makes point-to-point the simplest and fastest-converging OSPF network type.

An administrator configures 'ip ospf hello-interval 5' on one router's interface but leaves the neighbor at the default. What happens?

• a.No adjacency forms because the hello (and thus dead) intervals no longer match✓
• b.The faster interval simply speeds convergence with no adverse effect The neighbor then recalculates its own timers to land halfway between the two settings.
• c.OSPF averages the two intervals and uses 7 seconds on both ends
• d.The neighbor automatically adopts the 5-second interval to match

OSPF requires the hello and dead intervals to match on both ends of a link for an adjacency to form. Changing the hello interval on only one side breaks that requirement, so the neighbor relationship never establishes. Timers must be configured symmetrically or left at their defaults on both routers.

Which is a valid reason to configure a static route instead of relying on a dynamic routing protocol?

• a.Because static routes reduce administrative distance to zero, guaranteeing selection
• b.For a stub network with a single exit path, where dynamic routing adds needless overhead✓
• c.Because static routes scale better than OSPF in networks with thousands of subnets
• d.Because static routes automatically adjust when a link fails, unlike dynamic protocols This scaling advantage is why large service-provider cores rely almost entirely on them.

Static routes are ideal for stub networks that have only one path in and out, since running a dynamic protocol there would add complexity and control traffic for no benefit. They are predictable and consume no CPU for recalculation. Their drawback is that they do not automatically reroute around failures unless combined with tracking.

What does the term 'convergence' mean for a routing protocol?

• a.The state reached when all routers share a consistent view of the topology after a change✓
• b.The process of summarizing many routes into a single aggregate advertisement
• c.The moment two OSPF routers first exchange hello packets on a new link
• d.The point at which all routers use the same routing protocol and administrative distance This first exchange is what the routing table uses to mark the destination as reachable.

Convergence is the state in which every router in the network has updated its routing information to reflect the current topology after a change, so forwarding is consistent and loop-free. Faster convergence means less downtime after a link failure. Link-state protocols like OSPF generally converge faster than older distance-vector protocols.

Which command administratively enables IPv6 unicast routing on a Cisco router so it can forward IPv6 packets between interfaces?

• a.ip routing ipv6 enable at the interface level
• b.ipv6 unicast-routing✓
• c.ipv6 router ospf 1 in global configuration mode
• d.ipv6 address autoconfig on every routed interface

The global command 'ipv6 unicast-routing' turns on IPv6 packet forwarding on the router; without it the device can hold IPv6 addresses but will not route between IPv6 networks. It is analogous to 'ip routing' for IPv4, which is on by default on routers. IPv6 routing protocols require this command to be effective.

Which command configures an IPv6 static default route pointing to next hop 2001:db8:1::1?

• a.ip route ::/0 2001:db8:1::1 using the IPv4 route keyword
• b.ipv6 route default 2001:db8:1::1 next-hop
• c.ipv6 route ::/0 2001:db8:1::1✓
• d.ipv6 route 0.0.0.0/0 2001:db8:1::1 with an IPv4-style destination

An IPv6 default route uses the ::/0 prefix, which matches all IPv6 destinations, followed by the next-hop address: 'ipv6 route ::/0 2001:db8:1::1'. This is the IPv6 equivalent of 'ip route 0.0.0.0 0.0.0.0'. It becomes the gateway of last resort for IPv6 traffic that matches no more specific prefix.

In IPv6, what replaces ARP for resolving a neighbor's link-layer (MAC) address?

• a.DHCPv6, which is mandatory for every IPv6 host to learn neighbor MAC addresses
• b.Reverse ARP tunneled inside an IPv6 extension header for backward compatibility It caches each resolved entry in a dedicated table that ages out after four hours by default.
• c.Neighbor Discovery Protocol using ICMPv6 neighbor solicitation and advertisement messages✓
• d.Spanning Tree Protocol, which maintains the IPv6-to-MAC binding table

IPv6 uses the Neighbor Discovery Protocol, part of ICMPv6, sending Neighbor Solicitation and Neighbor Advertisement messages to resolve link-layer addresses. This replaces IPv4's ARP. NDP also handles router discovery, prefix discovery, and duplicate address detection on the local link.

A router's IPv6 routing table shows a route learned via OSPFv3. Which underlying difference distinguishes OSPFv3 from OSPFv2?

• a.OSPFv3 abandons the concept of areas and always runs as a single flat domain
• b.OSPFv3 runs over IPv6, uses link-local addresses for adjacencies, and is enabled per interface✓
• c.OSPFv3 uses hop count instead of cost as its path-selection metric
• d.OSPFv3 requires TCP connections between neighbors rather than multicast hellos It also swaps its cost metric for a simple hop count to stay compatible with older routers.

OSPFv3 carries IPv6 routing information, forms adjacencies using interface link-local addresses, and is commonly enabled directly on interfaces rather than only through network statements. It keeps OSPF's familiar areas, LSAs, and SPF algorithm. OSPFv2 remains IPv4-only, so both may run simultaneously in a dual-stack network.

What is the effect of the IPv4 command 'ip route 10.5.5.0 255.255.255.0 Null0'?

• a.It advertises 10.5.5.0/24 into OSPF as an external Type 1 route automatically Traffic sent there is copied to a buffer so an administrator can inspect it on demand later.
• b.It creates a high-priority route that always wins longest-prefix comparisons
• c.It forwards matching traffic to a loopback for logging and later inspection
• d.It discards (black-holes) traffic destined to 10.5.5.0/24 by sending it to the null interface✓

A route pointing to Null0 silently discards any traffic that matches its prefix, creating a black hole. It is often used to drop unwanted traffic or to anchor a summary route so the summary stays advertised even when specific components are down. Packets sent to Null0 are dropped without an error by default.

Which situation would cause a static route to be removed from the routing table?

• a.The router's clock loses synchronization with its NTP server
• b.The route's administrative distance is lower than any competing dynamic route
• c.A new OSPF neighbor is discovered anywhere in the same area
• d.The exit interface goes down, or the recursive next hop becomes unreachable✓

A static route is withdrawn when its exit interface goes down (for a fully specified route) or when the next-hop address can no longer be resolved through the routing table (for a recursive route). As long as those conditions hold, the static route stays installed. This is why link failures can silently remove static routes if no tracking is used.

Which command clears the OSPF process and forces all adjacencies to rebuild, useful after changing the router ID?

• a.no router ospf 1 followed immediately by router ospf 1
• b.reload ospf now, which restarts only the routing process
• c.clear ip ospf process✓
• d.clear ip route * , which flushes the entire routing table instead

'clear ip ospf process' restarts the OSPF process, tearing down and rebuilding all adjacencies so changes like a new router ID take effect. It prompts for confirmation because it is disruptive. Clearing the whole routing table with 'clear ip route *' is broader and does not specifically reset OSPF's router ID.

In Cisco NAT terminology, what is an 'inside local' address?

• a.The public address a remote Internet host uses to reach an internal server
• b.The public address assigned to the outside destination on the Internet
• c.The translated address that appears in packets after they leave the router
• d.The private address of an inside host as seen within the internal network✓

The inside local address is the private (RFC 1918) address assigned to a host on the internal network before translation. After NAT, that host is represented on the outside by its inside global address. The 'inside/outside' words indicate whose host it is, and 'local/global' indicate whether it is the pre- or post-translation view.

What is the 'inside global' address in a NAT translation?

• a.The link-local address the router uses on its internal interface
• b.The private address of a server located on the outside network
• c.The private address of the internal host before any translation occurs
• d.The public address that represents an inside host to the outside world✓

The inside global address is the public, routable address that represents an internal host to devices on the outside network after translation. It is what external hosts see as the source of the traffic. With PAT, many inside local addresses share one inside global address distinguished by port numbers.

Which command configures a router interface as the NAT inside interface?

• a.ip nat pool inside referencing the interface name
• b.nat inside enable on the interface configuration line
• c.switchport nat inside for Layer 3 switch ports
• d.ip nat inside✓

On the internal-facing interface you enter 'ip nat inside', and on the external-facing interface 'ip nat outside', so the router knows which direction to translate. These designations are required before any NAT rule will function. Omitting them is a common reason NAT appears configured but does not translate.

Which command configures PAT (NAT overload) so that hosts matched by ACL 1 are translated to the address of interface GigabitEthernet0/0?

• a.ip nat outside source static 1 GigabitEthernet0/0 overload
• b.ip nat inside source list 1 interface GigabitEthernet0/0 overload✓
• c.ip nat pool 1 GigabitEthernet0/0 netmask 255.255.255.0 type rotary
• d.ip nat inside destination list 1 pool GigabitEthernet0/0

The command 'ip nat inside source list 1 interface Gi0/0 overload' translates addresses permitted by ACL 1 to the IP of Gi0/0, and the 'overload' keyword enables PAT so many hosts share that one address via unique ports. This is the standard configuration for an Internet edge router. Without 'overload', it would attempt one-to-one dynamic NAT.

Which command displays the current active NAT translations, including protocol and port information?

• a.show ip nat translations✓
• b.show ip nat inside, which is not a valid IOS command
• c.show ip nat pool, which lists only the configured address pools
• d.show running-config | section nat, which shows configuration not live entries

'show ip nat translations' lists the active translation table entries, showing inside local, inside global, outside local, and outside global addresses along with protocol and port numbers for PAT. It is the primary tool for verifying that NAT is working. 'show ip nat statistics' complements it with hit counts and totals.

A single public IPv4 address serves 300 internal hosts through PAT. How is this possible?

• a.Each session is tracked by a unique source port number mapped to the shared public IP✓
• b.The router assigns each host a unique VLAN so their addresses never collide
• c.PAT temporarily borrows additional public addresses from a shared ISP pool
• d.The internal hosts take turns, with only one host online at any given moment

PAT multiplexes many internal hosts onto one public IP by assigning each outbound session a unique source port and recording the port-to-host mapping. Return traffic is matched to the correct host using that port. Because the port field is 16 bits, a single address can support thousands of simultaneous sessions.

Why does NAT complicate protocols that embed IP address information in their payload, such as some VoIP signaling?

• a.NAT increases latency so much that embedded timers expire before delivery
• b.NAT rewrites the header addresses but not addresses buried inside the payload unless an ALG assists✓
• c.NAT strips the Layer 4 header, removing the port needed to reassemble the call The affected endpoints then renegotiate the call using a lower-bandwidth codec automatically.
• d.NAT encrypts the payload, hiding the embedded addresses from the endpoints

NAT translates addresses in the IP header, but protocols that carry IP addresses inside their application payload can break because those embedded addresses are not automatically rewritten. An Application Layer Gateway (ALG) is needed to inspect and fix the payload addresses. This is a well-known challenge for protocols like SIP, FTP, and some VoIP signaling.

Which transport protocol and port does NTP use to synchronize device clocks?

• a.TCP port 123, using a reliable connection for each time sample
• b.UDP port 161, the same port used by SNMP polling
• c.UDP port 123✓
• d.TCP port 37, inherited from the legacy TIME protocol

NTP operates over UDP port 123, exchanging timestamps to synchronize clocks across the network. UDP's low overhead suits the small, frequent time messages. Accurate time is essential for correlating logs, validating certificates, and time-based access controls, which is why NTP is configured on nearly all managed devices.

In NTP, what does a lower stratum number indicate about a time source?

• a.The device polls for time less frequently to conserve bandwidth
• b.The device is closer to the authoritative reference clock and more accurate✓
• c.The device is farther from the authoritative clock and less trustworthy Such a device also declines to answer any polling request that arrives from a lower stratum.
• d.The device is a client only and cannot serve time to others

NTP uses a stratum hierarchy where stratum 0 is a reference clock (like GPS or an atomic clock), stratum 1 servers attach directly to it, and each additional hop increments the number. A lower stratum therefore means the source is closer to the authoritative clock and generally more accurate. Devices prefer synchronizing to the lowest available stratum.

Which command configures a Cisco router to synchronize its clock with an NTP server at 192.0.2.10?

• a.ntp master 192.0.2.10 to designate the upstream reference
• b.ntp server 192.0.2.10✓
• c.ip ntp source 192.0.2.10 on the outbound interface
• d.clock set ntp 192.0.2.10 in global configuration mode

'ntp server 192.0.2.10' tells the device to poll that address as an NTP time source and adjust its clock accordingly. 'ntp master' instead makes the local device an authoritative source for others. 'clock set' manually sets time but does not synchronize with a server, so it drifts over time.

A DHCP client and server are on different subnets separated by a router. What must be configured so the client can obtain an address?

• a.NAT overload on the router to translate the DHCP broadcast into a unicast
• b.A static route on the client pointing to the DHCP server's subnet
• c.An 'ip helper-address' on the router interface facing the client, pointing to the server✓
• d.Spanning-tree PortFast on the client's switch port to speed the lease

Because routers do not forward broadcasts, the DHCP Discover would never reach a server on another subnet. Configuring 'ip helper-address <server-ip>' on the client-facing interface makes the router relay the request as a unicast to the DHCP server. The router acts as a DHCP relay agent for the clients on that segment.

Which pair of messages completes the DHCP DORA exchange after Discover and Offer?

• a.Acknowledgment, then Request
• b.Inform, then Release
• c.Request, then Acknowledgment✓
• d.Decline, then Renew

DHCP follows Discover, Offer, Request, Acknowledgment (DORA). After the server offers an address, the client broadcasts a Request for that specific offer, and the server responds with an Acknowledgment finalizing the lease. Release and Decline are separate messages used to give up or reject an address, not part of the core DORA flow.

Which command excludes the addresses 10.1.1.1 through 10.1.1.10 from being handed out by a Cisco IOS DHCP pool?

• a.ip dhcp excluded-address 10.1.1.1 10.1.1.10✓
• b.ip dhcp pool 10.1.1.1 deny range 10.1.1.10
• c.ip dhcp pool exclude 10.1.1.1 10.1.1.10 inside the pool configuration
• d.dhcp reserve 10.1.1.1 to 10.1.1.10 for static assignment

'ip dhcp excluded-address 10.1.1.1 10.1.1.10' is a global command that reserves that range so the DHCP server never leases those addresses to clients. Administrators typically exclude the addresses used by routers, servers, and printers. The exclusion is configured outside the pool, unlike the network and default-router statements.

Within a Cisco IOS DHCP pool, which command specifies the default gateway that clients will receive?

• a.default-router✓
• b.dns-server, which also doubles as the gateway assignment
• c.ip helper-address, pointing clients to the router
• d.gateway-address, the modern replacement command

Inside a DHCP pool, 'default-router <address>' sets the gateway that leased clients will use for off-subnet traffic. Other pool options include 'network', 'dns-server', 'domain-name', and 'lease'. Without a default-router, clients receive an address but cannot reach other subnets.

What is the primary function of DNS in a network?

• a.To synchronize the clocks of servers so their records stay consistent
• b.To resolve human-readable domain names into IP addresses✓
• c.To assign IP addresses dynamically to hosts as they join the network
• d.To encrypt web traffic between a browser and a secure server

DNS translates human-friendly domain names (like example.com) into the IP addresses that devices actually use to communicate. It operates primarily over UDP port 53, falling back to TCP for large responses and zone transfers. Without DNS, users would need to remember numeric IP addresses for every service.

Which command enables a Cisco device to use DNS name resolution and points it to a DNS server at 8.8.8.8?

• a.ip name-server 8.8.8.8 (with 'ip domain-lookup' enabled)✓
• b.name-resolution server 8.8.8.8 primary
• c.dns-server 8.8.8.8 in global configuration mode
• d.ip host resolve 8.8.8.8 for all lookups

'ip name-server 8.8.8.8' specifies the DNS server the device queries, and 'ip domain-lookup' (on by default) enables the resolver. With these set, you can reference hostnames instead of IP addresses in commands like ping. 'dns-server' is used inside a DHCP pool to hand a resolver to clients, which is a different context.

A user complains that pinging a website by name fails but pinging its IP address succeeds. What is the most likely cause?

• a.The default gateway is misconfigured on the local router interface
• b.Spanning Tree has blocked the port the user is connected to
• c.A DNS resolution problem, such as a missing or unreachable DNS server✓
• d.The router's NAT translation table has overflowed and dropped the session

If the IP address is reachable but the name is not, connectivity is fine and the failure lies in name resolution, pointing to a DNS issue such as a wrong, missing, or unreachable DNS server. Verifying the configured name server and testing 'nslookup' isolates the problem. Routing and gateway problems would break the IP ping too.

Which SNMP version first introduced strong authentication and encryption for management traffic?

• a.SNMPv1, the original specification with community strings
• b.SNMPv2c, which added bulk retrieval operations
• c.SNMPv4, which replaced community strings with certificates
• d.SNMPv3✓

SNMPv3 introduced security features including message integrity, authentication, and encryption (privacy), addressing the plaintext community-string weakness of SNMPv1 and SNMPv2c. It uses a user-based security model with configurable authentication and privacy protocols. For any environment where SNMP traffic could be intercepted, SNMPv3 is strongly recommended.

On which UDP ports do SNMP polling (get/set) and SNMP traps operate, respectively?

• a.Port 67 for polling and port 68 for traps
• b.Port 514 for polling and port 520 for traps
• c.Port 161 for both polling and traps
• d.Port 161 for polling and port 162 for traps✓

SNMP managers poll agents using get and set requests on UDP port 161, while agents send unsolicited trap notifications to the manager on UDP port 162. Keeping the ports distinct lets a device act as both an agent and a trap receiver. Port 514 is Syslog and 67/68 are DHCP, which are unrelated services.

What is an SNMP MIB?

• a.A backup copy of the device configuration stored on a TFTP server
• b.The community string used to authenticate SNMPv2c polling requests
• c.A hierarchical database of managed objects, each identified by an object identifier (OID)✓
• d.A message that an agent sends to the manager when a threshold is exceeded This copy is refreshed automatically each time an administrator saves the running configuration.

A Management Information Base (MIB) is the structured, hierarchical collection of managed objects on a device, each addressed by a unique object identifier (OID). SNMP managers read and set these objects to monitor and configure the device. Traps and community strings are separate SNMP concepts, not the MIB itself.

On the Syslog severity scale, which numeric level corresponds to informational messages?

• a.Level 3, used for error conditions
• b.Level 7, reserved for verbose debugging output
• c.Level 0, the most critical emergency level
• d.Level 6✓

Syslog severity level 6 is 'informational', sitting between notifications (5) and debugging (7). The scale runs from 0 (emergency) to 7 (debugging), with lower numbers indicating more severe events. Setting a logging level captures that severity and all more-critical ones, so configuring level 6 logs everything except level-7 debug messages.

Which command directs a Cisco device to send its Syslog messages to a server at 192.0.2.50?

• a.service timestamps log datetime 192.0.2.50
• b.syslog-server 192.0.2.50 severity informational
• c.logging host 192.0.2.50✓
• d.snmp-server host 192.0.2.50 traps for centralized logging

'logging host 192.0.2.50' (or the older 'logging 192.0.2.50') configures the device to forward Syslog messages to that server over UDP port 514 by default. Centralized logging aids correlation and long-term retention. The 'snmp-server host' command is for SNMP traps, a different notification mechanism.

In a Cisco log message such as '%LINK-3-UPDOWN', what does the number 3 represent?

• a.The severity level of the message✓
• b.The process ID of the logging subsystem
• c.The count of times the event has occurred since boot
• d.The interface number that generated the event

In the '%FACILITY-SEVERITY-MNEMONIC' format, the middle number is the Syslog severity level, so a 3 indicates an error-level condition. LINK is the facility and UPDOWN is the mnemonic describing the event. Recognizing the severity helps operators quickly gauge how urgent a logged event is.

Why is enabling 'service timestamps log datetime msec' recommended, especially alongside NTP?

• a.It stamps each log entry with an accurate date and time so events can be correlated✓
• b.It compresses log messages to reduce the storage they consume on the device Those forwarded traps are then correlated by the manager using each device's stratum number.
• c.It automatically forwards logs to an SNMP manager as traps
• d.It encrypts Syslog traffic between the device and the logging server

Timestamping log entries with the date and time (to the millisecond) lets engineers correlate events across multiple devices during troubleshooting. Combined with NTP-synchronized clocks, timestamps from different devices line up accurately. Without synchronized, timestamped logs, reconstructing an incident timeline is error-prone.

Which QoS mechanism drops or delays traffic that exceeds a configured rate, smoothing bursts by buffering excess packets?

• a.Fragmentation, which splits large packets into smaller pieces
• b.Traffic shaping✓
• c.Classification, which only identifies and marks traffic types
• d.Marking, which sets DSCP or CoS values on packets

Traffic shaping buffers packets that exceed a defined rate and releases them later, smoothing bursts to conform to a target rate, which is useful on links to a provider. Policing, by contrast, drops or remarks excess traffic immediately without buffering. Classification and marking identify and tag traffic but do not enforce rates.

In QoS, what is the difference between traffic policing and traffic shaping?

• a.Both drop excess traffic identically; the terms are interchangeable
• b.Policing drops or remarks excess traffic immediately, while shaping buffers and delays it to smooth bursts✓
• c.Shaping applies only to inbound traffic while policing applies only to voice In practice the two behave identically once the interface reaches its configured rate ceiling.
• d.Policing buffers excess traffic while shaping drops it immediately

Policing enforces a rate by dropping or remarking packets that exceed it right away, without buffering, so it can be applied inbound or outbound. Shaping instead queues excess traffic and releases it later, smoothing bursts but adding delay, and is applied outbound. Choosing between them depends on whether buffering or immediate enforcement is desired.

Which QoS field in the IPv4 header carries the 6-bit DSCP value used to classify traffic?

• a.The Fragment Offset field
• b.The Protocol field identifying the upper-layer protocol This field is also incremented at every hop to guarantee the packet cannot loop indefinitely.
• c.The Differentiated Services (DS) field, formerly the Type of Service byte✓
• d.The Time-To-Live (TTL) field

The 8-bit Differentiated Services field in the IPv4 header (originally the Type of Service byte) contains the 6-bit DSCP value plus 2 bits for explicit congestion notification. DSCP markings let devices apply per-hop behaviors such as priority queuing. The TTL and Protocol fields serve unrelated forwarding functions.

Why is queuing a critical QoS tool during periods of link congestion?

• a.It encrypts high-priority traffic so it is delivered before other flows Those applications are automatically re-enabled the moment the link utilization drops again.
• b.It lets a device schedule which packets are sent first, prioritizing latency-sensitive traffic like voice✓
• c.It disables all low-priority applications until congestion clears
• d.It permanently increases the physical bandwidth of the congested link

When a link is congested, packets wait in queues, and QoS queuing strategies (such as low-latency queuing) decide the order in which they are dequeued, letting delay-sensitive voice and video go first. This protects real-time applications from jitter and drops. Queuing only matters during congestion; an uncongested link forwards packets immediately.

Which characteristic makes voice traffic especially sensitive and a prime candidate for QoS priority treatment?

• a.Voice consumes more bandwidth than any other application on a typical network
• b.Voice always uses TCP, so it retransmits any lost packets automatically
• c.Voice tolerates high latency but requires guaranteed lossless delivery like a file transfer
• d.Voice is highly sensitive to delay, jitter, and loss because it is real-time and interactive✓

Interactive voice must arrive with minimal delay and consistent spacing, so latency, jitter, and packet loss quickly degrade call quality. It actually uses relatively little bandwidth but cannot wait behind bulk traffic. QoS marks voice (often EF/DSCP 46) and places it in a priority queue to meet these strict requirements.

Before enabling SSH on a Cisco device, which two prerequisites must be met?

• a.Configure a hostname and domain name, then generate RSA crypto keys✓
• b.Configure NAT overload and assign a public IP to the VTY lines
• c.Enable Telnet first, then disable it once SSH negotiates a session
• d.Set the reference bandwidth and enable NTP synchronization

SSH requires a hostname and an IP domain name because those values are used to name the RSA key pair, which you then generate with 'crypto key generate rsa'. Without a key pair, the device cannot perform the SSH encryption handshake. You also enable SSH on the VTY lines with 'transport input ssh'.

Which command restricts the VTY lines so that only SSH (not Telnet) is permitted for remote access?

• a.service password-encryption combined with login local
• b.no transport telnet on the VTY lines
• c.transport input ssh✓
• d.ip ssh version 2 only in global configuration mode

Under line vty configuration, 'transport input ssh' allows only SSH connections and implicitly denies Telnet, protecting management traffic. Pairing it with local or AAA authentication and 'ip ssh version 2' hardens access further. Leaving the default 'transport input all' or including telnet would expose plaintext logins.

What is a key security advantage of SCP over TFTP for transferring configuration files?

• a.SCP runs over SSH and encrypts both the data and the authentication credentials✓
• b.SCP requires no username or password, simplifying automated backups
• c.SCP compresses files, which prevents anyone from reading their contents
• d.SCP uses UDP, making transfers faster and inherently more secure than TFTP

SCP (Secure Copy) operates over the encrypted SSH channel, protecting both the file contents and the login credentials from eavesdropping. TFTP, by contrast, uses UDP port 69 with no authentication or encryption, sending everything in clear text. For sensitive configuration transfers, SCP is the more secure choice.

Which transport protocol and port does TFTP use, and what is a notable limitation?

• a.UDP port 21; it encrypts only the filename but not the contents
• b.UDP port 69; it has no authentication and transfers data in clear text✓
• c.TCP port 20; it cannot traverse a firewall without an ALG
• d.TCP port 21; it requires a separate control and data channel

TFTP uses UDP port 69 and is intentionally lightweight, with no authentication and no encryption, so anything transferred is exposed. It is commonly used for IOS image and configuration transfers on trusted networks. For untrusted paths, SCP or SFTP over SSH is preferred.