I85PREP
⌘ K
CNPE study materials
CNPE study resources

CNPE practice questions

One question at a time. Build your CNPE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Architecture and Design

In a Palo Alto Networks NGFW deployment, which interface type is configured to face an untrusted external network such as the internet and typically hosts the default route and NAT policy?

  1. Layer 2 interface in a trust zone
  2. Layer 3 interface in an untrust zone Correct answer.
  3. Loopback interface in a management zone
  4. Virtual wire interface in a tap zone

Explanation

An untrusted-facing interface is normally a Layer 3 interface placed in a dedicated untrust zone so that security policy, NAT, and a default route can be applied. Layer 3 addressing lets the firewall act as the routed gateway toward the ISP.

Question 2Network Architecture and Design

A design requires that two internal segments share one physical firewall interface while remaining in separate security zones. Which capability enables this?

  1. Subinterfaces with 802.1Q VLAN tags Correct answer.
  2. Aggregate Ethernet with LACP
  3. Policy-based forwarding with PBF rules
  4. Virtual wire with a single pair of ports

Explanation

Tagged subinterfaces allow one physical port to carry multiple VLANs, and each subinterface can be assigned to a different zone. This preserves zone separation while conserving physical interfaces.

Question 3Network Architecture and Design

Which zone type on a Palo Alto Networks firewall is reserved for the firewall's own management plane traffic and should not carry transit user data?

  1. Trust zone
  2. Untrust zone
  3. Management zone Correct answer.
  4. DMZ zone

Explanation

The management zone is dedicated to administrative access to the firewall itself, such as web UI, SSH, and management-plane services. User transit traffic belongs in data-plane zones such as trust, untrust, or DMZ.

Question 4Network Architecture and Design

A network architect wants a single default route to summarize many internal prefixes toward the core. Which design principle does this best illustrate?

  1. Route summarization to reduce routing table size Correct answer.
  2. Equal-cost multipath for load sharing
  3. Route redistribution between protocols
  4. Policy-based routing for traffic steering

Explanation

Summarization replaces many specific prefixes with a single aggregate, shrinking the routing table and limiting topology change propagation. A default route is the extreme case of summarizing all destinations.

Question 5Network Architecture and Design

Which device role in an enterprise campus design aggregates access switches and typically applies policy between VLANs?

  1. Distribution layer switch Correct answer.
  2. Edge router
  3. Access layer switch
  4. Core layer switch

Explanation

The distribution layer aggregates access switches and commonly hosts inter-VLAN routing and policy enforcement. The access layer connects endpoints, while the core focuses on high-speed transport.

Question 6Network Architecture and Design

In a high-availability pair using active/passive mode, what is the primary role of the HA2 link?

  1. Providing out-of-band management access
  2. Synchronizing session and forwarding state between peers Correct answer.
  3. Carrying user data traffic during normal operation
  4. Advertising routes to upstream routers

Explanation

The HA2 link carries session and forwarding table synchronization so the passive peer can take over without dropping established sessions. HA1 handles control and configuration sync, while data traffic uses the data interfaces.

Question 7Network Architecture and Design

Which addressing scheme is most appropriate for point-to-point links between routers in a modern design?

  1. /29 subnets per link
  2. /31 subnets per RFC 3021 Correct answer.
  3. /24 subnets per link
  4. /30 subnets only

Explanation

RFC 3021 allows /31 prefixes on point-to-point links, using both addresses as usable and conserving address space. This is preferred over /30 when broadcast addressing is unnecessary.

Question 8Network Architecture and Design

A design document specifies that the firewall must inspect traffic between two internal segments while remaining invisible to the endpoints' IP configuration. Which deployment mode fits this requirement?

  1. Virtual wire Correct answer.
  2. Layer 3 routed
  3. Loopback with PBF
  4. NAT mode with proxy ARP

Explanation

Virtual wire mode inserts the firewall transparently between two ports without requiring IP reconfiguration on endpoints. Traffic is inspected while the firewall stays invisible at Layer 3.

Question 9Network Architecture and Design

An architect must place a public-facing web server so that internet traffic can reach it without exposing the internal trust zone. Which zone placement is correct?

  1. The untrust zone directly attached to the ISP
  2. The trust zone with a broad any-any rule
  3. A DMZ zone with policy allowing internet-to-DMZ on required ports Correct answer.
  4. The management zone with web UI access enabled

Explanation

A DMZ isolates externally reachable services from internal systems, and policy should permit only the specific ports the service needs. This limits exposure if the server is compromised.

Question 10Network Architecture and Design

A campus uses OSPF and wants to prevent a flapping access link from destabilizing the entire routing domain. Which design technique best addresses this?

  1. Redistribute static routes into OSPF
  2. Configure stub areas to limit LSA flooding Correct answer.
  3. Enable equal-cost multipath on core links
  4. Increase the OSPF reference bandwidth

Explanation

Stub areas restrict the type of LSAs flooded into an area, reducing the scope of topology changes and protecting the domain from churn. This bounds the impact of instability in edge segments.

Question 11Network Architecture and Design

A design requires that return traffic for outbound sessions traverse the same firewall in an active/active pair. Which mechanism ensures session symmetry?

  1. Asymmetric routing with per-packet load balancing
  2. Session ownership with HA synchronization Correct answer.
  3. Policy-based forwarding on each peer
  4. Static routes with equal cost on both peers

Explanation

In active/active HA, session ownership and HA synchronization ensure that both directions of a flow are processed by the same peer. Without symmetry, stateful inspection would drop or mishandle the return traffic.

Question 12Network Architecture and Design

An organization needs to connect 40 branch sites to a hub over a provider network while keeping the design simple and cost-effective. Which topology is the most appropriate baseline?

  1. Dual-homed triangle between three hubs
  2. Hub-and-spoke with a central security inspection point Correct answer.
  3. Ring topology across all branches
  4. Full mesh with dedicated circuits between every pair

Explanation

Hub-and-spoke centralizes policy and inspection at the hub and minimizes the number of links needed for many branches. Full mesh and ring options scale poorly in cost and complexity for 40 sites.

Question 13Network Architecture and Design

A design team wants to ensure that a compromised DMZ host cannot initiate connections to the trust zone. Which policy design principle should be applied?

  1. Any-any rules restricted to business hours
  2. Default-deny between zones with explicit allow rules Correct answer.
  3. Logging-only rules without deny actions
  4. Implicit allow from DMZ to trust

Explanation

A default-deny posture between zones blocks unauthorized flows, and explicit allow rules permit only required traffic. This contains a compromised host by preventing lateral movement into the trust zone.

Question 14Network Architecture and Design

A network architect is designing a data center that requires loop-free Layer 2 extension across racks with all links forwarding. Which technology best meets this requirement?

  1. Static VLAN pruning across trunks
  2. PVST+ with PortFast enabled
  3. VXLAN with an EVPN control plane Correct answer.
  4. Spanning Tree Protocol with root guard

Explanation

VXLAN with EVPN provides a loop-free overlay that allows all links to forward while extending Layer 2 segments across racks. EVPN distributes MAC and IP reachability without relying on STP blocking.

Question 15Network Architecture and Design

A design requires that management access to network devices be isolated from user traffic. Which approach best satisfies this?

  1. Management access over the user VLAN
  2. Management access via the DMZ web server
  3. A dedicated out-of-band management network Correct answer.
  4. Telnet access from any internal subnet

Explanation

An out-of-band management network separates administrative traffic from user data, reducing exposure and attack surface. Access can then be tightly controlled with ACLs and jump hosts.

Question 16Network Architecture and Design

An enterprise wants deterministic path selection for a latency-sensitive application across two WAN providers. Which design approach provides the most deterministic control?

  1. OSPF with default metrics on both providers
  2. Policy-based forwarding with per-application next-hop selection Correct answer.
  3. Static default routes on both providers
  4. BGP with local preference only

Explanation

Policy-based forwarding lets the architect steer specific applications to a chosen provider based on defined criteria, giving deterministic path control. Routing protocol metrics and local preference influence selection but do not target individual applications.

Question 17Network Architecture and Design

A design specifies dual ISP connections with automatic failover and independent provider addressing. Which technique best supports this?

  1. Static default route on the primary only
  2. NAT with a single public address pool
  3. Policy-based forwarding with path monitoring Correct answer.
  4. OSPF over both ISPs with equal cost

Explanation

Policy-based forwarding with path monitoring detects provider failure and redirects traffic to the surviving link. This provides automatic failover without requiring dynamic routing between providers.

Question 18Network Architecture and Design

A network architect must size a firewall cluster so that a single node failure does not degrade throughput below the design load. Which sizing principle applies?

  1. Size each node to carry the full design load Correct answer.
  2. Rely on QoS to throttle traffic during failure
  3. Assume traffic drops during failover
  4. Size the cluster to half the design load

Explanation

For N+1 resilience, each remaining node must handle the full design load after a peer fails. Sizing to half the load would leave the cluster oversubscribed during a failure.

Question 19Network Architecture and Design

A design uses a /24 for a segment that must support 300 hosts, but the architect discovers only 254 usable addresses. Which action resolves the shortfall with minimal disruption?

  1. Split the segment into two /25s
  2. Keep the /24 and rely on NAT
  3. Re-address the segment to a /23 Correct answer.
  4. Add a second /24 on the same VLAN

Explanation

A /23 provides 510 usable addresses, which covers 300 hosts in a single broadcast domain. Re-addressing to a larger prefix is the straightforward fix when the current subnet is too small.

Question 20Network Architecture and Design

An architect wants to prevent routing loops when redistributing between OSPF and BGP at two separate border routers. Which technique is most effective?

  1. Setting identical BGP router IDs
  2. Using static routes instead of redistribution
  3. Route tagging with mutual redistribution filters Correct answer.
  4. Increasing OSPF reference bandwidth

Explanation

Route tags mark the origin of redistributed routes, and filters at the second border router prevent those routes from being fed back into the source protocol. This breaks the feedback loop that causes suboptimal routing or loops.

Question 21Network Architecture and Design

In an active/active firewall pair using floating IP addresses, what happens to a session if the owning peer fails and the floating IP moves?

  1. The session continues only if NAT is disabled
  2. The session resets unless PBF is configured
  3. The session resets because only the floating IP moves
  4. The session continues because synchronized state allows the new owner to process it Correct answer.

Explanation

With HA session synchronization, the surviving peer already has the session state and can continue processing after the floating IP moves. This preserves established flows during failover.

Question 22Network Architecture and Design

A design must extend a Layer 2 segment between two data centers while avoiding STP-blocked links and preserving first-hop gateway redundancy. Which combination is most appropriate?

  1. EVPN-VXLAN overlay with distributed anycast gateways Correct answer.
  2. OTV with a single active gateway per site
  3. Dark fiber with PVST+ and PortFast
  4. VPC with STP root guard on both sites

Explanation

EVPN-VXLAN provides an active-active Layer 2 overlay, and distributed anycast gateways give first-hop redundancy with local forwarding at each site. This avoids STP blocking and optimizes traffic paths.

Question 23Network Architecture and Design

An architect is designing segmentation for a multi-tenant environment where tenants must not reach each other's workloads. Which design most directly enforces tenant isolation?

  1. Per-tenant security zones with default-deny inter-zone policy Correct answer.
  2. A shared VLAN with ACLs based on source IP
  3. A single trust zone with logging enabled
  4. NAT between tenants on the same segment

Explanation

Dedicated per-tenant zones with a default-deny inter-zone policy enforce isolation at the zone boundary. Shared segments with ACLs or logging leave tenants in the same broadcast domain and weaken separation.

Question 24Network Architecture and Design

A design requires that a firewall inspect east-west traffic between workloads on the same host without tromboning to a physical appliance. Which approach best fits?

  1. Physical firewall on a stick with subinterfaces
  2. Host-based microsegmentation with a distributed firewall Correct answer.
  3. Policy-based forwarding to a central appliance
  4. Virtual wire between two physical ports

Explanation

Distributed host-based microsegmentation enforces policy at the workload level, inspecting east-west traffic locally without hairpinning to a physical appliance. This scales inspection across the fabric.

Question 25Network Architecture and Design

A design team must ensure that a new branch can reach the data center even if the primary WAN router fails. Which design element is essential?

  1. A larger default route metric
  2. A redundant path with dynamic failover and tested convergence Correct answer.
  3. A single router with dual power supplies
  4. Static ARP entries on the branch switch

Explanation

Surviving a router failure requires an alternate path plus dynamic failover so traffic reconverges automatically. Dual power supplies protect only against power faults on a single device.

Question 26Network Architecture and Design

A network architect is documenting the design rationale for placing a stateful firewall between the trust zone and the untrust zone. Which statement best describes the fundamental reason a stateful inspection device belongs at that boundary?

  1. It assigns addresses to internal hosts so they never expose their real addresses to the internet
  2. It builds a session table so return traffic is permitted without an explicit inbound rule for each flow Correct answer.
  3. It encrypts every packet that crosses the boundary so payloads are unreadable on the untrusted side
  4. It establishes a routing adjacency with each zone so it can advertise the internal prefixes

Explanation

A stateful firewall records each permitted flow in a state table and uses that entry to allow the return traffic, which lets the policy be written as outbound-only rules rather than mirrored inbound rules. Encryption is the job of IPsec or TLS, not the stateful inspection function itself. Address hiding is performed by NAT, and route advertisement is a routing protocol function, so neither is the reason the device is placed at the boundary.

Question 27Network Architecture and Design

A design calls for a single physical firewall to protect several internal segments that must not communicate with one another. Which design element most directly enforces that separation on that one device?

  1. A single trust zone containing all segments with a shared any-any rule
  2. One interface per segment placed in the same virtual router without policy
  3. A dedicated management interface on the same subnet as the user segments
  4. Separate security zones with inter-zone policies that deny traffic by default Correct answer.

Explanation

Segment isolation on a single firewall is achieved by assigning each segment to its own security zone and applying inter-zone policy that denies by default and permits only required flows. Placing all segments in one zone removes the policy boundary between them, because intra-zone traffic is not filtered by inter-zone rules. Sharing a virtual router does not create a security boundary, and a management interface on the user subnet weakens rather than enforces separation.

Question 28Network Architecture and Design

An architect is choosing a routing design for a hub-and-spoke topology in which spokes must reach each other through the hub. Which design choice keeps spoke-to-spoke traffic working while avoiding the need for a full mesh of routing adjacencies?

  1. Run a full mesh of routing adjacencies among all spokes so each learns every prefix directly
  2. Run a single routing adjacency from each spoke to the hub and let the hub re-advertise spoke prefixes to other spokes Correct answer.
  3. Disable split horizon on the hub so spoke prefixes are never advertised back out
  4. Use static routes on every spoke that point only to the hub's physical interface address

Explanation

In hub-and-spoke, each spoke needs only one adjacency to the hub; the hub then re-advertises each spoke prefix to the other spokes, so traffic transits the hub and no full mesh is required. A full mesh defeats the purpose of the topology and scales poorly. Static routes pointing only at the hub interface address do not give spokes reachability to other spoke prefixes, and disabling split horizon affects loop prevention rather than providing spoke-to-spoke reachability.

Question 29Network Architecture and Design

A design must provide a management path to network devices that remains reachable even when the production data plane is under heavy load or has failed. Which design approach best meets that requirement?

  1. A dedicated out-of-band management network with its own physical path to the devices Correct answer.
  2. Console access only, with no remote management path provisioned at all
  3. In-band management reached through the production default gateway on each device
  4. A management VLAN carried as a subinterface on the same uplink as production traffic

Explanation

Out-of-band management uses a separate physical network and path, so it stays available when the production data plane is congested or down. A management VLAN on the same uplink shares fate with the production link and is not isolated from data-plane load. In-band management depends on the production forwarding path, and console-only access provides no remote management path.

Question 30Network Architecture and Design

An architect is designing a data center fabric in which every leaf connects to every spine, and each host connects to two leaves using a routing protocol on the host. Which combination of design characteristics best supports predictable any-to-any forwarding with even traffic distribution?

  1. Layer 3 leaf-spine with a single spine per leaf and static routes for host prefixes
  2. Layer 3 leaf-spine with ECMP across equal-cost spine paths and host routes advertised by dual-attached hosts Correct answer.
  3. Layer 2 leaf-spine with STP blocking redundant leaf-spine links and a single active path per host
  4. Layer 2 leaf-spine with all leaf-spine links in one VLAN and no loop-prevention mechanism

Explanation

A Layer 3 leaf-spine fabric with equal-cost paths lets every leaf reach every other leaf through any spine, and ECMP spreads flows across those paths while host routes advertised by dual-attached hosts keep forwarding optimal. Layer 2 designs with STP block redundant links, so capacity is unused and paths are not evenly used. A single spine per leaf removes path redundancy, and a Layer 2 design without loop prevention creates a broadcast storm risk.

Question 31Routing and Switching

In a Cisco router, which table does the data plane consult to decide the egress interface for a packet?

  1. The OSPF link-state database
  2. The ARP cache
  3. The CEF forwarding information base (FIB) Correct answer.
  4. The BGP RIB-In table

Explanation

Cisco Express Forwarding builds a forwarding information base derived from the routing table; the data plane performs a longest-prefix lookup in the FIB plus an adjacency table lookup to rewrite the frame. The routing table and protocol databases are control-plane structures used to build the FIB, not consulted per packet.

Question 32Routing and Switching

A switch port configured with `switchport mode access` receives a frame carrying an 802.1Q tag. What is the default behavior on a Cisco Catalyst switch?

  1. The frame is dropped because the port expects untagged frames Correct answer.
  2. The frame is forwarded unchanged with its tag preserved
  3. The port dynamically converts to trunk mode
  4. The tag is stripped and the frame is forwarded in the native VLAN

Explanation

An access port belongs to a single VLAN and expects untagged traffic; tagged frames arriving on it are normally discarded. Tag preservation and native-VLAN handling apply to trunk ports, not access ports.

Question 33Routing and Switching

Which statement describes the purpose of the Spanning Tree Protocol on a Layer 2 switched network?

  1. It provides loop-free Layer 3 routing between VLANs
  2. It authenticates endpoints before allowing them onto the access VLAN
  3. It load-balances traffic across all redundant links simultaneously by default
  4. It prevents Layer 2 loops by electing a root bridge and blocking redundant ports Correct answer.

Explanation

STP builds a loop-free logical topology by electing one root bridge and placing redundant ports into blocking or discarding states. It does not provide multipath load balancing across all links by default, nor does it perform routing or endpoint authentication.

Question 34Routing and Switching

Which destination address does a router use when forwarding a packet to a host on a directly connected Ethernet subnet?

  1. The broadcast MAC address ff:ff:ff:ff:ff:ff
  2. The MAC address of the router's own egress interface
  3. The MAC address of the default gateway
  4. The MAC address of the destination host, resolved via ARP Correct answer.

Explanation

For a destination on a directly connected subnet, the router resolves the host's IP to its MAC with ARP and uses that MAC as the frame destination. The IP destination remains the remote host throughout the path.

Question 35Routing and Switching

A network engineer configures `ip route 0.0.0.0 0.0.0.0 203.0.113.1`. What does this command accomplish?

  1. It blocks all traffic to the 203.0.113.0 network
  2. It installs a default route pointing to next hop 203.0.113.1 Correct answer.
  3. It redistributes connected networks into the routing protocol
  4. It creates a host route for 203.0.113.1

Explanation

The prefix 0.0.0.0/0 matches every destination, so the command installs a static default route via the specified next hop. It is used when no more specific route exists in the routing table.

Question 36Routing and Switching

What is the primary function of a VLAN trunk link between two switches?

  1. To carry traffic for multiple VLANs over a single physical link using tagging Correct answer.
  2. To provide Power over Ethernet to attached devices
  3. To convert access ports into routed ports
  4. To aggregate links into an EtherChannel bundle

Explanation

A trunk encapsulates frames with 802.1Q tags so that many VLANs share one inter-switch link. Access links carry a single untagged VLAN, and link aggregation or PoE are separate features.

Question 37Routing and Switching

Which OSPF packet type is used to discover neighbors and confirm bidirectional communication on a multiaccess segment?

  1. Database Description
  2. Link State Request
  3. Hello Correct answer.
  4. Link State Update

Explanation

OSPF Hello packets are sent periodically on each interface to discover neighbors, verify area and timer parameters, and confirm two-way reachability. Database Description, Link State Request, and Link State Update packets are used later during database synchronization.

Question 38Routing and Switching

Which protocol provides first-hop redundancy by presenting a shared virtual IP and MAC address to hosts on a LAN?

  1. LACP
  2. LLDP
  3. STP
  4. HSRP Correct answer.

Explanation

Hot Standby Router Protocol lets two or more routers share a virtual IP and virtual MAC so hosts keep a consistent default gateway if the active router fails. STP is Layer 2 loop prevention, LACP bundles links, and LLDP is neighbor discovery.

Question 39Routing and Switching

A router has two routes to 10.1.1.0/24: an OSPF route with metric 30 and a static route with administrative distance 1. Which route is installed in the routing table?

  1. The OSPF route, because dynamic routes always override static routes
  2. Both routes, and traffic is load-balanced
  3. The static route, because lower administrative distance is preferred Correct answer.
  4. The OSPF route, because lower metric is preferred

Explanation

When multiple sources offer the same prefix, the router first compares administrative distance, and the lower value wins before metrics are considered. Static routes have AD 1 versus OSPF's 110, so the static route is installed.

Question 40Routing and Switching

Two OSPF routers are connected on a point-to-point link but remain stuck in EXSTART state. Which condition most likely explains this?

  1. A mismatched OSPF area ID
  2. An MTU mismatch between the two interfaces Correct answer.
  3. A duplicate router ID on the segment
  4. An authentication key mismatch

Explanation

During EXSTART the routers negotiate a master/slave relationship and exchange Database Description packets that carry the interface MTU. A mismatch causes the DBD exchange to fail and the adjacency to remain in EXSTART or restart.

Question 41Routing and Switching

A switch has three ports in VLAN 10 and two ports in VLAN 20, all in the same spanning-tree instance (PVST+). Which statement is true about the topology?

  1. Each VLAN runs its own spanning-tree instance, so blocking may differ per VLAN Correct answer.
  2. VLAN 20 ports cannot participate in spanning tree
  3. A single instance blocks the same port for both VLANs
  4. The root bridge is elected separately for each port

Explanation

PVST+ runs one spanning-tree instance per VLAN, so each VLAN independently elects a root bridge and blocks ports. With only one instance per VLAN, blocking decisions can differ between VLAN 10 and VLAN 20.

Question 42Routing and Switching

A host on VLAN 10 cannot reach a host on VLAN 20 on the same multilayer switch. Inter-VLAN routing is configured with SVIs. What should the engineer verify first?

  1. That the SVI for each VLAN is up and has an IP address Correct answer.
  2. That the hosts are in the same broadcast domain
  3. That both VLANs use the same subnet mask
  4. That STP is disabled on the switch

Explanation

Inter-VLAN routing with SVIs requires each VLAN interface to exist, be administratively up, and have an IP address configured so it can route. If the VLAN has no active ports the SVI stays down and traffic cannot be routed.

Question 43Routing and Switching

An engineer wants to bundle four Gigabit links into one logical link and requires the bundle to negotiate with the peer. Which configuration satisfies this?

  1. Channel-group in active mode using LACP Correct answer.
  2. Channel-group in on mode
  3. Channel-group in auto mode using PAgP
  4. Channel-group in desirable mode using PAgP

Explanation

LACP active mode actively negotiates an EtherChannel with the peer using LACP. The on mode forces bundling without negotiation, while auto and desirable use PAgP rather than LACP.

Question 44Routing and Switching

Which condition causes a switch to place a port in the err-disabled state due to BPDU guard?

  1. A BPDU is received on a port configured with PortFast and BPDU guard Correct answer.
  2. The port negotiates an EtherChannel with a neighbor
  3. The port receives a tagged frame on an access VLAN
  4. The port detects a duplex mismatch

Explanation

BPDU guard is applied to edge ports so that if a BPDU is received, the port is immediately err-disabled to prevent a loop from an unauthorized switch. Tagged frames, EtherChannel negotiation, and duplex mismatch do not trigger BPDU guard.

Question 45Routing and Switching

A network uses OSPF with a single area. The engineer changes the reference bandwidth to 10000 Mbps. What is the resulting cost of a 1000 Mbps interface?

  1. 100
  2. 1000
  3. 1
  4. 10 Correct answer.

Explanation

OSPF cost is reference bandwidth divided by interface bandwidth, ignoring fractions. With 10000 Mbps reference and 1000 Mbps interface, cost is 10. The default reference of 100 Mbps would give cost 1.

Question 46Routing and Switching

Which statement about the OSPF DR/BDR election on a broadcast segment is correct?

  1. The BDR is chosen by the highest interface bandwidth
  2. The DR is elected only after the first LSA is flooded
  3. The router with the highest OSPF interface priority wins, with router ID as tiebreaker Correct answer.
  4. The router with the lowest router ID always becomes DR

Explanation

On broadcast and nonbroadcast multiaccess segments, OSPF elects the DR by highest interface priority, and ties are broken by highest router ID. The BDR is chosen by the same rules among remaining routers.

Question 47Routing and Switching

A route to 172.16.0.0/16 is learned via OSPF, and a route to 172.16.5.0/24 is learned via RIP. Which route does the router use for traffic destined to 172.16.5.10?

  1. The OSPF route, because it has a larger prefix
  2. The RIP route, because longest prefix match takes precedence over administrative distance Correct answer.
  3. Both routes, in equal-cost load balancing
  4. The OSPF route, because OSPF has a lower administrative distance

Explanation

The router first selects the longest matching prefix; 172.16.5.10 falls within the /24, so only the RIP route is considered. Administrative distance is compared only among routes to the same prefix.

Question 48Routing and Switching

Which statement accurately describes the difference between the OSPF neighbor and adjacency relationship?

  1. A neighbor relationship requires identical LSDBs, while an adjacency only requires Hellos
  2. Neighbors must be in different areas to form an adjacency
  3. Neighbors exchange Hellos, while an adjacency means databases are fully synchronized Correct answer.
  4. Adjacencies are formed only between DR and BDR

Explanation

Two OSPF routers become neighbors when they see each other's Hellos with matching parameters, but an adjacency requires progressing through DBD, LS Request, and LS Update exchange until databases are synchronized. On multiaccess segments, DROTHERs stay neighbors with each other without forming full adjacencies.

Question 49Routing and Switching

Which mechanism allows a switch to carry multiple VLANs over an EtherChannel while preserving per-VLAN forwarding decisions?

  1. Assign the port-channel to a single VLAN only
  2. Configure each member link as an access port in a different VLAN
  3. Disable STP on the port-channel
  4. Configure the port-channel as a trunk so member links carry all VLAN tags Correct answer.

Explanation

An EtherChannel is treated as one logical link, so configuring the port-channel interface as a trunk lets it carry all permitted VLANs with 802.1Q tags. Member links inherit the port-channel configuration.

Question 50Routing and Switching

A router receives a packet destined to 192.168.1.200. The routing table contains 192.168.0.0/16 via 10.0.0.1 and 192.168.1.0/24 via 10.0.0.2. Which next hop is used?

  1. 10.0.0.1, because the /16 was learned first
  2. 10.0.0.1, because it has a lower next-hop address
  3. 10.0.0.2, because the /24 is the longest matching prefix Correct answer.
  4. Both next hops, using per-packet load sharing

Explanation

The forwarding decision uses the longest prefix that matches the destination; 192.168.1.0/24 matches and is more specific than 192.168.0.0/16. The next hop of the selected route is used for the frame rewrite.