I85PREP
⌘ K
CWTS study materials
CWTS study resources

CWTS practice questions

One question at a time. Build your CWTS understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Wi-Fi Technology, Standards, and Certifications

In the IEEE 802.11 standard, what does the term BSS primarily identify?

  1. A set of stations controlled by a single coordination function Correct answer.
  2. A security certificate used during 802.1X authentication
  3. A licensed frequency band assigned to one operator
  4. A global routing domain shared by all access points

Explanation

The basic service set is the fundamental building block of an 802.11 network: a group of stations that coordinate their medium access under one coordination function. It may be infrastructure-based with an AP or independent without one. It is a logical topology concept, not a band, route, or credential.

Question 2Wi-Fi Technology, Standards, and Certifications

Which organization publishes the IEEE 802.11 amendments that define Wi-Fi PHY and MAC operation?

  1. IEEE Correct answer.
  2. IETF
  3. Wi-Fi Alliance
  4. ITU-R

Explanation

The IEEE 802.11 working group writes and publishes the standards that define PHY and MAC behaviour. The Wi-Fi Alliance is an industry certification body that tests interoperability against those standards. IETF and ITU-R handle internet protocols and radio regulations respectively.

Question 3Wi-Fi Technology, Standards, and Certifications

A station associates to an access point and gains access to the distribution system. Which term describes this configuration?

  1. Infrastructure BSS Correct answer.
  2. Independent BSS
  3. Ad hoc BSS
  4. Mesh BSS only

Explanation

An infrastructure BSS contains an access point that provides connectivity to the distribution system for associated stations. An independent BSS has no AP and stations communicate directly, while mesh BSS uses mesh stations for multi-hop forwarding. The presence of an AP is the deciding factor here.

Question 4Wi-Fi Technology, Standards, and Certifications

What is the primary purpose of the Wi-Fi CERTIFIED program?

  1. Assigning globally unique MAC addresses to vendors
  2. Allocating unlicensed spectrum for wireless use
  3. Encrypting management frames on behalf of vendors
  4. Testing and certifying interoperability of products against 802.11 features Correct answer.

Explanation

The Wi-Fi Alliance runs certification programs that verify a product implements required features and interoperates with other certified devices. Certification is voluntary and complements, but does not replace, the underlying IEEE standards. MAC address assignment, spectrum allocation, and encryption are handled elsewhere.

Question 5Wi-Fi Technology, Standards, and Certifications

Which frequency band does 802.11a use?

  1. 5 GHz Correct answer.
  2. 2.4 GHz
  3. 60 GHz
  4. 900 MHz

Explanation

802.11a operates in the 5 GHz band using OFDM and was ratified alongside 802.11b. It is not interoperable with 2.4 GHz-only devices because the PHY and band differ. The 60 GHz band is used by 802.11ad/ay, not 802.11a.

Question 6Wi-Fi Technology, Standards, and Certifications

Which security mechanism was introduced to replace WEP and is based on the Temporal Key Integrity Protocol?

  1. OWE
  2. 802.1X
  3. WPA3-SAE
  4. WPA Correct answer.

Explanation

WPA was designed as an interim fix for WEP weaknesses and uses TKIP for per-packet key mixing and integrity checks. WPA3 uses SAE, OWE targets open networks, and 802.1X is an authentication framework rather than a cipher suite.

Question 7Wi-Fi Technology, Standards, and Certifications

Which frame type is used by an access point to announce its SSID and capabilities to nearby stations?

  1. Block Ack frame
  2. PS-Poll frame
  3. Association request frame
  4. Beacon frame Correct answer.

Explanation

Beacon frames are transmitted periodically by the AP and carry the SSID, supported rates, and capability information. Association requests come from stations, PS-Poll relates to power saving, and Block Ack supports aggregation acknowledgements.

Question 8Wi-Fi Technology, Standards, and Certifications

Which 802.11 amendment first introduced operation in the 60 GHz band?

  1. 802.11ad Correct answer.
  2. 802.11ac
  3. 802.11ax
  4. 802.11n

Explanation

802.11ad defined the DMG PHY for the 60 GHz band, targeting very high throughput over short distances. 802.11ac and 802.11ax operate below 6 GHz, and 802.11n works in 2.4 and 5 GHz.

Question 9Wi-Fi Technology, Standards, and Certifications

An administrator wants a client to authenticate to the network using credentials validated by a RADIUS server. Which framework should be configured?

  1. WPA2-Personal with a pre-shared key
  2. WEP with shared key authentication
  3. 802.1X with an EAP method Correct answer.
  4. OWE transition mode

Explanation

802.1X provides port-based network access control in which the supplicant's credentials are relayed by the authenticator to a RADIUS authentication server. Personal mode uses a shared passphrase with no server, and WEP is deprecated and insecure.

Question 10Wi-Fi Technology, Standards, and Certifications

A station sends an Association Request and receives an Association Response with status code 17. What does this indicate?

  1. The request was rejected because of a channel switch
  2. The station failed 802.1X authentication
  3. The AP lacks resources to handle another association Correct answer.
  4. The AP requires a different regulatory domain

Explanation

Status code 17 in the Association Response means the AP is unable to handle the station because of insufficient resources, often a connection or association limit. Authentication failures use different status codes, and channel switch is signalled through separate management procedures.

Question 11Wi-Fi Technology, Standards, and Certifications

Which feature of 802.11ax improves efficiency in dense deployments by allowing simultaneous transmissions to multiple stations on the same channel?

  1. Short guard interval
  2. Channel bonding
  3. OFDMA Correct answer.
  4. Frame aggregation

Explanation

OFDMA divides a channel into resource units that can be assigned to different stations in the same transmission opportunity, improving efficiency under load. Channel bonding widens channels, short guard intervals reduce symbol overhead, and aggregation combines frames for one recipient.

Question 12Wi-Fi Technology, Standards, and Certifications

A client roams between two access points on the same ESS. Which identifier stays constant during this roam?

  1. AP radio MAC address
  2. SSID Correct answer.
  3. BSSID
  4. Basic rate set of each AP

Explanation

The SSID names the extended service set and remains the same as the client moves between APs within it. The BSSID identifies each individual AP and therefore changes, and per-AP parameters such as the basic rate set may also differ.

Question 13Wi-Fi Technology, Standards, and Certifications

Which mechanism in 802.11n allows multiple spatial streams to be sent simultaneously over the same channel?

  1. Dynamic frequency selection
  2. MIMO spatial multiplexing Correct answer.
  3. Frequency hopping spread spectrum
  4. Direct sequence spread spectrum

Explanation

MIMO spatial multiplexing transmits independent data streams from multiple antennas in the same channel, increasing throughput without extra bandwidth. DSSS and FHSS are older single-stream spread spectrum techniques, and DFS is a radar-avoidance requirement for 5 GHz.

Question 14Wi-Fi Technology, Standards, and Certifications

What is the role of the Distribution System in an infrastructure WLAN?

  1. It forwards frames between access points to reach stations outside the local BSS Correct answer.
  2. It assigns IP addresses to wireless clients
  3. It encrypts frames between the client and the AP
  4. It authenticates clients against a RADIUS server

Explanation

The distribution system is the backbone that connects APs and moves frames between BSSs, allowing a station to communicate beyond its own AP. Authentication, addressing, and encryption are separate functions performed by other components.

Question 15Wi-Fi Technology, Standards, and Certifications

Which EAP method provides mutual authentication using server-side certificates and is widely deployed in enterprise Wi-Fi?

  1. PAP
  2. CHAP
  3. EAP-TLS Correct answer.
  4. EAP-MD5

Explanation

EAP-TLS requires certificates on both the server and the client and delivers strong mutual authentication with a TLS tunnel. PAP and CHAP are legacy PPP authentication protocols, and EAP-MD5 offers only weak one-way authentication without a tunnel.

Question 16Wi-Fi Technology, Standards, and Certifications

Which PHY technology is used by 802.11g to achieve data rates up to 54 Mbps in the 2.4 GHz band?

  1. DSSS with CCK only
  2. FHSS
  3. HR-DSSS
  4. ERP-OFDM Correct answer.

Explanation

802.11g introduced ERP-OFDM, which applies OFDM in the 2.4 GHz band to reach rates up to 54 Mbps while remaining backward compatible with 802.11b. HR-DSSS and CCK top out at 11 Mbps, and FHSS is a legacy 1-2 Mbps technique.

Question 17Wi-Fi Technology, Standards, and Certifications

A network designer needs a 6 GHz-only deployment with mandatory WPA3 and no backward compatibility with older clients. Which amendment should be selected?

  1. 802.11ac Wave 2
  2. 802.11ax with Wi-Fi 6E certification Correct answer.
  3. 802.11g with WPA2
  4. 802.11ad

Explanation

Wi-Fi 6E extends 802.11ax operation into the 6 GHz band, where WPA3 and other stricter rules apply and legacy devices are excluded by design. 802.11ac is 5 GHz only, 802.11g is 2.4 GHz, and 802.11ad uses 60 GHz.

Question 18Wi-Fi Technology, Standards, and Certifications

Which key hierarchy element in WPA2-Personal is derived from the passphrase and SSID and then used to derive session keys?

  1. PMK Correct answer.
  2. AID
  3. GTK
  4. BSSID

Explanation

The pairwise master key is derived from the passphrase and SSID through the PBKDF2 function and serves as the basis for the four-way handshake that produces session keys. The GTK protects group traffic, while BSSID and AID are identifiers rather than keys.

Question 19Wi-Fi Technology, Standards, and Certifications

What is the purpose of the four-way handshake in an RSN?

  1. To confirm mutual possession of the PMK and derive fresh pairwise keys Correct answer.
  2. To assign an IP address to the supplicant
  3. To select the channel for the BSS
  4. To negotiate the supported data rates

Explanation

The four-way handshake proves that both parties hold the same pairwise master key and derives fresh pairwise transient keys plus the group key. It also installs keys in the correct order. Channel selection and rate negotiation are handled by other management exchanges.

Question 20Wi-Fi Technology, Standards, and Certifications

A station in power-save mode wakes and sends a PS-Poll frame. What is it requesting?

  1. A block acknowledgement agreement
  2. A new association with a different AP
  3. A channel switch announcement
  4. A single buffered frame held by the access point Correct answer.

Explanation

In legacy power save, the AP buffers frames for sleeping stations and indicates this in beacon TIM fields. When the station wakes, it sends a PS-Poll to retrieve one buffered frame. Association, channel switching, and block ack setup use separate frames.

Question 21Wi-Fi Technology, Standards, and Certifications

Which statement best describes the difference between an SSID and a BSSID?

  1. The SSID is used only in mesh networks, while the BSSID is used in infrastructure mode
  2. The SSID changes on every roam, while the BSSID stays fixed
  3. The SSID is a MAC address, while the BSSID is a human-readable label
  4. The SSID names the network, while the BSSID uniquely identifies a specific AP radio Correct answer.

Explanation

The SSID is the logical network name shared across an ESS, whereas the BSSID is the MAC address of a particular AP radio and changes when a client roams to another AP. Confusing the two leads to incorrect roaming and troubleshooting conclusions.

Question 22Wi-Fi Technology, Standards, and Certifications

An administrator enables WPA3-Personal on a network and notices that legacy WPA2 clients can still connect. Which configuration explains this behaviour?

  1. Management frame protection is disabled
  2. WPA3 transition mode is enabled Correct answer.
  3. The client is using OWE
  4. The AP is operating in monitor mode

Explanation

WPA3 transition mode advertises both SAE and PSK so that WPA2 clients can still associate while SAE-capable clients use the stronger method. Disabling management frame protection or running monitor mode does not create this dual behaviour, and OWE applies to open networks.

Question 23Wi-Fi Technology, Standards, and Certifications

Why does 802.11ax introduce trigger-based uplink OFDMA?

  1. To schedule simultaneous uplink transmissions from multiple stations and reduce contention overhead Correct answer.
  2. To eliminate the need for beacon frames
  3. To replace encryption with a new cipher suite
  4. To increase the transmit power of a single client

Explanation

Trigger frames from the AP allocate resource units and timing for multiple stations to transmit uplink simultaneously, which reduces contention and improves efficiency in dense environments. It does not change transmit power rules, beacon operation, or security ciphers.

Question 24Wi-Fi Technology, Standards, and Certifications

A 5 GHz access point must avoid interfering with radar systems. Which mechanism governs this requirement?

  1. Block acknowledgement
  2. Dynamic frequency selection Correct answer.
  3. Spatial reuse
  4. Automatic power save delivery

Explanation

Dynamic frequency selection requires 5 GHz devices to detect radar and vacate the channel, which is why some channels require DFS and may show long channel availability checks. Power save delivery, block ack, and spatial reuse address different functions entirely.

Question 25Wi-Fi Technology, Standards, and Certifications

Which characteristic distinguishes SAE in WPA3-Personal from the WPA2-Personal PSK handshake?

  1. SAE provides forward secrecy by deriving keys through a password-authenticated exchange Correct answer.
  2. SAE requires a RADIUS server for every association
  3. SAE uses TKIP for encryption
  4. SAE removes the need for any passphrase

Explanation

SAE performs a simultaneous authentication of equals exchange that resists offline dictionary attacks and yields forward secrecy, so captured sessions cannot be decrypted later with the passphrase. It does not require RADIUS, does not use TKIP, and still relies on a shared secret.

Question 26Wi-Fi Technology, Standards, and Certifications

Which organization publishes the 802.11 family of WLAN standards that vendors implement in Wi-Fi products?

  1. ITU-R
  2. Wi-Fi Alliance
  3. IEEE Correct answer.
  4. IETF

Explanation

The IEEE develops and publishes the 802.11 standards that define PHY and MAC behavior for WLANs. The Wi-Fi Alliance is an industry body that certifies interoperability against those standards but does not author them. Other bodies handle IP protocols or spectrum allocation rather than the 802.11 specification itself.

Question 27Wi-Fi Technology, Standards, and Certifications

A vendor wants to display the Wi-Fi CERTIFIED logo on a new access point. Which requirement must the product satisfy?

  1. Certification testing by the Wi-Fi Alliance for the relevant features Correct answer.
  2. Approval from the local radio spectrum regulator for the logo
  3. Publication of the product's firmware source code under an open license
  4. Registration of the product with the IEEE 802.11 working group

Explanation

The Wi-Fi CERTIFIED logo is granted by the Wi-Fi Alliance after a product passes its interoperability and feature certification tests, such as WPA3 or 802.11ax programs. IEEE authorship of the standard does not grant logo rights, and regulatory approval covers spectrum use rather than branding. Firmware licensing is unrelated to certification.

Question 28Wi-Fi Technology, Standards, and Certifications

Which frequency band does 802.11be (Wi-Fi 7) add to the bands already used by 802.11ax, enabling wider channels?

  1. 3.5 GHz
  2. 6 GHz Correct answer.
  3. 60 GHz
  4. 900 MHz

Explanation

Wi-Fi 7 builds on the 2.4, 5, and 6 GHz bands used by 802.11ax, and the 6 GHz band provides the contiguous spectrum needed for 320 MHz channels. The 60 GHz band belongs to 802.11ad/ay, and 900 MHz and 3.5 GHz are not Wi-Fi bands. This spectrum availability is central to Wi-Fi 7's throughput gains.

Question 29Wi-Fi Technology, Standards, and Certifications

An administrator wants to confirm that a client and AP negotiated a specific PHY rate and channel width. Which information element in the association exchange carries the client's supported data rates?

  1. ERP element
  2. Country element
  3. TIM element
  4. Supported Rates and Extended Supported Rates elements Correct answer.

Explanation

The Supported Rates and Extended Supported Rates elements list the data rates a station can use, and they appear in association and beacon frames. The Country element conveys regulatory constraints, the TIM element signals buffered traffic, and the ERP element flags 802.11g-specific behavior. Only the rates elements directly advertise data rate capability.

Question 30Wi-Fi Technology, Standards, and Certifications

A station associates to an ESS and later moves to another AP in the same ESS. Which address remains the same so that upper-layer sessions survive the move?

  1. The basic rate set of the new AP
  2. The AP's radio channel
  3. The station's MAC address Correct answer.
  4. The serving AP's BSSID

Explanation

The station's MAC address is its identity within the ESS, so the distribution system can forward frames to it at whichever AP it currently uses. The BSSID, channel, and basic rate set all change when the station moves to a different AP. Keeping the station address stable is what allows higher-layer connections to persist across the roam.

Question 31Wi-Fi Technology, Standards, and Certifications

A designer must keep a guest WLAN from reaching the corporate VLAN while allowing internet access. Which approach enforces this at the wireless infrastructure?

  1. Mapping the guest SSID to a separate VLAN with ACLs toward internal subnets Correct answer.
  2. Enabling 802.11w protected management frames on the guest SSID
  3. Increasing the beacon interval on the guest SSID
  4. Configuring the guest SSID to use only 802.11a rates

Explanation

Segmenting the guest SSID onto its own VLAN and applying access control lists prevents guest traffic from reaching internal subnets while still permitting internet-bound flows. Protected management frames, beacon interval tuning, and rate selection affect security or airtime, not Layer 3 reachability. Segmentation is the standard control for isolating guest traffic.

Question 32Wi-Fi Technology, Standards, and Certifications

A laptop reports a strong signal but low throughput on a heavily used 2.4 GHz channel. Which condition most directly explains this?

  1. Co-channel interference from neighboring APs sharing the channel Correct answer.
  2. An expired DHCP lease on the client
  3. Insufficient PoE budget on the access point
  4. A mismatched regulatory domain in the AP configuration

Explanation

On 2.4 GHz only a few non-overlapping channels exist, so neighboring APs commonly share a channel and contend for airtime, which cuts effective throughput despite a strong signal. PoE budget affects power delivery, regulatory domain affects allowed channels and power, and DHCP affects addressing. None of those directly causes airtime contention on a shared channel.

Question 33Wi-Fi Technology, Standards, and Certifications

A security auditor finds that a WPA2-Enterprise deployment accepts a client that presents a valid server certificate but never validates it. Which attack does this enable?

  1. A KRACK-style replay of the four-way handshake
  2. A deauthentication flood forcing clients into power-save mode
  3. An evil twin AP capturing credentials through a rogue RADIUS server Correct answer.
  4. A beacon flood exhausting the client's scan table

Explanation

If the supplicant does not validate the RADIUS server certificate, an attacker can stand up a rogue AP with its own authentication server and lure the client into sending credentials or a response the attacker can use. Deauthentication floods, handshake replays, and beacon floods are availability or key-reinstallation issues, not credential capture via a fake authentication server. Server certificate validation is the defense against this evil twin scenario.

Question 34Wi-Fi Technology, Standards, and Certifications

An engineer plans a high-density auditorium and wants to reduce contention among many clients. Which 802.11ax feature should be leveraged to schedule uplink transmissions?

  1. Legacy 802.11b protection mechanisms
  2. Trigger frames that solicit simultaneous uplink OFDMA resource units Correct answer.
  3. Wider 160 MHz channels for every client
  4. Larger A-MPDU aggregation limits per station

Explanation

802.11ax uses trigger frames from the AP to schedule uplink OFDMA, letting multiple stations transmit simultaneously on assigned resource units instead of contending for the whole channel. Larger aggregation and wider channels raise per-client throughput but do not reduce contention among many clients, and legacy protection adds overhead. Scheduling uplink access is the mechanism that improves dense-deployment efficiency.

Question 35Hardware and Software

In a wireless LAN deployment, which IEEE 802.11 amendment first introduced operation in the 6 GHz band for Wi-Fi?

  1. 802.11ax Correct answer.
  2. 802.11be
  3. 802.11ac
  4. 802.11n

Explanation

802.11ax (Wi-Fi 6) was amended by 802.11ax-2021 to permit operation in the 6 GHz band, and products using that band are marketed as Wi-Fi 6E. Earlier amendments such as 802.11n and 802.11ac operate only in 2.4 GHz and 5 GHz. 802.11be builds on 6 GHz support but did not introduce it.

Question 36Hardware and Software

Which PoE standard is capable of delivering up to 60 W at the PSE over two pairs using Type 3 hardware?

  1. IEEE 802.3az
  2. IEEE 802.3bt Correct answer.
  3. IEEE 802.3at
  4. IEEE 802.3af

Explanation

IEEE 802.3bt defines Type 3 (up to 60 W at the PSE) and Type 4 (up to 90 W) power delivery, using all four pairs for Type 4 and two pairs for Type 3. 802.3af provides about 15.4 W and 802.3at about 30 W at the PSE. 802.3az is Energy Efficient Ethernet and has nothing to do with power delivery.

Question 37Hardware and Software

A technician needs to connect a laptop directly to a switch console port to perform initial configuration. Which combination is appropriate?

  1. Rollover cable with terminal emulation software at 9600 baud 8N1 Correct answer.
  2. USB-C cable with a TFTP server
  3. Straight-through Ethernet cable with a Telnet client
  4. Crossover cable with an SSH client

Explanation

Console access uses a rollover (console) cable from the RJ-45 console port to a serial adapter, with terminal emulation set to the vendor's default, commonly 9600 baud, 8 data bits, no parity, 1 stop bit. Telnet and SSH require the device to already have an IP address and management access configured. TFTP is a file transfer protocol, not a console transport.

Question 38Hardware and Software

Which statement correctly describes the difference between TACACS+ and RADIUS for device administration?

  1. TACACS+ is defined in RFC 2865, while RADIUS is a Cisco-proprietary protocol.
  2. TACACS+ encrypts only the password field, while RADIUS encrypts the entire payload.
  3. TACACS+ separates authentication, authorization, and accounting, while RADIUS combines authentication and authorization. Correct answer.
  4. TACACS+ uses UDP port 1812, while RADIUS uses TCP port 49.

Explanation

TACACS+ keeps AAA functions modular so authorization can be handled per command, which is why it is preferred for network device administration. RADIUS bundles authentication and authorization into a single exchange and is commonly used for user network access. TACACS+ runs over TCP 49, while RADIUS runs over UDP 1812/1813.

Question 39Hardware and Software

Which IPv6 address type is used by a host to send a packet to every node on its local link only?

  1. Unique local
  2. Link-local unicast
  3. Global unicast
  4. Solicited-node multicast Correct answer.

Explanation

All-nodes on a link is reached with the solicited-node-derived all-nodes multicast group ff02::1, which is scoped to the local link. Global unicast and unique local addresses are individual host addresses, not group addresses. Link-local unicast addresses identify a single interface on the link.

Question 40Hardware and Software

A switch port configured with port security in restrict mode receives a frame from an unknown MAC address. What happens?

  1. The switch resets the violation counter and forwards the frame.
  2. The frame is dropped and a violation counter and syslog message are generated. Correct answer.
  3. The frame is forwarded and the new MAC is added to the secure table.
  4. The port is placed into the err-disabled state immediately.

Explanation

Restrict mode drops traffic from unknown source MAC addresses, increments the security violation counter, and can send an SNMP trap or syslog message, but keeps the port up. Shutdown mode is the mode that err-disables the interface. Protect mode silently drops frames without logging.

Question 41Hardware and Software

Which spanning tree variant uses a single instance for all VLANs and typically converges in about 30 to 50 seconds?

  1. MSTP
  2. PVST+ Correct answer.
  3. Rapid PVST+
  4. RSTP

Explanation

PVST+ runs one 802.1D legacy spanning tree instance per VLAN, and legacy 802.1D timers produce convergence in roughly 30 to 50 seconds. Rapid PVST+ and RSTP use the rapid re-convergence mechanisms of 802.1w, and MSTP maps multiple VLANs to fewer instances with rapid convergence.

Question 42Hardware and Software

A router receives a packet destined for 10.20.30.40. Its routing table holds 10.0.0.0/8 via next hop A, 10.20.0.0/16 via next hop B, and 10.20.30.0/24 via next hop C. Which next hop is used?

  1. Next hop C Correct answer.
  2. Next hop B
  3. The packet is dropped as ambiguous
  4. Next hop A

Explanation

Routers forward using the longest prefix match, so the most specific route containing the destination wins. All three routes match 10.20.30.40, and the /24 route is the longest match. Next hops A and B are valid matches but less specific.

Question 43Hardware and Software

Which OSPF packet type is used to confirm that a neighbor is still reachable on a broadcast network after adjacency is formed?

  1. Hello Correct answer.
  2. Link State Request
  3. Database Description
  4. Link State Update

Explanation

Hello packets are sent periodically on OSPF-enabled interfaces to discover neighbors, elect the DR and BDR on broadcast segments, and act as a keepalive confirming reachability. Database Description, Link State Request, and Link State Update packets carry database synchronization information rather than periodic liveness.

Question 44Hardware and Software

An engineer wants to summarize the four subnets 172.16.0.0/24 through 172.16.3.0/24 into one route. Which prefix accomplishes this?

  1. 172.16.0.0/22 Correct answer.
  2. 172.16.0.0/20
  3. 172.16.0.0/23
  4. 172.16.0.0/21

Explanation

The four /24 networks occupy the address range 172.16.0.0 to 172.16.3.255, which is exactly one /22 block. A /22 masks the last two bits of the third octet, so 0 through 3 in that octet are covered by one entry. A /23 would cover only two of the four subnets.

Question 45Hardware and Software

Which characteristic distinguishes a next-generation firewall from a traditional stateful firewall?

  1. It filters traffic based on source and destination IP addresses.
  2. It maintains a state table for TCP sessions.
  3. It performs NAT between inside and outside interfaces.
  4. It applies application-layer inspection and user identity awareness to traffic. Correct answer.

Explanation

A next-generation firewall adds application identification, intrusion prevention, and user or group awareness on top of stateful inspection. Stateful session tracking, NAT, and address-based filtering are capabilities that traditional stateful firewalls already provide.

Question 46Hardware and Software

A network uses HSRP version 1 with default settings on a pair of routers. Which statement about the virtual MAC address is accurate?

  1. The virtual MAC is 0000.0c9f.fXXX, where XXX is the group number.
  2. The virtual MAC equals the physical MAC of the active router.
  3. The virtual MAC is 0005.73a0.0000 for every group.
  4. The virtual MAC is 0000.0c07.acXX, where XX is the group number in hex. Correct answer.

Explanation

HSRP version 1 uses the well-known virtual MAC 0000.0c07.acXX, with the last octet carrying the group number in hexadecimal. Version 2 uses 0000.0c9f.fXXX and supports larger group numbers. The virtual MAC is independent of the router's physical MAC.

Question 47Hardware and Software

Which QoS marking field is preserved end to end at Layer 3 and carries a 6-bit differentiated services codepoint?

  1. EXP field in the MPLS label
  2. CoS field in the Ethernet frame
  3. PCP field in the 802.1Q tag
  4. DSCP field in the IP header Correct answer.

Explanation

The DSCP is a 6-bit field in the IPv4 Type of Service byte or the IPv6 Traffic Class byte, and it survives Layer 3 forwarding across routers. PCP and CoS are Layer 2 markings that are typically stripped or rewritten at routed boundaries, and the MPLS EXP field exists only within an MPLS domain.

Question 48Hardware and Software

A WLC is configured in local mode with APs on the same management subnet. Which traffic path describes client data in this deployment?

  1. Client data is bridged directly at the AP onto the local access VLAN without reaching the WLC.
  2. Client data is sent to the WLC only for authentication and then returned to the AP for bridging.
  3. Client data bypasses the WLC and is forwarded by the AP using a FlexConnect local switching policy.
  4. Client data is tunneled in CAPWAP to the WLC and then forwarded onto the wired network. Correct answer.

Explanation

In local mode, the AP forms a CAPWAP data tunnel to the WLC, and all client frames are encapsulated and sent to the controller, which forwards them onto the wired network. Local switching at the AP requires FlexConnect (formerly H-REAP) mode, and the controller does not merely broker authentication.

Question 49Hardware and Software

Which mechanism allows a switch to carry multiple VLANs over a single link to another switch?

  1. Private VLAN isolation
  2. Link aggregation without tagging
  3. 802.1Q trunking Correct answer.
  4. Port mirroring

Explanation

802.1Q inserts a 4-byte tag containing the VLAN identifier into Ethernet frames, letting one physical link carry frames for many VLANs. Port mirroring copies traffic for analysis, and private VLANs restrict lateral communication within a VLAN. Link aggregation without tagging still carries only untagged traffic.

Question 50Hardware and Software

A host with address 192.168.10.130/26 needs to reach a server at 192.168.10.190. What does the host do?

  1. It drops the packet because the destination is in the broadcast range.
  2. It sends an ARP request for the server and waits for a proxy reply.
  3. It sends the packet directly to the server because both addresses share the same subnet.
  4. It forwards the packet to its default gateway because the server is on a different subnet. Correct answer.

Explanation

A /26 mask creates subnets in blocks of 64, so 192.168.10.128/26 spans .128 to .191 and 192.168.10.192/26 begins at .192. The host .130 and server .190 actually fall in the same /26, so the host would ARP for the server directly, making the gateway answer incorrect; the correct reasoning is that both are in 192.168.10.128/26.