I85PREP
⌘ K
LCPE study materials
LCPE study resources

LCPE practice questions

One question at a time. Build your LCPE understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Network Fundamentals

A technician is documenting the TCP/IP model layers used on a new switch. Which layer of the TCP/IP model corresponds to the OSI model's network layer and is responsible for logical addressing and routing?

  1. Application layer
  2. Transport layer
  3. Network Access layer
  4. Internet layer Correct answer.

Explanation

The TCP/IP Internet layer maps to the OSI network layer and handles logical addressing (IP) and routing of packets between networks. The Network Access layer combines OSI physical and data link functions, while Transport handles end-to-end delivery.

Question 2Network Fundamentals

On an Ethernet network, which address is used by a switch to forward a frame out of a specific port within the local segment?

  1. The destination MAC address Correct answer.
  2. The destination IP address
  3. The destination network prefix
  4. The source port number

Explanation

A Layer 2 switch builds a MAC address table and forwards frames based on the destination MAC address contained in the frame header. IP addresses are used by routers at Layer 3, and port numbers belong to Layer 4 transport protocols.

Question 3Network Fundamentals

A host is configured with IP address 192.168.10.130 and subnet mask 255.255.255.192. What is the network address of the subnet this host belongs to?

  1. 192.168.10.128 Correct answer.
  2. 192.168.10.192
  3. 192.168.10.0
  4. 192.168.10.64

Explanation

A /26 mask (255.255.255.192) creates subnets in blocks of 64 in the last octet: 0, 64, 128, 192. The host 130 falls in the 128 block, so the network address is 192.168.10.128.

Question 4Network Fundamentals

Which characteristic distinguishes TCP from UDP at the transport layer?

  1. TCP operates only on local area networks
  2. TCP provides connection-oriented, reliable delivery with acknowledgments Correct answer.
  3. TCP uses connectionless datagrams without sequencing
  4. TCP encrypts all payload data by default

Explanation

TCP establishes a connection through a three-way handshake and provides reliable, ordered delivery using sequence numbers and acknowledgments. UDP is connectionless and does not guarantee delivery, ordering, or error recovery.

Question 5Network Fundamentals

A network engineer needs to connect two buildings 2 km apart with fiber and wants the link to operate as a single Layer 2 broadcast domain. Which device type accomplishes this?

  1. A firewall in transparent mode
  2. A Layer 2 switch at each end joined by the fiber Correct answer.
  3. A Layer 3 router
  4. A load balancer

Explanation

Extending a single broadcast domain across two locations requires Layer 2 connectivity, such as switches interconnected by fiber. A router would separate the locations into distinct broadcast domains.

Question 6Network Fundamentals

In IPv6, which address type is used for one-to-many delivery where packets are sent to all interfaces that have joined a specific group?

  1. Anycast
  2. Broadcast
  3. Unicast
  4. Multicast Correct answer.

Explanation

IPv6 multicast delivers packets to all interfaces that have joined a multicast group, identified by addresses beginning with ff00::/8. IPv6 has no broadcast address type; broadcast functionality is replaced by multicast.

Question 7Network Fundamentals

Which protocol resolves an IPv4 address to a MAC address on a local Ethernet segment?

  1. DHCP
  2. ICMP
  3. DNS
  4. ARP Correct answer.

Explanation

ARP broadcasts a request asking which device owns a given IPv4 address and receives the corresponding MAC address in reply. DNS resolves names to IP addresses, DHCP assigns addresses, and ICMP carries error and diagnostic messages.

Question 8Network Fundamentals

A company is assigned the network 10.20.0.0/16 and must create subnets supporting at least 500 usable host addresses each. Which subnet mask provides the required hosts with the least waste?

  1. 255.255.255.0
  2. 255.255.254.0 Correct answer.
  3. 255.255.252.0
  4. 255.255.248.0

Explanation

A /23 mask (255.255.254.0) provides 2^9 - 2 = 510 usable host addresses, which meets the 500-host requirement with minimal waste. A /24 gives only 254 hosts, while /22 and /21 provide more than needed.

Question 9Network Fundamentals

Which statement accurately describes the function of a default gateway on an end host?

  1. It assigns IP addresses to local clients
  2. It stores MAC addresses learned from incoming frames
  3. It forwards traffic destined for remote networks to a router Correct answer.
  4. It resolves domain names to IP addresses

Explanation

The default gateway is the router interface an end host sends traffic to when the destination is outside its local subnet. Hosts compare the destination to their subnet mask and use the gateway for all off-subnet traffic.

Question 10Network Fundamentals

An administrator notices that a workstation can reach hosts on its own subnet but cannot reach any host on remote subnets. Which configuration issue is the most likely cause?

  1. An incorrect DNS server address
  2. A duplicate MAC address on the local switch
  3. An incorrect default gateway address on the workstation Correct answer.
  4. A mismatched duplex setting on the local link

Explanation

Local communication works because the host ARPs directly for on-subnet peers, but off-subnet traffic must be sent to the default gateway. If that gateway address is wrong or missing, remote destinations become unreachable.

Question 11Network Fundamentals

Which OSI layer is responsible for establishing, managing, and terminating sessions between applications?

  1. Data Link layer
  2. Transport layer
  3. Presentation layer
  4. Session layer Correct answer.

Explanation

The OSI session layer establishes, manages, and terminates dialogues between applications. The transport layer handles end-to-end delivery, and the presentation layer handles data formatting and encryption.

Question 12Network Fundamentals

A network uses VLANs to segment traffic on a single physical switch. Which statement best describes traffic between two hosts in different VLANs?

  1. It requires a Layer 3 device such as a router or Layer 3 switch Correct answer.
  2. It is automatically blocked by the switch and cannot be enabled
  3. It is forwarded only if both hosts share the same MAC address
  4. It is switched directly at Layer 2 without any Layer 3 device

Explanation

Each VLAN is a separate broadcast domain, so inter-VLAN traffic must be routed by a Layer 3 device. This can be a router with subinterfaces or a Layer 3 switch performing inter-VLAN routing.

Question 13Network Fundamentals

Which field in an IPv4 header is decremented by each router along the path to prevent packets from looping indefinitely?

  1. Header checksum
  2. Fragment offset
  3. Protocol
  4. Time to Live Correct answer.

Explanation

The Time to Live (TTL) field is decremented by each router, and the packet is discarded when it reaches zero. This mechanism prevents packets from circulating forever due to routing loops.

Question 14Network Fundamentals

A host sends a packet to a destination address outside its subnet. What destination MAC address does the host place in the Ethernet frame?

  1. The MAC address of the default gateway interface Correct answer.
  2. The MAC address of the final destination host
  3. The MAC address of the DNS server
  4. The broadcast MAC address ff:ff:ff:ff:ff:ff

Explanation

For off-subnet destinations, the host resolves the default gateway's IP to a MAC address with ARP and uses that as the frame's destination MAC. The destination IP remains that of the remote host.

Question 15Network Fundamentals

Which routing concept describes a route that is manually configured by an administrator rather than learned automatically?

  1. Default route learned via OSPF
  2. Dynamic route
  3. Static route Correct answer.
  4. Directly connected route

Explanation

A static route is manually entered by an administrator and does not change unless edited. Dynamic routes are learned through routing protocols, and directly connected routes are derived from active interface configuration.

Question 16Network Fundamentals

A network designer is selecting a cabling standard for a new 10 Gigabit Ethernet backbone run of 300 meters. Which medium is appropriate?

  1. Cat 6a twisted pair
  2. Coaxial cable
  3. Cat 5e twisted pair
  4. Multimode fiber Correct answer.

Explanation

Multimode fiber supports 10 Gigabit Ethernet over distances well beyond the 100-meter limit of twisted-pair copper. Cat 6a is limited to roughly 100 meters, which is insufficient for a 300-meter run.

Question 17Network Fundamentals

Which protocol is used by a host to automatically obtain an IPv4 address, subnet mask, and default gateway?

  1. DNS
  2. DHCP Correct answer.
  3. ARP
  4. NTP

Explanation

DHCP automatically provides IP configuration, including address, mask, gateway, and DNS servers, using a discover-offer-request-acknowledge exchange. ARP resolves addresses, DNS resolves names, and NTP synchronizes time.

Question 18Network Fundamentals

An engineer sees the output of a command showing that a packet was fragmented during transit. Which IPv4 header fields are used to reassemble the original datagram?

  1. Version and header length
  2. Identification, flags, and fragment offset Correct answer.
  3. TTL and protocol
  4. Source and destination addresses

Explanation

Reassembly relies on the identification field to group fragments, the flags field (MF bit) to indicate more fragments, and the fragment offset to place each fragment correctly. The destination host uses these fields to rebuild the datagram.

Question 19Network Fundamentals

Which statement correctly describes the purpose of a subnet mask on an IPv4 host?

  1. It identifies which portion of an IP address is the network and which is the host Correct answer.
  2. It maps IP addresses to MAC addresses
  3. It encrypts traffic between subnets
  4. It assigns a default gateway automatically

Explanation

The subnet mask uses contiguous binary ones to define the network portion and zeros to define the host portion of an IPv4 address. The host uses this to determine whether a destination is local or remote.

Question 20Network Fundamentals

A network uses a star topology with a central switch. Which characteristic is a primary advantage of this design?

  1. A single cable failure disables the entire network
  2. It requires no central device
  3. Failure of one host link does not affect other hosts Correct answer.
  4. It eliminates the need for MAC addressing

Explanation

In a star topology, each host connects independently to a central device, so a single link failure affects only that host. The central device becomes a single point of failure, but per-link isolation is a key benefit.

Question 21Network Fundamentals

Which of the following best explains why UDP is preferred over TCP for live voice and video streams?

  1. UDP guarantees ordered delivery, which media requires
  2. UDP has lower overhead and avoids retransmission delays Correct answer.
  3. UDP provides built-in congestion control
  4. UDP encrypts streams automatically

Explanation

UDP has a minimal header and no retransmission or connection setup, which reduces latency for real-time media. Retransmitting lost packets in TCP would introduce delays that are worse than minor packet loss for live streams.

Question 22Network Fundamentals

A host with address 172.16.5.200/22 needs to reach 172.16.8.10. Based on the subnet mask, how does the host treat this destination?

  1. As a local destination reached directly via ARP
  2. As a broadcast destination
  3. As an invalid address that is dropped
  4. As a remote destination sent to the default gateway Correct answer.

Explanation

A /22 mask covers 172.16.4.0 through 172.16.7.255, so 172.16.8.10 lies outside the host's subnet. The host therefore forwards the packet to its default gateway for routing.

Question 23Network Fundamentals

Which device operates primarily at the OSI data link layer and uses MAC address tables to forward frames?

  1. Router
  2. Switch Correct answer.
  3. Repeater
  4. Hub

Explanation

A switch operates at Layer 2, learning source MAC addresses and forwarding frames based on a MAC address table. Routers operate at Layer 3, while hubs and repeaters operate at Layer 1 and simply repeat signals.

Question 24Network Fundamentals

Which IPv6 mechanism allows a host to automatically configure its own address using its MAC address without a DHCP server?

  1. Port address translation
  2. Stateless address autoconfiguration Correct answer.
  3. Network address translation
  4. DHCPv6 stateful assignment

Explanation

Stateless address autoconfiguration (SLAAC) lets a host build an IPv6 address from a network prefix advertised by a router combined with an interface identifier. DHCPv6 stateful assignment instead relies on a server to provide addresses.

Question 25Network Fundamentals

A network administrator observes that an interface is receiving frames with errors and suspects a physical layer problem. Which factor is a valid physical layer cause?

  1. A misconfigured IP address
  2. Electromagnetic interference on the cable Correct answer.
  3. An incorrect DNS entry
  4. An incorrect default gateway

Explanation

Electromagnetic interference degrades the signal on copper cabling and causes frame errors, which is a physical layer issue. Gateway, IP, and DNS problems are configuration issues at higher layers.

Question 26Network Fundamentals

Which TCP/IP model layer corresponds to the combination of the OSI session, presentation, and application layers?

  1. Application layer Correct answer.
  2. Transport layer
  3. Internet layer
  4. Network access layer

Explanation

The four-layer TCP/IP model merges the top three OSI layers into a single application layer, because session management, data formatting, and application protocols are all handled by software at that level. The transport and internet layers map one-to-one to OSI transport and network layers respectively.

Question 27Network Fundamentals

Which transport-layer protocol provides connection-oriented, reliable delivery with sequencing and acknowledgments?

  1. UDP
  2. ICMP
  3. ARP
  4. TCP Correct answer.

Explanation

TCP establishes a connection with a three-way handshake, numbers segments, acknowledges received data, and retransmits lost segments, giving reliable ordered delivery. UDP is connectionless and does not guarantee delivery, while ICMP and ARP operate at other layers for diagnostics and address resolution.

Question 28Network Fundamentals

Which address range is reserved for IPv4 link-local (APIPA) autoconfiguration?

  1. 169.254.0.0/16 Correct answer.
  2. 192.168.0.0/16
  3. 172.16.0.0/12
  4. 10.0.0.0/8

Explanation

The 169.254.0.0/16 block is reserved for link-local addressing, which a host self-assigns when no DHCP server responds. The other ranges listed are private addresses normally assigned statically or via DHCP and routed within an enterprise.

Question 29Network Fundamentals

Which term describes the maximum amount of data a medium can carry per unit of time, expressed in bits per second?

  1. Throughput
  2. Bandwidth Correct answer.
  3. Jitter
  4. Latency

Explanation

Bandwidth is the theoretical capacity of a link, measured in bits per second. Throughput is the actual achieved rate after overhead and loss, while latency and jitter describe delay characteristics rather than capacity.

Question 30Network Fundamentals

A host needs to send a packet to 192.168.10.45 while configured with address 192.168.10.20/26. How does the host handle this destination?

  1. It performs a DNS lookup to resolve the destination before sending
  2. It sends an ARP request for 192.168.10.45 and delivers the frame directly on the local segment Correct answer.
  3. It forwards the packet to its default gateway because the destination is on a different subnet
  4. It drops the packet because the destination address is in the reserved range

Explanation

A /26 mask gives a block size of 64, so 192.168.10.20 falls in 192.168.10.0–192.168.10.63 and 192.168.10.45 falls in the same subnet. Because the destination is local, the host ARPs for the destination MAC and sends the frame directly without involving a router.

Question 31Network Fundamentals

Which statement best describes the behavior of a switch flooding an unknown unicast frame?

  1. It discards the frame and sends an ICMP unreachable message to the source
  2. It rewrites the destination MAC address to the broadcast address before forwarding
  3. It sends the frame only to the port listed as the default gateway
  4. It sends the frame out every port except the ingress port when the destination MAC is not in its table Correct answer.

Explanation

When a switch receives a unicast frame whose destination MAC is absent from its MAC address table, it floods the frame out all ports in the same VLAN except the one it arrived on. Once the destination replies, the switch learns its MAC and port and forwards subsequent frames directly.

Question 32Network Fundamentals

Which protocol provides a loop-free path calculation by running the Dijkstra shortest-path-first algorithm within a single administrative area?

  1. HSRP
  2. BGP
  3. OSPF Correct answer.
  4. RIP

Explanation

OSPF is a link-state interior gateway protocol that builds a topology database and runs the SPF algorithm to compute loop-free shortest paths. RIP uses hop-count distance vector logic, BGP is a path-vector exterior protocol, and HSRP provides gateway redundancy.

Question 33Network Fundamentals

Which mechanism lets a host discover the MAC address of a router for an IPv6 destination on a remote network?

  1. Neighbor Discovery neighbor solicitation and advertisement Correct answer.
  2. ARP broadcast requests
  3. Router solicitation for a prefix
  4. DHCPv6 address assignment

Explanation

IPv6 Neighbor Discovery uses neighbor solicitation and neighbor advertisement messages over ICMPv6 to resolve link-layer addresses, replacing IPv4 ARP. The host resolves the next-hop router's link-layer address before forwarding the packet.

Question 34Network Fundamentals

A technician must connect two switches in different buildings over a 2 km distance using fiber. Which characteristic distinguishes single-mode from multimode fiber in this scenario?

  1. Single-mode fiber carries a single light path and supports longer distances with less dispersion Correct answer.
  2. Multimode fiber has no cladding and therefore suffers no signal loss
  3. Multimode fiber uses a laser source and is always required for runs beyond 1 km
  4. Single-mode fiber has a larger core and supports shorter distances than multimode

Explanation

Single-mode fiber has a very small core that allows essentially one propagation path, minimizing modal dispersion and supporting long campus and metro distances. Multimode fiber has a larger core with multiple light paths, which limits distance at high data rates.

Question 35Network Fundamentals

Which statement correctly describes the role of the TTL field when a packet crosses a router that does not support fragmentation of the packet?

  1. The router increments TTL to account for the additional hop
  2. The router resets TTL to its original value so the packet can continue
  3. The router decrements TTL and, if it reaches zero, discards the packet and returns an ICMP Time Exceeded message Correct answer.
  4. The router copies the TTL value into the options field before forwarding

Explanation

Each router decrements the TTL by one before forwarding. If the value reaches zero, the packet is discarded and an ICMP Time Exceeded message is sent to the source, which prevents packets from circulating indefinitely.

Question 36Network Fundamentals

A network engineer needs to allow a web server on a private LAN to be reachable from the internet without exposing its private address. Which technique should be used?

  1. A DHCP reservation binding the server's MAC to a private address
  2. PAT translating all internal hosts to one public address
  3. Static NAT mapping a public address to the server's private address Correct answer.
  4. A VLAN trunk carrying the server's traffic to the internet router

Explanation

Static NAT creates a fixed one-to-one translation between a public address and the server's private address, so external clients can initiate connections to the public address. PAT with a shared public address is normally used for outbound connections and does not provide a stable inbound mapping for a server.

Question 37Network Fundamentals

Which cloud connectivity model places an organization's on-premises network and a provider's virtual network on a dedicated private circuit rather than the public internet?

  1. Dedicated private interconnect Correct answer.
  2. SD-WAN with internet underlay
  3. Site-to-site VPN over broadband
  4. Client-to-site remote access VPN

Explanation

A dedicated private interconnect provides a private circuit between the enterprise edge and the cloud provider, avoiding internet paths and offering predictable latency and bandwidth. VPN and SD-WAN options ride over public internet transport.

Question 38Network Fundamentals

A network uses 802.1Q trunking between two switches. Which statement describes how frames from different VLANs are distinguished on the trunk?

  1. Each frame carries a 12-bit VLAN identifier in a tag inserted after the source MAC address Correct answer.
  2. Each frame's VLAN is identified by the IP precedence field in the IP header
  3. Each VLAN uses a separate physical cable pair within the trunk link
  4. Each VLAN is assigned a unique MAC address that replaces the destination MAC

Explanation

802.1Q inserts a four-byte tag into the Ethernet frame, containing a 12-bit VLAN ID that identifies the VLAN for each frame on the trunk. This allows multiple VLANs to share one physical link while remaining logically separate.

Question 39Network Fundamentals

An engineer must summarize four contiguous networks-172.16.4.0/24 through 172.16.7.0/24-into a single route. Which prefix accomplishes this?

  1. 172.16.4.0/23
  2. 172.16.0.0/21
  3. 172.16.4.0/24
  4. 172.16.4.0/22 Correct answer.

Explanation

The four /24 networks occupy the 172.16.4.0–172.16.7.255 range, which aligns on a /22 boundary. A /22 mask of 255.255.252.0 covers exactly those four subnets without including unrelated addresses.

Question 40Network Fundamentals

A host configured with a /28 mask reports that it can reach some hosts in its range but not others. Which explanation is most consistent with the addressing?

  1. The /28 block is a broadcast domain shared with all other subnets on the router
  2. The /28 block contains 16 addresses, so the host may be attempting to reach addresses in an adjacent block that require a gateway Correct answer.
  3. The /28 mask disables ARP, so the host cannot resolve any local neighbor
  4. The /28 mask allows only 4 usable addresses, so most destinations are unreachable by design

Explanation

A /28 provides 16 addresses, of which 14 are usable after the network and broadcast addresses. Hosts in the same /28 are reachable directly, but addresses just outside that block belong to a different subnet and require the default gateway, which explains partial reachability.

Question 41Network Access

A switch port is configured with the command `switchport port-security violation restrict`. What happens when a frame arrives from a MAC address that violates the configured maximum?

  1. The offending MAC address is automatically added to the secure table as a sticky entry.
  2. The frame is forwarded and only a log entry is written.
  3. The port is placed into the err-disabled state immediately.
  4. The frame is dropped, a violation counter increments, and a syslog/SNMP trap may be generated. Correct answer.

Explanation

In restrict mode the switch discards frames from the violating MAC address, increments the security violation counter, and can send a syslog message or SNMP trap. The interface stays up and forwarding for legitimate addresses, so traffic is not fully interrupted.

Question 42Network Access

Which statement correctly describes the default behavior of a switch port configured with 802.1X before any supplicant authenticates?

  1. All traffic is permitted, but it is tagged into a guest VLAN.
  2. Only DHCP and ARP traffic are permitted until authentication succeeds.
  3. All traffic is permitted until the authentication attempt fails.
  4. Only EAPOL frames are permitted; all other traffic is blocked. Correct answer.

Explanation

A port in the unauthorized state under 802.1X allows only EAPOL frames between the supplicant and the authenticator. Other data traffic is blocked until authentication succeeds. Guest VLANs and restricted traffic classes are optional configurations, not the default.

Question 43Network Access

Which Cisco switch command enables sticky learning of MAC addresses on a port that already has port security enabled?

  1. switchport port-security mac-address sticky Correct answer.
  2. switchport port-security violation sticky
  3. switchport port-security maximum sticky
  4. switchport port-security mac-address static

Explanation

The `switchport port-security mac-address sticky` command enables sticky learning, which dynamically learns MAC addresses and adds them to the running configuration as secure addresses. The other forms are not valid Cisco IOS port-security commands.

Question 44Network Access

A network engineer needs to allow only one device to connect to an access port and automatically disable the port if a different device connects. Which combination of port-security settings accomplishes this?

  1. maximum 2 with violation restrict
  2. maximum 1 with violation restrict
  3. maximum 1 with violation shutdown Correct answer.
  4. maximum 1 with violation protect

Explanation

Setting the maximum to 1 permits a single MAC address, and the shutdown violation mode places the port in err-disabled state when another address is seen. Protect and restrict modes drop or log violating traffic but leave the port enabled.

Question 45Network Access

What is the primary function of a DHCP snooping binding table on a Layer 2 switch?

  1. It stores static routes used to reach remote DHCP servers.
  2. It tracks ARP requests to prevent MAC flooding.
  3. It records client MAC, IP, VLAN, and port bindings so untrusted DHCP messages can be validated. Correct answer.
  4. It maps MAC addresses to 802.1X credentials for authentication.

Explanation

The DHCP snooping binding table stores the MAC address, IP address, lease time, VLAN, and interface for each legitimate DHCP lease. The switch uses this table to validate subsequent DHCP messages and to support features such as IP Source Guard and Dynamic ARP Inspection.

Question 46Network Access

On a switch with DHCP snooping enabled, which interface type is permitted to send DHCPOFFER and DHCPACK messages?

  1. Only interfaces in the native VLAN
  2. Untrusted interfaces
  3. Only trunk interfaces
  4. Trusted interfaces Correct answer.

Explanation

DHCP snooping classifies interfaces as trusted or untrusted. Server-originated messages such as OFFER and ACK are allowed only on trusted interfaces; untrusted ports may send only client-originated messages like DISCOVER and REQUEST.

Question 47Network Access

Dynamic ARP Inspection uses which data source to validate ARP packets on a switch?

  1. The 802.1X authentication session database
  2. The routing table and CEF adjacency table
  3. The DHCP snooping binding table and any configured ARP ACLs Correct answer.
  4. The MAC address table only

Explanation

DAI compares the sender MAC and sender IP in ARP packets against the DHCP snooping binding table and, where configured, static ARP ACLs. Packets that do not match an entry on an untrusted port are dropped.

Question 48Network Access

Which feature prevents a host from spoofing an IP address by permitting only traffic whose source IP matches the DHCP snooping binding table?

  1. IP Source Guard Correct answer.
  2. Dynamic ARP Inspection
  3. 802.1X port-based authentication
  4. Port security

Explanation

IP Source Guard filters traffic based on the DHCP snooping binding table (and optionally static IP source bindings), dropping packets whose source IP does not match the expected binding. DAI validates ARP payloads, port security limits MAC addresses, and 802.1X controls authentication.

Question 49Network Access

A trunk link between two switches carries VLANs 10, 20, and 30. The native VLAN is left at the default. Which statement about untagged frames on this trunk is accurate?

  1. Untagged frames are associated with VLAN 1 and could allow VLAN hopping if the native VLAN is not changed. Correct answer.
  2. Untagged frames are associated with the management VLAN configured on the switch.
  3. Untagged frames are associated with VLAN 10 because it is the lowest VLAN ID.
  4. Untagged frames are dropped because all VLANs are tagged.

Explanation

By default the native VLAN on an 802.1Q trunk is VLAN 1, and frames in that VLAN are sent untagged. If the native VLAN is left at default and matches an access VLAN, an attacker may exploit double tagging to reach other VLANs, so best practice is to change the native VLAN to an unused VLAN.

Question 50Network Access

Which configuration change best mitigates VLAN hopping via double tagging on an 802.1Q trunk?

  1. Set the native VLAN to the management VLAN on both ends
  2. Assign an unused VLAN as the native VLAN on both ends of the trunk Correct answer.
  3. Disable DTP and set the trunk to desirable mode
  4. Enable VTP transparent mode on all switches

Explanation

Double tagging relies on the attacker's frames being forwarded in the native VLAN, so moving the native VLAN to an unused VLAN that no access port uses removes the attack path. Disabling DTP is also good practice but does not by itself address double tagging.