I85PREP
⌘ K
AE-C study materials
AE-C study resources

AE-C (NBRC) practice questions

One question at a time. Build your AE-C understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Directory Services and Account Management

In Active Directory, which object is the top-level container of a domain and holds the domain's security policy settings?

  1. The Schema partition
  2. The domain DNS zone
  3. The Domain Naming Context Correct answer.
  4. The Configuration partition

Explanation

Each AD domain is stored in its own Domain Naming Context, whose root object represents the domain itself and links to the domain's password and lockout policies. The Configuration and Schema partitions are forest-wide, not per-domain, and a DNS zone is a name-resolution structure rather than a directory partition.

Question 2Directory Services and Account Management

Which built-in AD group is intended to hold accounts that need administrative rights on domain controllers?

  1. Enterprise Admins
  2. Server Operators
  3. Domain Admins Correct answer.
  4. Account Operators

Explanation

Domain Admins is nested in the local Administrators group of every domain controller in its domain, which is why its members can administer DCs. Enterprise Admins is broader (forest-wide, and only exists in the forest root domain) and Server Operators has a narrower set of server rights.

Question 3Directory Services and Account Management

What is the primary purpose of an Organizational Unit in Active Directory?

  1. To establish a separate security boundary equivalent to a forest
  2. To store the forest-wide schema definitions
  3. To define replication boundaries between domain controllers
  4. To delegate administration and apply Group Policy to a subset of objects Correct answer.

Explanation

OUs are containers used to organize objects so that administrative control can be delegated and Group Policy Objects can be linked at a meaningful scope. They are explicitly not security boundaries, and replication and schema storage are handled by partitions and sites.

Question 4Directory Services and Account Management

Which protocol and port does a Windows client use by default to query Active Directory for directory objects?

  1. Kerberos over UDP 88
  2. RPC over TCP 135
  3. SMB over TCP 445
  4. LDAP over TCP 389 Correct answer.

Explanation

Directory reads and searches use LDAP, which listens on TCP 389 (with LDAPS on 636 when TLS is required). Kerberos authenticates, SMB handles file sharing, and RPC endpoint mapping supports replication and management traffic rather than directory queries.

Question 5Directory Services and Account Management

A user account is configured with a logon-hours restriction of 08:00 to 18:00 Monday through Friday. What happens when the user attempts an interactive logon at 19:00 on Wednesday?

  1. The account is automatically disabled until the next permitted window
  2. The logon succeeds but Group Policy does not apply
  3. The logon is denied and the attempt can be audited Correct answer.
  4. The logon succeeds and an audit event records the exception

Explanation

Logon hours are enforced by the domain controller during authentication, so an attempt outside the permitted window is rejected and can generate a logon failure audit event. The account is not disabled, and policy processing is not conditioned on logon hours.

Question 6Directory Services and Account Management

Which account option forces a user to choose a new password at the next interactive logon?

  1. Store password using reversible encryption
  2. Account is sensitive and cannot be delegated
  3. User must change password at next logon Correct answer.
  4. Password never expires

Explanation

The 'User must change password at next logon' flag sets a stored attribute that prompts for a password change during the next interactive sign-in. Reversible encryption and non-delegation flags affect credential storage and delegation, not password change prompts.

Question 7Directory Services and Account Management

Which tool is the standard Microsoft management console for administering users, groups, computers, and OUs in a domain?

  1. Active Directory Sites and Services
  2. Active Directory Domains and Trusts
  3. Active Directory Users and Computers Correct answer.
  4. ADSI Edit

Explanation

Active Directory Users and Computers is the primary console for day-to-day account and OU administration. Sites and Services manages replication topology, Domains and Trusts manages trust relationships and UPN suffixes, and ADSI Edit is a low-level attribute editor.

Question 8Directory Services and Account Management

What distinguishes a security group from a distribution group in Active Directory?

  1. Distribution groups can be nested; security groups cannot
  2. Distribution groups are evaluated by Kerberos during logon
  3. Security groups exist only in the forest root domain
  4. Security groups can be assigned permissions; distribution groups are used only for email distribution Correct answer.

Explanation

Both group types can hold members, but only security groups carry a security identifier usable in access control entries. Distribution groups exist for messaging lists and are not used for authorization.

Question 9Directory Services and Account Management

A helpdesk technician must reset a user's password without knowing the old one. Which permission on the user object is required?

  1. Replicating Directory Changes
  2. Change Password
  3. Full Control over the domain
  4. Reset Password Correct answer.

Explanation

The extended right 'Reset Password' allows an administrator to set a new password without supplying the current one. 'Change Password' requires knowledge of the existing password, and replication rights are unrelated to account administration.

Question 10Directory Services and Account Management

An organization needs a group whose membership is valid only within one domain but which can be granted permissions on resources in any domain of the forest. Which group scope fits?

  1. Universal
  2. Local machine group
  3. Domain Local
  4. Global Correct answer.

Explanation

Global groups hold members from their own domain and can be granted access to resources in any domain in the forest, which is exactly the described requirement. Domain Local groups can hold cross-domain members but are used for resource permissions in their own domain.

Question 11Directory Services and Account Management

Which practice best implements the AGDLP nesting model for a file share?

  1. Place user accounts in global groups, nest them in domain local groups, and assign permissions to the domain local groups Correct answer.
  2. Place users in universal groups and assign share permissions to those groups
  3. Assign permissions to each user account individually and skip groups
  4. Assign permissions directly to global groups containing user accounts

Explanation

AGDLP places accounts in global groups, nests those in domain local groups, and grants resource permissions to the domain local group. This keeps permission assignments stable when membership changes and works cleanly across domains.

Question 12Directory Services and Account Management

What is the effect of setting an account's User Principal Name suffix to a routed, non-existent domain?

  1. Kerberos is automatically disabled for the account
  2. Users can authenticate but may see certificate or application errors Correct answer.
  3. Users cannot authenticate at all
  4. The account is moved to the forest root domain

Explanation

The UPN suffix is a logon name, not a requirement for the domain to resolve, so authentication still works. However, applications and certificate services that rely on the suffix may fail or warn when the name does not resolve.

Question 13Directory Services and Account Management

Which setting prevents a service account's password from expiring while still allowing the account to be used for interactive logon?

  1. Password never expires Correct answer.
  2. Smart card is required for interactive logon
  3. Account is disabled
  4. Account expires on a set date

Explanation

The 'Password never expires' flag exempts the account from the domain password policy's maximum age, which is common for service accounts. Disabling the account or requiring a smart card would block the intended interactive use.

Question 14Directory Services and Account Management

An administrator deletes a user account by mistake. Which statement about recovery is accurate in a default AD environment?

  1. The account can be restored from the Recycle Bin if the forest functional level supports it and the object is within the deleted object lifetime Correct answer.
  2. The account can be restored only by re-creating it with the same password
  3. The account is restored automatically at the next replication cycle
  4. The account is permanently removed the moment it is deleted

Explanation

AD Recycle Bin, available at the appropriate forest functional level, allows restoration of deleted objects with their attributes intact during the deleted object lifetime. Without it, recovery requires an authoritative restore from backup.

Question 15Directory Services and Account Management

Which attribute change causes a user's Kerberos tickets to be invalidated so that new tickets must be issued?

  1. Changing the user's office location
  2. Changing the user's telephone number
  3. Resetting the user's password Correct answer.
  4. Renaming the user's display name

Explanation

A password reset changes the key material derived from the password, so existing Kerberos tickets can no longer be validated and the user must obtain new ones. Informational attributes such as office, phone, or display name do not affect credential keys.

Question 16Directory Services and Account Management

What does a fine-grained password policy allow that a domain password policy does not?

  1. Different UPN suffixes for specific users
  2. Different replication intervals for password changes
  3. Different Kerberos ticket lifetimes for specific users
  4. Different password and lockout settings for specific users or global groups Correct answer.

Explanation

Fine-grained password policies apply a Password Settings Object to selected users or global security groups, overriding the domain policy for those principals. They do not control ticket lifetimes, replication schedules, or UPN suffixes.

Question 17Directory Services and Account Management

A company acquires a partner firm and needs users in the partner's separate forest to access resources in the company forest. Which approach provides authentication across forests without merging directories?

  1. Create a forest trust between the two forests Correct answer.
  2. Move all partner accounts into the company domain
  3. Create a shortcut trust within the company forest
  4. Configure a site link between the two forests

Explanation

A forest trust allows authentication across two separate forests while each retains its own directory. Moving accounts merges directories, shortcut trusts operate within a single forest, and site links control replication within a forest.

Question 18Directory Services and Account Management

Which group scope can contain members from any domain in the forest and be granted permissions on resources in any domain, at the cost of forest-wide membership replication?

  1. Global
  2. Universal Correct answer.
  3. Machine-local
  4. Domain Local

Explanation

Universal groups can include members from any domain and be used for permissions anywhere in the forest, and their membership is replicated to the global catalog. Global groups are limited to their own domain's membership, and Domain Local groups to their own domain's resources.

Question 19Directory Services and Account Management

What is the result of moving a user object between two OUs in the same domain?

  1. The user's password is reset automatically
  2. The user receives a new security identifier
  3. The user's group memberships are cleared
  4. Group Policy applied by the old OU no longer applies and policy from the new OU does Correct answer.

Explanation

OU membership determines which GPOs are linked and therefore applied, so moving an object changes its effective policy set. The object's SID, password, and group memberships are attributes of the object and are unaffected by the move.

Question 20Directory Services and Account Management

An administrator needs to ensure that a set of privileged accounts cannot be used to sign in to ordinary workstations. Which control best meets this requirement?

  1. Configure the accounts' logon hours
  2. Set the accounts' passwords to never expire
  3. Add the accounts to the Protected Users group Correct answer.
  4. Add the accounts to Domain Guests

Explanation

The Protected Users group enforces restrictions such as blocking credential delegation and restricting which protocols and devices the account can use, which reduces exposure on untrusted workstations. Logon hours and password expiry do not restrict which computers the account may use.

Question 21Directory Services and Account Management

Which statement correctly describes the relationship between a domain and a forest in Active Directory?

  1. A forest is a collection of domains that share a common schema, configuration, and global catalog Correct answer.
  2. A domain is a collection of forests that share a common schema
  3. Domains within a forest must use identical domain names
  4. A forest can contain only one domain

Explanation

A forest is the outermost boundary and consists of one or more domains that share the schema and configuration partitions plus a global catalog. A forest may contain many domains, and each domain has its own distinct DNS name.

Question 22Directory Services and Account Management

A user reports that after a password change on one domain controller, authentication fails intermittently on another. Which cause is most likely?

  1. The user's account has expired
  2. The user's UPN suffix is invalid
  3. Replication of the password change has not yet reached the other domain controller Correct answer.
  4. The password policy has been disabled

Explanation

Password changes replicate between domain controllers, and a DC that has not yet received the change may reject the new password until replication completes. Account expiry and UPN suffix issues would produce consistent rather than intermittent failures.

Question 23Directory Services and Account Management

Which combination correctly describes the default behavior of the Administrator account and the Guest account in a new AD domain?

  1. Both are enabled by default
  2. Administrator is enabled and Guest is disabled by default Correct answer.
  3. Both are disabled by default
  4. Administrator is disabled and Guest is enabled by default

Explanation

In a new domain the built-in Administrator account is enabled so the domain can be administered, while the Guest account is disabled by default for security. Administrators are expected to rename or further protect the Administrator account.

Question 24Directory Services and Account Management

An organization wants to delegate the ability to create and delete user accounts in a specific OU to a helpdesk group without granting rights elsewhere. What is the correct approach?

  1. Use the Delegation of Control Wizard on the OU to grant the appropriate account-management tasks Correct answer.
  2. Grant the helpdesk group Full Control at the domain root
  3. Add the helpdesk group to Domain Admins
  4. Add the helpdesk group to Account Operators and rely on default inheritance

Explanation

The Delegation of Control Wizard applies an access control entry on the chosen OU so the group receives only the selected tasks, such as creating and deleting user objects, within that scope. Domain-wide roles grant far more than required and violate least privilege.

Question 25Directory Services and Account Management

A service runs under a domain account and must access a SQL server on another host. Kerberos authentication fails with a delegation error. Which account setting is most relevant?

  1. The account's password is set to never expire
  2. The account's logon hours are restricted
  3. The account is a member of Domain Users
  4. The account is marked 'Account is sensitive and cannot be delegated' Correct answer.

Explanation

The 'sensitive and cannot be delegated' flag prevents the account's credentials from being forwarded through Kerberos delegation, which produces exactly this failure. Password expiry, default group membership, and logon hours do not block delegation.

Question 26Directory Services and Account Management

Which built-in Active Directory group is intended to hold accounts that need broad administrative control over the domain, such as modifying domain-wide settings and managing other administrators?

  1. Domain Admins Correct answer.
  2. Backup Operators
  3. Remote Desktop Users
  4. Domain Users

Explanation

Domain Admins is a built-in global group placed in the Administrators group of every domain-joined computer by default, giving its members full administrative control across the domain. It is the standard container for delegated domain-wide administration.

Question 27Directory Services and Account Management

An administrator wants to grant a helpdesk team the ability to reset passwords for users in a single department without giving them rights anywhere else in the domain. Which approach follows least-privilege delegation?

  1. Grant the helpdesk accounts the Account Operators role at the domain root.
  2. Add the helpdesk accounts to the built-in Administrators group on each domain controller.
  3. Add the helpdesk accounts to Domain Admins.
  4. Place the department users in a dedicated OU and delegate the Reset Password permission on that OU. Correct answer.

Explanation

Delegation of control assigns specific permissions on a scoped container, so placing users in a dedicated OU and delegating only Reset Password limits the helpdesk to that population. This is the standard least-privilege pattern for helpdesk password resets.

Question 28Directory Services and Account Management

Which statement describes the effect of disabling a user account rather than deleting it?

  1. The account's mailbox and profile are deleted immediately.
  2. The account's SID is removed and cannot be restored.
  3. The account retains its SID and group memberships but is blocked from logon. Correct answer.
  4. The account is moved automatically to the LostAndFound container.

Explanation

Disabling an account sets a flag that prevents interactive and network logon while preserving the object, its SID, group memberships, and linked resources. This makes disabling the preferred first step when an employee leaves or an account is under review.

Question 29Directory Services and Account Management

A company wants to ensure that all new user accounts created in a specific OU automatically receive a standard department value in the Department attribute. Which mechanism accomplishes this with the least manual effort?

  1. An LDAP query scheduled to run nightly
  2. A default value defined on the attribute in the directory schema
  3. A Group Policy preference or template applied at account creation Correct answer.
  4. A logon script assigned through Group Policy

Explanation

Group Policy preferences and account-provisioning templates can populate attributes such as Department at creation time, giving consistent values without manual entry. Automation at provisioning is the standard way to enforce data consistency.

Question 30Directory Services and Account Management

Which group scope should be used for a group that contains user accounts from multiple domains in the same forest and is granted permissions on resources in several domains?

  1. Local machine
  2. Universal Correct answer.
  3. Global
  4. Domain local

Explanation

Universal groups can contain members from any domain in the forest and can be granted permissions on resources in any domain, which matches the cross-domain requirement. Their membership is replicated to the global catalog, so membership changes should be infrequent.

Question 31Directory Services and Account Management

An administrator must prevent a contractor account from logging on during a defined maintenance window each night. Which control most directly enforces this?

  1. Removing the account from Domain Users
  2. Setting the account to expire on a future date
  3. A shorter maximum password age
  4. Logon hours configured on the account Correct answer.

Explanation

Logon hours define the periods during which an account may authenticate, and access outside those hours is denied. This is the direct directory control for time-based logon restriction.

Question 32Directory Services and Account Management

What is the purpose of the primary group setting on a user account when the account is used on non-Windows systems that rely on POSIX attributes?

  1. It identifies the group used for UNIX identity mapping through the primary group ID. Correct answer.
  2. It sets the default group for new objects created by that user.
  3. It controls which group receives mail addressed to the user.
  4. It determines which group's permissions apply when the user signs in to a domain controller.

Explanation

The primary group ID attribute maps a user to a UNIX primary group when POSIX attributes are used for identity integration. It is part of the schema extensions for UNIX interoperability, not a Windows permission mechanism.

Question 33Directory Services and Account Management

Which action best protects against the risk of orphaned SIDs appearing in access control lists after an employee leaves?

  1. Move the account to a quarantine OU without changing its status.
  2. Disable the account and review group memberships and ACLs before eventual deletion. Correct answer.
  3. Delete the account immediately on the last day of employment.
  4. Rename the account to a generic name and reuse it for the next hire.

Explanation

Disabling first preserves the SID so existing ACL entries remain resolvable while administrators review and clean up memberships and permissions. Deleting immediately leaves unresolved SIDs in ACLs that are difficult to audit.

Question 34Directory Services and Account Management

Which statement accurately describes how a fine-grained password policy differs from the domain password policy in its application?

  1. It can be linked to a global security group or a user object and applies to those subjects. Correct answer.
  2. It applies to all users in the domain and overrides the default policy.
  3. It replaces the need for account lockout settings entirely.
  4. It only applies to computer accounts and service accounts.

Explanation

Fine-grained password policies are applied through password settings objects linked to users or global security groups, allowing different password rules for different populations. The domain password policy remains the default for anyone not covered by a PSO.

Question 35Directory Services and Account Management

A user's account was locked out after several failed sign-in attempts. Which action restores access while preserving the account's existing configuration?

  1. Unlock the account in the directory. Correct answer.
  2. Reset the user's password.
  3. Disable and then re-enable the account.
  4. Delete and recreate the user object.

Explanation

An account lockout is a temporary state triggered by the lockout threshold, and unlocking clears that state without altering the password or other settings. Resetting the password is a separate action that changes credentials.

Question 36Directory Services and Account Management

An organization wants a single account to run a scheduled task on several servers without storing an interactive password. Which account type is designed for this scenario?

  1. A standard user account with a long password
  2. A local account created on each server
  3. A shared administrator account
  4. A group managed service account Correct answer.

Explanation

A group managed service account has its password managed and rotated automatically by the domain and can be used by services across multiple hosts without manual password handling. This reduces the risk of stale or shared credentials.

Question 37Directory Services and Account Management

Which outcome results from adding a user to a global group that is itself a member of a domain local group that holds permissions on a file share?

  1. The user receives permissions only after a domain controller restart.
  2. The user inherits the permissions granted to the domain local group through nesting. Correct answer.
  3. The user must be added directly to the domain local group for access to apply.
  4. The user's access token is unaffected because global groups cannot be nested.

Explanation

Group nesting means permissions flow through the chain: the user is a member of the global group, which is a member of the domain local group that carries the resource permission. The user's access token includes the nested group SIDs, so access applies without direct membership.

Question 38Directory Services and Account Management

An administrator needs to identify all accounts in the domain whose passwords have not changed in over a year. Which attribute is most directly useful for this review?

  1. pwdLastSet Correct answer.
  2. userAccountControl
  3. lastLogonTimestamp
  4. accountExpires

Explanation

The pwdLastSet attribute records when the password was last set, making it the direct indicator of password age. Reviewing it supports compliance checks and forced rotation for stale credentials.

Question 39Directory Services and Account Management

What is the effect of setting the userAccountControl flag that marks a password as never expiring on an individual account?

  1. The account can no longer be locked out.
  2. The account is exempt from all password complexity requirements.
  3. The account is exempt from the domain maximum password age. Correct answer.
  4. The account bypasses account expiration settings.

Explanation

The password-never-expires flag exempts just that account from the domain's maximum password age, so the password does not have to be changed on a schedule. It does not affect complexity rules, lockout, or account expiration.

Question 40Directory Services and Account Management

A junior administrator accidentally moves a user object to a different OU within the same domain. What is the immediate effect on the user's group memberships and resource access?

  1. The user's SID changes, requiring ACL updates.
  2. The user account is disabled until moved back.
  3. Group memberships are retained, but Group Policy settings applied by OU may change. Correct answer.
  4. All group memberships are removed and must be reassigned.

Explanation

Moving an object within a domain preserves its SID and group memberships, so existing permission assignments continue to apply. However, Group Policy is linked to OU structure, so policy settings and any delegated permissions scoped to the old OU may change.

Question 41Network Configuration and Services

On a Cisco IOS device, which command correctly configures a static default route toward next-hop 192.168.1.1?

  1. ip route 255.255.255.255 0.0.0.0 192.168.1.1
  2. ip default-network 192.168.1.1
  3. ip route 0.0.0.0 0.0.0.0 192.168.1.1 Correct answer.
  4. ip route 0.0.0.0 255.255.255.255 192.168.1.1

Explanation

A default static route uses the network 0.0.0.0 with mask 0.0.0.0 followed by the next-hop address. Only that combination matches every destination and is installed as the gateway of last resort. The full mask 255.255.255.255 would match only the host address 0.0.0.0.

Question 42Network Configuration and Services

A VLAN interface on a Layer 3 switch shows status up/line protocol down. What is the most likely cause?

  1. The switch lacks a default route
  2. The SVI IP address is in the wrong subnet
  3. No physical port in that VLAN is up Correct answer.
  4. STP has placed the SVI in blocking state

Explanation

A switched virtual interface stays in a down line-protocol state until at least one access port assigned to that VLAN is up and forwarding. This is standard behavior on Catalyst platforms and is a common troubleshooting point.

Question 43Network Configuration and Services

Which statement correctly describes the purpose of a DHCP relay agent on a router?

  1. It assigns IP addresses to clients directly from its own pool
  2. It forwards broadcast DHCP requests as unicast to a server on another subnet Correct answer.
  3. It converts DHCP to BOOTP for legacy clients
  4. It authenticates DHCP clients before leases are granted

Explanation

The ip helper-address command converts client broadcasts into unicast packets destined for a remote DHCP server and inserts the incoming interface address as the giaddr so the server can select the right pool. Without it, DHCP broadcasts would not cross router boundaries.

Question 44Network Configuration and Services

A network engineer wants to summarize the four subnets 10.1.4.0/24, 10.1.5.0/24, 10.1.6.0/24, and 10.1.7.0/24 into a single route. Which summary is most specific?

  1. 10.1.4.0/22 Correct answer.
  2. 10.1.0.0/20
  3. 10.1.4.0/23
  4. 10.1.0.0/16

Explanation

The four /24 networks share the first 22 bits, so 10.1.4.0/22 covers exactly those ranges. A /23 would only cover two of the four subnets, and a /20 or /16 would include additional addresses outside the intended range.

Question 45Network Configuration and Services

Which OSPF network type elects a DR and BDR without any manual configuration on an Ethernet interface?

  1. Point-to-multipoint
  2. Point-to-point
  3. Non-broadcast
  4. Broadcast Correct answer.

Explanation

The broadcast network type is the default on Ethernet and other multi-access interfaces, and it uses multicast hellos plus DR/BDR election. Point-to-point and point-to-multipoint types do not elect a DR, and non-broadcast requires manual neighbor statements.

Question 46Network Configuration and Services

Which command verifies that a Cisco router has learned a specific route via EIGRP?

  1. show ip eigrp neighbors
  2. show ip route eigrp Correct answer.
  3. show ip protocols
  4. show ip eigrp topology

Explanation

show ip route eigrp filters the routing table to display only routes installed by EIGRP, confirming the prefix, next hop, and metric. The other commands show topology or neighbor state but not the installed routing table entries.

Question 47Network Configuration and Services

Which statement about HSRP and VRRP is accurate?

  1. HSRP is an open standard while VRRP is Cisco proprietary
  2. VRRP uses an IP protocol number and permits the virtual IP to equal a real interface IP Correct answer.
  3. HSRP uses multicast 224.0.0.2 and VRRP uses 224.0.0.18
  4. Both protocols require the virtual MAC to be manually configured

Explanation

VRRP is an open standard carried directly over IP protocol 112 and allows the virtual address to match a physical interface address. HSRP is Cisco proprietary, runs over UDP 1985, and uses multicast 224.0.0.2, while VRRP uses 224.0.0.18.

Question 48Network Configuration and Services

Which NAT configuration allows many internal hosts to share a single public address using port translation?

  1. ip nat inside source list 1 interface GigabitEthernet0/0 overload Correct answer.
  2. ip nat outside source list 1 interface GigabitEthernet0/0
  3. ip nat pool PUBLIC 203.0.113.1 203.0.113.1 netmask 255.255.255.0
  4. ip nat inside source static 10.0.0.1 203.0.113.5

Explanation

The overload keyword enables PAT, translating many inside local addresses to the single interface address using unique source ports. The static form maps one host to one address, and the pool command alone does not perform translation without a matching ip nat inside source statement.

Question 49Network Configuration and Services

A trunk between two switches is passing native VLAN traffic untagged, but the native VLANs on each side are mismatched. What is the primary risk?

  1. STP disabled on the trunk
  2. VLAN hopping between the mismatched native VLANs Correct answer.
  3. Duplicate MAC address table entries
  4. Loss of the trunk entirely

Explanation

When native VLANs differ, untagged frames from one side are placed into the other side's native VLAN, allowing traffic to hop between VLANs. Cisco IOS also raises the native VLAN mismatch syslog message. The trunk itself remains up, so the issue is a security and segmentation risk rather than a link failure.

Question 50Network Configuration and Services

Which command enables IPv6 routing on a Cisco router?

  1. ipv6 routing enable
  2. ipv6 unicast-routing Correct answer.
  3. ip routing ipv6
  4. ipv6 cef

Explanation

The global command ipv6 unicast-routing enables IPv6 forwarding and allows the router to advertise prefixes and install IPv6 routes. Without it, IPv6 addresses can be configured but packets are not routed between interfaces.