I85PREP
⌘ K
NetSec Professional study materials
NetSec Professional study resources

NetSec Professional practice questions

One question at a time. Build your NetSec Professional understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Firewall Configuration, Routing, and Network Interfaces

A firewall is deployed with a default-deny inbound policy. How does the firewall handle inbound traffic that matches no configured rule?

  1. It is forwarded to the DMZ for inspection.
  2. It is permitted if it uses a well-known destination port.
  3. It is discarded and typically logged. Correct answer.
  4. It is permitted unless a later rule explicitly blocks it.

Explanation

A default-deny policy means the implicit final rule drops any packet that has not matched an earlier permit rule. This posture fails closed, which protects the network when new services appear or rules are misconfigured.

Question 2Firewall Configuration, Routing, and Network Interfaces

A host configured with 10.1.1.50/24 and default gateway 10.1.1.1 must send a packet to 10.1.1.200. What does the host do?

  1. It resolves the destination MAC with ARP and sends the frame directly to that host. Correct answer.
  2. It drops the packet because the destination is on a remote subnet.
  3. It queries DNS to resolve the destination before sending.
  4. It forwards the packet to its default gateway.

Explanation

The host applies its /24 mask and finds 10.1.1.200 inside the same 10.1.1.0/24 subnet, so the destination is on-link. On-link destinations are reached by ARP and direct Layer 2 delivery; the default gateway is used only for off-link destinations.

Question 3Firewall Configuration, Routing, and Network Interfaces

A stateful firewall permits an outbound TCP connection from an internal client to an external web server. How is the return traffic from the server treated?

  1. It is allowed only if the client uses a fixed source port.
  2. It is dropped because inbound sessions are not permitted.
  3. It must match a separate inbound permit rule.
  4. It is allowed because it matches an existing entry in the state table. Correct answer.

Explanation

A stateful firewall records each permitted session in a state table and automatically admits return packets that belong to that session. This removes the need for inbound rules covering the ephemeral ports clients use as source ports.

Question 4Firewall Configuration, Routing, and Network Interfaces

How many usable host addresses are available in the subnet 192.168.10.0/26?

  1. 126
  2. 30
  3. 64
  4. 62 Correct answer.

Explanation

A /26 leaves 6 host bits, giving 2^6 = 64 addresses. The network and broadcast addresses cannot be assigned to hosts, leaving 62 usable addresses.

Question 5Firewall Configuration, Routing, and Network Interfaces

Which technology lets a single physical link carry traffic for multiple VLANs between a switch and a firewall?

  1. Port mirroring
  2. Spanning Tree Protocol
  3. 802.1Q VLAN tagging Correct answer.
  4. Link aggregation with LACP

Explanation

802.1Q inserts a 4-byte tag into the Ethernet frame identifying the VLAN, so one trunk link can carry several VLANs to a firewall or another switch. The receiving device strips the tag and forwards the frame into the correct VLAN.

Question 6Firewall Configuration, Routing, and Network Interfaces

Two routes to 10.20.0.0/16 exist: one learned through OSPF and one configured as a static route. Using default administrative distances, which route is installed in the routing table?

  1. The static route Correct answer.
  2. The OSPF route
  3. Both, load-balanced equally
  4. Neither, until the metrics are compared

Explanation

Cisco-style routers compare administrative distance before metric. A static route has an administrative distance of 1 and OSPF defaults to 110, so the static route wins and the OSPF route stays out of the table.

Question 7Firewall Configuration, Routing, and Network Interfaces

Which command installs a default route with next hop 203.0.113.1 on a router?

  1. ip route 0.0.0.0 255.255.255.255 203.0.113.1
  2. ip route 0.0.0.0 0.0.0.0 203.0.113.1 Correct answer.
  3. ip route 203.0.113.1 0.0.0.0 default
  4. ip default-gateway 203.0.113.1

Explanation

A default route is a static route to prefix 0.0.0.0 with mask 0.0.0.0, matching any destination that no more specific route covers. The next-hop address follows the mask in the command syntax.

Question 8Firewall Configuration, Routing, and Network Interfaces

Clients on 10.5.5.0/24 must obtain addresses from a DHCP server at 10.9.9.10 on another subnet. What must be configured on the router interface facing the clients?

  1. Proxy ARP enabled on the interface
  2. A secondary IP address in the server's subnet
  3. A NAT rule translating UDP port 67
  4. An IP helper address pointing to the DHCP server Correct answer.

Explanation

DHCP Discover messages are broadcasts, and routers do not forward broadcasts, so the client-facing interface needs an IP helper address that relays them as unicast to the DHCP server. The relay also inserts the gateway address so the server selects the correct address pool.

Question 9Firewall Configuration, Routing, and Network Interfaces

A router's table contains 0.0.0.0/0 via A, 10.0.0.0/8 via B, 10.1.0.0/16 via C and 10.1.5.0/24 via D. Where is a packet destined for 10.1.5.77 forwarded?

  1. To next hop C
  2. To next hop D Correct answer.
  3. To next hop A
  4. To next hop B

Explanation

Routers select the longest matching prefix regardless of metric or administrative distance. The 10.1.5.0/24 entry is a /24 match and is more specific than the /16, /8 and /0 entries that also match the destination.

Question 10Firewall Configuration, Routing, and Network Interfaces

An internal web server at 172.16.5.20 is published to the internet as 198.51.100.80. Which translation is required?

  1. Dynamic NAT using a public address pool
  2. Source NAT with the server as the translation source
  3. Destination NAT translating 198.51.100.80 to 172.16.5.20 Correct answer.
  4. Port address translation for the internal clients

Explanation

Publishing an internal server requires destination NAT, often combined with port forwarding: the firewall rewrites the destination of inbound packets from the public address to the server's private address and reverses the translation on the return path.

Question 11Firewall Configuration, Routing, and Network Interfaces

A firewall evaluates rules top-down and stops at the first match. A permit rule for 10.0.0.0/8 to any sits above a deny rule for 10.0.0.5 to the web server. What happens to traffic from 10.0.0.5 to that server?

  1. Denied, because the deny rule is more specific
  2. Permitted, because the first matching rule decides Correct answer.
  3. Denied, because deny rules are always evaluated first
  4. Logged and dropped by the implicit deny

Explanation

Most rule-based firewalls evaluate top-down and stop at the first match, so rule order determines the outcome. A broader permit placed above a narrower deny makes that deny unreachable for the matching traffic.

Question 12Firewall Configuration, Routing, and Network Interfaces

An ACL entry must match every address in 192.168.16.0/20. Which wildcard mask pairs with the network address 192.168.16.0?

  1. 0.0.31.255
  2. 0.0.15.255 Correct answer.
  3. 0.0.240.255
  4. 0.0.0.255

Explanation

A /20 mask is 255.255.240.0, and the wildcard is its bitwise inverse, 0.0.15.255. That wildcard matches 192.168.16.0 through 192.168.31.255.

Question 13Firewall Configuration, Routing, and Network Interfaces

A stateful firewall drops TCP packets coming back from a server that clients can reach. The return path bypasses the firewall through a second router. What is the most likely cause?

  1. The firewall's NAT address pool is exhausted
  2. Asymmetric routing, leaving no state entry for the replies Correct answer.
  3. The server's TCP window size is set too small
  4. The client and server sit on the same VLAN

Explanation

Stateful inspection requires both directions of a flow to traverse the same firewall. When replies take a different path, the firewall receives packets with no matching session and drops them as out of state.

Question 14Firewall Configuration, Routing, and Network Interfaces

Which design places a public-facing web server where it can be reached from the internet while limiting exposure of the internal LAN?

  1. Web server dual-homed to the internet and LAN with no filtering
  2. Web server behind the core switch with no firewall inspection
  3. Web server on the internal LAN with a permit-any inbound rule
  4. Web server in a DMZ zone with rules permitting only the required flows Correct answer.

Explanation

A DMZ isolates internet-facing hosts on their own interface or zone so a compromise does not give direct access to the internal LAN. Rules normally permit inbound service traffic to the server, return traffic via state, and only the specific server-to-internal flows that are required.

Question 15Firewall Configuration, Routing, and Network Interfaces

In a zone-based firewall, what must exist before traffic can pass between two zones?

  1. A static NAT entry must exist for every host
  2. The two zones must share an IP subnet
  3. Both interfaces must be members of the same VLAN
  4. A zone pair with a policy that permits the traffic Correct answer.

Explanation

Zone-based firewalls assign interfaces to zones and control inter-zone traffic through zone-pair policies. Without a zone pair and a policy permitting the flow, traffic between the zones is dropped.

Question 16Firewall Configuration, Routing, and Network Interfaces

Which rule set best restricts inbound access to a web server while still allowing normal client connections?

  1. Permit TCP sourced from server port 80 to any destination
  2. Permit TCP ports 80 and 443 to the server in both directions
  3. Permit all TCP traffic from any source to the server
  4. Permit TCP to port 443 on the server and let stateful inspection allow replies Correct answer.

Explanation

Inbound access to a web server needs a rule allowing new connections to the service port, after which the stateful engine admits the server's replies. Overly broad rules or static bidirectional permits expand the attack surface unnecessarily.

Question 17Firewall Configuration, Routing, and Network Interfaces

A firewall interface reports late collisions and CRC errors that rise with load. The switch port is hard-coded to 100 Mb/s full duplex while the firewall interface is set to auto-negotiate. What is the likely explanation?

  1. The MAC address table on the switch is full
  2. The interface MTU is configured too high
  3. The copper cable is shorter than the minimum length
  4. A duplex mismatch between the two ends Correct answer.

Explanation

When one side is hard-coded to full duplex and the other auto-negotiates, the auto side commonly falls back to half duplex, producing late collisions, CRC errors and poor throughput under load. Both ends should be configured identically, ideally both to auto-negotiate.

Question 18Firewall Configuration, Routing, and Network Interfaces

An IPsec tunnel adds overhead, and packets larger than the path MTU are being dropped. What is the most appropriate fix on the routers and firewalls?

  1. Clamp TCP MSS and/or lower the tunnel MTU so packets fit Correct answer.
  2. Increase the LAN interface MTU to 9000
  3. Disable ICMP on the tunnel interface
  4. Enable proxy ARP on the tunnel interface

Explanation

Encapsulation adds headers, so packets sized for the LAN exceed the tunnel path MTU and are dropped when fragmentation is not permitted. Lowering the tunnel MTU and clamping the TCP maximum segment size keeps segments small enough to pass through the tunnel.

Question 19Firewall Configuration, Routing, and Network Interfaces

The contiguous networks 10.1.0.0/24 through 10.1.7.0/24 must be advertised as a single summary. Which summary covers exactly those networks?

  1. 10.1.0.0/24
  2. 10.1.0.0/21 Correct answer.
  3. 10.1.0.0/22
  4. 10.1.0.0/20

Explanation

The range 10.1.0.0 through 10.1.7.255 spans eight /24 blocks, which is 2^3, so three bits are removed from the prefix: 24 - 3 = 21. The resulting 10.1.0.0/21 with mask 255.255.248.0 covers exactly that range.

Question 20Firewall Configuration, Routing, and Network Interfaces

Which technique best prevents packets carrying forged internal source addresses from entering through an internet-facing interface?

  1. Dynamic ARP inspection
  2. Port security on the access switch
  3. Ingress filtering that drops internal source addresses arriving from outside Correct answer.
  4. DHCP snooping

Explanation

Spoofed packets with internal source addresses should never arrive on an internet-facing interface, so ingress filtering such as bogon and RFC 1918 filtering, or unicast RPF, drops them early. This blocks spoofing-based reflection and bypass attempts.

Question 21Firewall Configuration, Routing, and Network Interfaces

Internal users must reach an internal server through its public IP address, which the firewall destination-NATs. What must the firewall support for this to work?

  1. Proxy ARP for the public address
  2. NAT hairpinning (reflection) on the firewall Correct answer.
  3. A static route added to the internal clients
  4. Split-horizon DNS with no NAT change

Explanation

When internal clients use the public address, the packet arrives on the inside interface already destined to the translated public IP. Hairpinning, also called NAT reflection or loopback, lets the firewall apply the destination translation and send the traffic back out the same internal interface.

Question 22Firewall Configuration, Routing, and Network Interfaces

Traffic from one specific subnet must exit through ISP B, even though the routing table's best path for all destinations is ISP A. Which feature accomplishes this?

  1. A floating static route with administrative distance 250
  2. Raising the OSPF cost on the ISP A link
  3. Policy-based routing matching the source subnet Correct answer.
  4. Route redistribution between the two ISPs

Explanation

Policy-based routing matches attributes such as the source address and overrides the normal destination-based forwarding decision, so selected traffic can be steered to ISP B. Ordinary routing-table changes would affect all traffic rather than just that subnet.

Question 23Firewall Configuration, Routing, and Network Interfaces

A secondary link must carry traffic only when the primary OSPF path fails. Which configuration achieves this?

  1. A static route configured with the default administrative distance
  2. A second OSPF route with a lower cost
  3. A static route with an administrative distance higher than the OSPF route Correct answer.
  4. Removing the OSPF route from the routing table

Explanation

A floating static route is assigned an administrative distance higher than the dynamic protocol's distance, so it stays out of the routing table while the dynamic route exists. It is installed only after the dynamic route disappears.

Question 24Firewall Configuration, Routing, and Network Interfaces

IPv6 hosts on a segment fail to configure a default gateway automatically even though a router is attached to the link. Which is the most likely cause?

  1. DHCPv6 is disabled on the router
  2. Router Advertisements are suppressed on the interface Correct answer.
  3. The hosts are using EUI-64 interface identifiers
  4. The link MTU is set below 1280 bytes

Explanation

IPv6 hosts learn their default gateway from Router Advertisement messages, which supply the router's link-local address or an explicitly advertised router address. If RAs are suppressed or filtered, hosts cannot autoconfigure a default route even with a router present.

Question 25Firewall Configuration, Routing, and Network Interfaces

Strict unicast RPF is enabled on a router that has two internet links carrying traffic over asymmetric paths. What is the likely effect?

  1. All traffic is dropped because RPF requires a default route
  2. Only multicast traffic is affected
  3. Nothing changes because RPF examines the destination address
  4. Legitimate return traffic arriving on the non-preferred link is dropped Correct answer.

Explanation

Strict unicast RPF verifies that the packet's source is reachable through the interface it arrived on. With asymmetric paths the reverse route points to a different link, so valid packets are discarded; loose mode, which only checks that a route to the source exists, is used on multi-homed links.

Question 26Firewall Configuration, Routing, and Network Interfaces

Multiple internal hosts must share a single public IPv4 address for internet access. Which translation method accomplishes this?

  1. Policy NAT with one-to-one mappings
  2. Static one-to-one NAT
  3. Destination NAT with port forwarding
  4. Port address translation with overload Correct answer.

Explanation

Port address translation, also called NAT overload, multiplexes many internal sessions onto one public address by translating the source port as well as the source address, so each flow is uniquely identified. Static or one-to-one mappings consume a public address per host. Destination NAT rewrites inbound connections and does not provide outbound address sharing.

Question 27Firewall Configuration, Routing, and Network Interfaces

A router ACL reaches its end with no explicit deny statement. What happens to traffic that matches no entry?

  1. It is logged and then permitted
  2. It is dropped by an implicit deny Correct answer.
  3. It is forwarded to the default gateway
  4. It is permitted by default

Explanation

Every ACL ends with an implicit deny-any. Packets that match no configured entry therefore hit that final deny and are discarded. A permit entry must be added explicitly to allow any other traffic.

Question 28Firewall Configuration, Routing, and Network Interfaces

Where should a standard ACL that filters traffic from a specific source be placed?

  1. Only on the internet-facing interface
  2. As close to the destination as possible Correct answer.
  3. As close to the source as possible
  4. On every router along the path

Explanation

Standard ACLs match only the source address, so placing them near the source would block that host's traffic to every destination. Placing them near the destination keeps the filter close to the resource being protected. Extended ACLs, which match source and destination, are normally placed near the source.

Question 29Firewall Configuration, Routing, and Network Interfaces

Which wildcard mask matches exactly the addresses in 192.168.10.64/26?

  1. 0.0.0.63 Correct answer.
  2. 0.0.0.255
  3. 0.0.0.127
  4. 0.0.0.31

Explanation

A /26 leaves six host bits, so the wildcard is 0.0.0.63. Adding 63 to the network address 192.168.10.64 gives the top of the range, 192.168.10.127.

Question 30Firewall Configuration, Routing, and Network Interfaces

What administrative distance does a directly connected route have by default?

  1. 110
  2. 90
  3. 1
  4. 0 Correct answer.

Explanation

Directly connected routes are the most trusted source and carry an administrative distance of 0. Static routes default to 1, internal EIGRP to 90, and OSPF to 110.

Question 31Firewall Configuration, Routing, and Network Interfaces

Which characteristic makes a loopback interface useful for management and routing protocol stability?

  1. It carries the default route
  2. It stays up as long as the router is running Correct answer.
  3. It is active only while a physical link is up
  4. It must be configured with a /30 mask

Explanation

A loopback is a logical interface that remains up whenever the router is operational, independent of any physical link state. That stability makes it suitable for management access and for router-ID or peering addresses.

Question 32Firewall Configuration, Routing, and Network Interfaces

On a firewall that assigns security levels to interfaces, which direction is permitted by default?

  1. From a higher security level to a lower one Correct answer.
  2. Between two interfaces with equal security levels
  3. Only traffic destined to the firewall itself
  4. From a lower security level to a higher one

Explanation

Traffic flowing from a higher security level (for example, inside) to a lower level (for example, outside) is permitted by default. The reverse direction requires an explicit policy. Traffic between equal-level interfaces also needs explicit permission on most platforms.

Question 33Firewall Configuration, Routing, and Network Interfaces

A router must route between two VLANs carried over one physical link. What must be configured?

  1. One subinterface with two IP addresses
  2. One loopback per VLAN
  3. One 802.1Q subinterface per VLAN Correct answer.
  4. One tunnel interface per VLAN

Explanation

This is the router-on-a-stick design: the physical interface carries a trunk, and each VLAN gets a subinterface with 802.1Q encapsulation and its own IP address. Each subinterface acts as the default gateway for its VLAN.

Question 34Firewall Configuration, Routing, and Network Interfaces

Traffic between two sites must cross an IPsec tunnel without being translated by the internet NAT rule. What is the correct configuration?

  1. A destination NAT rule for the remote subnet
  2. A higher-metric static route to the remote subnet
  3. An ACL denying the traffic on the outside interface
  4. A NAT exemption rule for the site-to-site traffic Correct answer.

Explanation

A NAT exemption, also called identity NAT, matches the site-to-site traffic and passes it untranslated so the addresses in the IPsec selectors remain intact. The exemption must be evaluated before the general internet NAT rule. Routing changes and deny ACLs do not stop the translation.

Question 35Firewall Configuration, Routing, and Network Interfaces

An internal server at 10.0.0.50 listens on TCP 8080, and internet users must reach it at the public address on TCP 80. Which translation is needed?

  1. PAT overload on the outside interface
  2. Destination NAT translating port 80 to 8080 Correct answer.
  3. Source NAT translating port 80 to 8080
  4. Static NAT with no port change

Explanation

Port forwarding is a destination NAT rule that rewrites both the destination address and the destination port, mapping public TCP 80 to 10.0.0.50:8080. Source NAT changes the source of outbound flows and cannot redirect inbound connections.

Question 36Firewall Configuration, Routing, and Network Interfaces

TCP sessions over an IPsec tunnel stall on large transfers, but small pings succeed. Which adjustment is most appropriate?

  1. Clamp the TCP MSS on the tunnel interface Correct answer.
  2. Enable proxy ARP on the tunnel
  3. Increase the inside interface MTU
  4. Disable path MTU discovery

Explanation

The tunnel header reduces the usable payload, so full-size segments exceed the path MTU and are dropped. Clamping the TCP MSS rewrites the maximum segment size in the SYN packets so endpoints never send segments too large for the tunnel. Small ICMP packets fit, which is why pings still succeed.

Question 37Firewall Configuration, Routing, and Network Interfaces

Which single summary covers 172.16.0.0/24 through 172.16.3.0/24 without including any other subnet?

  1. 172.16.0.0/22 Correct answer.
  2. 172.16.0.0/23
  3. 172.16.0.0/21
  4. 172.16.0.0/16

Explanation

A /22 contains four /24s, 172.16.0.0 through 172.16.3.255, which is exactly the required range. A /23 covers only two of the subnets, while /21 and /16 include addresses outside the range.

Question 38Firewall Configuration, Routing, and Network Interfaces

What is the effect of marking an interface as passive in OSPF?

  1. The interface stops forwarding all IP traffic
  2. The interface forms adjacencies but sends no LSAs
  3. The interface is advertised but sends no Hellos Correct answer.
  4. The interface is removed from the routing table

Explanation

A passive interface still has its connected network included in router LSAs, so neighbors can reach it, but Hello packets are suppressed so no adjacency forms on that link. This is typical for LAN segments that face end hosts rather than other routers.

Question 39Firewall Configuration, Routing, and Network Interfaces

An OSPF router has a static default route and must advertise it to its neighbors. Which command accomplishes this?

  1. default-router 0.0.0.0
  2. network 0.0.0.0 0.0.0.0 area 0
  3. redistribute static
  4. default-information originate Correct answer.

Explanation

The default-information originate command injects 0.0.0.0/0 into OSPF when a default route exists locally, or unconditionally when the always keyword is added. Redistribution alone does not inject a default into OSPF.

Question 40Firewall Configuration, Routing, and Network Interfaces

Two OSPF routes to the same prefix have equal cost. What does a router do by default?

  1. Installs only the route with the lowest interface address
  2. Drops the prefix until the tie breaks
  3. Installs both and load-balances across them Correct answer.
  4. Installs only the oldest route

Explanation

Equal-cost paths to the same destination are installed together in the routing table, and the router load-balances across them up to the platform's maximum-path limit. This is equal-cost multipath.

Question 41Firewall Configuration, Routing, and Network Interfaces

On an Ethernet link, why is a static route that specifies only an exit interface considered poor practice?

  1. The route is rejected by the routing table
  2. The route cannot be redistributed later
  3. Each destination is ARP-resolved, adding overhead Correct answer.
  4. The route is converted to a connected route

Explanation

On a multiaccess network the router treats every destination as if it were directly attached and sends an ARP request for each one, which is inefficient and can exhaust the ARP cache. Specifying the next-hop IP address avoids this behavior.

Question 42Firewall Configuration, Routing, and Network Interfaces

In transparent mode, a firewall forwards traffic based on which information?

  1. Layer 3 addresses only
  2. Routing table entries only
  3. Layer 4 ports only
  4. Layer 2 addresses rather than IP addresses Correct answer.

Explanation

A transparent firewall acts as a Layer 2 bridge, so it forwards frames using MAC addresses and does not require IP addressing or routing on its interfaces. It can still filter on Layer 3 and Layer 4 fields through its access policies.

Question 43Firewall Configuration, Routing, and Network Interfaces

An ACL must permit HTTP only during business hours. Which feature is required?

  1. Established ACL
  2. Time-based ACL Correct answer.
  3. Dynamic ACL
  4. Reflexive ACL

Explanation

A time-based ACL references a time range, so the entry is active only during the defined periods. Reflexive and established entries address return traffic, and dynamic ACLs open access after authentication, not on a schedule.

Question 44Firewall Configuration, Routing, and Network Interfaces

Which ACL keyword records matching packets together with the input interface and source MAC address?

  1. reflexive
  2. established
  3. log-input Correct answer.
  4. count

Explanation

The log-input keyword writes a syslog message for each matching packet and includes the input interface and source MAC address in addition to the standard header fields. The plain log keyword records matches but omits that extra context.

Question 45Firewall Configuration, Routing, and Network Interfaces

An IPv6 ACL applied inbound permits only TCP 443 to one server. Clients report that the server is unreachable. Why?

  1. Neighbor discovery traffic is being denied Correct answer.
  2. The ACL must be applied outbound instead
  3. IPv6 ACLs cannot match TCP ports
  4. The clients are in a different OSPF area

Explanation

IPv6 access lists end with an implicit deny, which also drops ICMPv6 neighbor solicitation, neighbor advertisement, and router messages. Without those messages, hosts cannot resolve link-layer addresses or configure gateways, so the permitted TCP session never starts. Explicit ICMPv6 permits are required.

Question 46Firewall Configuration, Routing, and Network Interfaces

What does the established keyword on an extended ACL entry match?

  1. ICMP echo replies to the router
  2. TCP segments with the ACK or RST flag set Correct answer.
  3. UDP flows already present in the state table
  4. Any packet that has the SYN flag set

Explanation

The established keyword matches TCP segments that have the ACK or RST bit set, which is typical of return traffic from a server that the client contacted. It inspects flag bits and does not actually maintain session state.

Question 47Firewall Configuration, Routing, and Network Interfaces

A firewall translates a public address to an internal server. Which mechanism lets upstream devices on the outside segment learn the firewall's MAC address for that public IP?

  1. Proxy ARP Correct answer.
  2. 802.1Q tagging
  3. Dynamic routing
  4. DHCP relay

Explanation

The firewall answers ARP requests for the translated public address with its own outside MAC address, so upstream devices send the frames to the firewall. The firewall then translates the destination to the internal server's address.

Question 48Firewall Configuration, Routing, and Network Interfaces

Giant frames are counted on a router interface. What is the most likely cause?

  1. A failing cable on the segment
  2. A duplex mismatch with the attached switch
  3. Storm control enabled on the port
  4. Frames larger than the interface MTU from a jumbo-enabled neighbor Correct answer.

Explanation

The giants counter increments when frames exceed the configured MTU of the interface, which typically happens when the neighboring device is set for jumbo frames and the local interface is not. Aligning the MTU on both ends resolves the counter.

Question 49Firewall Configuration, Routing, and Network Interfaces

Two departments use the same 10.10.10.0/24 subnet and must remain separate on a single physical router. Which technology fits best?

  1. NAT overload
  2. VRF-lite Correct answer.
  3. Policy-based routing
  4. Multiple OSPF areas

Explanation

VRF-lite creates independent routing tables on the same router, so the overlapping subnet can exist once per VRF without conflict. Interfaces are assigned to different VRFs, and traffic between them requires explicit leaking or a shared service.

Question 50Firewall Configuration, Routing, and Network Interfaces

Traffic destined to the router itself must be controlled by a zone-based firewall. Which zone represents the router's own interfaces?

  1. The inside zone
  2. The DMZ zone
  3. The default zone
  4. The self zone Correct answer.

Explanation

The self zone represents the router or firewall device itself, including its own interfaces and management services. A policy between a zone and the self zone controls traffic that terminates on the device.