The five questions
1. Refer to the exhibit. Branch BR1 is allocated 172.16.40.0/24. The addressing plan must: - provide six department subnets - support at least 25 hosts in each - use one subnet size throughout - leave unused blocks for growth Which subnet must the fourth department receive?
- A. 172.16.40.96/27
- B. 172.16.40.96/28
- C. 172.16.40.128/27
- D. 172.16.40.192/26
Correct answer: A.
A /27 yields 30 usable host addresses, which covers the 25-host requirement, and a /24 divides into eight equal /27 blocks, so six departments are served and two blocks stay free for growth. Counting from 172.16.40.0/27, the blocks are .0, .32, .64, and .96, so the fourth department receives 172.16.40.96/27.
Why the others are wrong. 172.16.40.96/28 is on a valid boundary but offers only 14 usable addresses, short of the 25-host requirement. 172.16.40.128/27 is the fifth /27 block, not the fourth, so it would leave a gap at .96. 172.16.40.192/26 uses a /26, and only four /26 blocks fit in a /24, which cannot supply six equal department subnets at all, let alone spare blocks for growth.
2. Refer to the exhibit. An architect must harden spanning tree. The design must ensure that: - host ports forward immediately and shut down if a BPDU arrives - the distribution downlinks never accept a superior BPDU. Which two placements meet these requirements? (Choose two.)
- A. Enable PortFast with BPDU guard on the Acc-1 and Acc-2 host ports.
- B. Enable root guard on the Dist-1 and Dist-2 downlinks toward the access switches.
- C. Enable root guard on the Acc-1 and Acc-2 uplinks toward the distribution switches.
- D. Enable loop guard on the Acc-1 and Acc-2 host ports facing PCs and phones.
- E. Enable BPDU filter on the Dist-1 and Dist-2 downlinks toward the access switches.
Correct answer: A.
PortFast moves a host port straight to forwarding, and BPDU guard err-disables that port the instant a BPDU appears, so a switch plugged into a user outlet is removed from the topology. Root guard belongs on the distribution ports that face downstream: if a switch below sends a superior BPDU, the port goes to root-inconsistent and the root stays in the distribution layer.
Why the others are wrong. Root guard on the access uplinks would block the legitimate path to the real root, because the distribution switches are exactly where the superior BPDUs are supposed to come from. Loop guard acts on non-designated ports that stop receiving expected BPDUs; a host port never receives BPDUs at all, so it does nothing there and would leave the port open to a rogue switch. BPDU filter on the distribution downlinks stops BPDUs being sent and processed on those links, which hides the access switches from spanning tree entirely and invites the loop the design is trying to prevent.
3. Drag and drop the Metro Ethernet terms on the left onto the descriptions on the right. Not all terms are used.
Correct answer: A.
MEF terminology separates the interface from the service: the UNI is the physical demarcation, and the EVC is the logical service that associates two or more UNIs. E-LMI, standardized as MEF 16, runs across the UNI so the CE learns whether a provisioned EVC is active and which attributes, such as the CE-VLAN mapping, the carrier has assigned. E-Tree is the rooted multipoint service type, with root and leaf UNIs.
Why the others are wrong. ENNI is the external network-to-network interface between two carriers, not anything the subscriber attaches to, so it never matches a subscriber-facing demarcation. EPL is a service type, an all-to-one bundled point-to-point Ethernet Private Line that uses the whole UNI for one EVC, so it describes a specific product rather than the interface, the service association, the signaling protocol, or the rooted multipoint model.
4. Drag and drop the steps of an end-to-end QoS design into the order in which an architect carries them out.
Correct answer: A.
An end-to-end QoS design begins with an application audit, because the number of classes and their service levels come from what the network actually carries. The class model and its markings are defined next, marking is implemented at the access edge where the trust boundary sits, the scheduling tools are applied at congestion points such as the WAN edge, and the deployed policy is then measured and tuned.
Why the others are wrong. Reversing any of these steps breaks the design: choosing a class model before the audit fixes the class count before the requirements are known, applying queuing before marking leaves the schedulers with nothing to match on, and tuning bandwidth allocations before the policy is deployed produces numbers with no measurement behind them.
5. A retail chain receives 2001:db8:4a00::/40 from its provider for 180 stores. Each store has up to 12 VLANs, uses SLAAC for clients, and must be summarized as a single prefix at the WAN edge. Which allocation meets the requirements?
- A. Assign a /48 to each store and a /64 to each VLAN
- B. Assign a /44 to each store and a /48 to each VLAN
- C. Assign a /64 to each store and a /112 to each VLAN
- D. Assign a /52 to each store and a /68 to each VLAN
Correct answer: A.
A /40 contains 256 /48 blocks, which covers 180 stores with room to grow, and each store prefix summarizes as one /48 at the WAN edge. Inside a /48 there are 65,536 /64 blocks, far more than the 12 VLANs a store needs, and a /64 per VLAN is what SLAAC requires.
Why the others are wrong. A /44 per store would give only 16 stores out of a /40, which is nowhere near 180. A /64 per store leaves no room to subnet a site at all, and a /112 VLAN prefix breaks SLAAC, which needs a 64-bit interface identifier. A /52 per store does supply enough sites, but a /68 VLAN prefix is longer than /64 and likewise stops stateless autoconfiguration from working.
6. Refer to the exhibit. VLAN 10 must have a redundant default gateway for both IPv4 and IPv6, and the redundancy protocol must authenticate its hello packets so that a rogue switch cannot claim the gateway role. Which protocol meets these requirements?
- A. HSRP version 1
- B. HSRP version 2
- C. VRRP version 3
- D. VRRP version 2
Correct answer: B.
HSRP version 2 is the only choice here that provides a redundant gateway for IPv6 as well as IPv4 and still carries an authentication field, so MD5 key-string or key-chain authentication can reject hellos from an untrusted switch. That combination of IPv6 support plus authenticated hellos is exactly what the requirement states.
Why the others are wrong. HSRP version 1 is IPv4-only and limited to groups 0 through 255, so it cannot provide the IPv6 gateway at all. VRRP version 3 does add IPv6 support, but RFC 5798 deliberately removed the authentication fields that VRRP version 2 had, so it cannot authenticate its advertisements. VRRP version 2 is IPv4-only and its plain-text authentication was deprecated as offering no real protection.
7. Refer to the exhibit. A retailer joins two sites through a provider. The design must ensure that: - both sites stay in the same VLANs and IP subnets - R1 and R2 remain routing peers of each other - the provider learns no customer prefix. Which WAN service meets these requirements?
- A. A point-to-point Layer 2 VPN pseudowire between the two sites
- B. An MPLS Layer 3 VPN with eBGP running between CE and PE
- C. An MPLS Layer 3 VPN with OSPF running between CE and PE
- D. An Internet-based DMVPN Phase 3 overlay between the sites
Correct answer: A.
A point-to-point Layer 2 VPN, delivered as an Ethernet-over-MPLS pseudowire, carries the customer frames between the two UNIs unchanged, so VLANs 10 to 40 and their subnets span both sites. Because the handoff is a Layer 2 circuit, R1 and R2 see each other as directly connected neighbors and form the routing adjacency themselves. The provider switches on labels and never installs a customer route.
Why the others are wrong. An MPLS Layer 3 VPN with eBGP CE-PE peering terminates the Layer 2 domain at the PE: each site becomes a separate IP subnet, the VLANs cannot be extended, and the provider does hold the customer prefixes in a VRF, which the third requirement forbids. The same objection applies to an MPLS Layer 3 VPN with OSPF as the PE-CE protocol; only the routing protocol on the access circuit changes, not the Layer 3 handoff. A DMVPN Phase 3 overlay is a routed IPsec/mGRE tunnel over an IP transport, so it also breaks the shared VLAN and subnet, and it adds encryption and hub state the requirements never ask for.
8. An architect must support a videoconferencing application that signals the network before every session. The design must: - let the application request a specific type of service - reserve resources on each hop along the path - refuse the session when the path cannot supply them Which QoS model meets these requirements?
- A. IntServ signaled with RSVP along the path
- B. DiffServ with DSCP marking at the network edge
- C. DiffServ with class-based weighted fair queuing
- D. Best-effort forwarding with weighted random early detection
Correct answer: A.
IntServ is the only QoS model in which an application asks the network for a specific type of service and receives a guarantee. RSVP carries that request hop by hop, each device performs admission control, and the reservation is refused when a hop cannot supply the requested bandwidth.
Why the others are wrong. DiffServ with DSCP marking gives each packet a per-hop behavior chosen from its marking, but nothing is signaled and nothing is guaranteed to an individual flow. Class-based weighted fair queuing is a DiffServ queuing tool that divides bandwidth among classes rather than reserving it for a flow, and it has no admission control. Best-effort forwarding with WRED only manages queue depth for TCP flows and offers no reservation of any kind.
