Cisco Certified Support Technician (CCST) Networking 100-150 Practice Test 87
Question 860
The technician plans a correction for: At the fictional Maplecrest Office during its network support shift, the team observes: A switch's Cisco IOS release and uptime are requested for a support case but the engineer runs show mac address-table and reports MAC entries as software versions. During “Run show version and document the platform and software version for the case.”, which precaution MOST specifically prevents a related risk?
- Do not expose a management plane to arbitrary public IP sources simply for convenience.
- Do not repair browser history in place of missing IP routing configuration.
- Do not confuse MAC table records with operating-system image information.
- Do not accuse a user or device without recorded data supporting the conclusion.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Run show version and document the platform and software version for the case.” at the fictional Maplecrest Office. The required protection is “Do not confuse MAC table records with operating-system image information.”; success still requires “The incident records a valid IOS version or system image identifier from command output.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A worker connects to a branch router's SSH service over public internet without using the corporate remote access policy. The principal adjacent risk here is controlled by “Do not confuse MAC table records with operating-system image information.”.
B:This caution is appropriate for a separate failure pattern: A Windows client has no IPv4 default gateway and a technician checks only browser cache before escalating a routing outage. The principal adjacent risk here is controlled by “Do not confuse MAC table records with operating-system image information.”.
D:This caution is appropriate for a separate failure pattern: A help desk attributes a recurring outage to 'user error' without collecting interface counters, logs or endpoint details. The principal adjacent risk here is controlled by “Do not confuse MAC table records with operating-system image information.”.
Question 861
A service desk receives this network finding: At the fictional Quarry Municipal IT before a planned system change, the team observes: A support case needs a chassis serial and switch-stack member number, but a trainee reads only interface status and invents both. Which action MOST directly resolves the reported issue?
- Run an available supported Linux traceroute-style command toward the target.
- Use show inventory for product identifiers and show switch where supported for switch-stack membership.
- Compare tests at the impacted branch, its gateway, the provider handoff and the central service.
- Compare ping to an IP with nslookup of the affected hostname and inspect the configured DNS resolver.
Explanation
Correct Answer
B:Correct. In the fictional Quarry Municipal IT case, show inventory commonly reports hardware PID and serial, while show switch on supported stack-capable Catalyst models reports stack-member roles and identities. The specified corrective action, “Use show inventory for product identifiers and show switch where supported for switch-stack membership.”, directly targets that condition. Evidence of resolution: The hardware ticket records valid serial and stack member details from the appropriate read-only commands.
Incorrect Answers
A:That action addresses a different network issue: A Linux technician tries tracert and reports the command unavailable even though the objective is to find where a path fails. The present fictional Quarry Municipal IT finding instead needs “Use show inventory for product identifiers and show switch where supported for switch-stack membership.”, verified by “The hardware ticket records valid serial and stack member details from the appropriate read-only commands.”.
C:That action addresses a different network issue: A help-desk analyst tests only from their office during a remote-site outage and concludes every remote device is healthy because local systems work. The present fictional Quarry Municipal IT finding instead needs “Use show inventory for product identifiers and show switch where supported for switch-stack membership.”, verified by “The hardware ticket records valid serial and stack member details from the appropriate read-only commands.”.
D:That action addresses a different network issue: A PC pings 8.8.8.8 successfully but cannot resolve a website name and the operator replaces its Ethernet cable. The present fictional Quarry Municipal IT finding instead needs “Use show inventory for product identifiers and show switch where supported for switch-stack membership.”, verified by “The hardware ticket records valid serial and stack member details from the appropriate read-only commands.”.
Question 862
Before changing settings, consider this issue: At the fictional Quarry Municipal IT before a planned system change, the team observes: A support case needs a chassis serial and switch-stack member number, but a trainee reads only interface status and invents both. What is the MOST specific underlying cause?
- show inventory commonly reports hardware PID and serial, while show switch on supported stack-capable Catalyst models reports stack-member roles and identities.
- RDP targets compatible desktop hosts; Cisco network-device CLI access usually uses SSH or console.
- Monitoring telemetry collection and interactive configuration sessions are distinct management functions.
- Cloud-managed network devices may be monitored and configured through their assigned management platform.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Quarry Municipal IT: show inventory commonly reports hardware PID and serial, while show switch on supported stack-capable Catalyst models reports stack-member roles and identities. The corresponding remedy is “Use show inventory for product identifiers and show switch where supported for switch-stack membership.”. Confirmation: The hardware ticket records valid serial and stack member details from the appropriate read-only commands.
Incorrect Answers
B:That cause belongs to a different case: A technician uses a Windows remote desktop tool to administer a router CLI and expects a graphical Windows session on the Cisco switch. The observed fictional Quarry Municipal IT condition is specifically explained by “show inventory commonly reports hardware PID and serial, while show switch on supported stack-capable Catalyst models reports stack-member roles and identities.”.
C:That cause belongs to a different case: A small business uses an NMS to collect interface metrics but a novice expects it to provide encrypted administrative command access to every router without SSH or appropriate control channels. The observed fictional Quarry Municipal IT condition is specifically explained by “show inventory commonly reports hardware PID and serial, while show switch on supported stack-capable Catalyst models reports stack-member roles and identities.”.
D:That cause belongs to a different case: A managed Meraki access point shows a cloud-dashboard alert but the trainee tries to repair it through an unrelated legacy local switch GUI. The observed fictional Quarry Municipal IT condition is specifically explained by “show inventory commonly reports hardware PID and serial, while show switch on supported stack-capable Catalyst models reports stack-member roles and identities.”.
Question 863
A reviewer evaluates a proposed repair for: At the fictional Quarry Municipal IT before a planned system change, the team observes: A support case needs a chassis serial and switch-stack member number, but a trainee reads only interface status and invents both. The approved corrective action is: “Use show inventory for product identifiers and show switch where supported for switch-stack membership.” Which result BEST demonstrates success?
- The procedure retrieves status from NMS and uses SSH or console only when a permitted CLI change is necessary.
- The remote session reaches the router through the approved protected path with access logs.
- The authorized technician logs in successfully while unknown accounts remain denied.
- The hardware ticket records valid serial and stack member details from the appropriate read-only commands.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Use show inventory for product identifiers and show switch where supported for switch-stack membership.” at the fictional Quarry Municipal IT. It demonstrates correction of the original cause: show inventory commonly reports hardware PID and serial, while show switch on supported stack-capable Catalyst models reports stack-member roles and identities.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Record which tasks use the monitoring platform and which require authorized device management access.”. It does not establish the intended outcome “The hardware ticket records valid serial and stack member details from the appropriate read-only commands.” for the fictional Quarry Municipal IT case.
B:That result is evidence for a separate corrective action, “Connect through the authorized VPN and least-privilege management route before opening SSH.”. It does not establish the intended outcome “The hardware ticket records valid serial and stack member details from the appropriate read-only commands.” for the fictional Quarry Municipal IT case.
C:That result is evidence for a separate corrective action, “Check SSH port reachability, authentication method and user authorization without disabling protection.”. It does not establish the intended outcome “The hardware ticket records valid serial and stack member details from the appropriate read-only commands.” for the fictional Quarry Municipal IT case.
Question 864
The technician plans a correction for: At the fictional Quarry Municipal IT before a planned system change, the team observes: A support case needs a chassis serial and switch-stack member number, but a trainee reads only interface status and invents both. During “Use show inventory for product identifiers and show switch where supported for switch-stack membership.”, which precaution MOST specifically prevents a related risk?
- Do not publish unrestricted pcap payloads in publicly accessible support systems.
- Do not require an IP route for a direct physical console connection.
- Do not assume every standalone Cisco device supports switch-stack-specific show commands.
- Do not conclude there is no network traffic from a capture on the wrong adapter.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Use show inventory for product identifiers and show switch where supported for switch-stack membership.” at the fictional Quarry Municipal IT. The required protection is “Do not assume every standalone Cisco device supports switch-stack-specific show commands.”; success still requires “The hardware ticket records valid serial and stack member details from the appropriate read-only commands.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A technician shares a full packet capture containing customer passwords and unrelated sessions in a public ticket. The principal adjacent risk here is controlled by “Do not assume every standalone Cisco device supports switch-stack-specific show commands.”.
B:This caution is appropriate for a separate failure pattern: A switch's management IP is misconfigured and remote SSH fails, but an on-site technician refuses to use its working console port. The principal adjacent risk here is controlled by “Do not assume every standalone Cisco device supports switch-stack-specific show commands.”.
D:This caution is appropriate for a separate failure pattern: A technician captures packets on a laptop's inactive Ethernet adapter and sees nothing while the issue occurs over active Wi-Fi. The principal adjacent risk here is controlled by “Do not assume every standalone Cisco device supports switch-stack-specific show commands.”.
Question 865
A service desk receives this network finding: At the fictional Kestrel Regional Office in a technician onboarding review, the team observes: A switch is missing a workstation's MAC entry and the technician runs show ip route expecting it to show learned Ethernet source locations. Which action MOST directly resolves the reported issue?
- Interpret missing intermediate hop responses in context and verify the intended end-to-end service.
- Use show mac address-table and locate the workstation's MAC on the appropriate VLAN.
- Compare tests at the impacted branch, its gateway, the provider handoff and the central service.
- Resolve the hostname and separately test the HTTPS service's TCP connection.
Explanation
Correct Answer
B:Correct. In the fictional Kestrel Regional Office case, show mac address-table is used to inspect learned Ethernet MAC addresses and associated VLAN or ports. The specified corrective action, “Use show mac address-table and locate the workstation's MAC on the appropriate VLAN.”, directly targets that condition. Evidence of resolution: The table shows the relevant MAC and associated switch interface.
Incorrect Answers
A:That action addresses a different network issue: A traceroute stops showing hops after a firewall, but the browser can still load the destination over HTTPS. The present fictional Kestrel Regional Office finding instead needs “Use show mac address-table and locate the workstation's MAC on the appropriate VLAN.”, verified by “The table shows the relevant MAC and associated switch interface.”.
C:That action addresses a different network issue: A help-desk analyst tests only from their office during a remote-site outage and concludes every remote device is healthy because local systems work. The present fictional Kestrel Regional Office finding instead needs “Use show mac address-table and locate the workstation's MAC on the appropriate VLAN.”, verified by “The table shows the relevant MAC and associated switch interface.”.
D:That action addresses a different network issue: A technician uses nslookup to confirm a name exists and then claims a specific HTTPS port must be listening. The present fictional Kestrel Regional Office finding instead needs “Use show mac address-table and locate the workstation's MAC on the appropriate VLAN.”, verified by “The table shows the relevant MAC and associated switch interface.”.
Question 866
Before changing settings, consider this issue: At the fictional Kestrel Regional Office in a technician onboarding review, the team observes: A switch is missing a workstation's MAC entry and the technician runs show ip route expecting it to show learned Ethernet source locations. What is the MOST specific underlying cause?
- show mac address-table is used to inspect learned Ethernet MAC addresses and associated VLAN or ports.
- Secure remote administration depends on correct credentials, policy and transport reachability.
- Incorrect or stale DNS answers can direct an application to a wrong destination independently of local subnetting.
- Broad capture duration and scope can violate least-collection and data-privacy requirements.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Kestrel Regional Office: show mac address-table is used to inspect learned Ethernet MAC addresses and associated VLAN or ports. The corresponding remedy is “Use show mac address-table and locate the workstation's MAC on the appropriate VLAN.”. Confirmation: The table shows the relevant MAC and associated switch interface.
Incorrect Answers
B:That cause belongs to a different case: A technician cannot open a secure SSH session and recommends disabling all authentication instead of checking identity and management reachability. The observed fictional Kestrel Regional Office condition is specifically explained by “show mac address-table is used to inspect learned Ethernet MAC addresses and associated VLAN or ports.”.
C:That cause belongs to a different case: A workstation's name lookup returns an obsolete IP address and the technician changes its subnet mask instead of checking DNS. The observed fictional Kestrel Regional Office condition is specifically explained by “show mac address-table is used to inspect learned Ethernet MAC addresses and associated VLAN or ports.”.
D:That cause belongs to a different case: An engineer captures on a production uplink for hours without approval and collects traffic from unrelated departments to debug one laptop. The observed fictional Kestrel Regional Office condition is specifically explained by “show mac address-table is used to inspect learned Ethernet MAC addresses and associated VLAN or ports.”.
Question 867
A reviewer evaluates a proposed repair for: At the fictional Kestrel Regional Office in a technician onboarding review, the team observes: A switch is missing a workstation's MAC entry and the technician runs show ip route expecting it to show learned Ethernet source locations. The approved corrective action is: “Use show mac address-table and locate the workstation's MAC on the appropriate VLAN.” Which result BEST demonstrates success?
- The receiving team has the necessary evidence and acknowledges ownership in the ticket.
- The management session negotiates SSH and the plaintext Telnet service is not required.
- The file records the handshake sequence before subsequent application traffic.
- The table shows the relevant MAC and associated switch interface.
Explanation
Correct Answer
D:Correct. This is the required observable acceptance evidence for “Use show mac address-table and locate the workstation's MAC on the appropriate VLAN.” at the fictional Kestrel Regional Office. It demonstrates correction of the original cause: show mac address-table is used to inspect learned Ethernet MAC addresses and associated VLAN or ports.
Incorrect Answers
A:That result is evidence for a separate corrective action, “Transfer the incident to the responsible carrier or network team with circuit ID, impact and tests.”. It does not establish the intended outcome “The table shows the relevant MAC and associated switch interface.” for the fictional Kestrel Regional Office case.
B:That result is evidence for a separate corrective action, “Use SSH with authenticated device identity and approved credentials for remote CLI access.”. It does not establish the intended outcome “The table shows the relevant MAC and associated switch interface.” for the fictional Kestrel Regional Office case.
C:That result is evidence for a separate corrective action, “Restart the test application and begin capture before initiating the TCP session.”. It does not establish the intended outcome “The table shows the relevant MAC and associated switch interface.” for the fictional Kestrel Regional Office case.
Question 868
The technician plans a correction for: At the fictional Kestrel Regional Office in a technician onboarding review, the team observes: A switch is missing a workstation's MAC entry and the technician runs show ip route expecting it to show learned Ethernet source locations. During “Use show mac address-table and locate the workstation's MAC on the appropriate VLAN.”, which precaution MOST specifically prevents a related risk?
- Do not require an IP route for a direct physical console connection.
- Do not treat all ping failure text as interchangeable evidence.
- Do not assume the IPv4 routing table contains learned per-port Ethernet MAC entries.
- Do not declare a third-party circuit issue resolved merely after restarting an unrelated endpoint.
Explanation
Correct Answer
C:Correct. This precaution prevents a second fault while applying “Use show mac address-table and locate the workstation's MAC on the appropriate VLAN.” at the fictional Kestrel Regional Office. The required protection is “Do not assume the IPv4 routing table contains learned per-port Ethernet MAC entries.”; success still requires “The table shows the relevant MAC and associated switch interface.”.
Incorrect Answers
A:This caution is appropriate for a separate failure pattern: A switch's management IP is misconfigured and remote SSH fails, but an on-site technician refuses to use its working console port. The principal adjacent risk here is controlled by “Do not assume the IPv4 routing table contains learned per-port Ethernet MAC entries.”.
B:This caution is appropriate for a separate failure pattern: A technician tests 192.168.10.40 and receives 'Destination host unreachable' from the local PC, but records it as the same as an ordinary remote timeout. The principal adjacent risk here is controlled by “Do not assume the IPv4 routing table contains learned per-port Ethernet MAC entries.”.
D:This caution is appropriate for a separate failure pattern: A help-desk worker cannot resolve a carrier circuit fault but leaves the ticket unassigned because the local desktop was restarted. The principal adjacent risk here is controlled by “Do not assume the IPv4 routing table contains learned per-port Ethernet MAC entries.”.
Question 869
A service desk receives this network finding: At the fictional Ridgecrest Service Desk while checking a service ticket, the team observes: A Cisco switch port intermittently drops frames but the team only reads the port description in the running configuration. Which action MOST directly resolves the reported issue?
- Connect through the authorized VPN and least-privilege management route before opening SSH.
- Run show interfaces for the affected port and examine error, speed, duplex and line status evidence.
- Gather relevant logs, port status and endpoint tests before writing a diagnosis.
- Filter or inspect DNS traffic from the affected client and correlate transaction IDs and timing.
Explanation
Correct Answer
B:Correct. In the fictional Ridgecrest Service Desk case, Interface operational counters and error indications are available through show interfaces commands. The specified corrective action, “Run show interfaces for the affected port and examine error, speed, duplex and line status evidence.”, directly targets that condition. Evidence of resolution: The interface counters reveal or exclude CRC, error and other physical symptoms correlated with the outage.
Incorrect Answers
A:That action addresses a different network issue: A worker connects to a branch router's SSH service over public internet without using the corporate remote access policy. The present fictional Ridgecrest Service Desk finding instead needs “Run show interfaces for the affected port and examine error, speed, duplex and line status evidence.”, verified by “The interface counters reveal or exclude CRC, error and other physical symptoms correlated with the outage.”.
C:That action addresses a different network issue: A help desk attributes a recurring outage to 'user error' without collecting interface counters, logs or endpoint details. The present fictional Ridgecrest Service Desk finding instead needs “Run show interfaces for the affected port and examine error, speed, duplex and line status evidence.”, verified by “The interface counters reveal or exclude CRC, error and other physical symptoms correlated with the outage.”.
D:That action addresses a different network issue: A Wireshark user wants to investigate a failed DNS lookup but records only Ethernet broadcast frames unrelated to the query. The present fictional Ridgecrest Service Desk finding instead needs “Run show interfaces for the affected port and examine error, speed, duplex and line status evidence.”, verified by “The interface counters reveal or exclude CRC, error and other physical symptoms correlated with the outage.”.
Question 870
Before changing settings, consider this issue: At the fictional Ridgecrest Service Desk while checking a service ticket, the team observes: A Cisco switch port intermittently drops frames but the team only reads the port description in the running configuration. What is the MOST specific underlying cause?
- Interface operational counters and error indications are available through show interfaces commands.
- Network management systems aggregate device telemetry and alerts across a managed inventory.
- Management scripts should use appropriate authorized access and minimize changes when gathering diagnostics.
- Display filters change what is shown after capture; they do not delete already recorded packets.
Explanation
Correct Answer
A:Correct. This mechanism fits the observed network symptom at the fictional Ridgecrest Service Desk: Interface operational counters and error indications are available through show interfaces commands. The corresponding remedy is “Run show interfaces for the affected port and examine error, speed, duplex and line status evidence.”. Confirmation: The interface counters reveal or exclude CRC, error and other physical symptoms correlated with the outage.
Incorrect Answers
B:That cause belongs to a different case: A network manager wants an estate-wide view of link health but the technician logs into each device and manually guesses the fleet status. The observed fictional Ridgecrest Service Desk condition is specifically explained by “Interface operational counters and error indications are available through show interfaces commands.”.
C:That cause belongs to a different case: A support engineer launches an ad hoc script that reconfigures every router to collect interface data without confirming whether read-only data is available. The observed fictional Ridgecrest Service Desk condition is specifically explained by “Interface operational counters and error indications are available through show interfaces commands.”.
D:That cause belongs to a different case: A support worker uses a Wireshark display filter to hide TCP traffic and then claims that the filtered packets were never captured. The observed fictional Ridgecrest Service Desk condition is specifically explained by “Interface operational counters and error indications are available through show interfaces commands.”.