Cisco Certified Network Associate (CCNA) 200-301 Practice Test 14
Question 130
A Linux container image requires a kernel feature absent from the running host. Filesystem mounts and container networking work, but the application fails immediately when invoking that kernel facility. Which diagnosis is best?
- A Linux container always boots its own guest kernel, so the host kernel version cannot matter.
- A VRF route table is missing, which by itself would remove an operating system kernel feature.
- The container shares the host kernel and cannot supply the missing kernel capability without a compatible host or a VM with its own guest kernel.
- A DHCP lease is the only prerequisite for loading kernel modules inside an unprivileged container.
Explanation
Correct Answer
C:Standard OS containers isolate processes but use the host kernel. A container image can bundle user-space libraries, not an independent kernel; incompatible kernel APIs remain unavailable despite working mounts and bridges.
Incorrect Answers
A:Ordinary containers do not boot independent kernels; that is a distinguishing property of virtual machines.
B:VRFs isolate IP routing; they do not provide absent system calls or kernel modules.
D:IP addressing and kernel feature availability are distinct. A lease will not create a missing kernel API.
Question 131
A static IPv4 route to `10.50.0.0/16` exists inside VRF BLUE. Packets arrive on an interface assigned to VRF RED, whose routing table lacks the prefix. The global `show ip route` also does not list BLUE's route. What explains the forwarding failure?
- A route in VRF BLUE does not automatically satisfy lookups for traffic in VRF RED; inspect `show ip route vrf RED` and supply an authorized route/leak if intended.
- The route must be used because any IPv4 static route is globally shared across every VRF.
- A missing TCP three-way handshake is responsible for the absence of a VRF-specific destination route.
- The fix is to add an unrelated IPv6 `::/0` route to the global IPv6 table.
Explanation
Correct Answer
A:VRFs maintain separate IP route and forwarding tables. A prefix installed in BLUE can be invisible to the RED lookup context and the default global table; an inter-VRF connection requires an explicit design.
Incorrect Answers
B:Separate RIB/FIB contexts are the central point of VRF; BLUE and RED are not automatically merged.
C:The route lookup happens at Layer 3 for any IP packet, not only TCP sessions.
D:An IPv6 global default cannot fill a missing IPv4 route in a tenant VRF.
Question 132
A Linux host runs a VM with a full independent guest kernel and a container sharing the host kernel. An operations reviewer wants evidence of the isolation difference rather than a fix for one failed application. Which inspection best demonstrates the architectural distinction?
- Compare DNS A records for the VM and the container and assume equal IP addresses imply identical kernels.
- Inspect only the Ethernet line rate of the host NIC to decide whether both workloads have separate kernels.
- Check that the VM runs through a hypervisor with its own guest OS kernel while the container's processes use the host kernel with namespaces and resource isolation.
- Verify that both workloads can ping their gateway; successful ping is proof they each run a different operating-system kernel.
Explanation
Correct Answer
C:A traditional virtual machine virtualizes hardware through a hypervisor and can boot an independent operating system kernel. A typical Linux container isolates processes using host-kernel mechanisms such as namespaces and cgroups rather than booting a distinct guest kernel. To verify the distinction, inspect the hypervisor/guest OS state and the container runtime's process and namespace view on the host. This acceptance question differs from diagnosing an application's unsupported-kernel behavior: it tests evidence of the actual execution architecture, not the cause of a failed container launch. Network reachability and IP addressing do not prove the operating-system isolation model.
Incorrect Answers
A:DNS resolves names to addresses; it does not indicate whether the compute instance has its own operating system kernel. A container and VM may have separate IP addresses or share parts of a network namespace depending on configuration. Kernel architecture requires host/runtime evidence, not equality or difference in A records.
B:Ethernet interface speed is a physical or virtual network-link characteristic. Both VMs and containers can use the same underlying host NIC while having different isolation mechanisms. Bandwidth or negotiated line rate says nothing about whether a guest kernel exists, so it cannot prove the requested architecture distinction.
D:ICMP reachability can demonstrate some network connectivity for a running VM or container, but either can communicate without indicating its kernel model. A container sharing the host kernel may ping a gateway just as a VM with an independent guest kernel does. Inspect compute/runtime internals rather than using network reachability as a proxy.
Question 133
An Ethernet switch receives a frame on Gi1/0/5 in VLAN 30. The frame's source MAC is 00:11:22:33:44:55 and destination MAC is 00:aa:bb:cc:dd:ee. The source is not yet in the MAC table. What table entry can the switch learn immediately from this frame?
- The destination MAC mapped to Gi1/0/5, because switches always learn the outgoing destination.
- Both MAC addresses mapped to every port in VLAN 30, regardless of the ingress interface.
- Source 00:11:22:33:44:55 mapped to Gi1/0/5 in VLAN 30.
- The source MAC mapped to a routed IPv4 next hop, even though no IP header was inspected.
Explanation
Correct Answer
C:The frame arrived on Gi1/0/5 in VLAN 30 with source 00:11:22:33:44:55. A learning switch records or refreshes that source MAC's association with the ingress port and VLAN. Later frames addressed to that learned MAC can be forwarded selectively to Gi1/0/5 rather than flooded. The destination MAC's location is a separate lookup: if unknown, the frame may be flooded to eligible VLAN ports except the ingress port, subject to controls. Confirm the learned entry using `show mac address-table dynamic vlan 30`. This is a direct source-address-learning decision, not an ARP process and not a routed next-hop determination. The VLAN matters because the same physical MAC-learning process is scoped within the switching domain.
Incorrect Answers
A:Layer 2 source learning occurs from the source address on the ingress frame, not by assuming the destination lives on the arriving port. The destination might be reachable through another learned interface or may be unknown and flooded. Mapping the destination to Gi1/0/5 from this observation could misdirect future forwarding and is not the learning rule.
B:A switch does not normally learn a new MAC address on every member interface. It learns the source on the actual ingress port in the appropriate VLAN. The destination can be looked up for forwarding, but no new destination location is established merely by reading a frame's destination field. Replicating entries to all ports would destroy the purpose of selective Layer 2 forwarding.
D:A switch's MAC address table records Layer 2 source locations by VLAN and interface; a router's ARP or neighbor table maps network-layer addresses to link-layer neighbors. The incoming Ethernet frame alone does not establish an IPv4 next-hop route. Confusing the tables would make an operator incorrectly diagnose routing when the relevant event is a newly learned Layer 2 source MAC.
Question 134
A switch receives a unicast Ethernet frame on VLAN 20, but the destination MAC has no entry in VLAN 20's CAM table. Under ordinary learning-switch behavior without unknown-unicast suppression, what happens?
- The switch floods the frame to every VLAN configured anywhere on the device.
- The switch floods the frame out other forwarding ports in VLAN 20, excluding the ingress port.
- The switch sends the frame only back through its ingress interface.
- The switch consults an IPv4 default route to determine the unknown Layer 2 destination MAC port.
Explanation
Correct Answer
B:An unknown-destination unicast is flooded within its own Layer 2 broadcast domain when no destination location is learned. The switch does not flood it to unrelated VLANs and will forward to one port after learning the destination MAC.
Incorrect Answers
A:Layer 2 flooding is constrained to the incoming VLAN; VLAN separation remains effective.
C:Standard unknown-unicast flooding excludes the incoming port and uses other forwarding ports in the same VLAN.
D:An ordinary access VLAN switch uses its MAC forwarding table for Ethernet frames; IPv4 routing does not find the destination MAC in that VLAN.
Question 135
A switch learns a workstation's source MAC on Gi1/0/10. After a long idle period the dynamic CAM entry expires; the workstation then appears on Gi1/0/18 and sends traffic. Which behavior is expected?
- The switch permanently pins the MAC to Gi1/0/10 without a configured static or secure entry.
- The switch learns every destination MAC by reading the destination field of an incoming frame.
- The aged dynamic entry is removed, and the switch learns the source MAC anew on Gi1/0/18 when a frame arrives.
- All VLANs are merged when a dynamic CAM record times out.
Explanation
Correct Answer
C:Dynamic MAC table entries normally age after an inactivity timer. Switches learn from source MAC plus ingress port and VLAN, so subsequent traffic from a new port refreshes location. Rapid alternating moves under a loop are a different symptom.
Incorrect Answers
A:Ordinary dynamic CAM entries can age and be relearned; they are not necessarily permanent bindings.
B:Learning uses the source MAC and ingress port; unknown destinations may be flooded until a source frame is seen.
D:Entry expiration does not change VLAN broadcast-domain boundaries.
Question 136
A capture on switch Gi1/0/5 shows frames arriving from host A with source MAC 00:11:22:33:44:55 and destination MAC 00:aa:bb:cc:dd:ee. An engineer claims the switch must learn destination 00:aa:bb:cc:dd:ee on Gi1/0/5 after those frames arrive. Which diagnosis is correct?
- The switch must create a new route to destination MAC in its IPv4 RIB.
- The switch learns both source and destination MACs from each frame by the same ingress rule.
- MAC learning stops whenever a destination is unknown, so neither address can be recorded.
- The inference is wrong: ingress learning records the source on Gi1/0/5; the destination location requires separate learned evidence.
Explanation
Correct Answer
D:The captured frame provides direct evidence of source 00:11:22:33:44:55 on Gi1/0/5, so the switch can learn that VLAN-scoped source mapping. It does not prove that destination 00:aa:bb:cc:dd:ee is attached to Gi1/0/5. If the destination is already in the MAC table, the switch forwards accordingly; if unknown, it may flood within VLAN 30 to eligible interfaces. Only a frame arriving with 00:aa:bb:cc:dd:ee as its source on some port provides ordinary ingress-learning evidence for that host's location. Inspect the MAC table after bidirectional traffic to verify actual ports. This diagnosis corrects the mistaken inference itself, distinct from a separate item that asks which table entry the switch immediately learns.
Incorrect Answers
A:A MAC address is a Layer 2 identifier and is not a normal IP route destination in the router's IPv4 RIB. A switch may use an address table for Layer 2 forwarding, while routes operate on IPv4 or IPv6 prefixes. Adding a routed entry would neither establish where the destination MAC is attached nor explain the observed source-learning behavior.
B:The two Ethernet addresses have different roles in the forwarding pipeline. The source identifies the sender arriving on Gi1/0/5 and can be learned there; the destination is looked up to choose an egress path. There is no automatic rule that maps both to the ingress port, which would often be wrong for traffic sent to another device. Source learning and destination lookup must be distinguished.
C:Unknown destinations may cause flooding within a VLAN, but that does not suppress ordinary learning of the frame's source address. The switch can still record the sender and use that information for later replies even if the receiver's location is unknown. The absence of a destination-table entry affects where the current frame is forwarded, not whether the new source can be learned.
Question 137
A frame with an unknown unicast destination enters switch SW1 on access VLAN 20. A packet capture shows copies on other eligible VLAN 20 ports but none on access VLAN 30. A technician nevertheless reports that the switch has flooded the unknown destination to every VLAN. Which interpretation of the capture is correct?
- A physical loop has made SW1 learn the same source MAC on two ports.
- The switch has converted the unknown unicast into an IP broadcast routed across VLANs.
- The 802.1Q native VLAN setting must have changed on an interswitch trunk.
- Unknown unicast flooding remains within the frame’s VLAN; the capture does not show flooding into VLAN 30.
Explanation
Correct Answer
D:The switch learns forwarding entries from source MAC addresses. For an unknown destination MAC in VLAN 20, it floods the unicast frame to eligible forwarding ports in VLAN 20 other than the ingress port; it does not flood independently into VLAN 30. When the destination is learned, future unicast frames normally go to the specific known egress port. This scenario asks for the scope and diagnosis of an observed flood, not the configuration choice or a later acceptance test. The capture is fully consistent with normal VLAN-local unknown-unicast behavior.
Incorrect Answers
A:MAC flapping indicates the same source address is repeatedly learned on different ports, often due to a Layer 2 loop or endpoint movement. The given capture does not show source MAC changes or repeated movement between ports. Instead it shows ordinary copies of a frame whose destination is not in the VLAN 20 forwarding table. That is a different normal switching behavior. Before diagnosing a loop, review MAC-table movement logs and spanning-tree topology changes rather than inferring them from a single unknown-destination flood.
B:A switch does not automatically convert an Ethernet unknown unicast into an IP broadcast and route it through other VLANs. Flooding is a Layer 2 forwarding operation scoped to the incoming broadcast domain. A router or multilayer switch may forward IP packets between VLANs, but only after proper Layer 3 forwarding, not as the ordinary consequence of a missing destination MAC entry. The absence of copies in VLAN 30 supports VLAN-local flooding, not an inter-VLAN broadcast transformation.
C:A native VLAN mismatch can misclassify untagged traffic on an 802.1Q trunk, and it deserves attention if tagged and untagged frames appear in unexpected VLANs. No such symptom is supplied here: ingress and egress captures are consistently within VLAN 20. The frame destination is unknown to that VLAN's MAC table, which explains flooding to eligible ports in the same VLAN. A trunk configuration change should be investigated only when interface mode and tag evidence point to it.
Question 138
A switch repeatedly learns the same source MAC alternately on Gi1/0/3 and Gi1/0/4 several times per second while a Layer 2 loop is active. What most likely accounts for this instability?
- MAC flapping caused by looped frames entering the same VLAN from two paths, rather than normal inactivity aging.
- Normal CAM aging must move an actively transmitting MAC between two ports every few milliseconds.
- The switch is learning only destination addresses, so source-port changes are irrelevant.
- A static IPv4 route has changed the MAC address of the Ethernet sender on every packet.
Explanation
Correct Answer
A:A learning switch updates a source MAC-to-port association whenever it receives a frame. A loop can send copies of the same source frame back over different ports, causing rapid CAM moves; ordinary aging removes idle entries, not subsecond oscillation.
Incorrect Answers
B:Aging removes stale idle entries. Rapid repeated moves during an active loop point to topology instability.
C:Ethernet switches normally learn source MACs at the ingress port, which is precisely why alternating copies cause moves.
D:IP route selection does not explain repeated identical source MACs received on two switch ports in the same Layer 2 loop.
Question 139
Host A on Gi1/0/5 in VLAN 30 and host B on Gi1/0/7 in VLAN 30 exchange frames successfully. Which switch output most directly confirms that both sources have been learned on their actual ingress access ports?
- `show ip route` showing a default gateway route through VLAN 30.
- `show mac address-table dynamic vlan 30` showing host A on Gi1/0/5 and host B on Gi1/0/7.
- `show ntp associations` showing a selected time synchronization peer.
- `show spanning-tree root` showing the root bridge priority for VLAN 30.
Explanation
Correct Answer
B:After host A and host B transmit frames, the switch should learn their source MAC addresses on Gi1/0/5 and Gi1/0/7 within VLAN 30, respectively. `show mac address-table dynamic vlan 30` exposes this learned VLAN/MAC/interface mapping and distinguishes it from a static entry. Confirm that the entries are present after bidirectional traffic and that they remain stable instead of flapping between ports. The output is acceptance evidence for source-learning behavior; it does not itself prove the host's default gateway, IPv4 mask or DNS configuration is correct. This verification item is distinct from the design item about which source is learned from one incoming frame and from the fault-isolation item correcting a mistaken destination-learning claim.
Incorrect Answers
A:A routing table can help confirm Layer 3 paths through interfaces and gateways, but the question asks for the Layer 2 learning location of two individual source MACs on access ports. A default IP route does not identify which switchport learned each MAC. Use the MAC address table on the switch and filter by the relevant VLAN.
C:NTP peer association output concerns clock synchronization between devices and their time sources. It does not report Ethernet source MAC entries or where endpoints attach to access switchports. A selected NTP peer could coexist with completely incorrect VLAN membership or MAC flapping, so it cannot establish the requested Layer 2 learning result.
D:Spanning-tree root status reveals the Layer 2 topology role and port-selection framework, but it does not show the dynamic MAC addresses learned from individual ingress frames. A healthy root election can coexist with missing or incorrect MAC table entries. The correct verification must inspect VLAN 30's dynamic address table and compare learned ports with the actual cabling.
Question 140
After an endpoint on VLAN 20 replies, SW1 learns its MAC address on Gi1/0/12. Operations wants to show that frames for that destination no longer flood on every eligible VLAN 20 port. Which collection of observations most directly verifies the expected forwarding change?
- Show that the STP root bridge has not changed, without inspecting destination MAC learning.
- Observe broadcast frames on VLAN 30 and assume their rate should decrease when VLAN 20 learns a destination.
- Check trunk native VLAN settings only, without looking at forwarding or captures of the tested unicast.
- Record the VLAN 20 destination MAC-to-Gi1/0/12 entry and compare SPAN captures before and after learning to confirm unicast is sent only to that port.
Explanation
Correct Answer
D:`show mac address-table` filtered by VLAN and destination confirms that the switch learned the target MAC on Gi1/0/12. A SPAN or equivalent capture then shows frames for that known destination exiting the learned port instead of being flooded to all eligible VLAN 20 ports. Comparing observations before and after a reply ties forwarding behavior to MAC learning. This is a verification decision and not the separate conceptual fault-isolation question about whether unknown unicast flooding should cross VLAN boundaries.
Incorrect Answers
A:Spanning Tree Protocol protects against Layer 2 loops and influences which ports can forward. Stable root-bridge election is useful topology evidence, but it does not show that a particular destination MAC has been learned or that its unknown-unicast flooding has ceased. The requested acceptance test is narrower: a known destination frame should be forwarded to its learned egress port. Inspect the destination's VLAN-specific MAC-table entry and capture actual traffic, rather than relying on unrelated STP stability.
B:A broadcast on VLAN 30 is intentionally distributed within that VLAN and is not the same traffic class as an unknown unicast addressed to a host in VLAN 20. Learning a VLAN 20 destination does not imply that broadcasts elsewhere should decrease. Comparing broadcast rates across VLANs would therefore be a noisy and irrelevant proxy. The acceptance criteria require the tested destination MAC and the exact VLAN 20 egress behavior before and after the forwarding-table entry is learned.
C:Native VLAN configuration determines how untagged frames are classified on an 802.1Q trunk. It does not establish that a switch has learned a particular destination MAC or stopped unknown-unicast flooding. The configuration could be correct while the destination entry ages out or is learned on the wrong port. The useful evidence is the VLAN-tagged MAC address table correlated with captures for the tested unicast flow, not a static native-VLAN setting alone.
