Tài liệu TestKing''''s Cisco Internetwork Troubleshooting Version 9.1 pdf

642-831 (CIT®)


TestKing's Cisco® Internetwork Troubleshooting

Version 9.1

642 - 831


Leading the way in IT testing and certification tools, www.testking.com

- 2 -

Important Note
Please Read Carefully




Study Tips
This product will provide you questions and answers along with detailed explanations carefully compiled and
written by our experts. Try to understand the concepts behind the questions instead of cramming the questions.

Go through the entire document at least twice so that you make sure that you are not missing anything.

Further Material
For this test TestKing plans to provide:
* Study Guide. Concepts and labs. Provides a foundation of knowledge.
* Online Testing. Practice the questions in an exam environment.
Try a demo:

Latest Version
We are constantly reviewing our products. New material is added and old material is revised. Free updates are
available for 90 days after the purchase. You should check your member zone at TestKing an update 3-4 days
before the scheduled exam date.

Here is the procedure to get the latest version:

1. Go to www.testking.com
2. Click on Member zone/Log in
3. The latest versions of all purchased products are downloadable from here. Just click the links.

For most updates, it is enough just to print the new questions at the end of the new version, not the whole
document.

Feedback
Feedback on specific questions should be send to You should state: Exam number and

version, question number, and login ID.

Our experts will answer your mail promptly.

Copyright
Each pdf file contains a unique serial number associated with your particular name and contact information for
security purposes. So if we find out that a particular pdf file is being distributed by you, TestKing reserves the
right to take legal action against you according to the International Copyright Laws.
642 - 831


Leading the way in IT testing and certification tools, www.testking.com

- 3 -

Note:
Section A contains 72 questions.
Section B contains 125 questions.
The total number of questions is 197.
Each section starts with QUESTION NO :1. There are no missing questions.

Section A

QUESTION NO: 1
Which troubleshooting tool is included in Cisco Connection Online (CCO)?

A. Cisco Technical Information Center (TIC) web site
B. Cisco Technical Assistance Center (TAC) web site.
C. Cisco Center for Assisted Troubleshooting (CAT) web site.
D. Cisco Internetworking Troubleshooting Center (ITC) web site.

Answer: B
Explanation
: this is an obvious question as this is the name of the cisco technical assistance web site. To me
this is an easy question and no problem to verify as I did by going to the Cisco site just to be thorough.
Example:


QUESTION NO: 2
When troubleshooting a complex problem which troubleshooting approach is used?

A. Top-down
B. Bottom-up

C. Split-difference
D. Divide-and-conquer


Answer: B

Explanation
: This is a Cisco recommended technique for troubleshooting and it is a good way none-the-less. I
have designed digital electronics in a previous career and this is the quickest way to get to the root of the
problem. Any other way would simply be a waste of time. If you go to this site you will see that this is precisely
the way Cisco recommends to troubleshoot an issue. They dissect it which is divide and conquer all the way.
642 - 831

Leading the way in IT testing and certification tools, www.testking.com


- 4 -

Example:
/>r09186a008007e1d1.html#21487

QUESTION NO: 3
What does a logical layered network model allows a troubleshooter to do?

A. Focus on physical layers to isolate a problem.
B. Focus on specific elements to isolate a problem.
C. Focus on physical, data link and network layers to isolate a problem.
D. Focus on transport and application layers to isolate a problem.


Answer: B

Explanation:

I use the previous example as well here.
You must focus on specific elements or you will never isolate the problem (s).
/>r09186a008007e1d1.html#21487



QUESTION NO: 4
Match the correct stage to its description for the process of creating network documentation.



642 - 831

Leading the way in IT testing and certification tools, www.testking.com


- 5 -

Answer:


Explanation
: To me this only makes sense as well.

Login:
means login no need for further info (silly description)
Interface discovery:
you need to find out as much about the connections as possible to construct a cogent
theory of what you wish to accomplish,
Document
, If you have this then you are in good shape and can “see” a network diagram but for a lot of areas
you must do this yourself and the result will be a more thorough understanding of the issues and the processes
to solve them.
Diagram
: This applies to my previous answer in that you will need to add any new info to the current (if any)
diagrams you have.

Device discovery
: To check out any relevant devices that pertain to the issue is always a necessary step. But
after seeing that you have inadequate documentation you may want to proceed to get this situation together
asap. So this is ALWAYS a necessary step, even if you do not have any issues at all this should have been done.
If you go to this url you will find that I am right though you will have to dig some to get it all:
/>a8aa.html#45390

QUESTION NO: 5
Users report slow response time for TestKing's Intranet web server. While trying to isolate the problem,
you find that attempts to use ping and tracert to reach the server’s IP address are unsuccessful. You are
able to successfully Telnet to the server, although the response is very slow. At this point, what
assumptions can you make from the results of your attempts to further isolate the problem? (Choose

three)


A. Divide and conquer troubleshooting approach should be taken.
B. Physical layer issues have been eliminated as a possible cause of the slow response.
C. The IP address configuration has been eliminated as a possible cause of the slow response.
642 - 831


Leading the way in IT testing and certification tools, www.testking.com

- 6 -

D. ICMP may be blocked by an access list somewhere on the path between the users and the Intranet web
server.
E. TCP may be blocked by an access list somewhere on the path between the users and the Intranet web
server.
F. Application layer issues have been eliminated as a possible cause of the slow response.


Answer: C, D, F
Explanation
: First off if you can telnet then you have talked via an application layer until so you do not have an

application layer issue.
Second you could not telnet without ip so this is good, at least at the device itself. This would not totally explain
slowdowns but we will put that aside for now.
Icmp could definitely be blocked as ping and tracert use this protocol.

To the other answers:
You do not know if the physical layer is good as this is a slowdown issue at least initially, so you know that
there is connectivity but this does not mean there are no physical layer issues. There could be lots of data being
transferred at this time, a router or switch could have lost a connection (cable) and you are talking through an
alternate route thus the slowdown. There could be other things as well. Too many to list here.
TCP blocked: This could not be or ther would be NO ACCESS instead of slow access to the users.
This is all you can know at this point without further investigation but this should be a simple issue to fix.

QUESTION NO: 6
Which troubleshooting approach should be used when it is suspected that the problem is physical media
or a faulty hub?


A. Isolate and solve
B. Top-down
C. Bottom-up

D. Divide and conquer


Answer: C



QUESTION NO: 7
Which three stages are essential to general troubleshooting processes? (Choose three)


A. Research solutions

642 - 831


Leading the way in IT testing and certification tools, www.testking.com


- 7 -

B. Document a policy
C. Gathering symptoms
D. Correcting the problem
E. Isolating the problem

Answer: C, D, E



QUESTION NO: 8
What three pieces of information should you have ready before placing a call to Cisco TAC? (Choose
three)


A. Packet traces

B. Switch error logs
C. Server event logs
D. Client patch levels
E. Recent configuration changes


Answer: A, B, E



QUESTION NO: 9
Which action should you consider when implementing an action plan?

A. Document the topology of the network.
B. Delete access lists on routers to isolate traffic.
C. Create troubleshooting steps as needed during the process.
D. Restore your network to a known previous state if the action item does not solve the problem.


Answer: D



QUESTION NO: 10

A network administrator has determined that a problem exists in the transport layer.
Which two of the following network devices should the administrator focus on to isolate the problem?
(Choose two)


642 - 831


Leading the way in IT testing and certification tools, www.testking.com


- 8 -

A. Router
B. Standard switch
C. Hub
D. Media
E. End-system


Answer: A, E

QUESTION NO: 11
Which two are troubleshooting targets for connection-oriented protocols? (Choose two)


A. Verify time-to-live fields
B. Verify protocol numbers
C. Verify sequence numbers
D. Verify acknowledgment numbers


Answer: C, D
Explanation

: 1. Verify sequence number 2. Verify acknowledgment numbers



QUESTION NO: 12
Which documentation reduces the time that a troubleshooter needs to spend learning about the structure
and configuration of a network and helps them know when they have returned the network to normal
operation?


A. Design document
B. Baseline document

C. Network summary
D. Design summary


Answer: B



QUESTION NO: 13
What should the next step be when a network administrator has followed a correction plan and efforts to
correct the problem are unsuccessful?

642 - 831


Leading the way in IT testing and certification tools, www.testking.com


- 9 -


A. Stop making changes and return to the Gathering Symptoms stage.
B. Continue to make changes, documenting each change as it is made until the problem is corrected.
C. Undo all changes, returning the device to their known initial state.

D. Perform a core dump to send to Cisco technical support for analysis.


Answer: C



QUESTION NO: 14
Which two commands are used to gather information about MS Windows based end-systems? (Choose
two)

A. show route
B. route print
C. show interface
D. print route
E. arp –a
F. traceroute


Answer: B, E
See Below From Win2000 Workstation:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
C:\>route print

===========================================================================
Interface List
0x1 MS TCP Loopback interface
0x1000003 00 d0 09 f4 32 a0 NDIS 5.0 driver

===========================================================================
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 172.16.26.1 172.16.26.10 1
127.0.0.0 255.0.0.0 127.0.0.1 127.0.0.1 1
172.16.26.0 255.255.255.0 172.16.26.10 172.16.26.10 1

172.16.26.10 255.255.255.255 127.0.0.1 127.0.0.1 1
172.16.255.255 255.255.255.255 172.16.26.10 172.16.26.10 1
224.0.0.0 224.0.0.0 172.16.26.10 172.16.26.10 1
255.255.255.255 255.255.255.255 172.16.26.10 172.16.26.10 1
642 - 831


Leading the way in IT testing and certification tools, www.testking.com


- 10 -

Default Gateway: 172.16.26.1
===========================================================================
Persistent Routes:
None

C:\>arp -a

Interface: 172.16.26.10 on Interface 0x1000003
Internet Address Physical Address Type
172.16.26.1 00-30-ab-04-2c-d5 dynamic

C:\>

QUESTION NO: 15
What information should be included in a network topology diagram? (Choose two)


A. Location of configuration files.
B. Speed and duplex of individual switch ports.
C. Illustrations of each network device.
D. Representations of logical and physical connections.
E. Individual end user systems.

Answer: C, D



QUESTION NO: 16
The Cisco router logging process can distribute system error messages to which three destinations?
(Choose three)


A. Configuration file
B. Logging buffer

C. Terminal lines
D. External syslog server
E. History file
F. Message directory


Answer: B, C, D


642 - 831

Leading the way in IT testing and certification tools, www.testking.com


- 11 -


QUESTION NO: 17
Exhibit:


The exhibit illustrates the output of a command used to troubleshoot data-link targets.
Which command generated this output?

A. show cdp neighbor
B. show cdp neighbor detail
C. show interfaces serial 0/1
D. show interfaces serial 0/1 summary


Answer: B



QUESTION NO: 18

What does P in a trace output mean?

A. The port us unreachable.
B. The PSTN is unreachable.
C. The packet is unreachable.
D. The protocol is unreachable.


Answer: D
The capital letter P is the message for protocol unreachable

See URL:

642 - 831


Leading the way in IT testing and certification tools, www.testking.com


- 12 -

QUESTION NO: 19
Which command is used to determine if a problem lies in the first four layers of the OSI networking
model?


A.
ping
B.
arp –a
C.
telnet
D.

show ip interface


Answer: C



QUESTION NO: 20
Which two steps should be taken when troubleshooting external router connections to switches
supporting inter-VLAN routing? (Choose two)

A. Verify the correct media-type statement for each VLAN subinterface.
B. Verify that the subinterface for each VLAN has the correct IP address.
C. Ensure that the correct IP address if configured on the main interface.
D. Ensure that the full duplex setting on the main router interface matches that on the switch port.


Answer: B, D
Incorrect answers
:
A - there can only be one media type per physical interface
C - the main interface (fasteth 0/0 for example) is to be left un-numbered

QUESTION NO: 21
Which command will enable forwarding of packets that have no default route to the best supernet route
possible?


A.
ip redirects
B.
ip split-horizon
C.

ip proxy-arp
D.
ip classless
642 - 831


Leading the way in IT testing and certification tools, www.testking.com


- 13 -

Answer: D



QUESTION NO: 22
Which command can display system messages that indicate the presence of duplicate IP addresses on
network devices?


A.
show logging

B.
show interfaces
C.
show IP routing
D.
show IP protocol


Answer: A

QUESTION NO: 23
Network Topology Diagrams and Network Configuration Tables should be maintained on which
schedule?


A. At the end of the day.
B. At the end of the month.
C. At the end of the year.
D. At the time changes are applied.
E. Before making any changes.

Answer: D
Explanation:
This is correct per:
/>4148.shtml
Specifically Notes:

• Ensure logging is not turned on for the line from which you are collecting output (use the show logging command).

This states that you are getting info from a particular line and as a result this would allow you to find out if you
had duplicate ip addresses.

642 - 831

Leading the way in IT testing and certification tools, www.testking.com


- 14 -



QUESTION NO: 24
Switch>show version
Cisco Internetwork Operating System Software

IOS(tm)C2950 Software(C2950-I6Q4L2-M), Version 12.1(11)EA1, RELEASE SOFTWARE(fc1)
Copyright(c) 1986-2002 by cisco Systems, Inc.
Compiled Web 28-Aug-02 10:25 by antonino
Image text-base: 0x80010000, data-base: 0x80528000

ROM: Bootstrap program is CALHOUN boot loader

Switch uptime is 8 hours, 34 minutes
System returned to ROM by power-on
System image file is “flash:/c2950-i6q412-mz.121-11-EA1.bin”

cisco WS-C2950-24 (RC32300) processor (revision G0) with 20402K bytes of memory.

Processor board ID FHK0645Z0TE
Last reset from system-reset
Running Standard Image
24 FastEthernet/IEEE 802.3 interface(s)

32K byes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 00:0B:5F:4D:77:80
Motherboard assembly number: 73-5781-11
Power supply part number: 34-0965-01
Motherboard serial number: F0C064507AL
Power supply serial number: PHI0638059E
Model revision number: G0

Motherboard revision number: A0
Model number: WS-C2950-24
System serial number: FHK0645Z0TE
Configuration register is 0xF

Switch>

Examine the output of the show version command.

Which of the following pieces of information can be discovered about the network configuration of this
switch? (Choose two)

A. Spanning-tree version
B. Model of the device
642 - 831


Leading the way in IT testing and certification tools, www.testking.com


- 15 -

C. MAC addresses of any interfaces or ports

D. Active routing protocol
E. Installed memory
F. Routing protocol version


Answer: B, E



QUESTION NO: 25
Exhibit:

You work as a technician at TestKing. When installing new computers at TestKing's remote site in
Mexico City, you are unable to make a connection between the computers and the corporate web server
TestKingA. Using the ping command from the router at the remote site, you are able to successfully ping
both the intranet web server and the newly installed PCs.
Which two problems might produce this set of symptoms? (Choose two)


A. Incorrect default gateway configured on the new PCs.
B. Incorrect default gateway configured on the intranet web server.
C. Incorrect routing protocol configuration on the remote site router.
D. Incorrect routing protocol configuration on the router connected to the subnet where the intranet web
server is installed.

Answer: A, C



QUESTION NO: 26
What are the components that should be included in an End-system Topology Diagram? (Choose four)

642 - 831

Leading the way in IT testing and certification tools, www.testking.com


- 16 -


A. Operating system
B. Device name
C. IP routing protocol
D. Device illustration
E. Connection to the network
F. VTP domain

Answer: A, B, D, E



QUESTION NO: 27
Which Microsoft Windows command can be used to verify that the declared address for the end-system
is correct?


A.

ping
B.
tracert
C.
telnet
D.
arp –a


Answer: D

QUESTION NO: 28
What information is provided by the show ppp multilink command?

A. Bundle name
B. Bundle idle time out
C. Bundle flapping record
D. Bundle disconnect reason


Answer: A

QUESTION NO: 29
Which command is used to display active TCP/IP connections on a Microsoft Windows end system?

642 - 831


Leading the way in IT testing and certification tools, www.testking.com


- 17 -

A.
traceroute
B.
ping
C.
netstat
D.
ifconfig –a


Answer: C

QUESTION NO: 30
When a network administrator is recording network applications that are available on an end-system,
which two high bandwidth applications should be included because of their large impact on network
performance? (Choose two)


A. Streaming video players
B. Email clients
C. Internet browsers

D. IPTV multicast applications
E. Calendar software clients


Answer: A, D



QUESTION NO: 31
Which command displays TCP and UDP statistics and can be used to isolate problems at the transport
layer?

A.
show ip traffic
B.
show ip route
C.
show ip protocols
D.
show ip interface brief


Answer: A

QUESTION NO: 32
Users are complaining that HTTP sessions are not successfully completing. You verify that there is a
good network layer path from client to server and back.
642 - 831


Leading the way in IT testing and certification tools, www.testking.com

- 18 -

What should you check next?

A. Routing topology
B. Retransmissions
C. Buffer underruns
D. Switching topology


Answer: B
Explanation

: retransmissions -> buffer overflow, buffers to small



QUESTION NO: 33
IP routing often uses a table that shows the correspondence between network and LAN hardware
addresses.
When troubleshooting, you want to check if the hosts are in this table or if there are any duplicate routes.
Which Cisco IOS command should you use?

A. show ip arp
B. show ip hosts

C. show ip routes
D. show ip interface
E. show ip addresses


Answer: A



QUESTION NO: 34
Log in, interface discovery and device discovery are steps of which of the following processes?

A. Network troubleshooting
B. Network documentation
C. Network testing
D. Network configuration


Answer: B



642 - 831

Leading the way in IT testing and certification tools, www.testking.com


- 19 -

QUESTION NO: 35
Which type of network documentation would contain a list of high-bandwidth applications?

A. A network topology diagram
B. An end-system topology diagram
C. A network configuration table

D. An end-system configuration table


Answer: D



QUESTION NO: 36
Which command will enable IP multicast fast switching or multicast distributed switching?

A.
ip redirects

B.
ip mroute-cache
C.
ip multicast
D.
ip directed-broadcast


Answer: B

QUESTION NO: 37
Which two statements about EIGRP are true? (Choose two)


A. EIGRP routers maintain en EIGRP Neighbor Table and an EIGRP Topology table.
B. On Ethernet (Broadcast) networks, EIGRP routers only establish adjacencies with the DR and BDR.
C. An EIGRP route will be in the active state if it lost the successor and no feasible successor is available.
D. EIGRP triggered updates are flooded to every EIGRP router within the EIGRP AS.


Answer: A, C

QUESTION NO: 38
You have diagnosed a Frame Relay issue as a flapping link.
Which two problems could cause this condition? (Choose two)


642 - 831


Leading the way in IT testing and certification tools, www.testking.com

- 20 -

A. Too much line noise.
B. Improperly configured keepalives.
C. Mismatched encapsulation types.
D. Improperly configured IP addresses.


Answer: A, C
You could also have this situation if you did not set the speed of the link. Which is a good way to simulate this
issue for learning.

QUESTION NO: 39
Which command displays “network unreachable” messages being sent by the router?

A. show ip rip
B. debug ip icmp
C. show ip events
D. debug ip packet
E. show ip statistics

Answer: B
Proof:
/>l#xtocid18



QUESTION NO: 40
You are having difficulty reaching a remote network or host. Someone at the remote end pings your
router to assist you in troubleshooting.
You want to view the output of the pings being sent to you.
Which IOS command should you use on your router?

A. show icmp traffic
B. show icmp ip ping
C. debug icmp ip ping
D. debug ip icmp traffic


Answer: D
Is closest: debug ip icmp
642 - 831

Leading the way in IT testing and certification tools, www.testking.com


- 21 -

Not one of these commands exist. But as stated previously “D” is the closest.




QUESTION NO: 41
A performance problem on a TCP/IP network has been isolated above the data link layer.

Which command will display information about TCP events such as state changes, retransmissions, and
duplicate packets?


A. debug ip tcp
B. debug ip tcp packet access list
C. debug ip tcp transactions
D. show ip traffic


Answer: C

The correct answer is “C”
Check this site for proof:
/>html



QUESTION NO: 42
Which two criteria does a standard access-list use? (Choose two)


A. Full MAC address only
B. Source IP address

C. Wildcard mask
D. Domain name
E. User account


Answer: B, C



QUESTION NO: 43
A problem at which OSI model layers can cause the following messages to be output on the console?
(Choose two)

Router#
642 - 831


Leading the way in IT testing and certification tools, www.testking.com


- 22 -

Mar 23 12:10:20 %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to
down

Mar 23 12:10:20 %DUAL-5-NBRCHANGE: IP-EIGRP 101: Neighbor 172.21.177.1 (Serial1/0) is down:
interface down


A. Physical
B. Data link
C. Network
D. Transport
E. Session
F. Application

Answer: A, B



QUESTION NO: 44
What displays the status of FECN and BECN packets?

A. show interfaces
B. show frame-relay pvc
C. show frame-relay lmi
D. show frame-relay fecn and show frame-relay becn

Answer: B



QUESTION NO: 45
After implementing and testing a network change what is the next step?

A. Gather statistics
B. Identify the affected network layer
C. Compare the result to the baseline

D. Document the solution


Answer: D


642 - 831


Leading the way in IT testing and certification tools, www.testking.com

- 23 -


QUESTION NO: 46
A Catalyst 2500 series switch has been attached to a Cisco 2600 series router that will perform inter-vlan
routing for devices connected to the switch. Reports indicate that the routing between vlans is not taking
place.
What may be a possible cause for this?

A. Interface Ethernet 0 on the Cisco 2600 does not have the speed and duplex manually set.
B. Trunking using ISL has not been enabled on the Catalyst 2950.
C. Trunking using IEEE 802.1q has not been enabled on the Cisco 2600.

D. Sub-interfaces have not been configured on the Catalyst 2950.


Answer: C
Reference:
/>ml#c2600



QUESTION NO: 47
Which command allows you to check to see if the router is receiving ARP requests and sending ARP
replies?

A. debug arp
B. debug ip arp
C. debug ip arp events
D. debug ip arp packets


Answer: A
“A” is the only answer that is correct. The other commands do not exist.

QUESTION NO: 48
What should you do to minimize debug output?

A. Apply an access list to contain the focus.
B. Apply service timestamps to sort messages.
C. Configure the router to run optimum switching.
D. Only debug packets when using this command.


642 - 831

Leading the way in IT testing and certification tools, www.testking.com


- 24 -

Answer: A



QUESTION NO: 49
Which three Cisco IOS commands are used to check for data-link protocol characteristics? (Choose
three)

A.
ping
B.
show interfaces
C.
show ip route
D.
show controller
E.
show cdp neighbor

F.
traceroute


Answer: B, D, E



QUESTION NO: 50
Which two commands are used to configure helper addresses, using either standard or non-standard
default UDP ports? (Choose two)

A.
ip helper-address
B.
ip explicit-protocol
C.
ip any helper-address
D.
ip forward-protocol


Answer: A, D

Incorrect answers:
“B, C”:….there are no such commands!



QUESTION NO: 51
A remote router is no longer routing packets across a point-to-point link to a central site router. No
routing protocol information is being exchanged between the two routers. During your attempt to gather
symptoms, you issue the show ip interface brief command which indicates the status of the interface to be
UP/UP.
At which TCP/IP model layer would you begin your troubleshooting process?

A. Network interface
642 - 831


Leading the way in IT testing and certification tools, www.testking.com


- 25 -

B. Internet
C. Transport
D. Application

Answer: B
The first step is to confirm how bad the situation is, so ping and traceroute and any network (internet) layer tests
would need to be performed.



QUESTION NO: 52
A show controllers or show interface command can help isolate a problem to which OSI layer?

A. Physical

B. Network
C. Transport
D. Application


Answer: A



QUESTION NO: 53
Which command will aid a troubleshooter in gathering Microsoft Windows end-system symptoms by
identifying the path a packet takes through the network?

A.
ping
B.
tracert
C.
routetrace
D.
route print
E.
traceroute

Answer: B
Tracert for Microsoft and traceroute for Cisco.



QUESTION NO: 54
If a ping command has been used to verify connectivity between hosts and the symptoms to the trouble
ticket remain, which layer of the OSI model should an administrator troubleshoot next?