Tài liệu Cisco Internetwork Troubleshooting (CIT) Exam 642-831 Edition 2.0 pdf

Fravo.com
Certification Made Easy



MCSE, CCNA, CCNP, OCP, CIW, JAVA, Sun Solaris, Checkpoint
World No1 Cert Guides




Cisco Internetwork Troubleshooting
(CIT)
Exam 642-831


Edition 2.0







© Copyrights 1998-2005 Fravo Technologies. All Rights Reserved.
642-831

1

Congratulations!!

You have purchased a Fravo Technologies. Study Guide.

This study guide is a complete collection of questions and answers that have
been developed by our professional & certified team. You must study the
contents of this guide properly in order to prepare for the actual certification test.
The average time that we would suggest you for studying this study guide is
approximately 15 to 20 hours and you will surely pass your exam. We guarantee
it!

GOOD LUCK!




DISCLAIMER
This study guide and/or material is not sponsored by, endorsed by or affiliated
with Microsoft, Cisco, Oracle, Citrix, CIW, CheckPoint, Novell, Sun/Solaris,
CWNA, LPI, ISC, etc. All trademarks are properties of their respective owners.




Guarantee
If you use this study guide correctly and still fail the exam, send a scanned copy
of your official score notice at:

We will gladly refund the cost of this study guide or give you an exchange of
study guide of your choice of the same or lesser value.




This material is protected by copyright law and international treaties.
Unauthorized reproduction or distribution of this material, or any portion thereof,
may result in severe civil and criminal penalties, and will be prosecuted to the
maximum extent possible under law.


© Copyrights 1998-2005 Fravo Technologies. All Rights Reserved.




642-831

2

Note 1: Answers to the unanswered questions will be provided shortly.
Note 2: Section A contains 68 questions. Section B contains 125 questions. The total number of
questions is 193.

Section A

QUESTION 1 When troubleshooting a complex problem which troubleshooting approach
is used?

A. Top-down
B. Bottom-up
C. Split-difference
D. Divide-and-conquer

Answer:

QUESTION 2 Match the correct stage to its description for the process of creating network
documentation.

Answer:

QUESTION 3 Log in, interface discovery and device discovery are steps of which of the
following processes?

A. Network troubleshooting
B. Network documentation
C. Network testing
D. Network configuration

Answer:

QUESTION 4 Which troubleshooting approach should be used when it is suspected that
the problem is physical media or a faulty hub?

A. Isolate and solve
B. Top-down
C. Bottom-up
D. Divide and conquer

Answer:

QUESTION 5 What three pieces of information should you have ready before placing a call
to Cisco TAC? (Choose three)
642-831

3


A. Packet traces
B. Switch error logs
C. Server event logs
D. Client patch levels
E. Recent configuration changes

Answer:

QUESTION 6 What does a logical layered network model allows a troubleshooter to do?

A. Focus on physical layers to isolate a problem.
B. Focus on specific elements to isolate a problem.
C. Focus on physical, data link and network layers to isolate a problem.
D. Focus on transport and application layers to isolate a problem.

Answer:

QUESTION 7 A network administrator has determined that a problem exists in the
transport layer. Which two of the following network devices should the administrator
focus on to isolate the problem? (Choose two)

A. Router
B. Standard switches
C. Hub
D. Media
E. End-system

Answer:

QUESTION 8 Which documentation reduces the time that a troubleshooter needs to spend
learning about the structure and configuration of a network and helps them know when
they have returned the network to normal operation?

A. Design document
B. Baseline document
C. Network summary
D. Design summary

Answer:

QUESTION 9 What should the next step be when a network administrator has followed a
correction plan and efforts to correct the problem are unsuccessful?

A. Stop making changes and return to the Gathering Symptoms stage.
B. Continue to make changes, documenting each change as it is made until the problem is
corrected.
C. Undo all changes, returning the device to their known initial state.
D. Perform a core dump to send to Cisco technical support for analysis.

Answer:

QUESTION 10 Which troubleshooting tool is included in Cisco Connection Online (CCO)?

A. Cisco Technical Information Center (TIC) web site
B. Cisco Technical Assistance Center (TAC) web site.
642-831

4

C. Cisco Center for Assisted Troubleshooting (CAT) web site.
D. Cisco Internetworking Troubleshooting Center (ITC) web site.

Answer:

QUESTION 11 What information should be included in a network topology diagram?
(Choose two)

A. Location of configuration files.
B. Speed and duplex of individual switch ports.
C. Illustrations of each network device.
D. Representations of logical and physical connections.
E. Individual end user systems.

Answer:

QUESTION 12 The Cisco router logging process can distribute system error messages to
which three destinations? (Choose three)

A. Configuration file
B. Logging buffer

C. Terminal lines
D. External syslog server
E. History file
F. Message directory

Answer:

QUESTION 13 What does P in a trace output mean?

A. The port us unreachable.

B. The PSTN is unreachable.
C. The packet is unreachable.
D. The protocol is unreachable.

Answer:

QUESTION 14 Users report slow response time for Contoso's Intranet web server. While
trying to isolate the problem, you find that attempts to use ping and tracert to reach the
642-831

5

server's IP address are unsuccessful. You are able to successfully Telnet to the server,
although the response is very slow. At this point, what assumptions can you make from
the results of your attempts to further isolate the problem? (Choose three)

A. Divide and conquer troubleshooting approach should be taken.
B. Physical layer issues have been eliminated as a possible cause of the slow response.
C. The IP address configuration has been eliminated as a possible cause of the slow response.

D. ICMP may be blocked by an access list somewhere on the path between the users and the
Intranet web server.
E. TCP may be blocked by an access list somewhere on the path between the users and the
Intranet web server.
F. Application layer issues have been eliminated as a possible cause of the slow response.

Answer:

QUESTION 15 Which command is used to determine if a problem lies in the first four
layers of the OSI networking model?

A. ping
B. arp -a
C. telnet
D. show ip interface

Answer:

QUESTION 16 Which action should you consider when implementing an action plan?

A. Document the topology of the network.
B. Delete access lists on routers to isolate traffic.
C. Create troubleshooting steps as needed during the process.
D. Restore your network to a known previous state of the action item does not solve the problem.

Answer:

QUESTION 17 Which two steps should be taken when troubleshooting external router
connections to switches supporting inter-VLAN routing? (Choose two)

A. Verify the correct media-type statement for each VLAN sub interface.
B. Verify that the sub interface for each VLAN has the correct IP address.
C. Ensure that the correct IP address if configured on the main interface.
D. Ensure that the full duplex setting on the main router interface matches that on the switch port.

Answer:

QUESTION 18 The output from the Cisco IOS show buffers command has a count of
overruns. Where in the router would you must likely find the cause of the problem?

A. The router bus
B. The processor
C. Shared NVRAM
D. The route processor
E. The interface hardware

Answer:

QUESTION 19 Which command can display system messages that indicate the presence
642-831

6

of duplicate IP addresses on network devices?

A. show logging
B. show interfaces
C. show IP routing
D. show IP protocol

Answer:

QUESTION 20 Exhibit: The exhibit illustrates the output of a command used to
troubleshoot data-link targets. Which command generated this output?

A. show cdp neighbor
B. show cdp neighbor detail
C. show interfaces serial 0/1
D. show interfaces serial 0/1 summary

Answer:

QUESTION 21 Network Topology Diagrams and Network Configuration Tables should be
maintained on which schedule?

A. At the end of the day.
B. At the end of the month.
C. At the end of the year.
D. At the time changes are applied.
E. Before making any changes.

Answer:

QUESTION 22 Which two commands are used to gather information about MS Windows
based end-systems? (Choose two)

A. show route
B. route print
C. show interface
D. print route

E. arp -a
F. traceroute

Answer:

QUESTION 23 Exhibit: You work as a technician at Cer33iller. When installing new
computers at Contoso's remote site in Mexico City, you are unable to make a connection
between the computers and the corporate web server ContosoA. Using the ping command
from the router at the remote site, you are able to successfully ping both the intranet web
server and the newly installed PCs. Which two problems might produce this set of
symptoms? (Choose two)

A. Incorrect default gateway configured on the new PCs.
B. Incorrect default gateway configured on the intranet web server.
C. Incorrect routing protocol configuration on the remote site router.
D. Incorrect routing protocol configuration on the router connected to the subnet where the
intranet web server is installed.

Answer:
642-831

7



QUESTION 24 What are the components that should be included in an End-system
Topology Diagram? (Choose four)

A. Operating system
B. Device name

C. IP routing protocol
D. Device illustration
E. Connection to the network
F. VTP domain

Answer:

QUESTION 25 What information is provided by the show PPP multilink command?

A. Bundle name
B. Bundle idle time out
C. Bundle flapping record
D. Bundle disconnect reason

Answer:

QUESTION 26 Which two statements about EIGRP are true? (Choose two)

A. EIGRP routers maintain en EIGRP Neighbor Table and an EIGRP Topology table.
B. On Ethernet (Broadcast) networks, EIGRP routers only establish adjacencies with the DR and
BDR.
C. An EIGRP route will be in the active state if it lost the successor and no feasible successor is
available.
D. EIGRP triggered updates are flooded to every EIGRP router within the EIGRP AS.

Answer:

QUESTION 27 When a network administrator is recording network applications that are
available on an end-system, which two high bandwidth applications should be included
because of their large impact on network performance? (Choose two)

A. Streaming video players
B. Email clients
C. Internet browsers
D. IPTV multicast applications
E. Calendar software clients

Answer:

642-831

8

QUESTION 28 Which command will enable forwarding of packets that have no default
route to the best supernet route possible?

A. ip redirects
B. ip split-horizon
C. ip proxy-arp
D. ip classless

Answer:

QUESTION 29 Which two are troubleshooting targets for connection-oriented protocols?
(Choose two)

A. Verify time-to-live fields
B. Verify protocol numbers
C. Verify sequence numbers
D. Verify acknowledgment numbers

Answer:

QUESTION 30 Which command displays TCP and UDP statistics and can be used to
isolate problems at the transport layer?

A. show ip traffic
B. show ip route
C. show ip protocols
D. show ip interface brief

Answer:

QUESTION 31 Where is the output of debug and system error messages sent by default?

A. Output is written to a Syslog server.
B. Output is sent to the console terminal.
C. Output goes to the remote console if logging is off.
D. Output configuration requires a TFTP server to write files.
E. Error logging automatically invokes debug output to the designated TFTP server.

Answer:

QUESTION 32 Users are complaining that HTTP sessions are not successfully completing.
You verify that there is a good network layer path from client to server and back. What
should you check next?

A. Routing topology
B. Retransmissions
C. Buffer under runs

D. Switching topology

Answer:

QUESTION 33 Switch>show version Cisco Internet work Operating System Software
IOS(tm)C2950 Software(C2950-I6Q4L2-M), Version 12.1(11)EA1, RELEASE SOFTWARE(fc1)
Copyright(c) 1986-2002 by Cisco Systems, Inc. Compiled Web 28-Aug-02 10:25 by
antonino Image text-base: 0x80010000, data-base: 0x80528000 ROM: Bootstrap program is
CALHOUN boot loader Switch uptime is 8 hours, 34 minutes System returned to ROM by
642-831

9

power-on System image file is "flash:/c2950-i6q412-mz.121-11-EA1.bin" Cisco WS-C2950-
24 (RC32300) processor (revision G0) with 20402K bytes of memory. Processor board ID
FHK0645Z0TE Last reset from system-reset Running Standard Image 24 Fast
Ethernet/IEEE 802.3 interfaces 32K byes of flash-simulated non-volatile configuration
memory. Base Ethernet MAC Address: 00:0B:5F:4D: 77:80 Motherboard assembly number:
73-5781-11 Power supply part number: 34-0965-01 Motherboard serial number:
F0C064507AL Power supply serial number: PHI0638059E Model revision number: G0
Motherboard revision number: A0 Model number: WS-C2950-24 System serial number:
FHK0645Z0TE Configuration register is 0xF Switch. Examine the output of the show
version command. Which of the following pieces of information can be discovered about
the network configuration of this switch? (Choose two)

A. Spanning-tree version
B. Model of the device
C. MAC addresses of any interfaces or ports
D. Active routing protocol
E. Installed memory

F. Routing protocol version

Answer:

QUESTION 34 Which three stages are essential to general troubleshooting processes?
(Choose three)

A. Research solutions
B. Document a policy
C. Gathering symptoms
D. Correcting the problem
E. Isolating the problem

Answer:

QUESTION 35 Which Microsoft Windows command can be used to verify that the declared
address for the end system is correct?

A. ping
B. tracert
C. telnet
D. arp -a

Answer:

QUESTION 36 Which command will enable IP multicast fast switching or multicast
distributed switching?

A. ip redirects
B. ip mroute-cache

C. ip multicast
D. ip directed-broadcast

Answer:


QUESTION 37 You have diagnosed a Frame Relay issue as a flapping link. Which two
problems could cause this condition? (Choose two)

642-831

1
0

A. Too much line noise.
B. Improperly configured keep lives.
C. Mismatched encapsulation types.
D. Improperly configured IP addresses.

Answer:

QUESTION 38 You are having difficulty reaching a remote network or host. Someone at the
remote end pings your router to assist you in troubleshooting.
You want to view the output of the pings being sent to you. Which IOS command should
you use on your router?

A. show icmp traffic
B. show icmp ip ping
C. debug icmp ip ping
D. debug ip icmp traffic

Answer:

QUESTION 39 A performance problems on a TCP/IP network has been isolated above the
data link layer. Which command will display information about TCP events such as state
changes, retransmissions, and duplicate packets?

A. debug ip TCP
B. debug ip TCP packet access list
C. debug ip TCP transactions
D. show ip traffic

Answer:

QUESTION 40 Which two criteria does a standard access-list use? (Choose two)

A. Full MAC address only
B. Source IP address
C. Wildcard mask
D. Domain name
E. User account

Answer:

QUESTION 41 Which command is used to display active TCP/IP connections on a
Microsoft Windows end system?

A. traceroute
B. ping
C. net stat

D. ifconfig -a

Answer:

QUESTION 42 IP routing often uses a table that shows the correspondence between
network and LAN hardware addresses. When troubleshooting, you want to check if the
hosts are in this table or if there are any duplicate routes. Which Cisco IOS command
should you use?

A. show ip arp
642-831

11

B. show ip hosts
C. show ip routes
D. show ip interface
E. show ip addresses

Answer:

QUESTION 43 After implementing and testing a network change what is the next step?

A. Gather statistics
B. Identify the affected network layer
C. Compare the result to the baseline
D. Document the solution

Answer:

QUESTION 44 A Catalyst 2500 series switch has been attached to a Cisco 2600 series
router that will perform inter vlan routing for devices connected to the switch. Reports
indicate that the routing between vlans is not taking place. What may be a possible cause
for this?

A. Interface Ethernet 0 on the Cisco 2600 does not have the speed and duplex manually set.
B. Trunking using ISL has not been enabled on the Catalyst 2950.
C. Trunking using IEEE 802.1q has not been enabled on the Cisco 2600.
D. Sub-interfaces have not been configured on the Catalyst 2950.

Answer:

QUESTION 45 Which command allows you to check to see if the router is receiving ARP
requests and sending ARP replies?

A. debug arp
B. debug ip arp
C. debug ip arp events
D. debug ip arp packets

Answer:

QUESTION 46 What should you do to minimize debug output?

A. Apply an access list to contain the focus.
B. Apply service timestamps to sort messages.
C. Configure the router to run optimum switching.
D. Only debug packets when using this command.

Answer:

QUESTION 47 Which type of network documentation would contain a lost of high-
bandwidth applications?

A. A network topology diagram
B. An end-system topology diagram
C. A network configuration table
D. An end-system configuration table

Answer:
642-831

12


QUESTION 48 Which two commands are used to configure helper addresses, using either
standard or non-standard default UDP ports? (Choose two)

A. ip helper-address
B. ip explicit-protocol
C. ip any helper-address
D. ip forward-protocol

Answer:

QUESTION 49 A remote router is no longer routing packets across a point-to-point link to
a central site router. No routing protocol information is being exchanged between the two
routers. During your attempt to gather symptoms, you issue the show ip interface brief
command which indicates the status of the interface to be UP/UP. At which TCP/IP model
layer would you begin your troubleshooting process?

A. Network interface
B. Internet
C. Transport
D. Application

Answer:

QUESTION 50 A show controllers or show interface command can help isolate a problem
to which OSI layer?

A. Physical
B. Network
C. Transport
D. Application

Answer:

QUESTION 51 A problems at which OSI model layers can cause the following messages to
be output on the console? (Choose two)
Router# Mar 23 12:10:20 %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1,
changed state to down Mar 23 12:10:20 %DUAL-5-NBRCHANGE: IP-EIGRP 101: Neighbor
172.21.177.1 (Serial1/0) is down: interface down

A. Physical
B. Data link
C. Network
D. Transport
E. Session
F. Application

Answer:

QUESTION 52 Which command will aid a troubleshooter in gathering Microsoft Windows
end-system symptoms by identifying the path a packet takes through the network?

A. ping
B. tracert
C. route trace
D. route print
642-831

13

E. traceroute

Answer:

QUESTION 53 Which command displays "network unreachable" messages being sent by
the router?

A. show ip rip
B. debug ip icmp
C. show ip events
D. debug ip packet
E. show ip statistics

Answer:

QUESTION 54 What displays the status of FECN and BECN packets?

A. show interfaces
B. show frame-relay pvc
C. show frame-relay lmi
D. show frame-relay fecn and show frame-relay becn

Answer:

QUESTION 55 In which two ways are Topology Diagrams and Network Configuration Tables
similar? (Choose two)

A. Both share few components.
B. Both are used for troubleshooting.
C. Both use lines and symbols to represent network components.
D. Both share many of the same components.
E. Both define physical memory components.

Answer:

QUESTION 56 RouterContoso# show interface fas0/1 FastEthernet0/1 is up, line protocol is
up Hardware is Fast Ethernet, address is 0005.7428.0e01 (bia 9995.7428.0e01) MTU 1500
bytes, BW 100000 Kbit, DLY 1000 usec, reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loop back not set Keep alive set (10 sec) Full-duplex, 100Mb/s input
flow-control is off, output flow-c control is off ARP type: ARPA, ARP Timeout 04:00:00 Last
input 00:00:33, output 00:00:03, outgoing hang never Last clearing of "show interface"
counters never Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
queuing strategy: FIFO Output queue:0/40 (size/max) 5 minute input rate 0 bits/sec, 0
packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 371 494 packets input, 29182104
bytes, 0 no buffer Received 371379 broadcasts, 63459 runts, 0 giants, 0 throttles 119899
input errors, 56440 CRC, 0 frame, 0 overrun, 0 ignored

0 watchdog, 371374 multicast, 0 pause input 0 input packets with dribble condition
detected 929 671 packets output, 69998797 bytes, 0 under runs
0 output errors, 0 collisions, 2 interface resets 0 babbles, 0 late collisions, 0 deferred
0 lost carried, 0 no carrier, 0 PAUSE output 0 output buffer failures, 0 output buffers
swapped out A new workstation is connected to the switch. The workstation seems to be
very slow compared to other workstations connected to the same switch accessing the
same server. From the output of the show interface command, what is the probable cause
of the problem?

A. Duplex mismatch issue
642-831

14

B. Speed mismatch issue
C. Flow-control issue
D. Port fast issue
E. Udid issue
F. Jitter control issue

Answer:

QUESTION 57 How can a network administrator control the designation of the spanning-
tree root bridge in a switched network?

A. By raising the bridge ID on one switch.
B. By lowering the bridge priority on the desired switch.
C. By enabling uplink-fast on the ports of the desired switch.
D. By setting a lower MAC address on the designated switch.

Answer:

QUESTION 58 Which three Cisco IOS commands are used to check for data-link protocol
characteristics? (Choose three)

A. ping
B. show interfaces
C. show ip route
D. show controller
E. show cdp neighbor
F. traceroute

Answer:

QUESTION 59 You work as a network technician at Contoso. One of your users reports
slow response sending and receiving email, and when browsing the Internet. The output of
a ping command issued from the user's PC indicates intermittent success and failure
messages when attempting to contact the email server. A tracert to the corporate Internet
gateway router shows high latency and occasional time out messages. Which
troubleshooting approach would be effective in determining the cause of the slow
response times?

A. Bottom-up approach
B. Divide and conquer approach
C. Top-down approach
D. Random access approach

Answer:

QUESTION 60 Which three features make OSPF a more suitable choice than RIP for large

network installations? (Choose three)

A. Diffusing Update Algorithm
B. Faster convergence
C. Higher routing update overhead
D. Lower routing update overhead
E. No hop count limitation

Answer:

642-831

15

QUESTION 61 Which command can be used to correct IP routing problems?

A. ip split-horizon
B. ip route-cache
C. bandwidth
D. ifconfig

Answer:

QUESTION 62 Users in a workgroup are reporting the loss of connectivity to the corporate
e-mail and calendar system. While gathering the symptoms, the network administrator
finds that the workgroup users are able to access web pages located on the same server
as the e-mail calendar system. At which TCP/IP model layer would the administrator begin
the troubleshooting process?

A. Network interface

B. Internet
C. Transport
D. Application

Answer:

QUESTION 63 If a ping command has been used to verify connectivity between hosts and
the symptoms to the trouble ticket remain, which layer of the OSI model should an
administrator troubleshoot next?

A. Physical
B. Data link
C. Network
D. Application

Answer:

QUESTION 64 The MCP certified network technician at the Contoso1 office used a telnet
session to load a configuration file on the Contoso2 router. Halfway through executing the
configuration file the technician lost the telnet session to the Contoso2 router. Although
the interface on the Contoso1 routers shows both line and protocol as being up, the
technician cannot re-establish the telnet session, nor can he ping the router is not
accessible from the Contoso3 router either. The interface on the Contoso3 router also
indicates that the line and protocol are up. The Contoso company needs an expert to
resolve this problem. They have hired you to fix this problem. It is your task to re-establish
the IP connection from Contoso2 to Contoso1 and Contoso3 and to insure that routing
updates are passed between the two routers. The configuration on the Contoso1 and
Contoso3 routers are locked. Only show commands are available. It would be necessary to
discover the incorrect IP address that was sat by the technician and to correct the
configuration to include the routing protocol and the correct IP addresses. The task is

complete when the routes are updated correctly on all routers. Passwords for all routers
are the same. Privileged mode password: Contoso VTY password: Contoso IP Addresses
are shown below: ContosoContoso1 S0 10.16.15.10/24 21Contoso2 S0 172.18.140.2/24 S1
10.16.15.2/24 Contoso S1 172.18.140.10/24 To configure the router click on the host icon
that is connected to a router by a serial cable.

Answer: Pending. Send your suggestion to

QUESTION 65 Which symptom will indicate if a network problem is in the physical layer?

642-831

16

A. Output of a show ip interface brief command shows DOWN/DOWN.
B. The interface LED is amber on the affected device.
C. Pings succeed only a percentage of the time.
D. Output of show ip interface brief command shows UP/DOWN.

Answer:

QUESTION 66 Which four of the following categories are used to document the properties
of network routers? (Choose four)

A. Device name
B. Processing type
C. MAC address
D. IP address
E. IP routing protocols
F. Interface cache

Answer:

QUESTION 67 Network response times for an end-user application on a segment of the
network have degraded with the installation of a new router. The network administrator
begins his troubleshooting process by examining the routing protocol operation and then
checks the physical connections to the affected devices. Which troubleshooting method is
being applied?




A. Divide-and-conquer
B. Bottom-up
C. Top-down
D. Experience based

Answer:

QUESTION 68 What is the correct default escape sequence to abort a ping session on a
Cisco router?

642-831

17

A. Ctrl + Break
B. Ctrl + Alt + 6
C. Ctrl + Shift + 6
D. Ctrl + Alt + Del

E. Ctrl + Shift + Del

Answer:

Section B

QUESTION 1 Two routers are being learned on a router from two different IP routing
protocols. However, the protocol selected on the router is running on a slower interface.
Which command should you use so that the protocol being run on the faster interface is
more preferred?

A. ip cost
B. distance
C. ip distance
D. default-metric
E. distribute-list

Answer: D
Explanation: Because metrics for different protocols cannot be directly compared, you must
specify the default metric in order to designate the cost of the redistributed route used in RIP
updates. All routes that are redistributed will use the default metric.
Reference: RIP and OSPF Redistribution


QUESTION 2 Which command displays the LMI DLCI number used on a Frame Relay
interface?

A. show interfaces
B. show frame-relay lmi
C. show frame-relay pvc

D. show frame-relay dlci

Answer: C
Explanation: The show frame-relay pvc command displays PVC statistics. The output also
includes the LMI DLCI number.
Sample output: PVC Statistics for interface Serial0 (Frame Relay DTE)
dlci = 145, dlci USAGE = LOCAL, PVC STATUS = ACTIVE, INTERFACE = Serial0
<Etc - rest of output deleted>
Incorrect Answers
A: The show interfaces command is too general to be used for this purpose.
B: The show frame-relay lmi command displays LMI statistics. However, the output does not
include any LMI DLCI number.
D: There is no such command.

QUESTION 3 You have diagnosed a Frame Relay issue as a flapping link. Which two
problems could cause this condition? (Choose two.)

A. faulty cable
B. improperly configured keep lives
C. mismatched encapsulation types
D. improperly configured IP addresses

642-831

18

Answer: A, C
Explanation: Link flapping refers to losing and re-gaining link. A: Link flapping can be an
indication of a physical error (A), for example a faulty cable.
C: Trunking changes the formatting of the packet. The ports need to be in agreement as to what

format they are using on the link or they will not understand each other. Mismatched
encapsulation types can cause link flapping.
Note: Typical causes of link flapping on a switch port include:
• Speed/duplex mismatch
. • Faulty cable/loose connector
. • Faulty NIC or other end station problem
. • Faulty switch port
. • Other misconfiguration
Reference: Troubleshooting Switch Port Problems

QUESTION 4 Exhibit Which statement is true about the debug PPP negotiation shown in
the exhibit?

A. This shows the debug information for PPP PAP authentication.
B. The local router sent out the termination request to disconnect the link.
C. You should check to see if the passwords on the two sides are identical for this authentication
to succeed.
D. Only the remote router is trying to authenticate the local router, the local router does not
request authentication to the peer.

Answer: C
Explanation: The exhibit shows a PPP authentication attempt, which uses a three-way handshake
with CHAP The three way handshake fails however. The PPP partner does not agree on the
password.
Incorrect Answers
A: CHAP is used not PAP.
B: This is a PPP authentication using CHAP, not a termination request issued by the local router.
D: The local router is not involved in the authentication process.

QUESTION 5 Users are reporting that they're not able to browse the Internet. What step

might you take to determine that the clients are resolving the correct address from the
DNS server?

A. ping the DNS server
B. run a trace route to the DNS server
C. browse to the IP address of the web server
D. release and renew the DHCP address on the client

Answer: C
Explanation: If it is possible to browse the web server by IP address and not by host name, we
would know that we have a name resolution problem.
Incorrect Answers
A: Pinging the DNS server only checks if the DNS is reachable, not whether the client has the
correct name resolution configuration.
B: A trace route to the DNS server will only check if the DNS server is reachable (and which route
was used), not whether the client has the correct name resolution configuration.
D: Renewing the IP configuration on the client would not help this scenario.

QUESTION 6 With VLAN translation, a Catalyst 5000 can forward frames between which
pair of protocols?

A. ISL to VTP
642-831

19


B. HSRP to HDLC
C. Fast Ethernet to 802.10 FDDI
D. ARPA encapsulation to SNAP

Answer: C
Explanation: VLAN translation is able to work between Fast Ethernet and 802.10
FDDI
Reference: Catalyst 5000, Product Overview

Incorrect Answers
A: VLAN Trunk Protocol (VTP) is not an encapsulation protocol.
B, D: VTP requires a protocol type (Ethernet, FDDI, or Token Ring) to be configured for each
VLAN

QUESTION 7 Which three actions can be tracked or tested by Traffic Director software?
(Choose three.)

A. testing wire plant
B. simulating network changes
C. monitoring network usage trends
D. isolating protocol-related problems
E. implementing proactive network alarms

Answer: C, D, E
Explanation: The Traffic Director application lets you monitor and record information about
network usage, events, and trends (C), and identify and isolate many fault conditions in data
communication networks
(D).Furthermore, it can be used to set limit conditions on network traffic and generating alarms if
those limits are exceeded (E).
Reference: Traffic Director Overview
/>iew.htm
Incorrect Answers
A: The Traffic Director is not used to test physical wires.

B: The Traffic Director cannot be used to simulate network changes.

QUESTION 8 What are three possible causes of slow performance on a VLAN in a
switched network? (Choose three.)

A. no default route configured on the router
B. incorrect VTP domain defined on a switch
C. malfunctioning network adapter in a device
D. duplex mismatch with devices on switch ports
E. incorrect cable between a device and the switch port

642-831

20

Answer: A, C, D
Explanation: Lack of default route, malfunctioning network adapter, or duplex mismatch could
decrease performance.
Incorrect Answers
B: An incorrectly configured VTP domain would stop the traffic, not reduce it.
E: An incorrect cable would allow no traffic.

QUESTION 9 You have issued the command to display LMI type. The display includes the
following- LMI enq sent 2, LMI stat recvd 0, LMI upd recvd 0, DTE LMI upLMI enq recvd 0,
LMI stat sent 0, LMI upd sent 0LMI DLCI 0 LMI type is (output omitted) frame relay DTE
Which LMI type is used on this interface?

A. IETF
B. IEEE
C. Q933

D. Cisco

Answer: C
Explanation: LMI type Q933 must use DLCI 0.
Note: Only three LMI types can currently be used. These are ANSI T1.617, Cisco, and ITU-TQ
.933. The syntax of the command that sets the lmi type is:
frame-relay lmi-type {ansi | Cisco | q933a}
Reference: Configuring Frame Relay

Incorrect Answers A, B: IETF or IEEE ore not valid LMI types.
D: DLCI 0 is not used for LMI type Cisco.

QUESTION 10 You are dealing with a complex problem related to compatibility with
multiple vendors' products. Which online tool should you use to find a solution to this
problem?

A. Case Query Tool
B. Cisco Open Forum
C. Cisco Stack Decoder
D. Troubleshooting Assistant

Answer: A
Explanation: To get assistance on this complex compatibility problem the Case Query Tool
should be used. Every time you open a technical support case online, the Cisco TAC Case Open
tool's "recommendation” feature gives you a customized list of solutions selected by TAC
engineers. Simply fill out three drop-down fields describing your situation, and the Case Open tool
instantly displays links to documents and tools that may
resolve your issue right away.
Incorrect Answers
B: The Open Forum is not the best way to find solution to complex problems.

C: The Stack Decoder is used to analyze and diagnose stack traces from Cisco router platforms.
D: A powerful online tool, the Troubleshooting Assistant helps registered Cisco.com users solve
common hardware, configuration, and performance problems. However, it is not well suited for
the complex problem of this scenario.

QUESTION 11 Your Microsoft Exchange email administrator calls to tell you that she can
no longer browse the email server through Network Neighborhood on her Windows NT
workstation. What might be the cause of the problem?

A. The WINS server is down.
B. The Browse Master has gone down.
642-831

21

C. The Internet Firewall is blocking access.
D. The email server was moved to a different IP subnet.

Answer: A
Explanation: Windows NT uses WINS for name resolution. A WINS server which is
down could prevent the NT workstation from browsing resources on the network.
This is the most likely problem in this scenario.
Incorrect Answers
B: A Browse Master that goes down might slow down browsing, but would not
prevent name resolution from functioning.
C: The internet firewall is not applied when browsing local resources.
D: Moving a server to a different subnet could make it inaccessible if the IP
configuration is not adjusted. So this could cause the problem described in the
scenario. However, there are no reports on that the Email server is not
functioning. The most likely problem is a name resolution problem.

QUESTION 12 Which command allows you to check to see if the router is receiving ARP
requests and sending ARP replies?

A. debug arp
B. debug ip arp
C. debug ip arp events
D. debug ip arp packets

Answer: A
Explanation: Use the debug arp privileged EXEC command to display information on Address
Resolution Protocol (ARP) transactions.
Incorrect Answers: B, C, D: There are no such commands.

QUESTION 13 What are two primary features of switches that are missing in bridges?
(Choose two.)

A. high-capacity bus
B. hardware-based ASICs
C. spanning trees support
D. support for multiple Layer 2 protocols
E. reduction in the size of collision domains

Answer: B, E
Explanation: B: Application-specific integrated circuits (ASICs) enabled the construction of
switches.
E: A bridge is used to join network segments. A switch can be used to connect end nodes as well.
Typically, a switch has more ports and more attached devices. Each bridge port and each switch
port is a single collision domain. So a switch reduces the size of collision domains compared to a
bridge due to the number of ports.

Incorrect Answers
A: Bridges can use the same bus as switches.
C: Routers, not switches, use the spanning tree algorithm.
D: Bridges are switches supports about the same number of Layer 2 protocols.

QUESTION 14 Users on the network can reach hosts on certain networks through the router but
not hosts on other networks. You have determined that the local host is configured properly. What
is a possible cause of this problem?

642-831

22

A. The local router is down.
B. The remote host is down.
C. There is a misconfigured access list.
D. There is no default gateway on the local host.

Answer: C
Explanation: A misconfigured access list could prevent the client from access some networks.
Reference: Configuring IP Access Lists

Incorrect Answers
A: The local router cannot be down since we are able to access hosts on some remote networks.
B: The problem is not reach ability of a single host. Some networks are not reachable.
D: We know that the router can be reached since we can reach some remote networks. The
default gateway is correctly configured on the local host.

QUESTION 15 How can a network administrator control designation of the spanning-tree
root bridge in a switched network?

A. by raising the bridge
B. by lowering the bridge priority on the desired switch
C. by enabling uplink-fast on the ports of the desired switch
D. by setting a lower MAC address on the designated switch.

Answer: B
Explanation: The switch with the highest bridge priority (the lowest numerical priority value) is
elected as the root switch.
Reference: Configuring Spanning Tree


QUESTION 16 Which command line option to the show span tree command shows how
often the root bridge sends BPDUs?

A. bpdu time
B. hello time
C. root max age
D. heartbeat interval

Answer: B

Explanation: The spanning-tree [vl an stp-list] hello-time seconds command is used to specify the
interval between hello BPDUs.
Reference: Managing Switches


QUESTION 17 What does P in a trace output mean?

642-831

23

A. The port is unreachable.
B. The PSTN is unreachable.
C. The packet is unreachable.
D. The protocol is unreachable.

Answer: D
Explanation: The question applies to the output of the traceroute command. A P denotes t at a
protocol is unreachable.
Note: Traceroute Output Display Characters
Character Description * The probe timed out. ? Unknown packet type.
A Administratively unreachable. Usually, this output means that an
access list is blocking traffic.
H Host unreachable.
N Network unreachable.
P Protocol unreachable.
Q Source quench.
U Port unreachable.
Reference: Troubleshooting


QUESTION 18 Exhibit Based on the router configuration commands shown in the exhibit,
which statement is true?

A. IPX uses SAP encapsulation
B. The router is being configured for a trunk interface.
C. The router is connected to a switch whose address is 92.68.120.40
D. The switch uses 802.1Q trunking on the port connected to the router.

Answer: B
Explanation: The encapsulation isl 5 command indicates that ISL will be used. ISL operates in a
point-to-point environment: a trunk interface is being configured.
Reference: Cisco, Configuring Routing between VLANs with ISL Encapsulation

Incorrect Answers
A: There is no encapsulation sap command being used.
C: The IP address 92.68.120.40 does not apply to a remote switch. It is the IP address of the
interface that is being configured.
D: The encapsulation isl 5 command indicates that ISL will be used, not 802.1

QUESTION 19 Which command copies debug messages to your current terminal display?

A. logging monitor
B. logging terminal
C. terminal monitor
D. monitor terminal

Answer: C
Explanation: The terminal monitor command copies debug command output and system error
messages to the current terminal as well as to the console terminal.

QUESTION 20 A Novell clients learns about a server. Which packet does it send to learn a
route to the server?

A. IPX request
B. RIP request
C. SAP request
642-831

24

D. GNS request

Answer: D
Explanation: A GNS (Get Nearest Server) request is a request packet sent by a client on an IPX
network to locate the nearest active server of a particular type. An IPX network client issues a
GNS request to solicit either a direct response from a connected server or a response from a
router that tells it where on the internet work the service can be located. GNS is part of the IPX
SAP.

QUESTION 21 Which tool can be used to find a cable that has been damaged but has NO
opens or shorts?

A. TDR
B. network monitor
C. digital multimeter
D. protocol analyzer
E. Cisco Works 2000

Answer: A
Explanation: TDRs are the most sophisticated cable testers. These devices can quickly locate
open and short circuits, crimps, sharp bends, impedance mismatches, and other defects in
metallic cables.
Reference: System Troubleshooting Guidelines


QUESTION 22 You recently implemented inter VLAN routing using an external router on
your existing switched network. Now you have many users complaining that they are NOT

able to browse the Internet. What is the most likely cause of the problem?

A. The user's switch ports have port fast disabled.
B. Many users are using Category 3 patch cables.
C. The router has introduced a spanning-tree loop.
D. The VLAN configuration does not match on both sides of the trunk.

Answer: D
Explanation: The VLAN configuration on both sides of the trunk must match each other.
Reference: Using Port fast and Other Commands to Fix Workstation Startup Connectivity
Delays
Incorrect Answers
A: Port fast only helps to decrease the link startup time. Port fast could resolve the problem in this
scenario.
B: Usage of Category 3 patch would not cause this problem.
C: A spanning-tree loop would degrade overall performance, not the performance of group users.
D: A VLAN configuration error would cause problems to all users, not a subset of the users.

QUESTION 23 Before an AppleTalk client attaches to a file server (or printer), it must
locate the server. Which step in the AppleTalk connection sequence begins that process?

A. A Macintosh computer sends an ATP request to the local router.
B. A Macintosh computer sends a Get Zone List request to the local router.
C. A Macintosh computer sends an AFP broadcast request to the local router.
D. A Macintosh computer sends an NBP request to the local router.

Answer: A
Explanation: The ATP service allows exchanges between two socket clients in which one client
requests the other to perform a particular task and to report the results. ATP binds the request