200-301 interview questions & answers

The host sees the destination is not local (compares with its subnet mask), so it ARPs for its default gateway's MAC, frames the packet to the gateway, and sends it. The router strips the frame, looks up the destination network in its routing table, rewrites the Layer-2 header and forwards it hop by hop; each hop repeats this until the destination replies along the reverse path.

Redundant Layer-2 links create loops, and because frames have no TTL a broadcast would circulate forever (a broadcast storm). STP elects a root bridge and blocks redundant paths, leaving one loop-free active topology; if an active link fails it unblocks a standby path. RSTP converges in seconds rather than ~50 seconds.

A VLAN is a logical broadcast domain, so you can separate departments or roles on the same physical switches. A trunk (802.1Q) tags frames with their VLAN ID so a single link between switches carries traffic for many VLANs; an access port belongs to one VLAN and sends untagged frames to the device.

Static routes for small, stable networks, stub links, or a default route — predictable and no protocol overhead, but manual and no failover. Dynamic routing (OSPF, EIGRP) for larger networks that change: routers learn and reconverge automatically. Many designs use dynamic routing inside and a static default route out to the ISP.

Longest prefix match first — the most specific route always wins regardless of protocol. Only among routes with the same prefix length does administrative distance decide (e.g. OSPF 110 vs RIP 120), and then the metric within one protocol.

Discover (client broadcasts looking for a server), Offer (server offers an address), Request (client requests the offered address), Acknowledge (server confirms and hands over the lease with gateway, DNS, lease time). If the client and server are on different subnets you configure an ip helper-address so the router relays the broadcast.

Port security limits which or how many MAC addresses may use a switch access port, and can shut the port or drop traffic on a violation. It stops rogue devices and basic MAC-flooding attacks that try to turn the switch into a hub. It is a Layer-2 access control on edge ports.

Telnet sends everything, including the password, in clear text; SSH encrypts the whole session. To enable it you set a hostname and domain name, generate RSA keys (crypto key generate rsa), create a local user, and set the VTY lines to transport input ssh with login local.

Work the layers: confirm the clients have an IP, mask and gateway in the right VLAN (DHCP scope/helper). Check the SVI/gateway is up and the trunk carries that VLAN. Verify the router has a route and NAT includes that subnet, and that no ACL blocks it. ping and traceroute from the client narrow where it stops.

Controller-based (SDN) networking centralises the control plane: the controller programs devices through southbound APIs (e.g. NETCONF/RESTCONF) and exposes northbound APIs to applications. Config moves from box-by-box CLI to data models (YANG/JSON) and automation tools, so changes are consistent, versioned and repeatable.