IP Addressing & Routing - Cyber Security

1. Which aggregate route satisfies the requirement?
   Answer: 172.16.32.0/20, covering exactly the sixteen requested contiguous /24 networks. When you see route aggregation (also called supernetting or CIDR summarization) questions, your job is to find the single prefix that covers exactly the desired block — no more, no less. The key formula: to cover $2^n$ contiguous /24 networks, you borrow $n$ bits from the host portion of a /24, giving you a prefix length of $24 - n$. Here, you need exactly 16 networks (172.16.32.0/24 through 172.16.47.0/24). Since $2^4 = 16$, you borrow 4 bits, yielding a prefix of $24 - 4 = 20$. The block starts at 172.16.32.0, and a /20 mask covers addresses 172.16.32.0 through 172.16.47.255 — exactly the sixteen /24 networks requested. That confirms B is correct. A is wrong because a /19 borrows only 3 bits from the third octet, covering $2^5 = 32$ /24 networks (172.16.32.0 through 172.16.63.0) — twice as many as needed, violating the "without including additional networks" requirement. C is wrong because a /21 covers only $2^3 = 8$ /24 networks (172.16.32.0 through 172.16.39.0), missing the second half of the required range entirely. D is wrong because 172.16.40.0/20 starts at the midpoint of the desired range, not at 172.16.32.0. A valid aggregate must begin at the correct network boundary for that prefix length — 172.16.40.0 is not aligned to a /20 boundary starting at .32. As a study tip, always verify both the prefix length and the starting address. A misaligned starting address is a common distractor designed to catch students who only check the prefix math.
2. How will the workstation initially attempt to deliver a packet to the server?
   Answer: It will send the packet to 10.24.18.65 because the server is outside the workstation's local subnet. Whenever you see a routing question, your first job is to determine whether the destination IP is inside or outside the source host's subnet. A host uses ARP and delivers directly only when the destination shares its subnet; otherwise, it forwards to the default gateway — regardless of physical topology. Here, the workstation is 10.24.18.94/27. A /27 mask means 32 hosts per block, with subnets starting at multiples of 32. The relevant block starts at 10.24.18.64, giving a range of .65–.94 for usable hosts and .95 as the broadcast. The workstation's subnet is therefore 10.24.18.64/27, covering .65 through .94. The server's address, 10.24.18.97, falls in the next block (10.24.18.96/27, covering .97–.126). Because .97 is outside the workstation's /27, the workstation treats the destination as remote and forwards the packet to its default gateway, 10.24.18.65. That confirms B is correct. A is wrong because physical connectivity (same switch) is irrelevant to Layer 3 forwarding decisions. A host ARPs for a destination only when subnet math says the destination is local — the switch topology doesn't change that calculation. C is wrong because .97 is not the workstation's broadcast address. The broadcast for the 10.24.18.64/27 subnet is .95, not .97. D is wrong because "ARPing for an adjacent subnet address" is not a real networking behavior. Hosts ARP for destination IPs or the default gateway — never for a neighboring subnet's addresses. Study tip: Always subnet-check both addresses before deciding local vs. remote. Same switch ≠ same subnet.
3. An outside network announces a more specific prefix for a bank's IP block, and internet traffic to the bank flows to it. What is this?
   Answer: BGP route hijacking Internet routers prefer the most specific prefix, so a false BGP announcement pulls the bank's traffic toward the attacker. That is route hijacking. DNS cache poisoning also redirects users, but it forges name lookups rather than routing announcements.
4. What is the expected result when Router A receives a packet for 192.168.70.50?
   Answer: The packet alternates between the routers until its TTL expires and a router discards it. When studying routing behavior, always trace the packet's path hop by hop and ask: "Does each router have a valid, reachable route to the destination?" This question tests your understanding of routing loops — one of the most classic failure modes in network design. Here's what happens: Router A receives the packet for 192.168.70.50, matches its static route for 192.168.70.0/24, and forwards the packet to Router B. Router B has no specific route for that subnet, so it falls back on its default route — which points back to Router A. Router A receives it again, matches the same static route, and sends it to Router B again. This cycle repeats indefinitely. Because each router hop decrements the packet's Time-to-Live (TTL) field by 1, the TTL eventually hits zero, at which point the router holding it discards the packet and typically sends an ICMP "Time Exceeded" message back to the source. This is answer C, and it describes a classic routing loop. Answer A is wrong because there's no rule preventing a default route from forwarding traffic that originated from a static route — routers make independent, per-hop decisions without awareness of upstream routing logic. Answer B is completely fabricated; routers do not convert unicast packets into broadcasts based on prefix length. Answer D is wrong because Router A doesn't "recognize" its own next-hop in a way that halts forwarding — it simply matches its routing table and forwards again. For the exam, remember: anytime two routers point at each other with no valid exit, you have a routing loop. TTL is the only safety net that stops it.
5. Which IPv4 address falls within a private address range defined by RFC 1918?
   Answer: 172.20.10.5 RFC 1918 reserves 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. The 172.16.0.0/12 block covers 172.16 through 172.31, so 172.20.10.5 is private. 169.254.10.5 is not routed on the internet either, but it is link-local, not RFC 1918.
6. What will most likely happen to traffic from headquarters destined for 10.80.44.25?
   Answer: The traffic will reach the branch router and be discarded because no usable more-specific route remains. When you see a question involving route summarization and link failures, the core concept to focus on is longest-prefix match and how summarization can mask failures from upstream routers. Here's what's happening: the branch router advertises a /16 summary to headquarters, covering all 10.80.0.0–10.80.255.255 addresses. When the 10.80.44.0/24 link fails, BGP withdraws that specific /24 — but the /16 summary stays advertised because other subnets within that block are still reachable. Headquarters sees only the /16, so traffic destined for 10.80.44.25 gets forwarded to the branch router just as before. Once it arrives, the branch router consults its local routing table, finds no usable /24 route for 10.80.44.0, and hits the discard route (also called a null route) that exists for 10.80.0.0/16 — a standard practice to prevent routing loops. The packet is silently dropped. This makes B correct. A is wrong because summary routes operate independently of their component more-specific routes. Withdrawing a /24 does not automatically withdraw a /16 that still has other valid contributors. C describes broadcasting behavior, which has no basis in unicast IP routing — routers don't "broadcast" to find a destination. D invents a fictional routing rule; longest-prefix match selects the most specific matching prefix, not the numerically closest one. As a study tip: whenever you see summarization combined with a partial failure, always ask yourself what the upstream router sees versus what the summarizing router knows locally — that gap is almost always where the exam question lives.
7. Why is adding ordinary static routes alone insufficient to provide reliable communication between both 10.10.20.0/24 networks?
   Answer: Routers cannot uniquely select between identical destination prefixes without address translation or renumbering. When two networks share an identical IP prefix, routing breaks down at a fundamental level — and that's exactly the concept being tested here. Think about what a router actually does: it reads the destination address of a packet and looks up that prefix in its routing table to decide where to send it. Now imagine both sites use 10.10.20.0/24. A router at Site A sees traffic destined for 10.10.20.0/24 and has two matching entries — one pointing locally, one pointing through the VPN tunnel. Even if you write a static route, the router has no reliable way to distinguish "send this to the remote 10.10.20.0/24" from "keep this local." Packets intended for remote hosts get dropped or looped back locally. D is correct because without address translation (NAT) or renumbering one side, the identical prefixes create an unresolvable forwarding ambiguity. Choice A is wrong because connected routes actually take precedence over static routes in most routing tables — the opposite of what A claims. Choice B is a red herring; private IPv4 addresses cross encrypted VPNs constantly and legally. There's no protocol rule preventing RFC 1918 addresses inside a tunnel. Choice C is simply false — static routes work perfectly with CIDR prefixes like /24, /28, or any prefix length; they are not restricted to classful /8, /16, or /24 boundaries. As a study tip, whenever you see overlapping or duplicate subnets in a scenario, immediately think "routing ambiguity" — the fix is always either renumbering one side or deploying NAT to make the destinations distinguishable.
8. Inbound internet packets arrive claiming source IPs from the company's internal range. What is the best defense?
   Answer: Ingress anti-spoofing filters at the edge Packets from the internet should never carry internal source addresses, so edge ingress filtering should drop them as spoofed. NAT is tempting because it involves addresses at the edge, but it translates addresses rather than rejecting forged ones.
9. Which next hop will the router select for a packet addressed to 10.20.47.200?
   Answer: Router C, because its route is the longest matching prefix for the destination. When a router must forward a packet, it doesn't just look for any matching route — it looks for the most specific one. This principle is called longest prefix match, and it takes absolute priority over metric values. Think of it like a postal address: a zip code narrows you down to a city, but a full street address gets you to the exact house. The router always prefers the "fullest address." To find the longest match for 10.20.47.200, convert each route's prefix to its range. The /16 via Router A covers 10.20.0.0–10.20.255.255. The /19 via Router B covers 10.20.32.0–10.20.63.255. The /21 via Router C covers 10.20.40.0–10.20.47.255. All three technically include 10.20.47.200, but /21 has the most bits locked in — it is the narrowest, most precise match. Router C wins, making C correct. A is wrong because metric only acts as a tiebreaker when two routes have equal prefix lengths. Router A's low metric of 5 is irrelevant here since its /16 is far less specific than the /21. B is a tempting trap — Router B's /19 is more specific than Router A's /16, so the reasoning sounds valid. But /19 is still less specific than Router C's /21, so B loses to C on the same longest-prefix rule. D is wrong because the default route (0.0.0.0/0) is the least specific route possible — a catch-all used only when no better match exists. Its low metric of 1 is completely irrelevant when more specific matches are available. Study tip: On routing questions, always evaluate prefix length before you even glance at metrics. Metrics only matter between routes of equal specificity.
10. Why is the static route unlikely to provide connectivity to 203.0.113.0/24?
    Answer: The next-hop address is not within any connected subnet, so the router has no path to resolve and reach it. When you see a question about static routing failures, your first instinct should be to trace the packet's entire path — not just the destination, but how the router will actually forward toward the next-hop. Here's the core concept: before a router can forward traffic to any destination, it must be able to reach the next-hop address itself. It does this by checking whether the next-hop falls within a locally connected subnet. The router's only interface is 192.0.2.1/30, which covers the range 192.0.2.0–192.0.2.3. The configured next-hop, 192.0.2.6, falls outside that range entirely. With no default route and no dynamic routing, the router has absolutely no mechanism to reach 192.0.2.6 — meaning the static route is effectively a dead end. The route may appear in the routing table, but it will never successfully forward a packet. Answer A is correct for exactly this reason. Answer B is wrong because documentation ranges like 203.0.113.0/24 (reserved by RFC 5737 for examples and documentation) carry no operational forwarding restriction — routers do not discard static routes toward them based on standards. Answer C is wrong because /30 interfaces are perfectly valid for originating and forwarding routed traffic. A /30 simply provides two usable host addresses on a point-to-point link; it imposes no restriction on generating Ethernet frames. Answer D is wrong because proxy-ARP is used when a router answers ARP requests on behalf of hosts on another segment — it has nothing to do with resolving an unreachable next-hop. Study tip: Always verify that a static route's next-hop is reachable via a connected interface. If no connected subnet contains the next-hop, the route cannot be used regardless of what's configured.
11. Which behavior best explains why communication initiated by Host A may fail even though both hosts share the same LAN?
    Answer: Host A treats Host B as local, but Host B treats Host A as remote and sends its reply toward the unavailable gateway. Whenever you see a question involving hosts on the same physical LAN but with different subnet masks, your first instinct should be to check each host's perspective independently — because subnetting is locally interpreted. Host A uses a /24 mask, meaning its network is 192.168.50.0–192.168.50.255. From Host A's view, 192.168.50.200 falls inside that range, so Host A considers Host B local and sends frames directly via ARP — no gateway needed. Host B, however, uses a /25 mask, giving it the network 192.168.50.128–192.168.50.255. From Host B's perspective, 192.168.50.10 falls outside that range, so Host B treats Host A as remote. When Host B needs to reply, it forwards the packet to its default gateway — which is temporarily unavailable. The reply never arrives, and communication fails. This is exactly what answer D describes. A is wrong because Host A correctly identifies Host B as local and communicates directly; it does not use its gateway for this traffic. B has the logic completely backwards — it's Host A that considers Host B local (correct), but claims Host B also considers Host A local (wrong). C introduces a fabricated concept: Ethernet does not block traffic based on prefix-length mismatches. The physical layer is oblivious to subnet masks entirely. A useful habit: always evaluate subnet membership from each host's own mask, not a shared one. On security and networking exams, asymmetric routing failures caused by mismatched masks are a classic trap — one side reaches, the other can't reply.
12. Assuming no overriding routes exist, how will the sending host classify the destination?
    Answer: As on-link, because the first 68 bits of both addresses match, including the leading four bits of the fifth hextet. When IPv6 hosts determine whether a destination is on-link or off-link, they compare the destination address against their configured prefix — bit by bit, up to the prefix length. The prefix length doesn't have to fall on a neat 16-bit boundary, so you must be comfortable working at the bit level inside a hextet. Here, the source is configured with /68, meaning the first 68 bits define the local subnet. The first four hextets cover 64 bits (4 × 16), so the prefix extends 4 additional bits into the fifth hextet. Convert the fifth hextet of each address: - Source fifth hextet: 1abc → binary 0001 1010 1011 1100 → leading 4 bits: 0001 - Destination fifth hextet: 1fff → binary 0001 1111 1111 1111 → leading 4 bits: 0001 The first 68 bits match perfectly, so the destination falls within the same /68 subnet — it's on-link. Answer A is correct. Answer B is wrong because IPv6 (unlike some older assumptions) fully supports prefix lengths that fall mid-hextet. There is no rule requiring alignment to 16-bit boundaries. Answer C is wrong because on-link determination only requires the first prefix-length bits to match — not the entire hextet. The remaining 12 bits of the fifth hextet are host bits and are irrelevant to the subnet comparison. Answer D is wrong because 2001:db8::/32 is the documentation prefix used in examples; it carries no special "auto-local" routing treatment. Study tip: When a prefix length isn't a multiple of 16, immediately convert the boundary hextet to binary and count the exact bits — this is a classic exam trap designed to catch students who only compare full hextets.
13. Which allocation meets both requirements while leaving the remaining address space available?
    Answer: Assign 10.60.8.128/26 for 50 hosts and 10.60.8.192/27 for 20 hosts. When subnetting, your first job is to match prefix lengths to host requirements. The formula for usable hosts is $2^{(32 - \text{prefix})} - 2$. For 50 hosts, you need at least 62 usable addresses, which means a /26 ($2^6 - 2 = 62$). For 20 hosts, you need at least 30 usable addresses, which means a /27 ($2^5 - 2 = 30$). The second constraint is that subnets must be nonoverlapping and must fit inside the parent block 10.60.8.128/25, which spans 10.60.8.128–10.60.8.255. Choice A assigns 10.60.8.128/26 (covering .128–.191, giving 62 usable hosts) and 10.60.8.192/27 (covering .192–.223, giving 30 usable hosts). Both subnets sit inside the /25 parent, do not overlap, and satisfy the host requirements. This is correct. Choice B assigns a /27 for 50 hosts, but a /27 only yields 30 usable addresses — not enough for 50 hosts. It also attempts to place a /26 starting at .160, which would overlap the first /27 (.128–.159 and .160–.223 would conflict with any subsequent allocation). This fails both the size and ordering requirements. Choice C assigns 10.60.8.128/26 correctly for 50 hosts, but then places the /27 at 10.60.8.160 — which falls inside the /26 range (.128–.191), creating an overlap. That violates the nonoverlapping requirement. Choice D uses the entire /25 for 50 hosts, which both exceeds the needed size and consumes all remaining space, leaving no room for the second subnet. Study tip: Always allocate larger subnets first, starting at the beginning of the address block, then place smaller subnets immediately after — this naturally prevents overlaps.
14. A traceroute shows the same two routers alternating hop after hop until the packet is discarded. What is the likely cause?
    Answer: A routing loop between the routers When each router's best route points to the other, a packet bounces between them until its TTL reaches zero and it is discarded. That is a routing loop. A null route also drops traffic, but it drops it at one hop instead of repeating hops.
15. A server is assigned 172.16.5.80/26. What is the broadcast address of its subnet?
    Answer: 172.16.5.127 A /26 makes blocks of 64 addresses, so 172.16.5.80 sits in the .64 to .127 block. Its broadcast address is the last one, 172.16.5.127. Choosing 172.16.5.255 wrongly treats the subnet as a /24.

Start this quiz