Cyber Security Quiz: Ip Addressing And Routing
10 questions · exam conditions
0:00
Ip Addressing And RoutingQuestion 1 of 10

A branch router advertises the summary 10.80.0.0/16 to headquarters and has more-specific routes to several branch subnets. The route to 10.80.44.0/24 is withdrawn after a link failure, but the /16 summary remains advertised. The summarizing router also has a discard route for 10.80.0.0/16.

What will most likely happen to traffic from headquarters destined for 10.80.44.25?

Headquarters will stop sending the traffic because withdrawal of the /24 automatically withdraws the /16 summary.
The traffic will reach the branch router and be discarded because no usable more-specific route remains.
The traffic will be broadcast to all interfaces covered by the /16 until the failed subnet responds.
The traffic will follow the nearest remaining /24 because routing selects the numerically closest destination prefix.
← Back to quizzes

Cyber Security Quiz

Cyber Security Quiz: Ip Addressing And Routing

Practice Ip Addressing And Routing in Cyber Security with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Ip Addressing And Routing, giving you a quick way to practice the rules, question types, and explanations that matter most for Cyber Security.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A branch router advertises the summary 10.80.0.0/16 to headquarters and has more-specific routes to several branch subnets. The route to 10.80.44.0/24 is withdrawn after a link failure, but the /16 summary remains advertised. The summarizing router also has a discard route for 10.80.0.0/16.

What will most likely happen to traffic from headquarters destined for 10.80.44.25?

  1. Headquarters will stop sending the traffic because withdrawal of the /24 automatically withdraws the /16 summary.
  2. The traffic will reach the branch router and be discarded because no usable more-specific route remains. (correct answer)
  3. The traffic will be broadcast to all interfaces covered by the /16 until the failed subnet responds.
  4. The traffic will follow the nearest remaining /24 because routing selects the numerically closest destination prefix.
Explanation: When you see a question involving route summarization and link failures, the core concept to focus on is longest-prefix match and how summarization can mask failures from upstream routers. Here's what's happening: the branch router advertises a /16 summary to headquarters, covering all 10.80.0.0–10.80.255.255 addresses. When the 10.80.44.0/24 link fails, BGP withdraws that specific /24 — but the /16 summary stays advertised because other subnets within that block are still reachable. Headquarters sees only the /16, so traffic destined for 10.80.44.25 gets forwarded to the branch router just as before. Once it arrives, the branch router consults its local routing table, finds no usable /24 route for 10.80.44.0, and hits the discard route (also called a null route) that exists for 10.80.0.0/16 — a standard practice to prevent routing loops. The packet is silently dropped. This makes B correct. A is wrong because summary routes operate independently of their component more-specific routes. Withdrawing a /24 does not automatically withdraw a /16 that still has other valid contributors. C describes broadcasting behavior, which has no basis in unicast IP routing — routers don't "broadcast" to find a destination. D invents a fictional routing rule; longest-prefix match selects the most specific matching prefix, not the numerically closest one. As a study tip: whenever you see summarization combined with a partial failure, always ask yourself what the upstream router sees versus what the summarizing router knows locally — that gap is almost always where the exam question lives.

Question 2

Router A has a static route for 192.168.70.0/24 pointing to Router B. Router B has no route for that subnet but has a default route pointing back to Router A. The destination 192.168.70.50 is not connected to either router.

What is the expected result when Router A receives a packet for 192.168.70.50?

  1. Router A immediately drops the packet because a default route on Router B cannot satisfy a static route.
  2. Router B converts the packet into a local broadcast because the destination falls within a /24.
  3. The packet alternates between the routers until its TTL expires and a router discards it. (correct answer)
  4. The packet returns to the sender unchanged because Router A recognizes its own next-hop address.
Explanation: When studying routing behavior, always trace the packet's path hop by hop and ask: "Does each router have a valid, reachable route to the destination?" This question tests your understanding of routing loops — one of the most classic failure modes in network design. Here's what happens: Router A receives the packet for 192.168.70.50, matches its static route for 192.168.70.0/24, and forwards the packet to Router B. Router B has no specific route for that subnet, so it falls back on its default route — which points back to Router A. Router A receives it again, matches the same static route, and sends it to Router B again. This cycle repeats indefinitely. Because each router hop decrements the packet's Time-to-Live (TTL) field by 1, the TTL eventually hits zero, at which point the router holding it discards the packet and typically sends an ICMP "Time Exceeded" message back to the source. This is answer C, and it describes a classic routing loop. Answer A is wrong because there's no rule preventing a default route from forwarding traffic that originated from a static route — routers make independent, per-hop decisions without awareness of upstream routing logic. Answer B is completely fabricated; routers do not convert unicast packets into broadcasts based on prefix length. Answer D is wrong because Router A doesn't "recognize" its own next-hop in a way that halts forwarding — it simply matches its routing table and forwards again. For the exam, remember: anytime two routers point at each other with no valid exit, you have a routing loop. TTL is the only safety net that stops it.

Question 3

A workstation has address 10.24.18.94/27 and default gateway 10.24.18.65. A server connected to the same Ethernet switch has address 10.24.18.97/27. No VLAN or switch-port restrictions separate the devices.

How will the workstation initially attempt to deliver a packet to the server?

  1. It will ARP for 10.24.18.97 because both addresses are attached to the same Ethernet switch.
  2. It will send the packet to 10.24.18.65 because the server is outside the workstation's local subnet. (correct answer)
  3. It will discard the packet locally because 10.24.18.97 is the broadcast address of its subnet.
  4. It will ARP for 10.24.18.95 because that address represents the next adjacent subnet.
Explanation: Whenever you see a routing question, your first job is to determine whether the destination IP is inside or outside the source host's subnet. A host uses ARP and delivers directly only when the destination shares its subnet; otherwise, it forwards to the default gateway — regardless of physical topology. Here, the workstation is 10.24.18.94/27. A /27 mask means 32 hosts per block, with subnets starting at multiples of 32. The relevant block starts at 10.24.18.64, giving a range of .65–.94 for usable hosts and .95 as the broadcast. The workstation's subnet is therefore 10.24.18.64/27, covering .65 through .94. The server's address, 10.24.18.97, falls in the next block (10.24.18.96/27, covering .97–.126). Because .97 is outside the workstation's /27, the workstation treats the destination as remote and forwards the packet to its default gateway, 10.24.18.65. That confirms B is correct. A is wrong because physical connectivity (same switch) is irrelevant to Layer 3 forwarding decisions. A host ARPs for a destination only when subnet math says the destination is local — the switch topology doesn't change that calculation. C is wrong because .97 is not the workstation's broadcast address. The broadcast for the 10.24.18.64/27 subnet is .95, not .97. D is wrong because "ARPing for an adjacent subnet address" is not a real networking behavior. Hosts ARP for destination IPs or the default gateway — never for a neighboring subnet's addresses. Study tip: Always subnet-check both addresses before deciding local vs. remote. Same switch ≠ same subnet.

Question 4

A router has these routes: 10.20.0.0/16 via Router A with metric 5; 10.20.32.0/19 via Router B with metric 20; 10.20.40.0/21 via Router C with metric 50; and 0.0.0.0/0 via Router D with metric 1.

Which next hop will the router select for a packet addressed to 10.20.47.200?

  1. Router A, because its matching route has the lowest metric among the internal routes.
  2. Router B, because its route is more specific than the route through Router A.
  3. Router C, because its route is the longest matching prefix for the destination. (correct answer)
  4. Router D, because the default route has the lowest metric in the routing table.
Explanation: When a router must forward a packet, it doesn't just look for any matching route — it looks for the most specific one. This principle is called longest prefix match, and it takes absolute priority over metric values. Think of it like a postal address: a zip code narrows you down to a city, but a full street address gets you to the exact house. The router always prefers the "fullest address." To find the longest match for 10.20.47.200, convert each route's prefix to its range. The /16 via Router A covers 10.20.0.0–10.20.255.255. The /19 via Router B covers 10.20.32.0–10.20.63.255. The /21 via Router C covers 10.20.40.0–10.20.47.255. All three technically include 10.20.47.200, but /21 has the most bits locked in — it is the narrowest, most precise match. Router C wins, making C correct. A is wrong because metric only acts as a tiebreaker when two routes have equal prefix lengths. Router A's low metric of 5 is irrelevant here since its /16 is far less specific than the /21. B is a tempting trap — Router B's /19 is more specific than Router A's /16, so the reasoning sounds valid. But /19 is still less specific than Router C's /21, so B loses to C on the same longest-prefix rule. D is wrong because the default route (0.0.0.0/0) is the least specific route possible — a catch-all used only when no better match exists. Its low metric of 1 is completely irrelevant when more specific matches are available. Study tip: On routing questions, always evaluate prefix length before you even glance at metrics. Metrics only matter between routes of equal specificity.

Question 5

Host A is configured as 192.168.50.10/24. Host B is configured as 192.168.50.200/25. They are on the same Ethernet LAN. Host B has a default gateway, but the gateway is temporarily unavailable.

Which behavior best explains why communication initiated by Host A may fail even though both hosts share the same LAN?

  1. Both hosts treat each other as remote, so each sends all traffic through its configured default gateway.
  2. Host A treats Host B as remote, but Host B treats Host A as local and replies directly through Ethernet.
  3. Both hosts treat each other as local, but Ethernet blocks communication between different prefix lengths.
  4. Host A treats Host B as local, but Host B treats Host A as remote and sends its reply toward the unavailable gateway. (correct answer)
Explanation: Whenever you see a question involving hosts on the same physical LAN but with different subnet masks, your first instinct should be to check each host's perspective independently — because subnetting is locally interpreted. Host A uses a /24 mask, meaning its network is 192.168.50.0–192.168.50.255. From Host A's view, 192.168.50.200 falls inside that range, so Host A considers Host B local and sends frames directly via ARP — no gateway needed. Host B, however, uses a /25 mask, giving it the network 192.168.50.128–192.168.50.255. From Host B's perspective, 192.168.50.10 falls outside that range, so Host B treats Host A as remote. When Host B needs to reply, it forwards the packet to its default gateway — which is temporarily unavailable. The reply never arrives, and communication fails. This is exactly what answer D describes. A is wrong because Host A correctly identifies Host B as local and communicates directly; it does not use its gateway for this traffic. B has the logic completely backwards — it's Host A that considers Host B local (correct), but claims Host B also considers Host A local (wrong). C introduces a fabricated concept: Ethernet does not block traffic based on prefix-length mismatches. The physical layer is oblivious to subnet masks entirely. A useful habit: always evaluate subnet membership from each host's own mask, not a shared one. On security and networking exams, asymmetric routing failures caused by mismatched masks are a classic trap — one side reaches, the other can't reply.

Question 6

A router's only configured interface is 192.0.2.1/30 on an Ethernet segment. An administrator adds a static route to 203.0.113.0/24 using next-hop address 192.0.2.6. The router has no default route and learns no dynamic routes.

Why is the static route unlikely to provide connectivity to 203.0.113.0/24?

  1. The next-hop address is not within any connected subnet, so the router has no path to resolve and reach it. (correct answer)
  2. The destination prefix is a documentation range, so routers are required by standards to discard static routes toward it.
  3. The local interface uses a host address within a /30, so it cannot originate any routed Ethernet traffic.
  4. The next-hop address is off-link but still reachable, so the router will proxy-ARP on behalf of the destination.
Explanation: When you see a question about static routing failures, your first instinct should be to trace the packet's entire path — not just the destination, but how the router will actually forward toward the next-hop. Here's the core concept: before a router can forward traffic to any destination, it must be able to reach the next-hop address itself. It does this by checking whether the next-hop falls within a locally connected subnet. The router's only interface is 192.0.2.1/30, which covers the range 192.0.2.0–192.0.2.3. The configured next-hop, 192.0.2.6, falls outside that range entirely. With no default route and no dynamic routing, the router has absolutely no mechanism to reach 192.0.2.6 — meaning the static route is effectively a dead end. The route may appear in the routing table, but it will never successfully forward a packet. Answer A is correct for exactly this reason. Answer B is wrong because documentation ranges like 203.0.113.0/24 (reserved by RFC 5737 for examples and documentation) carry no operational forwarding restriction — routers do not discard static routes toward them based on standards. Answer C is wrong because /30 interfaces are perfectly valid for originating and forwarding routed traffic. A /30 simply provides two usable host addresses on a point-to-point link; it imposes no restriction on generating Ethernet frames. Answer D is wrong because proxy-ARP is used when a router answers ARP requests on behalf of hosts on another segment — it has nothing to do with resolving an unreachable next-hop. Study tip: Always verify that a static route's next-hop is reachable via a connected interface. If no connected subnet contains the next-hop, the route cannot be used regardless of what's configured.

Question 7

Two companies merge and connect their sites through a routed VPN. Both sites currently use 10.10.20.0/24 for local workstations. Neither company can immediately change its workstation addresses.

Why is adding ordinary static routes alone insufficient to provide reliable communication between both 10.10.20.0/24 networks?

  1. Each router will prefer the remote /24 because learned routes always override connected routes.
  2. Private IPv4 addresses cannot cross encrypted VPNs unless they are converted to public addresses.
  3. Static routes accept only classful network boundaries, so both sites must use separate /8 networks.
  4. Routers cannot uniquely select between identical destination prefixes without address translation or renumbering. (correct answer)
Explanation: When two networks share an identical IP prefix, routing breaks down at a fundamental level — and that's exactly the concept being tested here. Think about what a router actually does: it reads the destination address of a packet and looks up that prefix in its routing table to decide where to send it. Now imagine both sites use 10.10.20.0/24. A router at Site A sees traffic destined for 10.10.20.0/24 and has two matching entries — one pointing locally, one pointing through the VPN tunnel. Even if you write a static route, the router has no reliable way to distinguish "send this to the remote 10.10.20.0/24" from "keep this local." Packets intended for remote hosts get dropped or looped back locally. D is correct because without address translation (NAT) or renumbering one side, the identical prefixes create an unresolvable forwarding ambiguity. Choice A is wrong because connected routes actually take precedence over static routes in most routing tables — the opposite of what A claims. Choice B is a red herring; private IPv4 addresses cross encrypted VPNs constantly and legally. There's no protocol rule preventing RFC 1918 addresses inside a tunnel. Choice C is simply false — static routes work perfectly with CIDR prefixes like /24, /28, or any prefix length; they are not restricted to classful /8, /16, or /24 boundaries. As a study tip, whenever you see overlapping or duplicate subnets in a scenario, immediately think "routing ambiguity" — the fix is always either renumbering one side or deploying NAT to make the destinations distinguishable.

Question 8

An IPv6 host is configured as 2001:db8:12:3400:1abc::10/68. It needs to send traffic to 2001:db8:12:3400:1fff::20. Both devices are connected to the same Layer 2 network.

Assuming no overriding routes exist, how will the sending host classify the destination?

  1. As on-link, because the first 68 bits of both addresses match, including the leading four bits of the fifth hextet. (correct answer)
  2. As off-link, because IPv6 prefix boundaries must align with complete 16-bit hextet boundaries.
  3. As off-link, because the entire fifth hextet must be identical for two addresses to share a /68 prefix.
  4. As on-link, because all addresses beginning with 2001:db8 are automatically treated as locally connected.
Explanation: When IPv6 hosts determine whether a destination is on-link or off-link, they compare the destination address against their configured prefix — bit by bit, up to the prefix length. The prefix length doesn't have to fall on a neat 16-bit boundary, so you must be comfortable working at the bit level inside a hextet. Here, the source is configured with /68, meaning the first 68 bits define the local subnet. The first four hextets cover 64 bits (4 × 16), so the prefix extends 4 additional bits into the fifth hextet. Convert the fifth hextet of each address:
  • Source fifth hextet: 1abc → binary 0001 1010 1011 1100 → leading 4 bits: 0001
  • Destination fifth hextet: 1fff → binary 0001 1111 1111 1111 → leading 4 bits: 0001
The first 68 bits match perfectly, so the destination falls within the same /68 subnet — it's on-link. Answer A is correct. Answer B is wrong because IPv6 (unlike some older assumptions) fully supports prefix lengths that fall mid-hextet. There is no rule requiring alignment to 16-bit boundaries. Answer C is wrong because on-link determination only requires the first prefix-length bits to match — not the entire hextet. The remaining 12 bits of the fifth hextet are host bits and are irrelevant to the subnet comparison. Answer D is wrong because 2001:db8::/32 is the documentation prefix used in examples; it carries no special "auto-local" routing treatment. Study tip: When a prefix length isn't a multiple of 16, immediately convert the boundary hextet to binary and count the exact bits — this is a classic exam trap designed to catch students who only compare full hextets.

Question 9

A security architect wants to advertise one route that includes exactly the sixteen contiguous networks from 172.16.32.0/24 through 172.16.47.0/24, without including any additional /24 networks.

Which aggregate route satisfies the requirement?

  1. 172.16.32.0/19, covering the requested networks plus the next sixteen /24 networks.
  2. 172.16.32.0/20, covering exactly the sixteen requested contiguous /24 networks. (correct answer)
  3. 172.16.32.0/21, covering only the first eight of the requested /24 networks.
  4. 172.16.40.0/20, covering an overlapping block beginning at the midpoint of the range.
Explanation: When you see route aggregation (also called supernetting or CIDR summarization) questions, your job is to find the single prefix that covers exactly the desired block — no more, no less. The key formula: to cover 2n2^n contiguous /24 networks, you borrow nn bits from the host portion of a /24, giving you a prefix length of 24−n24 - n. Here, you need exactly 16 networks (172.16.32.0/24 through 172.16.47.0/24). Since 24=162^4 = 16, you borrow 4 bits, yielding a prefix of 24−4=2024 - 4 = 20. The block starts at 172.16.32.0, and a /20 mask covers addresses 172.16.32.0 through 172.16.47.255 — exactly the sixteen /24 networks requested. That confirms B is correct. A is wrong because a /19 borrows only 3 bits from the third octet, covering 25=322^5 = 32 /24 networks (172.16.32.0 through 172.16.63.0) — twice as many as needed, violating the "without including additional networks" requirement. C is wrong because a /21 covers only 23=82^3 = 8 /24 networks (172.16.32.0 through 172.16.39.0), missing the second half of the required range entirely. D is wrong because 172.16.40.0/20 starts at the midpoint of the desired range, not at 172.16.32.0. A valid aggregate must begin at the correct network boundary for that prefix length — 172.16.40.0 is not aligned to a /20 boundary starting at .32. As a study tip, always verify both the prefix length and the starting address. A misaligned starting address is a common distractor designed to catch students who only check the prefix math.

Question 10

An administrator must divide 10.60.8.128/25 into nonoverlapping subnets. One subnet must support 50 IPv4 hosts, and another must support 20 IPv4 hosts. Traditional network and broadcast addresses cannot be assigned to hosts.

Which allocation meets both requirements while leaving the remaining address space available?

  1. Assign 10.60.8.128/26 for 50 hosts and 10.60.8.192/27 for 20 hosts. (correct answer)
  2. Assign 10.60.8.128/27 for 50 hosts and 10.60.8.160/26 for 20 hosts.
  3. Assign 10.60.8.128/26 for 50 hosts and 10.60.8.160/27 for 20 hosts.
  4. Assign 10.60.8.128/25 for 50 hosts and 10.60.8.192/27 for 20 hosts.
Explanation: When subnetting, your first job is to match prefix lengths to host requirements. The formula for usable hosts is 2(32−prefix)−22^{(32 - \text{prefix})} - 2. For 50 hosts, you need at least 62 usable addresses, which means a /26 (26−2=622^6 - 2 = 62). For 20 hosts, you need at least 30 usable addresses, which means a /27 (25−2=302^5 - 2 = 30). The second constraint is that subnets must be nonoverlapping and must fit inside the parent block 10.60.8.128/25, which spans 10.60.8.128–10.60.8.255. Choice A assigns 10.60.8.128/26 (covering .128–.191, giving 62 usable hosts) and 10.60.8.192/27 (covering .192–.223, giving 30 usable hosts). Both subnets sit inside the /25 parent, do not overlap, and satisfy the host requirements. This is correct. Choice B assigns a /27 for 50 hosts, but a /27 only yields 30 usable addresses — not enough for 50 hosts. It also attempts to place a /26 starting at .160, which would overlap the first /27 (.128–.159 and .160–.223 would conflict with any subsequent allocation). This fails both the size and ordering requirements. Choice C assigns 10.60.8.128/26 correctly for 50 hosts, but then places the /27 at 10.60.8.160 — which falls inside the /26 range (.128–.191), creating an overlap. That violates the nonoverlapping requirement. Choice D uses the entire /25 for 50 hosts, which both exceeds the needed size and consumes all remaining space, leaving no room for the second subnet. Study tip: Always allocate larger subnets first, starting at the beginning of the address block, then place smaller subnets immediately after — this naturally prevents overlaps.