A network admin runs a ping test to a remote server and sees that the first few packets are lost, but subsequent packets succeed. What does this pattern most likely indicate?

The first packets triggered ARP resolution or a slow-start mechanism, and the path is now stable.

The remote server is overloaded.

A network engineer is capturing traffic on a switch to troubleshoot a slow application. The capture is huge, and the engineer wants to isolate only the traffic between the application server (10.1.1.5) and the client (10.1.1.20) on TCP port 443. Which filter should be applied to the capture session?

ip src 10.1.1.5 and tcp dst port 443

host 10.1.1.5 and host 10.1.1.20 and tcp port 443

A network engineer is analyzing a packet capture from a user's workstation that is experiencing slow file transfers to a server. The capture shows that the TCP window size is consistently small (e.g., 1-2 KB) even though the link bandwidth is 1 Gbps. The server is sending data, but the client's advertised window is small. What is the most likely cause of the slow transfer?

The server is using a small MSS.

The client's receive buffer is too small, limiting the TCP window size.

The network is experiencing packet loss, causing the sender to reduce its window.

There is a duplex mismatch on the client's link.

A network engineer is troubleshooting a problem where users in a remote office cannot reach a central server. The engineer runs a traceroute from the remote office and sees that the first three hops respond, but the fourth hop times out, and the traceroute ends. The engineer then runs a ping to the server's IP and it succeeds. What is the most likely explanation?

The fourth hop is a router that does not respond to ICMP traceroute probes, but the path is functional.

The server is blocking traceroute probes.

The firewall on the server is dropping ICMP.

There is a routing loop between hop 3 and hop 4.

A network team needs to capture traffic on a core switch that carries multiple VLANs. The capture must include traffic from VLAN 10 and VLAN 20, but the analyzer is connected to a port in VLAN 30. The switch supports RSPAN and ERSPAN. Which method should be used to ensure the analyzer receives the traffic?

Configure an ERSPAN session with sources from VLAN 10 and VLAN 20, and send the encapsulated traffic to the analyzer's IP address.

Configure an RSPAN session with a source VLAN that includes both VLAN 10 and VLAN 20, and set the destination to the analyzer's port.

Use local SPAN on the core switch, mirroring the uplink that carries all VLANs, and connect the analyzer to the same switch.

Place a TAP on the links for VLAN 10 and VLAN 20 and connect them to the analyzer.

CCIE Enterprise Infrastructure

Domain 4Objective 7

Network Operations CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 8)

Part of the Infrastructure Security and Services domain, which accounts for 15% of the CCIE-ENTERPRISE-INFRASTRUCTURE exam. Cisco does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 1–2 from this objective — we provide 53 practice questions to prepare you well beyond it. (estimate)

53questions here

11free pages

7concepts

15%of the exam

Questions 36–40

36application · medium
A network admin runs a ping test to a remote server and sees that the first few packets are lost, but subsequent packets succeed. What does this pattern most likely indicate?
Select an answer first
37application · medium
A network engineer is capturing traffic on a switch to troubleshoot a slow application. The capture is huge, and the engineer wants to isolate only the traffic between the application server (10.1.1.5) and the client (10.1.1.20) on TCP port 443. Which filter should be applied to the capture session?
Select an answer first
38expert · hard
A network engineer is analyzing a packet capture from a user's workstation that is experiencing slow file transfers to a server. The capture shows that the TCP window size is consistently small (e.g., 1-2 KB) even though the link bandwidth is 1 Gbps. The server is sending data, but the client's advertised window is small. What is the most likely cause of the slow transfer?
Select an answer first
39expert · hard
A network engineer is troubleshooting a problem where users in a remote office cannot reach a central server. The engineer runs a traceroute from the remote office and sees that the first three hops respond, but the fourth hop times out, and the traceroute ends. The engineer then runs a ping to the server's IP and it succeeds. What is the most likely explanation?
Select an answer first
40expert · hard
A network team needs to capture traffic on a core switch that carries multiple VLANs. The capture must include traffic from VLAN 10 and VLAN 20, but the analyzer is connected to a port in VLAN 30. The switch supports RSPAN and ERSPAN. Which method should be used to ensure the analyzer receives the traffic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCIE-ENTERPRISE-INFRASTRUCTURE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Cisco. “CCIE-ENTERPRISE-INFRASTRUCTURE” is a trademark of its owner, used for identification only.

Network Operations CCIE-ENTERPRISE-INFRASTRUCTURE Practice Questions (Page 8)

Questions 36–40

A network admin runs a ping test to a remote server and sees that the first few packets are lost, but subsequent packets succeed. What does this pattern most likely indicate?

Keep studying — Infrastructure Security and Services