Read the evidence · explain the choice

AP Networking Routing and Default Gateway Practice Test

Answer 75 routing and default gateway questions on longest-prefix matches, next hops, return paths, traceroute limits, NAT, route preference, and traffic policy.

Independent practice · Published and updated October 1, 2026 · Free for students and teachers

What this test measures

This test checks route matching, usable next hops, source-specific paths, return routing, and distinguishing routing from transport policy. Each difficulty has 25 questions; complete all three for 75. Easy emphasizes direct application, Medium combines evidence, and Hard asks you to choose among plausible diagnoses or evaluate what a result actually proves.

These are independent instructional questions, not released College Board items or a replica of Bluebook. The difficulty labels are local teaching choices; a score here does not predict an AP score.

For explanation before testing, use the routing and default gateway guide. Return to AP Networking Practice Tests by Topic to compare results across topics instead of repeating only your strongest subject.

Take the 25-question test for your selected level

Choose one answer to receive immediate feedback. Your first selection is scored; read the explanation before moving on. Use keyboard Tab to reach controls and arrow keys within the answer group. You can use these as untimed diagnostic practice, pausing to write your reasoning.

Changing difficulty or restarting clears the current attempt. Download your log first if you want to keep it.

Read the boundary before naming the fault

Representative reasoning

A table contains 10.0.0.0/8 via A and 10.20.0.0/16 via B. For 10.20.5.8, both prefixes match, but /16 is more specific. If the installed /16 has a higher metric than the /8, that does not make the /8 win this lookup. Metrics and route-source preference are separate selection questions.

Check which installed prefixes actually contain the destination, choose the longest match, and then verify that its next hop and policy permit forwarding. A route entry is a decision, not proof of end-to-end success.

A tempting shortcut to avoid

A responding gateway does not prove a remote application works. A router's own ping also may use a different source from a client, so its success cannot establish the client's return path or source-based permissions. Record the source, destination, protocol, and observation point for each test.

A worked decision

A server receives a client's SYN but no reply returns to the client. The request path has been demonstrated to that observation point. Inspect the server's selected gateway, return route to the client subnet, and intervening stateful policy. An asymmetric reply path can be valid routing yet encounter a firewall without the expected session state.

For a second representation of the same skill, review the related topic explanation. Compare its evidence with your calculation or packet-path sketch rather than memorizing the answer letter.

How to read the explained question library

All 75 items are available below as ordinary HTML. Open a question to view its choices, answer, and explanation. For retrieval practice, read the prompt, write a decision without opening it, then compare your reasoning. This library also gives teachers a stable question ID for discussion.

The six groups contain two halves of each difficulty, with 12 and 13 questions respectively. The interactive version uses the same questions and answer keys.

Easy explained questions · 1–12

Start by identifying the function or applying one explicit rule. These 12 questions are 1–12 of the easy set.

routing-easy-1 · What is the default gateway's usual role for a LAN host?
  1. Provide a next hop for destinations outside its local subnet
  2. Store every application password
  3. Translate every hostname
  4. Supply Ethernet power

Correct answer: A. Provide a next hop for destinations outside its local subnet

A gateway forwards off-subnet traffic when selected by the host's routes. DNS and power are separate functions.

routing-easy-2 · Which table does a router consult to choose an IP forwarding path?
  1. Patch-panel labels
  2. Routing table
  3. DNS cache
  4. User password table

Correct answer: B. Routing table

The routing table contains destination prefixes and forwarding information. DNS translates names but does not choose each router's path.

routing-easy-3 · What IPv4 prefix represents a default route?
  1. 127.0.0.1/32
  2. 192.168.0.0/16
  3. 255.255.255.255/32
  4. 0.0.0.0/0

Correct answer: D. 0.0.0.0/0

A /0 matches every IPv4 destination and serves as a fallback when no more specific usable route applies.

routing-easy-4 · Two installed routes match a destination. What normally determines which prefix is selected?
  1. Longest matching prefix
  2. Largest destination octet
  3. Alphabetically first hostname
  4. Shortest DNS TTL

Correct answer: A. Longest matching prefix

More prefix bits mean a more specific match. Route metrics do not ordinarily override a longer installed matching prefix.

routing-easy-5 · What happens to IPv4 TTL during router forwarding?
  1. It becomes a DNS TTL
  2. It is decremented
  3. It is copied from a VLAN ID
  4. It always increases

Correct answer: B. It is decremented

Routers decrement TTL to bound packet lifetime. A packet whose TTL expires is not forwarded onward normally.

routing-easy-6 · What does a successful ping primarily show?
  1. All DNS answers are correct
  2. The whole Internet is healthy
  3. An ICMP echo exchange succeeded with the tested destination
  4. Every TCP service works

Correct answer: C. An ICMP echo exchange succeeded with the tested destination

Ping tests a particular exchange at a time. Other protocols, hosts, and policies can behave differently.

routing-easy-7 · Which tool commonly exposes intermediate IP hops using TTL or hop-limit behavior?
  1. DNS zone editor
  2. Cable continuity tester
  3. Traceroute
  4. DHCP reservation table

Correct answer: C. Traceroute

Traceroute sends probes with controlled TTL/hop limits and interprets responses from intermediate hops.

routing-easy-8 · What is a next hop?
  1. The highest VLAN ID
  2. The final DNS suffix
  3. The DHCP lease duration
  4. The next router or forwarding destination on the selected path

Correct answer: D. The next router or forwarding destination on the selected path

A next hop directs the immediate forwarding step. It need not be the final destination host.

routing-easy-9 · A host sends to a same-subnet neighbor. Is the default gateway normally required?
  1. Only if both IPs are private
  2. Yes, DNS requires it
  3. Yes, every frame crosses it
  4. No, local delivery can be direct

Correct answer: D. No, local delivery can be direct

The host's connected subnet normally provides an on-link route. The gateway is for destinations requiring routing.

routing-easy-10 · What is a static route?
  1. A route explicitly configured by an administrator
  2. A switch MAC entry
  3. A DNS record with a long TTL
  4. A DHCP lease

Correct answer: A. A route explicitly configured by an administrator

A static route specifies a path by configuration rather than being learned through a dynamic routing protocol.

routing-easy-11 · What is a directly connected route?
  1. A path through every ISP
  2. A route associated with an attached IP subnet
  3. A reservation for one MAC
  4. A public DNS answer

Correct answer: B. A route associated with an attached IP subnet

An active configured interface can install a route to its attached network, subject to platform behavior.

routing-easy-12 · What is required for a reply to return across routed networks?
  1. A usable return path as well as a forward path
  2. An empty route table
  3. Identical cable colors
  4. A broadcast destination

Correct answer: A. A usable return path as well as a forward path

Bidirectional exchanges require return forwarding. A forward route alone does not guarantee a successful reply.

Easy explained questions · 13–25

Start by identifying the function or applying one explicit rule. These 13 questions are 13–25 of the easy set.

routing-easy-13 · A host has correct local address but wrong gateway. What can often still work?
  1. Same-subnet traffic
  2. All remote DNS servers
  3. Every Internet application
  4. Every remote VLAN

Correct answer: A. Same-subnet traffic

Local traffic may not use the default gateway. This makes a wrong gateway appear as selective remote failure.

routing-easy-14 · What does a routing metric help evaluate?
  1. DNS spelling
  2. Preference among comparable candidate paths under a routing method
  3. Ethernet connector size
  4. Physical cable color

Correct answer: B. Preference among comparable candidate paths under a routing method

Metrics represent path cost according to the protocol. Compare them within the appropriate routing context.

routing-easy-15 · What does an IPv4 host route /32 match?
  1. Every IPv4 address
  2. A 32-host LAN
  3. One IP address
  4. Only broadcast traffic

Correct answer: C. One IP address

All 32 bits are fixed. This is the most specific IPv4 destination prefix.

routing-easy-16 · Which command commonly displays a Windows IP routing table?
  1. nslookup alone
  2. net user
  3. route print
  4. ipconfig /flushdns only

Correct answer: C. route print

route print exposes route and interface information. DNS commands do not show the full forwarding table.

routing-easy-17 · What does NAT commonly change at an IPv4 network boundary?
  1. All application passwords
  2. Copper conductor count
  3. Address and sometimes transport-port mappings
  4. The physical VLAN tag standard

Correct answer: C. Address and sometimes transport-port mappings

NAT translates addressing according to state or policy. It is not itself a substitute for all firewall controls.

routing-easy-18 · What is the IPv6 default-route prefix?
  1. ::1/128
  2. fe80::/10
  3. ::/0
  4. ff00::/8

Correct answer: C. ::/0

::/0 matches all IPv6 destinations as a fallback. ::1 is loopback, not a default path.

routing-easy-19 · What is a router interface's IP address used for on a LAN?
  1. A DNS label for every cable
  2. A local Layer 3 endpoint and often gateway next hop
  3. An optical wavelength
  4. The MAC of every client

Correct answer: B. A local Layer 3 endpoint and often gateway next hop

Hosts can use that locally reachable interface as their gateway. The address does not identify all attached clients.

routing-easy-20 · A router receives a packet with no matching route, including no default. What is ordinary behavior?
  1. Deliver it to a random client
  2. Ask DNS to choose a cable
  3. Flood it across every VLAN
  4. Drop it and possibly report destination unreachable

Correct answer: D. Drop it and possibly report destination unreachable

Forwarding needs a usable route. Error reporting depends on implementation and policy, but random forwarding is not the solution.

routing-easy-21 · What is the difference between switching and routing here?
  1. Routing is DNS caching
  2. Switching forwards local frames; routing forwards packets between IP networks
  3. Switching always crosses IP subnets
  4. Routing requires wireless

Correct answer: B. Switching forwards local frames; routing forwards packets between IP networks

The distinction is the forwarding layer and addressing. A single device may implement both functions.

routing-easy-22 · A default gateway address is set to the LAN broadcast address. Why is that wrong?
  1. The gateway must always be public
  2. Broadcast guarantees fastest routing
  3. DNS chooses gateways from broadcast
  4. Broadcast is not an ordinary router host address

Correct answer: D. Broadcast is not an ordinary router host address

A usable locally reachable gateway interface is needed. The broadcast address cannot serve as an ordinary next-hop identity.

routing-easy-23 · What does an ACL on a router influence?
  1. The number of address bits in IPv4
  2. Fiber bend radius
  3. Which traffic is permitted or denied according to policy
  4. DHCP lease length universally

Correct answer: C. Which traffic is permitted or denied according to policy

A valid route does not mean policy allows the packet. ACLs can selectively constrain forwarding.

routing-easy-24 · Why can ping fail while HTTPS works?
  1. ICMP and HTTPS can be treated differently by policy or endpoints
  2. HTTPS never uses IP
  3. DNS always answers ping
  4. A working HTTPS connection proves ping must work

Correct answer: A. ICMP and HTTPS can be treated differently by policy or endpoints

Different protocols may be filtered or handled separately. Test the application's actual connection rather than relying only on ping.

routing-easy-25 · What does an IP prefix in a route describe?
  1. The destination address range the route matches
  2. A DNS password
  3. The switch's power budget
  4. A cable category

Correct answer: A. The destination address range the route matches

A prefix plus length defines the matched address space. Next hop and interface describe how to forward matching packets.

Medium explained questions · 1–12

Combine the configuration with the symptom before selecting a decision. These 12 questions are 1–12 of the medium set.

routing-medium-1 · Routes include 10.0.0.0/8 via A and 10.20.0.0/16 via B. Destination is 10.20.5.8. Which path wins?
  1. Both equally because both match
  2. Neither without DNS
  3. B
  4. A

Correct answer: C. B

The /16 matches more bits and is more specific than /8. The default or broader route is not preferred here.

routing-medium-2 · Routes include default via A and 192.168.40.0/24 via B. Destination is 192.168.40.70. Which path wins?
  1. B
  2. The DNS server
  3. A broadcast on every interface
  4. A

Correct answer: A. B

The specific /24 overrides the fallback /0 for this destination.

routing-medium-3 · Host 192.168.5.20/24 sends to 192.168.8.20. What should it normally resolve with ARP for the first hop?
  1. Every router on the path
  2. Its local gateway's IPv4 address
  3. The remote DNS hostname
  4. The remote host's address directly on the local LAN

Correct answer: B. Its local gateway's IPv4 address

The destination is off-subnet, so the host needs the MAC of its locally reachable next hop.

routing-medium-4 · A host reaches its gateway but not a remote subnet. What is the next useful evidence?
  1. Route and policy information beyond the local hop
  2. Only whether the cable is plugged in
  3. Only the link LED
  4. Only the hostname's capitalization

Correct answer: A. Route and policy information beyond the local hop

Gateway reachability narrows the fault beyond the tested local exchange. Routing, return paths, and policy still need inspection.

routing-medium-5 · A router has a route to the server subnet, but the server's gateway points elsewhere. Why might replies fail?
  1. The forward route guarantees return delivery
  2. DNS fixes return routing automatically
  3. Ethernet frames remember every hop
  4. The return path may be incorrect

Correct answer: D. The return path may be incorrect

Reply packets make their own forwarding decisions. A wrong gateway can break the return direction despite a correct forward route.

routing-medium-6 · A traceroute shows two responding hops followed by timeouts. What is justified?
  1. Later probes lack replies; the last responding hop is not proven to be the failure
  2. DNS certainly failed
  3. Every later router is absent
  4. Hop 3 is certainly powered off

Correct answer: A. Later probes lack replies; the last responding hop is not proven to be the failure

Routers may suppress probe replies while forwarding traffic. Compare destination/application reachability before locating a fault.

routing-medium-7 · Routes include 10.20.5.0/24 via C and 10.20.0.0/16 via B. Destination 10.20.6.8 uses which?
  1. Neither because both begin with 10
  2. C
  3. B
  4. Both equally

Correct answer: C. B

The /24 covers only third-octet value 5. Destination .6 is covered by the /16 but not that /24.

routing-medium-8 · Host 10.1.1.20/24 has gateway 10.1.2.1. What should be corrected first in an ordinary design?
  1. DNS TTL
  2. TCP window size
  3. The remote server certificate
  4. Gateway reachability within the host subnet

Correct answer: D. Gateway reachability within the host subnet

The configured next hop is outside the ordinary directly connected /24. Fix the local address/gateway design before remote diagnosis.

routing-medium-9 · A router forwards a packet from one Ethernet link to another. Which fields change normally?
  1. The DNS hostname inside every packet
  2. The final destination IP always
  3. The application password
  4. Link-layer source/destination MACs and IP TTL

Correct answer: D. Link-layer source/destination MACs and IP TTL

Routing builds a new link-layer frame and decrements TTL. Destination IP usually stays unchanged unless translation or other processing applies.

routing-medium-10 · A route is installed but its next-hop interface is down. What must be verified?
  1. Whether the route remains usable or is removed from effective forwarding
  2. Only the route's text label
  3. Only DNS spelling
  4. Only lease duration

Correct answer: A. Whether the route remains usable or is removed from effective forwarding

Configured routes and effective forwarding state can differ. Interface and next-hop dependencies determine usability.

routing-medium-11 · Two paths to the same prefix are learned by one routing protocol. What evidence selects the preferred path?
  1. That protocol's path-selection rules and metrics
  2. The largest client MAC
  3. The alphabetic interface name alone
  4. A comparison with an unrelated DNS TTL

Correct answer: A. That protocol's path-selection rules and metrics

Metrics have meaning within the protocol's rules. Do not assume values from unrelated mechanisms are directly comparable.

routing-medium-12 · A PC reaches remote services by IP but fails by hostname. What is the best first hypothesis?
  1. Every remote server is offline
  2. Name-resolution failure rather than a universal default-route failure
  3. No routing works
  4. Its link is down

Correct answer: B. Name-resolution failure rather than a universal default-route failure

Successful remote IP traffic demonstrates a tested routed path. Examine the resolver and records for the name-dependent failure.

Medium explained questions · 13–25

Combine the configuration with the symptom before selecting a decision. These 13 questions are 13–25 of the medium set.

routing-medium-13 · A more specific /32 route points to an old VPN while the default points to the working LAN gateway. Which controls that one destination?
  1. The route with the shortest prefix
  2. The matching /32 if it remains installed and usable
  3. The DNS server always
  4. The default because it is newer

Correct answer: B. The matching /32 if it remains installed and usable

A stale host route can divert a single destination. Specificity is not a guarantee that the selected path is healthy.

routing-medium-14 · The router can ping a server but a LAN client cannot. What extra dependency should be examined?
  1. Only the router's power supply
  2. Only fiber connector type
  3. Only the server's name length
  4. Client path, source-specific policy, and server return route

Correct answer: D. Client path, source-specific policy, and server return route

Router-originated traffic may use a different source/interface than client traffic. Its success does not prove the entire client exchange.

routing-medium-15 · An ACL denies TCP 443 but permits ICMP to a server. Which result is expected?
  1. The Ethernet link must go down
  2. DNS must stop resolving
  3. Ping may succeed while HTTPS fails
  4. HTTPS must succeed if ping works

Correct answer: C. Ping may succeed while HTTPS fails

Protocol-specific policy can separate these outcomes. A ping is not an application-port test.

routing-medium-16 · A network uses private IPv4 clients and no upstream private-route support. What may enable ordinary Internet access?
  1. A larger local broadcast domain alone
  2. A longer SSID
  3. A correctly configured NAT boundary and permitted route
  4. Changing MAC vendors

Correct answer: C. A correctly configured NAT boundary and permitted route

NAT can map private sources to routable addressing. Routes and firewall policy must also support the exchange.

routing-medium-17 · A router advertises a summary covering an unused subnet. What risk should be considered?
  1. The summary guarantees all hosts exist
  2. DNS creates the missing LAN
  3. The cable becomes longer
  4. Traffic to the unused range may be attracted without a real delivery path

Correct answer: D. Traffic to the unused range may be attracted without a real delivery path

Summaries describe ranges, including potentially unused space. The forwarding design must handle uncovered destinations intentionally.

routing-medium-18 · A host's local route is /24; a static /32 points one local address through another gateway. Which is selected?
  1. The /24 because it is connected
  2. The DNS answer's TTL
  3. The default automatically
  4. The /32 host route

Correct answer: D. The /32 host route

Among installed matching routes, /32 is more specific. Intentional exceptions can change normal on-link behavior.

routing-medium-19 · A remote service times out but the gateway replies in 1 ms. What does the low gateway latency not establish?
  1. The local path supported ICMP
  2. The gateway was reachable in that test
  3. Low latency to the remote service
  4. A local reply happened

Correct answer: C. Low latency to the remote service

A short local test cannot establish delay or capacity along the entire remote path.

routing-medium-20 · A subnet has two routers but hosts use only gateway A; A fails without a redundancy mechanism. What happens normally?
  1. Those hosts may lose off-subnet connectivity until their gateway path changes
  2. They automatically use B merely because it exists
  3. Local MAC learning always chooses B
  4. DNS turns B into A

Correct answer: A. Those hosts may lose off-subnet connectivity until their gateway path changes

A second router is not automatic gateway failover. Hosts need a supported virtual gateway, configuration change, or other intentional mechanism.

routing-medium-21 · A traceroute hop shows high response time but later hops and destination are fast. What interpretation is reasonable?
  1. The destination cannot be reachable
  2. That hop proves an end-to-end bottleneck
  3. The hop may de-prioritize probe responses without delaying transit traffic similarly
  4. DNS is the only possible cause

Correct answer: C. The hop may de-prioritize probe responses without delaying transit traffic similarly

Intermediate response processing differs from packet forwarding. Persistent delay continuing downstream is stronger path evidence.

routing-medium-22 · A firewall drops return packets for a session. What will a correct forward route alone fail to provide?
  1. A destination prefix match
  2. An outbound packet attempt
  3. A local next-hop selection
  4. A completed bidirectional exchange

Correct answer: D. A completed bidirectional exchange

Session success requires allowed return traffic as well as forwarding. The route table cannot prove stateful policy is correct.

routing-medium-23 · A directly connected 10.0.0.0/24 and default route coexist. Which handles 10.0.0.44 without an overriding host route?
  1. DNS forwarding
  2. The default
  3. The connected /24
  4. A random route

Correct answer: C. The connected /24

The connected /24 is the more specific matching route. Default is a fallback for other destinations.

routing-medium-24 · A destination is reachable using a temporary static route but not the normal learned route. What should be investigated?
  1. The normal route's next hop and path-selection state
  2. Only the hostname's spelling
  3. Only the local NIC speed
  4. Only the DHCP lease length

Correct answer: A. The normal route's next hop and path-selection state

The controlled path change supports a routing-path hypothesis. Record the temporary route and inspect the intended route rather than leaving an undocumented workaround.

routing-medium-25 · A /16 route points toward a router that lacks one included /24. What can happen to that /24 traffic?
  1. Layer 2 flooding spans the Internet
  2. DNS must repair it
  3. It may reach that router and then be dropped or misrouted
  4. The /16 creates the missing downstream route automatically

Correct answer: C. It may reach that router and then be dropped or misrouted

Each router needs its own usable forwarding decision. An upstream matching route does not prove downstream reachability.

Hard explained questions · 1–12

State what the evidence proves and reject conclusions that reach beyond it. These 12 questions are 1–12 of the hard set.

routing-hard-1 · Routes: 10.0.0.0/8 metric 1 via A; 10.4.0.0/16 metric 200 via B. Destination 10.4.8.9. Which installed route is used?
  1. Default regardless of prefix
  2. /8 via A because metric 1 is lower
  3. DNS selects the path
  4. /16 via B

Correct answer: D. /16 via B

Longest prefix is evaluated across matching installed routes. A lower metric on a less specific prefix does not override the /16 match.

routing-hard-2 · Routes: 192.168.0.0/16 via A; 192.168.7.0/24 via B; 192.168.7.22/32 via C. Which serves .7.23?
  1. All three equally
  2. A
  3. B
  4. C

Correct answer: C. B

The /32 matches only .22. For .23, the /24 is the longest matching prefix.

routing-hard-3 · A client reaches its gateway and router R reaches the server using its WAN source; client traffic times out. What should be checked first?
  1. Return routing and policy for the client's source subnet
  2. Assume the server is universally down
  3. Delete all specific routes
  4. Replace the client's cable without further evidence

Correct answer: A. Return routing and policy for the client's source subnet

Different source addresses can follow different policy and return paths. Router-originated success does not validate LAN-client traffic.

routing-hard-4 · A packet loops between routers with opposing default routes for an unknown prefix. What mechanism eventually bounds it?
  1. DHCP lease expiration
  2. DNS TTL expiration
  3. MAC aging alone
  4. TTL or hop-limit expiration

Correct answer: D. TTL or hop-limit expiration

Layer 3 hop count is reduced at each forwarding router. DNS and lease timers do not govern packet lifetime.

routing-hard-5 · An ACL allows requests from VLAN 10 to a server, but the server replies through a second firewall lacking session state. What issue is plausible?
  1. The Ethernet frame retains the original gateway MAC across every hop
  2. Asymmetric routing interacts with stateful filtering
  3. DNS must have duplicate names
  4. The subnet broadcast is too large

Correct answer: B. Asymmetric routing interacts with stateful filtering

An asymmetric return path can encounter a stateful device that did not observe the initiating traffic. Verify routing and state, not just static allow rules.

routing-hard-6 · A VPN installs 0.0.0.0/1 and 128.0.0.0/1, while LAN default /0 remains. Which paths cover general IPv4 Internet destinations?
  1. DNS chooses between them
  2. The LAN /0 because one default is enough
  3. Neither because /1 is invalid
  4. The VPN /1 routes if usable

Correct answer: D. The VPN /1 routes if usable

The two /1 routes collectively cover IPv4 and each is more specific than /0. More specific exceptions may still override them.

routing-hard-7 · A router has a summary 10.8.0.0/16 to R2 and a 10.8.5.0/24 to a discard interface. Destination 10.8.5.10 goes where?
  1. Every connected interface
  2. DNS
  3. The specific discard route
  4. R2 because summaries override details

Correct answer: C. The specific discard route

The /24 is the longest match even though its action is discard. Route selection is not a guarantee of successful delivery.

routing-hard-8 · A host is 192.168.1.10/16 but the LAN is intended /24. It cannot reach 192.168.2.20 through the gateway. Why?
  1. The gateway must have a public address
  2. A /16 always disables ARP
  3. DNS cannot resolve private hosts
  4. It may ARP locally for a destination that should be routed

Correct answer: D. It may ARP locally for a destination that should be routed

The overly broad mask creates an on-link classification. Correct the host mask rather than adding unrelated name-service workarounds.

routing-hard-9 · Traceroute times out from hop 4 onward, but HTTPS to the destination succeeds repeatedly. What is the strongest conclusion?
  1. The destination is offline
  2. Probe responses are limited; the tested application path still works
  3. All timed-out hops are absent
  4. Routing is completely broken at hop 4

Correct answer: B. Probe responses are limited; the tested application path still works

Successful application exchanges refute a universal forwarding outage. Probe filtering or response behavior can explain the trace.

routing-hard-10 · A route to a remote subnet exists, but ARP for its local next hop repeatedly goes unanswered. What should be investigated first?
  1. Local next-hop reachability and interface/VLAN attachment
  2. Only remote DNS records
  3. Only the route metric
  4. Only the destination's browser

Correct answer: A. Local next-hop reachability and interface/VLAN attachment

The router cannot deliver the next-link frame without a reachable neighbor. A route entry alone cannot overcome this local dependency.

routing-hard-11 · Gateway redundancy uses a virtual IP/MAC, but hosts were configured with one router's physical IP. What risk remains?
  1. The MAC table creates gateway redundancy
  2. They always follow the virtual IP anyway
  3. They may not benefit from virtual-gateway failover
  4. DNS automatically redirects the gateway

Correct answer: C. They may not benefit from virtual-gateway failover

Failover depends on hosts using the intended shared next-hop identity. A physical address may still fail with its router.

routing-hard-12 · An installed /24 route has a next hop reachable only through another route. What should be checked in addition to the destination match?
  1. Recursive next-hop resolution and actual forwarding interface
  2. Only the DNS suffix
  3. Only cable labels
  4. Only the user's account

Correct answer: A. Recursive next-hop resolution and actual forwarding interface

Some platforms resolve next hops recursively. A matching destination route must resolve to a usable forwarding adjacency.

Hard explained questions · 13–25

State what the evidence proves and reject conclusions that reach beyond it. These 13 questions are 13–25 of the hard set.

routing-hard-13 · A firewall shows outbound SYNs and no returning SYN-ACKs; ICMP works. Which next test is best?
  1. Check TCP service/listener, port policy, and return traffic at the server side
  2. Change the mask to /8
  3. Replace all access switches
  4. Conclude DNS failed despite using the IP

Correct answer: A. Check TCP service/listener, port policy, and return traffic at the server side

Protocol-specific evidence narrows the failure beyond general ICMP reachability. Capture or logs near the server can distinguish silence, refusal, and blocked return.

routing-hard-14 · A NAT gateway has a route and link but translation resources are exhausted during peak load. What can happen?
  1. The gateway's subnet must disappear
  2. Every local frame stops existing
  3. New sessions can fail despite basic link and route health
  4. DNS TTL becomes negative

Correct answer: C. New sessions can fail despite basic link and route health

NAT state is an additional dependency for translated sessions. Interface and route health do not establish available translation capacity.

routing-hard-15 · A router's route lookup selects interface B, but firewall logs show a deny on B. What is the justified claim?
  1. DNS selected interface B
  2. The physical cable is proven broken
  3. Routing selected a path, but policy prevented the tested traffic
  4. The destination is proven reachable

Correct answer: C. Routing selected a path, but policy prevented the tested traffic

Forwarding selection and authorization are distinct. The denial explains why the selected path did not complete this exchange.

routing-hard-16 · A route added for 10.20.0.0/16 restores one host but blackholes another subnet inside that range. What should be reviewed?
  1. Only the first host's keyboard
  2. Only switch power
  3. Whether the broad route overcaptures destinations with different intended paths
  4. Only DNS cache size

Correct answer: C. Whether the broad route overcaptures destinations with different intended paths

A broad prefix can redirect more destinations than the original target. Check affected subnets and use precise routing where appropriate.

routing-hard-17 · Two routes have identical prefix length but come from different routing sources. What rule should be consulted before comparing their numeric metrics?
  1. Always choose the smallest metric across every protocol
  2. The platform's route-source preference and each protocol's selection rules
  3. Choose by DNS order
  4. Always choose the longest interface name

Correct answer: B. The platform's route-source preference and each protocol's selection rules

Metrics across protocols are not generally on one common scale. Route-source preference can decide which candidate becomes installed.

routing-hard-18 · A client receives a redirect to another router on its LAN. What should an administrator evaluate?
  1. Whether all routes are host routes
  2. The intended next-hop topology and redirect trust/policy
  3. Whether DNS now uses TCP
  4. Whether the cable became fiber

Correct answer: B. The intended next-hop topology and redirect trust/policy

Redirect behavior concerns local routing optimization and trust. Verify the architecture rather than treating an unsolicited suggestion as proof of a safe path.

routing-hard-19 · A server's reply leaves through a gateway with no route to the client's private subnet. What does the outbound request prove insufficiently?
  1. The client sent a packet
  2. The request path does not prove the reply path
  3. The request contained an IP destination
  4. The server received some traffic

Correct answer: B. The request path does not prove the reply path

Reply forwarding depends on the server-side network's routing and policy. Diagnose both directions.

routing-hard-20 · A route table screenshot is from yesterday, while current forwarding fails after a WAN change. What evidence is required?
  1. Only a DNS TTL from last week
  2. Current effective routes, next-hop state, and matching traffic tests
  3. Only yesterday's table because routes never change
  4. Only the router model name

Correct answer: B. Current effective routes, next-hop state, and matching traffic tests

Time matters: configuration, learned routes, and interface state can change. Use current evidence for the current failure.

routing-hard-21 · A router pings the server from one source interface successfully but fails when using the client-facing source. What has the comparison isolated?
  1. Source-dependent routing or policy behavior
  2. A DNS spelling error
  3. A broken cable for all sources
  4. A universal server outage

Correct answer: A. Source-dependent routing or policy behavior

The destination and device stay fixed while source changes. Compare return routes and source-specific filtering for the failing subnet.

routing-hard-22 · A link failure removes a /24 route; the remaining /16 points to an unintended path. What behavior is plausible?
  1. The /16 can never match
  2. Traffic must stop because all /24s require DNS
  3. MAC tables choose the old /24
  4. Traffic falls back to the less specific matching /16

Correct answer: D. Traffic falls back to the less specific matching /16

When the more specific route disappears, a broader usable route can match. Verify whether that fallback is intended and functional.

routing-hard-23 · Routes include 10.0.0.0/8 via A, 10.64.0.0/10 via B, and 10.64.8.0/24 via C. Destination 10.100.1.1 uses which?
  1. C
  2. A
  3. B
  4. None

Correct answer: C. B

10.64.0.0/10 spans second-octet values 64–127. It matches 100 and is more specific than /8; the /24 does not match.

routing-hard-24 · A packet reaches the server but the reply is lost. Captures show the server replies with a gateway MAC on the correct local VLAN. What remains unproven?
  1. That the original request arrived
  2. That local encapsulation selected a next hop
  3. That the server sent a reply
  4. Downstream return forwarding and policy beyond that first hop

Correct answer: D. Downstream return forwarding and policy beyond that first hop

A first-hop reply capture establishes local transmission only. Follow the return path to locate the next missing observation.

routing-hard-25 · A technician changes gateway, DNS, and firewall rules at once, restoring access. What should the report say?
  1. The firewall was proven innocent
  2. DNS was definitely the only cause
  3. The gateway was proven defective
  4. The combined change restored service; the exact responsible dependency is not isolated

Correct answer: D. The combined change restored service; the exact responsible dependency is not isolated

Multiple simultaneous changes weaken causal diagnosis. Document each change and verify intended configuration and policy.

Once you can select a route, practice choosing the command output that verifies its dependencies in AP Networking CLI Command Output Troubleshooting Practice Test. Its 75 explained questions add a separate Easy, Medium, and Hard diagnostic for that next reasoning step.

Use the result to choose your next study step

Treat traceroute as a set of probe responses. Timeouts may reflect filtering or response suppression while forwarding continues. If the actual HTTPS connection succeeds, do not diagnose a universal outage at the first silent hop. Correlate current route state, captures, and application tests before assigning a failure boundary.

Record whether each miss concerned route selection, next-hop evidence, return path. Copy one decisive observation and one rejected inference into your error log. Then review the focused supporting resource, explain a missed item without its options, and retry the relevant level after a separate study session.

For course-level transfer, move to Unit 3 practice, Unit 4 practice. When the topic labels no longer guide your answer, use full practice exams and artifact analysis to combine selection, evidence, and explanation.

Teacher use

Assign one level as a diagnostic, collect explanations for two missed items, and group students by the missing step rather than total score alone. Ask pairs to compare a correct conclusion with a tempting overclaim. Do not treat repeated exposure to the same answer as independent evidence of mastery.

Once the route and transport path work, a website can still fail its identity or trust checks. Continue with the HTTPS, TLS, and certificate test to distinguish those later failures from the routing evidence assessed here.