CCNAv7: Introduction to Networking - ITN (Version 7.00) - ITNv7 Practice Leaving Exam
1. What two acronyms represent the sublayers of the data link that Ethernet relies on? (Choose two.)
- SFD
- GMBH
- CSMA
- MAC
- FCS
Explanation:For Layer 2 functions, Ethernet relies on Logical Link Control (LLC) and MAC sublayers to operate at the data link layer. FCS (Frame Check Sequence) and SFD (Start Frame Delimiter) are fields of the Ethernet frame. CSMA (Carrier Sense Multiple Access) is the technology that Ethernet uses to manage access to shared media.
2. A network team compares topologies for connection on a shared medium. What physical topology is an example of a hybrid topology for a LAN?
- Bus
- extended star
- Ring
- Teilgitter
Explanation:An extended star topology is an example of a hybrid topology because additional switches connect to other star topologies. A partial mesh topology is a common hybrid WAN topology. Bus and ring are not hybrid topology types.
3. Refer to the exhibition. PC1 issues an ARP request because it needs to send a packet to PC3. What will happen next in this scenario?
- SW1 sends an ARP reply with its Fa0/1 MAC address.
- RT1 sends an ARP reply with its own Fa0/0 MAC address.
- RT1 forwards the ARP request to PC3.
- RT1 sends an ARP reply with the PC3 MAC address.
- RT1 sends an ARP reply with its own Fa0/1 MAC address.
Explanation:When a network device needs to communicate with a device on another network, it sends an ARP request and asks for the default gateway MAC address. The default gateway (RT1) unicasts an ARP response with the Fa0/0 MAC address.
4. A network administrator issues the login lock for 180 attempts 2 within 30 commands on a router. What threat is the network administrator trying to prevent?
- a user trying to guess a password to access the router
- a worm trying to access another part of the network
- an unidentified person attempting to access the network equipment room
- a device attempting to inspect traffic on a link
Explanation:The "Login lock - for 180 attempts 2 within 30" command causes the device to block authentication after 2 unsuccessful attempts within 30 seconds for a duration of 180 seconds. A device examining traffic on a link has nothing to do with the router. The router configuration cannot prevent unauthorized access to the equipment room. A worm would not attempt to access the router to spread to another part of the network.
5. Which statement describes the properties of packet filtering and stateful firewalls in relation to the OSI model?
- A packet-filtering firewall uses session-layer information to track the status of a connection, while a stateful firewall uses application-layer information to track the status of a connection.
- Both stateful and packet filter firewalls can filter at the application level.
- A packet-filtering firewall can typically filter down to the transport layer, while a stateful firewall can filter down to the session layer.
- A stateful firewall can filter application-layer information, while a packet-filtering firewall cannot filter beyond the network layer.
Explanation:Firewalls with packet filtering can always filter Layer 3 content and sometimes TCP and UDP based content. Stateful firewalls monitor connections and therefore must be able to support up to the session layer of the OSI model.
6. What are two ways to protect a computer from malware? (Choose two.)
- Clear the browser cache.
- Use antivirus software.
- Delete unused software.
- Keep software up to date.
- Defragment the hard drive.
Explanation:A computer should at least use antivirus software and have all software up to date to protect against malware.
7. Ciscoville employees and residents do not have access to the Internet or other remote web-based services. IT pros quickly find that the city's firewall is flooded with so much traffic that the connection to the Internet is lost. What kind of attack is being launched in Ciscoville?
- Access
- Trojan horse
- enlightenment
- Of the
Explanation:A Denial of Service (DoS) attack prevents authorized users from using one or more computing resources.
8. Which two statements describe the properties of fiber optic cabling? (Choose two.)
- Fiber optic cables do not conduct electricity.
- Multimode fiber optic cables carry signals from multiple transmitting devices.
- Fiber optic cabling is mainly used as backbone cabling.
- Fiber optic cables use LEDs for singlemode cables and laser technology for multimode cables.
- Fiber optic cables have high signal loss.
Explanation:Fiber optic cables are primarily used for high-traffic backbone cabling and do not conduct electricity. Multimode fiber uses LEDs for signaling and singlemode fiber uses laser technology. Fiber optic cables only carry signals from one device to another.
9. Which OSI physical layer term describes the rate of transfer of bits over a medium over a period of time?
- latency
- well off
- throughput
- bandwidth
10. Relate to the exhibition. What is the maximum possible data throughput between PC and server?
- 10 MB/s
- 1000 MB/s
- 128 KB/s
- 100 MB/s
Explanation:The maximum throughput between any two nodes in a network is determined by the slowest link between those nodes.
11. Match the description to the media. (Not all options are used.)
Explanation:UTP cables are used in wired office environments. Coaxial cables are used to connect cable modems and televisions. Optical fibers are used for high transmission speeds and to transmit data over long distances. STP cables are used in environments where there is a lot of interference.
12. A client packet is received from a server. The packet has destination port number 22. What service is the client requesting?
- SSH
- TFTP
- DHCP
- DNS
2. Refer to the exhibition. What does the window size value indicate?
- the amount of data that can be sent at one time
- the amount of data that can be sent before an acknowledgment is required
- the total number of bits received during this TCP session
- a random number used when establishing a connection with the 3-way handshake
Explanation:The window size determines the number of bytes that can be sent before an acknowledgment is expected. The acknowledgment number is the number of the next expected byte.
13. Which TCP port group does port 414 belong to?
- very famous
- private or dynamic
- public
- registered
Explanation:Known ports: 0 to 1023.
Registered ports: 1024 to 49151.
Dynamic/Private: 49152 to 65535.
14. Relate to the exhibition. An administrator attempts to configure the switch but receives the error message shown in the exhibit. What is the problem?
- The entire command, configure terminal, must be used.
- The administrator is already in global configuration mode.
- The administrator must first enter the privileged EXEC mode before issuing the command.
- The administrator must connect through the console port to access the global configuration mode.
Explanation:To enter global configuration mode, enter the configure terminal command or a shortened version like config t from privileged EXEC mode. In this scenario, the administrator is in user EXEC mode, indicated by the > symbol after the hostname. The administrator would need to use the enable command to switch to privileged EXEC mode before entering the configure terminal command.
15. What is a user trying to determine when issuing a ping 10.1.1.1 command on a PC?
- if the TCP/IP stack works on the PC without putting any traffic on the wire
- whether there is a connection with the target device
- the path that traffic will take to reach the destination
- what type of device is at the destination
Explanation:The ping destination command can be used to test connectivity.
16. What is a characteristic of a Virtual Switch Interface (SVI)?
- An SVI is created in software and requires a configured IP address and subnet mask to allow remote access to the switch.
- Although it is a virtual interface, physical hardware must be present on the device connected to it.
- For SVIs, the no shutdown command does not need to be enabled.
- SVIs are preconfigured on Cisco switches.
Explanation:Cisco IOS Layer 2 switches have physical ports for devices to connect to. These ports do not support Layer 3 IP addresses. Therefore, switches have one or more virtual switch interfaces (SVIs). These are virtual interfaces because there is no physical hardware on the device connected to them. An SVI is created in software.
The virtual interface allows you to remotely manage a switch over an IPv4 and IPv6 network. Each switch ships with an SVI that appears out-of-the-box in the default configuration. The default SVI is the VLAN1 interface.
17. Match the descriptions to the terms. (Not all options are used.)
Explanation:A GUI, or graphical user interface, allows the user to interact with the operating system by pointing and clicking on items on the screen. A CLI, or command line interface, requires users to enter commands at a command prompt to interact with the operating system. The shell is the part of the operating system that is closest to the user. The kernel is the part of the operating system that interfaces with the hardware.
18. What if a switch receives a frame and the calculated CRC value is different than the value in the FCS field?
- The switch notifies the source of the bad frame.
- The switch places the new CRC value in the FCS field and forwards the frame.
- The switch drops the frame.
- The switch floods the frame to all ports except the port through which the frame arrived to notify the hosts of the error.
Explanation:The purpose of the CRC value in the FCS field is to determine if the frame contains errors. If the frame has errors, the switch discards the frame.
19. Two network engineers discuss methods of forwarding frames through a switch. What is an important concept related to the cut-through switching method?
- Fragment-free switching offers the lowest latency.
- Fast-forward switching can be viewed as a compromise between store-and-forward switching and fragment-free switching.
- Fragment-free switching is the typical cut-through switching method.
- Packets can be forwarded with errors when fast-forward switching is used.
Explanation:Fast-forward switching offers the lowest latency and is the typical cut-through switching method. Fragment-free switching can be viewed as a compromise between store-and-forward switching and fast-forward switching. Because fast-forward switching begins forwarding before the entire packet has been received, packets may be forwarded with errors.
20. Which two problems can cause both runts and giants in Ethernet networks? (Choose two.)
- Using the wrong cable type
- Half duplex operation
- a faulty network card
- electrical interference on serial interfaces
- CRC error
Explanation:Because collisions are a normal aspect of half-duplex communications, runt and giant frames are common by-products of these operations. A faulty NIC can also place frames on the network that are either too short or longer than the maximum allowed length. CRC errors can be caused by using the wrong type of cable or by electrical interference. Using a cable that's too long can result in late-stage collisions rather than dwarfs and behemoths.
21. What two functions are performed on the LLC sublayer of the OSI data link layer to facilitate Ethernet communications? (Choose two.)
- implements CSMA/CD over legacy half-duplex shared media
- allows IPv4 and IPv6 to share the same physical medium
- integrates Layer 2 flows between 10 Gigabit Ethernet over fiber and 1 Gigabit Ethernet over copper
- implements a process for delimiting fields within an Ethernet-2 frame
- inserts information into the Ethernet frame that identifies what network layer protocol is encapsulated by the frame
different case
- responsible for the internal structure of the Ethernet frame
- applies source and destination MAC addresses to Ethernet frames
- integrates Layer 2 flows between 10 Gigabit Ethernet over fiber and 1 Gigabit Ethernet over copper
- allows IPv4 and IPv6 to share the same physical medium
- handles the communication between the upper layer network software and the Ethernet NIC hardware
different case
- adds Ethernet control information to network protocol data
- responsible for the internal structure of the Ethernet frame
- implements trailer with frame check sequence for error detection
- allows IPv4 and IPv6 to share the same physical medium
- applies source and destination MAC addresses to Ethernet frames
different case
- implements CSMA/CD over legacy half-duplex shared media
- adds Ethernet control information to network protocol data
- inserts information into the Ethernet frame that identifies what network layer protocol is encapsulated by the frame
- applies source and destination MAC addresses to Ethernet frames
- integrates Layer 2 flows between 10 Gigabit Ethernet over fiber and 1 Gigabit Ethernet over copper
Explanation:The data link layer is actually divided into two sublayers:
+ Logical Link Control (LLC): This upper sub-layer defines the software processes that provide services for the network layer protocols. It places information in the frames that identifies which network layer protocol is used for the frame. This information allows multiple Layer 3 protocols, such as IPv4 and IPv6, to share the same network interface and media.
+ Media Access Control (MAC): This lower sub-layer defines the media access processes performed by the hardware. It provides addressing and data link layer delineation according to the physical signaling requirements of the medium and the type of data link layer protocol used.
22. Which two commands can be used to verify that DNS name resolution is working properly on a Windows PC? (Choose two.)
- nslookup cisco.com
- ping cisco.com
- ipconfig /flushdns
- net cisco.com
- nbtstat cisco.com
Explanation:The ping command tests the connection between two hosts. When ping uses a host's domain name to test the connection, the resolver on the PC first performs name resolution to query the DNS server for the host's IP address. If the ping command cannot resolve the domain name to an IP address, an error is returned.
Nslookup is a tool for testing and troubleshooting DNS servers.
23. A small advertising company has a web server that provides important business services. The company connects to the Internet through a leased line service with an ISP. Which approach best provides cost-effective redundancy for Internet connectivity?
- Add a second network card to the web server.
- Add a connection to the Internet via a DSL line to another ISP.
- Add another web server to prepare for failover support.
- Add multiple links between the switches and the edge router.
Explanation:With a separate DSL connection to another ISP, the company has a redundancy solution for the Internet connection should the dedicated line fail. The other options offer other aspects of redundancy but not the internet connection. The options to add a second NIC and add multiple links between the switches and the edge router provide redundancy in case a NIC fails or a link between the switches and the edge router fails. The ability to add another web server provides redundancy if the main web server fails.
24. Only employees connected to IPv6 interfaces have difficulty connecting to remote networks. The analyst wants to verify that IPv6 routing has been enabled. What is the best command to complete the task?
- kopiere running-config startup-config
- show interfaces
- Show IP NAT translations
- show running configuration
25. Relate to the exhibition. A network administrator connects a new host to the registrar LAN. The host needs to communicate with remote networks. What IP address would be configured as the default gateway on the new host?
Floor(config)# interface gi0/1 Floor(config-if)# description Connects to the registrar's LAN Floor(config-if)# ip address 192.168.235.234 255.255.255.0 Floor(config-if)# no shutdown Floor (config-if)# interface gi0/0 Floor(config-if)# description Connects to manager LAN Floor(config-if)# ip address 192.168.234.114 255.255.255.0 Floor(config-if)# no shutdown Floor(config-if) # interface s0/0/0 Floor(config-if)# description Connects to ISP Floor(config-if)# ip address 10.234.235.254 255.255.255.0 Floor(config-if)# no shutdown Floor (config-if)# Interface s0/0/1 Floor(config-if)# Description Establishes a connection to the central WAN Floor(config-if)# IP address 203.0.113.3 255.255.255.0 Floor(config-if) # no shutdown Floor(config-if) # end
- 192.168.235.234
- 203.0.113.3
- 192.168.235.1
- 10.234.235.254
- 192.168.234.114
26. Map the command to the device mode in which the command is entered. (Not all options are used.)
Explanation:The release command is entered in R1> mode. The login command is entered in R1(config-line)# mode. The copy running-config startup-config command is entered in R1# mode. The IP address 192.168.4.4 255.255.255.0 command is entered in R1(config-if)# mode. The service password encryption command is entered in global configuration mode.
27. A router boots up and enters setup mode. What is the reason for that?
- The IOS image is corrupt.
- Cisco IOS is missing from flash memory.
- The configuration file is missing from NVRAM.
- The POST process detected a hardware error.
Explanation:The startup configuration file is stored in NVRAM and contains the commands required to initially configure a router. It also creates the running configuration file that is stored in RAM.
28. What service does POP3 provide?
- Retrieves emails from the server by downloading the email to the client's local email application.
- An application that allows real-time chats between remote users.
- Allows remote access to network devices and servers.
- Uses encryption to provide secure remote access to network devices and servers.
29. Two students work on a network design project. One student draws while the other student writes the proposal. The drawing is finished and the student wants to share the folder with the drawing so the other student can access the file and copy it to a USB drive. Which network model is used?
- Peer-To-Peer
- Client based
- master-slave
- point to point
Explanation:In a peer-to-peer (P2P) network model, data is exchanged between two network devices without using a dedicated server.
30. What command is used to manually query a DNS server to resolve a specific hostname?
- Tracert
- ipconfig /displaydns
- nslookup
- network
Explanation:The nslookup command was created to allow a user to manually query a DNS server to resolve a specific hostname. The ipconfig /displaydns command only displays previously resolved DNS records. The tracert command was created to examine the path taken by packets as they traverse a network and can resolve a hostname by automatically querying a DNS server. The net command is used to manage network computers, servers, printers, and network drives.
31. What PDU is processed when a host computer decapsulates a message at the transport layer of the TCP/IP model?
- Bits
- frame
- Package
- Segment
Explanation:At the transport layer, a host computer decapsulates a segment to reassemble data into an acceptable format through the application layer protocol of the TCP/IP model.
32. Which two layers of the OSI model have the same functionality as two layers of the TCP/IP model? (Choose two.)
- Data Connection
- network
- physically
- meeting
- Transport
Explanation:The OSI transport layer is functionally equivalent to the TCP/IP transport layer, and the OSI network layer is equivalent to the TCP/IP Internet layer. The OSI data link and physical layers together correspond to the TCP/IP network access layer. The OSI session layer (with the presentation layer) is contained in the TCP/IP application layer.
33. Which three layers of the OSI model are functionally comparable to the application layer of the TCP/IP model? (Choose three.)
- presentation
- physically
- network
- Data Connection
- Transport
- Application
- meeting
Explanation:
The TCP/IP model consists of four layers: Application, Transport, Internet, and Network Access. The OSI model consists of seven layers: Application, Presentation, Session, Transport, Network, Data Link, and Physical. The top three layers of the OSI model: application, presentation and session are mapped to the application layer of the TCP/IP model.
34. Which destination address is used in an ARP request frame?
- 0.0.0.0
- 255.255.255.255
- the physical address of the target host
- FFFF.FFFF.FFFF
- AAAA.AAAA.AAAA
Explanation:
The purpose of an ARP request is to find the MAC address of the target host on an Ethernet LAN. The ARP process sends a Layer 2 broadcast to all devices on the Ethernet LAN. The frame contains the IP address of the destination and the broadcast MAC address FFFF.FFFF.FFFF. The host with the IP address that matches the IP address in the ARP request responds with a unicast frame containing the host's MAC address. Thus, the original sending host gets the destination IP and MAC address pair to continue the encapsulation process for data transmission.
35. A network engineer enters the command ping 127.0.0.1 at a computer command prompt. What is the technician trying to achieve?
- Ping a host computer with IP address 127.0.0.1 on the network
- Tracing the path to a host computer on the network and the network has an IP address of 127.0.0.1
- Check the IP address on the network card
- Testing the integrity of the TCP/IP stack on the local computer
Explanation:127.0.0.1 is a TCP/IP reserved address for testing the device's NIC, drivers, and TCP/IP implementation.
36. Although CSMA/CD is still a feature of Ethernet, why is it no longer necessary?
- the practically unlimited availability of IPv6 addresses
- the use of CSMA/CA
- the use of full-duplex capable Layer 2 switches
- the development of half-duplex switch operation
- using Gigabit Ethernet speeds
Explanation:By using Layer 2 switches operating in full-duplex mode, collisions are eliminated, eliminating the need for CSMA/CD.
37. What does a router do when it receives a Layer 2 frame over the network medium?
- re-encapsulates the packet in a new frame
- forwards the new frame appropriate for the medium of that segment of the physical network
- determines the best way
- decapsulates the frame
Explanation:Routers are responsible for encapsulating a frame with the correct format for the physical network media they connect. At each hop along the path, a router does the following: Accepts a frame from media
Decapsulates the frame
Determines the best path to forward the packet
Re-encapsulates the packet in a new frame
Forwards the new frame according to the medium of this segment of the physical network
38. Network Information:
* Local router LAN interface: 172.19.29.254 / fe80:65ab:dcc1::10
* Local router WAN interface: 198.133.219.33 / 2001:db8:FACE:39::10
* Remote-Server: 192.135.250.103
What task might a user attempt to accomplish with the ping 2001:db8:FACE:39::10 command?
- Check whether there is a connection within the local network
- Creating a network performance benchmark for a server on the company intranet
- Finding the path to reach the remote server
- check if there is a connection to the internet
39. Which two ICMP messages are used by both IPv4 and IPv6 protocols? (Choose two.)
- neighbor prompt
- Router Advertisement
- router prompt
- Protocol not available
- Route detour
Explanation:The ICMP messages that both ICMPv4 and ICMPv6 have in common include: host acknowledgment, destination (network, host, protocol, port) or service unreachable, timeout, and route redirection. Router Solicitation, Neighbor Solicitation and Router Advertisement are new protocols implemented in ICMPv6.
40. Given the network 172.18.109.0, what subnet mask would be used if 6 host bits were available?
- 255.255.192.0
- 255.255.224.0
- 255.255.255.192
- 255.255.255.248
- 255.255.255.252
Explanation:
On an IPv4 network, the subnet mask is determined by the required hosts bits:
11 host bits required - 255.255.248.0
10 host bits required - 255.255.252.0
9 host bits required - 255.255.254.0
8 host bits required - 255.255.255.0
7 host bits required - 255.255.255.128
6 host bits required - 255.255.255.192
5 host bits required - 255.255.255.224
4 host bits required - 255.255.255.240
3 host bits required - 255.255.255.248
2 host bits required - 255.255.255.252
41. Three devices are on three different subnets. Assign the network address and broadcast address to each subnet that these devices are on. (Not all options are used.)
Device 1: IP address 192.168.10.77/28 in subnet 1
Device 2: IP address 192.168.10.17/30 in subnet 2
Device 3: IP address 192.168.10.35/29 in subnet 3
Explanation:To calculate one of these addresses, write the device's IP address in binary form. Draw a line showing where subnet mask 1 ends. For example, for device 1, the last octet (77) is 01001101. The line would be drawn between 0100 and 1101 since the subnet mask is /28. Change all bits to the right of the line to 0 to find the network number (01000000 or 64). Change all bits to the right of the line to 1 to determine the broadcast address (01001111 or 79).
42. What type of address is 198.133.219.162?
- Link-local
- public
- Ribbon
- Multicast
43. What does the IP address 192.168.1.15/29 mean?
- subnet address
- Unicast-Adresse
- Multicast-Adresse
- Broadcastadresse
Explanation:A broadcast address is the last address of a particular network. This address cannot be assigned to any host and is used to communicate with all hosts on that network.
44. Why is NAT not needed in IPv6?
- Since IPv6 has security built in, there is no need to hide IPv6 addresses of internal networks
- The problems caused by NAT applications are solved as the IPv6 header improves packet handling by intermediate routers
- The end-to-end connectivity problems caused by NAT are solved as the number of routes increases with the number of nodes connected to the Internet.
- Any host or user can get a public IPv6 network address as the number of available IPv6 addresses is extremely large
Explanation:The large number of public IPv6 addresses makes NAT superfluous. Locations from the largest companies to individual households can be given public IPv6 network addresses. This avoids some of the NAT-induced application problems experienced by applications that require end-to-end connectivity.
45. Which routing table entry has a next-hop address associated with a destination network?
- directly connected routes
- local routes
- remote routes
- C and L source routes
Explanation:Routing table entries for remote routes have a next hop IP address. The next hop IP address is the address of the router interface of the next device to be used to reach the destination network. Directly connected and local routes have no next hop because they don't have to go through another router to be reached.
46. Which term describes a field in the IPv4 packet header that contains a unicast, multicast, or broadcast address?
- Destination IPv4 address
- Protocol
- TTL
- Header-Prüfsumme
47. What is the impact on communication if the default gateway is misconfigured on the host?
- There is no impact on communication.
- The host cannot communicate on the local network.
- The host can communicate with other hosts on the local network, but not with hosts on remote networks.
- The host can communicate with other hosts on remote networks, but not with hosts on the local network.
Explanation:A default gateway is only required to communicate with devices on another network. The lack of a default gateway does not affect connectivity between devices on the same local network.
48. What is the compressed format of IPv6 address fe80:0000:0000:0000:0220:0b3f:f0e0:0029?
- fe80:9ea:0:2200::fe0:290
- fe80:9ea0::2020::bf:e0:9290
- fe80::220:b3f:f0e0:29
- fe80:9ea0::2020:0:bf:e0:9290
49. Relate to the exhibition. A user issues the netstat –r command on a workstation. Which IPv6 address is one of the workstation's link-local addresses?
- ::1/128
- fe80::30d0:115:3f57:fe4c/128
- fe80::/64
- 2001:0:9d38:6ab8:30d0:115:3f57:fe4c/128
Explanation:In the IPv6 addressing scheme, the fe80::/10 network is reserved for link-local addresses. The address fe80::/64 is a network address that indicates that fe80::/64 is actually used for link-local addresses on this workstation. Thus, the address fe80::30d0:115:3f57:fe4c/128 is a valid IPv6 link-local address.
50. What kind of IPv6 address is represented by ::1/128?
- EUI-64 generates link-local
- global unicast
- not specified
- Ribbon
51. Which statement describes network security?
- It supports growth over time in accordance with approved network design practices.
- It synchronizes traffic flows using timestamps.
- It ensures sensitive corporate data is available to authorized users.
- It prioritizes data flows to give priority to delay-sensitive traffic.
52. Which two devices would be called intermediate devices? (Choose two.)
- WLAN-Controller
- Server
- Robots on the assembly line
- IPS
- game console
- Retail scanners
53. What property describes spyware?
- Software installed on a user device that collects information about the user
- using stolen credentials to access private data
- an attack that slows down or crashes a device or network service
- A network device that filters access and traffic on a network
54. Relate to the exhibition. The exhibit shows a small switched network and the contents of the switch's MAC address table. PC1 sent a frame addressed to PC3. What does the switch do with the frame?
- The switch discards the frame.
- The switch forwards the frame to all ports.
- The switch only forwards the frame to port 2.
- The switch only forwards the frame to ports 1 and 3.
- The switch forwards the frame to all ports except port 4.
Explanation:The MAC address of PC3 does not exist in the switch MAC table. Because the switch does not know where to send the frame addressed to PC3, it forwards the frame to all switch ports except port 4, the incoming port.