Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 261Question →

A network administrator is establishing an 802.1Q trunk connection between two core switches, SW-CORE-A and SW-CORE-B. The interface on SW-CORE-A is configured with a native VLAN of 20, whereas the interface on SW-CORE-B is configured with the default native VLAN of 1. Both switch interfaces explicitly allow VLANs 10, 20, and 30 across the trunk link.

Which of the following operational outcomes will occur as a result of this configuration mismatch? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Untagged frames originating from VLAN 20 on SW-CORE-A will be placed into VLAN 1 upon arrival at SW-CORE-B.; Control protocols such as CDP or PVST+ will generate native VLAN mismatch error messages in the system log.

Answer

Untagged frames originating from VLAN 20 on SW-CORE-A will be placed into VLAN 1 upon arrival at SW-CORE-B, and control protocols such as CDP or PVST+ will generate native VLAN mismatch error messages in the system log.
On an IEEE 802.1Q trunk, frames belonging to the designated native VLAN are transmitted without a 4-byte VLAN tag. When SW-CORE-A sends untagged frames for VLAN 20, SW-CORE-B receives them without a tag and assigns them to its own configured native VLAN (VLAN 1), causing unintended traffic leakage between VLAN 20 and VLAN 1. Additionally, switch discovery and spanning-tree protocols (such as CDP and PVST+) exchange control frames that detect this native VLAN mismatch, generating log warnings to alert network administrators.

Step-by-Step Solution

1
Analyze how 802.1Q trunking handles native VLAN traffic.
Frames associated with the native VLAN are sent untagged across the trunk link.
SW-CORE-A sends VLAN 20 frames untagged because VLAN 20 is set as its native VLAN.
2
Evaluate ingress behavior at the receiving switch (SW-CORE-B).
Untagged frames entering SW-CORE-B are mapped to SW-CORE-B's native VLAN (VLAN 1).
An 802.1Q switch implicitly assigns all incoming untagged frames to whichever VLAN is designated as native on that specific port.
3
Assess network management protocol reactions.
CDP/STP detect the discrepancy and log native VLAN mismatch warnings.
Protocols exchange native VLAN IDs within management frames to detect misconfigurations.

Key Concept

802.1Q Native VLAN Tagging and Mismatch Symptoms
Question 262Question →

When a network router configured as a DHCP relay agent receives an incoming DHCPDISCOVER broadcast message from a client host, how does it modify the packet header before forwarding it to a remote DHCP server?

Show answer & explanation

Answer: It sets the Gateway IP Address (GIADDR) field to the IP address of the router interface that received the broadcast.

Answer

The router sets the Gateway IP Address (GIADDR) field to the IP address of the receiving interface before forwarding the packet as a unicast message to the DHCP server.
When a router acts as a DHCP relay agent, it intercepts broadcast DHCPDISCOVER messages on a local network interface and populates the Gateway IP Address (GIADDR) field with that interface's IP address. It then unicasts the packet to the remote DHCP server, allowing the server to determine which pool of addresses to draw from based on the GIADDR subnet.

Step-by-Step Solution

1
Identify the primary role of a DHCP Relay Agent during client address discovery.
The relay agent intercepts the client's Layer 2/Layer 3 broadcast (DHCPDISCOVER) on the local subnet.
Broadcast frames cannot cross Layer 3 router boundaries without explicit relay processing.
2
Examine the packet header modifications made by the relay agent.
The relay agent records the IP address of its receiving interface into the GIADDR (Gateway IP Address) field of the DHCP message header.
The remote DHCP server uses the GIADDR value to identify the originating subnet and assign an appropriate IP address from the correct scope.
3
Determine the forwarding behavior across the network.
The router converts the client broadcast into a Layer 3 unicast packet destined for the configured DHCP server IP address, keeping the destination port as UDP port 67.
Unicast forwarding allows the packet to be routed across intermediate network subnets to reach the centralized DHCP server.

Key Concept

DHCP Relay GIADDR Field Population
Question 263Question →

A network administrator is carving out a new subnet from the IP address block 10.150.0.0/1610.150.0.0/16 for a high-density virtualization cluster. The cluster requires static IP address assignments for 250250 virtual machine hosts, 33 redundant default gateway router interfaces, and 22 out-of-band management switches. To minimize wasted address space, the administrator allocates the smallest CIDR subnet starting at network address 10.150.32.010.150.32.0 that satisfies all host requirements. Which of the following statements regarding this newly created subnet are correct? (Select TWO).

Select all that apply

Show answer & explanation

Answer: The subnet requires a /23 CIDR prefix (subnet mask 255.255.254.0) to accommodate all 255 required IP endpoints.; The IPv4 address 10.150.33.254 is a valid usable host IP address within this subnet.

Answer

The subnet requires a /23 CIDR prefix (subnet mask 255.255.254.0) to accommodate all 255 required IP endpoints, and the IPv4 address 10.150.33.254 is a valid usable host IP address within this subnet.
The scenario demands 255 usable IP addresses (250+3+2=255250 + 3 + 2 = 255). A /24 subnet provides 28=2562^8 = 256 total addresses, but subtracting the network ID and broadcast address leaves only 254254 usable host IPs, which fails to accommodate the 255 endpoints. Therefore, a /23 subnet (29−2=5102^9 - 2 = 510 usable hosts) with subnet mask 255.255.254.0 is required. Within the 10.150.32.0/2310.150.32.0/23 subnet, the address space spans from 10.150.32.010.150.32.0 (network ID) to 10.150.33.25510.150.33.255 (broadcast ID). Thus, 10.150.33.25410.150.33.254 is the last usable IP address in the range.

Step-by-Step Solution

1
Calculate total host endpoints required
250 virtual machines + 3 router interfaces + 2 switches = 255 IP addresses required
Every active host and interface on the subnet requires a distinct usable IPv4 address.
2
Determine the minimum host bits (h) and smallest CIDR prefix
A /24 prefix yields 28−2=2542^8 - 2 = 254 usable hosts (insufficient). A /23 prefix yields 29−2=5102^9 - 2 = 510 usable hosts (sufficient). Minimum CIDR is /23.
Subnet design requires 2h−2≥required hosts2^h - 2 \ge \text{required hosts}. For 255255 hosts, h=9h=9 host bits are needed.
3
Calculate network boundaries for 10.150.32.0/23
Network ID: 10.150.32.010.150.32.0, First usable IP: 10.150.32.110.150.32.1, Last usable IP: 10.150.33.25410.150.33.254, Broadcast IP: 10.150.33.25510.150.33.255
A /23 subnet covers two consecutive /24 blocks (10.150.32.010.150.32.0 and 10.150.33.010.150.33.0).

Key Concept

IPv4 Subnetting & Usable Host Calculation (2^h - 2 rule)
Question 264Question →

When an active link fails in a legacy IEEE 802.1D Spanning Tree Protocol (STP) network, switches must complete a specific message exchange sequence to propagate the topology change and flush invalid MAC addresses. In what chronological sequence do these protocol actions occur following the link failure on a non-root switch?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for IEEE 802.1D topology change processing is: (1) The switch experiencing link failure generates a TCN BPDU, (2) The TCN BPDU is transmitted upstream out the Root Port, (3) The upstream switch acknowledges receipt using the TCA bit, (4) The Root Bridge receives the TCN and broadcasts configuration BPDUs with the TC flag set, and (5) Non-root switches temporarily shorten their MAC table aging timer to the Forward Delay duration.
In standard IEEE 802.1D STP, topology change handling follows a strict five-step progression: the local switch detects the failure and creates a TCN BPDU, sends it upstream through its Root Port, receives a hop-by-hop TCA acknowledgment from the next switch, the Root Bridge receives the TCN and broadcasts BPDUs with the TC bit set, and finally, network switches receive the TC flag and reduce their MAC address table aging timer to 15 seconds (Forward Delay).

Step-by-Step Solution

1
Detect event and create notification packet
The local switch detects link failure on a forwarding port and originates a TCN BPDU
Port state transitions trigger the local switch to initiate the STP topology change mechanism.
2
Propagate notification toward the root
The TCN BPDU is sent out the switch's Root Port upstream
TCN BPDUs must travel up the spanning-tree hierarchy toward the Root Bridge.
3
Perform hop-by-hop acknowledgement
The upstream switch sets the TCA bit in its next configuration BPDU back to the sender
TCA flag confirms receipt of the TCN BPDU so the sender ceases sending periodic TCN BPDUs every Hello interval.
4
Initiate domain-wide topology change alert
The Root Bridge receives the TCN BPDU and sets the TC flag in all outbound configuration BPDUs
The Root Bridge is the sole authority for propagating TC flags to all switches across the layer 2 network.
5
Accelerate MAC address table flushing
Non-root switches shorten their MAC table aging timer from 300 seconds to 15 seconds (Forward Delay)
Lowering the aging timer allows obsolete bridging table entries to age out rapidly without abruptly emptying the entire MAC table.

Key Concept

802.1D Topology Change Notification (TCN) Sequence
Question 265Question →

A client workstation on a corporate LAN transmits web traffic to an external server across multiple subnets. When an intermediate router receives the Ethernet frame on its ingress interface, which of the following best describes the encapsulation and de-encapsulation actions performed by the router prior to forwarding the packet out its egress interface?

Show answer & explanation

Answer: The router strips the incoming Layer 2 frame header and trailer to inspect the Layer 3 packet, then encapsulates the original Layer 3 packet into a new Layer 2 frame formatted for the egress link.

Answer

The router removes the incoming Layer 2 frame header and trailer, inspects the Layer 3 packet header to make a forwarding decision, decrements the Time to Live (TTL), and encapsulates the untouched IP packet inside a new Layer 2 frame for the outbound interface.
When traffic crosses a router (Layer 3 device), the router strips the incoming Layer 2 frame header and trailer because MAC addresses are only locally significant. The router inspects the Layer 3 IP header to determine the next hop, decrements the TTL, and then wraps the original IP packet inside a new Layer 2 header and trailer formatted specifically for the next hop's data link protocol.

Step-by-Step Solution

1
De-encapsulate Layer 2
The router receives the physical signals on its ingress interface, validates the Frame Check Sequence (FCS), and strips the Layer 2 Ethernet header and trailer.
Layer 2 encapsulation is only valid for local communication within the ingress network segment.
2
Inspect Layer 3 IP Header
The router reads the destination IP address in the Layer 3 packet header, consults its routing table, decrements the TTL field, and re-calculates the IP header checksum.
Layer 3 payload (the IP packet, including Layer 4 TCP and upper-layer data) remains intact to maintain end-to-end transport integrity.
3
Encapsulate for Egress Layer 2
The router adds a new Layer 2 header (with the egress interface MAC as source and next-hop MAC as destination) and a new trailer around the IP packet.
New Layer 2 encapsulation is required to transmit the packet across the next physical hop toward the destination.

Key Concept

Hop-by-hop Layer 2 de-encapsulation and re-encapsulation by Layer 3 devices
Estimated Time:1m 30s
Question 266Question →

A systems engineer is provisioning a dedicated storage area network management VLAN using the IPv4 subnet block 192.168.100.128/26192.168.100.128/26. What is the broadcast IP address for this network segment?

Show answer & explanation

Answer: 192.168.100.191

Answer

192.168.100.191
For the network block 192.168.100.128/26192.168.100.128/26, the subnet mask is 255.255.255.192255.255.255.192, yielding subnets spaced in increments of 64 in the fourth octet (00, 6464, 128128, 192192). The subnet starting at 192.168.100.128192.168.100.128 spans up to 192.168.100.191192.168.100.191, making 192.168.100.191192.168.100.191 the broadcast address.

Step-by-Step Solution

1
Determine the prefix length and host bits
A /26/26 prefix leaves 32−26=632 - 26 = 6 bits for host addressing.
Calculating host bits identifies the size of each subnet block.
2
Calculate the block size in the fourth octet
The block size is 26=642^6 = 64.
Each subnet in this block increments by 64 in the last octet.
3
Find the next network address and determine the broadcast address
The current network address is 192.168.100.128192.168.100.128. The next subnet starts at 128+64=192.168.100.192128 + 64 = 192.168.100.192. Subtracting 1 yields the broadcast address 192.168.100.191192.168.100.191.
The broadcast address is always the last IP address in the subnet block immediately preceding the next network boundary.

Key Concept

IPv4 Broadcast Address Calculation
Estimated Time:1m 30s
Question 267Question →

A network technician is configuring switch ports and VLAN settings across an enterprise network. Match each switching concept or feature to its primary operational behavior.

Click a left item, then click its matching right item

Items

802.1Q Trunking
Native VLAN
Access Port
Sticky MAC Learning

Matches

Show answer & explanation

Answer

802.1Q Trunking matches carrying traffic for multiple VLANs via 4-byte header tagging; Native VLAN matches processing untagged frames on a trunk link; Access Port matches carrying single VLAN untagged traffic to endpoints; Sticky MAC Learning matches converting dynamically learned MAC addresses into permanent switch port configuration entries.
Each switching concept accurately maps to its operational definition: 802.1Q trunking enables multi-VLAN transport via 4-byte frame tagging, native VLAN handles untagged trunk traffic, access ports connect end devices within a single VLAN, and sticky MAC learning dynamically saves secure MAC addresses to configuration memory.

Step-by-Step Solution

1
Identify the mechanism for multiplexing multiple VLANs across a single inter-switch link.
802.1Q trunking inserts a 4-byte VLAN tag into the frame header to identify traffic belonging to different VLANs.
Trunking is specifically designed to carry traffic for multiple VLANs across point-to-point switch connections.
2
Identify how untagged frames arriving on a trunk port are processed.
Untagged frames on an 802.1Q trunk link are automatically mapped to the designated Native VLAN.
The IEEE 802.1Q standard utilizes a native VLAN for backward compatibility with untagged legacy traffic.
3
Determine the switch port configuration used for connecting individual endpoint hosts.
An Access Port belongs to a single VLAN and delivers standard untagged frames to connected endpoint devices.
Endpoints generally do not inspect 802.1Q tags, so access ports strip internal tags before frame egress.
4
Identify the port security mechanism that saves dynamically learned MAC addresses.
Sticky MAC Learning converts dynamically learned MAC addresses into static entries recorded in the switch configuration.
This avoids manual MAC address entry while enforcing port security parameters across device reboots.

Key Concept

Switching Concepts and VLAN Operations
Estimated Time:1m 30s
Question 268Question →

A network administrator is evaluating Network Address Translation options for a small remote office where 50 internal devices with private IPv4 addresses need simultaneous internet access using only one assigned public IPv4 address. Which of the following statements accurately describe how Port Address Translation (PAT) fulfills this requirement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: PAT tracks individual outbound client connections by appending unique Layer 4 source port numbers to the shared public IP address.; PAT modifies both the source IP address and the source port number in outbound IPv4 packet headers.

Answer

Port Address Translation (PAT) tracks outbound sessions by appending unique Layer 4 source port numbers to the single public IP address, modifying both the source IP address and source port number in outbound packet headers.
Port Address Translation (PAT) allows multiple private IPv4 hosts to share a single public IPv4 address simultaneously by translating both the source IP address (Layer 3) and source port number (Layer 4) for outbound packets, using distinct port numbers to track return traffic for each host.

Step-by-Step Solution

1
Identify the scenario requirement
50 internal hosts with private addresses must share a single public IP address simultaneously.
Because only one public IP address is available, traditional one-to-one Static NAT or Dynamic NAT without port translation cannot support all hosts concurrently.
2
Analyze how PAT operates at Layer 3 and Layer 4
PAT assigns a unique source port number to each session originating from an internal host.
By distinguishing traffic flows using Layer 4 TCP/UDP port numbers alongside the single public Layer 3 IP address, thousands of concurrent sessions can share one IP address.
3
Evaluate packet translation behavior
Outbound packets undergo translation of both their internal source IP address and internal source port number.
The router/firewall updates the header fields so return traffic from the internet is directed back to the public IP and translated port.

Key Concept

Port Address Translation (PAT / NAT Overload)
Question 269Question →

A network administrator is documenting a newly assigned IPv6 address with the uncompressed form 2001:0db8:0000:0000:0005:0000:0000:0001. Which of the following options represents the correctly compressed IPv6 address according to standard RFC 5952 formatting rules?

Show answer & explanation

Answer: 2001:db8::5:0:0:1

Answer

2001:db8::5:0:0:1
The address 2001:db8::5:0:0:1 is correct because standard RFC 5952 rules require suppressing leading zeros in all 16-bit fields (changing 0db8 to db8, 0005 to 5, and 0001 to 1). Furthermore, when two sequences of zero blocks are of equal length (here, two 0000 blocks each), the first sequence must be replaced by a double colon (::), leaving the second sequence written as explicit zeros.

Step-by-Step Solution

1
Suppress leading zeros in each 16-bit block.
2001:0db8 becomes 2001:db8, 0005 becomes 5, and 0001 becomes 1, resulting in 2001:db8:0:0:5:0:0:1.
RFC 5952 mandates that leading zeros within any 16-bit field must be suppressed.
2
Identify consecutive blocks of zeros.
There are two separate zero sequences: blocks 3-4 (0:0) and blocks 6-7 (0:0). Both have a length of two blocks.
Double-colon compression (::) can only be applied to consecutive 16-bit fields of zeros.
3
Apply double-colon compression to the first longest sequence of zero blocks.
Compress blocks 3-4 to obtain 2001:db8::5:0:0:1.
When multiple zero sequences of equal length exist, RFC 5952 specifies that the first sequence must be compressed, and :: must never be used more than once in an address.

Key Concept

RFC 5952 IPv6 Address Compression Rules
Estimated Time:45s
Question 270Question →

A network technician needs to allocate an IPv4 subnet for a new branch department that requires 5050 workstation IP addresses, 22 printer IP addresses, and 11 default gateway IP address. What is the maximum number of additional usable host addresses remaining in the smallest CIDR subnet that satisfies these requirements?

Show answer & explanation

Answer: 99

Answer

The maximum number of additional usable host addresses remaining in the smallest CIDR subnet is 99.
The required usable host count is 50+2+1=5350 + 2 + 1 = 53 addresses. The smallest CIDR prefix capable of supporting at least 5353 host addresses is /26/26 (66 host bits), offering 26−2=622^6 - 2 = 62 usable host IPs (/27/27 only provides 3030). Subtracting the 5353 required addresses from 6262 total usable addresses leaves 99 additional usable host addresses for growth.

Step-by-Step Solution

1
Calculate total required usable IP addresses
50 workstations+2 printers+1 gateway=53 usable host IPs50 \text{ workstations} + 2 \text{ printers} + 1 \text{ gateway} = 53 \text{ usable host IPs}
All active devices and router interfaces in the subnet require a unique usable IPv4 address.
2
Determine the smallest CIDR subnet mask for 53 hosts
A /26/26 subnet (66 host bits) yields 26−2=622^6 - 2 = 62 usable host addresses.
A /27/27 subnet (55 host bits) only provides 25−2=302^5 - 2 = 30 usable addresses, which is insufficient. The /26/26 mask is the smallest block that fits 5353 hosts.
3
Calculate remaining usable host address capacity
62 total usable addresses−53 assigned addresses=9 remaining usable addresses62 \text{ total usable addresses} - 53 \text{ assigned addresses} = 9 \text{ remaining usable addresses}
Subtracting assigned IPs from total usable subnet IPs gives the spare host address capacity.

Key Concept

Subnet Usable Host Capacity Calculation (2h−22^h - 2)
Question 271Question →

A host operating system receives an incoming transmission containing web application traffic. As the destination network stack processes the protocol data unit (PDU) through de-encapsulation, which of the following operations occur specifically at Layer 3 (Network Layer) before the payload is passed up to Layer 4? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The destination IP address in the packet header is verified against the receiving host's configured address.; The Protocol field within the IP header is inspected to identify which Transport layer protocol should receive the encapsulated payload.

Answer

The correct Layer 3 operations are verifying the destination IP address against the local host address and inspecting the IP header Protocol field to determine the target Layer 4 protocol handler.
During de-encapsulation at Layer 3 (Network Layer), the network stack inspects the IP header to verify that the packet's destination IP matches the host interface address. It also checks the IP header's Protocol field (such as 6 for TCP or 17 for UDP) to determine which Layer 4 protocol module should receive the stripped payload.

Step-by-Step Solution

1
Analyze Layer 3 IP header processing during de-encapsulation.
Identify that Layer 3 processes the IPv4 or IPv6 header containing source/destination IP addresses and protocol demultiplexing information.
De-encapsulation strips headers bottom-up; Layer 3 processes IP header fields before stripping them to yield the Layer 4 segment.
2
Evaluate destination addressing at Layer 3.
Verifying destination IP address ensures the host is the intended recipient.
If the destination IP does not match the receiving host or allowed multicast/broadcast, the packet is dropped.
3
Determine how Layer 3 hands off data to Layer 4.
Reading the Protocol field in the IP header tells Layer 3 which protocol (e.g., TCP or UDP) receives the payload.
Demultiplexing at Layer 3 relies on the IP Protocol field to pass the payload up to Layer 4.

Key Concept

Layer 3 De-encapsulation and Header Demultiplexing
Question 272Question →

A network administrator is configuring four interconnected switches running standard IEEE 802.1D Spanning Tree Protocol (STP). All switches currently maintain the default bridge priority value of 32768. Which switch configuration modification will guarantee that a specific switch becomes elected as the STP Root Bridge?

Show answer & explanation

Answer: Lower the bridge priority numerical value on the desired switch.

Answer

Lower the bridge priority numerical value on the desired switch.
In Spanning Tree Protocol (STP), the switch with the lowest numerical Bridge ID (BID) is elected as the Root Bridge. The BID is composed of the Bridge Priority and the switch MAC address. Because all switches default to a priority of 32768, lowering the priority value on a specific switch reduces its BID, ensuring it wins the root election.

Step-by-Step Solution

1
Identify the criteria used by 802.1D STP for root bridge election.
STP elects the switch with the lowest Bridge ID (BID) as the Root Bridge.
The BID is composed of a 2-byte Bridge Priority followed by a 6-byte MAC Address.
2
Determine how to force a specific switch to have the lowest BID.
Manually lower the Bridge Priority value (e.g., set to 4096 or 0).
Since lower numerical values win the election, reducing the priority below the default 32768 ensures that this switch wins regardless of MAC addresses.

Key Concept

STP Root Bridge Election and Priority Calibration
Question 273Question →

A network administrator receives a critical security update for an enterprise core router's operating system. Which of the following actions should the administrator take first to ensure network stability before deploying the patch to production?

Show answer & explanation

Answer: Test the patch in a isolated staging environment that mimics the production network.

Answer

Testing the patch in an isolated staging environment that mimics the production network is the essential first step before any live deployment.
In proper patch management lifecycles, testing patches within a non-production lab or staging environment is always the first operational requirement. This isolates bugs and validates performance before live implementation.

Step-by-Step Solution

1
Identify the standard operating procedure for patch deployment.
Recognize that patch management requires risk mitigation steps including testing, baseline backing up, and scheduled maintenance windows.
Applying untested firmware or software updates directly to live devices can lead to unexpected outages or feature breakage.
2
Evaluate the safest initial action among the available options.
Deploying the update in a controlled sandbox or staging environment allows verification of stability and compatibility without impacting users.
Staging environments mirror production hardware and configurations, ensuring unexpected behavior is resolved prior to change advisory board (CAB) final approval and production rollout.

Key Concept

Patch Staging and Pre-deployment Testing
Question 274Question →

A network security auditor is reviewing an enterprise organization's network logging and monitoring infrastructure to meet stringent compliance regulations. The audit reveals two major vulnerabilities: (1) SNMP management traffic captures reveal cleartext interface statistics and OID payloads despite network administrators requiring password access to the monitoring console, and (2) during periodic core switch link saturation, critical Syslog alerts from edge devices are consistently dropped before reaching the centralized SIEM. Which combination of configuration updates will resolve both compliance findings by ensuring cryptographic privacy of network management payloads and reliable, tamper-resistant log delivery?

Show answer & explanation

Answer: Migrate SNMP monitoring to SNMPv3 configured for authPriv using SHA authentication and AES encryption, and reconfigure Syslog transport to use TLS over TCP port 6514.

Answer

Migrate SNMP monitoring to SNMPv3 configured for authPriv using SHA authentication and AES encryption, and reconfigure Syslog transport to use TLS over TCP port 6514.
SNMPv3 authPriv combines cryptographic user authentication (such as SHA) with symmetric payload encryption (such as AES), preventing eavesdroppers from reading cleartext OID values and interface stats. Furthermore, configuring Syslog over TLS using TCP port 6514 ensures both cryptographic log security and reliable, acknowledged packet delivery that prevents log loss during network congestion.

Step-by-Step Solution

1
Identify the required SNMP security model for management traffic privacy
SNMPv3 with the authPriv security level is required because authNoPriv only provides message integrity/authentication, whereas authPriv adds symmetric encryption (such as AES) to protect payload confidentiality.
Cleartext OIDs and statistics must be encrypted in transit to satisfy compliance regulations.
2
Analyze the log packet drop issue during network congestion
Standard Syslog uses UDP port 514, which is connectionless and unacknowledged, leading to silently dropped log packets when buffers overflow during traffic spikes.
A connection-oriented transport protocol (TCP) is necessary to ensure acknowledgment and delivery reliability.
3
Select the correct secure, reliable Syslog transport configuration
Syslog over TLS utilizes TCP port 6514, delivering both transport-layer security/encryption and reliable TCP delivery semantics.
Port 6514 is the standard IANA-assigned port for Syslog over TLS (RFC 5425).

Key Concept

SNMPv3 Security Levels (authPriv) and Secure Syslog Transport (TLS/TCP Port 6514)
Question 275Question →

A network engineering team is deploying core IP addressing and network management services for domain-joined hosts across multiple routed subnets. To ensure accurate logging correlation across distributed systems and proper name resolution for dual-stack hosts, which of the following protocols or resource records should be implemented? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: NTP operating on UDP port 123 to maintain consistent time synchronization across network hosts and security devices.; AAAA resource records configured in the DNS server to map internal hostnames to assigned IPv6 addresses.

Answer

The correct implementations are NTP operating on UDP port 123 for network-wide time synchronization and AAAA records in DNS for mapping hostnames to IPv6 addresses.
NTP operating on UDP port 123 provides centralized time synchronization required for log correlation across network systems. In addition, AAAA resource records in DNS provide standard hostname-to-IPv6 address resolution for dual-stack environments.

Step-by-Step Solution

1
Analyze time synchronization requirement
NTP operates on UDP port 123 to provide clock synchronization across log sources and network endpoints.
Accurate event correlation and log auditing across distributed subnets require synchronized clocks using NTP.
2
Analyze host name resolution requirement for dual-stack hosts
DNS AAAA records map hostnames directly to 128-bit IPv6 addresses.
Standard forward DNS resolution for IPv6 protocol addressing uses AAAA resource records.
3
Evaluate distractor options against protocol specifications and placement rules
DHCP uses UDP ports 67/68 (not TCP), PTR records perform reverse lookups (not CNAME), and relay agents belong on client default gateways (not the server interface).
Identifying accurate protocol ports, record types, and deployment locations eliminates incorrect service configurations.

Key Concept

IP Addressing Services (NTP operations, DNS record types, and DHCP relay architectural requirements)
Question 276Question →

Four routers on a shared Layer 2 Ethernet segment are configured to run OSPF using the broadcast network type. The administrator configures the OSPF interface priorities and router IDs as follows:

RouterOSPF Interface PriorityRouter ID
Router A1192.168.1.10
Router B210.10.10.1
Router C010.20.20.20
Router D210.10.10.2

Assuming all routers boot simultaneously and form adjacencies, which router will be elected as the Designated Router (DR) for this multi-access segment?

Show answer & explanation

Answer: Router D

Answer

Router D will be elected as the Designated Router because it shares the highest priority (2) and has a higher Router ID than Router B.
In OSPF broadcast networks, the Designated Router election evaluates highest interface priority first. Routers with priority 0 are completely excluded. Routers B and D tie with a priority of 2. To break the tie, OSPF selects the router with the highest Router ID. Comparing 10.10.10.2 (Router D) against 10.10.10.1 (Router B), Router D has the higher Router ID and is elected DR.

Step-by-Step Solution

1
Filter out ineligible routers based on OSPF interface priority.
Router C (priority 0) is excluded from DR and BDR election.
Setting an OSPF priority to 0 makes a router ineligible to become a DR or BDR.
2
Compare the remaining routers by highest OSPF interface priority.
Router B and Router D tie with the highest priority of 2, while Router A has a lower priority of 1.
OSPF DR election first evaluates the highest interface priority value.
3
Break the tie between Router B and Router D using Router IDs.
Router D wins with Router ID 10.10.10.2 compared to Router B's 10.10.10.1.
When interface priorities are equal, the router with the highest numeric Router ID is elected.

Key Concept

OSPF Designated Router (DR) election criteria (Highest Priority > Highest Router ID; Priority 0 excludes).
Estimated Time:1m 0s
Question 277Question →

A network administrator is configuring a secondary DNS server to perform a full zone transfer (AXFR) from the primary name server. Which transport layer protocol and port number are used by default to execute this zone transfer?

Show answer & explanation

Answer: TCP port 53

Answer

DNS zone transfers (AXFR/IXFR) use TCP port 53 to guarantee reliable delivery of full or incremental zone database files.
DNS zone transfers (such as AXFR or IXFR) move potentially large amounts of DNS database records between name servers. To guarantee that all resource records arrive intact and in order without data loss, DNS uses TCP port 53 for zone transfers.

Step-by-Step Solution

1
Identify the type of DNS traffic being requested
The traffic is a zone transfer (AXFR) between a primary and secondary DNS server.
Standard DNS resolution queries use connectionless UDP, but bulk database transfers require reliable session delivery.
2
Determine the transport protocol and port for DNS zone transfers
Zone transfers require TCP on port 53.
TCP ensures packet sequencing, error checking, and reliable retransmission when transferring entire zone records, while port 53 is the dedicated port for DNS services.

Key Concept

DNS Transport Protocols (UDP 53 for Queries vs TCP 53 for Zone Transfers)
Question 278Question →

Match each IPv6 base header field to its correct functional description.

Click a left item, then click its matching right item

Items

Payload Length
Flow Label
Next Header
Hop Limit

Matches

Show answer & explanation

Answer

Payload Length pairs with describing payload size excluding the 40-byte base header; Flow Label pairs with identifying specific packet flows for path handling; Next Header pairs with specifying the encapsulated protocol or extension header; Hop Limit pairs with decrementing at each hop to prevent loops.
Each item matches its corresponding function: Payload Length measures bytes beyond the fixed 40-byte base header, Flow Label tags specific packet streams for uniform routing treatment, Next Header identifies protocol payloads or extension headers, and Hop Limit prevents loops by decrementing at each hop.

Step-by-Step Solution

1
Identify the purpose of Payload Length in the IPv6 header.
Payload Length measures the bytes after the 40-byte base header.
Unlike IPv4's Total Length field, IPv6 Payload Length excludes the base header itself.
2
Determine the function of the Flow Label field.
Flow Label maintains flow consistency for real-time packets.
It allows routers to service non-fragmented sequence packets along identical paths.
3
Determine the function of the Next Header field.
Next Header specifies payload or extension headers.
It acts as a pointer to the upper-layer protocol (e.g., TCP=6, UDP=17) or an IPv6 extension header.
4
Identify the function of Hop Limit.
Hop Limit decrements to stop loop propagation.
It performs the exact functionality of IPv4 TTL.

Key Concept

IPv6 Base Header Architecture
Question 279Question →

In what sequential order does a link-state dynamic routing protocol, such as Open Shortest Path First (OSPF), process topology information from initial startup to updating the router's active routing table?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with discovering neighbors using Hello packets, followed by exchanging Link-State Advertisements (LSAs), building the full Link-State Database (LSDB), executing Dijkstra's Shortest Path First (SPF) algorithm, and finally installing the optimal calculated routes into the IP routing table.
Link-state routing protocols follow a strict, logical lifecycle: discovering neighbors using Hello messages, exchanging link-state information via LSAs, assembling a local copy of the full topology map in the LSDB, running Dijkstra's SPF calculation on that map, and installing the resulting best-path routes into the forwarding table.

Step-by-Step Solution

1
Identify neighbor discovery
Hello packets are transmitted to locate directly connected neighbor routers.
Link-state routers cannot exchange topology data until neighbor adjacencies are established.
2
Identify topology exchange
Link-State Advertisements (LSAs) are exchanged between adjacent neighbors.
LSAs contain information about connected links, states, and associated path costs.
3
Identify database assembly
The router compiles all received LSAs into a unified Link-State Database (LSDB).
The LSDB serves as the complete topological map of the entire routing area.
4
Identify path computation
Dijkstra's Shortest Path First (SPF) algorithm processes the LSDB topology tree.
SPF calculates the shortest logical path from the local router to every known destination network.
5
Identify route installation
The resulting lowest-cost paths are placed into the active IP routing table.
Only the best calculated paths are selected for active packet forwarding.

Key Concept

Link-state dynamic routing protocol convergence sequence (OSPF)
Question 280Question →

An organization is deploying a high-speed fiber-optic network to interconnect several municipal government buildings located across a single city boundary to share central voice and video communications. Which of the following network scope classifications best describes this deployment?

Show answer & explanation

Answer: Metropolitan Area Network (MAN)

Answer

Metropolitan Area Network (MAN)
A Metropolitan Area Network (MAN) is designed to connect facilities and resources distributed across a single city or metropolitan area, typically utilizing leased telecom lines or dedicated dark fiber.

Step-by-Step Solution

1
Analyze the geographic parameters given in the scenario.
The network interconnects multiple facilities distributed across a single city.
Network types (PAN, LAN, CAN, MAN, WAN) are categorized primarily by geographic coverage.
2
Match the geographic coverage to the correct network classification.
A network that spans across a town or city is classified as a Metropolitan Area Network (MAN).
LANs serve localized sites, CANs serve connected campus buildings, MANs serve entire cities, and WANs serve broad geographical distances.

Key Concept

Geographic scope classifications of network types (MAN vs LAN, WAN, SAN)
PreviousPage 14 / 112Next
All practice questions — CompTIA Network+ | Examkin