Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 561Question →

A network administrator is configuring DNS infrastructure for an enterprise web application hosted behind a cloud provider's elastic load balancer. The administrator must map the organization's root domain apex (`example.com`) to the load balancer's domain name (`lb-prod-948201.cloudprovider.net`). When attempting to create a CNAME record for `example.com`, the primary DNS server fails to commit the change. The administrator executes the following diagnostic query against the local authoritative DNS server:

text
$ dig @192.168.1.10 example.com SOA +noall +answer +authority
;; ANSWER SECTION:
example.com. 3600 IN SOA ns1.example.com. hostmaster.example.com. 2026072701 7200 3600 1209600 3600

;; AUTHORITY SECTION:
example.com. 3600 IN NS ns1.example.com.

Which of the following DNS record implementations will successfully map the root domain apex to the cloud load balancer hostname without violating standard DNS specifications?

Show answer & explanation

Answer: An ALIAS (or ANAME) record at the zone apex, which dynamically resolves the target hostname to IP addresses for incoming client queries.

Answer

An ALIAS (or ANAME) record at the zone apex, which dynamically resolves the target hostname to IP addresses for incoming client queries.
The DNS specification (RFC 1034 section 3.6.2) mandates that if a CNAME record is present at a host label, no other resource records (such as MX, A, SOA, or NS) can exist for that same label. Because every DNS zone root (apex) must contain SOA and NS records, a standard CNAME record at `example.com` is invalid. Modern DNS providers offer virtual or synthetic record types—commonly called ALIAS or ANAME records—that simulate CNAME functionality at the zone apex by dynamically resolving the target domain's IP addresses and returning A/AAAA records to querying clients.

Step-by-Step Solution

1
Analyze the DNS RFC requirement for CNAME coexistence at the zone apex.
According to RFC 1034, a CNAME record cannot coexist with any other record types for the same label. Because a zone apex MUST contain SOA and NS records, a standard CNAME record cannot be placed at `example.com`.
Placing a standard CNAME at the apex creates structural conflicts with the SOA and NS records essential for domain operation.
2
Evaluate technical mechanisms designed to overcome zone apex CNAME limitations.
DNS providers implement synthetic or virtual record types (such as ALIAS, ANAME, or CNAME flattening) that allow a hostname target at the root apex.
The authoritative DNS server resolves the target hostname (`lb-prod-948201.cloudprovider.net`) to its underlying IP addresses on the backend and responds to clients with standard A or AAAA records.
3
Select the compliant record type that satisfies the application requirements.
Deploying an ALIAS (or ANAME) record maps `example.com` to the load balancer hostname without violating DNS specifications.
This maintains RFC compliance for SOA/NS records while fulfilling the dynamic host mapping requirement.

Key Concept

DNS Zone Apex Restrictions and ALIAS/ANAME Records
Estimated Time:2m 0s
Question 562Question →

A network administrator is analyzing an existing office layout where all workstations are physically connected via individual twisted-pair cables to a central legacy hub. While the cable layout forms a star shape, users report frequent transmission slowdowns caused by data frame collisions during high-traffic periods. Which of the following best describes the logical topology operating within this network?

Show answer & explanation

Answer: Logical bus, because the central hub repeats signals to all attached ports, creating a single shared collision domain.

Answer

Logical bus, because the central hub repeats signals to all attached ports, creating a single shared collision domain.
While the physical cabling radiates outward from a central hub to form a physical star, hubs function at Layer 1 of the OSI model by repeating all incoming traffic to all active ports. As a result, all connected endpoints share a single collision domain, which defines a logical bus topology.

Step-by-Step Solution

1
Analyze the physical cable layout described in the scenario.
Individual cables radiate from a central device to workstations, forming a physical star topology.
Physical topology represents the physical arrangement of cabling and device connections.
2
Determine how data flows internally through a network hub.
A legacy hub operates at Layer 1 and repeats incoming electrical signals to every active port.
Logical topology describes how data actually travels across the network medium.
3
Match the device behavior to its corresponding logical topology.
Because all nodes receive every transmission and contend for the same medium, the network operates as a logical bus.
A physical star with a central hub forms a logical bus network.

Key Concept

Physical vs. Logical Topologies (Hub-based Ethernet)
Question 563Question →

A network technician is configuring an enterprise router to forward client DHCP requests from a newly created VLAN to a centralized DHCP server situated on a remote management subnet. Clients on the new VLAN are currently receiving APIPA addresses because Layer 3 routers block broadcast traffic by default. Which configuration action on the router interface serving the new VLAN will successfully enable host IP addressing from the central server?

Show answer & explanation

Answer: Configure an IP Helper address on the VLAN interface to relay DHCP broadcast frames as unicast UDP packets to the remote server IP address.

Answer

Configuring an IP Helper address on the VLAN interface to relay DHCP broadcast frames as unicast UDP packets to the remote server IP address.
DHCP clients initiate address acquisition using local broadcast messages (DHCPDISCOVER). Because routers do not forward broadcast packets between subnets, a DHCP relay agent (configured via an IP helper command on the router's local VLAN interface) must intercept these broadcasts and forward them as unicast UDP traffic to the centralized DHCP server.

Step-by-Step Solution

1
Analyze the client symptom and network architecture
Clients receiving 169.254.x.x169.254.x.x (APIPA) indicates that DHCPDISCOVER broadcasts are failing to reach a DHCP server.
Routers drop Layer 2/3 broadcast frames by default to prevent broadcast storms across subnets.
2
Identify the required service component for cross-subnet DHCP functionality
A DHCP Relay Agent (IP Helper) must be placed on the default gateway interface of the local client VLAN.
The relay agent listens for incoming DHCP client broadcasts and forwards them as unicast UDP traffic (destination port 67) to the remote DHCP server IP address.

Key Concept

DHCP Relay Agent / IP Helper Operations
Question 564Question →

A principal network architect is designing a high-availability out-of-band (OOB) management framework for a remote enterprise data center. The solution must guarantee secure administrative access to core network appliances and power controls even during a complete collapse of the primary WAN infrastructure and internal LAN control planes. Which TWO of the following deployment strategies directly satisfy these out-of-band access and security requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Deploy an encrypted cellular modem connected to a centralized serial console server that interfaces directly with the console ports of network appliances.; Utilize remote-managed Power Distribution Units (PDUs) reachable via an isolated OOB management network segment to perform hardware power cycling.

Answer

The correct strategies are deploying an encrypted cellular modem connected to a serial console server for terminal console access, and using remote-managed PDUs on an isolated OOB network segment for power management.
True out-of-band (OOB) management requires complete architectural isolation from production network channels. Connecting a central serial console server to appliance serial console ports via an encrypted cellular modem ensures administrators retain direct shell access during total WAN/LAN failures. Complementing this with intelligent PDUs on an isolated management network enables power-cycling frozen hardware remotely.

Step-by-Step Solution

1
Analyze the operational constraints of out-of-band management during primary network failures.
OOB management infrastructure must remain operational over alternative mediums (such as cellular or dedicated dial-up) when primary WAN routers and LAN switches fail.
In-band mechanisms depend on active data plane routing and switching, rendering them unavailable during major infrastructure outages.
2
Select components that provide direct device control and power management without relying on local network stacks.
Serial console servers provide low-level terminal access via RS-232 serial links, while remote smart PDUs allow cold-rebooting frozen devices.
Serial console access bypasses standard IP networking stacks on target appliances, and remote PDUs solve kernel hang scenarios.

Key Concept

Out-of-band (OOB) management architectures separate administrative control channels from production data networks using independent physical paths, secure serial console servers, and remote PDU power management.
Estimated Time:3m 0s
Question 565Question →

A network technician is configuring an IPsec site-to-site Virtual Private Network (VPN) between two branch offices. Arrange the following steps in the correct order in which an IPsec VPN connection is established between the two gateways.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for establishing an IPsec VPN connection is: 1) Negotiate IKE Phase 1 security parameters, 2) Authenticate peers and perform Diffie-Hellman key exchange to establish the IKE Phase 1 tunnel, 3) Negotiate IKE Phase 2 parameters to establish IPsec Security Associations (SAs), and 4) Encrypt and transmit user data packets across the established IPsec tunnel.
Establishing an IPsec connection requires setting up a secure management channel first via IKE Phase 1 (negotiation followed by authentication and key exchange), then negotiating IPsec SAs in Phase 2, and finally encrypting and forwarding actual user data.

Step-by-Step Solution

1
Identify the initial policy negotiation phase.
Gateways agree on Phase 1 proposal parameters (IKE Phase 1 negotiation).
Both VPN endpoints must agree on encryption and hash algorithms before initiating authentication.
2
Establish the management tunnel.
Diffie-Hellman key exchange completes and creates the ISAKMP/IKE SA tunnel.
Peer authentication and key exchange establish a secure control channel to protect subsequent negotiations.
3
Negotiate parameters for data protection.
IKE Phase 2 creates IPsec Security Associations (SAs).
Phase 2 defines how the actual user payload data will be encapsulated and encrypted (ESP/AH).
4
Begin data transmission.
User data is encrypted and transmitted.
Payload traffic can only pass through once data-plane security associations are fully negotiated and active.

Key Concept

IPsec VPN Tunnel Establishment Process (IKE Phase 1 and Phase 2)
Question 566Question →

A network technician is configuring a remote access solution for mobile workers to securely connect to internal enterprise resources. The technical requirements specify that the security protocol suite must operate at the Network layer (Layer 3) of the OSI model to authenticate and encrypt all IP packets passing through the tunnel. Which of the following protocols should the technician implement?

Show answer & explanation

Answer: IPsec

Answer

IPsec is the correct protocol suite because it functions at the OSI Network layer (Layer 3) to authenticate and encrypt all IP packet payloads and headers.
IPsec (Internet Protocol Security) operates natively at Layer 3 (the Network layer) of the OSI model. By running at Layer 3, IPsec can secure and encrypt all upper-layer protocol traffic (such as TCP and UDP) seamlessly without requiring application-specific configurations.

Step-by-Step Solution

1
Identify the OSI layer constraint specified in the prompt requirement.
The target protocol must operate directly at Layer 3 (Network layer).
Layer 3 protocols can encrypt and encapsulate full IP packets regardless of upper-layer applications.
2
Evaluate the listed VPN and remote access protocols against their operating layer.
IPsec operates at Layer 3; TLS operates at Layer 4/7; SSH operates at Layer 7; PPTP encapsulates Layer 2 frames.
Only IPsec meets the exact OSI Layer 3 architectural requirement.

Key Concept

IPsec Layer 3 Operation and Encapsulation
Question 567Question →

During a physical fiber cut, an enterprise branch site experiences complete loss of its primary and secondary WAN transport links. Network engineers must urgently perform low-level command-line reconfiguration on the core switches and execute a hard power cycle on an unresponsive edge router at the location. Which of the following infrastructure deployment models provides secure emergency administrative access to these hardware assets without depending on the production transport network?

Show answer & explanation

Answer: Connecting a dedicated terminal server and switched Power Distribution Unit (PDU) to an isolated cellular gateway, managing serial console lines using SSH and power sockets using HTTPS.

Answer

Connecting a dedicated terminal server and switched Power Distribution Unit (PDU) to an isolated cellular gateway, managing serial console lines using SSH and power sockets using HTTPS.
Out-of-band (OOB) management provides a dedicated, secondary path into network infrastructure that functions even when the primary production network fails completely. Combining a cellular gateway with a console terminal server and a remotely managed switched PDU enables network engineers to establish encrypted SSH serial console sessions to configure switches and access HTTPS management pages to cycle power on frozen hardware.

Step-by-Step Solution

1
Analyze network failure constraints.
Primary and secondary in-band WAN transport links are completely down, ruling out any management system reliant on production IP routing pathways.
Out-of-band (OOB) connectivity must utilize an independent communication path such as cellular modems or POTS lines.
2
Evaluate access requirements for hardware recovery.
Serial console access (terminal server) is required for CLI changes on headless devices, and remote power control (switched PDU) is required to hard reboot unresponsive routers.
In-band administrative protocols (SSH/RDP to primary IP addresses) are unavailable when network OS components or transport interfaces crash.
3
Evaluate transport security and protocol characteristics.
SSH (TCP port 22) and HTTPS (TCP port 443) provide strong encryption over the cellular out-of-band link, while Telnet, SNMPv2c, and incorrect UDP protocol selections introduce severe security vulnerabilities or total protocol failures.
Security mandates encrypted administration even over out-of-band channels.

Key Concept

Out-of-Band (OOB) Remote Management Architecture
Question 568Question →

A network administrator configures an active/passive firewall cluster to ensure high availability for an enterprise network. During a failover test, the passive firewall successfully assumes the active role, and newly initiated web traffic flows normally. However, all established, long-lived TCP sessions (such as SSH connections and database transactions) are immediately dropped, forcing users to reconnect. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: Stateful session synchronization between the cluster nodes was not enabled.

Answer

Stateful session synchronization between the cluster nodes was not enabled.
In a stateful high-availability deployment, active and standby nodes replicate connection tracking tables, NAT tables, and VPN state information across a dedicated heartbeat link. If state synchronization is missing or disabled (stateless failover), the standby unit has no record of established connections when it becomes active, forcing it to drop existing stateful TCP sessions while accepting new connections.

Step-by-Step Solution

1
Analyze the symptoms described in the scenario.
Takeover succeeded, and new traffic flows as expected, but active TCP connections dropped.
This indicates that Layer 2/3 IP failover (such as Virtual IP transfer) worked correctly, but state information was missing on the newly active node.
2
Differentiate between stateless and stateful high-availability failover.
Stateless failover moves IP addresses without sharing state tables; stateful failover continuously replicates state tables.
Without stateful session synchronization, the new active device treats incoming packets for pre-existing TCP connections as invalid (since they do not match any known session entry) and sends RST packets to reset them.
3
Select the configuration requirement that prevents session termination upon takeover.
Enabling stateful failover / state synchronization between HA nodes maintains active connection state across transitions.
This matches the exact root cause of dropped established connections during an otherwise successful failover.

Key Concept

Stateful vs. Stateless High Availability Failover
Question 569Question →

As part of a wireless security assessment, an engineer must accurately map each IEEE 802.11 cryptographic protocol to its underlying encryption algorithm and message integrity mechanism. Match each protocol on the left to its matching cryptographic pair on the right.

Click a left item, then click its matching right item

Items

GCMP-256
CCMP-128
TKIP
BIP-GMAC-256

Matches

Show answer & explanation

Answer

GCMP-256 matches AES in Galois/Counter Mode (256-bit key). CCMP-128 matches AES in Counter Mode with CBC-MAC (128-bit key). TKIP matches RC4 stream cipher with the Michael algorithm. BIP-GMAC-256 matches Galois Message Authentication Code under 802.11w for broadcast/multicast management frames.
Each protocol correctly pairs with its cryptographic specification: GCMP-256 uses AES in Galois/Counter Mode with 256-bit keys; CCMP-128 uses AES Counter Mode with CBC-MAC; TKIP pairs RC4 with the Michael integrity check algorithm; and BIP-GMAC-256 provides Galois MAC integrity protection for broadcast management frames.

Step-by-Step Solution

1
Identify the cryptographic suite requirements for high-strength WPA3 Enterprise (192-bit mode).
GCMP-256 provides 256-bit authenticated encryption via Galois/Counter Mode.
WPA3 Enterprise 192-bit security relies on GCMP-256 as its primary data protection cipher.
2
Analyze standard IEEE 802.11i baseline encryption (CCMP-128).
CCMP-128 pairs AES in Counter Mode (CTR) for encryption with CBC-MAC for integrity.
This is the mandatory baseline cipher suite for standard WPA2 and WPA3 Personal.
3
Examine legacy protocol primitives for TKIP.
TKIP wraps RC4 encryption with the Michael Message Integrity Check (MIC).
TKIP was created to fix WEP vulnerabilities without requiring new hardware, utilizing RC4 and Michael.
4
Determine the management frame integrity protocol for broadcast traffic.
BIP-GMAC-256 uses Galois MAC to protect group management frames under Protected Management Frames (PMF).
Broadcast Integrity Protocol (BIP) safeguards deauthentication and disassociation broadcast frames from spoofing attacks.

Key Concept

Wireless Cipher Suites and Integrity Mechanisms
Question 570Question →

A network administrator is designing an IPv4 addressing scheme for a enterprise WLAN segment that must support at least 500500 usable host devices per subnet. What is the maximum CIDR prefix length (integer value of the mask bits) that can be assigned to meet this requirement without wasting IP address space?

Show answer & explanation

Answer: 23

Answer

The maximum CIDR prefix length that supports at least 500 usable host addresses is 23.
To host at least 500500 usable devices, a subnet requires 9 host bits because 29−2=5102^9 - 2 = 510 usable IP addresses. Subtracting 9 host bits from the 32 total bits in an IPv4 address results in a prefix length of 23.

Step-by-Step Solution

1
Calculate the required number of host bits
9 host bits are required.
Using the formula 2h−22^h - 2, 8 host bits yield only 254 usable addresses, whereas 9 host bits yield 510510 usable addresses, which satisfies the 500500 host minimum requirement.
2
Calculate the network prefix length in CIDR notation
The prefix length is 23.
An IPv4 address consists of 32 bits in total. Subtracting the 9 host bits (32−932 - 9) leaves 23 bits for the network and subnet identifier.

Key Concept

IPv4 Host Capacity and CIDR Prefix Calculation
Question 571Question →

A network operations team is subnetting the enterprise block 10.45.128.0/1810.45.128.0/18 to create equal-sized subnets capable of supporting at least 500500 usable host IP addresses per subnet. If subnets are allocated sequentially starting from the lowest address in the block, what is the network address (Network ID) of the fifth allocated subnet?

Show answer & explanation

Answer: 10.45.136.0; 10.45.136.0/23

Answer

10.45.136.0
To accommodate at least 500500 usable hosts per subnet, 99 host bits are required because 29−2=5102^9 - 2 = 510 usable addresses. This results in a prefix length of /23/23 (32−9=2332 - 9 = 23), which increments the third octet by 22 per subnet (256−254=2256 - 254 = 2). Starting sequentially from 10.45.128.010.45.128.0, the subnets are: 1st: 10.45.128.010.45.128.0, 2nd: 10.45.130.010.45.130.0, 3rd: 10.45.132.010.45.132.0, 4th: 10.45.134.010.45.134.0, and 5th: 10.45.136.010.45.136.0.

Step-by-Step Solution

1
Determine the number of host bits required for 500 usable host IP addresses.
9 host bits are required.
The formula for usable hosts is 2h−2≥5002^h - 2 \ge 500. For h=8h=8, 28−2=2542^8 - 2 = 254 hosts (insufficient). For h=9h=9, 29−2=5102^9 - 2 = 510 hosts (sufficient).
2
Calculate the subnet prefix length and block size.
Prefix length is /23/23 and the block size in the third octet is 2.
Subtracting 99 host bits from 3232 total bits gives 32−9=2332 - 9 = 23 (/23/23). The block size per subnet is 224−23=22^{24-23} = 2 in the third octet.
3
Calculate the network ID of the fifth subnet allocated sequentially from 10.45.128.010.45.128.0.
The network address is 10.45.136.0.
The first subnet is 10.45.128.010.45.128.0. Each subsequent subnet increments the third octet by 2. The 5th subnet corresponds to 4 increments (4×2=84 \times 2 = 8): 128+8=136128 + 8 = 136, yielding 10.45.136.0/2310.45.136.0/23.

Key Concept

Host bit calculation and sequential IPv4 subnet allocation
Estimated Time:2m 0s
Question 572Question →

A network architect is evaluating dynamic routing protocols for an enterprise environment with redundant paths. The architect needs to ensure optimal path selection and fast convergence using Interior Gateway Protocols (IGPs). Which of the following statements accurately describe the operational characteristics of OSPF and EIGRP? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: EIGRP calculates backup routes known as feasible successors and maintains them in its topology table to enable rapid failover without recalculating paths.; OSPF routers construct a synchronized Link-State Database (LSDB) representing the network map and run the Shortest Path First algorithm to determine the shortest tree to every destination.

Answer

The statements correctly describing OSPF and EIGRP are: EIGRP maintains precalculated backup routes (feasible successors) in its topology table for fast convergence, and OSPF maintains a synchronized Link-State Database (LSDB) to compute shortest path trees using Dijkstra's algorithm.
EIGRP uses the DUAL algorithm to identify feasible successors in the topology table, guaranteeing loop-free backup routes for instantaneous failover. Additionally, OSPF routers build a synchronized Link-State Database (LSDB) within an area and run Dijkstra's SPF algorithm to calculate the shortest path to every destination subnetwork.

Step-by-Step Solution

1
Analyze EIGRP convergence mechanisms.
EIGRP calculates primary routes (successors) and backup routes (feasible successors) stored in the topology table, enabling fast convergence via DUAL.
If the primary route fails, EIGRP immediately promotes the feasible successor without needing a full recalculation.
2
Analyze OSPF operation and OSI layer encapsulation.
OSPF is a link-state protocol using Dijkstra's algorithm over an identical LSDB, and its packets are encapsulated in IP (Layer 3) headers using protocol number 89.
OSPF is a Layer 3 protocol, not a Layer 2 frame-level protocol, and builds a complete map of the network within an area.
3
Evaluate NAT/PAT interaction with dynamic routing protocols.
PAT translates private sockets to public IP/port combinations at the edge device and does not inject static host routes into RIB tables via dynamic routing protocols.
Routing protocols manage network prefix reachability, whereas PAT manages address translation tables.

Key Concept

Link-State vs Distance-Vector / Advanced Distance-Vector Routing Protocol Operations
Question 573Question →

A network administrator is designing a Variable Length Subnet Mask (VLSM) scheme starting from the base address block 10.100.128.0/2110.100.128.0/21. Subnets must be allocated contiguously without unallocated gaps, prioritized from largest host requirement to smallest as follows:

- Segment 1: Requires at least 500500 usable host IP addresses
- Segment 2: Requires at least 250250 usable host IP addresses
- Segment 3: Requires at least 120120 usable host IP addresses
- Segment 4: Requires a point-to-point link accommodating exactly 22 usable host IP addresses

Which of the following statements regarding this VLSM allocation scheme are correct? (Select THREE.)

Select all that apply

Show answer & explanation

Answer: The broadcast address for Segment 1 is 10.100.129.25510.100.129.255.; The valid usable host IP address range for Segment 3 is 10.100.131.110.100.131.1 through 10.100.131.12610.100.131.126.; The first usable IP address assigned to Segment 4 is 10.100.131.12910.100.131.129.

Answer

The correct statements are: the broadcast address for Segment 1 is 10.100.129.25510.100.129.255, the valid usable host IP address range for Segment 3 is 10.100.131.110.100.131.1 through 10.100.131.12610.100.131.126, and the first usable IP address assigned to Segment 4 is 10.100.131.12910.100.131.129.
The statement regarding Segment 1's broadcast address being 10.100.129.25510.100.129.255 is correct because a /23/23 subnet spanning 10.100.128.010.100.128.0 ends at 10.100.129.25510.100.129.255. The statement regarding Segment 3's usable range (10.100.131.110.100.131.1–10.100.131.12610.100.131.126) is correct because its /25/25 allocation spans 10.100.131.010.100.131.0 to 10.100.131.12710.100.131.127. The statement specifying Segment 4's first usable IP as 10.100.131.12910.100.131.129 is correct because Segment 4's /30/30 block begins at Network ID 10.100.131.12810.100.131.128.

Step-by-Step Solution

1
Calculate subnet requirement and bounds for Segment 1
Segment 1 needs 500 usable hosts. 29−2=510≥5002^9 - 2 = 510 \ge 500, requiring a /23/23 block (255.255.254.0255.255.254.0). Starting at 10.100.128.0/2310.100.128.0/23, the network ID is 10.100.128.010.100.128.0 and the broadcast address is 10.100.129.25510.100.129.255. Total usable hosts is 510 (512 total IPs minus 2).
VLSM allocations must satisfy host requirements using the smallest matching block (2n−22^n - 2).
2
Calculate subnet requirement and bounds for Segment 2
Segment 2 needs 250 usable hosts. 28−2=254≥2502^8 - 2 = 254 \ge 250, requiring a /24/24 block (255.255.255.0255.255.255.0). Contiguously following Segment 1, Segment 2 starts at 10.100.130.0/2410.100.130.0/24. Network ID is 10.100.130.010.100.130.0, broadcast address is 10.100.130.25510.100.130.255.
The next available IP after 10.100.129.25510.100.129.255 is 10.100.130.010.100.130.0.
3
Calculate subnet requirement and bounds for Segment 3
Segment 3 needs 120 usable hosts. 27−2=126≥1202^7 - 2 = 126 \ge 120, requiring a /25/25 block (255.255.255.128255.255.255.128). Contiguously following Segment 2, Segment 3 starts at 10.100.131.0/2510.100.131.0/25. Network ID is 10.100.131.010.100.131.0, broadcast address is 10.100.131.12710.100.131.127, usable range is 10.100.131.110.100.131.1 to 10.100.131.12610.100.131.126.
The next available IP after 10.100.130.25510.100.130.255 is 10.100.131.010.100.131.0.
4
Calculate subnet requirement and bounds for Segment 4
Segment 4 needs 2 usable hosts. 22−2=22^2 - 2 = 2, requiring a /30/30 block (255.255.255.252255.255.255.252). Contiguously following Segment 3, Segment 4 starts at 10.100.131.128/3010.100.131.128/30. Network ID is 10.100.131.12810.100.131.128, first usable IP is 10.100.131.12910.100.131.129, second usable IP is 10.100.131.13010.100.131.130, broadcast address is 10.100.131.13110.100.131.131.
The next available IP after 10.100.131.12710.100.131.127 is 10.100.131.12810.100.131.128.

Key Concept

Variable Length Subnet Masking (VLSM) and IPv4 Usable Host Calculations
Question 574Question →

A network administrator configures a DHCP relay agent on a Layer 3 switch interface to support host workstations on VLAN 25 (10.25.0.0/2410.25.0.0/24, default gateway 10.25.0.110.25.0.1). The centralized DHCP server resides on VLAN 100 (10.100.0.510.100.0.5). When an unconfigured client on VLAN 25 broadcasts a DHCPDISCOVER packet, which TWO of the following actions does the DHCP relay agent execute to ensure the DHCP server correctly processes the request?

Select all that apply

Show answer & explanation

Answer: It converts the incoming client broadcast packet into a Layer 3 unicast packet destined for 10.100.0.510.100.0.5.; It populates the Gateway IP Address (`giaddr`) field in the DHCP header with 10.25.0.110.25.0.1.

Answer

The DHCP relay agent converts the host broadcast request into a unicast packet directed to the DHCP server (10.100.0.510.100.0.5) and populates the `giaddr` field with the receiving gateway interface IP address (10.25.0.110.25.0.1).
When a DHCP relay agent processes a client's broadcast request, it encapsulates the message into a Layer 3 unicast packet destined for the centralized DHCP server's IP address (10.100.0.510.100.0.5). To inform the DHCP server which subnet scope must be used for address assignment, the relay agent places the IP address of its receiving interface (10.25.0.110.25.0.1) into the Gateway IP Address (`giaddr`) field of the DHCP header.

Step-by-Step Solution

1
Analyze client broadcast message reception
The host on VLAN 25 broadcasts a DHCPDISCOVER message using source IP 0.0.0.00.0.0.0, destination IP 255.255.255.255255.255.255.255, UDP source port 68, and UDP destination port 67.
Unconfigured DHCP clients cannot route traffic outside their local broadcast domain.
2
Examine DHCP relay agent packet processing
The Layer 3 switch interface intercepts the broadcast, writes its own interface IP (10.25.0.110.25.0.1) into the `giaddr` header field, and converts the destination IP to the unicast address of the remote DHCP server (10.100.0.510.100.0.5).
The server requires the `giaddr` value to select the correct address pool (10.25.0.0/2410.25.0.0/24) and unicast addressing to cross routed boundaries.

Key Concept

DHCP Relay Agent and GIADDR Operation
Estimated Time:1m 30s
Question 575Question →

A computer connected to Switch 1 on an access port assigned to VLAN 40 sends a unicast Ethernet frame to a server connected to Switch 2 on an access port also assigned to VLAN 40. The two switches are interconnected by an 802.1Q trunk link where VLAN 40 is configured as the native VLAN on both sides. What happens to the IEEE 802.1Q header of the frame as it travels from the sending computer to the receiving server?

Show answer & explanation

Answer: The frame remains untagged throughout its entire transmission from the source computer to the destination server.

Answer

The frame remains untagged throughout its entire transmission from the source computer to the destination server.
Under the IEEE 802.1Q standard, traffic associated with the native VLAN is sent across a trunk link untagged. Since the sending host sends an untagged frame, Switch 1 forwards it untagged across the trunk, and Switch 2 delivers it untagged to the receiving server, the frame stays untagged along the entire path.

Step-by-Step Solution

1
Analyze host-to-switch egress on access port
The source computer sends a standard untagged Ethernet frame to Switch 1.
Standard end hosts on access ports do not append IEEE 802.1Q tags to outgoing Ethernet frames.
2
Determine trunk encapsulation behavior for the native VLAN
Switch 1 identifies the frame as belonging to VLAN 40, which matches the native VLAN of the 802.1Q trunk, and forwards it across the trunk link without adding a tag.
By default under the IEEE 802.1Q standard, frames belonging to the native VLAN are forwarded untagged across trunk links.
3
Analyze trunk ingress and access port egress on the receiving switch
Switch 2 receives the untagged frame on its trunk port, maps it to its native VLAN (VLAN 40), and delivers it untagged out the destination access port to the server.
Untagged frames received on an 802.1Q trunk port are automatically placed into the configured native VLAN.

Key Concept

802.1Q Native VLAN Trunking Behavior
Estimated Time:1m 15s
Question 576Question →

A network administrator is troubleshooting connectivity issues on a router filtering traffic between client workstations on subnet 172.16.20.0/24172.16.20.0/24 and an internal core server on host 10.10.1.5/3210.10.1.5/32. Workstations are unable to resolve domain names using the internal DNS service hosted on 10.10.1.510.10.1.5. The administrator inspects the following IPv4 extended Access Control List (ACL) applied inbound on the workstation interface:

`10 permit tcp 172.16.20.0 0.0.0.255 host 10.10.1.5 eq 53`
`20 permit tcp 172.16.20.0 0.0.0.255 host 10.10.1.5 eq 88`
`30 permit tcp 172.16.20.0 0.0.0.255 host 10.10.1.5 eq 445`

Which of the following best explains why standard DNS queries sent by client workstations to the server are being dropped?

Show answer & explanation

Answer: Standard client DNS lookups primarily use UDP port 53, but rule 10 only permits TCP port 53, causing UDP queries to fall through to the implicit deny rule.

Answer

Standard client DNS lookups primarily use UDP port 53, but rule 10 only permits TCP port 53, causing UDP queries to fall through to the implicit deny rule.
Standard DNS client queries use UDP port 53 for fast, connectionless name lookups. Rule 10 specifies protocol `tcp`, which does not match UDP packets. Unmatched UDP DNS queries pass through lines 10, 20, and 30 without matching, hitting the ACL's mandatory implicit deny rule at the bottom and getting dropped.

Step-by-Step Solution

1
Analyze the protocol requirement for standard DNS queries.
Standard client-to-server DNS name resolution requests are sent using UDP datagrams to port 53 (TCP port 53 is reserved for zone transfers or responses exceeding 512 bytes).
Identifying the transport-layer protocol used by standard DNS client software is necessary to evaluate ACL rule parameters.
2
Evaluate the configured ACL entries against client DNS traffic.
Line 10 permits `tcp` port 53 traffic from `172.16.20.0/24` to `10.10.1.5`. Incoming UDP packets targeting port 53 do not match the protocol field (`tcp`) of line 10.
ACL rules evaluate packets sequentially and require exact matches for configured fields (protocol, source, destination, port).
3
Determine packet disposition for unmatched traffic.
The incoming UDP packets fail to match lines 10, 20, and 30, reaching the end of the access control list where they are dropped by the implicit `deny ip any any` rule.
Every network ACL ends with an invisible default action that blocks all traffic not explicitly permitted.

Key Concept

Stateless ACL matching rules, transport layer protocol distinctions (TCP vs UDP for DNS), and the implicit deny behavior.
Estimated Time:2m 0s
Question 577Question →

Which wireless security standard introduced mandatory support for the Counter Mode Cipher Block Chaining Message Authentication Code Protocol (CCMP), utilizing the Advanced Encryption Standard (AES) cipher to replace legacy TKIP encryption?

Show answer & explanation

Answer: WPA2

Answer

WPA2
WPA2 (Wi-Fi Protected Access 2), defined under IEEE 802.11i, introduced mandatory support for CCMP, which employs the 128-bit AES block cipher to deliver strong confidentiality and packet integrity.

Step-by-Step Solution

1
Identify the cryptographic mechanism described in the question prompt.
The prompt specifies the introduction of CCMP (Counter Mode Cipher Block Chaining Message Authentication Code Protocol) using AES.
Understanding which standard first mandated AES-CCMP is key to classifying 802.11 security generations.
2
Compare historical 802.11 security standards and their default encryption ciphers.
WEP used RC4 with static keys, WPA introduced TKIP over RC4, WPA2 introduced CCMP with AES, and WPA3 upgraded to GCMP-256 and SAE.
Mapping standards to ciphers isolates WPA2 as the standard that introduced CCMP.

Key Concept

Wireless Encryption Protocols and Ciphers
Question 578Question →

A remote worker needs to access internal corporate web applications over the Internet using a standard web browser with SSL/TLS encryption, without installing any dedicated software on the laptop. Which of the following remote access solutions is being utilized?

Show answer & explanation

Answer: Clientless SSL VPN

Answer

Clientless SSL VPN is the technology that provides secure remote access via a standard web browser without requiring client software installation.
Clientless SSL VPN enables secure remote access to web-based internal applications directly through a standard web browser using SSL/TLS encryption. Because the browser handles the cryptographic session, no additional client software needs to be deployed or managed on the endpoint device.

Step-by-Step Solution

1
Analyze the access requirements described in the scenario.
The scenario specifies connection through a standard web browser, SSL/TLS encryption, and no dedicated client software installation.
Identifying endpoint application requirements and transport mechanisms determines the appropriate VPN model.
2
Match the requirement against available remote access technologies.
Clientless SSL VPN runs directly within a Web browser using standard TLS, satisfying all endpoint restrictions.
IPsec requires pre-installed host software, while RADIUS and SNMPv3 serve authentication and network management purposes respectively.

Key Concept

Clientless SSL VPN vs. Client-based Remote Access
Estimated Time:45s
Question 579Question →

An enterprise network engineer is documenting the connection workflow for remote employees accessing internal web applications via a Clientless SSL/TLS VPN gateway integrated with a central RADIUS AAA server. Arrange the operational steps in the correct chronological sequence from the initial remote connection request to the retrieval of internal corporate resources.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence begins with establishing the underlying TLS session on TCP port 443, presenting the web authentication portal, forwarding a RADIUS Access-Request to the AAA server, receiving the RADIUS Access-Accept response with authorization parameters, generating the authenticated portal session with an HTTP cookie, and finally proxying client HTTP requests to internal servers.
Establishing a Clientless SSL VPN session requires a strict logical progression: first, negotiating an encrypted TLS channel (TCP 443) to protect credential transmission; second, presenting the login interface; third, using RADIUS AAA protocol to forward credentials from the gateway to the backend authentication server; fourth, receiving authorization via RADIUS Access-Accept; fifth, issuing session state cookies and rendering the application portal; and sixth, acting as a Layer 7 reverse proxy for requests to internal corporate resources.

Step-by-Step Solution

1
Establish encrypted transport layer connection
TLS session negotiated over TCP port 443 between client browser and VPN concentrator.
Security requires creating an encrypted channel before transmitting sensitive user authentication data.
2
Present authentication interface
VPN gateway delivers the HTML login portal to the remote client browser.
The gateway must collect user credentials over the secure channel.
3
Delegate authentication to RADIUS AAA server
VPN gateway formats an Access-Request message and sends it over UDP (port 1812/1645) to RADIUS.
The VPN gateway functions as a RADIUS client and delegates identity verification to central AAA infrastructure.
4
Receive AAA authorization validation
RADIUS server validates credentials and responds with an Access-Accept packet containing user group policies.
The central directory confirms identity and communicates access constraints to the VPN concentrator.
5
Instantiate client session state
VPN gateway sets a secure HTTP session cookie and renders the customized portal page.
Session cookies maintain state across subsequent HTTPS requests without re-authenticating on every page load.
6
Reverse-proxy internal application traffic
The gateway accepts portal requests, communicates with internal application servers, and returns re-encrypted responses to the client.
Clientless SSL VPN access operates at Layer 7, functioning as a reverse proxy without assigning an internal virtual IP adapter to the endpoint.

Key Concept

Clientless SSL/TLS VPN Architecture & AAA/RADIUS Sequence
Question 580Question →

A network administrator needs to monitor performance metrics on core switches while ensuring that all polling traffic is authenticated and payload data is encrypted across the network. Which of the following SNMP configurations should the administrator deploy?

Show answer & explanation

Answer: SNMPv3 with authPriv security level

Answer

SNMPv3 with authPriv security level
SNMPv3 with the authPriv security level meets both requirements by utilizing cryptographic authentication along with payload encryption.

Step-by-Step Solution

1
Identify the security requirements for network performance monitoring.
The requirement mandates both authentication and payload encryption for monitoring traffic.
Unencrypted polling traffic exposes sensitive system OIDs and operational data to network eavesdropping.
2
Select the SNMP version and security mode that satisfies both requirements.
SNMPv3 with authPriv provides cryptographic user authentication (such as SHA) and data privacy (such as AES encryption).
SNMPv1 and SNMPv2c lack cryptographic protection, and lower SNMPv3 security levels do not encrypt the data payload.

Key Concept

SNMP Security Levels and Versions
PreviousPage 29 / 112Next
All practice questions — CompTIA Network+ | Examkin