Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 61Question →

A network engineer is troubleshooting an issue where endpoints on a recently provisioned subnet are unable to communicate with their default gateway. The engineer needs to quickly verify the assigned IP address ranges, VLAN designations, and router logical interfaces across the network segments without needing physical cable runs or rack position details. Which documentation artifact should the engineer consult to locate this information?

Show answer & explanation

Answer: Logical topology diagram

Answer

The logical topology diagram is the correct document to consult because it details Layer 2 and Layer 3 relationships, including VLAN IDs, IP subnet assignments, and default gateway router interfaces.
A logical topology diagram focuses on how network traffic flows logically through the infrastructure. It documents Layer 2 and Layer 3 details such as IP subnets, VLAN boundaries, network masks, virtual router interface addresses, and routing protocols, making it the ideal resource for addressing gateway reachability and IP scheme issues.

Step-by-Step Solution

1
Identify the operational requirement from the scenario
The engineer needs information regarding IP addressing schemes, VLAN IDs, and logical gateway interfaces.
Resolving gateway reachability issues requires inspecting Layer 2 and Layer 3 logical configurations.
2
Distinguish between logical and physical network documentation artifacts
Physical diagrams and rack elevations map physical hardware layout, while logical diagrams map data paths, protocols, subnets, and routing relationships.
Selecting the appropriate diagram type ensures quick access to subnet and VLAN information.
3
Select the documentation artifact that contains the required Layer 2/3 details
Logical topology diagrams provide direct visibility into subnet allocations, gateway IPs, and VLAN configurations.
This artifact directly addresses the engineer's need to verify IP address ranges and gateway configurations.

Key Concept

Logical Topology Diagrams vs Physical Network Documentation
Estimated Time:1m 0s
Question 62Question →

A network engineer is provisioning subnets from the assigned IPv4 block 10.150.12.0/2210.150.12.0/22 for an industrial automation network. Each production segment requires a subnet capable of accommodating at least 110110 usable IP addresses for automated controllers and monitoring sensors. What is the maximum number of subnets meeting this requirement that can be created from the allocated block?

Show answer & explanation

Answer: 8

Answer

The maximum number of valid subnets that can be created is 8.
To host at least 110110 usable IP addresses per segment, 77 host bits are required because 27−2=1262^7 - 2 = 126 usable host IPs (66 bits only provide 26−2=622^6 - 2 = 62 usable IPs). A 77-bit host field corresponds to a /25/25 prefix length (32−7=2532 - 7 = 25). Subnetting a /22/22 block into /25/25 subnets yields 225−22=23=82^{25 - 22} = 2^3 = 8 subnets.

Step-by-Step Solution

1
Calculate the host bits needed for at least 110 usable IP addresses.
7 host bits are required because 27−2=1262^7 - 2 = 126 usable hosts (26−2=622^6 - 2 = 62 is insufficient).
Each subnet must accommodate 110 hosts, requiring 7 host bits.
2
Determine the required prefix length for each subnet.
Subnet prefix length is /25/25 (32−7=2532 - 7 = 25).
Subtracting host bits from 32 gives the network prefix length.
3
Determine the number of /25/25 subnets created from a /22/22 block.
2(25−22)=23=82^{(25 - 22)} = 2^3 = 8 subnets.
The difference between the new prefix length (/25) and original prefix length (/22) provides 3 subnet bits.

Key Concept

Subnet sizing and host capacity calculation using IPv4 CIDR notation
Question 63Question →

A network administrator is deploying IPv6 across a new corporate branch office. To optimize IP allocation, the administrator subnets the organization's assigned prefix into /68/68 subnets and configures one of these /68/68 subnets on the gateway router's local interface. Although Router Advertisement (RA) messages are actively transmitted across the LAN, host workstations configured to use Stateless Address Autoconfiguration (SLAAC) fail to acquire global unicast addresses. Which of the following best explains why SLAAC is failing to automatically configure host addresses on this subnet?

Show answer & explanation

Answer: SLAAC mandates a prefix length of exactly /64 on the interface to generate 64-bit host interface identifiers.

Answer

SLAAC mandates a prefix length of exactly /64 on the interface to generate 64-bit host interface identifiers.
Stateless Address Autoconfiguration (SLAAC), defined in RFC 4862, requires a /64 subnet prefix length. Since IPv6 host interface identifiers (generated via EUI-64 or privacy extensions) are 64 bits long, the host expects a 64-bit prefix from ICMPv6 Router Advertisement messages to complete the 128-bit IPv6 address structure. If a subnet prefix longer than /64 (such as /68) is configured on the gateway router, hosts will refrain from using SLAAC to autoconfigure global unicast addresses.

Step-by-Step Solution

1
Analyze the SLAAC specification standard (RFC 4862) regarding prefix requirements.
SLAAC combines a /64 network prefix received from Router Advertisements with a 64-bit interface identifier (EUI-64 or opaque random string) to form a 128-bit IPv6 address.
Because IPv6 host interface IDs are defined as 64 bits in standard SLAAC autoconfiguration, the network prefix must be exactly /64.
2
Evaluate the network configuration described in the scenario.
The router interface was configured with a /68 prefix length.
When a router advertises a prefix length other than /64 in ICMPv6 Router Advertisement Prefix Information Options, client SLAAC implementations ignore the prefix for autoconfiguration.
3
Select the option that correctly identifies the /64 prefix requirement constraint.
The requirement for an exact /64 prefix length explains the autoconfiguration failure.
Correcting the interface subnetting to /64 will allow client workstations to automatically build their global unicast IPv6 addresses.

Key Concept

SLAAC Prefix Length Requirement (/64)
Question 64Question →

A critical network management server experiences a hardware controller failure on Wednesday at 11:15 AM. The administrator must restore the system to the most recent operational state prior to the crash. The organization's backup schedule consists of a full backup executed every Sunday at 00:00, daily incremental backups executed Monday and Tuesday at 23:00, and hourly transaction log backups executed on the hour. Which of the following procedures describes the correct restoration sequence required to recover the server with minimal data loss?

Show answer & explanation

Answer: Restore the Sunday full backup, apply the Monday and Tuesday incremental backups sequentially, and then apply the Wednesday hourly transaction log backups from 01:00 through 11:00.

Answer

Restore the Sunday full backup, apply the Monday and Tuesday incremental backups sequentially, and then apply the Wednesday hourly transaction log backups from 01:00 through 11:00.
Restoring an incremental backup strategy requires starting with the last full backup and sequentially applying every single incremental backup executed since that full backup. To achieve the Recovery Point Objective (RPO) nearest to the 11:15 AM outage, all hourly transaction log backups created on Wednesday up to 11:00 must then be applied in order.

Step-by-Step Solution

1
Identify the backup strategy type and baseline requirement.
The backup schedule utilizes incremental backups, which require the baseline full backup from Sunday 00:00.
Incremental backups rely on previous full and incremental sets to maintain cumulative file state changes.
2
Determine the chronological order of daily incremental backups.
The Monday 23:00 and Tuesday 23:00 incremental backups must both be applied in exact chronological order.
Unlike differential backups, incremental backups only clear the archive bit for data modified since the previous incremental backup.
3
Apply point-in-time transaction log backups to reach the time nearest to the outage.
Apply hourly transaction log backups from Wednesday 01:00 through 11:00.
This restores granular changes made throughout Wednesday morning prior to the 11:15 AM controller failure.

Key Concept

Incremental Backup Restoration Mechanics
Question 65Question →

A network administrator needs to document how IP addresses, subnets, and VLAN IDs are allocated across different departments in an enterprise, without showing physical cable locations or rack equipment positions. Which type of network document is best suited for this task?

Show answer & explanation

Answer: Logical network diagram

Answer

Logical network diagram
Logical network diagrams display the high-level flow of data, IP addressing schemes, subnet boundaries, and VLAN structures across a network infrastructure, abstracting away physical cabling details and rack mounting locations.

Step-by-Step Solution

1
Identify the core requirement in the scenario
The requirement calls for documenting IP addresses, subnets, and VLAN assignments without focusing on physical cabling or physical hardware placement.
Different network documentation types serve distinct operational roles (logical vs. physical).
2
Compare network diagram types to the requirements
Logical network diagrams illustrate network flow, IP addressing schemas, subnets, and VLAN configurations across devices.
Physical diagrams focus on physical layout, whereas logical diagrams abstract physical components into network-layer relationships.

Key Concept

Logical vs. Physical Network Documentation
Question 66Question →

A network administrator configures a static 1:1 NAT mapping on an enterprise edge router for an internal application server with Inside Local address 192.168.10.50192.168.10.50 to Inside Global address 198.51.100.50198.51.100.50. Additionally, a dynamic Port Address Translation (PAT / Overload) rule is configured to translate all host traffic from 192.168.10.0/24192.168.10.0/24 to the router's public interface address (198.51.100.1198.51.100.1). Remote clients on the internet can successfully initiate connections to the application server using 198.51.100.50198.51.100.50. However, when the internal application server itself initiates outbound requests to a partner API service that enforces IP whitelist security, the partner API rejects the connection. Network captures reveal that outbound packets originating from the server are sent using source IP 198.51.100.1198.51.100.1 with an ephemeral port rather than 198.51.100.50198.51.100.50. Which of the following best explains why this issue occurs?

Show answer & explanation

Answer: The router evaluates the dynamic PAT rule prior to the static NAT mapping in its translation table for outbound connections.

Answer

The router evaluates the dynamic PAT rule prior to the static NAT mapping in its translation table for outbound connections.
In router and firewall configurations, NAT rules are processed in a defined order of execution. When an internal server with a static NAT mapping initiates an outbound session, the router checks the source IP against its NAT entries. If a generic PAT/Overload rule matching the server's subnet is evaluated before the static NAT mapping, outbound packets are dynamically translated to the PAT address (198.51.100.1198.51.100.1) with a randomized ephemeral port. Inbound traffic addressed directly to 198.51.100.50198.51.100.50 still succeeds because inbound static NAT entries take direct precedence for incoming destination translation.

Step-by-Step Solution

1
Analyze the bidirectional nature of Static NAT versus dynamic PAT.
Static 1:1 NAT provides bidirectional translation between 192.168.10.50192.168.10.50 (Inside Local) and 198.51.100.50198.51.100.50 (Inside Global). PAT translates multiple internal IPs to a shared public IP using unique Layer 4 port numbers.
Understanding host reachability in both directions helps isolate why inbound connectivity works while outbound traffic gets remapped.
2
Trace the packet flow for outbound traffic originating from 192.168.10.50192.168.10.50.
Outbound packets from the server match the source network 192.168.10.0/24192.168.10.0/24.
When the server initiates a connection outbound, the router checks its NAT rule lookup order to determine how to translate the source IP address.
3
Determine the cause of the unexpected translation address (198.51.100.1198.51.100.1).
The router encounters and executes the dynamic PAT overload rule before evaluating the static NAT entry, resulting in translation to the outside interface IP.
If the rule evaluation order or access control list priority favours the PAT statement for outbound flows, the static 1:1 translation for outbound traffic is bypassed.

Key Concept

NAT/PAT Rule Processing Order and Bidirectional Static NAT Behavior
Estimated Time:2m 0s
Question 67Question →

A network engineering team is designing a multi-floor high-density enterprise wireless deployment using IEEE 802.11ax access points operating in both the 2.4 GHz and 5 GHz bands. During the predictive site survey phase, the team must configure the deployment to minimize co-channel interference (CCI), prevent coverage overlap issues, and optimize client band steering toward 5 GHz. Which of the following technical design decisions and configuration strategies should the team implement? (Select THREE).

Select all that apply

Show answer & explanation

Answer: Stagger 2.4 GHz channel assignments using non-overlapping channels 1, 6, and 11 across adjacent access points, while selectively disabling 2.4 GHz radios on redundant access points in dense areas.; Restrict 5 GHz channel widths to 20 MHz or 40 MHz rather than 80 MHz or 160 MHz channel bonding in high-density areas.; Lower the transmit power on 2.4 GHz radios relative to 5 GHz radios to equalize coverage cell sizes and encourage 5 GHz client association.

Answer

The correct strategies are: 1) Staggering 2.4 GHz channels using non-overlapping channels 1, 6, and 11 while selectively disabling redundant 2.4 GHz radios; 2) Restricting 5 GHz channel widths to 20 MHz or 40 MHz to preserve available non-overlapping channels; and 3) Lowering 2.4 GHz transmit power relative to 5 GHz to balance cell sizes and foster band steering.
In high-density enterprise wireless deployments, effective RF planning relies on eliminating channel overlap, maximizing independent channel count, and balancing cell boundaries. First, using non-overlapping 2.4 GHz channels (1, 6, and 11) and turning off excess 2.4 GHz radios prevents excessive co-channel overlap. Second, keeping 5 GHz channel widths to 20 MHz or 40 MHz preserves non-overlapping channel availability, avoiding co-channel interference caused by wide 80 MHz channel bonding. Third, turning down 2.4 GHz transmit power reduces its coverage radius to match 5 GHz, guiding dual-band clients onto the faster 5 GHz band.

Step-by-Step Solution

1
Analyze 2.4 GHz spectrum planning and channel allocation constraints.
Identify that 2.4 GHz only offers three non-overlapping 20 MHz channels (1, 6, and 11 in standard domain planning). Adjacent or bonded channel assignments (such as channels 3 or 9, or 80 MHz bonding) induce severe interference. Disabling redundant 2.4 GHz radios reduces co-channel interference in dense deployments.
2.4 GHz signals travel farther and penetrate obstacles better, causing excessive cell overlap if every AP broadcasts 2.4 GHz at high power.
2
Evaluate 5 GHz channel width design in high-density deployments.
Determine that while 80 MHz channel bonding increases throughput, it reduces the total count of non-overlapping channels. High-density AP environments require more non-overlapping channels (using 20 MHz or 40 MHz channel widths) to prevent co-channel interference.
Maximizing channel count per spatial area takes priority over individual peak channel bandwidth in dense enterprise environments.
3
Assess transmit power matching and cell boundary management across bands.
Reduce 2.4 GHz transmit power so its RF footprint matches the smaller footprint of the 5 GHz radio on the same access point.
Equalizing coverage cell boundaries ensures smooth client roaming and encourages dual-band client devices to connect to the less congested 5 GHz band.

Key Concept

Enterprise Wireless Cell Planning, Channel Allocation, and Co-Channel Interference Mitigation
Question 68Question →

A network administrator needs to perform remote power management on individual rack-mounted network devices in a server room. Specifically, when an appliance experiences an operating system freeze and stops responding to network traffic, the administrator must be able to reboot the specific device by toggling its electrical receptacle remotely over the network. Which device should be installed to meet this requirement?

Show answer & explanation

Answer: Switched Power Distribution Unit (PDU)

Answer

Switched Power Distribution Unit (PDU)
A switched Power Distribution Unit (PDU) features intelligent network-connected management interfaces that allow network engineers to power-cycle individual electrical outlets remotely. This provides out-of-band power management to force a hard reboot on hardware whose operating system or network stack has completely crashed.

Step-by-Step Solution

1
Identify the administrative requirement in the scenario.
The goal is to remotely power cycle (hard reboot) an individual device whose operating system has frozen.
When an OS hangs, software-based in-band protocols (such as SSH, RDP, or Telnet) become completely unresponsive.
2
Evaluate hardware capabilities for out-of-band power management.
A Switched PDU provides network-addressable power outlets that can be toggled on and off independently.
It operates independently of the managed target device's operating system state.

Key Concept

Remote Power Management and Switched PDUs
Question 69Question →

A network systems engineer is configuring edge firewall access control lists (ACLs) to allow administrators to deploy a secure web management portal that authenticates domain users against an encrypted centralized directory server. Which TWO of the following port and transport protocol combinations must be permitted through the firewall to support these services? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: TCP 443; TCP 636

Answer

The firewall must permit TCP port 443 for HTTPS web access and TCP port 636 for secure LDAPS directory service authentication.
The scenario requires permitting secure web portal traffic (HTTPS) and encrypted directory authentication (LDAPS). HTTPS relies on TCP port 443 for TLS-encrypted communication. LDAPS relies on TCP port 636 to secure directory queries over TLS. Therefore, permitting TCP 443 and TCP 636 fulfills all secure connectivity requirements.

Step-by-Step Solution

1
Identify the required secure web service protocol and its default transport port.
Secure web management uses HTTPS, which operates over TCP port 443.
HTTPS uses TLS encryption on connection-oriented TCP port 443.
2
Identify the required secure directory service authentication protocol and its default transport port.
Encrypted directory authentication uses LDAPS, which operates over TCP port 636.
LDAPS provides encrypted access to directory services over TLS on TCP port 636.
3
Evaluate transport layer protocol and port number requirements against invalid options.
Rule out UDP port 636 and TCP port 389.
LDAPS requires TCP for reliable connection management (ruling out UDP), and standard unencrypted LDAP uses port 389 rather than port 636.

Key Concept

Common Secure Network Ports and Protocols (HTTPS and LDAPS)
Question 70Question →

A system administrator is configuring static IP addresses for IoT monitoring sensors within a subnet assigned the network address block 192.168.88.0/26192.168.88.0/26. Which of the following IP addresses is a valid usable host address for a sensor in this subnet?

Show answer & explanation

Answer: 192.168.88.45192.168.88.45

Answer

The IP address 192.168.88.45192.168.88.45 is a valid usable host address within the 192.168.88.0/26192.168.88.0/26 subnet.
For a /26/26 prefix, the total number of addresses in the subnet is 232−26=642^{32-26} = 64. The address block spans from 192.168.88.0192.168.88.0 to 192.168.88.63192.168.88.63. Subtracting the network address (192.168.88.0192.168.88.0) and the broadcast address (192.168.88.63192.168.88.63) yields a usable host range of 192.168.88.1192.168.88.1 through 192.168.88.62192.168.88.62. The value 192.168.88.45192.168.88.45 falls within this valid range.

Step-by-Step Solution

1
Determine the block size from the CIDR prefix length
A /26/26 prefix uses 32−26=632 - 26 = 6 host bits. The total block size is 26=642^6 = 64 addresses.
Calculating the total number of addresses per block establishes the subnet boundary.
2
Calculate the network ID and broadcast address
The network address is 192.168.88.0192.168.88.0. The broadcast address is 192.168.88.0+64−1=192.168.88.63192.168.88.0 + 64 - 1 = 192.168.88.63.
The first address in the block is the network ID and the last address is the broadcast address.
3
Identify the range of usable host IP addresses
Usable host range is from 192.168.88.1192.168.88.1 (first usable) to 192.168.88.62192.168.88.62 (last usable).
Usable host IPs exclude the network ID and the broadcast address.
4
Evaluate the given choices against the usable host range
The address 192.168.88.45192.168.88.45 is the only candidate that falls strictly between 192.168.88.1192.168.88.1 and 192.168.88.62192.168.88.62.
Only addresses within the usable host range can be assigned to host devices.

Key Concept

IPv4 Usable Host Addressing in CIDR Subnets
Question 71Question →

A network administrator is designing a dedicated VLAN for a warehouse automation system that requires static IPv4 addresses for 1515 smart sensor nodes. To conserve network address space, the administrator must select the smallest possible CIDR subnet prefix that accommodates all required host nodes. Which prefix length should be configured for this subnet?

Show answer & explanation

Answer: /27

Answer

The prefix /27 is the correct choice because it provides 30 usable host IP addresses, satisfying the 15-node requirement while minimizing wasted address space.
To calculate usable IPv4 addresses, the formula 2n−22^n - 2 must be used, where nn is the number of host bits. For 1515 devices, a /28 mask provides 24=162^4 = 16 total addresses, but only 16−2=1416 - 2 = 14 usable host addresses, which is insufficient. Moving to a /27 mask provides n=5n = 5 host bits, yielding 25−2=302^5 - 2 = 30 usable host addresses. This is the smallest prefix length that satisfies the requirement of 15 hosts.

Step-by-Step Solution

1
Determine host bits required using the formula 2n−2≥required hosts2^n - 2 \ge \text{required hosts}
For 15 hosts: 2n−2≥15  ⟹  2n≥172^n - 2 \ge 15 \implies 2^n \ge 17. The smallest integer nn satisfying this is n=5n = 5 host bits (25=322^5 = 32).
Two IP addresses in every standard IPv4 subnet are reserved for the Network ID (all host bits 0) and Broadcast address (all host bits 1).
2
Calculate the CIDR prefix length from the host bits
Prefix length =32−5=27= 32 - 5 = 27 (written as /27).
An IPv4 address consists of 32 bits total. Subtracting host bits yields network prefix bits.
3
Verify usable host count for /27
25−2=302^5 - 2 = 30 usable addresses. Since 30≥1530 \ge 15, /27 is the smallest valid subnet mask.
A /28 prefix only yields 24−2=142^4 - 2 = 14 usable host addresses, failing to support 15 nodes.

Key Concept

Subnet Usable Host Calculation
Question 72Question →

A network engineer is troubleshooting high latency and packet retransmissions in a densely populated multi-tenant office building. A site survey reveals that four adjacent enterprise access points (APs) in the 5 GHz spectrum were all configured with 80 MHz channel bonding using channels 36, 40, 44, and 48 (UNII-1 band). Because these four 20 MHz sub-channels comprise a single 80 MHz bonded channel, all four access points are competing for the exact same frequency space. Which of the following channel management strategies should the engineer implement to eliminate co-channel interference while maintaining distinct, non-overlapping channels for each access point?

Show answer & explanation

Answer: Reduce the channel width of each access point from 80 MHz to 20 MHz and assign distinct channels 36, 40, 44, and 48 across the four access points.

Answer

Reduce the channel width of each access point from 80 MHz to 20 MHz and assign distinct channels 36, 40, 44, and 48 across the four access points.
Reducing the channel width from 80 MHz to 20 MHz separates the single wide channel into four independent, non-overlapping 20 MHz channels (36, 40, 44, and 48). Assigning one distinct 20 MHz channel to each access point completely eliminates co-channel interference (CCI) and resolves contention issues.

Step-by-Step Solution

1
Analyze the existing channel allocation and spectrum usage.
The four access points are operating on an 80 MHz channel width that spans channels 36, 40, 44, and 48 simultaneously, forcing all four APs into the same collision domain.
When channels are bonded into an 80 MHz width, the individual 20 MHz sub-channels no longer function independently.
2
Evaluate channel width modification to create non-overlapping frequency spaces.
Reducing the channel width to 20 MHz yields four individual, non-overlapping channels (36, 40, 44, and 48) in the 5 GHz UNII-1 band.
Operating each AP on a dedicated 20 MHz channel eliminates co-channel contention and allows simultaneous transmissions.

Key Concept

5 GHz Channel Bonding and Co-Channel Interference Mitigation
Question 73Question →

During a routine wireless inspection, a technician discovers that an access point positioned between two existing access points operating on channels 1 and 6 has been configured to use channel 4, resulting in severe adjacent-channel interference. Which channel should be assigned to this access point to ensure all three access points use non-overlapping channels in the 2.4 GHz band?

Show answer & explanation

Answer: Channel 11

Answer

Channel 11 is the correct choice because channels 1, 6, and 11 are the standard non-overlapping channels in the 2.4 GHz wireless spectrum for North America.
In the 2.4 GHz Wi-Fi spectrum, channels 1, 6, and 11 are the standard non-overlapping channels available in North America. Because the neighboring access points are already deployed on channels 1 and 6, configuring the intermediate access point to channel 11 eliminates adjacent-channel interference.

Step-by-Step Solution

1
Identify the standard non-overlapping 2.4 GHz channels in North America.
The primary non-overlapping channels are channels 1, 6, and 11.
Each standard 2.4 GHz Wi-Fi channel occupies 22 MHz of bandwidth with 5 MHz spacing between channel centers, requiring a minimum gap of 5 channels to avoid spectral overlap.
2
Determine which non-overlapping channel remains unused among the three access points.
With access points already operating on channels 1 and 6, channel 11 is the only remaining non-overlapping option.
Selecting channel 11 isolates the access point's frequency band from channels 1 and 6, resolving adjacent-channel interference.

Key Concept

2.4 GHz Wireless Non-Overlapping Channel Assignment
Estimated Time:45s
Question 74Question →

An enterprise network infrastructure team needs to apply a vendor-recommended operating system update across core routing hardware to address a zero-day vulnerability. In which order should the engineer execute the patch management and maintenance lifecycle steps from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence for network patch management requires isolating and testing the update in a lab, obtaining Change Advisory Board approval with an established rollback strategy, executing a pilot deployment in a staging environment, and finally completing the full production rollout accompanied by post-implementation health checks.
Structured network maintenance follows a linear lifecycle to minimize outage risks: testing the patch in an isolated lab environment comes first to discover defect anomalies; securing formal Change Advisory Board (CAB) approval with documented rollback steps comes second; deploying to a pilot staging environment during a scheduled maintenance window comes third; and completing full production rollout alongside post-deployment auditing comes last.

Step-by-Step Solution

1
Conduct isolated lab testing.
Software integrity and basic compatibility are confirmed without placing live network traffic at risk.
Initial lab validation provides empirical data needed to construct accurate risk assessments for governance reviews.
2
Obtain formal Change Advisory Board authorization.
The change management workflow reviews maintenance windows, emergency contact structures, and rollback parameters.
Enterprise policy strictly prohibits deploying software modifications without prior peer review and change approval.
3
Execute a controlled staging and pilot deployment.
Unexpected bugs or throughput degradation are contained within a small subset of non-essential devices.
Pilot deployment detects environmental anomalies that may not manifest in lab topology settings.
4
Roll out to production and audit systems.
The vulnerability is remediated across all core devices, and post-update operational baselines are verified.
Verification auditing ensures all target systems took the update properly and remain fully functional.

Key Concept

Network Patch Management Lifecycle and Change Management Governance
Question 75Question →

Match each network security authentication protocol or access control framework to its corresponding architectural characteristic and transport specification.

Click a left item, then click its matching right item

Items

RADIUS
TACACS+
Kerberos
802.1X

Matches

Show answer & explanation

Answer

RADIUS matches UDP ports 1812/1813 with password-only encryption; TACACS+ matches TCP port 49 with full payload encryption and decoupled AAA; Kerberos matches Key Distribution Center tickets over port 88; 802.1X matches IEEE Layer 2 port-based access control using EAP encapsulation.
Each item is correctly matched based on its transport protocol, port assignments, and architectural mechanisms. RADIUS utilizes UDP 1812/1813 with password-only attribute encryption. TACACS+ uses TCP port 49 with full payload encryption and separate AAA processes. Kerberos relies on a KDC issuing TGTs on port 88. 802.1X specifies IEEE Layer 2 port-based network access control encapsulating EAP.

Step-by-Step Solution

1
Analyze RADIUS transport and encryption properties
RADIUS operates over connectionless UDP (ports 1812 for authentication and 1813 for accounting), combines authentication and authorization, and encrypts only the password field.
Differentiate RADIUS transport ports and attribute encryption scope.
2
Analyze TACACS+ transport and security architecture
TACACS+ utilizes connection-oriented TCP port 49, separates the AAA components independently, and encrypts the entire packet payload.
Identify TACACS+ protocol parameters and full-payload encryption design.
3
Examine Kerberos ticket-based authentication flow
Kerberos uses a trusted KDC to issue Ticket-Granting Tickets (TGTs) and service tickets over port 88.
Relate Kerberos to single sign-on ticket architecture.
4
Examine 802.1X framework responsibilities
802.1X provides Layer 2 port-based network access control, encapsulating Extensible Authentication Protocol (EAP) frames between the endpoint supplicant and authenticator switch/AP.
Distinguish network access enforcement frameworks from backend AAA directory protocols.

Key Concept

Centralized AAA Protocols, Port Numbers, and Encryption Boundaries
Question 76Question →

A network engineer is configuring address translation policies on an enterprise edge firewall. Match each specific technical mapping requirement on the left with its corresponding address translation implementation type on the right.

Click a left item, then click its matching right item

Items

Providing a permanent, one-to-one mapping between a private IP address of an internal web server (10.1.10.5010.1.10.50) and a dedicated public IP address (203.0.113.50203.0.113.50).
Allowing 200 internal workstations on a private subnet (192.168.1.0/24192.168.1.0/24) to access external resources simultaneously using a single public IP address (203.0.113.1203.0.113.1).
Mapping internal hosts on demand to available external IP addresses from a pre-allocated public address pool (203.0.113.100−203.0.113.110203.0.113.100 - 203.0.113.110) without port modification.
Redirecting inbound traffic sent to an external public IP on port 8080 (203.0.113.20:8080203.0.113.20:8080) to an internal database management interface (10.1.10.20:8010.1.10.20:80).

Matches

Show answer & explanation

Answer

Static NAT pairs with permanent 1-to-1 server mapping; Port Address Translation (PAT / NAT Overload) pairs with many workstations sharing a single public IP address; Dynamic NAT pairs with mapping hosts to a pool of public IP addresses on demand; Port Forwarding (Static PAT) pairs with redirecting a specific external port to an internal IP address and port.
Each NAT implementation serves a distinct networking use case: Static NAT provides a fixed 1-to-1 mapping for external server accessibility; PAT multiplexes multiple private IP addresses onto one public IP using Layer 4 port tracking; Dynamic NAT draws 1-to-1 public IP mappings temporarily from a pool; and Port Forwarding directs specific inbound external port traffic to an internal target host.

Step-by-Step Solution

1
Analyze the requirement for a permanent 1-to-1 server mapping
Identified Static NAT as the fixed one-to-one mapping mechanism required for public inbound access.
Static NAT maintains a persistent mapping between one private IP and one public IP.
2
Analyze the requirement for multiple workstations sharing a single public IP
Identified PAT (Port Address Translation / NAT Overload) as the solution.
PAT differentiates connections from multiple internal hosts sharing one IP by assigning unique Layer 4 source ports.
3
Analyze the requirement for on-demand allocation from a public IP pool without port translation
Identified Dynamic NAT as the matching translation mechanism.
Dynamic NAT allocates a public IP address from a defined pool to an internal host for the active session length.
4
Analyze the requirement for redirecting inbound traffic on a specific port to an internal IP and port
Identified Port Forwarding (Static PAT) as the solution.
Port Forwarding routes specific incoming public socket requests (IP:Port) to an internal host's designated socket.

Key Concept

NAT and PAT Implementation Types and Selection Criteria
Estimated Time:1m 30s
Question 77Question →

During a security compliance audit of network documentation, a systems engineer needs to standardize an abridged IPv6 address into its complete 128-bit explicit form.

What is the fully expanded, uncompressed representation of the IPv6 address 2001:db8:40::ae0:12?

Show answer & explanation

Answer: 2001:0db8:0040:0000:0000:0000:0ae0:0012; 2001:0DB8:0040:0000:0000:0000:0AE0:0012

Answer

2001:0db8:0040:0000:0000:0000:0ae0:0012
Expanding a compressed IPv6 address requires expanding each block to four hexadecimal digits by restoring omitted leading zeros and replacing the double colon (::) with the required number of 0000 blocks to reach a total of 8 blocks. The address 2001:db8:40::ae0:12 contains 5 explicit blocks (2001, 0db8, 0040, 0ae0, 0012), meaning the double colon represents 3 contiguous zero blocks (0000:0000:0000), producing 2001:0db8:0040:0000:0000:0000:0ae0:0012.

Step-by-Step Solution

1
Count the explicit 16-bit fields present in the compressed address.
There are 5 explicit fields specified: '2001', 'db8', '40', 'ae0', and '12'.
An IPv6 address always consists of 8 total 16-bit fields.
2
Determine the number of missing zero fields represented by the double colon (::).
8 total fields - 5 explicit fields = 3 missing consecutive zero fields (0000:0000:0000).
The double colon symbol expands to fill all omitted 16-bit zero blocks so the address reaches exactly 8 fields.
3
Pad each explicit field with leading zeros to complete 4 hexadecimal digits per field.
'2001' remains '2001', 'db8' becomes '0db8', '40' becomes '0040', 'ae0' becomes '0ae0', and '12' becomes '0012'.
RFC 5952 zero-suppression removes leading zeros within a block, which must be restored during full expansion.
4
Assemble all 8 expanded fields separated by colons.
2001:0db8:0040:0000:0000:0000:0ae0:0012
Combining the padded explicit blocks and the expanded zero blocks yields the full 39-character 128-bit uncompressed IPv6 address.

Key Concept

IPv6 Address Uncompression and Structure Standards
Question 78Question →

During a packet capture analysis on a receiving web server, a network technician traces an incoming Ethernet frame carrying an HTTP request. As the server's network stack begins de-encapsulating the data, the Network Interface Card (NIC) verifies the Frame Check Sequence (FCS) and strips the Layer 2 Ethernet header and trailer. Which Protocol Data Unit (PDU) is immediately passed up to the Network layer (Layer 3) for further processing?

Show answer & explanation

Answer: Packet

Answer

The Protocol Data Unit passed to Layer 3 is the Packet.
During de-encapsulation on an incoming host, the network stack processes data from the bottom up. The Data Link layer (Layer 2) processes the Ethernet Frame, checks for transmission errors using the trailer's Frame Check Sequence (FCS), and strips the Ethernet header and trailer. The payload remaining is an IP Packet, which is handed directly to the Network layer (Layer 3) to examine source and destination IP addresses.

Step-by-Step Solution

1
Identify the initial receiving layer and PDU
The receiving host receives physical signals and reconstructs a Layer 2 Frame.
The Ethernet protocol operates at Layer 2 (Data Link layer).
2
Perform Layer 2 de-encapsulation
The Layer 2 Ethernet header and trailer (FCS) are inspected and removed.
De-encapsulation unwraps outer headers to expose the inner payload.
3
Determine the resulting PDU passed to Layer 3
The remaining inner payload is an IP Packet.
Layer 3 (Network layer) operates on Packets containing IP addressing information.

Key Concept

OSI De-encapsulation Sequence and Layer PDUs
Estimated Time:1m 0s
Question 79Question →

A network administrator needs to deploy a security solution that can analyze network traffic in real time and automatically drop malicious packets before they reach the internal network. Which system type and deployment mode best meets this requirement?

Show answer & explanation

Answer: An inline Network Intrusion Prevention System (NIPS)

Answer

An inline Network Intrusion Prevention System (NIPS) is the correct choice because placing a prevention system in-band enables active dropping of malicious traffic in real time.
An inline Network Intrusion Prevention System (NIPS) sits directly in the communication path (in-band). This placement allows it to evaluate live traffic and immediately block, reset, or drop malicious network traffic before it penetrates the internal network.

Step-by-Step Solution

1
Identify the required operational capability from the scenario.
The requirement specifies that the system must automatically drop malicious packets in real time.
Active mitigation requires an inline prevention mechanism rather than passive detection.
2
Determine the necessary placement and device type.
Selecting a Network Intrusion Prevention System (NIPS) deployed in-band (inline).
An inline NIPS processes traffic as it passes through the device, granting the authority to drop blocked packets before they reach internal targets.

Key Concept

Inline NIPS vs. Passive NIDS Deployment
Question 80Question →

Which of the following environments should a network administrator use to evaluate a vendor's new firmware update for system stability before applying it to production network equipment?

Show answer & explanation

Answer: A dedicated non-production lab or staging environment

Answer

A dedicated non-production lab or staging environment should be used to evaluate firmware updates prior to production deployment.
Evaluating firmware patches in a separate lab or staging environment allows network administrators to verify stability, feature compatibility, and performance without placing production systems at risk.

Step-by-Step Solution

1
Identify the primary risk of deploying untested software updates.
Untested firmware patches may introduce software bugs, unexpected reboots, or configuration incompatibilities.
Production network availability requires minimizing unnecessary risk during patch management operations.
2
Determine the proper environment for pre-deployment validation.
Select an isolated laboratory or staging environment that mirrors production equipment.
Staging allows full functional testing of the patch without affecting live users or business operations.

Key Concept

Testing patches and firmware in a non-production staging environment
PreviousPage 4 / 112Next
All practice questions — CompTIA Network+ | Examkin