Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 821Question →

A network security engineer is analyzing a packet capture taken between a Network Access Server (NAS) and a centralized authentication server during a remote access connection attempt. The capture reveals that the authentication request is transmitted using UDP over port 1812. Further payload examination demonstrates that only the user password attribute within the packet is obfuscated using a shared secret and MD5 hashing, while the surrounding header information and username remain visible in plaintext. Based on these observed operational characteristics, which authentication protocol is in use, and what structural feature accounts for this payload exposure?

Show answer & explanation

Answer: RADIUS, because it encrypts only the password attribute within the Access-Request packet body while operating over UDP.

Answer

RADIUS is being observed because it uses UDP port 1812 and encrypts only the password attribute within the Access-Request packet payload, leaving other packet fields unencrypted.
The scenario describes RADIUS authentication. RADIUS operates over UDP port 1812 (and port 1813 for accounting) and combines authentication and authorization into a single transaction. A defining cryptographic limitation of RADIUS is that it encrypts only the password attribute inside the Access-Request packet body using a shared secret and MD5 digest, leaving packet headers and usernames exposed in cleartext.

Step-by-Step Solution

1
Identify the transport protocol and port number from the packet capture
The capture shows UDP over port 1812, which is the standard port reserved for RADIUS authentication and authorization traffic.
RADIUS uses UDP port 1812 (or legacy ports 1645/1646), whereas TACACS+ uses TCP port 49.
2
Analyze the payload encryption boundary specified in the scenario
Only the password attribute is obfuscated, leaving headers and username in plaintext.
RADIUS encrypts only the password field within the Access-Request body using a shared secret MD5 mechanism. In contrast, TACACS+ encrypts the entire packet payload.
3
Correlate protocol features to select the correct protocol identification
The combination of UDP port 1812 and password-only encryption strictly identifies RADIUS.
Matching both transport layer (UDP 1812) and cryptographic boundary (password-only obfuscation) confirms RADIUS behavior.

Key Concept

RADIUS vs TACACS+ Architectural and Encryption Differences
Question 822Question →

During a compliance audit of an organization's network monitoring infrastructure, an auditor notes that event log messages and SNMP telemetry are vulnerable to packet loss, eavesdropping, and tampering across WAN links. To remediate these findings, the security engineer must ensure that centralized log forwarding to the SIEM appliance guarantees delivery acknowledgment, encrypts message traffic over standard secure ports, and that SNMP polling enforces cryptographic user authentication along with payload privacy. Which of the following configuration sets correctly fulfills all specified requirements?

Show answer & explanation

Answer: Configure Syslog log forwarding over TCP port 6514 using TLS encryption, and implement SNMPv3 with the authPriv security level.

Answer

The correct implementation requires Syslog log forwarding over TCP port 6514 using TLS encryption, paired with SNMPv3 utilizing the authPriv security level.
The requirement for reliable and encrypted log forwarding necessitates using TCP port 6514 with TLS (RFC 5425). Standard UDP 514 lacks connection state and encryption. For SNMP monitoring, satisfying both authentication and privacy requirements requires SNMPv3 configured with the authPriv security level (which uses authentication algorithms along with payload privacy encryption).

Step-by-Step Solution

1
Identify the required transport protocol and port for secure, reliable log forwarding.
Syslog using TCP port 6514 with TLS provides guaranteed delivery and encryption.
Standard Syslog uses UDP port 514 (unreliable and unencrypted). TLS-encrypted Syslog is standardized under RFC 5425 using TCP port 6514.
2
Determine the appropriate SNMP version and security model to satisfy authentication and payload privacy requirements.
SNMPv3 with the authPriv security level is required.
SNMPv1 and SNMPv2c send credentials in cleartext. SNMPv3 authNoPriv authenticates but does not encrypt; authPriv encrypts both header/authentication credentials and payload data using symmetric ciphers.
3
Synthesize the findings to select the matching configuration choice.
Combining Syslog over TCP 6514 (TLS) and SNMPv3 authPriv fulfills all audit requirements.
This combination satisfies both reliable/encrypted log transport and authenticated/encrypted SNMP management polling.

Key Concept

Syslog over TLS (TCP Port 6514) and SNMPv3 Security Levels (authPriv)
Estimated Time:1m 30s
Question 823Question →

Match each intrusion detection or prevention concept with its corresponding operational characteristic.

Click a left item, then click its matching right item

Items

Signature-Based Detection
Anomaly-Based Detection
Inline NIPS Deployment
Passive NIDS Deployment

Matches

Show answer & explanation

Answer

Signature-Based Detection pairs with known threat pattern database comparison; Anomaly-Based Detection pairs with baseline deviation alerting; Inline NIPS Deployment pairs with active packet blocking in the traffic path; Passive NIDS Deployment pairs with out-of-band traffic monitoring via SPAN port.
Each intrusion detection and prevention component matches its specific operational method: signature-based detection uses known threat patterns, anomaly-based detection identifies deviations from normal baselines, inline NIPS acts in-band to block malicious packets, and passive NIDS operates out-of-band via SPAN/TAP ports to monitor without adding latency.

Step-by-Step Solution

1
Differentiate between signature-based and anomaly-based detection mechanisms.
Signature-based detection matches traffic to predefined threat definitions, whereas anomaly-based detection flags deviations from established normal baselines.
Signature detection uses specific known fingerprints, while anomaly detection focuses on behavioral variations.
2
Differentiate between inline prevention (IPS) and passive monitoring (IDS) topology placements.
Inline NIPS is placed directly in-band to drop malicious packets, while passive NIDS connects out-of-band (e.g., via SPAN port) to inspect copied packets.
Prevention systems must sit in the active data path to block traffic, while detection systems mirror traffic to avoid introducing network latency.

Key Concept

IDS/IPS Detection Mechanisms and Deployment Topologies
Question 824Question →

A network architecture team is updating its operational repository to streamline disaster recovery, infrastructure auditing, and physical capacity management workflows across a hybrid enterprise data center. Match each specialized network documentation artifact to its primary operational or troubleshooting application.

Click a left item, then click its matching right item

Items

Fiber Optic Cable Run Matrix with Optical Time-Domain Reflectometer (OTDR) Baseline Traces
Logical Topology Map with FHRP Virtual IP (VIP) State and Dynamic Routing Annotations
Physical Rack Elevation Diagram with Circuit Power Phase Balancing and Thermal U-Positioning
Configuration Baseline Diff paired with Change Management Audit Logs

Matches

Show answer & explanation

Answer

Each documentation artifact corresponds directly to its specific domain: OTDR traces analyze physical fiber attenuation; logical topology maps diagnose protocol and VIP routing paths; physical rack elevations evaluate power load balance and thermal management; and configuration baseline diffs identify unauthorized change drift.
Each artifact targets a distinct layer of network operations: OTDR traces isolate physical fiber integrity issues; logical topology maps detail IP routing paths and gateway redundancy states; physical rack elevation diagrams track spatial, electrical phase, and thermal limits; and configuration baseline diffs identify unauthorized CLI changes.

Step-by-Step Solution

1
Analyze the physical layer diagnostic artifact.
Correlate OTDR baseline traces and cable run matrices with optical loss analysis, fiber distance measurements, and splice fault localization.
OTDR tools measure signal reflection over distance to diagnose physical layer medium anomalies.
2
Analyze protocol-level and logical routing documentation.
Associate logical topology maps containing FHRP and routing information with layer 3 traffic flow, asymmetric paths, and failover diagnostics.
Logical diagrams detail software abstractions, IP routing boundaries, virtual gateway redundancies, and packet flow logic.
3
Analyze spatial, power, and environmental rack planning documentation.
Match physical rack elevation diagrams incorporating thermal and phase data with physical unit placement and power distribution unit planning.
Rack elevations prevent thermal hotspots and electrical circuit overloads during hardware installation.
4
Analyze operational change tracking and configuration audit artifacts.
Link configuration diffs and change management logs with operational audit, compliance verification, and tracking unauthorized modifications.
Baseline diffs highlight line-by-line configuration variances against approved operational snapshots.

Key Concept

Distinguishing distinct network documentation artifacts and mapping them to appropriate layer-specific troubleshooting and operational workflows.
Estimated Time:2m 0s
Question 825Question →

A network administrator is establishing a standard patch management procedure for enterprise routers. Place the following steps of the software patch management lifecycle in the correct order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of the patch management lifecycle steps is: 1) Identify and evaluate vendor patch releases, 2) Test the software patch in an isolated lab environment, 3) Submit a formal request to the Change Advisory Board (CAB) for approval, 4) Deploy the patch to production network devices during an authorized maintenance window, and 5) Perform post-deployment auditing and functionality verification.
The standard patch management lifecycle follows a structured sequence: discovering vendor patches, testing updates in a non-production lab, securing approval through change management processes, deploying during an authorized maintenance window, and completing post-deployment audits to confirm stability.

Step-by-Step Solution

1
Identify patch requirements
Discovers vendor security releases and evaluates applicability.
The patch lifecycle must begin with identifying updates before any operational changes are planned.
2
Validate the patch in a lab environment
Confirms software stability without impacting production networks.
Lab testing identifies unexpected bugs or configuration incompatibilities prior to broad deployment.
3
Obtain organizational change authorization
Secures approval from the Change Advisory Board and schedules the work.
Change management ensures stakeholders are aware of risks, scheduling, and rollback strategies.
4
Execute production deployment
Installs the patch on active network routers.
Applying patches within an authorized maintenance window minimizes operational disruption to end users.
5
Perform post-patch validation and audit
Confirms successful patch installation and system stability.
Post-deployment verification ensures vulnerabilities are mitigated and services remain fully functional.

Key Concept

Standard Patch Management Lifecycle
Estimated Time:1m 0s
Question 826Question →

During a network security audit, an administrator discovers two major vulnerabilities on an enterprise network: internal administrative session credentials are being intercepted in cleartext by unauthorized packet sniffing, and stored database audit logs have been silently modified after an intrusion. To remediate these vulnerabilities and satisfy security compliance, the network engineering team must implement technical controls that explicitly protect the affected pillars of the CIA Triad. Which combination of security controls correctly restores confidentiality for administrative sessions while ensuring data integrity for the stored audit logs?

Show answer & explanation

Answer: Enforcing SSH or TLS protocol encryption for all administrative sessions, and generating SHA-256 cryptographic hashes combined with digital signatures for audit log files.

Answer

Enforcing SSH or TLS protocol encryption for administrative sessions to protect confidentiality, paired with SHA-256 cryptographic hashing and digital signatures to ensure audit log integrity.
Confidentiality ensures that sensitive data, such as administrative credentials, remains inaccessible to unauthorized eavesdroppers. Protocols like SSH and TLS utilize symmetric and asymmetric encryption to protect transport payloads. Integrity ensures that data remains unaltered and authentic. Cryptographic hashing algorithms like SHA-256 generate unique fixed-length digests, while digital signatures provide non-repudiation and verification of file origin, perfectly addressing both vulnerabilities identified in the scenario.

Step-by-Step Solution

1
Analyze the confidentiality vulnerability
Cleartext credential interception indicates a breach of confidentiality during network transmission.
Confidentiality guarantees that data in transit is hidden from unauthorized observers. Strong transport encryption like SSH or TLS prevents eavesdropping.
2
Analyze the integrity vulnerability
Unauthorized modification of database audit logs indicates a failure of data integrity.
Integrity guarantees that data has not been altered or tampered with. Cryptographic hashing (SHA-256) and digital signatures validate file authenticity and detect modifications.
3
Evaluate control pairs against CIA Triad definitions
SSH/TLS combined with SHA-256 hashing directly addresses confidentiality and integrity respectively.
Other controls such as RAID 1 or backup schedules target Availability, while RADIUS and SNMPv2c fail to provide complete payload confidentiality.

Key Concept

CIA Triad (Confidentiality vs. Integrity vs. Availability Controls)
Estimated Time:2m 0s
Question 827Question →

Match each Intrusion Detection/Prevention System (IDS/IPS) technology or deployment mode on the left with its corresponding operational characteristic on the right.

Click a left item, then click its matching right item

Items

Signature-Based Detection
Anomaly-Based Detection
Inline NIPS Deployment
Out-of-Band NIDS Deployment

Matches

Show answer & explanation

Answer

Signature-Based Detection matches with comparing traffic against known exploit patterns. Anomaly-Based Detection matches with establishing a baseline of standard behavior to identify statistical deviations. Inline NIPS Deployment matches with sitting in-band within live traffic to actively drop malicious packets. Out-of-Band NIDS Deployment matches with receiving mirrored traffic via SPAN/TAP to inspect activity passively without introducing latency.
Each IDS/IPS technology and deployment mode is accurately matched with its operational profile: Signature-based detection relies on known attack signatures. Anomaly-based detection flags deviations from a baseline of normal activity. Inline NIPS resides directly in the traffic stream (in-band) to actively block threats. Out-of-band NIDS passively monitors copied traffic from a SPAN or TAP without introducing latency.

Step-by-Step Solution

1
Differentiate threat detection engine methods.
Signature-based detection checks traffic payloads against predefined static patterns. Anomaly-based detection measures active network metrics against a baseline of normal behavior.
Detection engines use either predefined rules/signatures or statistical behavioral modeling to identify security events.
2
Differentiate physical network placements and action capabilities.
Inline (in-band) deployment places the device directly in the packet path to perform active prevention (dropping malicious packets). Out-of-band deployment uses mirrored traffic (SPAN/TAP) for passive detection without impacting production packet forwarding latency.
Network placement dictates whether an intrusion system operates as a passive observer (NIDS) or an active inline enforcement device (NIPS).

Key Concept

Intrusion Detection and Prevention System (IDS/IPS) Detection Logic and Network Topology Placement
Question 828Question →

Match each authentication protocol or access control framework to its defining operational and architectural characteristics.

Click a left item, then click its matching right item

Items

RADIUS
TACACS+
IEEE 802.1X
Kerberos

Matches

Show answer & explanation

Answer

RADIUS pairs with connectionless transport encrypting passwords only; TACACS+ pairs with TCP port 49 encrypting the full payload; IEEE 802.1X pairs with port-based EAP encapsulation; Kerberos pairs with KDC ticket-granting architecture.
Each protocol is accurately matched based on its network transport, cryptographic boundary, service modularity, and operational role within enterprise authentication.

Step-by-Step Solution

1
Analyze transport protocols and encryption scope for centralized AAA services
RADIUS uses UDP and encrypts only passwords, whereas TACACS+ uses TCP port 49 and encrypts the entire payload.
Differentiating transport reliability and encryption boundary is fundamental to AAA protocol identification.
2
Evaluate AAA component modularity
RADIUS merges authentication and authorization into combined packets, while TACACS+ decouples authentication, authorization, and accounting entirely.
TACACS+ allows granular command-level authorization independent of initial authentication.
3
Identify network access control and ticket-based authentication standards
IEEE 802.1X governs physical/wireless port access using EAPOL, while Kerberos handles single sign-on via KDC tickets.
802.1X provides layer-2 port security, whereas Kerberos is a domain authentication protocol.

Key Concept

AAA Protocol Architecture and Authentication Mechanisms
Question 829Question →

Match each network logging and auditing component on the left with its corresponding primary function on the right.

Click a left item, then click its matching right item

Items

Syslog
NetFlow
SNMPv3
SIEM

Matches

Show answer & explanation

Answer

Syslog matches standard system event log forwarding; NetFlow matches IP traffic flow statistics collection; SNMPv3 matches secure device status monitoring with authentication and encryption; SIEM matches centralized log aggregation and security event correlation.
Each logging and monitoring technology addresses a distinct auditing requirement: Syslog forwards system event notifications; NetFlow gathers traffic flow metadata; SNMPv3 provides secure device polling and alerting; and SIEM centralizes log aggregation, correlation, and compliance auditing.

Step-by-Step Solution

1
Identify the function of Syslog.
Syslog handles sending text-based log messages generated by system events to a central log collector.
Syslog is the standard protocol for event messaging on network equipment.
2
Identify the function of NetFlow.
NetFlow records traffic volume, IP source/destination pairs, and port metrics.
NetFlow focuses on traffic flow metadata rather than system status event logs.
3
Identify the features of SNMPv3.
SNMPv3 provides device monitoring with built-in encryption and authentication capabilities.
Version 3 addresses security weaknesses found in SNMPv1 and SNMPv2c.
4
Identify the role of a SIEM platform.
SIEM aggregates and correlates event data from across the enterprise for auditing and detection.
SIEM systems combine log management with automated correlation.

Key Concept

Network Logging and Auditing Technologies
Question 830Question →

A network engineer configures two Layer 3 switches, Switch-1 and Switch-2, with Virtual Router Redundancy Protocol (VRRP) to provide default gateway redundancy for a server VLAN (172.16.20.0/24172.16.20.0/24). Switch-1 is configured with a VRRP priority of 110 and a physical SVI address of 172.16.20.2172.16.20.2. Switch-2 has a priority of 100 and a physical SVI address of 172.16.20.3172.16.20.3. The VRRP Virtual IP (VIP) is assigned as 172.16.20.1172.16.20.1. After a network maintenance reboot, end-user servers lose connectivity to external subnets whenever Switch-1 undergoes maintenance, despite Switch-2 being fully operational. Troubleshooting reveals that all servers were manually statically configured with 172.16.20.2172.16.20.2 as their default gateway. Which of the following best explains why gateway redundancy failed and identifies the correct solution?

Show answer & explanation

Answer: The servers were configured with the physical IP address of Switch-1 rather than the VRRP Virtual IP address; updating host default gateway configurations to 172.16.20.1172.16.20.1 will resolve the issue.

Answer

The host servers were misconfigured to point directly to Switch-1's physical IP address (172.16.20.2172.16.20.2) instead of the VRRP Virtual IP address (172.16.20.1172.16.20.1). Configuring all hosts to use the VRRP VIP as their default gateway allows Switch-2 to transparently assume handling gateway traffic via the shared Virtual MAC address if Switch-1 fails.
First Hop Redundancy Protocols (FHRP) such as VRRP rely on workstations and servers using a shared Virtual IP (VIP) address as their default gateway. When hosts are incorrectly configured with the physical IP address of a specific router interface, traffic is routed directly to that single device without leveraging the virtual gateway mechanism. If that specific router fails or goes offline for maintenance, host packets sent to its physical IP are dropped, breaking redundancy. Setting host default gateways to the VRRP VIP ensures traffic floats to the active Master router.

Step-by-Step Solution

1
Analyze host IP configuration and First Hop Redundancy Protocol (FHRP) architecture.
Identify that host default gateways are set to 172.16.20.2172.16.20.2, which is the physical SVI IP of Switch-1, rather than the VRRP VIP of 172.16.20.1172.16.20.1.
FHRP protocols like VRRP provide redundancy by generating a shared Virtual IP (VIP) and Virtual MAC address that float between active/backup nodes.
2
Determine the impact of pointing default gateways to physical interface IPs.
When Switch-1 goes offline, traffic destined to its physical IP (172.16.20.2172.16.20.2) drops because Switch-2 only responds to ARP requests for the Virtual IP (172.16.20.1172.16.20.1) when assuming the Master role.
Host packets targeted at a dead physical MAC/IP cannot be intercepted by VRRP Backup routers without host configuration using the VIP.
3
Select the correct remediation.
Reconfigure server default gateway settings to target the VRRP VIP (172.16.20.1172.16.20.1).
This restores high availability, allowing Switch-2 to seamlessly take over default gateway duties upon Switch-1 failure.

Key Concept

FHRP Virtual Gateway IP Configuration
Question 831Question →

Match each Syslog severity level to its corresponding event description based on standard network auditing and logging specifications.

Click a left item, then click its matching right item

Items

Syslog Severity 2 (Critical)
Syslog Severity 4 (Warning)
Syslog Severity 5 (Notice)
Syslog Severity 7 (Debug)

Matches

Show answer & explanation

Answer

Syslog Severity 2 (Critical) matches critical conditions requiring prompt intervention; Syslog Severity 4 (Warning) matches warning conditions indicating potential degradation; Syslog Severity 5 (Notice) matches normal but significant operational events; and Syslog Severity 7 (Debug) matches detailed diagnostic messages for real-time troubleshooting.
Each Syslog severity rating corresponds to a standard priority level: Severity 2 (Critical) maps to urgent conditions like hardware component failures; Severity 4 (Warning) maps to conditions indicating performance degradation; Severity 5 (Notice) records normal but significant system events; and Severity 7 (Debug) yields granular diagnostic output for protocol analysis.

Step-by-Step Solution

1
Recall the standard Syslog numerical severity scale (0 through 7) defined in RFC 5424.
Severity ratings range from 0 (Emergency - system unusable) down to 7 (Debug - verbose troubleshooting).
Proper log severity auditing requires understanding the hierarchical priority of system event classifications.
2
Differentiate critical and warning thresholds (Severity 2 vs Severity 4).
Severity 2 addresses critical component failures needing immediate intervention, whereas Severity 4 alerts on non-fatal warnings or degraded performance.
Critical logs signify active high-impact failures, while warning logs provide proactive indications of potential impairment.
3
Differentiate operational notifications and debug output (Severity 5 vs Severity 7).
Severity 5 captures routine, significant administrative state events, whereas Severity 7 outputs high-volume diagnostic detail for active troubleshooting.
Notice logs document healthy baseline operations, while debug logs generate high-overhead telemetry for deep protocol analysis.

Key Concept

Syslog Severity Levels (RFC 5424)
Question 832Question →

A network engineering team must mitigate a critical zero-day privilege escalation vulnerability affecting core infrastructure routers. Which of the following represents the correct sequence of administrative and technical steps required to safely implement this software update according to standardized network maintenance procedures?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with vendor advisory analysis and hash verification, followed by staging/lab testing, securing formal CAB approval with a rollback strategy, taking pre-upgrade configuration baselines, and finally executing the deployment during an authorized maintenance window followed by verification.
The correct process follows standardized network operations governance: initial risk and patch verification precedes staging lab validation, which provides empirical data required for Change Advisory Board (CAB) authorization. Immediately prior to applying the update during the approved maintenance window, administrators take a full baseline backup of target devices to ensure immediate rollback capabilities if the upgrade encounters unexpected faults.

Step-by-Step Solution

1
Analyze vendor advisories and confirm patch integrity.
Establishes necessity, scope, and verifies patch file authenticity via cryptographic hashes.
Prevents deploying corrupted binaries or unnecessary updates.
2
Perform staging lab validation.
Identifies software bugs, performance anomalies, or CLI syntax variations.
Lab verification ensures production stability without risking live network traffic.
3
Request Change Advisory Board (CAB) review and approval.
Schedules maintenance windows and approves backout/rollback procedures.
Enforces operational governance and prevents unauthorized enterprise disruptions.
4
Take pre-deployment configuration and system backups.
Creates a recovery point corresponding to the exact current production state.
Allows rapid restoration if firmware flashing fails or causes unexpected downtime.
5
Execute patch installation in production and perform verification.
Applies security fixes and verifies routing protocols and service availability.
Completes the maintenance cycle within designated out-of-service hours.

Key Concept

Network Patch Management Lifecycle and Change Management Governance
Question 833Question →

Match each high availability and redundancy mechanism to its corresponding operational characteristics within an enterprise network design.

Click a left item, then click its matching right item

Items

Link Aggregation Control Protocol (LACP)
Virtual Router Redundancy Protocol (VRRP)
Equal-Cost Multi-Path (ECMP)
Stateful Firewall Pair Synchronization

Matches

Show answer & explanation

Answer

Link Aggregation Control Protocol (LACP) matches bundling physical Ethernet interfaces into a single logical channel. Virtual Router Redundancy Protocol (VRRP) matches presenting a single Virtual IP address for default gateway redundancy. Equal-Cost Multi-Path (ECMP) matches distributing Layer 3 traffic across multiple parallel paths of identical cost. Stateful Firewall Pair Synchronization matches replicating connection tracking tables across appliances.
High availability designs utilize specialized protocols at different layers: LACP bundles physical links for bandwidth and link failover, VRRP manages Virtual IPs for default gateway redundancy, ECMP balances routing traffic over equal-cost paths, and stateful synchronization maintains active session tables across security appliances during a failover event.

Step-by-Step Solution

1
Analyze Layer 2 link aggregation mechanisms.
Identify LACP as the standard protocol for combining physical interfaces into a logical link (EtherChannel/Trunk) to provide physical link redundancy.
LACP specifically targets switch-to-switch or server-to-switch link failures at Layer 2.
2
Identify default gateway redundancy mechanisms.
Associate VRRP with Virtual IP (VIP) sharing across redundant gateway routers.
VRRP provides transparent first-hop failover for end-user devices configured with a single gateway address.
3
Evaluate Layer 3 routing redundancy and load balancing.
Match ECMP with routing traffic across parallel equal-cost paths.
ECMP operates at the routing layer to leverage multiple simultaneous paths.
4
Evaluate high availability for stateful security appliances.
Connect Stateful Firewall Pair Synchronization with mirroring active session state tables.
Stateful failover requires synchronized session tables so existing user connections remain active upon failover.

Key Concept

High Availability and Redundancy Mechanisms Across Network Layers
Question 834Question →

A network security architect is designing an enterprise monitoring and threat mitigation strategy. Match each intrusion detection/prevention deployment model on the left with its corresponding technical implementation characteristic on the right.

Click a left item, then click its matching right item

Items

Inline NIPS with Signature-Based Engine
Passive Out-of-Band NIDS via Hardware TAP
Host-Based IPS (HIPS) with Behavior Analysis
Anomaly-Based NIDS with Baseline Monitoring

Matches

Show answer & explanation

Answer

Inline NIPS with Signature-Based Engine matches active packet dropping of known CVE payloads in transit. Passive Out-of-Band NIDS via Hardware TAP matches receiving physical packet copies without latency or single-point-of-failure risks. Host-Based IPS (HIPS) with Behavior Analysis matches local OS API call and memory evaluation to stop zero-day execution. Anomaly-Based NIDS with Baseline Monitoring matches comparing live metrics against statistical profiles to detect unusual protocol shifts.
Each architecture correctly pairs placement with detection engine capabilities: Inline NIPS actively drops known signature matches in-band; Hardware TAPs feed passive out-of-band monitoring without latency or failure risks; HIPS monitors local endpoint process memory and system calls; Anomaly-based NIDS flags traffic metric deviations against established statistical baselines.

Step-by-Step Solution

1
Analyze deployment topology (in-band inline vs out-of-band passive vs host-based)
Inline NIPS and HIPS operate directly within the execution/packet flow to actively prevent attacks, whereas passive TAP out-of-band NIDS processes out-of-line data streams without impacting network speed.
Placement dictates whether the system can actively block threats in transit or merely log/alert passively.
2
Evaluate detection engine mechanisms (signature-based vs anomaly-based vs behavior-based)
Signature engines require known CVE patterns; behavior engines inspect host system call sequences; anomaly engines detect deviations from normal baseline metrics.
Detection logic dictates whether predefined threat indicators, system behaviors, or statistical variances trigger detection.
3
Match each deployment model to its unique operational description
All left items align uniquely with their technical counterparts based on placement, action capability, and detection mechanism.
Each deployment model addresses distinct operational trade-offs regarding latency, visibility, and prevention capabilities.

Key Concept

Intrusion Detection and Prevention Systems (IDS/IPS) Topologies and Detection Engines
Question 835Question →

A senior network engineer is leading a major infrastructure upgrade to implement multi-chassis link aggregation and new VLAN topologies across an enterprise datacenter. To satisfy compliance and ensure minimal service disruption, the organization enforces a strict ITIL-aligned change control policy. Place the following phases of the change management lifecycle in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence for the enterprise change management lifecycle is: (1) Draft the Request for Change (RFC) with rollback plans, (2) Perform sandbox lab testing and validation, (3) Present the RFC and test findings to the Change Advisory Board (CAB) for authorization, (4) Schedule the maintenance window and notify stakeholders, (5) Execute the change within the maintenance window and run post-change validation, and (6) Conduct a Post-Implementation Review (PIR), update network baselines, and close the RFC.
The correct sequence strictly adheres to structured change management governance: drafting the initial RFC and rollback plan, proving concept stability via sandbox testing, acquiring formal CAB authorization, scheduling windows and alerting stakeholders, deploying changes with immediate verification during the window, and concluding with a Post-Implementation Review to update baselines and close the ticket.

Step-by-Step Solution

1
Identify the initial proposal phase.
Drafting the Request for Change (RFC) establishes the technical scope, impact evaluation, and contingency rollback plan.
A formal change process cannot proceed without documented objectives, risk assessments, and recovery steps.
2
Determine pre-authorization testing requirements.
Executing non-production lab testing validates the configuration commands and verifies rollback procedures.
Empirical testing evidence is required to prove safety and refine risk metrics before seeking administrative authorization.
3
Identify the authorization checkpoint.
Presenting the RFC and lab validation evidence to the Change Advisory Board (CAB) secures formal organizational approval.
The CAB must assess high-level operational risks and business impacts before authorizing deployment into production.
4
Identify post-approval scheduling requirements.
Scheduling the maintenance window and broadcasting stakeholder advisories.
Stakeholder advisories and resource locking must only occur after the change has been officially approved by the CAB.
5
Determine execution and immediate verification phase.
Executing the configuration modifications during the maintenance window followed by immediate post-change testing.
Modifications must be confined to approved windows, and post-change testing ensures immediate detection of failures while the window is active.
6
Identify post-implementation closure requirements.
Conducting a Post-Implementation Review (PIR), updating configuration baselines and network documentation, and closing the RFC.
Closing the lifecycle requires capturing final network state baselines, updating CMDB records, and auditing the overall success of the change.

Key Concept

Standard Change Management Workflow
Question 836Question →

A network administrator must remediate a critical software vulnerability discovered on an enterprise edge router. Arrange the standard patch management lifecycle procedures in the correct sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the patch management lifecycle is: 1) Validate the vendor patch in an isolated staging environment, 2) Submit a change management ticket with risk assessment and rollback plan, 3) Create a full system state and configuration backup immediately prior to implementation, 4) Install the patch on the production router during the designated maintenance window, and 5) Perform post-deployment verification and document the updated baseline.
The standard patch management process requires structured progression: isolated lab testing first, followed by change advisory board authorization, pre-update baseline backups, scheduled production rollout, and final post-implementation auditing.

Step-by-Step Solution

1
Initial Staging & Lab Testing
Patch compatibility and firmware stability are confirmed in sandbox isolation.
Deploying unverified code directly into active environments risks widespread outages.
2
Change Control & Governance Approval
Stakeholders approve the operational risk, maintenance window schedule, and rollback strategy.
Unapproved production modifications violate administrative policy and risk uncoordinated downtime.
3
Pre-Deployment Configuration Baseline & Backup
A clean system restore point is saved.
If the upgrade encounters errors or memory corruption, the device can be rapidly restored to its prior state.
4
Production Window Rollout Execution
The firmware update is applied to target hardware.
Performing updates during low-impact maintenance windows avoids operational impact.
5
Post-Implementation Audit & Documentation
Device stability is verified, baseline documentation updated, and change ticket closed.
Ensures the vulnerability is successfully remediated and asset inventory records remain current.

Key Concept

Standard Patch Management Lifecycle
Question 837Question →

A network administrator needs to centralize administrative access for network switches using an authentication protocol that encrypts the entire packet payload. Which protocol best satisfies this requirement?

Show answer & explanation

Answer: TACACS+

Answer

TACACS+ is the correct protocol because it encrypts the full body (payload) of each packet during administration sessions.
TACACS+ encrypts the entire packet body following the header, providing full confidentiality for administrative sessions and commands.

Step-by-Step Solution

1
Analyze the requirement for full packet payload encryption during device administration.
Identify that RADIUS only encrypts the password attribute, whereas TACACS+ encrypts the entire packet body.
Security requirements specifying complete command and credential payload privacy necessitate TACACS+ over RADIUS.
2
Select the protocol matching full payload encryption.
Choose TACACS+.
TACACS+ uses TCP port 49 and provides full payload encryption.

Key Concept

RADIUS vs TACACS+ Payload Encryption Boundaries
Question 838Question →

A network administrator needs to deploy a network security device at the perimeter that sits directly in the traffic flow to inspect incoming packets and actively drop detected malicious traffic in real time. Which device should be placed inline to meet this objective?

Show answer & explanation

Answer: Network Intrusion Prevention System (NIPS)

Answer

Network Intrusion Prevention System (NIPS)
A Network Intrusion Prevention System (NIPS) is deployed in-band (inline) along the network communication path. This positioning allows it to inspect all traversing packets in real time and automatically take preventive action, such as dropping malicious packets or resetting TCP connections, before malicious traffic reaches its destination.

Step-by-Step Solution

1
Identify the key operational requirement in the scenario.
The device must operate inline to actively block and drop malicious traffic in real time.
Inline deployment ensures all traffic passes through the security system before reaching internal hosts.
2
Compare passive (detection) versus active (prevention) system capabilities.
Intrusion Detection Systems (IDS) operate passively out-of-band, whereas Intrusion Prevention Systems (IPS) operate actively in-band.
An inline NIPS has the technical capability to interrupt the traffic flow and drop malicious packets immediately.

Key Concept

Inline NIPS vs. Passive NIDS Deployment
Question 839Question →

Which of the following operational characteristics correctly distinguish TACACS+ from RADIUS when evaluating centralized network access controls? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: TACACS+ encrypts the entire packet payload, whereas RADIUS encrypts only the password field.; TACACS+ uses TCP as its transport protocol, whereas RADIUS typically relies on UDP.

Answer

TACACS+ encrypts the entire packet payload and uses TCP as its transport protocol, whereas RADIUS encrypts only the password field and relies on UDP.
TACACS+ provides full-packet body encryption for all communications and relies on connection-oriented TCP (port 49). In contrast, RADIUS only encrypts the password field within its payload and relies on connectionless UDP (ports 1812/1813).

Step-by-Step Solution

1
Analyze encryption scope differences between RADIUS and TACACS+
Identify that TACACS+ encrypts the entire payload body of every packet, whereas RADIUS leaves packet headers and attributes unencrypted, encrypting only the user password field.
Encryption boundary is a core architectural distinction between TACACS+ and RADIUS.
2
Analyze transport protocol and port assignments
Identify that TACACS+ operates over TCP port 49, offering reliable connection delivery, while RADIUS operates over UDP ports 1812 (authentication) and 1813 (accounting).
Layer 4 transport choice dictates connection handling and default port numbers for each AAA protocol.

Key Concept

Core architectural differences between RADIUS and TACACS+ AAA protocols
Question 840Question →

An enterprise network uses two routers, Router-A and Router-B, to provide default gateway redundancy for the 192.168.50.0/24192.168.50.0/24 subnet using Hot Standby Router Protocol (HSRP). Router-A has a physical interface IP address of 192.168.50.2192.168.50.2, Router-B has a physical interface IP address of 192.168.50.3192.168.50.3, and the configured HSRP virtual IP (VIP) is 192.168.50.1192.168.50.1. During scheduled maintenance, Router-A is rebooted, causing Router-B to successfully transition from Standby to Active status. However, hosts on the 192.168.50.0/24192.168.50.0/24 subnet immediately lose all outbound network access. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The host workstations were statically assigned the physical interface IP address 192.168.50.2192.168.50.2 as their default gateway instead of the virtual IP address 192.168.50.1192.168.50.1.

Answer

The host workstations were statically assigned the physical interface IP address 192.168.50.2 as their default gateway instead of the virtual IP address 192.168.50.1.
First Hop Redundancy Protocols like HSRP, VRRP, and CARP provide default gateway redundancy by presenting a shared Virtual IP (VIP) address to client hosts. When Router-A reboots, Router-B takes over ownership of the VIP (192.168.50.1192.168.50.1). However, if host workstations were misconfigured to use Router-A's physical interface IP address (192.168.50.2192.168.50.2) as their default gateway, their outbound packets continue targeting 192.168.50.2192.168.50.2, which is currently unreachable, leading to complete outbound access failure.

Step-by-Step Solution

1
Analyze the HSRP topology configuration
Router-A physical IP = 192.168.50.2192.168.50.2, Router-B physical IP = 192.168.50.3192.168.50.3, Virtual IP (VIP) = 192.168.50.1192.168.50.1.
First Hop Redundancy Protocols (FHRP) create a shared Virtual IP (VIP) that acts as the single logical default gateway address for client devices.
2
Evaluate host traffic behavior during failover
Router-B became Active and claimed control of the VIP (192.168.50.1192.168.50.1), but host traffic stopped flowing.
If hosts send packets directly to 192.168.50.2192.168.50.2 (Router-A's physical interface), those packets will be dropped when Router-A reboots, because Router-B only listens for ARP and traffic destined for the VIP (192.168.50.1192.168.50.1) and its own physical IP (192.168.50.3192.168.50.3).
3
Identify the root cause of the misconfiguration
Host default gateway addresses were set to Router-A's physical IP address instead of the HSRP VIP.
To benefit from high availability gateway redundancy, all network clients must point to the Virtual IP address as their default gateway.

Key Concept

First Hop Redundancy Protocol (FHRP) Virtual IP Assignment
PreviousPage 42 / 112Next
All practice questions — CompTIA Network+ | Examkin