All practice questions

A network engineer is executing a scheduled operating system software update on a core managed switch equipped with dual flash memory banks (Bank 0 and Bank 1). The switch currently executes its operational firmware from Bank 0. To follow software maintenance best practices for risk mitigation and rapid rollback capability, which of the following procedures should the engineer execute?

A network security administrator needs to implement a security solution that continuously monitors network traffic and actively drops malicious packets in real time before they can reach critical application servers. Which device type and deployment configuration best fulfills these requirements?

A network security architect is reviewing enterprise controls to align with core security principles across a hybrid multi-cloud environment. Match each technical security mechanism to the primary security principle of the CIA Triad or expanded core concepts it directly fulfills.

A network administrator configures an inbound extended Access Control List (ACL) on a router interface (GigabitEthernet0/0) to allow internal workstations on subnet 172.16.10.0/24 to browse secure external websites and perform domain name resolution. The applied ACL rules are evaluated top-down as follows:

Although outbound TCP SYN packets sent to external Web servers successfully pass through the router interface, internal clients report that HTTPS web pages fail to load and connections instantly time out. Outbound interface NAT and default routing are verified to be fully operational.

Which technical requirement of stateless access control filtering explains why these HTTPS connections fail to establish?

An enterprise network administrator maintains a disaster recovery plan for an active database server. The backup schedule performs a full backup every Sunday at 01:00, daily differential backups every evening at 23:00 (Monday through Saturday), and incremental transaction log backups every two hours between 08:00 and 18:00 daily. On Thursday at 15:30, a primary storage failure occurs. Which sequence of backup sets must be restored to recover the server to its 14:00 Thursday point-in-time state with the fewest restoration operations?

An enterprise network engineer is analyzing complex network performance anomalies across different application types and operational environments. Match each observed performance symptom or monitoring vulnerability to its corresponding performance metric, protocol mechanism, or diagnostic technique.

An enterprise infrastructure uses two Layer 3 switches, Router-Alpha and Router-Beta, configured with Hot Standby Router Protocol (HSRP) to provide default gateway redundancy for hosts on VLAN 50 ($172.16.50.0/24$). Router-Alpha is intended to be the primary gateway and is configured with an HSRP priority of $120$, preemption enabled, and WAN interface tracking with a priority decrement of $30$. Router-Beta is configured with an HSRP priority of $100$. During an unexpected WAN uplink disruption on Router-Alpha, its tracked interface goes down, successfully reducing its advertised priority to $90$. However, network monitoring reveals that host traffic on VLAN 50 continues routing through Router-Alpha's degraded path instead of transitioning to Router-Beta. Which configuration deficiency on Router-Beta prevents it from assuming the Active gateway role?

Prior to installing a minor software patch on an enterprise edge router, a network engineer creates a backup of the current operating configuration and tests the update in an isolated environment. What is the primary purpose of performing these pre-deployment actions?

An enterprise network design requires deploying redundant layer 2 and layer 3 mechanisms across perimeter firewalls, default gateways, and switch uplinks. Match each high availability protocol on the left with its corresponding operational specification or MAC/header characteristic on the right.

A network administrator is configuring Virtual Router Redundancy Protocol (VRRP) across two routers to provide first-hop redundancy for a local subnet. To ensure that end-user workstations seamlessly switch traffic to the standby router in the event of a primary router failure, which IP address should be configured as the default gateway on the workstations?

A network security engineer is auditing the logging infrastructure of an enterprise network. The engineer discovers that network infrastructure devices transmit sensitive audit logs to a central SIEM server over an unencrypted channel, and critical log messages are lost during peak traffic congestion. Which protocol configuration change will ensure encrypted transport and guaranteed delivery of the audit logs?

A network security architect must implement centralized AAA management for network administrators executing commands on enterprise routers across loss-prone WAN links. The solution must support per-command authorization policy enforcement, encrypt the entire packet payload during transit, and use a reliable connection-oriented transport protocol to guarantee delivery of accounting records. Which protocol and transport combination should the architect deploy?

Following a workstation compromise, an enterprise security team observes that an internal database server receives encrypted command-and-control traffic, accompanied by unauthorized local process injection and file integrity alterations. The existing network-based IDS connected via a switch SPAN port failed to decrypt the payload and was structurally incapable of stopping the local system modifications due to its passive out-of-band placement. To actively block unauthorized system calls, memory manipulation, and malicious file modifications directly on the server host, which security technology should be deployed?

A network engineer is troubleshooting log loss during periods of high link congestion. System logs sent from edge routers to a centralized collector are currently dropped during traffic spikes. The compliance team mandates that log transmission across the WAN link must guarantee delivery, avoid loss under network congestion, and encrypt log payloads in transit. Which configuration change best satisfies all technical and compliance requirements?

An enterprise organization requires a disaster recovery strategy for its mission-critical database cluster across dual data centers separated by 120 km. The business demands a Recovery Point Objective (RPO) of absolute zero data loss and a Recovery Time Objective (RTO) under 5 minutes. Which of the following technical controls and redundancy configurations MUST be combined to satisfy these stringent business continuity metrics? (Select TWO)

A company is updating its perimeter network architecture to defend against automated exploit attacks targeted at public-facing application servers. The security strategy requires a device positioned directly in the traffic flow that can inspect packet payloads in real time and automatically drop malicious frames before they cross into the internal segment. Which security appliance deployment best satisfies these active mitigation requirements?

During a security compliance audit of an enterprise network, an administrator is tasked with remediating an auditing finding regarding switch telemetry monitoring. The audit report indicates that device monitoring traps sent across the management VLAN are vulnerable to packet sniffing because authentication credentials and telemetry payloads are transmitted without encryption. Which SNMP configuration mode should the administrator deploy to satisfy the audit requirement for both cryptographic user authentication and payload encryption?

A network engineer is configuring Variable Length Subnet Masking (VLSM) within the assigned block $10.200.16.0/20$. The first subnet (Subnet A) must be allocated from the start of the block to support at least $600$ usable host interfaces. The second subnet (Subnet B) must be provisioned immediately following the address space allocated to Subnet A to accommodate at least $250$ usable host interfaces. What is the decimal value of the third octet in the network ID of Subnet B?

A network security analyst is investigating a compromised corporate subnet where users attempting to access internal file servers are periodically redirected to an unauthorized external server capturing credentials. A packet capture analysis on the local segment reveals two distinct operational anomalies:
1. Unsolicited, continuous ARP response frames broadcast across the segment, binding the subnet default gateway's IP address to an unrecognized host's MAC address.
2. Injected response packets intercepting local recursive name resolution requests and supplying spoofed IP addresses for internal domain names.

Which of the following attack vectors are directly being executed in this enterprise incident? (Select TWO)

A network security administrator is transitioning core switch infrastructure management from a RADIUS solution to TACACS+. When auditing protocol behavior and firewall traffic rules for TACACS+, which of the following operational characteristics accurately describe TACACS+ compared to RADIUS? (Select TWO)