Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 941Question →

A network security engineer is designing an intrusion prevention architecture for a high-frequency trading firm's REST API gateway. The gateway receives TLS 1.3 encrypted HTTP/2 traffic routed asymmetrically across dual active-active Internet edge links. The firm requires active, real-time blocking of unknown zero-day application exploits, strict adherence to sub-millisecond added network latency limits (<1 ms< 1\text{ ms}), and complete protection against session dropping caused by asymmetric TCP packet paths. Which deployment model and inspection mechanism best fulfills all system requirements?

Show answer & explanation

Answer: Deploy a Host-based Intrusion Prevention System (HIPS) running an anomaly-based detection engine directly on the API gateway servers.

Answer

Deploying a Host-based Intrusion Prevention System (HIPS) utilizing an anomaly-based detection engine directly on the host API gateway servers is the optimal solution.
Deploying a Host-based Intrusion Prevention System (HIPS) directly on the API gateway hosts solves all technical challenges simultaneously. Because HIPS operates at the operating system/application level on the endpoint, it inspects network traffic after TLS decryption occurred. Furthermore, host placement eliminates external network inline latency and avoids TCP session corruption caused by asymmetric routing across dual ISP links. Utilizing an anomaly-based detection engine allows the system to detect and actively prevent zero-day exploits by identifying deviations from baseline behavior rather than relying on known signatures.

Step-by-Step Solution

1
Analyze asymmetric routing and network latency constraints.
Inline network appliances (NIPS) placed across active-active links suffer from state asymmetry unless synchronized across links, and introduce additional inline interface processing latency. Host-based placement (HIPS) eliminates external network-hop latency and avoids asymmetric network routing state mismatches altogether.
Host systems reassemble TCP segments locally after network routing delivers packets, rendering network asymmetry irrelevant to host-level security engines.
2
Evaluate payload encryption requirements (TLS 1.3).
Network-level sensors (NIDS/NIPS) placed before SSL/TLS termination cannot inspect encrypted HTTP/2 payload contents without complex SSL decryption proxies that add latency. HIPS operates post-decryption inside the host network stack/application layer.
Inspecting encrypted payloads requires access to the cleartext stream, which is naturally available at the host application endpoint.
3
Match detection engine logic to the threat model (zero-day exploits).
Signature-based engines depend on known exploit patterns and fail to identify novel zero-day attacks. Anomaly/behavioral-based engines establish a baseline of normal behavior and flag or block novel deviations.
Zero-day vulnerability attacks lack pre-existing signatures, making anomaly-based or heuristic detection mandatory for active prevention.

Key Concept

Host-based IPS (HIPS) vs Network-based IPS (NIPS) placement trade-offs regarding payload encryption, asymmetric routing, and anomaly vs signature detection engines.
Question 942Question →

A network security engineer configures an extended stateless IPv4 Access Control List (ACL) applied inbound on a perimeter router interface (`GigabitEthernet0/1`) to filter incoming Internet traffic. The ACL contains the following sequential rules:

- Rule 10: `permit tcp any eq 443 192.168.50.0 0.0.0.255 established`
- Rule 20: `permit tcp any host 192.168.50.10 eq 443`
- Rule 30: `permit udp 192.168.50.0 0.0.0.255 eq 53 any`

An external host with IP address 198.51.100.42198.51.100.42 sends an unsolicited TCP SYN packet (initial connection request) with source port 443443 to an internal host at 192.168.50.25192.168.50.25 on destination port 80808080.

Which action does the router take when processing this incoming TCP SYN packet?

Show answer & explanation

Answer: The router drops the packet because it fails to match Rule 10 due to missing ACK/RST flags, misses subsequent rules, and triggers the implicit deny statement.

Answer

The router drops the packet because it fails to match Rule 10 due to missing ACK/RST flags, misses subsequent rules, and triggers the implicit deny statement.
When evaluating stateless extended ACL rules, the router checks fields in exact top-to-bottom order. For Rule 10, the packet matches protocol (TCP), source address (`any`), source port (`eq 443`), and destination subnet (192.168.50.0/24192.168.50.0/24). However, Rule 10 includes the `established` keyword, which requires the TCP ACK or RST control bit to be set. Because an initial unsolicited connection attempt sends a TCP SYN packet (without ACK or RST), Rule 10 does not match. The packet subsequently fails Rule 20 (wrong host and destination port) and Rule 30 (wrong protocol), causing it to hit the default implicit deny rule at the end of the ACL and be dropped.

Step-by-Step Solution

1
Analyze incoming packet header details against Rule 10 criteria
The packet has source IP 198.51.100.42198.51.100.42, source port 443443, destination IP 192.168.50.25192.168.50.25, destination port 80808080, and TCP flags set to SYN only. Rule 10 specifies `established`, which requires ACK or RST flags to be present. Thus, Rule 10 does not match.
Stateless ACL rules using the `established` keyword inspect TCP control flags to allow return traffic while blocking incoming initial session setups.
2
Evaluate packet against Rule 20 and Rule 30
Rule 20 expects destination host 192.168.50.10192.168.50.10 and destination port 443443 (packet is for .25.25 on port 80808080). Rule 30 expects UDP protocol (packet is TCP). Neither rule matches.
Extended ACLs perform top-to-bottom sequential rule checking until an exact match is identified.
3
Apply final default ACL behavior
Having matched no explicit permit statements, the packet encounters the unwritten default rule: `deny ip any any`.
All standard and extended ACLs terminate with an implicit deny statement that drops all unapproved IP traffic.

Key Concept

Stateless ACL TCP Flag Filtering and Implicit Deny Logic
Estimated Time:2m 0s
Question 943Question →

An enterprise network engineer is analyzing performance degradation across a site-to-site WAN link supporting real-time voice traffic. Network monitoring shows low overall latency, but voice quality suffers from audio artifacts caused by uneven packet delivery intervals. Additionally, organization compliance policies mandate that device metrics gathered from edge routers must support user authentication and payload encryption. Which TWO of the following metrics or protocol configurations should the engineer implement to address these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Analyze packet jitter metrics to measure the variation in arrival delay across voice streams.; Implement SNMPv3 using the authPriv security level to secure router telemetry polling.

Answer

The engineer must monitor jitter to measure latency variation in voice streams and deploy SNMPv3 with authPriv to encrypt telemetry polling.
Analyzing packet jitter allows engineers to isolate delay variance impacting real-time media streams, while configuring SNMPv3 with authPriv ensures device telemetry is protected using user authentication and AES payload encryption.

Step-by-Step Solution

1
Identify the relevant performance metric for audio distortion caused by inconsistent arrival times.
Jitter is identified as the rate of variance in delay, directly addressing packet buffer issues in real-time voice traffic.
Mean latency alone does not capture arrival time fluctuations that impact real-time playback buffers.
2
Evaluate remote monitoring protocol security levels against encryption and authentication compliance rules.
SNMPv3 authPriv is selected because it enforces both authentication (auth) and privacy/encryption (priv).
SNMPv1 and SNMPv2c lack native cryptographic encryption, sending credentials in plaintext.

Key Concept

Network Performance Metrics (Jitter) and Secure SNMP Management (SNMPv3 authPriv)
Estimated Time:2m 0s
Question 944Question →

During an approved maintenance window, a network engineering team applies a critical software update to an enterprise SD-WAN orchestrator cluster. During post-implementation validation, monitoring systems alert that multiple IPsec tunnels to remote branch sites are experiencing severe degradation and packet drop. With only 10 minutes remaining in the maintenance window and no immediate root cause identified, which of the following is the most appropriate action for the team to execute?

Show answer & explanation

Answer: Immediately execute the documented rollback plan to restore the SD-WAN orchestrator cluster to its pre-change baseline configuration before the maintenance window expires.

Answer

Execute the documented rollback plan to restore the SD-WAN orchestrator cluster to its pre-change baseline configuration before the maintenance window expires.
Executing the pre-approved rollback plan ensures the network returns to a known stable baseline configuration within the allocated maintenance window, preventing unvetted changes from impacting normal business operations.

Step-by-Step Solution

1
Evaluate post-implementation state against success criteria and maintenance window constraints.
Validation failed due to IPsec tunnel degradation, and remaining maintenance window time is insufficient for deep troubleshooting.
Changes must be fully validated or rolled back within the agreed maintenance window to minimize impact on production service.
2
Determine the appropriate change management protocol for failed changes.
Triggering the documented and pre-approved rollback plan is mandatory when post-change testing fails.
Executing the rollback restores the network to a known stable operational baseline safely.

Key Concept

Change Management Maintenance Window & Rollback Triggers
Question 945Question →

A network security administrator is mapping enterprise authentication protocols and frameworks to their core operational characteristics. Match each authentication protocol or framework on the left with its correct operational description on the right.

Click a left item, then click its matching right item

Items

TACACS+
RADIUS
Kerberos
802.1X

Matches

Show answer & explanation

Answer

TACACS+ matches full payload encryption over TCP port 49; RADIUS matches password-only encryption over UDP ports 1812/1813; Kerberos matches ticket-granting tokens for SSO; 802.1X matches port-based access control encapsulating EAP traffic.
Each protocol is accurately matched to its operational characteristics: TACACS+ encrypts the entire payload over TCP port 49 with decoupled AAA; RADIUS encrypts only passwords over UDP ports 1812/1813 with combined authentication/authorization; Kerberos uses a Key Distribution Center and tickets for SSO; and 802.1X provides port-level protection using EAP encapsulation.

Step-by-Step Solution

1
Identify the transport protocol and encryption boundary for administrative device management.
Recognize that TACACS+ uses TCP port 49, separates AAA components, and encrypts the complete payload.
TACACS+ was engineered specifically for router/switch management where full command encryption and granular authorization are needed.
2
Identify the transport protocol and encryption behavior of network access AAA.
Associate RADIUS with UDP ports 1812/1813 and password-only encryption.
RADIUS combines authentication and authorization into single response packets while obfuscating only user credentials.
3
Examine token-based domain single sign-on protocols.
Link Kerberos to ticket-granting tokens and Key Distribution Centers.
Kerberos facilitates secure authentication across network services using mutual authentication and cryptographic tokens.
4
Analyze port-based network boundary enforcement mechanisms.
Pair 802.1X with EAP encapsulation at Layer 2.
802.1X prevents unauthorized network port access until an authentication server validates the supplicant's credentials.

Key Concept

AAA Framework and Centralized Authentication Protocols
Question 946Question →

Following a critical vulnerability advisory affecting an enterprise syslog management server, a network operations administrator is scheduled to deploy a vendor-provided operating system hotfix. To follow proper change management procedures and minimize operational downtime during deployment, which step should the administrator execute before installing the patch in production?

Show answer & explanation

Answer: Perform a verified full system backup and validate the hotfix within an isolated sandbox environment.

Answer

Perform a verified full system backup and validate the hotfix within an isolated sandbox environment.
Safe software maintenance requires validating patches in a non-production staging or sandbox environment to detect adverse interactions, alongside creating a verified full system backup to ensure rapid rollback if issues arise during deployment.

Step-by-Step Solution

1
Review pre-deployment requirements and change management policies.
Identified the necessity of risk mitigation, backup verification, and staging.
Applying patches directly into production creates unquantified operational risks.
2
Create and verify a full system backup/image.
Established a complete restoration baseline.
Allows rapid recovery to a known good state if the hotfix corrupts system services.
3
Test and validate the patch in a non-production sandbox environment.
Confirmed hotfix stability and functionality without disrupting live operations.
Identifies software conflicts or unexpected dependencies prior to live deployment.

Key Concept

Patch Staging and Backup Baselines
Question 947Question →

Match each network performance metric on the left with its corresponding definition on the right.

Click a left item, then click its matching right item

Items

Latency
Jitter
Throughput
Packet Loss

Matches

Show answer & explanation

Answer

Latency matches with 'The total time required for a data packet to travel from its source to its destination.' Jitter matches with 'The variation in packet arrival delay times across a network transmission.' Throughput matches with 'The actual rate of successful data delivery over a communication channel over a given timeframe.' Packet Loss matches with 'The percentage of sent data packets that fail to reach their intended destination.'
Each metric uniquely defines a specific network transmission quality property: Latency is transit delay, Jitter is variance in delay, Throughput is actual delivered bandwidth rate, and Packet Loss is the percentage of dropped packets.

Step-by-Step Solution

1
Identify the definition of Latency.
Latency represents time delay from source to destination.
Latency measures propagation, queuing, and serialization delays in traffic delivery.
2
Identify the definition of Jitter.
Jitter represents variation in delay times.
Jitter quantifies how much latency fluctuates between consecutive packets.
3
Identify the definition of Throughput.
Throughput represents actual successful transmission rate.
Throughput is the actual payload data successfully sent and received over time.
4
Identify the definition of Packet Loss.
Packet Loss represents the percentage of undelivered packets.
Packet loss measures packets dropped along the network pathway.

Key Concept

Core Network Performance Telemetry Metrics
Question 948Question →

Place the standard stages of an enterprise network change management workflow in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: 1) Submit a formal Request for Change (RFC) document, 2) Perform a risk assessment and obtain Change Advisory Board (CAB) approval, 3) Execute the configuration changes during the maintenance window, and 4) Perform post-implementation testing and update configuration baseline documentation.
The standard change management lifecycle follows a strict sequence: initiating the process by submitting an RFC, analyzing risks and acquiring authorization from the Change Advisory Board (CAB), carrying out the change inside an authorized maintenance window, and concluding with post-implementation validation and documentation updates.

Step-by-Step Solution

1
Identify the initial step of proposing a change.
Submitting the RFC initiates the formal workflow.
Changes must be documented and formally requested before evaluation can begin.
2
Identify the review and authorization step.
CAB review and risk assessment evaluate the proposal.
Management and stakeholders must review and approve the request prior to deployment to mitigate potential downtime.
3
Identify the execution phase.
Implementation occurs in a scheduled maintenance window.
Approved changes must be carried out during pre-determined maintenance hours to minimize business disruption.
4
Identify the final verification and documentation step.
Post-implementation review and baseline updates finalize the change.
Verification ensures functional stability, and updated documentation ensures configuration records reflect the new operational state.

Key Concept

Standard Change Management Process Lifecycle
Question 949Question →

A network technician is documenting security controls across an enterprise network infrastructure. Match each intrusion detection or prevention system deployment on the left with its defining operational capability or structural characteristic on the right.

Click a left item, then click its matching right item

Items

Inline NIPS deployment
Out-of-band NIDS via TAP
Signature-based HIDS
Anomaly-based NIDS

Matches

Show answer & explanation

Answer

Inline NIPS deployment pairs with filtering traffic in the active physical path to drop malicious packets in real time; Out-of-band NIDS via TAP pairs with monitoring mirrored traffic streams without introducing latency; Signature-based HIDS pairs with inspecting local host log files and system calls against known threat patterns; Anomaly-based NIDS pairs with flagging network traffic dynamics that deviate from an established baseline of normal activity.
Each deployment model matches its distinct functional characteristic. Inline NIPS processes live traffic in-band to enable active prevention. Out-of-band NIDS passively analyzes duplicated traffic via TAP/SPAN ports with zero latency. Host-based IDS monitors internal endpoint events using signatures, and anomaly-based NIDS flags deviations from established traffic baselines.

Step-by-Step Solution

1
Evaluate network path positioning (in-band vs out-of-band).
Inline NIPS sits directly in the traffic flow to perform active packet blocking, whereas out-of-band NIDS sits off-path receiving copied frames with zero latency overhead.
Physical placement determines whether an enforcement engine can block traffic inline or only generate passive alerts.
2
Determine target monitoring scope (Host vs Network).
HIDS focuses on endpoint internal states such as system calls and host log entries, while NIDS inspects packet headers and payloads across network segments.
Host-based mechanisms protect single endpoints from internal process manipulation, while network-based mechanisms inspect wire traffic.
3
Differentiate detection algorithms (Signature vs Anomaly/Behavioral).
Signature engines compare activity against a database of known bad indicators, while anomaly engines compare activity against a recorded baseline of normal operation.
Anomaly detection identifies novel zero-day attacks by detecting statistical variations from normal patterns.

Key Concept

Intrusion Detection and Prevention Systems (IDS/IPS) Architecture and Detection Engines
Question 950Question →

A network administrator is establishing performance monitoring on core network equipment and must satisfy a corporate security compliance policy requiring both cryptographic authentication and payload encryption for all device status polling. Which SNMP configuration mode must be implemented on the network devices to meet these requirements?

Show answer & explanation

Answer: SNMPv3 using the authPriv security level

Answer

SNMPv3 using the authPriv security level
SNMPv3 introduces security models that support authentication and encryption. The authPriv (Authentication and Privacy) level provides message authentication via HMAC-MD5 or HMAC-SHA and payload confidentiality using symmetric encryption algorithms such as AES or DES.

Step-by-Step Solution

1
Identify the security requirements stated in the policy
The policy mandates both authentication (verifying source identity) and payload privacy (encrypting traffic data).
Security levels determine whether authentication, encryption, or both are applied to SNMP polling traffic.
2
Evaluate the capabilities of SNMP versions and security levels
SNMPv1 and SNMPv2c use cleartext community strings without payload encryption. SNMPv3 defines three security levels: noAuthNoPriv (no auth, no encryption), authNoPriv (auth, no encryption), and authPriv (auth and encryption).
Only authPriv inside SNMPv3 fulfills both requirements simultaneously.

Key Concept

SNMPv3 Security Levels (noAuthNoPriv, authNoPriv, authPriv)
Estimated Time:45s
Question 951Question →

A network administrator configures a standard router Access Control List (ACL) to permit web traffic to an internal server. After applying the rule, the administrator observes that all other inbound network traffic to that interface is blocked, even though no specific deny statements were explicitly written. Which of the following explains this behavior?

Show answer & explanation

Answer: ACLs conclude with an unwritten implicit deny rule that drops all traffic not explicitly permitted.

Answer

Access Control Lists end with an unwritten implicit deny statement that drops any packet not explicitly allowed by a preceding rule.
Every Access Control List contains an invisible, unwritten implicit deny all rule at the end of the rule list. If incoming traffic does not match any explicit permit statement, it hits this implicit deny entry and is dropped by the router.

Step-by-Step Solution

1
Analyze the ACL evaluation process for incoming network packets.
The router checks packet fields top-down against each sequential rule in the list.
ACL entries are evaluated in sequential order until a match is found.
2
Determine packet disposition when no configured rules match the traffic.
The packet hits the invisible final statement at the bottom of the ACL list.
All standard and extended ACLs implicitly terminate with a deny-all statement to ensure a secure default-deny posture.

Key Concept

ACL Implicit Deny Behavior
Estimated Time:45s
Question 952Question →

An enterprise network security administrator is establishing a secure procedure for receiving automated network device configuration updates from third-party vendor systems over an open network. The security policy dictates that the system must guarantee the configuration payload has not been modified during transmission and must also ensure that the vendor cannot deny having created and sent the specific configuration update. Which of the following mechanisms best fulfills both of these security requirements?

Show answer & explanation

Answer: Digitally signing the configuration payload using the vendor's private key

Answer

Digitally signing the configuration payload using the vendor's private key
Digital signatures rely on asymmetric public key infrastructure (PKI). By hashing the configuration payload and signing the digest with the vendor's private key, the system ensures data integrity (any modification breaks the hash verification) and non-repudiation (only the owner of the private key could have signed it).

Step-by-Step Solution

1
Identify the required core security principles
The requirements are data integrity (verifying payload was not altered) and non-repudiation (preventing the sender from denying origin).
The scenario explicitly requests verification of payload contents and indisputable sender origin.
2
Evaluate symmetric key mechanisms against non-repudiation
Symmetric keys (such as AES-256 or HMAC pre-shared secrets) are shared between two endpoints. Since either party can create or alter the encrypted data/digest, neither mechanism satisfies non-repudiation.
Non-repudiation strictly requires asymmetric cryptography where only one unique entity possesses the private signing key.
3
Evaluate asymmetric digital signatures
The sender generates a hash digest of the configuration payload and encrypts it using their private key. The recipient validates integrity by computing the hash and decrypting the signature using the sender's public key.
Only the holder of the private key could have produced the signature, satisfying both integrity and non-repudiation.

Key Concept

Non-repudiation & Integrity in Security Architecture
Question 953Question →

A network administrator is deploying a centralized authentication mechanism to manage administrative access to enterprise switches. The security policy mandates that every shell command executed by network personnel must be authorized on an individual, per-command basis, and all communication between the network switches and the AAA server must encrypt the entire packet body. Which protocol should the administrator implement to satisfy these requirements?

Show answer & explanation

Answer: TACACS+, because it encrypts the full payload of the packet and decouples authentication and authorization functions to support per-command control.

Answer

TACACS+ is the correct choice because it encrypts the entire packet payload and decouples AAA components, enabling per-command administrative authorization.
TACACS+ (Terminal Access Controller Access-Control System Plus) operates over TCP port 49 and is designed specifically for device administration. It encrypts the entire body of every packet exchanged between the client device and the server, ensuring privacy for all command data. Crucially, TACACS+ decouples authentication, authorization, and accounting, which enables granular per-command authorization policies where every command typed by an administrator must be approved by the server.

Step-by-Step Solution

1
Analyze the encryption requirement.
The requirement specifies encrypting the entire packet body, not just the password field.
TACACS+ encrypts the entire body of the packet, whereas RADIUS only encrypts the password.
2
Analyze the authorization requirement.
The requirement specifies per-command authorization for CLI access on network switches.
TACACS+ separates authentication, authorization, and accounting into distinct modules, allowing the network device to query the AAA server for authorization on every individual command. RADIUS combines authentication and authorization into a single process.
3
Select the protocol that satisfies both cryptographic and operational criteria.
TACACS+ (running over TCP port 49) meets all constraints.
Only TACACS+ provides full payload encryption combined with decoupled per-command authorization.

Key Concept

AAA Protocol Features (RADIUS vs TACACS+)
Estimated Time:1m 30s
Question 954Question →

An enterprise network architect is evaluating security controls across a multi-tier network deployment. Match each technical implementation on the left with the core security principle or objective it primarily satisfies on the right.

Click a left item, then click its matching right item

Items

Enforcing Ephemeral Diffie-Hellman (ECDHE) key exchange for secure web gateway TLS connections
Implementing SHA-256 HMAC checksum validation on dynamic routing protocol updates
Deploying BGP Anycast routing paired with multi-datacenter active-active firewall clusters
Applying PKI asymmetric digital signatures with cryptographic timestamps to automated network audit logs

Matches

Show answer & explanation

Answer

The correct pairings match ECDHE key exchange with Confidentiality, SHA-256 HMAC validation with Integrity, BGP Anycast active-active architecture with Availability, and PKI asymmetric signatures with Non-repudiation.
Each control is paired with its primary objective: ECDHE protects session confidentiality via forward secrecy; HMAC validation guarantees data integrity by detecting unauthorized alterations; BGP Anycast with active-active clustering guarantees system availability through fault tolerance; digital signing of logs ensures non-repudiation by mathematically tying log generation to the signing entity.

Step-by-Step Solution

1
Analyze the objective of ECDHE key exchange
Identified that ephemeral keys protect past session data from future compromise (Confidentiality).
Perfect Forward Secrecy ensures encrypted traffic remains confidential even if long-term credentials leak.
2
Analyze HMAC usage in network routing protocols
Identified that hash-based message authentication codes detect unauthorized payload modifications (Integrity).
Cryptographic hashes verify payload data remains unchanged between peers.
3
Analyze multi-datacenter active-active clustering with BGP Anycast
Identified that fault-tolerant and distributed network infrastructure maintains uptime (Availability).
Redundancy and load distribution prevent single points of failure from causing outages.
4
Analyze asymmetric digital signatures on audit records
Identified that private-key signing prevents a system or user from denying log generation (Non-repudiation).
Digital signatures bind identity cryptographically to specific data at a specific time.

Key Concept

Mapping Advanced Network Security Controls to CIA Triad and Non-repudiation Principles
Question 955Question →

A network security analyst is investigating simultaneous security alerts on two separate VLANs within an enterprise network. On VLAN 20, client workstations attempting to reach the internal ERP server (10.20.4.50) present browser certificate warnings. Packet captures on VLAN 20 show a flood of unsolicited ARP responses associating the default gateway IP address (10.20.4.1) with the MAC address of an unrecognized host on the local segment. On VLAN 30, clients resolving the hostname erp.corporate.local receive IP address 198.51.100.44 (an external host) instead of 10.20.4.50. Packet captures on VLAN 30 reveal forged UDP port 53 responses arriving prior to replies from the legitimate internal DNS server, with no abnormal Layer 2 ARP activity detected. Which of the following correctly identifies the distinct attack vectors operating on VLAN 20 and VLAN 30, respectively?

Show answer & explanation

Answer: VLAN 20 is undergoing ARP cache poisoning (Layer 2 Man-in-the-Middle), while VLAN 30 is undergoing DNS cache poisoning (DNS spoofing).

Answer

VLAN 20 is undergoing ARP cache poisoning (Layer 2 Man-in-the-Middle), while VLAN 30 is undergoing DNS cache poisoning (DNS spoofing).
The scenario describes two distinct attack mechanisms. On VLAN 20, the adversary sends unsolicited ARP responses to bind the default gateway's IP address to a rogue MAC address, corrupting local ARP tables and creating a Layer 2 Man-in-the-Middle state (ARP cache poisoning). On VLAN 30, the adversary sends forged DNS reply packets over UDP port 53 that arrive before the legitimate server replies, poisoning client DNS caches with a malicious IP address (DNS cache poisoning).

Step-by-Step Solution

1
Analyze telemetry and packet behavior for VLAN 20.
Unsolicited ARP replies map the default gateway IP address (10.20.4.1) to an unauthorized host's MAC address, corrupting client ARP caches and redirecting Layer 2 frames through an intermediary machine (Man-in-the-Middle).
ARP operate at Layer 2 to map IP addresses to MAC addresses on local broadcast domains.
2
Analyze telemetry and packet behavior for VLAN 30.
Forged DNS responses delivered via UDP port 53 arrive faster than responses from the legitimate internal DNS server, causing clients to cache an external IP address for an internal hostname.
DNS spoofing / cache poisoning injects false hostname-to-IP mappings into resolvers by exploiting connectionless UDP responses.
3
Synthesize the findings to select the matching vector pair.
VLAN 20 exhibits ARP cache poisoning, while VLAN 30 exhibits DNS cache poisoning.
Differentiating Layer 2 MAC resolution spoofing from Layer 7 name resolution spoofing identifies the exact attack mechanisms.

Key Concept

Differentiating Layer 2 ARP Cache Poisoning from Layer 7 DNS Cache Poisoning Vectors
Estimated Time:2m 0s
Question 956Question →

A network administrator needs to collect baseline bandwidth utilization metrics from network switches across an enterprise subnet. Corporate security policy mandates that all monitoring traffic must support cryptographic authentication and data encryption. Which protocol version should the administrator configure to satisfy these security requirements?

Show answer & explanation

Answer: SNMPv3

Answer

SNMPv3 should be selected because it includes the User-based Security Model (USM) that supports authentication and encryption.
The selection of SNMPv3 fulfills the requirement for authenticated and encrypted monitoring communications. SNMPv3 incorporates the User-based Security Model (USM), allowing for the authPriv security level which encrypts telemetry payloads using algorithms such as AES.

Step-by-Step Solution

1
Identify the primary requirement
The scenario requires a network monitoring protocol that supports cryptographic authentication and payload encryption.
Security compliance mandates secure communication for gathering network device metrics.
2
Evaluate protocol security features
SNMPv3 is the only SNMP version that introduces USM, enabling authentication (HMAC-SHA/MD5) and encryption (AES/DES).
Earlier versions (SNMPv1 and SNMPv2c) pass community strings in cleartext across the network.

Key Concept

SNMP Version Security Capabilities
Question 957Question →

A network administrator is preparing a Request for Change (RFC) to deploy a configuration change across several core switches during an upcoming maintenance window. To ensure business continuity in the event that the change causes unexpected network failure, which of the following is most critical to include in the RFC prior to execution?

Show answer & explanation

Answer: A verified rollback plan that details the specific steps to restore the network to its previous stable state

Answer

A verified rollback plan detailing the specific steps to restore the network to its previous stable state
A documented and verified rollback plan is essential to change management because it provides clear instructions for undoing configuration changes and restoring service if the deployment fails or introduces unexpected instability.

Step-by-Step Solution

1
Identify the primary purpose of a Request for Change (RFC) in formal change management.
Recognize that RFCs require risk mitigation and emergency contingency planning before approval and execution.
Changes to core infrastructure carry risk of service disruption.
2
Evaluate the required pre-implementation components of an RFC.
Determine that a rollback plan provides explicit, tested instructions to revert configurations if failures occur during implementation.
Having a rollback plan minimizes downtime and protects business operations.

Key Concept

Rollback Plan in Change Management
Question 958Question →

A network security administrator is tasked with updating the network management baseline across all edge routers. The monitoring platform must collect hardware health parameters, such as CPU utilization and temperature metrics, while strictly enforcing packet payload encryption and cryptographic user authentication across the wire. Which configuration choice best satisfies these security and operational requirements?

Show answer & explanation

Answer: Configure SNMPv3 on all routers using the authPriv security level with USM enabled.

Answer

Configure SNMPv3 on all routers using the authPriv security level with USM enabled.
SNMPv3 with the authPriv security level implements the User-based Security Model (USM), providing both strong HMAC-based user authentication and payload encryption (such as AES) for device health and performance monitoring.

Step-by-Step Solution

1
Identify required performance monitoring features
The requirements call for polling device metrics (CPU utilization and temperature) with user authentication and payload encryption.
Determines protocol capabilities necessary for device status polling vs flow analysis.
2
Evaluate SNMP version capabilities
SNMPv1 and SNMPv2c use cleartext community strings. SNMPv3 introduces User-based Security Model (USM).
Eliminates legacy SNMP protocols that lack strong cryptographic security.
3
Determine the correct SNMPv3 security level
The authPriv level guarantees both cryptographic user authentication (HMAC-SHA/MD5) and encryption of packet contents (AES/DES).
Fulfills both security mandates (authentication + privacy/encryption).

Key Concept

SNMPv3 Security Levels and Network Telemetry
Question 959Question →

A network operations team needs to remediate a high-severity vulnerability disclosed in the operating system of the organization's core network switches. Place the standard patch management lifecycle steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence for the patch management lifecycle is: 1) Identify vulnerable assets and scan inventory, 2) Test the patch in an isolated lab environment, 3) Submit a change request with a rollback plan to the Change Advisory Board, 4) Deploy the firmware update during the approved maintenance window, and 5) Verify post-patch operation and update baseline documentation.
The correct sequence follows industry-standard patch management governance: discovering vulnerable inventory, validating patches in sandbox environments, gaining Change Advisory Board authorization with rollback strategies, executing the update during scheduled maintenance, and completing post-deployment auditing and baselining.

Step-by-Step Solution

1
Identify affected assets
Quantified affected switch inventory and current firmware versions.
Before testing or scheduling maintenance, administrators must determine the precise scope of vulnerable devices.
2
Validate patch in lab environment
Verified patch stability and cryptographically verified file integrity.
Staging in an isolated lab prevents introducing software bugs or system instability into live operations.
3
Obtain Change Advisory Board (CAB) authorization
Approved maintenance window, risk assessment, and contingency rollback plan.
Formal change control minimizes unannounced downtime and ensures leadership oversight.
4
Execute maintenance window deployment
Firmware successfully updated on production switch infrastructure.
Live modifications must occur strictly within designated maintenance windows following validation.
5
Perform post-deployment verification and auditing
Confirmed stable traffic flow, checked error logs, and saved new configuration baseline.
Auditing confirms successful remediation, while updated baseline documentation ensures ongoing operational accuracy.

Key Concept

Standard Network Patch Management Lifecycle
Question 960Question →

A network administrator is preparing to update the operating system software across a fleet of centralized wireless LAN controllers (WLCs) managing access points across several corporate sites. Lab validation of the new firmware version has been successfully completed. To minimize operational risk and prevent widespread connectivity issues caused by undiscovered software bugs during full-scale rollout, which deployment strategy should the administrator implement next?

Show answer & explanation

Answer: Perform a phased pilot deployment by updating a single non-critical controller site first and monitoring system stability before upgrading the remaining production WLCs.

Answer

Perform a phased pilot deployment by updating a single non-critical controller site first and monitoring system stability before upgrading the remaining production WLCs.
Performing a phased pilot deployment tests software changes in a controlled, live environment with reduced risk. If unforeseen issues occur, only a small subset of users is affected, allowing the organization to halt further deployment and roll back easily.

Step-by-Step Solution

1
Analyze the operational goal of updating firmware on high-impact centralized network infrastructure.
Identified the requirement to minimize service downtime and isolate unexpected software issues.
Large-scale updates carry risk even after lab validation due to environment-specific variables.
2
Evaluate standard patch deployment lifecycle procedures.
Determined that following lab testing, a pilot deployment to a limited, non-critical production site is the recommended best practice.
Pilot deployments validate software performance under real production traffic while limiting the blast radius of potential failures.

Key Concept

Pilot and Phased Software Deployment
Estimated Time:1m 30s
PreviousPage 48 / 112Next
All practice questions — CompTIA Network+ | Examkin