Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 961Question →

A network technician is configuring an Access Control List (ACL) on a router interface to allow web traffic to an internal web server at 192.168.1.50 via HTTPS (TCP port 443). The technician adds an explicit rule permitting this traffic. However, after applying the ACL, all other network traffic passing through the interface is immediately blocked, despite no explicit deny rules being added to the configuration. Which fundamental ACL feature causes this automatic blocking behavior?

Show answer & explanation

Answer: Implicit deny

Answer

The implicit deny feature causes this behavior, as firewalls and ACLs automatically append an unwritten rule at the end of every rule list that drops all unmatched traffic.
The implicit deny feature is a standard security default in network ACLs and firewalls. Once an ACL is active on an interface, any packet that fails to match any explicit permit statement is automatically dropped by the implicit deny rule at the end of the evaluation list.

Step-by-Step Solution

1
Analyze the observed issue after applying the ACL.
Traffic not explicitly matched by the permit rule is blocked automatically.
Network ACLs process packets sequentially from top to bottom until a match is found.
2
Identify the default catch-all mechanism at the end of an ACL.
The final implied statement is 'deny all traffic'.
This implicit deny rule ensures a default-deny security posture by dropping any traffic that was not explicitly permitted.

Key Concept

ACL Implicit Deny Feature
Question 962Question →

A network security engineer is evaluating transport layer behavior and payload security differences between RADIUS and TACACS+ protocols during an infrastructure audit. Which of the following statements accurately describe characteristics of the TACACS+ protocol compared to RADIUS? (Select TWO).

Select all that apply

Show answer & explanation

Answer: TACACS+ encrypts the entire payload of the packet, whereas RADIUS encrypts only the password field.; TACACS+ operates over TCP port 49, whereas RADIUS typically uses UDP ports 1812 and 1813.

Answer

The correct statements are that TACACS+ encrypts the entire payload of the packet whereas RADIUS encrypts only the password field, and TACACS+ operates over TCP port 49 whereas RADIUS typically uses UDP ports 1812 and 1813.
TACACS+ provides full payload confidentiality by encrypting the entire packet body after the header, and it uses TCP port 49 to ensure connection reliability. In contrast, RADIUS encrypts only the password attribute in Access-Request packets and operates over connectionless UDP ports 1812 and 1813.

Step-by-Step Solution

1
Analyze transport protocols and port assignments for TACACS+ and RADIUS.
TACACS+ uses TCP port 49 for reliable transport, whereas RADIUS uses UDP ports 1812 (Authentication/Authorization) and 1813 (Accounting).
Identifying the transport protocol distinguishes TACACS+ (TCP) from RADIUS (UDP).
2
Evaluate cryptographic boundary differences between TACACS+ and RADIUS.
TACACS+ encrypts the entire packet payload, providing confidentiality for all attributes and command strings. RADIUS encrypts only the password attribute in Access-Request packets.
Understanding encryption scopes clarifies payload confidentiality characteristics for each protocol.

Key Concept

RADIUS vs TACACS+ Protocol Architectural Differences
Question 963Question →

A network security team is transitioning from a passive out-of-band Network Intrusion Detection System (NIDS) TAP interface to an active in-band Network Intrusion Prevention System (NIPS) on an enterprise perimeter connection. Which of the following represent key operational advantages or trade-offs specific to deploying an inline NIPS compared to a passive NIDS? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An inline NIPS can drop malicious packets in real time before they reach their destination host.; An inline NIPS introduces potential latency and can become a single point of failure if bypass mechanisms fail.

Answer

The correct statements are that an inline NIPS can drop malicious packets in real time before reaching the destination, and that in-band placement introduces potential latency and single-point-of-failure risks if bypass hardware is absent.
Deploying an Intrusion Prevention System in-band (inline) means all packets flow through the device. This allows the system to actively prevent attacks by dropping malicious packets in real time. However, because it sits directly in the communication path, it adds packet processing latency and creates a potential single point of failure if the device crashes or lacks bypass capabilities.

Step-by-Step Solution

1
Analyze the structural placement difference between inline NIPS (in-band) and passive NIDS (out-of-band).
Inline NIPS devices sit directly along the network path, whereas passive NIDS monitors mirrored copy traffic via TAP or SPAN ports.
Placement determines whether the system can actively alter live traffic or only inspect copied traffic.
2
Evaluate the real-time prevention capability.
Being in-band allows the NIPS to inspect and drop or reset malicious connections before packets reach target devices.
This active prevention capability is the primary operational advantage of NIPS over NIDS.
3
Evaluate the hardware and throughput implications of inline placement.
Since every packet must pass through the NIPS engine, hardware latency is introduced, and device failure can sever the link if fail-open/bypass mechanisms are not configured.
This represents the primary trade-off when moving from zero-impact passive monitoring to inline prevention.

Key Concept

Inline NIPS vs Passive NIDS Operational Trade-offs
Question 964Question →

A network engineering team needs to upgrade the firmware and security policy configuration on a mission-critical, active/passive high-availability (HA) firewall pair. To adhere to enterprise change management best practices while ensuring minimal risk of unapproved downtime, in what sequence should the engineer execute these implementation steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with submitting the Request for Change (RFC), followed by obtaining Change Advisory Board (CAB) approval, applying changes to the passive standby firewall unit first, executing a controlled failover for live traffic validation, and finally updating the secondary appliance while completing post-implementation documentation.
Standard enterprise change management mandates that planning and RFC submission occur first, followed by CAB evaluation and approval. During implementation on redundant systems, applying updates to the standby system minimizes operational risk. Once the standby unit is updated, initiating a controlled failover enables production traffic validation against baselines while retaining an un-upgraded fallback. Finally, updating the secondary device, verifying HA sync, and completing a post-implementation review finishes the change lifecycle.

Step-by-Step Solution

1
Formulate and submit the Request for Change (RFC).
The proposed technical modification, rollback plan, sandbox test logs, and maintenance window are documented.
Enterprise policy requires all production changes to be fully planned and documented prior to review.
2
Obtain Change Advisory Board (CAB) authorization.
Formal business approval is granted and affected teams are scheduled for potential maintenance impacts.
Changes cannot be implemented in production without explicit organizational authorization.
3
Implement configuration changes on the passive appliance during the maintenance window.
The standby node receives the new firmware/policy without disrupting active production traffic.
Modifying the passive node first insulates active production sessions from potential update failures.
4
Perform a controlled HA failover and conduct baseline health verification.
Live traffic passes through the newly updated unit while the non-updated unit serves as an immediate, un-upgraded failback option.
Validation against performance baselines confirms system health under real operational loads.
5
Upgrade the second appliance, verify HA cluster state synchronization, and close the RFC with a Post-Implementation Review (PIR).
Both firewalls run identical baseline configurations with synchronized state tables, and change management documentation is complete.
Closing out the change management lifecycle ensures documentation remains accurate and baseline records reflect the new operational state.

Key Concept

High-Availability Network Change Management Lifecycle
Question 965Question →

A network security administrator is configuring a stateful perimeter firewall and documenting how the device inspects incoming network traffic. When an initial TCP SYN packet initiating a new session arrives at the untrusted external interface destined for an internal server, the firewall executes specific operational phases to process the request. In what chronological order, from first to last, does the stateful firewall process this new incoming connection attempt?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of stateful firewall operations is: 1) Inspect the active connection state table for an existing session match, 2) Evaluate the packet against static ACL security rules sequentially from top to bottom upon a state table miss, 3) Create a new session entry in the state table using the 5-tuple details after matching a permit rule, and 4) Perform routing table lookup and forward the packet to the destination interface.
Stateful firewalls operate by maintaining session state across network connections. When an inbound packet arrives, the firewall first checks its active connection state table (Item 1). Because an initial TCP SYN packet represents a new session, it results in a state table lookup miss. Next, the firewall evaluates the packet against the configured security policy / ACL rules sequentially from top to bottom (Item 2). If an explicit permit rule matches the packet, the firewall instantiates a new dynamic session entry in the state table capturing the 5-tuple connection metrics (Item 3). Finally, the firewall determines the outbound interface via a routing lookup and forwards the packet to its destination (Item 4).

Step-by-Step Solution

1
Check State Table
State table cache miss identified for the initial TCP SYN packet.
Stateful firewalls optimize processing by checking active state tables first to bypass full ACL rule evaluation for established connections.
2
Evaluate Access Control Rules
Packet matches an explicit permit rule in the firewall policy.
New connection attempts (SYN flag set) must be explicitly allowed by security policy rules processed top-to-bottom.
3
Update State Table
A new session entry tracking source/destination IP, source/destination port, and protocol is added.
Recording the 5-tuple state allows the firewall to implicitly allow returning SYN-ACK traffic without requiring a separate static return ACL rule.
4
Forward Packet
Packet is routed and egressed via the internal interface.
Once security evaluation and state tracking are completed, the firewall passes the packet along its routing path.

Key Concept

Stateful Inspection Workflow and State Table Dynamics
Estimated Time:2m 0s
Question 966Question →

A network administrator is documenting the authentication sequence for remote users connecting to an enterprise network using an IKEv2 IPsec Virtual Private Network (VPN) with EAP authentication. Place the following phases and steps of the IKEv2 negotiation process in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of steps for establishing an IKEv2 remote access VPN session is: 1) Negotiate algorithms and exchange Diffie-Hellman keys during IKE_SA_INIT, 2) Send user identity and request EAP authentication during IKE_AUTH, 3) Proxy credential verification to the RADIUS server, and 4) Complete IKE_AUTH by assigning a virtual IP address and creating the Child SA.
Establishing an IKEv2 remote access VPN session requires a structured multi-phase process. First, the client and gateway initiate the IKE_SA_INIT exchange to negotiate cryptographic suites and exchange Diffie-Hellman public keys, forming a secure control tunnel. Second, the client initiates the IKE_AUTH exchange to submit its identity and select EAP authentication. Third, the VPN gateway proxies these EAP authentication messages to a backend RADIUS server for identity validation. Fourth, after the RADIUS server approves access, the gateway responds with the final IKE_AUTH message, assigning a local virtual IP address to the client and instantiating the Child SA used to protect actual data traffic.

Step-by-Step Solution

1
Identify the unauthenticated control phase (IKE_SA_INIT).
The client and VPN gateway establish shared secret keys using Diffie-Hellman and agree on encryption algorithms.
A secure, encrypted channel must be formed before transmitting sensitive authentication identity data.
2
Identify the start of the user authentication phase (IKE_AUTH).
The client requests authentication via Extensible Authentication Protocol (EAP) inside the secure control channel.
EAP negotiation occurs within the protection of the newly created IKE SA.
3
Identify backend credential verification.
The VPN gateway passes EAP messages to the RADIUS server to validate remote user credentials.
Enterprise VPNs rely on central AAA servers to verify identity and policy compliance.
4
Identify final session establishment and IP assignment.
The VPN gateway confirms authentication, provisions a virtual IP address via configuration payloads, and creates the Child SA.
The Child SA (IPsec SA) handles data transport after authorization is confirmed.

Key Concept

IKEv2 VPN Handshake and EAP Authentication Sequence
Question 967Question →

A network administrator receives security alerts from a passive Network Intrusion Detection System (NIDS) connected to a switch SPAN port, indicating that malicious payloads are reaching internal web servers. Although the NIDS successfully logs the suspicious traffic, it fails to stop the attacks. Which network security deployment modification would enable active packet dropping to prevent malicious traffic from reaching the servers?

Show answer & explanation

Answer: Deploy a Network Intrusion Prevention System (NIPS) in-band along the traffic path.

Answer

Deploy a Network Intrusion Prevention System (NIPS) in-band along the traffic path.
A Network Intrusion Prevention System (NIPS) deployed in-band (inline) sits directly within the network traffic flow. Unlike passive out-of-band NIDS solutions receiving port mirrors, an inline NIPS actively inspects live traffic and drops malicious packets before they reach destination systems.

Step-by-Step Solution

1
Evaluate the current monitoring architecture.
The current NIDS operates out-of-band via a switch SPAN port.
Out-of-band systems receive mirrored copies of packets passively, enabling logging and alerting but preventing real-time packet manipulation or inline blocking.
2
Determine the functional requirement for active prevention.
The requirement is to intercept and block malicious traffic before destination arrival.
Active threat mitigation requires an inline (in-band) device through which all production traffic physically flows.
3
Select the appropriate device and placement topology.
Deploy an inline Network Intrusion Prevention System (NIPS).
An in-band NIPS evaluates live traffic stream frames and drops malicious packets in real time.

Key Concept

Inline (In-Band) NIPS vs. Out-of-Band (Passive) NIDS Architecture
Question 968Question →

A network technician discovers an unauthorized wireless router plugged into a corporate network switch port inside an unsecured conference room. The device is broadcasting a wireless network that mimics the legitimate company network to intercept employee credentials. Which of the following statements accurately describe this security threat? (Select TWO)

Select all that apply

Show answer & explanation

Answer: The unauthorized wireless device functions as a rogue access point on the corporate network.; The setup allows the attacker to execute a Man-in-the-Middle (MitM) attack against connecting clients.

Answer

The security threat involves a rogue access point that facilitates a Man-in-the-Middle (MitM) attack on connecting network clients.
Plugging an unauthorized wireless access point into an internal network port establishes a rogue access point. When users connect to this unauthorized access point, traffic passes through the attacker's hardware, enabling a Man-in-the-Middle (MitM) attack to intercept sensitive data.

Step-by-Step Solution

1
Identify the physical and wireless attack vector described in the scenario.
An unauthorized wireless router connected to an internal switch port is classified as a rogue access point.
Connecting unauthorized wireless devices directly to an enterprise network port bypasses network perimeter security policies.
2
Determine the objective and operational impact of the attack.
Intercepting network traffic passing through the fake wireless interface constitutes a Man-in-the-Middle (MitM) attack.
The attacker places their hardware between wireless clients and the enterprise network to capture sensitive user credentials.

Key Concept

Rogue Access Points and Man-in-the-Middle (MitM) Wireless Attacks
Question 969Question →

Match each Virtual Private Network (VPN) protocol to its primary operational characteristic or protocol specification.

Click a left item, then click its matching right item

Items

IPsec
SSL/TLS VPN
PPTP
WireGuard

Matches

Show answer & explanation

Answer

IPsec matches with Layer 3 operation using ESP and IKE; SSL/TLS matches with clientless browser remote access over TCP port 443; PPTP matches with legacy Layer 2 protocol using TCP port 1723; WireGuard matches with lightweight kernel-space protocol using ChaCha20.
Each protocol is matched accurately based on its layer operation, port usage, and cryptographic implementation: IPsec provides Layer 3 tunneling with ESP/IKE; SSL/TLS allows clientless access on TCP port 443; PPTP is a legacy Layer 2 protocol operating over TCP port 1723 and GRE; and WireGuard is a modern kernel-level protocol using ChaCha20 encryption.

Step-by-Step Solution

1
Identify the OSI layer and encapsulation mechanism of IPsec.
IPsec operates at Layer 3 (Network layer) using ESP and IKE.
IPsec secures IP packets directly at the network layer for site-to-site or client-based tunnels.
2
Determine the connection and client requirements for SSL/TLS VPNs.
SSL/TLS VPNs use standard HTTPS (TCP port 443) for clientless access.
Web browsers natively support SSL/TLS, eliminating the need for dedicated VPN client software.
3
Recall the protocol components and security status of PPTP.
PPTP relies on TCP port 1723 and GRE, and is deprecated due to security flaws.
PPTP uses vulnerable encryption and authentication methods.
4
Identify the key features of WireGuard.
WireGuard is a modern kernel-space protocol using ChaCha20.
WireGuard was designed for simplicity, high speed, and modern cryptographic standards.

Key Concept

Virtual Private Network (VPN) Protocols and Characteristics
Question 970Question →

Match each high-availability concept or operational mechanism on the left with its corresponding description on the right.

Click a left item, then click its matching right item

Items

Heartbeat Signal
Virtual MAC Address
Split-Brain Condition
Link Aggregation (802.3ad)

Matches

Show answer & explanation

Answer

Heartbeat Signal matches periodic control messages for node health monitoring; Virtual MAC Address matches the shared identifier assigned to active FHRP gateways; Split-Brain Condition matches dual-active failure states caused by lost keepalive communication; Link Aggregation (802.3ad) matches bundling physical links into a single logical redundant interface.
Each high-availability mechanism is correctly linked to its precise operational role: Heartbeat Signals monitor state via periodic check messages; Virtual MAC Addresses provide transparent failover for client gateways in FHRP; Split-Brain describes dual-active fault states caused by lost interconnect connectivity; and Link Aggregation (802.3ad) combines physical links for redundant throughput.

Step-by-Step Solution

1
Identify the primary function of heartbeat signals in high availability clustering.
Heartbeats send regular state check packets over interconnect links to detect node status.
Health monitoring is essential for automated failover initiation.
2
Determine how Virtual MAC addresses function within FHRP group operations.
The active gateway answers ARP requests using the shared virtual MAC so clients do not need to alter their ARP tables during gateway failover.
Ensures seamless Layer 2 transition to standby devices.
3
Analyze cluster behavior when communication between redundant nodes drops completely.
Both devices assume the active role simultaneously, resulting in a split-brain scenario.
Loss of status visibility prevents nodes from knowing if their peer is dead or simply uncommunicative.
4
Associate IEEE 802.3ad Link Aggregation with physical layer interface redundancy.
Bundling multiple interfaces into a single NIC bond / port channel provides increased aggregate bandwidth and fault tolerance.
Traffic fails over immediately to remaining operational cables without link down events.

Key Concept

High Availability Concepts and Mechanisms
Question 971Question →

An enterprise is upgrading its remote access infrastructure for network administrators who connect via remote VPN sessions to manage core routers and firewalls. The security policy mandates a central AAA authentication service that encrypts the entire packet payload during communication between the VPN gateway and the authentication server, while also supporting granular, command-level authorization. Which protocol should the network engineer configure on the VPN gateway to meet these security requirements?

Show answer & explanation

Answer: TACACS+

Answer

TACACS+ is the correct protocol because it encrypts the entire packet payload and decouples authentication from authorization to allow per-command authorization for network management.
TACACS+ (Terminal Access Controller Access-Control System Plus) is designed specifically for administrative access control over network infrastructure. It runs over TCP (port 49), encrypts the entire payload of every packet exchanged between the NAS (VPN gateway) and the AAA server, and cleanly separates authentication, authorization, and accounting. This architecture allows administrators to enforce per-command authorization policies for remote access users.

Step-by-Step Solution

1
Analyze the requirements for payload encryption in AAA server communication.
TACACS+ encrypts the complete body of the packet, whereas RADIUS encrypts only the password attribute.
Protecting all administrative data during AAA transmission requires full-payload encryption.
2
Evaluate protocol support for modular separation of AAA functions.
TACACS+ separates authentication, authorization, and accounting into distinct operations, enabling command-by-command authorization rules.
RADIUS combines authentication and authorization into single request/response pairs, preventing granular command-level restriction.
3
Select the protocol that satisfies both encryption and granular control constraints.
TACACS+ fulfills both requirements.
It runs over TCP port 49 and supports granular control with full-packet encryption.

Key Concept

TACACS+ vs RADIUS AAA Architecture in Remote Access Security
Question 972Question →

During a routine audit of core network operations, a security analyst discovers that event logs generated by perimeter firewalls are occasionally dropped during bandwidth spikes. Additionally, network packet captures reveal that log messages are transmitted across the internal network in unencrypted text. Which configuration update will resolve log delivery failures while ensuring log confidentiality during transit?

Show answer & explanation

Answer: Implement Syslog transport using TCP over port 6514 encrypted with TLS.

Answer

Implement Syslog transport using TCP over port 6514 encrypted with TLS.
Implementing Syslog over TCP port 6514 with TLS satisfies both audit requirements. TCP guarantees delivery through sequence numbers and acknowledgments, preventing log message loss during congestion. TLS encrypts log packets during transmission, preserving confidentiality.

Step-by-Step Solution

1
Identify reliability requirement
TCP must be selected over UDP to guarantee connection-oriented delivery and retransmission of lost log packets during network congestion.
UDP lacks delivery acknowledgments and flow control, leading to silent drops.
2
Identify confidentiality requirement
TLS encryption must be applied to secure log data in transit.
Standard Syslog traffic is plaintext; TLS wraps the syslog stream to prevent eavesdropping.
3
Verify standard port assignment
Syslog over TLS standardly uses TCP port 6514.
RFC 5425 specifies TCP port 6514 for secure Syslog transport.

Key Concept

Secure Syslog Transport and Log Integrity
Estimated Time:1m 15s
Question 973Question →

A network administrator is upgrading a small office wireless access point from WPA2-Personal to WPA3-Personal. Which TWO of the following capabilities are standard security enhancements introduced by WPA3-Personal?

Select all that apply

Show answer & explanation

Answer: Simultaneous Authentication of Equals (SAE) to mitigate offline dictionary attacks; Mandatory Protected Management Frames (PMF) to safeguard control and management traffic

Answer

The two correct enhancements introduced by WPA3-Personal are Simultaneous Authentication of Equals (SAE) to mitigate offline dictionary attacks and mandatory Protected Management Frames (PMF) to safeguard control and management traffic.
WPA3-Personal improves wireless security over WPA2-Personal by implementing Simultaneous Authentication of Equals (SAE) to block offline password guessing attacks and by requiring Protected Management Frames (PMF) to protect management packets from spoofing.

Step-by-Step Solution

1
Identify the features specific to WPA3-Personal mode compared to WPA2-Personal.
WPA3-Personal replaces PSK with SAE (Dragonfly handshake) to stop offline dictionary attacks.
SAE ensures that key establishment requires active interaction, preventing attackers from capturing handshakes for brute-force analysis.
2
Evaluate the management frame requirement for WPA3.
Protected Management Frames (PMF) are strictly enforced in WPA3.
PMF prevents spoofed deauthentication/disassociation attacks that were common in earlier Wi-Fi standards.
3
Distinguish Personal features from Enterprise requirements and deprecated protocols.
802.1X RADIUS authentication applies to Enterprise modes, while TKIP is completely deprecated.
Personal mode relies on shared secrets rather than RADIUS servers, and TKIP is insecure.

Key Concept

WPA3-Personal Security Enhancements (SAE and PMF)
Estimated Time:1m 0s
Question 974Question →

A network security architect is designing a wireless infrastructure for a regional corporate facility. Organizational compliance rules require that every employee authenticate using individual Active Directory domain credentials managed through a centralized authentication server, while simultaneously utilizing modern AES-based cipher suites for confidentiality. Which wireless security standard and authentication mechanism combination fulfills all compliance requirements?

Show answer & explanation

Answer: WPA3-Enterprise utilizing 802.1X authentication with a RADIUS server and AES-CCMP/GCMP encryption

Answer

WPA3-Enterprise utilizing 802.1X authentication with a RADIUS server and AES-CCMP/GCMP encryption
The scenario requires centralized, per-user credential authentication against Active Directory along with modern AES encryption. WPA3-Enterprise uses 802.1X authentication, which forwards Extensible Authentication Protocol (EAP) messages to a RADIUS server for identity verification, while enforcing strong AES-CCMP or GCMP encryption for data protection.

Step-by-Step Solution

1
Analyze authentication requirements from the scenario
Individual employee credential authentication linked to Active Directory requires an Enterprise deployment leveraging 802.1X port-based access control rather than pre-shared keys.
Personal modes (PSK or SAE) use shared secret passphrases rather than centralized per-user authentication.
2
Evaluate authentication protocol suitability
RADIUS is the standard protocol used with 802.1X for wireless client authentication, whereas TACACS+ is primarily used for device administration AAA.
RADIUS integrates natively with 802.1X EAP frameworks to communicate with backend directories like Active Directory.
3
Verify encryption suite compliance
WPA3-Enterprise mandates robust AES-based encryption mechanisms (such as CCMP-128 or GCMP-256) to ensure confidentiality and integrity.
Combining WPA3-Enterprise, 802.1X RADIUS authentication, and modern AES ciphers meets all stated security and compliance directives.

Key Concept

Wireless Enterprise Authentication and Encryption Standards
Estimated Time:2m 0s
Question 975Question →

A network engineer is troubleshooting a remote access VPN deployment. Remote workers connecting via an IPsec IKEv2 client can successfully establish Phase 1 and Phase 2 Security Associations and access internal servers by IP address. However, when users attempt to connect to internal resources using hostnames such as `server1.corp.internal`, the lookup fails or resolves to public internet addresses. The engineer needs internal hostnames to be resolved by the corporate DNS server across the tunnel while preventing general internet web traffic from being redirected through the corporate network. Which of the following configuration changes should the engineer implement on the VPN gateway profile?

Show answer & explanation

Answer: Configure Split DNS settings in the VPN client connection profile to route queries for `*.corp.internal` to the internal corporate DNS server.

Answer

Configure Split DNS settings in the VPN client connection profile to route queries for internal domain names through the tunnel.
Configuring Split DNS pushes rules to the VPN client specifying that queries for internal domain suffixes (such as `*.corp.internal`) must be forwarded across the encrypted tunnel to the internal corporate DNS server, while all other DNS requests go to the local network DNS.

Step-by-Step Solution

1
Analyze the business and technical requirements
Internal hostnames must resolve using corporate DNS, while public internet traffic must remain outside the VPN tunnel.
Users are experiencing name resolution failures for internal domains while split tunneling is active.
2
Evaluate name resolution mechanisms under split tunneling
Without Split DNS, client operating systems send all DNS queries to their physical network interface DNS server (local ISP).
Split DNS specifies target domain suffixes (e.g., `*.corp.internal`) that should be sent exclusively over the VPN interface to corporate DNS servers.
3
Select the correct configuration parameter
Enabling Split DNS pushes domain routing rules to the remote VPN client upon successful authentication.
This selectively sends internal DNS traffic across the tunnel while keeping regular internet traffic on the client's local network gateway.

Key Concept

Split DNS configuration in remote access VPN profiles
Question 976Question →

During a security incident investigation, a network analyst reviews packet captures from an ongoing Distributed Denial of Service (DDoS) event targeting an enterprise's web server. The logs reveal a high volume of inbound UDP traffic originating from standard network management servers on external networks. The attacker initiated this traffic by transmitting small query packets with a forged source IP address matching the victim's public server, inducing the external servers to transmit significantly larger response payloads back to the victim. Which of the following attack vectors is being executed in this scenario?

Show answer & explanation

Answer: NTP Reflection and Amplification Attack

Answer

NTP Reflection and Amplification Attack
The scenario describes an amplification and reflection DDoS attack. The attacker sends small UDP requests (such as NTP monlist queries) with a spoofed source IP address corresponding to the victim's IP. The open third-party servers reply to the victim with significantly larger payloads, reflecting and amplifying the attack volume.

Step-by-Step Solution

1
Analyze traffic characteristics and transport protocols from the incident log.
Identified high-volume UDP traffic originating from external time management servers targeting port 123.
Determining the protocol (UDP) and service (NTP/port 123) isolates the specific vector exploited.
2
Evaluate the mechanism of IP address manipulation and response size discrepancy.
Forged source IP addresses (IP spoofing) caused third-party servers to send disproportionately large payload responses to the victim.
This behavior defines a classic reflection and amplification mechanism where small queries yield massive response amplification factor multipliers.
3
Select the attack classification matching both the protocol vector and amplification mechanism.
Confirmed the incident as an NTP Reflection and Amplification Attack.
No other choice correctly combines connectionless UDP reflection, IP spoofing, and amplification capabilities.

Key Concept

NTP Reflection and Amplification Attack Mechanics
Question 977Question →

A network technician is establishing standard configuration baseline documentation for newly installed branch switches. Which of the following elements should be included as key components of an enterprise configuration baseline? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The approved operating system software version and standardized management security settings.; The hardware inventory details, including device model numbers, serial numbers, and MAC addresses.

Answer

The correct elements to include in a configuration baseline are the approved operating system software version with standardized management security settings, and the hardware inventory details including device model numbers, serial numbers, and MAC addresses.
A configuration baseline serves as the official reference point for network devices. It contains verified device inventory data (such as serial numbers and MAC addresses) and approved software configurations (such as firmware build numbers, management access controls, and default port settings). This allows administrators to audit devices for unauthorized drift and swiftly restore devices to a known good state.

Step-by-Step Solution

1
Identify the purpose of a network configuration baseline
Recognize that a baseline captures the known, tested, and approved initial operating state of network hardware and software.
Establishing a baseline allows network administrators to detect unauthorized configuration drift and maintain standardization.
2
Evaluate the choices for valid configuration baseline components
Select the OS software version, security settings, and hardware inventory details.
These details define the physical and logical configuration standard required for operational consistency and inventory audits.

Key Concept

Configuration Baseline Documentation
Estimated Time:1m 0s
Question 978Question →

An enterprise network engineer is designing a comprehensive network performance monitoring architecture. Match each telemetry protocol or monitoring technique on the left with its appropriate operational deployment objective on the right.

Click a left item, then click its matching right item

Items

sFlow packet sampling telemetry
IPFIX (IP Flow Information Export) flow records
SNMPv3 with authPriv security level
TWAMP (Two-Way Active Measurement Protocol) probing

Matches

Show answer & explanation

Answer

sFlow packet sampling matches hardware ASIC-driven statistical sampling; IPFIX flow records match aggregating stateful flow statistics for top-talkers; SNMPv3 with authPriv matches querying device MIB objects with HMAC authentication and AES encryption; TWAMP probing matches measuring precise two-way latency, loss, and jitter across real-time paths.
sFlow relies on hardware ASIC packet sampling (stateless) across high-port-density devices. IPFIX aggregates flow records to provide stateful conversation telemetry. SNMPv3 with authPriv provides authenticating and encrypting capabilities (HMAC and AES) for polling switch and router MIB counter metrics. TWAMP actively generates timestamped test frames between devices to measure round-trip delay, jitter, and loss accurately.

Step-by-Step Solution

1
Analyze the sampling mechanism and state requirements of switch monitoring technologies.
Identify sFlow as a hardware-based, stateless packet-sampling mechanism suitable for high-density switches, matching right_1.
Unlike flow-based telemetry, sFlow samples 1-out-of-N packets at the ASIC layer without maintaining active flow tables.
2
Evaluate flow aggregation standards for traffic profile and top-talker tracking.
Identify IPFIX as an open IETF standard for template-based flow export to analyze Layer 4 conversations, matching right_2.
Flow technologies track active connections by key tuple fields (IP addresses, ports, protocol) to summarize bandwidth allocation.
3
Examine device management protocol security parameters.
Identify SNMPv3 authPriv as the configuration providing both cryptographic authentication and packet payload encryption, matching right_3.
The authPriv security model in SNMPv3 User-based Security Model (USM) enforces SHA/MD5 digest validation along with AES encryption for MIB object polling.
4
Differentiate active synthetic probes from passive telemetry collector mechanisms.
Identify TWAMP as an active measurement protocol tailored for real-time SLA parameters such as jitter and delay, matching right_4.
Active synthetic probing generates timed timestamped test packets to compute microsecond-level latency and jitter metrics across a path.

Key Concept

Network Performance Telemetry Protocols and Monitoring Methodologies
Question 979Question →

A network infrastructure team is preparing a complex change to transition an enterprise data center's core routing infrastructure from a static routing model to an internal BGP (iBGP) topology. The proposed configuration updates have already been tested in a isolated sandbox environment and reviewed by the Change Advisory Board (CAB). Which of the following components must be formally documented within the final Request for Change (RFC) before the maintenance window is approved for execution?

Show answer & explanation

Answer: Specific criteria defining unacceptable performance impact alongside a pre-tested rollback plan and explicit rollback execution triggers

Answer

Specific criteria defining unacceptable performance impact alongside a pre-tested rollback plan and explicit rollback execution triggers
A comprehensive Request for Change (RFC) must specify explicit, measurable triggers for failure (such as convergence timeouts or packet loss thresholds) along with a fully documented and tested rollback plan. This ensures that if unforeseen issues occur in production, the team can quickly restore the network to its verified baseline state before the maintenance window expires.

Step-by-Step Solution

1
Analyze the change management lifecycle requirements for a high-risk enterprise network deployment.
Identified that even after sandbox validation and CAB review, an RFC requires explicit risk mitigation mechanisms.
Enterprise change control requires a documented and validated mechanism to revert changes if production behavior deviates from lab tests.
2
Evaluate the essential elements of an RFC document prior to maintenance window execution.
Determined that clear rollback triggers, threshold metrics, and step-by-step restoration procedures are mandatory components.
Without clear triggers and tested back-out plans, engineers risk extending downtime while attempting ad-hoc troubleshooting during maintenance.

Key Concept

Request for Change (RFC) Mandatory Rollback Plan and Execution Triggers
Question 980Question →

An organization is deploying a remote access VPN solution and requires integration with a central AAA server for network administration access control. The security requirements dictate that authentication and authorization functions must be decoupled into separate processes, and the entire payload of each AAA transmission must be encrypted. Which protocol should the network administrator select?

Show answer & explanation

Answer: TACACS+

Answer

TACACS+ is the correct choice because it separates authentication and authorization while encrypting the complete packet payload.
TACACS+ (Terminal Access Controller Access-Control System Plus) operates over TCP port 49, encrypts the entire payload of every packet following the header, and strictly separates authentication, authorization, and accounting functions.

Step-by-Step Solution

1
Analyze the encryption requirement
The requirement mandates full payload encryption of all AAA communications.
Complete payload encryption prevents eavesdroppers from viewing user attributes or administrative commands sent to the AAA server.
2
Analyze the architectural decoupling requirement
Authentication and authorization must be distinct, decoupled processes.
Decoupling allows granular command authorization to be evaluated independently from user login credentials.
3
Evaluate protocol features
TACACS+ meets both criteria by encrypting the full body of each packet and maintaining independent AAA modules.
RADIUS encrypts only the password field and combines authentication and authorization into single transactions, while L2TP and IPsec AH are network tunnel and security header protocols rather than AAA frameworks.

Key Concept

AAA Protocol Differentiation for Secure VPN Remote Access
PreviousPage 49 / 112Next
All practice questions — CompTIA Network+ | Examkin