Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 1121Question →

A corporate enterprise plans to deploy a new port security baseline across all access switches at branch office sites during an upcoming scheduled maintenance window. Which of the following components MUST be included within the formal Request for Change (RFC) document prior to submitting it for Change Advisory Board (CAB) review? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A comprehensive rollback plan detailing specific metric-based triggers and step-by-step instructions for configuration baseline restoration; A formal risk assessment outlining potential service impacts, dependency mapping, and business disruption severity

Answer

A comprehensive rollback plan detailing specific metric-based triggers and step-by-step instructions for configuration baseline restoration, and a formal risk assessment outlining potential service impacts, dependency mapping, and business disruption severity.
A formal Request for Change (RFC) must incorporate a comprehensive rollback strategy with predefined execution triggers and step-by-step recovery commands to restore the original baseline if issues arise. Additionally, a detailed risk assessment evaluating service dependencies and business impact is required so the Change Advisory Board (CAB) can properly evaluate and approve the change request.

Step-by-Step Solution

1
Identify mandatory components required in a standard enterprise Request for Change (RFC).
Recognize that RFC documentation must define project scope, risk impact analysis, scheduling details, validation testing, and rollback procedures.
Standard change management governance ensures that network modifications are properly vetted, predictable, and reversible.
2
Evaluate the candidate options against change management best practices.
Select the options detailing a clear rollback strategy with back-out triggers and a risk assessment mapping service dependencies.
A rollback strategy guarantees recovery steps if production failures occur, while a risk assessment enables the CAB to judge the operational risk.

Key Concept

Request for Change (RFC) essential documentation components
Question 1122Question →

Match each network security threat to its corresponding attack vector or operational mechanism.

Click a left item, then click its matching right item

Items

Smurf Attack
Password Spraying
Typosquatting
VLAN Hopping

Matches

Show answer & explanation

Answer

Smurf Attack matches ICMP broadcast spoofing amplification; Password Spraying matches testing a single password across many accounts; Typosquatting matches registering mispelled domain names; VLAN Hopping matches crafting double 802.1Q tagged frames.
Each attack type is paired correctly with its primary technical mechanism: Smurf attacks use ICMP amplification via broadcast addresses; password spraying evades account lockout by trying a single common password across many user accounts; typosquatting targets human typographical errors in domain names; and VLAN hopping manipulates 802.1Q tags to traverse isolated virtual networks.

Step-by-Step Solution

1
Analyze the operational mechanism of Smurf Attack
Identify that it uses ICMP echo requests sent to broadcast addresses with a spoofed source IP.
This matches the ICMP amplification broadcast description.
2
Analyze Password Spraying
Identify that it targets many accounts with few passwords.
This contrasts with brute force attacks and matches the lockout evasion strategy description.
3
Analyze Typosquatting
Identify that it leverages mistyped web domain names.
This matches registering deliberate spelling variations of popular domains.
4
Analyze VLAN Hopping
Identify that it involves circumvention of VLAN boundaries.
This matches sending double 802.1Q tagged frames through switch trunks.

Key Concept

Common Network Attack Types and Vectors
Question 1123Question →

Match each physical security control or environmental measure on the left with its primary protective function on the right.

Click a left item, then click its matching right item

Items

Biometric scanner
Faraday cage
HVAC system
Mantrap

Matches

Show answer & explanation

Answer

Biometric scanner matches authenticating access based on unique human biological features; Faraday cage matches shielding equipment against electromagnetic interference and signal leakage; HVAC system matches regulating ambient temperature and humidity levels; Mantrap matches preventing tailgating using an interlocking two-door enclosure.
The correct pairings accurately reflect standard network security definitions: biometric scanners rely on human biological metrics for access control, Faraday cages suppress electromagnetic signal emissions and interference, HVAC systems manage ambient temperature and humidity metrics, and mantraps utilize two interlocking doors to stop tailgating.

Step-by-Step Solution

1
Analyze each physical security control and environmental measure listed on the left.
Identified biometric scanners as identity authenticators, Faraday cages as signal blockers, HVAC as climate regulators, and mantraps as entryway access barriers.
Each control serves a distinct operational purpose in data center physical security and environmental protection.
2
Correlate each item on the left with its exact functional definition on the right.
Paired biometric scanner with biological feature authentication, Faraday cage with electromagnetic shielding, HVAC system with temperature and humidity regulation, and mantrap with tailgating prevention via interlocking doors.
Aligning standard CompTIA Network+ security definitions connects each control to its primary risk mitigation capability.

Key Concept

Physical Access and Environmental Controls
Question 1124Question →

A network administrator is configuring centralized administration for network switches. The organization's security policy mandates that every CLI command executed by administrators must be individually authorized and audited, and all traffic between the switch and authentication server must be completely encrypted. Which authentication protocol should the administrator deploy to satisfy these requirements?

Show answer & explanation

Answer: TACACS+

Answer

TACACS+ is the correct choice because it encrypts the full packet payload and supports granular per-command authorization and accounting for network device administration.
TACACS+ (Terminal Access Controller Access-Control System Plus) separates authentication, authorization, and accounting functions. It encrypts the complete body of the packet for enhanced privacy and allows administrators to enforce per-command authorization rules on network devices.

Step-by-Step Solution

1
Analyze the operational requirements from the scenario.
Identified two primary requirements: full packet encryption and per-command CLI authorization/auditing.
Centralized device administration requires AAA capabilities tailored for network hardware control.
2
Evaluate protocol payload encryption mechanisms.
TACACS+ encrypts the entire message body (payload), whereas RADIUS encrypts only the user password field.
Security compliance requires encrypting all administrative data passed across the network.
3
Evaluate command authorization granularity.
TACACS+ separates authorization from authentication, enabling command-by-command authorization, whereas RADIUS combines them.
Granular command control is necessary to restrict and audit individual administrative commands.

Key Concept

TACACS+ vs RADIUS for Network Device Administration
Estimated Time:1m 15s
Question 1125Question →

An enterprise implements Virtual Router Redundancy Protocol (VRRP) across two core switches to provide high availability for client devices on a production VLAN. During a scheduled test, the primary switch is powered down, and network logs confirm that the standby switch successfully transitions to the master role. However, workstations on the VLAN immediately lose external network connectivity and fail to recover. Diagnostics show that VRRP advertisement packets and virtual MAC transitions operated correctly. Which of the following host misconfigurations is the most likely cause of this connectivity failure?

Show answer & explanation

Answer: Workstations were configured with the primary switch's physical interface IP address as their default gateway rather than the virtual IP address shared by the redundancy group.

Answer

Workstations were configured with the primary switch's physical interface IP address as their default gateway rather than the virtual IP address shared by the redundancy group.
For First Hop Redundancy Protocols (such as VRRP or HSRP) to provide seamless failover, client workstations must use the Virtual IP (VIP) assigned to the router redundancy group as their default gateway. When the active router fails, the standby router takes ownership of the Virtual IP and virtual MAC address. If workstations are statically or dynamically configured with the physical interface IP of the primary router instead of the VIP, their traffic continues targeting the failed physical interface, breaking outbound connectivity despite a successful protocol failover.

Step-by-Step Solution

1
Analyze First Hop Redundancy Protocol (FHRP) operational requirements.
FHRP protocols like VRRP and HSRP create a Virtual IP (VIP) and Virtual MAC address that are shared between redundant routers.
Client endpoints must send outbound traffic to the Virtual IP so that whichever router holds the active/master role can process the frames seamless to the client.
2
Evaluate the failure symptom described in the scenario.
The backup switch successfully assumed the Master role, meaning VRRP failover executed properly at the network layer.
If clients lose connectivity despite a successful VRRP failover, client traffic is directed to a specific physical hardware address rather than the virtual gateway.
3
Identify the client-side configuration error.
Clients configured with the physical interface IP of the primary router lose access when that specific device fails because their packets are sent to an inactive physical node rather than the virtual gateway.
Configuring hosts with the Virtual IP (VIP) ensures traffic is dynamically serviced by whichever switch currently holds the master role.

Key Concept

FHRP Virtual Gateway IP Configuration
Question 1126Question →

A network technician is preparing to establish a secure management baseline on a newly unboxed switch prior to connecting it to the production network. Place the following administrative hardening steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The baseline hardening process begins by changing default administrative passwords and removing cleartext services, followed by generating crypto keys to enable SSH/HTTPS. Next, unused ports are administratively disabled and isolated, and finally, the configuration is saved to NVRAM.
The correct chronological process begins with securing initial local access by changing default passwords and turning off insecure cleartext protocols (Telnet/HTTP). Next, cryptographic keys are generated to support encrypted management protocols (SSH/HTTPS). After secure management is enabled, physical switch ports are hardened by disabling unused interfaces and placing them in an isolated VLAN. Finally, the running configuration must be written to NVRAM so all security policies remain active across reboots.

Step-by-Step Solution

1
Eliminate default access risks and cleartext services.
Default credentials are changed and Telnet/HTTP are disabled.
Prevents unauthorized baseline access and cleartext credential sniffing during device setup.
2
Configure encrypted management access.
SSH and HTTPS services are enabled using generated cryptographic keys.
Ensures all subsequent administrative interactions across the network are encrypted.
3
Harden unused physical interfaces.
Unused switch ports are shut down and assigned to an isolated VLAN.
Prevents unauthorized physical access and port-based network intrusion.
4
Persist configuration settings.
The running configuration is saved to startup-config in NVRAM.
Guarantees that all applied security controls persist through reboots in production.

Key Concept

Switch Baseline Hardening Sequence
Question 1127Question →

A network administrator is deploying a dual-protocol Layer 2 Tunneling Protocol over IPsec (L2TP/IPsec) remote access VPN for mobile employees, integrated with a central RADIUS server for enterprise AAA. Which of the following technical requirements and protocol characteristics are accurate for this implementation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: L2TP provides data tunneling and frame encapsulation, while IPsec provides data confidentiality and payload integrity.; The initial connection setup relies on UDP port 500 for IPsec IKE negotiation and UDP port 1701 for L2TP session traffic.

Answer

L2TP provides data tunneling and frame encapsulation while IPsec provides data confidentiality and integrity, and the initial connection setup relies on UDP port 500 for IPsec IKE negotiation and UDP port 1701 for L2TP session traffic.
L2TP/IPsec combines the tunneling capabilities of L2TP with the security features of IPsec. L2TP encapsulates Layer 2 frames inside UDP packets, while IPsec provides encryption (ESP) and security association negotiation (IKE over UDP 500). L2TP session management uses UDP port 1701.

Step-by-Step Solution

1
Analyze the functional responsibilities of L2TP and IPsec in a combined deployment.
Identify that L2TP handles Layer 2 frame tunneling and user session control, but lacks encryption capabilities. IPsec fills this gap by encrypting and authenticating the encapsulated L2TP packets at Layer 3.
Understanding layer separation in composite VPN protocols clarifies why both L2TP and IPsec are paired together.
2
Verify transport layer protocols and port numbers associated with L2TP/IPsec operations.
Confirm that IPsec Internet Key Exchange (IKE) uses UDP port 500 for phase negotiations, while L2TP uses UDP port 1701 for tunnel maintenance and control.
Firewall configuration rules for remote access VPNs require precise identification of both protocol control ports.
3
Evaluate and eliminate distractors related to encryption layers and RADIUS client-server architecture.
Disprove native L2TP encryption (Layer 2) and direct client-to-RADIUS TCP communication, recognizing RADIUS uses UDP (ports 1812/1813) and operates between the VPN gateway and RADIUS server.
Prevents common misconceptions regarding AAA query transport and VPN client authentication flows.

Key Concept

L2TP/IPsec Architecture, OSI Encapsulation, and Port Requirements
Estimated Time:1m 30s
Question 1128Question →

A network engineer installs dual redundant power distribution units (PDUs) and configures a dynamic link aggregation group (LAG) across two physically separate switch stacks for an enterprise storage cluster. Which core pillar of the CIA triad does this redundant architecture primarily support?

Show answer & explanation

Answer: Availability

Answer

Availability is the pillar of the CIA triad being directly supported, as redundant PDUs and link aggregation maintain access and eliminate single points of failure.
The core purpose of deploying redundant power sources (dual PDUs) and resilient multi-switch link aggregation (LAG) is fault tolerance. These controls eliminate single points of failure to guarantee that network services and storage remain continuously accessible to authorized users, which directly fulfills the Availability pillar of the CIA triad.

Step-by-Step Solution

1
Analyze the technical controls described in the scenario.
Dual PDUs provide power redundancy, while dynamic link aggregation across switch stacks provides network connection redundancy.
Identifying the purpose of hardware and connection redundancy is necessary to map controls to security principles.
2
Map the technical controls to the core security pillars.
Preventing single points of failure ensures uninterrupted uptime and fault tolerance for legitimate access.
Protecting against unexpected service failure or system downtime directly fulfills the objective of Availability.

Key Concept

CIA Triad - Availability Controls
Question 1129Question →

A network technician is investigating reports of intermittent dropouts and low data rates for mobile workstations in a newly renovated wing of a medical facility. The access point status indicates normal operational health, but a site measurement near the reinforced concrete walls shows a received signal strength indicator (RSSI) of -84 dBm compared to -52 dBm in the central hallway. Which of the following is the most likely cause of the degraded wireless performance?

Show answer & explanation

Answer: Signal attenuation caused by physical absorption from building construction materials

Answer

Signal attenuation caused by physical absorption from building construction materials is the primary cause of the low RSSI readings.
The correct answer correctly identifies physical attenuation. High-density materials like reinforced concrete absorb wireless radio frequency signals, drastically reducing received signal strength (RSSI) for devices operating behind or near those barriers.

Step-by-Step Solution

1
Analyze the reported symptom and site survey metrics
Identified a severe drop in RSSI from -52 dBm (acceptable/good signal) to -84 dBm (poor/unusable signal) specifically near reinforced concrete walls.
RSSI measures signal power at the receiver; a major drop across a physical boundary points to environmental interference.
2
Evaluate RF propagation characteristics against physical barriers
Dense obstacles such as concrete, brick, and rebar cause high signal attenuation (absorption of radio frequency energy).
Physical obstacles weaken RF wave amplitude as they pass through, dropping RSSI significantly.
3
Differentiate from logical or channel configuration issues
Eliminated DHCP, duplex mismatch, and channel overlap as causes because none of these directly decrease measured RF power level (RSSI).
Only physical distance, transmission power, or physical obstacles cause RSSI reductions.

Key Concept

Wireless Signal Attenuation and Environmental Obstacles
Question 1130Question →

A network security administrator is updating physical and environmental defense measures for a new enterprise data facility. Match each physical security or environmental risk on the left with its corresponding primary control measure on the right.

Click a left item, then click its matching right item

Items

Risk of electrostatic discharge (ESD) damaging sensitive networking hardware in equipment rooms
Risk of electromagnetic interference (EMI) and radio frequency (RF) eavesdropping on core servers
Risk of unmonitored liquid accumulation beneath raised flooring caused by HVAC condensation
Risk of unauthorized individuals tailgating behind employees into the primary server hall

Matches

Show answer & explanation

Answer

ESD risk matches anti-static flooring with 40%-60% relative humidity control; RF/EMI eavesdropping risk matches a grounded Faraday cage; subfloor HVAC liquid accumulation risk matches conductive rope leak detection sensors; and unauthorized tailgating risk matches a dual-door mantrap with weight sensors.
Each risk aligns directly with established Network+ physical security and environmental standards: ESD risk is mitigated via anti-static flooring combined with humidity controls (40%-60%); RF eavesdropping and EMI are contained using Faraday cages; subfloor water leaks are monitored via conductive rope sensors; and tailgating is prevented using interlocking mantraps.

Step-by-Step Solution

1
Analyze the electrostatic discharge (ESD) risk in low-humidity environments.
Air that is too dry increases static accumulation. Maintaining relative humidity between 40% and 60% along with anti-static grounding safe-guards equipment.
Relative humidity below 40% promotes ESD buildup, while humidity above 60% leads to condensation risk.
2
Analyze the electromagnetic interference (EMI) and signal interception risk.
Containing or blocking RF emissions requires conductive metallic shielding.
A grounded Faraday cage reflects and absorbs external and internal RF/EMI signals.
3
Analyze subfloor liquid accumulation risks from air handling units.
Water pooling under raised floors requires continuous line-based detection across cable pathways.
Subfloor conductive rope sensors detect moisture anywhere along their run, unlike point sensors which only detect localized pools.
4
Analyze physical unauthorized entry via tailgating/piggybacking.
Tailgating bypasses single card-swipe access points.
Mantraps use interlocking doors and weight/occupancy verification to ensure only one authenticated individual passes through at a time.

Key Concept

Physical Security Controls and Environmental Measures
Question 1131Question →

A network administrator is setting up a site-to-site IPsec VPN connection between a branch office router and the headquarters firewall. The branch office router is situated behind an ISP border device that performs Network Address Translation (NAT). During testing, the administrator notes that IPsec Encapsulating Security Payload (ESP) packets are dropped when traversing the NAT gateway because address translation alters packet headers and breaks cryptographic integrity checks. Which feature should be configured to encapsulate the IPsec traffic and allow successful traversal across the NAT device?

Show answer & explanation

Answer: NAT Traversal (NAT-T) using UDP port 4500

Answer

NAT Traversal (NAT-T) using UDP port 4500
NAT Traversal (NAT-T) encapsulates IPsec ESP packets inside UDP datagrams using destination port UDP 4500. This allows routers performing Network Address Translation (NAT) to rewrite outer header IP addresses and ports without altering or corrupting the inner encrypted IPsec ESP packet, successfully preserving payload integrity checks.

Step-by-Step Solution

1
Analyze why standard IPsec ESP fails across Network Address Translation (NAT) devices.
NAT alters source/destination IP addresses and port numbers in packet headers, which invalidates IPsec cryptographic checksums.
IPsec security mechanisms are designed to detect any modification of packet headers in transit as tampering.
2
Identify the standard protocol enhancement designed to resolve IPsec NAT incompatibilities.
NAT Traversal (NAT-T) detects NAT gateways during IKE negotiations and wraps ESP packets within UDP headers.
Encapsulating ESP in UDP port 4500 allows intermediate NAT devices to modify the outer UDP/IP headers while preserving the inner encrypted IPsec payload intact.

Key Concept

IPsec NAT Traversal (NAT-T) and UDP Port Encapsulation
Question 1132Question →

Users in an enterprise office report severe latency and high packet loss when connected to the 2.4 GHz Wi-Fi network near a central atrium. A spectral scan reveals several neighboring access points operating on channels 3, 4, and 5 with 40 MHz channel widths. Which TWO of the following actions should the network administrator take to resolve the wireless signal degradation? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Reassign the 2.4 GHz access points to non-overlapping channels (1, 6, or 11).; Reduce the 2.4 GHz channel width from 40 MHz down to 20 MHz.

Answer

The network administrator should reassign the 2.4 GHz access points to non-overlapping channels (1, 6, or 11) and reduce the channel width from 40 MHz to 20 MHz.
In the 2.4 GHz band, standard 20 MHz channels only allow three non-overlapping channels: 1, 6, and 11. Deploying access points on channels 3, 4, or 5 causes severe adjacent-channel interference, which degrades signal quality and causes packet loss. Additionally, using a 40 MHz channel width in the crowded 2.4 GHz spectrum bonds two 20 MHz channels together, leaving almost no room for non-overlapping operation. Therefore, switching to non-overlapping channels (1, 6, or 11) and reducing the channel width to 20 MHz resolves the RF contention.

Step-by-Step Solution

1
Analyze the spectral scan findings
Identified adjacent-channel interference caused by access points operating on channels 3, 4, and 5, exacerbated by wide 40 MHz channel configurations in the 2.4 GHz band.
The 2.4 GHz Wi-Fi spectrum only has 20 MHz of channel spacing between non-overlapping channels 1, 6, and 11.
2
Select non-overlapping channels
Configuring access points to use only channels 1, 6, or 11 eliminates adjacent-channel interference.
Channels 1, 6, and 11 do not share overlapping frequency spectrum with one another in standard 20 MHz channel allocations.
3
Adjust channel width configuration
Reducing channel width from 40 MHz to 20 MHz restricts the overall spectral footprint.
Using 40 MHz channels in the 2.4 GHz band consumes nearly the entire available spectrum, leading to severe co-channel and adjacent-channel interference.

Key Concept

2.4 GHz Wi-Fi Channel Planning and Channel Width Optimization
Question 1133Question →

A network security engineer is creating an extended IPv4 Access Control List (ACL) on a perimeter router to regulate inbound traffic from an untrusted partner network (198.51.100.0/24198.51.100.0/24) destined for an internal server subnet (172.16.10.0/24172.16.10.0/24). The security policy specifies the following administrative priorities:
1. All SSH policy enforcement (specific host access and subnet-wide restrictions) must be evaluated first.
2. Application database traffic must be permitted for the designated database host only.
3. All other unapproved traffic from the partner network to the internal subnet must be explicitly dropped at the end of the ACL.

Arrange the following ACL statements in the correct top-to-bottom sequence (from Line 10 to Line 40) to enforce this policy without rule shadowing or logic errors.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct top-to-bottom ACL processing order is: 1) Permit SSH to host 172.16.10.15, 2) Deny SSH to subnet 172.16.10.0/24, 3) Permit MySQL (TCP 3306) to host 172.16.10.50, 4) Deny all IP traffic from 198.51.100.0/24 to 172.16.10.0/24.
Router Access Control Lists process entries sequentially from top to bottom and stop evaluating upon the first match. To allow SSH to host 172.16.10.15 while blocking SSH to the rest of the 172.16.10.0/24 subnet, the host permit rule must appear first. Following SSH policy requirements, the MySQL permit rule for host 172.16.10.50 must precede the final explicit subnet IP deny rule to ensure legitimate database traffic is not blocked.

Step-by-Step Solution

1
Identify specific exception rules required prior to general block rules.
The host-specific SSH permit statement (`permit tcp ... host 172.16.10.15 eq 22`) must be placed before any subnet-wide SSH deny statement.
ACLs perform top-to-bottom sequential matching. Placing a broader deny rule above a specific permit rule creates 'rule shadowing,' rendering the permit rule unreachable.
2
Group and sequence the remaining protocol control rules according to policy priorities.
Place the subnet-wide SSH deny statement (`deny tcp ... 172.16.10.0 0.0.0.255 eq 22`) immediately following the specific host SSH permit rule.
This satisfies the requirement to evaluate all SSH access controls prior to evaluating database application rules.
3
Insert specific application service permits.
Place the MySQL permit rule (`permit tcp ... host 172.16.10.50 eq 3306`) after the SSH controls but before any general IP block rules.
Database traffic to the database server must be matched and allowed before hitting any blanket denial statement.
4
Position the broad subnet containment rule.
Place the explicit subnet-to-subnet IP deny statement (`deny ip 198.51.100.0 0.0.0.255 172.16.10.0 0.0.0.255`) at the end of the ACL entry sequence.
This ensures that any traffic not explicitly permitted by preceding lines is blocked before reaching implicit default behaviors.

Key Concept

ACL Sequential Evaluation and Shadowing Prevention
Question 1134Question →

A network engineer is preparing a formal Request for Change (RFC) for an upcoming core router configuration update during a scheduled maintenance window. The Change Advisory Board (CAB) mandates that all high-impact RFCs include provisions to minimize operational downtime in case the update causes unforeseen service disruption. Which of the following components MUST be explicitly defined within the RFC to fulfill this mandatory requirement?

Show answer & explanation

Answer: A detailed rollback plan that includes specific back-out procedures and quantitative trigger thresholds.

Answer

A detailed rollback plan that includes specific back-out procedures and quantitative trigger thresholds.
A comprehensive rollback plan specifies the step-by-step procedures, timing constraints, and clear trigger conditions required to safely restore the network to its pre-change state if the modification introduces unexpected issues.

Step-by-Step Solution

1
Identify the core requirement of the Change Advisory Board (CAB) scenario.
The CAB requires a mechanism to mitigate risk and quickly restore service if the proposed change fails.
Standard change management protocol dictates that risk mitigation must be established prior to executing changes.
2
Evaluate the role of a rollback plan within an RFC.
A rollback plan specifies explicit steps, time limits, and trigger conditions to revert changes safety.
Having predefined rollback triggers prevents prolonged outages caused by troubleshooting failed changes live during a tight maintenance window.

Key Concept

Rollback Planning and Risk Mitigation in Change Management
Question 1135Question →

A network administrator is troubleshooting severe signal degradation and frequent disconnections reported by users working near large metal shelving units in a warehouse environment. A site survey reveals high signal attenuation and co-channel interference on the 2.4 GHz band. Which TWO of the following troubleshooting steps should the administrator perform to resolve these wireless connectivity issues?

Select all that apply

Show answer & explanation

Answer: Migrate the access points in the affected area to non-overlapping channels (such as channels 1, 6, or 11).; Relocate access points or install directional antennas to direct signal coverage down the aisles and clear of metal obstructions.

Answer

The administrator should migrate access points to non-overlapping channels (1, 6, or 11) and relocate access points or install directional antennas to bypass metal obstructions.
Migrating access points to non-overlapping channels (1, 6, and 11 on the 2.4 GHz spectrum) eliminates channel overlap and adjacent-channel interference. Relocating access points or deploying directional antennas bypasses physical attenuation and signal reflection caused by heavy metal structures in the warehouse.

Step-by-Step Solution

1
Identify the physical and frequency causes of the wireless connection drops in the warehouse.
Recognized that metal shelving causes physical signal attenuation/reflection, while improper channel assignment leads to channel overlap interference.
Troubleshooting requires addressing both physical RF absorption and channel frequency assignment.
2
Select solutions targeting radio frequency channel selection and physical signal propagation.
Migrating to channels 1, 6, or 11 resolves co-channel interference, and deploying directional antennas or moving APs clears physical line-of-sight obstructions.
These steps directly remediate the Layer 1 wireless issues identified in the scenario.

Key Concept

Troubleshooting Wireless Signal Attenuation, Obstructions, and Channel Overlap
Estimated Time:1m 0s
Question 1136Question →

A network technician receives a service desk ticket regarding a user who has lost network connectivity. The technician gathers information from the user and formulates a probable cause that a loose Ethernet cable at the wall jack is causing the outage. According to the official CompTIA troubleshooting methodology, which step should the technician perform NEXT?

Show answer & explanation

Answer: Test the theory to determine the actual cause.

Answer

Testing the theory to determine the actual cause is the next step required by the CompTIA troubleshooting methodology.
According to the standard CompTIA troubleshooting framework, after establishing a theory of probable cause, the technician must test the theory to confirm the cause (Step 3) before creating or implementing a plan of action.

Step-by-Step Solution

1
Identify the current phase of the troubleshooting process.
The technician has already identified the problem and established a theory of probable cause.
Recognizing the current progress in the official methodology dictates what action comes next.
2
Determine the immediate next step in the CompTIA 6-step framework.
Step 2 (Establish a theory of probable cause) is immediately followed by Step 3 (Test the theory to determine the cause).
A technician must confirm whether a hypothesized cause is correct before attempting resolution.

Key Concept

CompTIA Troubleshooting Methodology Step Sequence
Question 1137Question →

Following a maintenance check on a central data hall's environmental control system, telemetry logs indicate that the relative humidity (RHRH) inside the facility has dropped to 18%18\%, while the ambient air temperature remains stable at 20∘C20^\circ\text{C} (68∘F68^\circ\text{F}). Which of the following operational risks is most significantly increased by allowing this low humidity level to persist?

Show answer & explanation

Answer: Increased probability of electrostatic discharge (ESD) accumulation and damage to active network electronics

Answer

Increased probability of electrostatic discharge (ESD) accumulation and damage to active network electronics
In server rooms and network infrastructure spaces, standard environmental guidelines recommend maintaining relative humidity between 40%40\% and 55%55\%. When relative humidity drops below 40%40\% (such as the reported 18%18\%), static electrical charges accumulate readily on equipment chassis, cables, and personnel. Any subsequent discharge can destroy delicate microcontrollers and transceiver modules via electrostatic discharge (ESD).

Step-by-Step Solution

1
Analyze the reported environmental conditions
Relative humidity (RH=18%RH = 18\%) is significantly below standard data center thresholds (40%–55%40\%\text{--}55\%), while temperature (20∘C20^\circ\text{C}) is normal.
Identifying environmental deviations helps correlate physical parameters to operational risks.
2
Evaluate physical risks associated with low humidity
Dry air lacks sufficient water vapor to dissipate surface static charges, leading to high static charge buildup on technicians, chassis, and cabling.
Static accumulation released near integrated circuits causes permanent ESD damage.
3
Select the correct physical security/environmental defense control impact
Maintaining relative humidity within 40%–55%40\%\text{--}55\% prevents ESD buildup while avoiding high-humidity condensation risks.
Proper environmental controls balance humidity to prevent both ESD (low RH) and corrosion/shorting (high RH).

Key Concept

Data Center Environmental Controls: Relative Humidity and ESD Mitigation
Question 1138Question →

A network administrator notices that local endpoint traffic intended for the default gateway is being redirected to an unauthorized workstation. Packet captures reveal that the unauthorized workstation is repeatedly sending unsolicited gratuitous ARP replies associating the default gateway's IP address with its own MAC address. Which of the following attack types is occurring?

Show answer & explanation

Answer: ARP poisoning

Answer

ARP poisoning
ARP poisoning involves broadcasting forged ARP response messages on a local network to link an attacker's MAC address with a legitimate IP address (such as the default gateway). This redirects local subnet traffic through the attacker's computer.

Step-by-Step Solution

1
Analyze the reported network anomaly and protocol traffic
The packet capture identifies unsolicited gratuitous ARP replies mapping a gateway IP to an unauthorized MAC address.
Address Resolution Protocol (ARP) maps Layer 3 IPv4 addresses to Layer 2 MAC hardware addresses on local Ethernet subnets.
2
Determine the attack vector based on the protocol behavior
Spoofing ARP replies to intercept local traffic is known as ARP poisoning (or ARP spoofing).
By corrupting the ARP tables of neighboring hosts, the attacker positions themselves on-path for intercepted network traffic.

Key Concept

Address Resolution Protocol (ARP) Poisoning
Question 1139Question →

Users in a newly renovated office space report severe latency and frequent packet loss while connected to the wireless network. A network technician measures the Received Signal Strength Indicator (RSSI) on an affected client device and records a strong signal reading of −55 dBm-55\text{ dBm}. However, the Signal-to-Noise Ratio (SNR) is measured at only 8 dB8\text{ dB}, leading to high retransmission rates. Which of the following is the most likely cause of this performance degradation?

Show answer & explanation

Answer: A high ambient noise floor caused by non-802.11 RF interference in the environment

Answer

A high ambient noise floor caused by non-802.11 RF interference in the environment
Signal-to-Noise Ratio (SNR) represents the difference between the received signal strength (RSSI) and the background noise floor. Given an RSSI of −55 dBm-55\text{ dBm} and an SNR of only 8 dB8\text{ dB}, the noise floor is calculated to be −63 dBm-63\text{ dBm}, which is significantly higher than the acceptable baseline of −90 dBm-90\text{ dBm}. This high noise floor is caused by ambient non-802.11 RF interference, causing corruption of transmitted frames and elevated retransmission rates despite strong transmitter signal power.

Step-by-Step Solution

1
Analyze the reported physical layer Wi-Fi metrics
The measured RSSI is −55 dBm-55\text{ dBm} (indicating strong signal power) and the SNR is 8 dB8\text{ dB} (indicating poor signal quality).
Signal-to-Noise Ratio is defined as SNR=RSSI−Noise Floor\text{SNR} = \text{RSSI} - \text{Noise Floor}.
2
Calculate the environmental noise floor level
Noise Floor=−55 dBm−8 dB=−63 dBm\text{Noise Floor} = -55\text{ dBm} - 8\text{ dB} = -63\text{ dBm}.
Enterprise Wi-Fi networks typically require an SNR of 20 dB20\text{ dB} or higher and operate with a healthy noise floor between −90 dBm-90\text{ dBm} and −95 dBm-95\text{ dBm}.
3
Determine the root cause of the elevated noise floor
An elevated noise floor at −63 dBm-63\text{ dBm} points directly to high ambient RF noise created by non-802.11 interference sources.
External RF noise raises the overall background noise floor, shrinking the SNR gap even when the access point radiates a strong signal.

Key Concept

Signal-to-Noise Ratio (SNR) and Noise Floor Troubleshooting
Question 1140Question →

A network engineer is configuring an IPsec site-to-site VPN connection across the Internet between a corporate headquarters router with a static public IP address and a branch office router situated behind a carrier-grade Network Address Translation (CGNAT) gateway. During initial deployment testing, IKEv2 Phase 1 negotiation completes successfully, but IPsec Phase 2 fails to pass encrypted data traffic across the tunnel, resulting in integrity check failure drops on the receiving router. Troubleshooting reveals that the security policy was configured using Authentication Header (AH) in transport mode. Which modification to the VPN configuration will resolve the transmission failure while ensuring payload encryption and data integrity across the NAT boundary?

Show answer & explanation

Answer: Switch the security protocol from Authentication Header (AH) to Encapsulating Security Payload (ESP) and enable NAT Traversal (NAT-T) using UDP port 4500.

Answer

The VPN configuration must be updated to use Encapsulating Security Payload (ESP) instead of Authentication Header (AH), alongside enabling NAT Traversal (NAT-T) on UDP port 4500.
The correct response recommends replacing Authentication Header (AH) with Encapsulating Security Payload (ESP) and using NAT Traversal (NAT-T) on UDP port 4500. AH validates the integrity of the outer IP header fields; because NAT modifies IP address headers in transit, AH integrity verification always fails across a NAT boundary. ESP encrypts the payload and does not include the outer IP header in its checksum. When NAT-T is enabled, ESP packets are encapsulated inside UDP port 4500 datagrams, allowing NAT devices to multiplex and translate the connection via standard Port Address Translation (PAT).

Step-by-Step Solution

1
Analyze why Authentication Header (AH) fails when passing through a Network Address Translation (NAT) device.
AH computes an Integrity Check Value (ICV) over the IP header fields (including source/destination IP addresses). When NAT modifies these address fields in transit, the receiving endpoint recalculates a mismatched ICV, causing packet drops.
AH does not support NAT traversal because it protects the IP header against modification.
2
Evaluate protocol options for confidentiality and NAT compatibility.
Encapsulating Security Payload (ESP) provides confidentiality (encryption) and integrity for the payload without including the outer IP header in its ICV calculation.
ESP allows NAT modifications to outer IP headers without invalidating the cryptographic checksum of the encrypted inner payload.
3
Determine the required mechanism for passing raw IPsec ESP packets through NAT routers.
Enable NAT Traversal (NAT-T), which detects NAT devices during IKE Phase 1 and encapsulates protocol 50 (ESP) packets inside standard UDP port 4500 datagrams.
NAT devices frequently drop raw ESP (IP protocol 50) packets due to lack of L4 port numbers required for PAT/NAT table tracking.

Key Concept

IPsec Protocols (AH vs ESP) and NAT Traversal (NAT-T)
PreviousPage 57 / 112Next
All practice questions — CompTIA Network+ | Examkin