Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 1141Question →

A network security administrator applies a new stateless extended IPv4 Access Control List (ACL) to interface GigabitEthernet0/0GigabitEthernet0/0 in the inbound direction on a perimeter router. The interface serves an internal management VLAN on subnet 192.168.4.0/24192.168.4.0/24. The objective of the configuration is to permit local network devices to send SNMP trap notifications to an off-site monitoring server at IP address 198.51.100.45198.51.100.45 listening on UDP port 162.

The technician configures a single rule entry:
`access-list 102 permit udp 192.168.4.0 0.0.0.255 host 198.51.100.45 eq 162`

Immediately after applying the ACL with `ip access-group 102 in`, users on the 192.168.4.0/24192.168.4.0/24 subnet report a complete loss of web access (TCP ports 80/443) and DNS name resolution (UDP port 53) to all external destinations.

Which of the following identifies the root cause of this network outage?

Show answer & explanation

Answer: The ACL lacks explicit permit statements for HTTP, HTTPS, and DNS traffic, causing all unlisted traffic to be blocked by the unwritten implicit deny rule at the end of the access list.

Answer

The network outage occurred because Access Control Lists end with an implicit deny statement that automatically drops any packet not explicitly permitted by an earlier rule.
The correct answer highlights that all network Access Control Lists feature an unwritten implicit deny rule at the end of the rule chain ('deny ip any any'). When an ACL contains only one permit entry (such as UDP port 162 for SNMP traps), all other protocols—including DNS (UDP port 53), HTTP (TCP port 80), and HTTPS (TCP port 443)—fail to match the single permit rule and are automatically dropped by the implicit deny.

Step-by-Step Solution

1
Analyze the configured ACL entry and interface placement.
The ACL entry permits only UDP traffic originating from subnet 192.168.4.0/24192.168.4.0/24 destined to 198.51.100.45198.51.100.45 on port 162.
Understanding the explicit scope of the rule isolates what traffic is matching the permit rule.
2
Evaluate the default behavior of IPv4 ACL rule processing.
All standard Cisco and industry-standard IPv4 ACLs append an invisible, default 'deny ip any any' rule at the bottom of the access list.
Any packet that does not match an explicit permit statement falls through to the implicit deny rule.
3
Determine the packet disposition for HTTP, HTTPS, and DNS traffic.
Traffic directed to TCP ports 80/443 and UDP port 53 fails to match the SNMP trap rule and is dropped by the implicit deny.
Without explicit permit statements for general web browsing and DNS resolution, those protocols are blocked completely.

Key Concept

ACL Implicit Deny Evaluation
Estimated Time:2m 0s
Question 1142Question →

A network engineer is analyzing physical layer and spectrum analysis logs to diagnose radio frequency (RF) propagation and interference anomalies across an enterprise campus. Match each RF phenomenon or interference condition to its corresponding diagnostic observation.

Click a left item, then click its matching right item

Items

Multipath Distortion
Adjacent-Channel Interference (ACI)
Co-Channel Interference (CCI)
RF Attenuation and Absorption

Matches

Show answer & explanation

Answer

Multipath Distortion matches with high retry rates near metal structures despite strong RSSI (-52 dBm); Adjacent-Channel Interference matches with non-demodulable frame corruption from overlapping channels 1 and 3; Co-Channel Interference matches with high channel utilization and CSMA/CA backoff delays on channel 6; RF Attenuation matches with predictable RSSI drops behind reinforced concrete walls.
Multipath distortion is characterized by high retry rates under strong RSSI due to out-of-phase reflections. Adjacent-channel interference results from partially overlapping channels (e.g., 1 and 3) creating raw RF noise. Co-channel interference occurs when devices on the same channel share airtime via CSMA/CA deferrals. Attenuation causes linear RSSI degradation due to physical dense obstacles.

Step-by-Step Solution

1
Analyze the physical mechanics of signal reflections causing phase cancellation.
Correlate delayed reflections off metal surfaces with high packet retries and strong RSSI to identify Multipath Distortion.
Metal reflects RF waves, generating multiple delayed paths (delay spread) that disrupt symbol demodulation without lowering raw received power.
2
Evaluate channel allocation boundaries in the 2.4 GHz band.
Match channels 1 and 3 overlap to Adjacent-Channel Interference.
Channels 1 and 3 share overlapping frequency spectrum; their sidebands collide without conforming to shared CSMA/CA preamble decoding.
3
Assess CSMA/CA airtime sharing on identical non-overlapping channels.
Connect high channel utilization and contention delays on channel 6 to Co-Channel Interference.
APs on the same channel hear each other's transmissions and defer transmission via CCA, causing airtime starvation rather than unreadable corruption.
4
Determine the impact of dense building materials on RF signal strength.
Pair RSSI reduction through concrete walls to RF Attenuation and Absorption.
Dense materials absorb RF energy, reducing the signal amplitude (dBm) systematically as the wave traverses the structure.

Key Concept

Differentiating physical RF signal impairments (attenuation, multipath reflection) from spectral channel access issues (co-channel interference vs. adjacent-channel interference).
Question 1143Question →

A network administrator is establishing a baseline hardening configuration on a newly deployed edge switch. Which of the following administrative practices should be implemented to secure the management plane of the device? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Disable the Telnet daemon and configure SSH for encrypted command-line management.; Replace legacy SNMPv1/v2c configurations with SNMPv3 utilizing cryptographic authentication and privacy (authPriv).

Answer

The administrator should disable Telnet in favor of SSH for encrypted CLI administration, and deploy SNMPv3 with authPriv instead of insecure legacy SNMP versions.
Disabling Telnet in favor of SSH secures CLI sessions by encrypting all traffic. Transitioning to SNMPv3 with authPriv ensures that network monitoring traffic is cryptographically authenticated and encrypted, preventing unauthorized device access and interception.

Step-by-Step Solution

1
Evaluate CLI management protocols.
Telnet uses cleartext traffic on port 23, while SSH uses encrypted sessions on port 22.
Hardening the management plane requires encrypting all interactive administrative access.
2
Evaluate monitoring protocols.
SNMPv1 and SNMPv2c transmit community strings in unencrypted text. SNMPv3 provides strong authentication and privacy (authPriv).
Cryptographic authentication and payload encryption are required for secure device monitoring.

Key Concept

Management Plane Hardening
Question 1144Question →

A network security team is updating its enterprise defense framework to align existing technical controls with core security principles. Match each core security principle on the left with its corresponding technical control implementation on the right.

Click a left item, then click its matching right item

Items

Confidentiality
Integrity
Availability
Non-repudiation

Matches

Show answer & explanation

Answer

Confidentiality matches with AES-256 disk encryption; Integrity matches with SHA-256 checksum verification; Availability matches with redundant load-balanced firewalls; Non-repudiation matches with PKI digital signatures on logs.
Each core principle directly aligns with its target control: Confidentiality is sustained by encrypting stored workstation data, Integrity is maintained by validating firmware hash signatures before installation, Availability is preserved through redundant multi-site infrastructure, and Non-repudiation is enforced by cryptographically signing administrative actions.

Step-by-Step Solution

1
Analyze the goal of Confidentiality
Confidentiality protects data against unauthorized disclosure.
Encrypting local storage drives using AES-256 ensures only authenticated key holders can read the contents.
2
Analyze the goal of Integrity
Integrity protects data against unauthorized alteration or corruption.
Hashing firmware images using SHA-256 allows network administrators to verify that binaries match official vendor hashes exactly.
3
Analyze the goal of Availability
Availability guarantees system uptime and access during failures or operational stress.
Geographically redundant firewall pairs prevent service interruptions caused by localized outages or hardware failures.
4
Analyze the goal of Non-repudiation
Non-repudiation ensures auditability such that an actor cannot deny performing a specific operation.
Public Key Infrastructure (PKI) digital signatures cryptographically bind an action log to the administrator's unique key pair.

Key Concept

CIA Triad & Core Security Principles (Confidentiality, Integrity, Availability, Non-repudiation)
Question 1145Question →

An enterprise network engineer is designing a physical connectivity architecture between two secure server rooms located on separate floors of a shared multi-tenant commercial facility. High-throughput fiber optic cabling must pass through unmonitored building maintenance risers accessible to third-party facility personnel. The security policy requires real-time automated alerts if physical tampering, unauthorized bending, or physical tapping of the conduit pathway occurs. Which physical security control should the engineer implement to meet this requirement?

Show answer & explanation

Answer: An Alarmed Protected Distribution System (PDS) utilizing continuous optical fiber monitoring along the conduit pathway

Answer

An Alarmed Protected Distribution System (PDS) utilizing continuous optical fiber monitoring along the conduit pathway
An Alarmed Protected Distribution System (PDS) is specifically designed to protect unencrypted optical and copper communication lines passing through un-monitored or shared spaces. It employs continuous optical fiber sensing or electronic carrier monitoring to detect physical stress, conduit vibration, or micro-bending caused by unauthorized tapping attempts, instantly sending real-time alerts to network operations.

Step-by-Step Solution

1
Analyze the physical security requirement
Identified the need for continuous, real-time automated detection of physical tampering or tapping along fiber runs passing through untrusted, shared building infrastructure.
The requirement specifically mandates immediate automated notification rather than delayed manual detection or perimeter access restriction.
2
Evaluate candidate physical security mechanisms against pathway constraints
Differentiated between access control (mantraps), passive physical encasement (Hardened PDS), manual testing utilities (continuity testers), and active sensor monitoring (Alarmed PDS).
Hardened PDS requires physical locks and visual inspections, while Alarmed PDS integrates optical/carrier monitoring to instantly alert administrators to physical disturbance or micro-bending.
3
Select the control that fulfills both real-time alerting and physical pathway protection
Determined that an Alarmed Protected Distribution System (PDS) is the standard physical security control specified for high-security physical link monitoring.
Alarmed PDS continuously measures light properties or acoustic changes inside conduit runs, satisfying all enterprise security policy mandates.

Key Concept

Protected Distribution System (PDS) and Physical Cable Pathway Security
Question 1146Question →

A network engineer is designing a high-availability network topology for a cluster of mission-critical application servers. The design requires active-active link aggregation, increased total bandwidth, and seamless link failover across two separate physical access switches without Spanning Tree Protocol (STP) placing any redundant interface into a blocking state. Which TWO of the following configurations or technologies must be implemented to fulfill these requirements?

Select all that apply

Show answer & explanation

Answer: Configure Multi-Chassis Link Aggregation (MC-LAG) or Virtual Port Channel technology across the two access switches.; Enable IEEE 802.3ad Link Aggregation Control Protocol (LACP) in active mode on the server NIC team.

Answer

To achieve active-active link aggregation and redundant switch connectivity without STP blocking links, Multi-Chassis Link Aggregation (MC-LAG) must be configured on the switches alongside IEEE 802.3ad LACP on the server NIC team.
Implementing Multi-Chassis Link Aggregation (MC-LAG) across the access switch pair allows them to function as a single logical switch toward the servers. Combining this with IEEE 802.3ad LACP on the server NIC team enables active-active link aggregation, increased total throughput, and transparent link failover without Spanning Tree Protocol blocking redundant paths.

Step-by-Step Solution

1
Analyze the requirement for active-active link bundling spanning two physical switches.
Identified that standard LACP requires member links to terminate on a single logical device entity.
Unstacked standalone switches cannot coordinate control plane frames for a single standard LACP trunk.
2
Identify the switch technology that presents two physical switches as one logical switch.
Selected Multi-Chassis Link Aggregation (MC-LAG).
MC-LAG synchronizes control states between peer switches so downstream servers perceive them as a single LACP peer.
3
Identify the standard host protocol for dynamic link bundling.
Selected IEEE 802.3ad Link Aggregation Control Protocol (LACP) in active mode.
LACP manages frame distribution and link status monitoring dynamically across all active interfaces in the group.

Key Concept

Multi-Chassis Link Aggregation (MC-LAG) and Dynamic LACP Integration
Question 1147Question →

A enterprise network administrator receives multiple urgent tickets reporting intermittent database connection timeouts immediately following an after-hours core switch firmware upgrade. Place the following troubleshooting steps in the exact chronological sequence mandated by the official CompTIA Network+ Troubleshooting Methodology, starting with the earliest step and ending with the final step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence follows the official 6-step CompTIA Troubleshooting Methodology: 1. Identify the problem (information gathering, symptoms, duplication), 2. Establish a theory of probable cause (question obvious, OSI model approach), 3. Test the theory to determine cause, 4. Establish a plan of action to resolve the problem and implement the solution, 5. Verify full system functionality and implement preventive measures, 6. Document findings, actions, and outcomes.
The CompTIA Troubleshooting Methodology defines a strict six-step linear order: Step 1 is identifying the problem (gathering information, interviewing users, checking logs, replicating symptoms); Step 2 is establishing a theory of probable cause; Step 3 is testing the theory to determine cause; Step 4 is establishing a plan of action and implementing the solution; Step 5 is verifying full system functionality and implementing preventive measures; Step 6 is documenting findings, actions, and outcomes.

Step-by-Step Solution

1
Identify the Problem
Information gathered from user interviews, switch logs, and symptom replication on a test client.
Before forming hypotheses or taking administrative action, the technician must clearly define the problem scope and reproduce symptoms.
2
Establish a Theory of Probable Cause
Formulate a hypothesis regarding trunk native VLAN reset during firmware update.
Technicians must evaluate possible causes using top-to-bottom or bottom-to-top OSI methods while questioning the obvious.
3
Test the Theory to Determine Cause
Packet capture confirms untagged frame drops caused by native VLAN mismatch.
The theory must be empirically tested before making infrastructure or configuration modifications.
4
Establish a Plan of Action and Implement Solution
Draft change request, evaluate risk, acquire approval, and apply configuration fix.
Changes must be planned to minimize secondary impacts before implementing the fix.
5
Verify Full System Functionality & Implement Preventive Measures
Execute query benchmarks across subnets and deploy compliance monitoring.
System-wide operation must be confirmed working post-fix, followed by proactive measures to avoid recurrence.
6
Document Findings, Actions, and Outcomes
Record event lifecycle details in ITSM platform and update knowledge repository.
Formal documentation ensures knowledge retention and provides reference data for future operational incidents.

Key Concept

CompTIA 6-Step Troubleshooting Methodology
Question 1148Question →

An IT technician working in a newly commissioned remote network facility reports experiencing frequent static electric shocks when touching metallic server racks. Subsequent monitoring reveals that the temperature is maintained at 20∘C20^{\circ}\text{C}, but relative humidity levels inside the room have dropped to 15%15\%. Which of the following environmental security controls should be adjusted to minimize electrostatic discharge (ESD) risks to sensitive network hardware?

Show answer & explanation

Answer: Increase the environmental relative humidity level to maintain a range between 40% and 55%.

Answer

Increase the environmental relative humidity level to maintain a range between 40% and 55%.
Increasing relative humidity to 40%-55% provides sufficient moisture in the air to continuously drain ambient static charges before high-voltage electrostatic discharges occur. This mitigates hardware damage risks while staying below thresholds that cause condensation.

Step-by-Step Solution

1
Analyze the reported physical environment issue
Low relative humidity (15%15\%) allows electrical charges to accumulate easily on metallic surfaces and personnel, creating a high risk of ESD damage.
Air with extremely low humidity lacks the conductive moisture film necessary to dissipate static charges harmlessly into the ground.
2
Evaluate humidity management standards for data centers
Industry standards recommend maintaining relative humidity between 40% and 55% (or keeping the dew point between 5.5∘C5.5^{\circ}\text{C} and 15∘C15^{\circ}\text{C}).
Maintaining humidity within this target window reduces static charge generation while preventing excess moisture condensation.
3
Select the appropriate environmental control
Increasing humidity via the HVAC humidifier remediates ESD risks directly.
This directly targets the root cause of static electricity accumulation without introducing environmental hazards.

Key Concept

Environmental Controls and Humidity Management for ESD Mitigation
Question 1149Question →

After conducting diagnostic tests on a malfunctioning core switch, a systems engineer confirms their theory that a corrupted firmware image is causing routing table drops. Following the CompTIA troubleshooting methodology, which of the following actions should the engineer take next? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Establish a plan of action to resolve the issue while identifying potential side effects.; Implement the resolution or escalate the issue as necessary to restore normal operation.

Answer

The engineer should establish a plan of action while considering potential effects, and implement the solution or escalate as necessary.
Once a theory of probable cause has been tested and confirmed, the CompTIA troubleshooting methodology dictates moving to Step 4: Establish a plan of action to resolve the problem and implement the solution. This step encompasses formulating a detailed plan while considering potential effects and carrying out the necessary implementation or escalation.

Step-by-Step Solution

1
Identify the completed step in the CompTIA troubleshooting sequence.
The engineer has established and successfully tested/confirmed the theory of probable cause (Step 3 complete).
Identifying the current progress pinpoints where the technician stands in the methodology.
2
Identify the immediate next step in the methodology.
Step 4 requires establishing a plan of action to resolve the problem and implementing the solution.
CompTIA process rules mandate that planning resolution steps, identifying potential effects, and implementing the fix must occur before verification or documentation.
3
Select the correct actions corresponding to Step 4.
Developing a plan of action with side-effect consideration and executing/escalating the implementation represent the valid actions for this step.
Actions such as system verification (Step 5) and documentation (Step 6) cannot be performed out of sequence.

Key Concept

CompTIA troubleshooting methodology process sequence
Question 1150Question →

A network security administrator is documenting legacy and modern wireless security protocols for a corporate compliance audit. Match each wireless security standard on the left with its corresponding encryption cipher and integrity mechanism on the right.

Click a left item, then click its matching right item

Items

WEP (Wired Equivalent Privacy)
WPA (Wi-Fi Protected Access)
WPA2 (Wi-Fi Protected Access 2)
WPA3-Personal

Matches

Show answer & explanation

Answer

WEP pairs with RC4, 24-bit IV, and CRC-32; WPA pairs with RC4, TKIP, and Michael MIC; WPA2 pairs with AES-CCMP; WPA3-Personal pairs with AES-GCMP-128 and SAE.
Wireless standards evolved systematically: WEP used simple RC4 with CRC-32; WPA upgraded legacy hardware with RC4 wrapped in TKIP; WPA2 introduced mandatory AES-CCMP; and WPA3-Personal implemented AES-GCMP-128 combined with SAE.

Step-by-Step Solution

1
Analyze WEP cryptographic construction
WEP uses RC4 with a 24-bit IV and CRC-32.
WEP is the oldest standard and relied on unencrypted 24-bit IV headers and non-cryptographic CRC-32 integrity checks.
2
Analyze WPA cryptographic construction
WPA uses RC4 with TKIP and Michael MIC.
WPA was designed to run on WEP legacy hardware by wrapping RC4 in TKIP key mixing and adding the Michael MIC algorithm.
3
Analyze WPA2 cryptographic construction
WPA2 uses AES with CCMP.
WPA2 introduced 802.11i compliance, requiring hardware-based AES encryption coupled with Counter Mode CBC-MAC Protocol (CCMP).
4
Analyze WPA3-Personal cryptographic construction
WPA3-Personal uses AES-GCMP-128 with SAE.
WPA3 upgrades baseline encryption to GCMP and mandates SAE key exchange to block offline dictionary attacks.

Key Concept

Wireless Security Standards and Encryption Protocols
Question 1151Question →

A network technician is responding to an outage and needs to follow the standard CompTIA troubleshooting process. Place the following primary steps of the CompTIA Network+ troubleshooting methodology in the correct chronological order from first step to final step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence of the CompTIA troubleshooting methodology is: 1. Identify the problem, 2. Establish a theory of probable cause, 3. Test the theory to determine the cause, 4. Establish a plan of action to resolve the problem and identify potential effects, 5. Verify full system functionality and implement preventive measures, and 6. Document findings, actions, and outcomes.
The CompTIA Network+ troubleshooting methodology follows a strict 6-step logical sequence: initial problem identification, forming a theory of cause, testing the theory, planning and implementing the fix, verifying overall system stability along with preventive steps, and ending with comprehensive documentation.

Step-by-Step Solution

1
Information Gathering & Symptom Identification
Identify the problem
Technicians must gather user input, duplicate the problem if possible, and establish the scope before forming hypotheses.
2
Hypothesis Formulation
Establish a theory of probable cause
After identifying symptoms, question the obvious and consider top-to-bottom/bottom-to-top OSI layer approaches.
3
Hypothesis Testing
Test the theory to determine the cause
Once a theory is formed, test it. If confirmed, proceed; if not, re-establish a new theory or escalate.
4
Action Planning
Establish a plan of action to resolve the problem and identify potential effects
Plan the repair steps, assess potential impacts on rest of network, and then implement the solution.
5
System Verification
Verify full system functionality and implement preventive measures
Confirm that the fix works without breaking other services and apply measures to prevent repeat issues.
6
Knowledge Base Update
Document findings, actions, and outcomes
The final step ensures proper administrative records, history tracking, and team knowledge sharing.

Key Concept

CompTIA 6-Step Troubleshooting Methodology Order
Question 1152Question →

A network security team investigates an incident where employees on a corporate LAN segment report intermittent connectivity drops and redirection to an untrusted portal. Network packet captures reveal two distinct anomalous activities: a rapid influx of DHCP DISCOVER frames generated using spoofed source MAC addresses to exhaust available IP pool leases, followed by unauthorized DHCP ACK messages directing hosts to use an attacker-controlled default gateway. Which TWO of the following attack types were executed during this incident?

Select all that apply

Show answer & explanation

Answer: DHCP Starvation attack; Rogue DHCP server attack establishing an on-path position

Answer

The correct attack types involved are the DHCP Starvation attack and the Rogue DHCP server attack establishing an on-path position.
The incident combines DHCP starvation and a rogue DHCP server attack. Flooding DHCP DISCOVER packets with spoofed MAC addresses depletes the legitimate server's available IP leases. Once legitimate leases are exhausted, the attacker's rogue DHCP server responds to client requests with unauthorized IP parameters, setting the attacker's machine as the default gateway to intercept client traffic.

Step-by-Step Solution

1
Analyze the first packet capture symptom involving spoofed source MAC addresses flooding DHCP DISCOVER frames.
Identify this mechanism as a DHCP Starvation attack, which depletes the legitimate DHCP pool.
Exhausting legitimate IP leases prevents valid clients from receiving IP configurations from the legitimate server.
2
Analyze the second packet capture symptom where unauthorized DHCP ACK responses supply an attacker-controlled default gateway IP.
Identify this mechanism as a Rogue DHCP server attack facilitating an on-path (Man-in-the-Middle) vector.
By answering DHCP requests after legitimate pool exhaustion, the rogue server assigns itself as the default gateway to intercept client traffic.

Key Concept

Identifying DHCP Starvation and Rogue DHCP On-Path Attack Vectors
Estimated Time:2m 0s
Question 1153Question →

A network engineering team needs to update the primary TACACS+ server IP addresses and authentication keys across all wireless LAN controllers in an enterprise network. To adhere to organizational governance and minimize service disruption, the team must follow the standard change management lifecycle.

Place the following change management steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order begins with drafting and submitting the RFC, followed by obtaining CAB approval, validating the change in a lab environment, executing the deployment during the maintenance window, and concluding with post-implementation verification and documentation updates.
The standard change management lifecycle follows a strict sequential flow: Request initiation (RFC submission), Stakeholder review and approval (CAB approval), Technical validation (sandbox testing and rollback verification), Maintenance execution (production deployment), and Finalization (post-implementation review and baseline documentation update).

Step-by-Step Solution

1
Initiate the formal change process by drafting and submitting the RFC.
Comprehensive documentation of proposed scope, risks, and rollback steps is created.
All structured changes require formal tracking and initial documentation before review.
2
Submit the RFC to the CAB for review.
Formal authorization and scheduling alignment are secured from key stakeholders.
CAB approval ensures business continuity and prevents uncoordinated network changes.
3
Conduct pre-deployment testing in a lab or staging environment.
Potential syntax errors and rollback failures are identified prior to production exposure.
Testing validates the implementation plan and ensures the rollback procedure is effective.
4
Implement the change on production devices during the designated maintenance window.
The configuration updates are applied to the active network infrastructure.
Performing execution inside approved windows minimizes operational impact to end users.
5
Verify service functionality, perform PIR, and update baseline configuration records.
The change workflow is formally closed and network documentation reflects current state.
Post-implementation review and baseline updates ensure configuration drift is avoided and institutional records remain accurate.

Key Concept

Standard ITIL/CompTIA Change Management Lifecycle Stages
Question 1154Question →

A network engineer is configuring stateless Access Control Lists (ACLs) on a Layer 3 switch to secure communication between an application tier subnet (172.16.10.0/24172.16.10.0/24) and a database tier subnet (10.20.30.0/2410.20.30.0/24). The application servers must establish connection requests to MySQL database instances listening on TCP port 33063306. Because the filtering device is a stateless ACL rather than a stateful firewall, bidirectional rules must be defined explicitly. Which TWO of the following ACL entries must be configured on the database interface to allow this traffic flow while maintaining state awareness manually?

Select all that apply

Show answer & explanation

Answer: An inbound rule permitting TCP traffic from source subnet 172.16.10.0/24172.16.10.0/24 on ephemeral ports to destination subnet 10.20.30.0/2410.20.30.0/24 on destination port 33063306.; An outbound rule permitting TCP traffic from source subnet 10.20.30.0/2410.20.30.0/24 on source port 33063306 to destination subnet 172.16.10.0/24172.16.10.0/24 on ephemeral ports.

Answer

The correct requirements are the inbound rule permitting TCP traffic from the application subnet to destination port 3306, and the outbound rule permitting TCP return traffic from source port 3306 to the application subnet.
Stateless ACLs process each packet in isolation against the access list rules. Because they do not maintain a dynamic connection state table, a complete bidirectional traffic flow requires both an inbound permit rule for the initial request (from application servers to destination port 3306) and an explicit outbound permit rule for the response traffic (from database source port 3306 back to client ephemeral ports).

Step-by-Step Solution

1
Identify transport layer requirements for the database service.
MySQL uses TCP on destination port 3306 for reliable client-server communication.
Choosing the correct protocol (TCP vs. UDP) is necessary when writing extended ACL rules.
2
Analyze the operational difference between stateful firewalls and stateless ACLs.
Stateless ACLs analyze individual packets independently and do not maintain a state table to dynamic permit return traffic.
Return traffic generated by the database server will be blocked by the ACL implicit deny rule unless an explicit outbound rule is defined.
3
Construct the required inbound and outbound ACL rule pair.
Inbound entry permits TCP traffic from application hosts (172.16.10.0/24172.16.10.0/24) to database hosts (10.20.30.0/2410.20.30.0/24) on port 33063306. Outbound entry permits TCP return traffic from database hosts (source port 33063306) back to application hosts.
Both rules are mandatory to complete the full two-way TCP handshake and session payload exchange on a stateless device.

Key Concept

Stateless ACL Directionality and Protocol Requirements
Question 1155Question →

A mobile workstation user moves across an office floor and suddenly loses access to network resources. Upon checking the client's network settings, a technician observes an IP address of 169.254.112.45169.254.112.45. What is the primary cause of this wireless connectivity issue?

Show answer & explanation

Answer: The wireless client failed to receive an IP address assignment from the DHCP server.

Answer

The wireless client failed to receive an IP address assignment from the DHCP server.
An IP address within the 169.254.0.0/16169.254.0.0/16 range indicates an Automatic Private IP Addressing (APIPA) assignment. This occurs when a wireless client cannot reach a DHCP server to obtain or renew a valid IP address lease upon connecting or roaming.

Step-by-Step Solution

1
Identify the IP address pattern shown on the client device.
The address 169.254.112.45169.254.112.45 falls within the 169.254.0.0/16169.254.0.0/16 APIPA address range.
APIPA addresses are automatically self-assigned by client operating systems when DHCP discovery fails.
2
Determine why APIPA was assigned during wireless roaming.
The client lost connectivity to the DHCP server or failed to renew its lease when transitioning between access points.
When DHCP requests time out, the client cannot communicate on the local network.

Key Concept

APIPA Address Assignment in Wireless Troubleshooting
Question 1156Question →

A network administrator is troubleshooting a user workstation that cannot connect to an internal website named `server1.corp.local`. The technician runs the `nslookup` command on the workstation and receives the following output:

C:\Users\User> nslookup server1.corp.local
Server: dc01.corp.local
Address: 10.0.0.10

*** dc01.corp.local can't find server1.corp.local: Non-existent domain

Which of the following is the most likely cause of this name resolution failure?

Show answer & explanation

Answer: The host name `server1.corp.local` does not have a corresponding A record configured on the DNS server.

Answer

The host name does not have a corresponding A record configured on the DNS server.
The output explicitly demonstrates that the client reached the DNS server at `10.0.0.10`, which answered with a 'Non-existent domain' (NXDOMAIN) status. This indicates that the DNS server is working correctly but lacks an A record mapping `server1.corp.local` to an IP address.

Step-by-Step Solution

1
Analyze the command-line utility output from nslookup.
The local workstation successfully contacted the primary DNS server `dc01.corp.local` at IP address `10.0.0.10`.
Establishing that the DNS server responded rules out basic network reachability issues and offline DNS server failures.
2
Interpret the specific error message provided by the DNS server.
The server returned `Non-existent domain` (NXDOMAIN).
This error means the DNS server checked its zone database for `server1.corp.local` but found no matching address record.
3
Determine the necessary administrative resolution.
Create a valid A (IPv4) host record for `server1.corp.local` on the DNS server.
Adding the missing resource record directly resolves the NXDOMAIN error and enables proper hostname lookup.

Key Concept

DNS Host Record (A Record) Verification and NXDOMAIN Error Diagnosis
Question 1157Question →

A network engineer is investigating complex wireless performance issues across an enterprise facility. Match each observed wireless diagnostic metric/symptom on the left with its most likely root cause or underlying phenomenon on the right.

Click a left item, then click its matching right item

Items

Client devices report an RSSI of −55 dBm-55\text{ dBm} and noise floor of −95 dBm-95\text{ dBm} (SNR =40 dB= 40\text{ dB}), yet experience severe throughput degradation and excessive frame retransmissions that spike specifically when heavy non-Wi-Fi industrial equipment operates nearby.
A stationary client experiences sudden signal drop-offs from −58 dBm-58\text{ dBm} to −82 dBm-82\text{ dBm} and high packet corruption whenever wall-mounted metallic blinds are adjusted, despite maintaining a clear direct line-of-sight to the access point.
Wireless laptops experience excessive authentication delays (>3 seconds>3\text{ seconds}) and dropped sessions specifically while moving between coverage cells managed by a centralized Wireless LAN Controller (WLC).
A handheld scanner connected on the 5 GHz5\text{ GHz} band exhibits a consistent −30 dBm-30\text{ dBm} signal loss when turned 90∘90^\circ perpendicular to a ceiling-mounted directional patch antenna.

Matches

Show answer & explanation

Answer

1 matches Narrowband non-802.11 RF interference elevating duty cycle without raising the measured Wi-Fi noise floor; 2 matches Multipath delay spread caused by dynamic environmental reflection vectors; 3 matches Missing 802.11r Fast BSS Transition configuration causing full 802.1X re-authentication during roaming; 4 matches Cross-polarization mismatch between transmitting and receiving antennas.
Each diagnostic observation directly corresponds to a specific physical layer or 802.11 MAC layer mechanism: non-802.11 interference consumes airtime without registering standard preamble noise; moving reflective metal induces dynamic multipath phase cancellation; roaming without 802.11r forces lengthy RADIUS renegotiations; and rotating a directional linear antenna relative to another creates severe cross-polarization loss.

Step-by-Step Solution

1
Analyze item 1 (High SNR with non-Wi-Fi industrial interference).
Recognize that non-802.11 equipment creates raw RF energy that interferes with channel availability and frame reception without necessarily registering on Wi-Fi preamble-based noise floor meters.
Explains why high SNR readings can coexist with severe retransmissions during non-Wi-Fi interference.
2
Analyze item 2 (Signal drop-offs due to metallic blind adjustments).
Identify that shifting reflective metal creates phase-shifted reflected signals that cause destructive interference (multipath fading).
Dynamic reflection vectors degrade signal quality via delay spread.
3
Analyze item 3 (Multi-second latency during roaming across WLC coverage cells).
Pinpoint the lack of 802.11r Fast BSS Transition (FT) requiring full 802.1X EAP exchange with the RADIUS server.
Full re-authentication during roaming introduces multi-second delays unless fast roaming standards are enabled.
4
Analyze item 4 (30 dBm30\text{ dBm} signal loss upon 90∘90^\circ rotation).
Connect physical antenna orientation to polarization alignment loss.
Perpendicular alignment between linearly polarized antennas causes dramatic cross-polarization attenuation (~2020 to 30 dB30\text{ dB}).

Key Concept

Advanced Wireless Troubleshooting Metrics and Physical/MAC Layer Phenomena
Question 1158Question →

Mobile laptop users in an office building report that as they walk from the hallway into an adjacent conference room, their devices maintain a weak Wi-Fi connection to the distant hallway access point (AP) rather than connecting to the closer AP inside the conference room. A site survey reveals that the hallway AP is transmitting at maximum power (20 dBm20\text{ dBm}), while client laptops transmit at standard power (13 dBm13\text{ dBm}). Which of the following actions will BEST resolve this sticky client issue and promote seamless roaming?

Show answer & explanation

Answer: Reduce the transmit power of the hallway access point to align with client device capabilities.

Answer

Reduce the transmit power of the hallway access point to align with client device capabilities.
When an access point operates at maximum transmit power, its signal reaches far beyond the range at which client devices can transmit back effectively. Client laptops perceive the high signal strength from the hallway AP and refuse to roam (known as the sticky client problem). Lowering the AP's transmit power balances the cell size with client capabilities, allowing clients to detect signal attenuation and roam cleanly to the nearer access point.

Step-by-Step Solution

1
Analyze the site survey transmit power metrics.
The hallway AP transmits at 20 dBm20\text{ dBm}, while clients transmit at 13 dBm13\text{ dBm}. This creates an asymmetric coverage cell where clients receive a strong signal from the hallway AP far beyond the range at which the AP can reliably hear the client.
Because the AP's signal remains strong from the client's perspective, the client device does not hit its roaming threshold to search for a closer AP.
2
Determine the corrective action to balance coverage cell boundaries.
Reducing the hallway AP's transmit power matches its cell boundary to typical client transmission limits.
Symmetrical cell boundaries allow client RSSI to drop naturally as devices move away, prompting the client to disassociate and roam to the conference room AP.

Key Concept

AP Transmit Power Mismatch and Sticky Client Troubleshooting
Question 1159Question →

Following an internal security audit of enterprise network infrastructure, a network engineer must remediate vulnerabilities on several Layer 3 switches. The audit report specifically highlighted risks associated with management plane traffic eavesdropping and VLAN hopping exploits on trunk links. Which of the following TWO device hardening measures should the engineer implement to directly address these findings? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure SNMPv3 using the authPriv security mode to enforce cryptographic authentication and message payload encryption.; Reassign the 802.1Q native VLAN on trunk links from the default VLAN 1 to an explicit, unused VLAN ID.

Answer

The correct hardening actions are enabling SNMPv3 with authPriv for encrypted telemetry and reassigning the native VLAN on 802.1Q trunk links to an unused VLAN ID.
Hardening network switches against eavesdropping and trunk link attacks requires securing both management protocols and Layer 2 interfaces. Configuring SNMPv3 with the authPriv setting ensures authentication and full payload encryption for management communications. Furthermore, reassigning the native VLAN from default VLAN 1 to an unused VLAN ID prevents attacker frames from jumping broadcast domains via 802.1Q double-tagging.

Step-by-Step Solution

1
Analyze management plane security requirements
Identify that SNMPv3 authPriv provides both authentication and payload privacy (encryption), unlike unencrypted SNMPv1/v2c.
Management plane protocols must prevent unauthorized access and credential/data interception.
2
Analyze trunk link vulnerability mitigations
Identify that changing the default native VLAN (VLAN 1) to a dedicated, unused VLAN ID prevents VLAN hopping exploits.
Crafted double-tagged 802.1Q frames rely on the native VLAN matching between switches to cross VLAN boundaries.
3
Evaluate distractor controls
Reject SNMPv2c, leaving unused ports in default VLAN 1, and Telnet on port 22 as insecure or incorrect implementations.
Insecure defaults and incorrect protocol choices introduce security vulnerabilities.

Key Concept

Management plane protocol encryption and Layer 2 trunk baseline security
Estimated Time:2m 0s
Question 1160Question →

A network administrator is troubleshooting name resolution issues on a Linux workstation. The administrator runs the command `dig @10.0.0.5 webserver.company.local` and receives the following output:

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 18402
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;webserver.company.local. IN A

Which of the following is the most accurate interpretation of this command output?

Show answer & explanation

Answer: The DNS server is reachable and active, but no IPv4 address (A) record exists for the requested hostname.

Answer

The DNS server processed the request successfully (NOERROR), but no IPv4 address (A) record is configured for the requested hostname (ANSWER: 0).
The command output header status `NOERROR` confirms successful communication with the DNS server at 10.0.0.5, while `ANSWER: 0` shows that no host address (A) record is present for `webserver.company.local`.

Step-by-Step Solution

1
Examine the status header of the output.
The header shows `status: NOERROR`, proving that communication with the DNS server succeeded and the query was processed without error.
Establishing whether the DNS server responded correctly is the first diagnostic step.
2
Analyze the ANSWER section count in the header.
The header indicates `ANSWER: 0`, meaning no resource records matching the query were returned.
Determining record presence isolates whether the issue is network reachability versus missing host configuration.
3
Synthesize the status code and answer count to determine the root cause.
The combination of NOERROR status and 0 answer records indicates the target host lacks an active A record on the DNS server.
Distinguishes between complete domain absence (NXDOMAIN), transport failures (timeouts), and missing specific records.

Key Concept

Interpreting DNS Query Status Codes and Answer Counts using CLI Tools
PreviousPage 58 / 112Next
All practice questions — CompTIA Network+ | Examkin