Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 1241Question →

A network engineer is diagnosing several distinct wireless performance and connectivity issues across a medical clinic. Match each observed diagnostic scenario on the left with its primary root cause on the right.

Click a left item, then click its matching right item

Items

A client device near a 2.4 GHz AP receives strong signal strength (−50 dBm-50 \text{ dBm}), but experiences an extremely low Signal-to-Noise Ratio (5 dB5 \text{ dB}) and severe packet retries near operating breakroom equipment.
Mobile tablet users experience brief dropouts and repeated re-authentication prompts when walking along a corridor between two access points operating on non-overlapping channels.
Clients connected to a 5 GHz wireless network on Channel 52 suddenly lose connectivity for up to one minute, after which the AP switches its broadcast to Channel 36.
A wireless laptop maintains a strong connection with high throughput in open hallway space, but experiences a drop of over 35 dBm35 \text{ dBm} immediately after moving into an adjacent lead-lined radiology room.

Matches

Show answer & explanation

Answer

1 matches non-802.11 RFI; 2 matches sub-optimal roaming/sticky client behavior; 3 matches DFS radar detection; 4 matches signal attenuation from building materials.
Each scenario maps to a fundamental RF behavior: non-Wi-Fi radiation increases the noise floor (RFI), client-driven AP switching delays cause roaming drops, regulatory radar compliance forces 5 GHz DFS channel shifts, and high-density lead shielding causes severe RF attenuation.

Step-by-Step Solution

1
Analyze Scenario 1 (High RSSI, low SNR near breakroom equipment)
Identified that non-802.11 devices like microwaves emit RF noise on 2.4 GHz, raising the noise floor and dropping SNR.
Low SNR with high RSSI points directly to environmental noise/RFI rather than distance or attenuation.
2
Analyze Scenario 2 (Dropouts during physical movement between APs)
Identified poor roaming transitions between AP cells.
When clients hang on to a weak AP (sticky client) or re-authenticate without fast roaming standards, voice/video connections drop.
3
Analyze Scenario 3 (Disconnect on 5 GHz Channel 52 followed by AP channel change)
Identified DFS radar detection behavior mandated for 5 GHz spectrum channels.
802.11 units sharing 5 GHz DFS channels must quiet radio transmissions and move to a non-DFS channel when radar is detected.
4
Analyze Scenario 4 (Severe signal drop behind lead-lined walls)
Identified physical absorption/attenuation of radio waves.
Dense materials such as lead, metal, or concrete absorb RF energy, dramatically reducing signal power.

Key Concept

Troubleshooting Wireless RF Issues: RFI, Roaming, DFS, and Attenuation
Question 1242Question →

An enterprise organization experiences a security incident where a system administrator denies executing a set of unauthorized configuration changes on a core network switch, claiming another user forged their session. The security team must implement a technical control that ensures administrative actions can be cryptographically traced to a specific individual who cannot later deny performing them. Which of the following security concepts best meets this operational requirement?

Show answer & explanation

Answer: Non-repudiation enforced through asymmetric digital signatures

Answer

Non-repudiation enforced through asymmetric digital signatures
Non-repudiation ensures that an individual cannot dispute the validity of their action or command. Asymmetric digital signatures provide non-repudiation because the signature can only be created using the sender's private key, guaranteeing both authenticity and accountability.

Step-by-Step Solution

1
Analyze the core security requirement in the scenario.
The requirement focuses on ensuring an administrator cannot deny performing specific logged actions, which is the core definition of non-repudiation.
Non-repudiation ensures that the origin or execution of a transaction/command cannot be refuted by the party responsible.
2
Identify the cryptographic mechanism supporting non-repudiation.
Asymmetric cryptography using private keys creates digital signatures tied uniquely to an individual.
Because only the specific individual possesses their private key, a valid digital signature proves identity and action beyond reasonable doubt.

Key Concept

CIA Triad & Core Security Concepts - Non-repudiation and Asymmetric Digital Signatures
Estimated Time:1m 15s
Question 1243Question →

Following an unannounced configuration drift incident, a network engineer submits a formal Request for Change (RFC) to deploy a standardized configuration baseline across all datacenter access switches. The RFC details the proposed technical modifications, maintenance window timing, and post-deployment verification procedures. However, the Change Advisory Board (CAB) defers authorization because the proposal fails to specify the exact performance thresholds (such as interface error spikes or packet loss rates) that would mandate immediately reversing the deployment. Which critical component of the RFC requires revision before approval can be granted?

Show answer & explanation

Answer: The rollback plan and its activation triggers

Answer

The rollback plan and its activation triggers
A comprehensive Request for Change (RFC) must include a explicit rollback (backout) plan that specifies both the technical steps to revert to the previous baseline and the measurable abort criteria (such as packet loss or interface error thresholds). Without clear rollback triggers, engineers cannot determine when a deployment has failed and must be aborted to protect production services.

Step-by-Step Solution

1
Identify the missing requirement in the CAB evaluation scenario.
The CAB noted the absence of defined thresholds for aborting and reversing the deployment if network issues occur during implementation.
CAB approval requires risk mitigation controls that specify when and how to revert modifications to protect operational continuity.
2
Map the missing requirement to standard RFC documentation components.
Definite threshold criteria for reversing a change belong directly within the rollback (or backout) plan section of an RFC.
A robust rollback plan must detail both the technical steps to restore the prior configuration baseline and the explicit trigger conditions that mandate rolling back.

Key Concept

Request for Change (RFC) Essential Elements and Rollback Triggers
Estimated Time:1m 30s
Question 1244Question →

A user on a Windows workstation reports that navigating to `portal.corp.local` in a web browser leads to a 'Connection Refused' error. A network technician runs `nslookup portal.corp.local` and receives a successful authoritative response pointing to `192.168.10.45`. However, running `ipconfig /displaydns` on the client workstation reveals the following output:

text
Record Name . . . . . : portal.corp.local
Record Type . . . . . : 1
Time To Live . . . . : 86400
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 127.0.0.1

Which of the following is the root cause of the name resolution failure?

Show answer & explanation

Answer: A static entry in the client workstation's local HOSTS file is mapping the domain to the loopback address.

Answer

A static entry in the client workstation's local HOSTS file is mapping the domain to the loopback address.
Operating systems check local resolution mechanisms (such as the HOSTS file) prior to sending DNS requests across the network. Entries in the HOSTS file are cached locally with a TTL of 86400 seconds. Because `nslookup` bypasses local system resolution to directly query DNS servers, it received the valid IP address (`192.168.10.45`), whereas application traffic from the web browser utilized the local cache entry pointing to `127.0.0.1`.

Step-by-Step Solution

1
Analyze the result of the nslookup query
The DNS server resolves `portal.corp.local` to `192.168.10.45`.
Confirms that the host record on the DNS server is configured correctly.
2
Analyze the output of `ipconfig /displaydns`
The client resolver cache contains an A record mapping `portal.corp.local` to `127.0.0.1` with a TTL of 86400.
Identifies the exact IP address the workstation operating system uses for host resolution.
3
Evaluate operating system resolution order and source of entry
Entries defined in the local `HOSTS` file take precedence over DNS server queries and populate the resolver cache with a static 24-hour TTL (86400 seconds).
Explains why web browser connections fail while direct nslookup queries return the true server address.

Key Concept

Local HOSTS file precedence over DNS server queries and DNS cache behavior
Question 1245Question →

A systems engineer is troubleshooting connectivity to a critical database server named `db1.internal.net`. Standard network utilities produce conflicting IP resolution results as shown below:

text
$ host db1.internal.net
db1.internal.net has address 192.168.1.50

$ dig @10.0.0.53 db1.internal.net +short
10.0.0.150

Which of the following is the most likely cause of this address discrepancy?

Show answer & explanation

Answer: A static entry in the local system HOSTS file is overriding standard DNS server resolution.

Answer

A static entry in the local system HOSTS file is overriding standard DNS server resolution.
In standard operating system TCP/IP stacks, local name resolution precedence checks local static files (such as `/etc/hosts` on Linux or `hosts` on Windows) before issuing queries to configured DNS servers. When standard lookup utilities yield a different result than an explicit, direct query to the authoritative DNS server, a static mapping in the local HOSTS file is overriding the network DNS response.

Step-by-Step Solution

1
Analyze the output of the default host command
The local system resolver returns IP address 192.168.1.50 when evaluating standard name requests.
The standard system resolver checks local cache and static configuration files before generating external network queries.
2
Analyze the output of the explicit dig command
Bypassing standard OS resolution and querying DNS server 10.0.0.53 directly returns IP address 10.0.0.150.
Explicit dig queries (@server) bypass OS resolution order and directly test the specified server's response.
3
Evaluate standard OS name resolution precedence order
Identify that local HOSTS file entries take precedence over DNS server queries.
Because the DNS server has the correct IP (10.0.0.150) but the system resolves to 192.168.1.50 locally, a local static mapping in `/etc/hosts` (or `C:\Windows\System32\drivers\etc\hosts`) is taking precedence.

Key Concept

Operating System Name Resolution Precedence (HOSTS file vs. DNS Server)
Question 1246Question →

A network administrator receives complaints about intermittent Wi-Fi connectivity and poor throughput inside a newly renovated executive conference room surrounded by modern energy-efficient glass panels. An RF site survey indicates that 5 GHz signal strength drops sharply from -61 dBm just outside the room to -86 dBm inside the room. Which of the following is the most likely cause of this wireless signal degradation?

Show answer & explanation

Answer: Signal attenuation caused by metallic Low-E coatings on the glass panels

Answer

Signal attenuation caused by metallic Low-E coatings on the glass panels
Modern energy-efficient glass coated with Low-E (low-emissivity) metallic films severely absorbs and reflects radio frequency signals, causing significant RF signal attenuation when signals attempt to pass through the glass partition.

Step-by-Step Solution

1
Analyze the observed wireless symptom and measurements
The signal strength degrades significantly (a 25 dBm drop) specifically when moving across the glass barrier into the room.
Physical obstacles and building materials directly impact radio frequency propagation and receive signal metrics.
2
Evaluate the effect of energy-efficient glass on RF signals
Low-emissivity (Low-E) glass is treated with thin metallic oxide layers, which reflect and absorb RF signals similarly to solid metal barriers.
Metallic elements act as effective RF shields, leading to substantial signal attenuation.
3
Differentiate RF physical signal loss from network layer or configuration issues
Duplex mismatches, non-overlapping channel assignments, and APIPA IP address failures do not lower the physical RF signal level measured in dBm.
Only physical barriers, distance, or antenna issues alter measured received signal power.

Key Concept

RF Attenuation and Physical Obstacles in Wireless Networks
Estimated Time:1m 30s
Question 1247Question →

An enterprise network engineer is investigating severe throughput degradation and excessive frame retransmissions on a newly installed 2.4 GHz wireless network servicing an open-plan office. A site survey reveals that three neighboring access points with overlapping coverage areas are configured as follows:

- Access Point North: Channel 1, 20 MHz channel width
- Access Point Center: Channel 3, 20 MHz channel width
- Access Point South: Channel 5, 20 MHz channel width

Which administrative action will most effectively eliminate the performance bottleneck caused by adjacent-channel interference?

Show answer & explanation

Answer: Reassign the access point channels to 1, 6, and 11 respectively.

Answer

Reassigning the access point operating channels to 1, 6, and 11 eliminates adjacent-channel interference by enforcing non-overlapping 20 MHz frequency spacing in the 2.4 GHz spectrum.
In 2.4 GHz Wi-Fi deployments, 20 MHz wide channels require 25 MHz of center-frequency separation to operate without overlapping. Channels 1, 6, and 11 are the standard non-overlapping channels. Reconfiguring adjacent access points from channels 1, 3, and 5 to channels 1, 6, and 11 removes adjacent-channel interference (ACI), preventing RF noise and high packet retransmission rates.

Step-by-Step Solution

1
Analyze the existing 2.4 GHz channel configuration.
Channels 1, 3, and 5 overlap directly with each other because standard 20 MHz 2.4 GHz channels require a 25 MHz separation (5 channel numbers apart) to avoid overlapping.
Channels 1, 3, and 5 cause partial spectrum overlap, leading to severe adjacent-channel interference (ACI) where radio receivers cannot effectively decode frames.
2
Identify standard non-overlapping channels for the 2.4 GHz Wi-Fi spectrum.
In the 2.4 GHz spectrum (802.11b/g/n), the three primary non-overlapping channels are 1, 6, and 11.
Using channels 1, 6, and 11 ensures complete frequency separation between neighboring access points.
3
Select the remediation action that enforces non-overlapping channel separation.
Reconfiguring the access points to channels 1, 6, and 11 eliminates ACI.
Eliminating ACI stops packet corruption at the physical layer, drastically reducing retransmission rates and restoring throughput.

Key Concept

2.4 GHz Non-Overlapping Channel Assignment & Adjacent-Channel Interference
Estimated Time:2m 0s
Question 1248Question →

A network engineer is conducting a security baseline hardening exercise on a branch office router. The audit reveals that administrative management sessions and remote telemetry are currently using unencrypted legacy protocols. The engineer must secure the management plane so that all administrative command access and monitoring data are protected against eavesdropping and unauthorized modification. Which TWO configuration actions should the network engineer implement to meet these hardening requirements?

Select all that apply

Show answer & explanation

Answer: Disable Telnet and HTTP access, and enable SSHv2 alongside HTTPS for encrypted administrative sessions.; Migrate network monitoring services from SNMPv1/v2c to SNMPv3 configured with the authPriv security level.

Answer

The correct hardening actions are to disable Telnet and HTTP in favor of SSHv2 and HTTPS, and to implement SNMPv3 with the authPriv security level for remote monitoring.
Hardening network device management planes requires encrypting all administrative and telemetry streams. Replacing cleartext Telnet and HTTP with SSHv2 and HTTPS protects command-line and web administration sessions. Furthermore, deploying SNMPv3 with authPriv ensures both authentication integrity and payload confidentiality for network monitoring traffic.

Step-by-Step Solution

1
Analyze management plane protocol requirements
Identify that plain-text administration (Telnet/HTTP) must be replaced with encrypted equivalents (SSHv2/HTTPS).
Plain-text protocols expose administrative credentials and session traffic to sniffing attacks.
2
Analyze remote telemetry and monitoring requirements
Select SNMPv3 using the authPriv security tier.
Unlike SNMPv1/v2c which transmit community strings in plain text without payload encryption, SNMPv3 authPriv enforces HMAC authentication and AES/DES encryption.
3
Evaluate distractor practices against device hardening baselines
Reject retaining default VLAN 1 assignments on unused interfaces or trunk native VLANs, as well as port 23 misconfigurations.
Unused ports should be shutdown and moved to a non-default blackhole VLAN, native VLAN 1 should be changed, and port 23 remains unencrypted Telnet.

Key Concept

Device Management Plane Hardening
Estimated Time:2m 0s
Question 1249Question →

A network administrator is troubleshooting name resolution issues on a Linux workstation. The system successfully resolves typical small domain requests, but queries expecting large responses fail.

The administrator executes the following diagnostic commands from the workstation:

text dig TXT large-record.enterprise.internal ;; Truncated, retrying in TCP mode. ;; communications error to 10.20.4.53#53: timed out dig +notcp TXT large-record.enterprise.internal ;; ;; WARNING: recursion requested but not available ;; GOT ANSWER: ;; flags: qr rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; WARNING: Messages truncated; TC bit is set.

Which of the following are the MOST likely causes of this name resolution failure? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An intermediate firewall or network Access Control List (ACL) is dropping traffic on TCP port 53.; The requested DNS response payload exceeds the maximum UDP packet buffer size, forcing a fallback to TCP.

Answer

The primary causes are that the DNS response payload exceeds the UDP packet buffer limit (setting the TC bit) and an intermediate firewall or network ACL is blocking the required fallback connection over TCP port 53.
DNS relies on UDP port 53 for standard lightweight lookups. When a DNS response (such as a large TXT record set) exceeds the maximum allowed UDP payload size, the server returns a response with the Truncated (TC) header flag set. This signals the client to retry the request over TCP port 53. In this scenario, the UDP query succeeds and receives the TC flag, but the subsequent TCP connection times out because a firewall or network access control list is blocking TCP port 53.

Step-by-Step Solution

1
Analyze the output of the first `dig` command.
The message `Truncated, retrying in TCP mode.` indicates that the DNS server responded over UDP with the TC (Truncated) bit set because the response size exceeded the UDP payload capacity.
Standard DNS uses UDP port 53 for queries under 512 bytes (or EDNS limit). Larger responses require retrying via TCP.
2
Analyze the error message following the TCP fallback attempt.
The error `communications error to 10.20.4.53#53: timed out` indicates a layer 4 transport or access failure when attempting to establish a TCP connection on port 53.
Since UDP communication reached the server successfully, the host IP and general routing are functional; however, TCP port 53 traffic is being filtered by a security boundary.
3
Synthesize the root causes.
The combination of payload size exceeding UDP thresholds and blocked TCP port 53 traffic prevents the client from receiving the complete DNS record payload.
Both DNS protocol behavior (truncation) and network layer access rules (blocked TCP 53) directly account for the observed diagnostic output.

Key Concept

DNS Protocol Transport Modes (UDP vs TCP Port 53) and Truncation (TC Bit) Behavior
Question 1250Question →

A network technician is troubleshooting severe packet loss and high Near-End Crosstalk (NEXT) error rates on a newly terminated Category 6 unshielded twisted-pair (UTP) cable run. A simple continuity wiremap tester indicates that all eight pins are correctly wired straight-through (pins 1 through 8 match on both ends). However, the link fails certification testing and suffers from extreme signal degradation under load. Which TWO of the following explain the likely cause of this issue or represent the correct troubleshooting steps? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The cable run contains split pairs, where pin continuity is maintained straight-through but wire pairs were matched incorrectly, breaking electromagnetic cancellation.; A cable certifier or Time-Domain Reflectometer (TDR) capable of RF frequency analysis must be used to pinpoint NEXT and impedance mismatches along the cable run.

Answer

The cable run suffers from split pairs (maintaining continuity while disrupting differential pair twisting), and a cable certifier/TDR analyzer must be deployed to locate and measure high-frequency Crosstalk (NEXT) and impedance anomalies.
Split pairs maintain pin-to-pin DC continuity on basic wiremap testers, but separate the intended twisted pairs across different circuits. This disrupts the differential cancellation of electromagnetic interference and causes severe Near-End Crosstalk (NEXT). Detecting split pairs and measuring NEXT requires a cable certifier or advanced Time-Domain Reflectometer (TDR).

Step-by-Step Solution

1
Analyze why a basic wiremap tester shows straight-through 1-to-1 pin alignment despite high Near-End Crosstalk (NEXT) errors.
Identify that split pairs fulfill DC continuity requirements on simple LED wiremap devices but split the twisted functional wire pairs, resulting in loss of noise cancellation.
Twisted pair cabling relies on balanced differential signaling over paired conductors to reject crosstalk.
2
Select the appropriate diagnostic tool for high-frequency signal and crosstalk analysis.
Choose a cable certifier or TDR with RF transmission testing capabilities.
Simple continuity testers and tone probes lack the electronics required to measure NEXT, return loss, or split pair phenomena.

Key Concept

Identifying split pairs and selecting advanced copper testing tools (cable certifiers/TDR) for crosstalk troubleshooting.
Question 1251Question →

A network operations team is preparing to modify BGP routing parameters across WAN edge routers to connect a secondary internet service provider. Before executing this scheduled modification, the lead network engineer must submit a formal Request for Change (RFC) to the Change Advisory Board (CAB). Which TWO of the following elements must be explicitly detailed within the RFC to ensure proper change management governance?

Select all that apply

Show answer & explanation

Answer: A step-by-step rollback procedure with defined trigger conditions for reverting the changes if unexpected performance degradation occurs; A comprehensive risk and impact analysis detailing potential downtime and affected business services

Answer

The correct elements that must be included in the Request for Change (RFC) are a step-by-step rollback procedure with defined trigger conditions, and a comprehensive risk and impact analysis detailing potential service disruptions.
A formal Request for Change (RFC) submitted to a Change Advisory Board (CAB) must contain a detailed risk and impact analysis to gauge potential service disruption, alongside a clear rollback plan with concrete triggers to safely undo changes if implementation fails during the maintenance window.

Step-by-Step Solution

1
Identify the core requirements of an enterprise Request for Change (RFC) document prior to CAB review.
Recognize that RFC documentation must justify the change, evaluate risk, specify the implementation steps, and detail emergency recovery procedures.
CAB approval relies on knowing the business impact, scheduling scope, and risk mitigation strategies.
2
Evaluate the necessity of a rollback plan with specific trigger criteria.
Confirm that a defined rollback plan allows engineers to abort and revert the change safely if issues arise during execution.
Without predefined trigger conditions, teams risk extending downtime beyond approved maintenance windows trying to troubleshoot ad-hoc errors.
3
Evaluate the risk assessment component.
Confirm that risk and impact analysis is required to determine maintenance window scheduling and business unit notifications.
Higher-risk changes targeting core WAN edge infrastructure require greater scrutiny and broader stakeholder awareness.

Key Concept

Request for Change (RFC) Components and Risk Management
Question 1252Question →

A technician is installing three wireless access points in a small office using the 2.4 GHz band. To prevent adjacent-channel interference between the access points, which combination of non-overlapping channels should the technician assign?

Show answer & explanation

Answer: Channels 1, 6, and 11

Answer

Channels 1, 6, and 11 should be assigned because they are the three standard non-overlapping channels in the 2.4 GHz spectrum.
Selecting channels 1, 6, and 11 ensures complete frequency separation among all three access points, eliminating adjacent-channel interference in the 2.4 GHz band.

Step-by-Step Solution

1
Identify the operating frequency band and channel width.
The network operates on the 2.4 GHz frequency band using 20 MHz wide channels.
2.4 GHz channel numbers are spaced 5 MHz apart, requiring 4 channel spacings (20 MHz) to prevent overlap.
2
Determine the non-overlapping channel set.
Channels 1, 6, and 11 have center frequencies of 2412 MHz, 2437 MHz, and 2462 MHz, keeping their spectra separate.
Assigning 1, 6, and 11 prevents adjacent-channel interference across three neighboring access points.

Key Concept

2.4 GHz Wireless Channel Planning and Non-Overlapping Channels
Question 1253Question →

A network administrator is deploying a WPA3-Enterprise wireless network for corporate headquarters to satisfy compliance mandates for individual user accountability and wireless management security. Which of the following components or protocol features are mandatory requirements when implementing WPA3-Enterprise? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An 802.1X RADIUS authentication server infrastructure for centralizing individual user credentials; Protected Management Frames (PMF) enabled to prevent spoofing and eavesdropping of management traffic

Answer

The mandatory components for WPA3-Enterprise are an 802.1X RADIUS authentication server infrastructure and Protected Management Frames (PMF).
WPA3-Enterprise requires 802.1X RADIUS authentication for individual user accountability and mandates Protected Management Frames (PMF / IEEE 802.1w) to protect wireless management frames against forgery.

Step-by-Step Solution

1
Determine the required authentication framework for enterprise wireless security
WPA3-Enterprise mandates 802.1X EAP authentication backed by a central RADIUS server rather than preshared keys.
802.1X provides individual user accountability and centralized identity management required by enterprise policies.
2
Identify the required management frame protection mechanisms under WPA3 standards
Protected Management Frames (PMF / IEEE 802.1w) must be enabled.
WPA3 strictly mandates PMF to protect control and management frames (such as deauthentication) against interception and forgery.

Key Concept

WPA3-Enterprise Architecture and Security Requirements
Question 1254Question →

An organization is renovating a central server room that houses high-density rack servers and critical core switches. The facility team needs to install a fire suppression system that immediately extinguishes electrical fires without leaving residue, causing short circuits, or damaging sensitive electronic components. Which of the following fire suppression systems best meets these physical environmental requirements?

Show answer & explanation

Answer: Clean-agent gaseous fire suppression system

Answer

Clean-agent gaseous fire suppression system
Clean-agent gaseous fire suppression systems utilize non-conductive gases (such as FM-200, Novec 1230, or Inergen) to extinguish fires by removing heat or oxygen without releasing water, chemical powders, or conductive residue. This protects live electronics and server infrastructure from water damage and short-circuit risks.

Step-by-Step Solution

1
Analyze the physical environmental requirements of the server room
Identified the need for a non-conductive, zero-residue fire suppression agent suitable for energized electrical and network equipment.
Water and chemical foam agents conduct electricity and cause permanent physical hardware corrosion and short circuits.
2
Evaluate fire suppression system types against electronic safety criteria
Clean-agent gas systems (FM-200, Novec 1230, or inert gases) smother or interrupt the chemical reaction of fires without water or residue.
Gaseous clean agents evaporate quickly, leave no chemical deposit, and do not conduct electricity.

Key Concept

Clean-Agent Fire Suppression for Data Centers and MDFs
Estimated Time:1m 0s
Question 1255Question →

Match each physical layer cabling issue or diagnostic scenario with the most appropriate testing tool or verification technique required to identify or locate the root cause.

Click a left item, then click its matching right item

Items

Pinpointing the exact physical distance to a micro-bend anomaly on a single-mode optical fiber run spanning 12 kilometers
Detecting a split pair condition on a newly terminated Cat 6A UTP cable run that successfully passes basic DC continuity wiremap tests
Measuring absolute optical insertion loss in dB across a newly spliced multimode optical fiber link
Tracing an unmapped twisted-pair copper cable drop from a workstation outlet to its corresponding patch panel port without disconnecting active equipment

Matches

Show answer & explanation

Answer

Distance localization on long single-mode fiber matches Optical Time-Domain Reflectometer (OTDR); detecting split pairs passing DC wiremap matches Cable Certifier performing NEXT analysis; measuring insertion loss across fiber matches Optical Power Meter with Optical Light Source; tracing unmapped copper drops matches Tone Generator and Inductive Probe.
Each cabling tool serves a distinct physical layer diagnostic role: OTDR pinpoints event distances along fiber optic strands via reflections; cable certifiers perform frequency sweep NEXT tests to reveal split pair noise anomalies; OPM/light source kits quantify cumulative insertion loss in dB; and tone generator/probe sets non-intrusively trace copper wire runs.

Step-by-Step Solution

1
Analyze the long-distance optical defect localization requirement.
Determine that time-domain analysis is required to map signal reflections over distance.
An Optical Time-Domain Reflectometer (OTDR) measures Rayleigh backscattering and Fresnel reflections to locate defects along a extended fiber run.
2
Analyze split pair fault characteristics on copper twisted-pair cabling.
Recognize that split pairs pass basic continuity tests but cause severe crosstalk.
Conductors are connected to matching pin numbers on both ends (passing DC wiremap), but are split across different physical pairs. A full cable certifier performing high-frequency NEXT testing is necessary to detect the resulting interference.
3
Determine insertion loss measurement requirements for fiber optics.
Pair a light source with an optical power meter.
Insertion loss calculations rely on comparing a known reference light level against received signal power measured by an Optical Power Meter (OPM).
4
Evaluate cable identification tools for unmapped panel ports.
Select a tone generator and inductive probe.
Toning injects an audible signal onto wire conductors, allowing an inductive probe to acoustically pinpoint cable bundles and patch panel terminations.

Key Concept

Physical Cabling Diagnostic Tools and Fault Characteristics
Question 1256Question →

A network technician executes the `nslookup server1.lab.local` command from a client workstation to verify hostname resolution. The command yields the following output:

Server: dns1.lab.local
Address: 10.0.0.2

*** dns1.lab.local can't find server1.lab.local: Non-existent domain

Which of the following issues is the most likely cause of this error message?

Show answer & explanation

Answer: The host record (A record) for server1.lab.local is missing from the DNS server database.

Answer

The host record (A record) for server1.lab.local is missing from the DNS server database.
The correct answer identifies that the DNS server responded with an NXDOMAIN (Non-existent domain) message, which confirms the DNS service is operational at 10.0.0.2 but lacks an active host (A) record for the requested hostname.

Step-by-Step Solution

1
Analyze the `nslookup` output lines.
The local workstation successfully contacted the DNS server named `dns1.lab.local` at IP address `10.0.0.2`.
Establishing that the server responded rules out network reachability or local service outage issues.
2
Interpret the specific error string `Non-existent domain` (NXDOMAIN).
Identified that the DNS server searched its records but found no mapping for `server1.lab.local`.
An NXDOMAIN response directly signifies that no corresponding resource record (such as an A or AAAA record) exists in the queried zone file.

Key Concept

Interpreting nslookup output and NXDOMAIN errors during name resolution troubleshooting
Question 1257Question →

A network engineer is troubleshooting name resolution issues on a client workstation attempting to resolve a large DNSSEC-signed resource record hosted on an internal DNS server (192.168.10.5). The engineer runs `dig` and receives the following output:

text
$ dig @192.168.10.5 api.internal.corp +dnssec
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41052
;; flags: qr aa tc rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0

;; Truncation occurred.
;; COMMUNICATIONS ERROR: cannot reach server over TCP (192.168.10.5:53)

Which of the following represents the most likely root cause of this failure?

Show answer & explanation

Answer: An intermediate firewall rule is dropping TCP port 53 traffic between the client workstation and the DNS server, preventing query retry after UDP truncation.

Answer

An intermediate firewall rule dropping TCP port 53 traffic between the client workstation and the DNS server, preventing query fallback after UDP payload truncation.
DNS relies on UDP port 53 for fast, low-overhead name resolution. However, when response data (such as large DNSSEC records) exceeds UDP length limits, the server truncates the response and sets the TC (Truncation) flag in the DNS header. By RFC standard, the client resolver must immediately retry the query over TCP port 53. The error message `cannot reach server over TCP` explicitly indicates that while initial UDP queries reach the server, network security filters (firewall/ACL) are blocking TCP port 53 traffic required for the fallback query.

Step-by-Step Solution

1
Analyze the DNS header flags in the `dig` command output.
The `tc` (Truncated) flag is set in the header (`flags: qr aa tc rd ra`), indicating that the complete DNS payload exceeds the maximum allowable UDP packet size (typically 512 bytes without EDNS0 or exceeding negotiated EDNS limits).
When a DNS response is too large to fit in a single UDP datagram, the server truncates the response and sets the TC flag to notify the client.
2
Evaluate the client resolver behavior following UDP truncation.
Standard DNS protocol behavior dictates that upon receiving a response with the TC flag set, the resolver MUST re-issue the query using TCP on port 53.
TCP provides stream-based delivery that accommodates large response payloads (such as DNSSEC keys/signatures or extensive record sets).
3
Interpret the specific communications error in the output.
`COMMUNICATIONS ERROR: cannot reach server over TCP (192.168.10.5:53)` demonstrates that UDP port 53 communication succeeded, but TCP port 53 transport failed.
This distinct differential failure (UDP working, TCP failing) points directly to a firewall/ACL rule blocking TCP port 53 while permitting UDP port 53.

Key Concept

DNS Transport Protocols and TCP Fallback upon Response Truncation (TC Flag)
Question 1258Question →

During a data center upgrade, a network engineer is investigating why a newly provisioned storage switch fails to synchronize fabric configuration files with the primary core switch. The engineer performed diagnostic packet captures and verified that the underlying cause is an MTU mismatch across the interconnecting trunk link, which causes jumbo frames to be dropped. According to the CompTIA troubleshooting methodology, which of the following actions should the network engineer perform NEXT?

Show answer & explanation

Answer: Develop a plan of action to adjust the trunk interface MTU settings and evaluate the change's potential impact on active fabric traffic.

Answer

Develop a plan of action to adjust the trunk interface MTU settings and evaluate the change's potential impact on active fabric traffic.
The scenario states that the engineer has already tested and confirmed the root cause (an MTU mismatch dropping jumbo frames), completing Step 3 (Test the theory to determine cause). According to the CompTIA troubleshooting methodology, the immediate next step is Step 4: Establish a plan of action to resolve the problem and identify potential effects. Developing a plan to adjust MTU while assessing risks to active fabric traffic strictly fulfills this phase.

Step-by-Step Solution

1
Identify the completed methodology phase from the scenario context.
The engineer performed packet captures and confirmed the MTU mismatch as the root cause, indicating that Step 3 (Test the theory to determine cause) is complete.
CompTIA troubleshooting requires determining the current phase before identifying the immediate next step.
2
Determine the next sequential phase in the CompTIA 7-step model.
Following Step 3 (Test theory), the technician must perform Step 4: Establish a plan of action to resolve the problem and identify potential effects.
Planning and risk assessment must precede actual implementation to avoid creating secondary network outages.
3
Select the option matching Step 4 requirements.
Developing a plan of action to adjust MTU while evaluating potential impacts on active fabric traffic directly matches Step 4.
This option explicitly fulfills both key components of Step 4: action planning and impact assessment.

Key Concept

CompTIA Troubleshooting Methodology Step Order (Testing Theory -> Plan of Action & Identifying Potential Effects)
Question 1259Question →

A network administrator is evaluating enterprise network telemetry tools and performance metrics. Match each monitoring scenario or metric requirement on the left with the corresponding metric or telemetry mechanism on the right.

Click a left item, then click its matching right item

Items

Measuring time variations between packet arrivals that cause choppiness in real-time VoIP calls
Periodically polling device CPU metrics and interface counters with encrypted payloads and authentication
Aggregating IP traffic flow statistics, protocol breakdown, and conversation byte counts across router interfaces
Measuring the total elapsed round-trip time required for a packet to travel from source to destination and back

Matches

Show answer & explanation

Answer

The correct pairings match packet delay variation to Jitter, authenticated and encrypted metric polling to SNMPv3 authPriv, traffic flow breakdown statistics to NetFlow / IPFIX, and total round-trip travel time to Latency.
Each monitoring scenario directly maps to its corresponding baseline metric or protocol: delay fluctuation in real-time calls is jitter; encrypted/authenticated device polling uses SNMPv3 authPriv; aggregating IP conversation and flow data uses NetFlow/IPFIX; and total transit delay is latency.

Step-by-Step Solution

1
Identify the performance issue related to packet delay variation in real-time voice calls.
Variation in arrival time between consecutive packets is defined as jitter.
VoIP streams require consistent packet delivery timing; variations result in audio buffer underruns/overruns.
2
Determine the management protocol required for secure, encrypted polling of system metrics.
SNMPv3 with authPriv provides both authentication and privacy (encryption).
Lower SNMP security levels like noAuthNoPriv or authNoPriv lack encryption for polled management data.
3
Match traffic flow analysis and protocol breakdown requirements to telemetry protocols.
NetFlow and IPFIX export flow records containing source/destination IPs, ports, and byte counts.
SNMP polls device counters, whereas flow technologies aggregate granular conversation metadata.
4
Associate total transit time measurement with the correct baseline performance metric.
Total delay for packet transmission and receipt is latency.
Latency measures overall transit time across a link or network path.

Key Concept

Network Performance Metrics and Telemetry Mechanisms
Question 1260Question →

A network administrator configures a new client subnet on VLAN 40 (10.40.0.0/2210.40.0.0/22) serviced by a central Layer 3 core switch. The central DHCP server (10.10.1.5010.10.1.50) resides on VLAN 10. Users on VLAN 40 report they cannot access internal servers or the internet. Executing `ipconfig /all` on a affected workstation returns the following output:

text
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Link-local IPv4 Address . . . . . : 169.254.109.88
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :

The administrator verifies that the DHCP server scope for 10.40.0.0/2210.40.0.0/22 is active, enabled, and currently has over 500 available leases. Which of the following represents the most likely root cause of this failure?

Show answer & explanation

Answer: The Layer 3 interface for VLAN 40 lacks a DHCP relay agent (IP helper address) configuration pointing to 10.10.1.50.

Answer

The Layer 3 interface for VLAN 40 lacks a DHCP relay agent (IP helper address) configuration pointing to 10.10.1.50.
Because DHCP requests originate as Layer 2 broadcast traffic (destination MAC FF:FF:FF:FF:FF:FF), routers and Layer 3 switches will not forward these frames across subnets. Configuring a DHCP relay agent (IP helper address) on the interface serving VLAN 40 allows the switch to encapsulate the broadcast request as a unicast packet sent directly to the DHCP server at 10.10.1.50.

Step-by-Step Solution

1
Analyze the client command output symptoms.
The IPv4 address starts with 169.254.x.x with a 255.255.0.0 mask, identifying an Automatic Private IP Addressing (APIPA) lease assignment due to DHCP failure.
When a DHCP client fails to receive a DHCPOFFER response to its DHCPDISCOVER request, the operating system assigns an APIPA address.
2
Evaluate network boundary topology and DHCP broadcast behavior.
The client resides on VLAN 40 (10.40.0.0/22) while the DHCP server resides on VLAN 10 (10.10.1.50). Routers and Layer 3 switches drop Layer 2 broadcast frames by default.
DHCPDISCOVER messages are broadcast frames (255.255.255.255) and cannot cross the Layer 3 boundary between VLAN 40 and VLAN 10 without assistance.
3
Determine the missing network configuration requirement.
An IP helper address (DHCP relay) must be configured on the VLAN 40 switch virtual interface (SVI) or router gateway interface.
The relay agent intercepts client broadcast DHCP requests and forwards them as unicast packets to the central DHCP server at 10.10.1.50.

Key Concept

DHCP Relay Agent (IP Helper Address) placement across Layer 3 boundaries
PreviousPage 63 / 112Next
All practice questions — CompTIA Network+ | Examkin