Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 1321Question →

A network administrator applies the following IPv4 extended Access Control List (ACL) inbound on interface GigabitEthernet0/0 to control outbound internet access for internal clients on the 172.16.40.0/24172.16.40.0/24 network:

text
access-list 102 permit udp 172.16.40.0 0.0.0.255 any eq 53
access-list 102 permit tcp 172.16.40.0 0.0.0.255 eq 443 any

Users report that domain name resolution functions properly, but secure web browsing to external websites fails. Which of the following configuration errors in the ACL is causing the HTTPS traffic to be dropped?

Show answer & explanation

Answer: The ACL rule specifies port 443 as the source port criterion rather than the destination port criterion.

Answer

The ACL rule specifies port 443 as the source port criterion rather than the destination port criterion.
The correct option correctly identifies that the `eq 443` keyword was placed after the source network specification (`172.16.40.0 0.0.0.255`) rather than after the destination specification (`any`). Client computers initiate connections using dynamic high-numbered ephemeral source ports and target destination port 443 on web servers. Because the ACL checks for source port 443, outgoing client HTTPS requests fail to match the rule and fall through to the implicit deny.

Step-by-Step Solution

1
Analyze the extended ACL syntax structure.
The syntax format for Cisco extended IPv4 ACLs is `access-list <number> permit/deny <protocol> <source-ip> <source-wildcard> [operator port] <dest-ip> <dest-wildcard> [operator port]`.
Understanding position-dependent arguments in extended ACL rules is critical for identifying parameter mismatches.
2
Evaluate the second rule: `access-list 102 permit tcp 172.16.40.0 0.0.0.255 eq 443 any`.
The `eq 443` modifier is placed immediately after the source wildcard mask `0.0.0.255` and before the destination keyword `any`.
This configuration attempts to match packets where the client's source port is 443.
3
Compare rule parameter placement with actual client traffic characteristics.
Client web browsers originate traffic using dynamically allocated ephemeral source ports (e.g., 49152–65535) destined to server port 443. Because the client's source port is not 443, the packet fails to match this permit rule and is dropped by the implicit deny at the end of the ACL.
To permit client connections to external web servers, `eq 443` must follow the destination specifier `any` (i.e., `permit tcp 172.16.40.0 0.0.0.255 any eq 443`).

Key Concept

Firewalls and Access Control Lists (ACLs)
Estimated Time:1m 30s
Question 1322Question →

A system administrator notices that a newly provisioned server cannot reach destinations outside its local subnet. Arrange the diagnostic actions in the correct logical sequence following standard CompTIA troubleshooting methodology.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper troubleshooting sequence begins with verifying local host network settings, testing reachability to the local default gateway via ping, performing a traceroute to isolate the path failure hop, and inspecting the gateway router's routing table and access control lists.
Logical network troubleshooting flows systematically from the local host up through the network path. First, local interface configurations must be verified. Second, connectivity to the immediate gateway is tested. Third, traceroute isolates where remote forwarding fails. Finally, deep analysis of router ACLs and routing tables is performed at the point of failure.

Step-by-Step Solution

1
Inspect local network configuration
Confirms the host IP, subnet mask, and default gateway address are correctly configured.
Eliminates local host misconfigurations before testing network infrastructure.
2
Ping local default gateway
Validates functional ICMP communication across the local switch fabric to the router interface.
Ensures the host can reach its local gateway before attempting off-subnet diagnostics.
3
Run traceroute to target destination
Determines whether packets stop at the local gateway or at a downstream hop.
Isolates the specific network device responsible for packet loss.
4
Examine router configuration
Identifies root causes such as missing default static routes or explicit/implicit ACL deny statements.
Enables targeted remediation on the affected network device.

Key Concept

Troubleshooting Gateway and Routing Path Issues
Question 1323Question →

A network technician needs to identify which port on a patch panel inside a wiring closet connects to an unlabelled wall outlet in a conference room. Which of the following tools is best suited to trace and locate this cable run?

Show answer & explanation

Answer: Tone generator and probe

Answer

The tone generator and probe is the appropriate tool for tracing and locating an unlabelled cable run.
A tone generator emits an analog audio tone onto copper conductors, while an inductive probe senses the signal without physical metal contact. This allows a technician to sweep the probe across patch panel ports to quickly pinpoint the matching cable end.

Step-by-Step Solution

1
Determine the troubleshooting requirement
The objective is to trace an unlabelled physical copper cable from a wall jack to its patch panel termination point.
Identifying unlabelled cable runs requires a tool designed for cable tracing rather than performance certification or fault distance measurement.
2
Select the correct physical diagnostic tool
Connecting the tone generator to the wall outlet sends an audible signal down the cable, which can then be detected at the patch panel using the inductive probe.
Tone generators and probes (often called fox and hound kits) are explicitly built to locate specific wires within bundles or unlabelled patch panels.

Key Concept

Cable Tracing and Location Tools
Question 1324Question →

A network technician terminates a custom Category 6A unshielded twisted-pair (UTP) cable run between a high-density patch panel and an enterprise core switch. A basic LED wiremapper confirms pin-to-pin continuity on all eight conductors (pins 1 through 8 match identically on both ends). However, when connected to 10 Gbps10\text{ Gbps} switch interfaces, the link fails to auto-negotiate above 100 Mbps100\text{ Mbps} and generates a rapid accumulation of Cyclic Redundancy Check (CRC) errors and Near-End Crosstalk (NEXT) violations under traffic load. Which of the following physical layer faults is the root cause of this failure, and which instrument must be used to diagnose it accurately?

Show answer & explanation

Answer: A split pair condition caused by mispairing conductors across different twisted pairs, requiring a cable certifier or high-frequency TDR to detect NEXT failure.

Answer

The root cause is a split pair condition, which preserves pin-to-pin DC continuity but destroys noise cancellation, requiring a cable certifier or high-frequency Time-Domain Reflectometer (TDR) capable of measuring Near-End Crosstalk (NEXT) to diagnose.
A split pair occurs when individual conductors are wired to the correct pin locations on both ends of a cable run, but are physically taken from different twisted pairs (for example, placing pin 3 and pin 4 onto the same physical twisted pair). Because continuity remains 1-to-1, simple DC wiremappers register a pass. However, at high frequencies such as 10 Gbps10\text{ Gbps} Ethernet, the lack of pair twisting mutual cancellation generates extreme Near-End Crosstalk (NEXT) and packet corruption, causing auto-negotiation fallbacks and CRC errors. A cable certifier or TDR capable of measuring parameter performance across frequencies is required to detect and pinpoint this condition.

Step-by-Step Solution

1
Analyze the diagnostic data from the basic wiremapper test
Basic LED wiremappers send low-voltage DC signals down each conductor individually to verify pin-to-pin continuity (e.g., Pin 1 to Pin 1, Pin 2 to Pin 2). Passing this test rules out open circuits, short circuits, and reversed pinouts.
Establishing what a basic continuity tester can and cannot measure isolates the category of cable fault.
2
Correlate link performance symptoms with physical twisted-pair physics
Twisted-pair Ethernet relies on differential signaling across dedicated pairs (e.g., pins 1/2, 3/6, 4/5, 7/8 in T568B) to cancel electromagnetic interference and crosstalk. In a split pair, individual wires are connected to the correct pins on both ends, but conductors from different physical pairs are paired together.
DC current flows through the correct pin numbers, so DC continuity passes, but the AC differential signals travel along non-twisted physical partners, eliminating noise cancellation and creating severe NEXT and CRC errors at high frequencies (10 Gbps10\text{ Gbps}).
3
Select the appropriate diagnostic instrument
Identifying split pairs and high-frequency crosstalk requires a cable certifier or advanced Time-Domain Reflectometer (TDR) that measures AC signal parameters, NEXT, return loss, and impedance discontinuities.
Simple continuity testers or tone probes cannot analyze signal phase, crosstalk, or high-frequency performance metrics.

Key Concept

Split Pair Faults & Advanced Cable Certification
Question 1325Question →

A network engineer is systematically troubleshooting a client workstation that is experiencing intermittent domain name resolution failures for internal corporate servers. Arrange the troubleshooting steps in the correct, logical order—beginning with local client configuration verification and progressing outward to network transport validation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct systematic order begins with verifying client IP configuration settings (ipconfig /all), followed by inspecting local DNS cache entries (ipconfig /displaydns), checking static mapping overrides in the HOSTS file, issuing an explicit query directly to the DNS server (nslookup), and finally inspecting network path firewalls for UDP/TCP port 53 traffic blocking.
Systematic DNS troubleshooting follows a logical progression from local client endpoint configuration (verifying IP settings, clearing local cache, inspecting static HOSTS file entries) to direct server querying (nslookup), and finally to network path transport verification (UDP/TCP port 53 firewall inspection).

Step-by-Step Solution

1
Verify client IP configuration settings.
Confirmed assigned Primary/Secondary DNS IP addresses and DNS search suffixes.
Incorrect server IPs or missing domain suffixes prevent queries from reaching the intended server.
2
Inspect local endpoint DNS resolver cache.
Identified whether previously resolved names or stale negative cache entries are causing failures.
Operating systems check memory cache before sending outbound network queries.
3
Review local static HOSTS file overrides.
Checked for misconfigured IP-to-hostname mappings on the local filesystem.
HOSTS file entries supersede DNS server lookup requests in standard host name resolution order.
4
Execute explicit nslookup targeting the DNS server.
Determined whether the DNS server responds to direct FQDN queries.
Direct queries bypass client-side caching and isolate client configuration from server responsiveness.
5
Verify network transport layer rules on UDP/TCP port 53.
Isolated intermediate network firewalls blocking DNS traffic.
If client configuration is valid but queries time out, intermediate network firewalls or ACLs are blocking UDP/TCP port 53.

Key Concept

Troubleshooting DNS and Name Resolution Services
Estimated Time:2m 0s
Question 1326Question →

A network administrator receives a report that a newly assigned workstation on VLAN 25 (10.25.0.0/2410.25.0.0/24) cannot access remote intranet services. Upon inspecting the workstation, the administrator observes an auto-configured IPv4 address of 169.254.42.10169.254.42.10. Place the following diagnostic and remediation steps in the correct logical sequence to systematically troubleshoot and resolve this DHCP relay issue from client verification to final resolution.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct logical sequence begins with client-side verification (`ipconfig /all`), followed by testing local subnet connectivity using a static IP, checking the router's DHCP relay (`ip helper-address`) configuration, confirming DHCP server scope availability for VLAN 25, and finally releasing and renewing the client's lease.
Following the structured troubleshooting methodology, an administrator must first verify client symptoms (APIPA confirmation), isolate local physical and VLAN connectivity using a temporary static IP, verify that the Layer 3 boundary device is properly configured with a DHCP relay agent (`ip helper-address`), ensure the remote DHCP server has an active scope for that subnet, and finally test dynamic acquisition on the client.

Step-by-Step Solution

1
Confirm client symptom and network stack state
Identify that the client holds an APIPA address (169.254.42.10169.254.42.10), proving DHCP DISCOVER messages failed to receive an OFFER.
CompTIA troubleshooting methodology mandates verifying the problem and gathering initial symptoms on the affected client first.
2
Isolate local Layer 2/3 network path
Confirming ping to 10.25.0.110.25.0.1 works under a temporary static IP proves local cabling, NIC, and switch VLAN configuration are functional.
Eliminates basic physical and local link issues before troubleshooting higher-level services across subnets.
3
Audit gateway DHCP relay configuration
Identify if `ip helper-address` is missing or pointing to an incorrect IP on the gateway interface for VLAN 25.
DHCP broadcasts cannot cross routers without a relay agent forwarding unicast requests to the DHCP server.
4
Audit central DHCP server scope state
Ensure the server scope for 10.25.0.0/2410.25.0.0/24 is active, not scope-exhausted, and configured with correct options.
Even with a working relay agent, an unactivated or exhausted scope prevents IP assignment.
5
Verify resolution on client
Client successfully receives an IP address in the 10.25.0.0/2410.25.0.0/24 range via dynamic lease renewal.
Confirms full end-to-end functionality of the DHCP process.

Key Concept

DHCP Relay and APIPA Troubleshooting Methodology across Subnets
Question 1327Question →

An IT technician is troubleshooting severe throughput degradation and excessive frame retransmissions on a newly configured 2.4 GHz wireless network in an office suite. A site survey reveals that three nearby access points serving the area are operating on channels 1, 3, and 5. Which of the following modifications should the technician make to resolve the interference?

Show answer & explanation

Answer: Reconfigure the access points to operate on channels 1, 6, and 11.

Answer

Reconfigure the access points to operate on channels 1, 6, and 11.
The 2.4 GHz Wi-Fi spectrum uses 20 MHz channel widths spaced 5 MHz apart. To avoid adjacent-channel interference (ACI), access points must be configured on non-overlapping channels (1, 6, and 11). Operating APs on channels 1, 3, and 5 results in overlapping frequency ranges that cause heavy packet corruption and retransmissions.

Step-by-Step Solution

1
Analyze the reported symptoms and current channel assignment
Identified that channels 1, 3, and 5 overlap with one another in the 2.4 GHz band, leading to adjacent-channel interference (ACI).
Channels 1, 3, and 5 share frequency ranges, causing RF energy from one channel to corrupt signals on adjacent channels.
2
Determine the standard non-overlapping channel scheme for 2.4 GHz Wi-Fi
Channels 1, 6, and 11 provide 20 MHz spacing with no frequency overlap.
20 MHz wide channels require 25 MHz of separation between center frequencies to prevent overlapping boundaries.
3
Select the appropriate remedial action
Reassigning the access points to channels 1, 6, and 11 resolves ACI.
Proper channel separation eliminates adjacent channel interference and restores normal wireless throughput.

Key Concept

2.4 GHz Non-Overlapping Channel Selection
Question 1328Question →

During a post-maintenance outage, voice over IP (VoIP) endpoints on a newly provisioned voice VLAN fail to register with the local SIP call manager. A network engineer formulates a hypothesis that a newly applied transport layer security (TLS) certificate authority (CA) bundle is missing on the automated provisioning server payload. To test this theory, the engineer sets up an isolated test bench, captures the boot traffic of a test phone via switch port mirroring, and inspects the packet trace. The trace confirms that the phone aborts the session during the TLS handshake due to an untrusted certificate authority, successfully validating the root cause. Which of the following actions should the engineer perform NEXT according to the CompTIA troubleshooting methodology?

Show answer & explanation

Answer: Develop a plan of action to update the CA trust store on the provisioning server and assess potential side effects on active handsets before applying the change.

Answer

Develop a plan of action to update the CA trust store on the provisioning server and assess potential side effects on active handsets before applying the change.
In the CompTIA 7-step troubleshooting methodology, the steps are: 1. Identify the problem, 2. Establish a theory of probable cause, 3. Test the theory to determine cause, 4. Establish a plan of action to resolve the problem and identify potential effects (then implement the solution), 5. Verify full system functionality and implement preventive measures, and 6. Document findings, actions, and outcomes. Because packet capture analysis on the isolated test bench confirmed the root cause (untrusted CA certificate), Step 3 is complete. The required next step is Step 4: establishing a plan of action and evaluating potential side effects before implementing the resolution.

Step-by-Step Solution

1
Analyze current phase in CompTIA 7-step methodology
The engineer confirmed the hypothesis through packet inspection on an isolated test bench, completing Step 3 (Test the theory to determine cause).
Confirming the root cause concludes the theory testing phase.
2
Determine the next logical step in the CompTIA sequence
Step 4 of the methodology requires establishing a plan of action to resolve the problem and identifying potential effects.
Before executing changes in production, a plan must be structured and risk mitigation assessed.
3
Select the option that aligns with Step 4
Developing a plan of action to update the CA trust store while identifying potential impacts directly matches Step 4.
This maintains strict compliance with standard CompTIA troubleshooting framework rules.

Key Concept

CompTIA 7-Step Troubleshooting Methodology Sequence (Step 3 to Step 4 transition)
Question 1329Question →

A network technician is testing connectivity on a workstation that fails to load external websites. The technician executes `nslookup portal.vendor.com` in the command prompt and receives the following output:

text
C:\> nslookup portal.vendor.com
DNS request timed out.
timeout was 2 seconds.
Server: UnKnown
Address: 192.168.1.50

*** Request to UnKnown timed out

Which of the following is the most likely reason for this DNS resolution failure?

Show answer & explanation

Answer: The local workstation cannot reach or receive a response from the configured DNS server at 192.168.1.50.

Answer

The local workstation cannot reach or receive a response from the configured DNS server at 192.168.1.50.
The correct option correctly identifies that a request timeout in `nslookup` occurs when the client sends a query to the designated DNS server (192.168.1.50) but receives no reply before the timer expires. This typically points to an unreachable DNS server, network path interruption, or blocked port 53 traffic.

Step-by-Step Solution

1
Analyze the nslookup command output.
Identified that the client queried DNS server 192.168.1.50 and encountered 'DNS request timed out.'
Understanding the error message pinpointed the exact stage of the failure.
2
Differentiate between name resolution failure types.
Recognized that timeouts signify network transport or service availability issues rather than record misconfigurations (which return NXDOMAIN or SERVFAIL).
A request timeout means the server never responded back to the client's UDP/TCP port 53 query.
3
Select the option describing network reachability or service unresponsiveness.
Determined that 192.168.1.50 is unreachable or not responding to DNS requests.
This directly matches the observed timeout symptom.

Key Concept

DNS Timeout vs. Resolution Error Diagnosis
Question 1330Question →

A network administrator is investigating reports of intermittent data backup failures across a core router interface. Although 5-minute average polling shows link utilization peaks at only 65%, interface statistics report a high count of egress packet drops during peak backup windows. The administrator needs to implement a telemetry and polling solution to capture short burst congestion while ensuring secure remote monitoring. Which of the following approaches best addresses this requirement?

Show answer & explanation

Answer: Configure flow telemetry (IPFIX/NetFlow) combined with SNMPv3 using authPriv to monitor fine-grained traffic flows and encrypted interface metrics.

Answer

Configure flow telemetry (IPFIX/NetFlow) combined with SNMPv3 using authPriv to monitor fine-grained traffic flows and encrypted interface metrics.
Combining flow telemetry (IPFIX/NetFlow) with SNMPv3 (authPriv) provides both high-resolution visibility into traffic microbursts causing buffer drops and secure, encrypted management polling for interface statistics.

Step-by-Step Solution

1
Analyze the monitoring symptom
Standard 5-minute SNMP polling averages out short traffic spikes (microbursts), masking buffer exhaustion that leads to egress frame drops.
High-frequency microbursts require flow-based telemetry (NetFlow/IPFIX) to identify specific bandwidth-consuming applications and traffic spikes.
2
Evaluate security and protocol requirements
SNMPv3 with authPriv ensures authentication and AES payload encryption, satisfying secure monitoring requirements.
Legacy SNMP versions (v1/v2c) transmit credentials in cleartext and lack privacy protections.

Key Concept

Network Telemetry and SNMP Security Levels
Estimated Time:1m 30s
Question 1331Question →

A network administrator receives a ticket stating that a newly deployed application server at 192.168.20.5/24192.168.20.5/24 cannot reach a remote database server located on a different subnet at 10.1.50.10/2410.1.50.10/24. Place the following diagnostic and remediation steps in the correct logical troubleshooting sequence to isolate and resolve the issue.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct logical order begins with checking local host IP configuration (item 1), testing local gateway reachability (item 2), tracing the path to isolate the failing hop (item 3), inspecting the routing table and ACLs at that hop (item 4), and finally applying the fix and verifying end-to-end connectivity (item 5).
Standard network troubleshooting proceeds methodically from the host level outward: verify host parameters, test local gateway reachability, perform path analysis to locate the failing hop, evaluate routing and ACL configurations on that device, and verify resolution.

Step-by-Step Solution

1
Verify local host IP configuration
Ensures the host has a valid IP address, mask, and default gateway setting
Rule out basic local misconfigurations before investigating network infrastructure.
2
Ping the local default gateway
Confirms Layer 2 and Layer 3 reachability within the local broadcast domain
Isolates whether the problem is on the local LAN segment or across routed bounds.
3
Perform path tracing using traceroute
Pinpoints the exact intermediate router or firewall hop where ICMP/IP packets stop
Narrows the scope of investigation to a specific network device.
4
Analyze routing entries and ACL statements on the target hop device
Determines if packets are dropped due to a missing static/dynamic route or blocked by an implicit/explicit deny rule
Identifies the precise root cause of the forwarding failure.
5
Implement corrective configuration and conduct end-to-end validation
Restores bidirectional IP communication and verifies solution effectiveness
Confirms resolution without leaving unverified changes in production.

Key Concept

CompTIA Troubleshooting Methodology applied to Routing, Default Gateways, and ACLs
Question 1332Question →

A network administrator is investigating connectivity issues where branch office users report that cloud-hosted file transfers repeatedly stall and disconnect over an IPsec VPN tunnel. The administrator tests a hypothesis by sending ICMP packets with the Don't Fragment (DF) bit set, confirming that an maximum transmission unit (MTU) mismatch across the WAN interface is causing packet fragmentation drops. According to the CompTIA troubleshooting methodology, which action should the administrator perform NEXT?

Show answer & explanation

Answer: Establish a plan of action to modify the interface MTU and TCP MSS values while identifying potential impacts on overall network traffic.

Answer

Establish a plan of action to modify the interface MTU and TCP MSS values while identifying potential impacts on overall network traffic.
The CompTIA troubleshooting methodology follows a strict sequence: 1. Identify the problem, 2. Establish a theory of probable cause, 3. Test the theory to determine cause, 4. Establish a plan of action to resolve the problem and identify potential effects, 5. Verify full system functionality and implement preventive measures, and 6. Document findings, actions, and outcomes. Because the administrator has already tested the theory and confirmed the MTU mismatch (Step 3), the immediate next step is Step 4: Establishing a plan of action to resolve the issue while considering potential side effects.

Step-by-Step Solution

1
Identify the current step in the CompTIA 6-step troubleshooting process based on the scenario details.
The scenario describes that the administrator has tested the hypothesis (ICMP ping with DF bit set) and confirmed the cause (MTU mismatch), completing Step 3: Test the theory to determine cause.
CompTIA troubleshooting requires following a strict sequential workflow.
2
Determine the next sequential phase required by the methodology.
The step immediately following Step 3 (Test theory) is Step 4: Establish a plan of action to resolve the problem and identify potential effects.
Changes must be planned and evaluated for side effects before implementation.
3
Select the choice that corresponds to establishing a plan of action.
Developing a plan to adjust MTU/TCP MSS settings while considering traffic impacts correctly represents Step 4.
Planning actions and assessing potential effects ensures structured change management.

Key Concept

CompTIA Troubleshooting Methodology Step Sequence
Estimated Time:1m 15s
Question 1333Question →

A network operations team needs to establish a baseline performance monitoring architecture across remote branch offices. Match each network telemetry and performance monitoring mechanism on the left with its primary collection metric or operational behavior on the right.

Click a left item, then click its matching right item

Items

SNMPv3 Polling
IPFIX / NetFlow Export
Syslog Messaging
ICMP Echo Probing

Matches

Show answer & explanation

Answer

SNMPv3 Polling matches querying structured MIB OIDs over encrypted UDP sessions; IPFIX / NetFlow Export matches collecting flow-level IP header data; Syslog Messaging matches transmitting unpolled event-driven log messages; ICMP Echo Probing matches measuring real-time round-trip time latency and unreturned packet percentages.
Each monitoring tool maps to its distinct operational telemetry function: SNMPv3 uses encrypted polling for MIB hardware metrics; IPFIX/NetFlow collects flow metadata for traffic composition analysis; Syslog delivers unpolled event logs categorized by severity; ICMP Echo probes measure latency and packet loss rates.

Step-by-Step Solution

1
Analyze the role of SNMPv3 Polling.
SNMPv3 provides secure, pull-based access to structured device variables defined in Management Information Bases (MIBs), such as CPU, RAM, and interface error counters.
SNMP is the industry standard for polling managed network device operational counters.
2
Analyze the role of IPFIX / NetFlow Export.
Flow technologies capture 5-tuple IP header attributes (source/destination IP, ports, protocol) to analyze traffic volume and top talkers.
Flow telemetry measures traffic volume composition rather than device hardware status.
3
Analyze the role of Syslog Messaging.
Syslog delivers unpolled notifications containing severity codes when notable events (e.g., interface flaps, authentication errors) occur.
Syslog is event-driven and unpolled, unlike SNMP polling or flow statistics.
4
Analyze the role of ICMP Echo Probing.
ICMP Echo probes issue synthetic traffic (pings) to calculate round-trip time delay and packet drop statistics.
Active probing directly measures latency and packet loss across a network path.

Key Concept

Network Performance Monitoring Mechanisms and Telemetry Classification
Estimated Time:1m 30s
Question 1334Question →

A network administrator runs the following command on a host experiencing name resolution failures:

C:\> nslookup app.corp.local 192.168.1.10
Server: dns01.corp.local
Address: 192.168.1.10

*** dns01.corp.local can't find app.corp.local: Non-existent domain

Based on the output, which TWO of the following represent plausible root causes for this error? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: An A record for the hostname app.corp.local is missing from the forward lookup zone on the DNS server.; The queried hostname app.corp.local contains a typographical error or does not match the configured domain name record.

Answer

The correct root causes are that an A record for app.corp.local is missing from the DNS server's forward lookup zone, and that the queried hostname contains a typographical error or does not match the record.
The nslookup utility successfully established contact with DNS server 192.168.1.10, but received an NXDOMAIN response. This demonstrates that network layer connectivity is operational, but the DNS zone database lacks an A/AAAA record for the queried name, or the user queried a misspelled domain name.

Step-by-Step Solution

1
Analyze the nslookup command output.
The command successfully communicated with the specified DNS server at IP address 192.168.1.10192.168.1.10.
The output returns the server name and address, indicating network connectivity to the DNS service on port 53 is functional.
2
Evaluate the specific error message returned by the resolver.
The server responded with 'can't find app.corp.local: Non-existent domain' (NXDOMAIN).
NXDOMAIN confirms the DNS server processed the query but could not find a matching host record in its database.
3
Identify valid causes for an NXDOMAIN response.
The missing host record (A record) on the DNS zone or an incorrect host name query are the correct explanations.
Both causes directly explain why an authoritative DNS server returns a non-existent domain error.

Key Concept

Troubleshooting DNS NXDOMAIN Errors and Host Record Misconfigurations
Question 1335Question →

A user's workstation is assigned a static IPv4 address of 192.168.1.50192.168.1.50 with a subnet mask of 255.255.255.0255.255.255.0. The default gateway is configured as 192.168.2.1192.168.2.1. The user cannot access any external resources or communicate outside the local network segment. Which of the following best explains why the workstation cannot reach the default gateway?

Show answer & explanation

Answer: The host IP address and the default gateway reside on different IP subnets.

Answer

The host IP address and the default gateway reside on different IP subnets.
For a workstation to forward traffic off its local network segment, its default gateway must share the same IP subnet. With a subnet mask of 255.255.255.0255.255.255.0, the workstation at 192.168.1.50192.168.1.50 belongs to the 192.168.1.0/24192.168.1.0/24 network, while the configured gateway 192.168.2.1192.168.2.1 belongs to the 192.168.2.0/24192.168.2.0/24 network. Because they reside on separate subnets, local ARP requests to locate the gateway will fail.

Step-by-Step Solution

1
Determine the host's IP network ID based on its assigned IP address and subnet mask.
An IP address of 192.168.1.50192.168.1.50 with subnet mask 255.255.255.0255.255.255.0 places the host on network 192.168.1.0/24192.168.1.0/24.
The subnet mask 255.255.255.0255.255.255.0 defines the first 24 bits (three octets) as the network prefix.
2
Determine the network ID of the configured default gateway address.
A gateway address of 192.168.2.1192.168.2.1 with subnet mask 255.255.255.0255.255.255.0 places the gateway on network 192.168.2.0/24192.168.2.0/24.
For host-to-gateway Layer 2 frame resolution, the gateway must reside on the same IP subnet as the host.
3
Compare the host network ID with the gateway network ID to establish the root cause.
Network 192.168.1.0/24192.168.1.0/24 does not match 192.168.2.0/24192.168.2.0/24.
A host cannot resolve ARP requests or forward frames to a default gateway configured on a different subnet.

Key Concept

Default Gateway Subnet Misconfiguration
Question 1336Question →

A network technician is troubleshooting DNS resolution issues on a branch office workstation. The workstation is configured to use the local branch gateway router (192.168.10.1192.168.10.1) as its primary DNS server, which should forward requests for internal corporate resources to the core DNS server (10.100.1.510.100.1.5).

When attempting to resolve an internal hostname, the technician runs the following command-line queries from the workstation:

text
$ nslookup intranet.corp.local
Server: 192.168.10.1
Address: 192.168.10.1#53

** server can't find intranet.corp.local: SERVFAIL

$ nslookup intranet.corp.local 10.100.1.5
Server: 10.100.1.5
Address: 10.100.1.5#53

Name: intranet.corp.local
Address: 10.100.20.50

Based on the output, which TWO of the following are the most likely root causes for the initial resolution failure? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The DNS forwarder configuration on the local router (192.168.10.1) is specified with an incorrect or unreachable upstream DNS server IP address.; An Access Control List (ACL) or firewall rule is blocking port 53 UDP/TCP traffic originating from the router's IP address to the core DNS server.

Answer

The initial resolution failure is most likely caused by either an incorrect upstream DNS server IP address configured in the local router's DNS forwarder settings, or an Access Control List (ACL) / firewall rule blocking DNS port 53 traffic sourcing from the router's IP address to the core DNS server.
The output demonstrates that the workstation can directly query the core DNS server at 10.100.1.5 and receive an authoritative A record response. However, querying the local router at 192.168.10.1 yields a SERVFAIL error. This error occurs when a DNS server cannot fulfill a query due to an upstream failure. This indicates either that the router is attempting to forward requests to an incorrect/unreachable upstream IP address configured in its forwarding list, or that intermediate network security controls (ACLs/firewalls) are blocking port 53 traffic originating specifically from the router's IP address.

Step-by-Step Solution

1
Analyze the first command output (`nslookup intranet.corp.local`).
The query sent to the local gateway (192.168.10.1192.168.10.1) returns a `SERVFAIL` error response.
`SERVFAIL` indicates that the DNS server received the request but encountered an internal failure (such as an inability to communicate with upstream recursive/authoritative servers) while attempting to process it.
2
Analyze the second command output (`nslookup intranet.corp.local 10.100.1.5`).
Direct query to the core DNS server (10.100.1.510.100.1.5) successfully resolves `intranet.corp.local` to IP address 10.100.20.5010.100.20.50.
This confirms that the host record exists, the core DNS server is operational, and the workstation itself has IP connectivity to port 53 on 10.100.1.510.100.1.5.
3
Deduce why querying the router fails while querying the core server directly succeeds.
Identify issues specific to the relay path between 192.168.10.1192.168.10.1 and 10.100.1.510.100.1.5.
Because the workstation can reach 10.100.1.510.100.1.5, any path failure must affect traffic originating from 192.168.10.1192.168.10.1 specifically (such as router-sourced ACL restrictions) or an internal misconfiguration on 192.168.10.1192.168.10.1 (such as an incorrect forwarder destination IP address).

Key Concept

DNS Forwarder and Relay Troubleshooting
Question 1337Question →

A network security administrator is troubleshooting a remote access IPsec VPN deployment across a router performing Network Address Translation (NAT). During testing, site-to-client connections configured to use IPsec Authentication Header (AH) fail to establish, whereas connections configured to use Encapsulating Security Payload (ESP) succeed. Which of the following best explains why IPsec AH fails when passing through a NAT device?

Show answer & explanation

Answer: AH includes the outer IP header fields when calculating its integrity checksum, causing header modifications made by NAT to invalidate the packet authentication.

Answer

IPsec Authentication Header (AH) calculates its integrity checksum over the outer IP header fields, so Network Address Translation (NAT) modifications cause authentication verification failure at the receiving endpoint.
IPsec Authentication Header (AH) provides connectionless integrity and authentication by calculating an Integrity Check Value (ICV) over the entire IP packet, including mutable fields such as the source and destination IP addresses in the outer header. When Network Address Translation (NAT) modifies the IP header, the ICV check fails at the receiver. In contrast, Encapsulating Security Payload (ESP) does not include the outer IP header in its ICV calculation, enabling compatibility with NAT Traversal (NAT-T).

Step-by-Step Solution

1
Analyze how IPsec Authentication Header (AH) operates
AH provides data integrity and origin authentication by computing an Integrity Check Value (ICV) across the entire packet, including IP header fields.
Understanding ICV coverage scope is essential to evaluating packet modifications.
2
Examine the impact of Network Address Translation (NAT)
NAT alters source or destination IP addresses in the outer IP header.
Modifying IP header values changes the checksum input fields.
3
Correlate packet alteration with ICV verification failure
The receiver recalculates the ICV upon packet arrival; because NAT altered the IP address, the calculated ICV does not match the transmitted ICV, causing packet rejection.
This explains why AH fails through NAT while ESP (which excludes outer IP header fields from ICV calculation or uses UDP encapsulation for NAT-T) succeeds.

Key Concept

IPsec Authentication Header (AH) vs Encapsulating Security Payload (ESP) NAT Traversal Compatibility
Question 1338Question →

A network technician is troubleshooting a workstation that can ping other local hosts on the 192.168.10.0/24192.168.10.0/24 subnet but cannot access any remote servers on external networks. Running an IP configuration utility displays the following settings:

- IP Address: 192.168.10.45192.168.10.45
- Subnet Mask: 255.255.255.0255.255.255.0
- Default Gateway: 192.168.20.1192.168.20.1

Which of the following configuration issues is preventing the workstation from reaching external networks?

Show answer & explanation

Answer: The default gateway IP address is located on a different subnet than the workstation.

Answer

The default gateway IP address is located on a different subnet than the workstation.
A host needs a default gateway configured on its own local IP subnet so it can resolve the gateway's MAC address via ARP and deliver off-subnet frames. Because the workstation resides in 192.168.10.0/24192.168.10.0/24 while the gateway address is configured as 192.168.20.1192.168.20.1, the host considers the gateway unreachable and cannot transmit packets to external destinations.

Step-by-Step Solution

1
Analyze the host network configuration parameters.
Host IP address is 192.168.10.45192.168.10.45 with mask 255.255.255.0255.255.255.0 (/24), defining the local subnet as 192.168.10.0192.168.10.0 to 192.168.10.255192.168.10.255.
Determining the local subnet boundaries is necessary to evaluate local address validity.
2
Compare the default gateway IP address against the host subnet range.
The gateway 192.168.20.1192.168.20.1 belongs to the 192.168.20.0/24192.168.20.0/24 network, which is outside the host's local subnet.
For a host to forward non-local traffic, the default gateway's IP address must be directly reachable on the local Layer 2 segment.
3
Identify the root cause of the external unreachability.
The workstation cannot send ARP requests or Ethernet frames directly to a gateway that resides on a foreign subnet.
Mismatched gateway subnets prevent out-of-subnet routing.

Key Concept

Default Gateway Subnet Alignment
Question 1339Question →

A network technician is troubleshooting an issue where a newly deployed application server (10.40.20.50/2410.40.20.50/24) in VLAN 20 cannot connect to an off-site database cluster at 172.16.100.25/24172.16.100.25/24. Hosts in VLAN 20 can reach local resources and the internet, but cannot communicate with the 172.16.100.0/24172.16.100.0/24 network. Following the standard CompTIA network troubleshooting methodology, place the diagnostic and remediation steps in the correct sequential order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequential order for troubleshooting routing, gateway, and ACL issues is: 1) Verify local host configuration and gateway reachability (`item_1`), 2) Trace the path to locate the failure hop (`item_2`), 3) Check the router's routing table for destination routes (`item_3`), 4) Audit interface ACLs for filtering or implicit deny statements (`item_4`), and 5) Apply the configuration fix and verify end-to-end connectivity (`item_5`).
Following the structured CompTIA troubleshooting methodology, network diagnostics move logically from local host checks (ping default gateway), to path isolation (traceroute), to device routing tables (`show ip route`), to access control list inspection (`show ip access-lists`), and finally to implementing and verifying the solution.

Step-by-Step Solution

1
Test local stack and default gateway connectivity.
Confirms Layer 1–3 network interface functionality and local subnet communication.
Always eliminate local client and gateway configuration issues prior to inspecting remote network infrastructure.
2
Run path isolation diagnostics (`traceroute`).
Identifies the exact hop where packets are dropped.
Isolates whether the failure occurs within the local network, at a core routing boundary, or across a WAN/VPN link.
3
Verify routing table contents on the target router.
Determines if the router possesses a valid exit interface or next-hop route for 172.16.100.0/24172.16.100.0/24.
A missing route causes the router to drop packets or send them to an incorrect default route.
4
Audit interface Access Control Lists (ACLs).
Reveals whether traffic is permitted or inadvertently dropped by rule sequence or implicit deny.
Even with a valid route, interface ACLs evaluate traffic before or after routing lookup and can block communication.
5
Modify the configuration and conduct final verification.
Restores full connectivity and documents resolution.
Testing service reachability after applying configuration changes confirms complete problem resolution.

Key Concept

Structured Network Troubleshooting Methodology for Routing and ACLs
Question 1340Question →

A network security administrator reviews authentication logs for a corporate Remote Access VPN gateway and notices a pattern of authentication failures across over 500 distinct employee accounts within a short timeframe. Further inspection shows that each individual account experienced only two failed login attempts per hour, avoiding account lockout thresholds. Which of the following attack types is most likely occurring?

Show answer & explanation

Answer: Password spraying attack

Answer

Password spraying attack
Password spraying is a technique where an attacker attempts a few common passwords (e.g., 'Summer2026!') against a vast list of usernames. By keeping the number of failed attempts low per account within a given time period, the attacker successfully circumvents automated account lockout mechanisms.

Step-by-Step Solution

1
Analyze the log signature provided in the scenario.
Identified multiple user accounts (500+) receiving a low frequency of failed attempts (2 per hour), deliberately designed to stay beneath account lockout policies.
Security controls typically lock an account after 3 to 5 failed attempts within a set window; attackers adapt by testing a few common passwords across many accounts.
2
Compare the signature against common attack vectors.
Password spraying specifically fits the pattern of horizontal testing (few passwords across many accounts), whereas traditional brute-force is vertical testing (many passwords against one account).
Distinguishing between horizontal and vertical credential attacks is critical for deploying appropriate mitigations such as multi-factor authentication (MFA).

Key Concept

Password Spraying Attack
Estimated Time:1m 15s
PreviousPage 67 / 112Next
All practice questions — CompTIA Network+ | Examkin