All practice questions

2237 questions

All types2,237 Multiple choice1,150 Multiple select488 Numeric30 Matching350 Ordering201 Short answer18

A network administrator is analyzing console log messages and packet captures between two Layer 2 switches, Switch-A and Switch-B, connected via an 802.1Q trunk on port GigabitEthernet0/1. Switch-A has GigabitEthernet0/1 configured with 'switchport trunk native vlan 10', whereas Switch-B has GigabitEthernet0/1 configured with 'switchport trunk native vlan 20'. Cisco Discovery Protocol (CDP) alerts report a %CDP-4-NATIVE_VLAN_MISMATCH error. Hosts on Switch-A in VLAN 10 report unexpected cross-talk and data leaks to hosts on Switch-B in VLAN 20, while tagged VLAN 30 traffic functions normally. Which of the following correctly explains the underlying root cause of this behavior and the required resolution?

The native VLAN mismatch causes untagged frames sent from Switch-A (VLAN 10) to be received and ingested as untagged frames on Switch-B and assigned to its local native VLAN (VLAN 20); configuring matching native VLAN numbers on both trunk endpoints resolves the cross-VLAN leakage.

Late collisions caused by a duplex mismatch on GigabitEthernet0/1 are stripping the 802.1Q header tags from VLAN 10 frames prior to arrival at Switch-B; manually setting both trunk ports to full-duplex speed and mode will restore proper tagging.

Layer 2 switches cannot pass traffic between identical VLANs across physical switch boundaries without a Layer 3 inter-VLAN router; installing an external router to perform subinterface routing will resolve the communication issue.

Spanning Tree Protocol (STP) has placed GigabitEthernet0/1 on Switch-A into a blocking state because Switch-A has an STP bridge priority of 61440; decreasing Switch-A's STP priority to 65535 will elect Switch-A as the root bridge and unblock the port.

Show answer & explanation

Answer: The native VLAN mismatch causes untagged frames sent from Switch-A (VLAN 10) to be received and ingested as untagged frames on Switch-B and assigned to its local native VLAN (VLAN 20); configuring matching native VLAN numbers on both trunk endpoints resolves the cross-VLAN leakage.

Answer

In 802.1Q trunking, traffic belonging to the native VLAN is sent untagged across the link. When Switch-A sends VLAN 10 traffic untagged (due to native VLAN 10 configuration), Switch-B receives those untagged frames and implicitly assigns them to its own native VLAN (VLAN 20). This results in untagged broadcast domain leakage across VLAN boundaries. Matching the native VLAN settings across both switches resolves the issue.

Step-by-Step Solution

Analyze the 802.1Q trunking protocol behavior for native VLAN traffic.

IEEE 802.1Q trunks transmit frames belonging to the designated native VLAN without an explicit 4-byte 802.1Q header tag.

Native VLAN frames are unencapsulated for backward compatibility with non-trunking devices.

Trace frame egress from Switch-A and ingress on Switch-B.

Switch-A transmits VLAN 10 traffic untagged because VLAN 10 is its native VLAN. Switch-B receives untagged frames on GigabitEthernet0/1 and maps all incoming untagged frames to its own native VLAN, which is VLAN 20.

Trunk interfaces do not carry native VLAN identification metadata inside untagged frame headers.

Determine the necessary administrative resolution.

Aligning the native VLAN configurations on both Switch-A and Switch-B (e.g., setting both to VLAN 10 or both to an unused VLAN like VLAN 99) eliminates the native VLAN mismatch log and prevents untagged traffic leakage.

Both switches must agree on the native VLAN ID on trunk links for symmetrical handling of untagged frame encapsulation.

Key Concept

Native VLAN Mismatch Behavior on IEEE 802.1Q Trunk Links

Question 1342Question →

A network administrator is provisioning a wireless network for a medical clinic. To fulfill regulatory compliance mandates, the deployment requires centralized user authentication integrated with an 802.1X RADIUS server and 192-bit cryptographic strength for payload confidentiality. Which wireless security deployment mode and encryption suite best satisfies these requirements?

WPA3-Enterprise using GCMP-256 encryption

WPA3-Personal using Simultaneous Authentication of Equals (SAE)

WPA3-Enterprise using TACACS+ for wireless frame encryption

WPA2-Personal using AES-CCMP-128 with dynamic pre-shared keys

Show answer & explanation

Answer: WPA3-Enterprise using GCMP-256 encryption

Answer

WPA3-Enterprise using GCMP-256 encryption

WPA3-Enterprise mode provides 802.1X authentication via RADIUS servers for individual user accountability and supports the optional 192-bit security mode leveraging GCMP-256 encryption.

Step-by-Step Solution

Identify authentication requirements

Requirements mandate 802.1X RADIUS individual authentication, ruling out Personal (PSK/SAE) modes.

Enterprise modes use EAP and 802.1X RADIUS servers for identity management.

Evaluate cryptographic strength requirements

Requirements specify 192-bit cryptographic security mode.

WPA3-Enterprise 192-bit mode utilizes GCMP-256 (Galois/Counter Mode Protocol) for robust payload encryption.

Key Concept

WPA3 Wireless Security Standards and 802.1X Enterprise Authentication

Question 1343Question →

A network administrator configures a workstation with IP address $172.20.30.45$ and subnet mask $255.255.255.192$ . The workstation can successfully ping local hosts, but fails to reach any external subnets. Reviewing `ipconfig /all` reveals the following output:

IPv4 Address. . . . . . . . . . . : 172.20.30.45
Subnet Mask . . . . . . . . . . . : 255.255.255.192
Default Gateway . . . . . . . . . : 172.20.30.65

Which of the following identifies the root cause of the connectivity failure?

The default gateway IP address resides outside the workstation's local subnet range.

An implicit deny rule on the router's inbound Access Control List (ACL) is dropping outbound packets.

The host IP address 172.20.30.45 is a directed broadcast address and cannot be assigned to an end device.

The workstation requires switchport re-assignment because inter-VLAN routing is disabled on the switch.

Show answer & explanation

Answer: The default gateway IP address resides outside the workstation's local subnet range.

Answer

The default gateway IP address resides outside the workstation's local subnet range.

The workstation IP address (

172.20.30.45

) with subnet mask

255.255.255.192

(/26) belongs to the subnet

172.20.30.0/26

, which spans addresses

172.20.30.0

through

172.20.30.63

. The configured default gateway (

172.20.30.65

) lies within the adjacent subnet

172.20.30.64/26

. Because a host's default gateway must reside on the same local subnet as the host interface, the host cannot send local ARP queries for the gateway, breaking all outbound non-local traffic.

Step-by-Step Solution

Calculate the subnet boundaries for the workstation using the given CIDR mask

A subnet mask of

255.255.255.192

corresponds to a

/26

prefix, giving a block size of

256 - 192 = 64

addresses per subnet.

Subnet ranges increment by 64 in the fourth octet: Subnet 0 (

172.20.30.0 - 172.20.30.63

) and Subnet 1 (

172.20.30.64 - 172.20.30.127

Determine the host's subnet and valid host range

The host address

172.20.30.45

falls into Subnet 0 (

172.20.30.0/26

), where usable IPs are

172.20.30.1

through

172.20.30.62

Devices must have a default gateway configured within their own local subnet boundary to enable ARP resolution for off-subnet forwarding.

Evaluate the configured default gateway address

The configured gateway IP is

172.20.30.65

, which falls into Subnet 1 (

172.20.30.64/26

Because

172.20.30.65

is on a different subnet, the host cannot ARP for its gateway address directly on the local link.

Key Concept

Default Gateway Subnet Alignment

Estimated Time:1m 30s

Question 1344Question →

A network technician is investigating a connectivity issue where a host with IP address $172.16.5.25/24$ cannot access services on a remote subnet $10.10.1.0/24$ . Local ping tests confirm the host can communicate with other devices on $172.16.5.0/24$ . Which of the following misconfigurations could cause this issue? (Select TWO.)

Select all that apply

The host is configured with a default gateway address (

172.16.4.1

) that resides outside its assigned subnet

An Access Control List (ACL) applied to the egress router interface drops traffic due to an implicit deny rule

The host and its local router interface reside within the same VLAN broadcast domain

The router has disabled application port 23, preventing basic Layer 3 IP packet forwarding

Show answer & explanation

Answer: The host is configured with a default gateway address ( $172.16.4.1$ ) that resides outside its assigned subnet; An Access Control List (ACL) applied to the egress router interface drops traffic due to an implicit deny rule

Answer

The host is configured with a default gateway address outside its subnet (

172.16.4.1

), and an Access Control List (ACL) drops the traffic due to an implicit deny rule.

For a host to reach remote networks, its default gateway must be on the local subnet (

172.16.5.0/24

). A gateway address of

172.16.4.1

prevents routing. Furthermore, network traffic passed to a router will be dropped if an applied ACL lacks a permit entry due to the default implicit deny clause.

Step-by-Step Solution

Analyze local vs. remote connectivity symptoms

The host communicates locally on

172.16.5.0/24

, confirming Layer 1/2 functionality and local switchport settings, but fails to reach remote networks.

Traffic destined for off-link addresses (

10.10.1.0/24

) must be sent to a valid local Layer 3 default gateway.

Evaluate default gateway IP configuration

An IP of

172.16.4.1

is on a different subnet than

172.16.5.25/24

Hosts cannot resolve ARP for a default gateway that is not on their local IP subnet, preventing remote packet delivery.

Evaluate router ACL behavior

Traffic matching no explicit permit rule on a router interface is blocked.

Access Control Lists filtering traffic implement an implicit deny rule at the end of the list.

Key Concept

Troubleshooting Default Gateways and Router ACL Placement

Question 1345Question →

A network administrator submits a Request for Change (RFC) to perform a major firmware upgrade on the central distribution switches servicing a corporate office. The submission details the business justification, target maintenance window, affected VLANs, and post-installation validation tests. However, the Change Advisory Board (CAB) rejects the RFC during review. Which of the following critical components was most likely missing from the RFC submission?

A comprehensive rollback plan specifying exact steps and triggers to revert to the previous software version if validation fails

A plan to implement alternative fixes on production switches before establishing a probable cause for potential issues

A directive to downgrade switch management interfaces to unencrypted SNMPv2c for monitoring during the upgrade

A configuration change to update connected client default gateways from the HSRP virtual IP to physical interface IPs

Show answer & explanation

Answer: A comprehensive rollback plan specifying exact steps and triggers to revert to the previous software version if validation fails

Answer

A comprehensive rollback plan specifying exact steps and triggers to revert to the previous software version if validation fails

A formal Request for Change (RFC) submitted to a Change Advisory Board (CAB) must contain a documented rollback (backout) plan. This plan outlines explicit steps, backout time windows, and threshold triggers for reverting network devices to their baseline configuration and software version if post-change validation fails.

Step-by-Step Solution

Analyze the core requirements of a formal Request for Change (RFC) within enterprise change management.

Identified that an RFC must cover change scope, risk assessment, schedule, validation plan, and backout/rollback procedures.

The Change Advisory Board (CAB) requires proof that system availability can be restored if the change causes an unexpected outage.

Evaluate the missing element in the scenario's submitted RFC.

The administrator provided justification, scheduling, scope, and validation, but omitted a backout/rollback plan.

Without a clear rollback procedure, maintenance risks prolonged network downtime if the new firmware behaves unexpectedly.

Key Concept

Essential elements of a Request for Change (RFC) and Rollback Planning

Question 1346Question →

A network technician receives reports that client workstations on a corporate subnet are unable to resolve external internet hostnames, although internal hostname resolution functions normally. Place the diagnostic and remediation steps in the correct logical sequence from initial client-side isolation to final resolution verification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with verifying network connectivity to the internal DNS server, testing recursive lookup failure on the local resolver, testing direct outbound lookup to a public DNS server, remediating server forwarder and firewall settings, and finally flushing the local client cache to verify resolution.

Effective troubleshooting follows a logical progression from local connectivity verification to service isolation, root-cause remediation, and end-state validation. Verifying network layer reachability first ensures the client can reach its assigned resolver. Testing queries against the internal DNS server isolates recursion failures. Testing queries directly against an external public resolver determines if outbound transport on port

53

is blocked. Fixing the forwarders/firewall addresses the root cause, and flushing the client cache verifies successful end-to-end resolution.

Step-by-Step Solution

Verify basic connectivity to the local DNS server.

Confirms the network interface and routing path to the primary resolver are operational.

Lower-layer connectivity issues must be ruled out before testing application-layer DNS functionality.

Test external DNS query against the local internal DNS server using `nslookup`.

Identifies that the internal server responds to internal names but fails or times out on external domain requests.

Isolates the failure to external recursion or upstream forwarding features on the DNS server.

Test direct external query to a public DNS server (such as

8.8.8.8

) using `nslookup`.

Determines whether perimeter firewalls permit outbound UDP/TCP port

53

traffic from the network.

Distinguishes between a network/firewall transport issue and an internal DNS server forwarder misconfiguration.

Correct DNS forwarder settings on the internal DNS server and ensure firewall ACLs permit egress DNS traffic.

Restores upstream name resolution processing on the internal DNS server.

Fixes the underlying infrastructure root cause permitting recursive queries to succeed.

Execute `ipconfig /flushdns` on the client workstation and test web browsing.

Removes old negative or stale cached entries and confirms successful domain resolution.

Ensures client applications receive freshly resolved IP addresses following service restoration.

Key Concept

Systematic DNS Troubleshooting Methodology for External Resolution and Upstream Forwarder Failures

Estimated Time:1m 30s

Question 1347Question →

A network technician suspects that recent Active Directory logon failures across a branch office are caused by Network Time Protocol (NTP) traffic being blocked by a newly deployed perimeter firewall. To test this theory, the technician creates a temporary logging rule on the firewall and attempts a manual time synchronization from a branch domain controller, observing that outgoing UDP port 123 packets are actively being dropped. Having confirmed that NTP packet blockage is the root cause of the synchronization failure, which of the following actions should the technician perform NEXT according to the CompTIA troubleshooting methodology?

Document the firewall drop logs and root cause analysis in the ticketing system.

Develop a plan of action to modify the firewall security policy and implement the fix.

Perform system-wide authentication testing to verify that domain controller logon delays are eliminated.

Question affected branch office users to determine if non-domain devices are experiencing time skew.

Show answer & explanation

Answer: Develop a plan of action to modify the firewall security policy and implement the fix.

Answer

Develop a plan of action to modify the firewall security policy and implement the fix.

According to the official CompTIA Troubleshooting Methodology, the steps are strictly ordered as: 1) Identify the problem, 2) Establish a theory of probable cause, 3) Test the theory to determine cause, 4) Establish a plan of action to resolve the problem and implement the solution, 5) Verify full system functionality and implement preventive measures, and 6) Document findings, actions, and outcomes. Because the technician has successfully tested and confirmed the theory (Step 3), the immediate next step is to establish a plan of action and implement the solution (Step 4).

Step-by-Step Solution

Identify current methodology stage

The technician completed testing the theory by confirming firewall drops on UDP port 123.

Testing the theory (Step 3) confirms the root cause of the problem.

Determine the next sequential step in the CompTIA 6-step model

Step 4 is 'Establish a plan of action to resolve the problem and implement the solution'.

After confirming the cause, the technician must plan the remediation steps (including change management approval if necessary) and execute the implementation.

Key Concept

CompTIA Troubleshooting Methodology Order

Estimated Time:1m 15s

Question 1348Question →

A network administrator needs to construct an inbound IPv4 extended Access Control List (ACL) on a gateway router to secure an internal server subnet ( $10.20.30.0/24$ ). The security policy requires allowing administrative SSH access from host $192.168.1.50$ , allowing web HTTPS traffic from the internal workstation subnet ( $192.168.1.0/24$ ), blocking all other traffic originating from subnet $192.168.1.0/24$ , and permitting traffic from all other internal subnets. Place the following ACL statement descriptions in the correct sequence from top to bottom (first matching rule to last).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order from top to bottom is: 1) Permit TCP from host 192.168.1.50 to host 10.20.30.5 port 22; 2) Permit TCP from subnet 192.168.1.0/24 to subnet 10.20.30.0/24 port 443; 3) Deny IP from subnet 192.168.1.0/24 to subnet 10.20.30.0/24; 4) Permit IP from any to any.

ACL entries operate on a top-down, first-match logic. The correct sequence starts with the most specific match criteria (individual host SSH access), followed by broader protocol permissions for the subnet (HTTPS), then the broad subnet deny statement, and finally a permit statement for all remaining subnet traffic.

Step-by-Step Solution

Identify the most specific rule

Host-specific rule permitting SSH (TCP port 22) from

192.168.1.50

10.20.30.5

ACLs process rules sequentially from top to bottom. Specific single-host rules must precede broader subnet rules to prevent rule shadowing.

Place specific protocol/port permissions for the source subnet

Subnet rule permitting HTTPS (TCP port 443) from

192.168.1.0/24

10.20.30.0/24

HTTPS permission must occur before blocking the rest of subnet

192.168.1.0/24

traffic.

Apply broad denial for the specific source subnet

Rule denying all IP traffic from subnet

192.168.1.0/24

10.20.30.0/24

This drops any non-HTTPS traffic from subnet

192.168.1.0/24

while preserving access permitted in earlier steps.

Permit remaining subnets

Rule permitting IP traffic from any source to any destination

This allows traffic from other network subnets to reach the server network, overriding the implicit deny any rule at the end of the ACL.

Key Concept

ACL Sequential Evaluation and Shadowing Prevention

Estimated Time:1m 30s

Question 1349Question →

A client workstation on VLAN 10 ( $10.10.10.0/24$ ) fails to receive an IPv4 address lease from a centralized DHCP server located on VLAN 20 ( $10.10.20.5$ ). Which TWO of the following configurations or conditions on the intervening Layer 3 router would directly prevent the client from obtaining a DHCP lease? (Select TWO.)

Select all that apply

The router interface attached to VLAN 10 lacks an IP helper address (DHCP relay agent) configured to forward broadcast request packets to

10.10.20.5

An inbound Access Control List (ACL) applied to the VLAN 10 router interface is blocking UDP traffic targeted at destination ports 67 and 68.

The DHCP server's scope for VLAN 10 has auto-assigned an APIPA address of

169.254.1.50

to the client due to default gateway unreachable errors.

The router's default gateway address for VLAN 20 resides on a different subnet than the DHCP server's IP address.

Show answer & explanation

Answer: The router interface attached to VLAN 10 lacks an IP helper address (DHCP relay agent) configured to forward broadcast request packets to $10.10.20.5$ .; An inbound Access Control List (ACL) applied to the VLAN 10 router interface is blocking UDP traffic targeted at destination ports 67 and 68.

Answer

The client fails to obtain an IP lease because the router interface on VLAN 10 is missing a DHCP relay (IP helper address) to forward broadcast traffic across subnets, and/or an Access Control List on the router is blocking UDP ports 67 and 68 used by DHCP.

DHCP Discover packets are sent as broadcasts (

255.255.255.255

). Routers do not forward broadcasts between subnets unless a DHCP relay agent (IP helper address) is explicitly configured on the receiving interface. Additionally, DHCP relies on UDP ports 67 and 68, so blocking these ports with an ACL on the router interface prevents relay processing.

Step-by-Step Solution

Analyze how DHCP broadcast packets behave at Layer 3 boundaries.

DHCP Discover messages are sent as Layer 2/3 broadcasts, which routers drop by default.

To cross subnets to reach a server on VLAN 20, the router interface on VLAN 10 must have a relay agent (IP helper address) enabled.

Identify required transport protocol ports for DHCP communications.

DHCP traffic uses UDP port 67 for the server and UDP port 68 for the client.

If an ACL on the router blocks these ports, DHCP messages cannot be relayed or processed.

Key Concept

DHCP Relay and Port Requirements for Cross-Subnet IP Addressing Services

Question 1350Question →

Following an internal compliance audit, an enterprise network engineering team must update performance monitoring configurations across core switches. The updated security baseline requires all device metrics polling to enforce cryptographic user authentication as well as full packet payload encryption. Which protocol configuration satisfies these performance monitoring security requirements?

SNMPv3 configured with the authPriv security level

SNMPv3 configured with the authNoPriv security level

SNMPv2c configured with an encrypted community string

SNMPv3 configured with the authPriv security level over TCP port 161

Show answer & explanation

Answer: SNMPv3 configured with the authPriv security level

Answer

SNMPv3 configured with the authPriv security level

SNMPv3 configured with the authPriv (Authentication and Privacy) security level provides cryptographic user authentication using SHA/MD5 hashing alongside payload privacy through encryption algorithms such as AES. This combination directly fulfills the requirement for authenticated and encrypted telemetry polling.

Step-by-Step Solution

Analyze the compliance requirements for device telemetry and polling.

The requirements demand both cryptographic authentication of polling entities and privacy (encryption) for performance metrics payloads.

Ensuring both features prevents unauthorized device polling and passive interception of network state metrics.

Evaluate Simple Network Management Protocol (SNMP) version capabilities and security levels.

SNMPv3 introduces three distinct security models: noAuthNoPriv (no authentication, no encryption), authNoPriv (HMAC authentication without encryption), and authPriv (HMAC authentication with symmetric encryption such as AES).

Only authPriv fulfills both mandatory criteria of authentication and privacy.

Verify the default transport protocol and port for SNMP polling.

Standard SNMP queries operate using UDP as the transport protocol on port 161.

UDP reduces transmission overhead and latency for high-frequency performance metrics polling compared to connection-oriented TCP.

Key Concept

SNMP Security Levels for Performance Monitoring

Question 1351Question →

A network administrator has just completed diagnostic testing and confirmed that a failing Small Form-factor Pluggable (SFP+) optical transceiver on a core switch is causing excessive CRC errors and link flapping. According to the CompTIA troubleshooting methodology, which TWO of the following actions should the administrator take next as part of the immediate following step?

Select all that apply

Develop a detailed plan of action to replace the faulty optical transceiver while identifying any potential operational impacts.

Perform continuous ping tests and bandwidth benchmarking across the link to confirm interface error counters remain at zero.

Execute the physical replacement of the compromised SFP+ module during an approved maintenance window.

Log the root cause, transceiver serial numbers, and vendor RMA details in the enterprise ticketing system for future reference.

Show answer & explanation

Answer: Develop a detailed plan of action to replace the faulty optical transceiver while identifying any potential operational impacts.; Execute the physical replacement of the compromised SFP+ module during an approved maintenance window.

Answer

The administrator should develop a detailed plan of action identifying potential effects and execute the physical replacement of the transceiver during an approved window.

Once a theory of probable cause is confirmed in Step 3 of the CompTIA troubleshooting methodology, the administrator must move to Step 4: 'Establish a plan of action to resolve the problem and identify potential effects', followed by implementing the fix. Developing a structured plan to minimize outage risks and subsequently replacing the hardware during a maintenance window represent the correct actions within this phase.

Step-by-Step Solution

Identify the current phase of the troubleshooting methodology based on the scenario state.

The scenario states that diagnostic testing is complete and the theory of probable cause has been confirmed (Step 3: Test the theory to determine cause).

Determining the completed phase establishes where the administrator is in the CompTIA 6-step sequence.

Determine the mandatory next phase in the official CompTIA sequence.

The immediate next phase is Step 4: Establish a plan of action to resolve the problem and identify potential effects, then implement the solution or escalate.

CompTIA methodology strictly requires planning and assessing impact prior to implementation, followed by implementing the fix.

Select the correct actions that belong strictly to Step 4.

Developing a plan of action while considering potential effects and replacing the module during a scheduled window belong directly to Step 4.

Actions involving verification belong to Step 5, while final logging and documentation belong to Step 6.

Key Concept

CompTIA Troubleshooting Methodology Sequence (Step 3 to Step 4 transition)

Question 1352Question →

A network technician is troubleshooting a suspected physical wiring fault on an unshielded twisted-pair (UTP) Ethernet cable run. Which of the following tools should the technician use to identify pinout errors and locate physical conductor breaks? (Select TWO.)

Select all that apply

Using a wiremap tester to verify pin continuity and detect split pair conditions

Using a Time-Domain Reflectometer (TDR) to locate the precise distance to an open or short circuit

Using a tone generator and probe to measure signal attenuation and crosstalk metrics across individual wires

Using an optical power meter to test insertion loss along the copper cable run

Show answer & explanation

Answer: Using a wiremap tester to verify pin continuity and detect split pair conditions; Using a Time-Domain Reflectometer (TDR) to locate the precise distance to an open or short circuit

Answer

The correct tools are using a wiremap tester to verify pin continuity and detect split pairs, and using a Time-Domain Reflectometer (TDR) to locate the precise distance to an open or short circuit.

A wiremap tester evaluates individual conductor connections to identify open circuits, shorts, reversed pairs, and split pairs across RJ45 terminations. A Time-Domain Reflectometer (TDR) transmits electrical pulses down copper pairs and measures signal reflections to calculate the exact distance to physical damage such as a severed wire or short.

Step-by-Step Solution

Identify tools designed specifically for copper physical layer continuity and fault diagnostics.

Wiremap testers and TDRs evaluate the electrical continuity and physical integrity of copper conductor pairs.

Wiremap testers verify pin assignments and pair alignment, while TDRs send electrical pulses and analyze signal reflections to pinpoint conductor breaks.

Eliminate misapplied or incompatible network testing tools.

Tone probes are limited to physical cable tracing, and optical power meters are strictly designed for fiber optics.

Tone generators do not perform quantitative electrical signal measurement, and optical meters cannot interface with copper conductors.

Key Concept

Selecting Appropriate Tools for Copper Physical Cabling Troubleshooting

Question 1353Question →

A network engineer is troubleshooting name resolution failures for a corporate portal on a Linux workstation. The engineer executes an initial query using `dig @10.50.1.10 portal.corp.local` and receives the following output snippet:

text
;; flags: qr rd ra tc; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0
;; MSG SIZE rcvd: 52

To troubleshoot further, the engineer attempts an explicit TCP query using `dig +tcp @10.50.1.10 portal.corp.local`, which results in a connection timeout after 15 seconds. Standard UDP ICMP reachability to `10.50.1.10` is verified. Which of the following is the root cause of this name resolution failure?

An intermediate network security device is blocking TCP port 53, preventing the resolver from completing DNS fallback after receiving a truncated UDP response.

The DNS server lacks a valid A or AAAA record for portal.corp.local, causing the resolver to fail back to TCP to request missing resource records.

The local workstation resolver incorrectly interprets the truncated flag as an authoritative SERVFAIL response and misroutes the TCP query.

The DNS server protocol implementation requires TCP for initial domain queries and uses UDP only as a secondary fallback protocol.

Show answer & explanation

Answer: An intermediate network security device is blocking TCP port 53, preventing the resolver from completing DNS fallback after receiving a truncated UDP response.

Answer

An intermediate network security device is blocking TCP port 53, preventing the resolver from completing DNS fallback after receiving a truncated UDP response.

The output from `dig` explicitly shows the `tc` (truncation) header flag. According to DNS standard specifications (RFC 1035), when a server response exceeds the maximum allowed payload size for a UDP datagram, the server sets the `tc` bit. Upon detecting this bit, the client's resolver is designed to re-issue the query using TCP on port 53 to receive the full data stream. Because the explicit `dig +tcp` query timed out while UDP/ICMP reachability was confirmed, an intermediate firewall or security control is blocking TCP port 53, preventing the resolution process from completing.

Step-by-Step Solution

Analyze the initial DNS query output flags.

The `dig` output contains the `tc` (truncated) flag, indicating the server's response was larger than the maximum allowed UDP packet size and was cut off.

When a DNS response payload exceeds the UDP limit, the server sets `tc` to instruct the client to re-query using TCP.

Analyze the explicit TCP query result (`dig +tcp`).

The command timed out after 15 seconds.

A timeout specifically on TCP port 53 (while ICMP/UDP reachability exists) points to intermediate filtering (Access Control List or firewall) blocking TCP traffic on port 53.

Synthesize findings to determine root cause.

Because UDP responses are truncated and TCP port 53 is blocked, the client cannot successfully retrieve the complete DNS resource records.

DNS relies on TCP port 53 for fallback when responses exceed UDP size limits. Blocking TCP port 53 breaks large DNS responses.

Key Concept

DNS Protocol Operations & TCP Fallback Truncation Mechanics

Estimated Time:2m 0s

Question 1354Question →

A network administrator is troubleshooting persistent latency spikes and excessive frame retransmissions in an executive conference facility. A site survey reveals that adjacent access points are broadcasting on overlapping 40 MHz channels within the 2.4 GHz spectrum, and legacy 802.11b basic data rates (1 Mbps and 2 Mbps) remain enabled across all radios. Which TWO actions should the administrator take to mitigate these wireless performance issues?

Select all that apply

Reconfigure all 2.4 GHz radios to use 20 MHz channel widths and assign non-overlapping channels (1, 6, or 11).

Increase the RF transmit power on all access points to maximum output to overcome signal attenuation.

Disable basic data rates below 12 Mbps on the wireless controller to eliminate legacy management frame overhead.

Expand the DHCP scope by altering the subnet mask from /24 to /22 to prevent IP address pool exhaustion.

Show answer & explanation

Answer: Reconfigure all 2.4 GHz radios to use 20 MHz channel widths and assign non-overlapping channels (1, 6, or 11).; Disable basic data rates below 12 Mbps on the wireless controller to eliminate legacy management frame overhead.

Answer

Reconfigure all 2.4 GHz radios to use 20 MHz channel widths on non-overlapping channels (1, 6, or 11), and disable basic data rates below 12 Mbps on the wireless controller.

The performance issues are caused by RF channel overlap and airtime congestion. In the 2.4 GHz spectrum, 40 MHz channel bonding consumes almost the entire band, making channel overlap inevitable. Restricting 2.4 GHz radios to 20 MHz channel widths using non-overlapping channels (1, 6, and 11) removes adjacent-channel interference. Additionally, management and control frames must be sent at the lowest enabled basic data rate; disabling legacy rates below 12 Mbps reduces the airtime required for overhead traffic, freeing up RF capacity.

Step-by-Step Solution

Analyze the site survey findings to identify physical layer and airtime efficiency bottlenecks.

Identified two primary issues: 40 MHz channel bonding in 2.4 GHz causing severe channel overlap, and 1-2 Mbps basic data rates causing airtime hogging by management frames.

The 2.4 GHz band only has 83.5 MHz of total spectrum, making 40 MHz channels guarantee overlap; legacy basic rates force control frames (beacons, ACKs) to transmit at slow speeds.

Remediate radio frequency channel overlap in the 2.4 GHz spectrum.

Reduce channel width to 20 MHz and assign channels 1, 6, and 11 across adjacent access points.

20 MHz channel widths allow exactly three non-overlapping channels (1, 6, 11) in North America/standard regulatory domains, eliminating adjacent-channel interference.

Optimize wireless airtime utilization on the controller.

Disable basic rates of 1 Mbps, 2 Mbps, 5.5 Mbps, and 11 Mbps, setting the minimum mandatory rate to 12 Mbps.

Management and multicast frames are sent at the lowest mandatory basic rate. Raising this threshold speeds up frame transmission and reduces channel utilization.

Key Concept

2.4 GHz Channel Planning and Wireless Airtime Efficiency Optimization

Estimated Time:2m 0s

Question 1355Question →

A network technician is troubleshooting a newly deployed web server configured with IP address $10.50.12.35/27$ . The server can ping another host on the local subnet at $10.50.12.34$ , but it cannot reach external networks or receive HTTPS requests from internet clients.

Reviewing the device settings reveals:
- Router LAN Interface IP: $10.50.12.33/27$
- Server Default Gateway: $10.50.12.1$
- Router WAN Interface Inbound ACL:
- `permit tcp any host 10.50.12.35 eq 80`
- `deny ip any any`

Which TWO of the following troubleshooting actions are required to restore full intended connectivity for the server?

Select all that apply

Update the server's default gateway address to

10.50.12.33

Add a rule to the router WAN inbound ACL permitting TCP port 443 traffic to

10.50.12.35

Change the server subnet mask to

255.255.255.0

to include

10.50.12.1

within the local subnet.

Reassign the server interface to the native VLAN to bypass Layer 3 routing for external destinations.

Show answer & explanation

Answer: Update the server's default gateway address to $10.50.12.33$ .; Add a rule to the router WAN inbound ACL permitting TCP port 443 traffic to $10.50.12.35$ .

Answer

The server's default gateway address must be changed to

10.50.12.33

, and an inbound ACL rule permitting TCP port 443 to host

10.50.12.35

must be added to the router's WAN interface.

The host resides on the

10.50.12.32/27

subnet. The gateway IP

10.50.12.1

is outside this subnet, preventing remote network access until updated to the router interface address

10.50.12.33

. Additionally, incoming HTTPS traffic uses TCP port 443, which is blocked by the WAN ACL's implicit deny until an explicit permit rule for TCP port 443 is inserted.

Step-by-Step Solution

Analyze the subnet boundaries for the server's IP configuration.

For

10.50.12.35/27

, the network ID is

10.50.12.32

, the broadcast address is

10.50.12.63

, and usable host IP addresses range from

10.50.12.33

10.50.12.62

Determines whether the gateway address assigned to the server resides on the same local subnet.

Identify the routing error causing external host unreachability.

The configured gateway

10.50.12.1

is on a different subnet (

10.50.12.0/27

), making it unreachable as a Layer 3 next hop. Updating the default gateway to

10.50.12.33

resolves outbound routing.

A host must have a valid default gateway on its local subnet to send packets outside its local segment.

Evaluate the WAN interface inbound ACL for HTTPS traffic.

The ACL permits port 80 (HTTP) but lacks a permit rule for port 443 (HTTPS). Due to the implicit deny rule (`deny ip any any`), incoming HTTPS packets are dropped.

An explicit ACL permit rule for TCP port 443 is necessary to allow inbound HTTPS traffic.

Key Concept

Subnet Default Gateway Alignment & Access Control List Port Filtering

Question 1356Question →

A network engineer is establishing a telemetry and performance monitoring architecture for remote site routers experiencing performance degradation during real-time video conferencing. The solution must capture flow-level metrics such as packet loss and inter-arrival jitter for video traffic while ensuring secure, encrypted polling of router hardware resources (CPU and memory utilization). Which of the following protocols and configurations should the engineer implement? (Select TWO.)

Select all that apply

Configure SNMPv3 with the authPriv security level for polling router resource utilization metrics.

Deploy IPFIX flow telemetry exporting over UDP to collect traffic stream statistics and inter-arrival jitter.

Utilize SNMPv2c with read-only community strings to encrypt bandwidth and system resource telemetry.

Configure IPFIX export over TCP port 161 to guarantee delivery of real-time voice jitter metrics.

Show answer & explanation

Answer: Configure SNMPv3 with the authPriv security level for polling router resource utilization metrics.; Deploy IPFIX flow telemetry exporting over UDP to collect traffic stream statistics and inter-arrival jitter.

Answer

The engineer should implement SNMPv3 configured with the authPriv security level for secure system resource polling and deploy IPFIX flow telemetry over UDP to capture real-time traffic jitter and stream performance metrics.

Configuring SNMPv3 with authPriv provides cryptographic authentication and payload privacy, which secures router CPU and memory utilization queries. Implementing IPFIX over UDP allows the monitoring system to capture detailed flow statistics, tracking packet loss, throughput, and inter-arrival jitter for real-time video streams without transport-layer retransmission latency.

Step-by-Step Solution

Identify the protocol and security configuration required for secure hardware metric polling.

SNMPv3 with authPriv provides cryptographic authentication and encryption for monitoring system metrics like CPU and memory utilization.

SNMPv1 and SNMPv2c transmit community strings in cleartext without payload encryption, whereas SNMPv3 authPriv secures administrative polling.

Select the appropriate flow monitoring protocol and transport for real-time traffic performance.

IPFIX exporting over UDP monitors flow-level performance, capturing packet loss and inter-arrival jitter without retransmission delays.

Flow telemetry protocols like IPFIX analyze packet headers across switch and router interfaces, utilizing UDP to stream performance statistics in real time.

Key Concept

Network Telemetry Protocols and SNMP Security Levels

Question 1357Question →

A network administrator suspects that a twisted-pair copper cable run inside a wall cavity has a broken conductor, causing a complete link failure. Which of the following tools should the administrator use to locate the exact distance to the break along the cable run?

Time-Domain Reflectometer (TDR)

Tone generator and probe

Optical power meter

Wiremap tester

Show answer & explanation

Answer: Time-Domain Reflectometer (TDR)

Answer

Time-Domain Reflectometer (TDR)

A Time-Domain Reflectometer (TDR) issues electrical signals along copper wire pairs and calculates the precise distance to an open or short circuit based on signal reflections.

Step-by-Step Solution

Identify the primary diagnostic requirement in the scenario.

The goal is to measure the distance along a copper cable to locate a conductor break (open circuit).

Different testing tools serve distinct functions; finding the distance to a fault requires signal reflection measurements.

Evaluate the capabilities of metallic cable testing tools.

A Time-Domain Reflectometer (TDR) sends pulses down the cable and analyzes reflected signals to measure distance to cable anomalies.

Impedance changes from breaks or shorts reflect pulses back to the device, enabling accurate distance calculation.

Key Concept

Using a Time-Domain Reflectometer (TDR) to locate distance to faults in copper cabling

Estimated Time:45s

Question 1358Question →

A network technician deploys a 65-meter Category 6A UTP cable run between a core switch and a distribution switch. A basic continuity cable tester indicates proper 1-to-1 pin alignment across all eight conductors (Pin 1 to Pin 1, Pin 2 to Pin 2, etc.). However, when the link is connected to 10GBASE-T ports, the connection frequently drops, exhibits excessive frame errors, and fails to sustain 10Gbps throughput. During physical termination, individual wires from different twisted pairs were incorrectly paired together on adjacent pins (such as pairing pin 3 with pin 4 and pin 5 with pin 6) at both ends of the run. Which physical cabling fault is present in this installation, and which diagnostic tool is required to identify and measure the extent of this failure?

A split pair condition; a cable certifier capable of measuring Near-End Crosstalk (NEXT)

An open pair fault; a tone generator and inductive probe tracking signal propagation

A switch duplex mismatch; a network device CLI analyzing port interface error counters

A Layer 2 PDU encapsulation mismatch; a software packet analyzer capturing data frames

Show answer & explanation

Answer: A split pair condition; a cable certifier capable of measuring Near-End Crosstalk (NEXT)

Answer

A split pair condition is present in the installation, requiring a cable certifier capable of measuring Near-End Crosstalk (NEXT) to detect and quantify the fault.

The correct answer identifies a split pair condition and selects a cable certifier. In twisted-pair Ethernet cabling standards (such as T568A/T568B), specific pins form differential pairs (Pins 1-2, 3-6, 4-5, and 7-8). When an installer connects wires from different pairs to pins intended for a single pair at both ends, DC continuity remains 1-to-1 straight-through, so basic wiremap tools report no errors. However, because the positive and negative signals of a differential pair no longer travel along the same twisted pair of wires, mutual electromagnetic shielding is lost, producing catastrophic Near-End Crosstalk (NEXT) at high signaling rates such as 10GBASE-T. A cable certifier evaluates RF signaling performance, including NEXT, across the frequency spectrum of Category 6A.

Step-by-Step Solution

Analyze the reported symptom and continuity test results

The continuity tester shows straight-through pin-to-pin alignment (1-to-1), ruling out simple opens, shorts, or transposed pins (reversed wiremap).

Standard continuity testers only measure DC electrical continuity and wire alignment, not high-frequency signal integrity.

Evaluate the physical termination details

Wires from separate pairs were placed onto adjacent pin positions (e.g., pin 3 with pin 4, pin 5 with pin 6) at both ends of the cable run.

Twisted pair cabling (such as T568A/T568B) relies on specific pair groupings (pins 1-2, 3-6, 4-5, 7-8) to ensure electromagnetic interference and crosstalk cancel out along the run. Splitting pairs destroys this differential signaling protection.

Identify the cabling anomaly and appropriate testing tool

This fault is defined as a split pair, which causes severe Near-End Crosstalk (NEXT) and attenuation-to-crosstalk ratio (ACR) failure under high frequencies. A cable certifier is required to measure RF parameters like NEXT.

Simple continuity testers or tone probes cannot measure RF parameters or detect split pairs when DC continuity is preserved.

Key Concept

Split Pair Faults and NEXT Measurement

Estimated Time:2m 0s

Question 1359Question →

An organization is implementing a client-based Remote Access VPN using L2TP/IPsec to provide secure connectivity for remote workers through perimeter firewalls and Network Address Translation (NAT) gateways. Which of the following protocol requirements and firewall rules are necessary to establish and maintain this VPN connection? (Select TWO.)

Select all that apply

UDP port 500 must be allowed inbound and outbound for Internet Key Exchange (IKE) Security Association (SA) negotiations.

UDP port 4500 must be permitted to support IPsec NAT-Traversal (NAT-T) when clients reside behind NAT devices.

TCP port 1701 must be permitted through the firewall to provide payload encryption for the un-encapsulated L2TP tunnel.

IP Protocol 51 (Authentication Header) must be enabled to encrypt data payloads and preserve integrity across NAT gateways.

Show answer & explanation

Answer: UDP port 500 must be allowed inbound and outbound for Internet Key Exchange (IKE) Security Association (SA) negotiations.; UDP port 4500 must be permitted to support IPsec NAT-Traversal (NAT-T) when clients reside behind NAT devices.

Answer

UDP port 500 for IKE negotiations and UDP port 4500 for NAT-Traversal are both required for L2TP/IPsec remote access VPN connections across NAT gateways.

For an L2TP/IPsec VPN connection to successfully navigate boundary firewalls and NAT devices, UDP port 500 must be opened for IKE authentication and key exchange, and UDP port 4500 must be permitted to allow NAT-Traversal (NAT-T) encapsulation of ESP data packets.

Step-by-Step Solution

Identify key protocols for IPsec handshake and negotiation

Recognize that Internet Key Exchange (IKE) uses UDP port 500 to authenticate peers and set up Security Associations.

Without allowing UDP port 500 through the boundary firewall, initial key exchange cannot complete.

Analyze the impact of Network Address Translation (NAT) on IPsec traffic

Determine that NAT-Traversal (NAT-T) encapsulates ESP traffic inside UDP port 4500 headers when NAT is detected between endpoints.

Standard IPsec ESP (IP Protocol 50) packets lack port numbers and often fail or experience issues when traversing NAT unless wrapped in UDP 4500.

Evaluate distractor choices regarding transport protocols and encryption roles

Identify that L2TP uses UDP port 1701 (not TCP) and provides no native encryption, while AH (IP Protocol 51) provides no encryption and fails when modified by NAT.

L2TP relies on IPsec for confidentiality, and ESP with NAT-T (UDP 4500) must be used instead of AH for NAT compatibility.

Key Concept

L2TP/IPsec Protocol Requirements and Firewall NAT Traversal

Question 1360Question →

A network administrator is configuring an extended IPv4 Access Control List (ACL) on a core router to permit administrator workstations on subnet $172.20.10.0/24$ to manage remote servers on subnet $10.30.50.0/24$ using Remote Desktop Protocol (RDP). The administrator configures the following ACL entry inbound on the router interface connected to the administrator subnet:

`access-list 110 permit tcp 172.20.10.0 0.0.0.255 eq 3389 10.30.50.0 0.0.0.255`
`access-list 110 deny ip any any`

After applying the ACL, administrators report that RDP connection attempts to the servers time out. Which of the following identifies the configuration error in the ACL entry?

The rule places the port filter parameter (`eq 3389`) after the source subnet instead of after the destination subnet.

The explicit `deny ip any any` statement overrides the permit statement because implicit deny rules take precedence over custom permit entries.

The rule specifies the TCP protocol, whereas standard Remote Desktop Protocol (RDP) connection negotiation relies exclusively on UDP.

The extended ACL is applied on a Layer 3 interface, which limits filtering capabilities strictly to IP addresses rather than Layer 4 port numbers.

Show answer & explanation

Answer: The rule places the port filter parameter (`eq 3389`) after the source subnet instead of after the destination subnet.

Answer

The configuration error is that the port filter parameter (`eq 3389`) is positioned immediately after the source IP address structure instead of after the destination IP address structure in the extended ACL statement.

The correct answer correctly identifies that `eq 3389` was placed after the source network parameters rather than the destination network parameters. In extended ACLs, client-initiated traffic uses dynamic source ports, so service port filters like RDP (TCP 3389) must be appended after the destination IP address.

Step-by-Step Solution

Analyze extended IPv4 ACL syntax structure

Standard extended ACL syntax follows: `access-list [number] permit/deny [protocol] [source IP] [source wildcard] [operator port] [destination IP] [destination wildcard] [operator port]`.

Correct positioning of protocol and port parameters is required for the router to match the proper fields in packet headers.

Evaluate source versus destination port roles for RDP traffic

Client workstations initiate RDP sessions using an OS-assigned ephemeral source port (e.g., 49152–65535) targeted at destination TCP port 3389 on the server.

Placing `eq 3389` immediately after the source address `172.20.10.0 0.0.0.255` causes the router to look for packets with a source port of 3389, which fails to match outbound client connection requests.

Determine the required ACL modification

Move the port specification to match destination port 3389: `access-list 110 permit tcp 172.20.10.0 0.0.0.255 10.30.50.0 0.0.0.255 eq 3389`.

This correctly permits TCP traffic originating from the administrator subnet targeted at port 3389 on the server subnet.

Key Concept

Extended Access Control List (ACL) Syntax and Port Placement

PreviousPage 68 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept