Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 1361Question →

A network audit requires verifying that wireless security standards across company facilities are aligned with their correct cryptographic algorithms and integrity controls. Match each wireless security protocol on the left with its corresponding encryption cipher and integrity mechanism on the right.

Click a left item, then click its matching right item

Items

WEP
WPA2-Personal
WPA3-Personal
WPA3-Enterprise (192-bit mode)

Matches

Show answer & explanation

Answer

WEP pairs with RC4 stream cipher with CRC-32 integrity check; WPA2-Personal pairs with AES-CCMP encryption with CBC-MAC integrity check; WPA3-Personal pairs with AES-CCMP-128 encryption with SAE key establishment; WPA3-Enterprise (192-bit mode) pairs with AES-GCMP-256 encryption with BIP-GMAC-256 integrity check.
Each wireless security standard enforces distinct cipher suites and key management protocols: WEP pairs with RC4 and CRC-32; WPA2-Personal uses AES-CCMP with CBC-MAC; WPA3-Personal incorporates SAE alongside AES-CCMP-128; and WPA3-Enterprise 192-bit mode requires higher-strength AES-GCMP-256 and BIP-GMAC-256.

Step-by-Step Solution

1
Identify the cryptographic mechanism defined for legacy WEP.
WEP uses RC4 for encryption and CRC-32 for integrity.
WEP is an early 802.11 security mechanism notorious for initialization vector reuse and weak CRC-32 integrity checking.
2
Identify the encryption suite mandated by WPA2-Personal.
WPA2-Personal uses AES-CCMP, combining AES encryption with CBC-MAC for data integrity.
The IEEE 802.11i standard introduced CCMP to address the security flaws present in TKIP and WEP.
3
Identify the key exchange and cipher baseline for WPA3-Personal.
WPA3-Personal standardizes on AES-CCMP-128 for payload encryption and utilizes SAE for key exchange.
SAE provides forward secrecy and protects against offline dictionary attacks during pre-shared key handshakes.
4
Identify the enhanced 192-bit cryptographic suit mandated by WPA3-Enterprise high-security mode.
WPA3-Enterprise 192-bit mode requires AES-GCMP-256 payload encryption with BIP-GMAC-256 for management frame protection.
GCMP-256 provides authenticated encryption suitable for high-security commercial and government enterprise deployments.

Key Concept

Wireless Security Standards and Encryption Protocols
Question 1362Question →

A network technician notices severe network performance degradation on a workstation connected to a switch port. Checking the switch port statistics shows a high count of late collisions and alignment errors, while the workstation's network interface card is manually set to full-duplex. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The switch interface is operating in half-duplex mode, causing a duplex mismatch.

Answer

The switch interface is operating in half-duplex mode, causing a duplex mismatch.
A duplex mismatch occurs when one end of an Ethernet link runs in full-duplex mode and the other operates in half-duplex mode. The half-duplex port senses collisions while the full-duplex port transmits arbitrarily, resulting in late collisions, FCS errors, and poor throughput.

Step-by-Step Solution

1
Analyze the reported port symptoms and interface error counters.
The presence of late collisions specifically indicates that one side of the link is attempting CSMA/CD collision detection (half-duplex) while the other side transmits simultaneously without checking for carrier sense (full-duplex).
Late collisions occur when a collision is detected after the first 64 bytes of a frame have been transmitted, which is characteristic of a duplex mismatch.
2
Evaluate the configuration state of both link endpoints.
Since the workstation is hardcoded to full-duplex, the switch port autonegotiation likely failed or was manually set to half-duplex.
Duplex autonegotiation standard specifies that if autonegotiation fails on one end, the port defaults to half-duplex mode.

Key Concept

Duplex Mismatch Identification
Question 1363Question →

A network engineering team is preparing to implement a major SD-WAN traffic steering policy update across all enterprise branch locations. Place the standard change management steps in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological order is: 1) Draft and submit a formal RFC with a rollback plan, 2) Present the RFC to the CAB for authorization, 3) Schedule the maintenance window and notify stakeholders, 4) Create configuration backups and deploy the change during the maintenance window, and 5) Perform post-implementation verification, update documentation, and close the RFC ticket.
The standard network change management workflow progresses systematically through request formulation (RFC creation with risk analysis and rollback plans), advisory review (CAB approval), logistics and communication (window scheduling and user notifications), controlled deployment (pre-change backups and execution), and post-deployment closure (testing, documentation updates, and RFC ticket closure).

Step-by-Step Solution

1
Identify the initial proposal phase.
The process must begin with drafting and submitting an RFC that includes impact analysis and rollback steps.
Changes cannot be evaluated or approved without a formal request specifying the scope and safety plan.
2
Determine the approval phase.
The RFC is submitted to the Change Advisory Board (CAB).
Authorized oversight ensures changes do not conflict with other operational events or introduce unvetted business risks.
3
Determine the preparation phase prior to execution.
Schedule the maintenance window and notify affected users.
Stakeholder communication ensures organizational awareness before service impacts occur.
4
Identify the execution phase.
Perform baseline backups and deploy the policy changes.
Backups ensure state recovery if deployment fails, and deployment must occur within the authorized window.
5
Determine the post-execution phase.
Validate functionality, update documentation, and close the ticket.
A change is only complete when verified operational, baseline documentation reflects reality, and administrative record-keeping is closed.

Key Concept

Standard Network Change Management Lifecycle
Question 1364Question →

Match each network attack vector to its primary technical mechanism or observed network anomaly.

Click a left item, then click its matching right item

Items

Rogue DHCP Server
TCP SYN Flood
MAC Flooding
SSL/TLS Stripping

Matches

Show answer & explanation

Answer

Rogue DHCP Server matches issuing unauthorized IP configuration settings to client endpoints; TCP SYN Flood matches exhausting the target host connection backlog queue with half-open requests; MAC Flooding matches overflowing the Layer 2 switch CAM table to force broadcast state; SSL/TLS Stripping matches downgrading HTTPS communications to unencrypted HTTP.
Each network attack vector targets a specific layer or operational protocol: Rogue DHCP misdirects network layer routing by spoofing configuration offers; TCP SYN floods exhaust transport layer state queues; MAC flooding saturates data link layer switch address tables; SSL/TLS stripping manipulates application/session layer encryption negotiation.

Step-by-Step Solution

1
Identify the primary operational target and mechanism of a Rogue DHCP Server.
Rogue DHCP servers exploit client broadcast discovery to assign unauthorized gateway and DNS settings.
Clients accept configuration settings from the fastest responding DHCP offer on the network segment.
2
Analyze the impact of a TCP SYN Flood on system resources.
Flooding incomplete handshakes exhausts the target server backlog queue.
The server allocates state memory for each SYN request and waits for an ACK packet that never arrives.
3
Determine the effect of MAC Flooding on switch behavior.
Overwriting switch CAM table entries forces the switch into fail-open (hub-like) broadcast mode.
When the lookup table cannot store new MAC-to-port mappings, unicast frames are flooded out all ports to ensure delivery.
4
Evaluate the objective of SSL/TLS Stripping during proxy interception.
Forces encrypted web sessions down to unencrypted HTTP sessions.
The proxy rewrites secure HTTPS links and location headers before forwarding response content to the endpoint browser.

Key Concept

Common Network Attack Types and Vectors
Question 1365Question →

A network administrator is troubleshooting connectivity failures for dynamic clients in a newly provisioned branch office. Users on VLAN 102 (10.102.4.0/2210.102.4.0/22) report that their workstations periodically lose connection to local corporate resources and display IP addresses in the 169.254.x.x169.254.x.x range. The centralized dual DHCP redundant servers reside on VLAN 10 (10.10.1.510.10.1.5 and 10.10.1.610.10.1.6).

Upon reviewing the Core L3 Switch configuration and DHCP server diagnostics, the administrator notes the following:
text Interface VLAN 102 description Workstation_Subnet ip address 10.102.4.1 255.255.252.0 ip helper-address 10.10.1.5 ! DHCP Server Scope Statistics (10.102.4.0/22): Active Leases: 1022 / 1022 (100% Utilized) Default Lease Time: 8 Days Environment Type: High-density roaming laptop conference area

Which of the following actions should the network administrator perform to resolve the IP address assignment failures and ensure high-availability DHCP relay operations? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Add a second `ip helper-address 10.10.1.6` command under the Interface VLAN 102 configuration on the Core L3 Switch.; Decrease the DHCP lease duration on the server scope and implement shorter lease periods suited for transient device environments.

Answer

The network administrator must add the second DHCP relay address (`ip helper-address 10.10.1.6`) on the VLAN subinterface for relay redundancy, and reduce the DHCP scope lease duration on the DHCP server to mitigate scope exhaustion caused by transient devices.
The scenario highlights two distinct IP addressing and DHCP troubleshooting issues: scope exhaustion and missing relay redundancy. First, reducing the lease duration allows transient client leases to expire rapidly, recycling addresses back into the pool. Second, configuring the secondary IP helper address (`ip helper-address 10.10.1.6`) on the Layer 3 interface allows the router to forward DHCP unicast requests to both redundant DHCP servers simultaneously.

Step-by-Step Solution

1
Analyze client IP output and DHCP scope state
Workstations receive 169.254.x.x169.254.x.x (APIPA) because the single configured DHCP server's scope is 100% exhausted (1022/10221022/1022 active leases).
An 8-day lease duration in a transient conference environment retains IP assignments long after devices disconnect, leading to exhaustion.
2
Evaluate DHCP Relay (IP Helper) configuration for redundancy
The Layer 3 interface only contains `ip helper-address 10.10.1.5`, omitting the secondary server (10.10.1.610.10.1.6).
Without configuring the second helper address, relay requests are never forwarded to the backup server when the primary server scope is exhausted or unavailable.
3
Select appropriate remediation steps
Adding `ip helper-address 10.10.1.6` ensures dual-relay forwarding, while shortening lease times frees expired leases quickly.
Both steps together resolve immediate capacity bottlenecks and build resilient DHCP relay operations across subnets.

Key Concept

Troubleshooting DHCP Scope Exhaustion and Redundant Relay Agent Placement
Estimated Time:3m 0s
Question 1366Question →

A network administrator is troubleshooting an 802.1Q trunk connection between Switch-1 and Switch-2. Switch-1 is configured with a native VLAN of 10 and allows VLANs 10, 20, and 30 across its trunk interface GigabitEthernet0/1. Switch-2 has its GigabitEthernet0/1 trunk interface configured with a native VLAN of 20 and allows only VLANs 10 and 20. Console logs indicate recurring CDP native VLAN mismatch messages, and workstations residing on VLAN 30 attached to Switch-1 are completely unable to communicate with VLAN 30 hosts attached to Switch-2.

Which TWO configuration adjustments must be performed on Switch-2 to resolve the console error logs and restore VLAN 30 trunking communication?

Select all that apply

Show answer & explanation

Answer: Configure the native VLAN on Switch-2 interface GigabitEthernet0/1 to VLAN 10.; Add VLAN 30 to the allowed VLAN list on Switch-2 interface GigabitEthernet0/1.

Answer

To resolve the issues, Switch-2 must have its trunk native VLAN updated to VLAN 10 to match Switch-1, and VLAN 30 must be explicitly added to the trunk port's allowed VLAN list.
The correct adjustments require aligning the native VLAN ID across both ends of the trunk (setting Switch-2 native VLAN to 10) to clear the CDP native VLAN mismatch log, and expanding Switch-2's allowed VLAN trunk list to include VLAN 30 so that tagged frames for VLAN 30 can be received and forwarded.

Step-by-Step Solution

1
Analyze the native VLAN mismatch error between Switch-1 and Switch-2.
Switch-1 uses VLAN 10 as native, while Switch-2 uses VLAN 20. 802.1Q trunks send native VLAN frames untagged, causing cross-VLAN traffic leakage and log errors.
Both ends of an 802.1Q trunk must agree on the native VLAN ID so untagged frames are properly mapped to the identical broadcast domain on both switches.
2
Analyze the VLAN 30 connectivity failure across the trunk.
Switch-2 allowed list only includes VLANs 10 and 20. VLAN 30 frames sent by Switch-1 are dropped at Switch-2's trunk ingress.
Trunk interfaces prune traffic for VLANs not explicitly included in their allowed VLAN list.
3
Determine the required remedial commands on Switch-2.
Reconfigure Switch-2 GigabitEthernet0/1 to use native VLAN 10 and add VLAN 30 to the trunk allowed VLAN list.
These two steps directly clear the console error and allow VLAN 30 tagged traffic to pass.

Key Concept

802.1Q Trunking Parameters & Native VLAN / Allowed VLAN Troubleshooting
Question 1367Question →

A network administrator is troubleshooting an issue where client workstations can resolve standard hostnames, but queries returning large DNS Security Extensions (DNSSEC) records fail to resolve. To isolate the issue, the administrator runs the following command from an affected host:

$ dig +tcp @10.0.0.53 sec.enterprise.local +dnssec
;; Communications error to 10.0.0.53#53(10.0.0.53): connection timed out

Standard `dig` queries executed without the `+tcp` flag complete successfully over UDP. Which of the following is the most likely root cause of this resolution failure?

Show answer & explanation

Answer: An intermediate firewall or network ACL is blocking inbound or outbound TCP port 53 traffic.

Answer

An intermediate firewall or network ACL is blocking inbound or outbound TCP port 53 traffic.
DNS relies on UDP port 53 for standard queries, but falls back to TCP port 53 whenever response data exceeds the maximum UDP packet size (common with DNSSEC records) or when requested explicitly via tools like `dig +tcp`. Because UDP queries succeed but TCP queries time out, a network firewall or access control list (ACL) is dropping TCP port 53 traffic.

Step-by-Step Solution

1
Analyze the baseline behavior vs the failure condition.
Standard UDP DNS queries to 10.0.0.53 succeed, but forced TCP DNS queries time out.
Isolates the problem specifically to the transport protocol (TCP vs UDP) rather than general IP unreachability or invalid DNS record data.
2
Evaluate protocol requirements for DNS operations.
DNS uses UDP port 53 for standard small lookups, but relies on TCP port 53 when responses exceed payload limits (like DNSSEC) or for explicit TCP queries.
Explains why basic queries work while DNSSEC queries requiring TCP fail.
3
Correlate CLI output timeout with network access controls.
A 'connection timed out' error on port 53 over TCP indicates packet dropping by a firewall or access control list (ACL).
Pinpoints the root cause as blocked TCP port 53 traffic on an intervening network security device.

Key Concept

DNS Transport Layer Protocols (UDP/TCP Port 53)
Question 1368Question →

A network administrator is troubleshooting an issue where a database server at 192.168.50.10/24192.168.50.10/24 cannot establish a connection to a cloud backup endpoint at 172.24.100.45/24172.24.100.45/24. The database server is configured with 192.168.50.1192.168.50.1 as its default gateway.

A traceroute executed from the database server produces the following output:

C:\> traceroute 172.24.100.45
Tracing route to 172.24.100.45 over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 192.168.50.1
2 2 ms 1 ms 2 ms 10.200.1.1
3 * * * Request timed out.
4 * * * Request timed out.

The administrator connects to router 10.200.1.110.200.1.1 and reviews its routing table and interface status:

Gateway of last resort is 10.200.2.2 to network 0.0.0.0

S* 0.0.0.0/0 [1/0] via 10.200.2.2
C 10.200.1.0/30 is directly connected, GigabitEthernet0/0
C 192.168.50.0/24 is directly connected, GigabitEthernet0/1
S 172.24.0.0/16 [1/0] via 10.200.3.2

GigabitEthernet0/0 is up, line protocol is up (IP 10.200.1.1/30)
GigabitEthernet0/1 is up, line protocol is up (IP 192.168.50.1/24)
GigabitEthernet0/2 is down, line protocol is down (IP 10.200.3.1/30)

Which of the following is the root cause of the connectivity failure?

Show answer & explanation

Answer: The router selects the static route 172.24.0.0/16172.24.0.0/16 based on longest prefix match, but its associated outbound interface is down.

Answer

The router selects the static route 172.24.0.0/16172.24.0.0/16 based on longest prefix match, but its associated outbound interface is down.
Routers forward packets based on the Longest Prefix Match rule. Because 172.24.0.0/16172.24.0.0/16 is more specific than the default route 0.0.0.0/00.0.0.0/0, traffic destined for 172.24.100.45172.24.100.45 matches the static route via 10.200.3.210.200.3.2. However, interface GigabitEthernet0/2 is down, causing router 10.200.1.110.200.1.1 to drop the traffic rather than forwarding it.

Step-by-Step Solution

1
Analyze traceroute diagnostic output
The packet successfully reaches hop 1 (192.168.50.1192.168.50.1) and hop 2 (10.200.1.110.200.1.1), but times out at hop 3, indicating the breakdown occurs at router 10.200.1.110.200.1.1.
Identify the specific hop where packet forwarding fails.
2
Evaluate the routing decision logic on router 10.200.1.110.200.1.1
The target address is 172.24.100.45172.24.100.45. The router evaluates candidate routes: default route 0.0.0.0/00.0.0.0/0 vs static route 172.24.0.0/16172.24.0.0/16.
Routers apply Longest Prefix Match (LPM) rules, preferring /16/16 over /0/0 regardless of default gateway settings.
3
Correlate the selected route with interface operational state
The route to 172.24.0.0/16172.24.0.0/16 forwards packets via next-hop 10.200.3.210.200.3.2 out interface GigabitEthernet0/2, which has a status of line protocol down.
Traffic matching a static route pointing to an inactive or down interface will be dropped, preventing failover to less specific routes if not dynamically withdrawn.

Key Concept

Longest Prefix Match Routing and Next-Hop/Interface Unreachability
Estimated Time:2m 0s
Question 1369Question →

A network engineer is troubleshooting an enterprise 10GBASE-SR multimode fiber backbone run measuring 350 meters that connects two core switches across a campus facility. The optical link fails to bring up the interface. An initial power check indicates high optical attenuation along the path, but both transceivers and patch cables test normally. Which diagnostic tool should the engineer use to locate the precise distance to the physical break or microbend within the fiber optic cable run?

Show answer & explanation

Answer: Optical Time-Domain Reflectometer (OTDR)

Answer

An Optical Time-Domain Reflectometer (OTDR) should be used to locate the precise distance to a physical break or bend in a fiber optic cable run.
An Optical Time-Domain Reflectometer (OTDR) injects light pulses into the optical fiber and analyzes backscattered and reflected light signals. By measuring the elapsed time of returned reflections, it accurately plots attenuation along the cable and pinpoints the exact distance to physical discontinuities such as macrobends, dirty splices, or cable breaks.

Step-by-Step Solution

1
Analyze the physical layer requirements and media type.
The scenario specifies a 350-meter 10GBASE-SR multimode optical fiber link.
Choosing the correct diagnostic tool requires selecting media-compatible equipment (optical fiber vs. twisted-pair copper).
2
Differentiate between end-to-end loss testing and fault location pinpointing.
End-to-end attenuation is known, but the specific location of the structural fault inside the conduit needs to be mapped.
An Optical Power Meter confirms total signal loss across the link but cannot measure distance to a fault.
3
Select the tool designed for reflective distance-to-fault analysis over optical fiber.
An OTDR emits optical pulses and analyzes Rayleigh backscattering and Fresnel reflections to output a trace graph showing exact distance markers for events like breaks, bends, and splices.
An OTDR is the definitive tool for locating physical faults along medium-to-long fiber runs.

Key Concept

Fiber Optic Diagnostic Tools and OTDR Operation
Estimated Time:1m 30s
Question 1370Question →

A network administrator runs the `ipconfig` command on a user's workstation that is experiencing network connectivity issues. The command output displays an IPv4 address of 169.254.108.42169.254.108.42 with a subnet mask of 255.255.0.0255.255.0.0. Which of the following best explains the root cause of this configuration?

Show answer & explanation

Answer: The workstation failed to contact a DHCP server and automatically assigned itself an Automatic Private IP Addressing (APIPA) address.

Answer

The workstation failed to contact a DHCP server and automatically assigned itself an Automatic Private IP Addressing (APIPA) address.
When a network interface configured for dynamic addressing cannot reach a DHCP server, Windows client operating systems automatically assign a link-local IP address in the range of 169.254.0.1169.254.0.1 to 169.254.255.254169.254.255.254 using APIPA.

Step-by-Step Solution

1
Analyze the IP address output from ipconfig
The IPv4 address is 169.254.108.42.
Addresses within the range 169.254.0.0/16 are reserved for Automatic Private IP Addressing (APIPA).
2
Identify the conditions under which APIPA is used
APIPA is invoked when a DHCP client requests an IP address lease but receives no response from any DHCP server on the local network or via DHCP relay.
This mechanism allows link-local communication when centralized network IP assignment fails.

Key Concept

APIPA Address Symptom Diagnosis
Estimated Time:45s
Question 1371Question →

During a network maintenance window, a network administrator configures an extended Access Control List (ACL) on a Layer 3 core switch to restrict access from the Engineering VLAN subnet (10.120.4.0/2210.120.4.0/22) to the Data Center subnet (10.120.32.0/2410.120.32.0/24). Shortly after implementation, users report that while HTTP web access to an internal application server at 10.120.32.5010.120.32.50 is functional, secure HTTPS sessions to the same server fail to establish.

The administrator inspects the switch configuration using `show ip access-lists ENG_TO_DC` and retrieves the following output:

text
Extended IP access list ENG_TO_DC
10 permit tcp 10.120.4.0 0.0.3.255 host 10.120.32.50 eq 80
20 deny ip 10.120.4.0 0.0.3.255 10.120.32.0 0.0.0.255
30 permit tcp 10.120.4.0 0.0.3.255 host 10.120.32.50 eq 443

Which of the following identifies the root cause of the HTTPS connectivity failure?

Show answer & explanation

Answer: Rule 20 explicitly denies all IP traffic directed to the Data Center subnet before Rule 30 evaluating HTTPS traffic can be processed.

Answer

Rule 20 explicitly denies all IP traffic directed to the Data Center subnet before Rule 30 evaluating HTTPS traffic can be processed.
Access Control Lists process rules sequentially in numerical order. Rule 20 contains a broad block filtering all IP traffic destined for the 10.120.32.0/24 subnet. When an HTTPS packet arrives, it fails to match Rule 10 (which requires port 80), matches Rule 20, and is immediately dropped. Rule 30 is shadowed and never evaluated.

Step-by-Step Solution

1
Analyze the sequential processing mechanism of Access Control Lists (ACLs).
ACLs process packets top-down, stopping at the first rule that matches packet headers.
Top-down evaluation means higher-numbered sequence rules are never evaluated if a prior rule matches.
2
Evaluate incoming HTTPS packets against the rules in sequence.
An HTTPS packet targeting port 443 does not match Rule 10 (port 80), but matches the broad criteria of Rule 20 (deny ip 10.120.4.0 0.0.3.255 10.120.32.0 0.0.0.255).
Since 'ip' encompasses all Layer 3 payloads (including TCP), Rule 20 matches all remaining traffic to the destination subnet.
3
Determine the impact on Rule 30.
Rule 30 is shadowed and will receive zero packet matches.
Placing a broad deny rule above a specific permit rule creates a logical shadowing defect.

Key Concept

ACL Rule Ordering and Rule Shadowing
Estimated Time:1m 30s
Question 1372Question →

A network security technician is analyzing packet captures from an enterprise user segment after host traffic was unexpectedly intercepted. The packet capture shows multiple unsolicited ARP responses associating the default gateway's IP address with an unauthorized host's MAC address. Which of the following options correctly identify the mechanism behind this incident and an effective defense? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The underlying mechanism relies on sending spoofed gratuitous ARP frames to corrupt local MAC-to-IP translation tables.; Configuring Dynamic ARP Inspection (DAI) on Layer 2 switchports will validate ARP packets against trusted DHCP bindings.

Answer

The attack mechanism involves spoofing gratuitous ARP frames to alter host MAC-to-IP tables, and the effective defense is implementing Dynamic ARP Inspection (DAI) on access switch ports.
Unsolicited ARP replies linking a gateway IP to an attacker's MAC address indicate ARP poisoning. Spoofed gratuitous ARP frames corrupt local ARP tables to intercept network traffic. Implementing Dynamic ARP Inspection (DAI) on Layer 2 switches mitigates this vector by validating ARP responses against the DHCP snooping table.

Step-by-Step Solution

1
Analyze the packet capture anomaly
Unsolicited ARP replies binding the default gateway IP to an unauthorized MAC address indicate local Layer 2 ARP poisoning.
Address Resolution Protocol (ARP) translates Layer 3 IP addresses to Layer 2 MAC addresses without built-in authentication.
2
Identify the specific attack vector mechanism
Spoofed gratuitous ARP messages overwrite neighbor ARP cache entries across the broadcast domain.
Hosts accept incoming unsolicited ARP responses and update their translation tables dynamically.
3
Select the appropriate mitigation control
Dynamic ARP Inspection (DAI) intercept and drop invalid ARP replies on untrusted switch ports.
DAI cross-references incoming ARP requests and responses against the valid IP-to-MAC mappings in the DHCP snooping database.

Key Concept

Address Resolution Protocol (ARP) Poisoning and Dynamic ARP Inspection (DAI)
Question 1373Question →

A systems engineer is troubleshooting a name resolution failure for an internal application alias, `app.corp.net`. When querying the primary DNS server directly using `nslookup`, the following output is returned:

text
$ nslookup app.corp.net 10.150.1.10
Server: dns01.corp.net
Address: 10.150.1.10

** server can't find app.corp.net: NXDOMAIN

Upon reviewing the primary zone configuration, the administrator confirms that `app.corp.net` exists as a valid CNAME record mapping to `web-prod-01.internal.net`. However, `web-prod-01.internal.net` is hosted in a separate private zone that is not configured on or reachable by `dns01.corp.net`.

Which of the following best explains why the DNS server returns an NXDOMAIN error for the CNAME query?

Show answer & explanation

Answer: The DNS server is unable to resolve the canonical host specified in the CNAME record to a valid address record within its available zones.

Answer

The DNS server is unable to resolve the canonical host specified in the CNAME record to a valid address record within its available zones.
When a DNS client queries a record that is configured as a CNAME (Canonical Name), the DNS server must follow the alias to the target FQDN and resolve its corresponding address (A/AAAA) record. If the target FQDN belongs to a zone that is missing, unreachable, or un-delegated, the server cannot fulfill the query chain and returns an NXDOMAIN error.

Step-by-Step Solution

1
Analyze the command output and error code.
The command targets DNS server `10.150.1.10` directly and returns `NXDOMAIN` for `app.corp.net`.
`NXDOMAIN` (Non-Existent Domain) indicates that the server queried believes the domain name does not exist in DNS.
2
Evaluate the DNS record configuration described in the scenario.
`app.corp.net` is a CNAME record pointing to `web-prod-01.internal.net`.
Resolving a CNAME record requires a two-step resolution process: looking up the alias, and then resolving the canonical target hostname to an IP address (A or AAAA record).
3
Correlate the missing target zone with the resolution failure.
Because `web-prod-01.internal.net` resides in an unlinked private zone, the DNS server fails to complete the canonical name lookup.
If the canonical target name cannot be resolved to an IP address by the server, the final response returned to the client for the CNAME lookup is `NXDOMAIN`.

Key Concept

DNS CNAME Resolution Chaining and NXDOMAIN Failure Modes
Estimated Time:2m 0s
Question 1374Question →

A network technician is investigating a client workstation that fails to resolve the internal hostname `app.finance.local`. Place the following diagnostic steps in the correct order, starting from initial client configuration verification through transport layer troubleshooting.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper troubleshooting sequence moves from local client IP configuration verification, to clearing local host resolution mechanisms (HOSTS file and DNS resolver cache), to testing direct DNS server resolution via `nslookup`, and finally checking transport connectivity on port 53.
A methodical name resolution troubleshooting workflow starts by validating client IP/DNS configuration, clearing local client-side caches and static lookup overrides, querying the designated DNS server directly to test record availability, and lastly verifying port 53 reachability if timeouts occur.

Step-by-Step Solution

1
Verify client TCP/IP configuration
Confirms the workstation possesses a valid IP, subnet mask, default gateway, and correct DNS server IP.
Troubleshooting should start at Layer 3 client settings to ensure the endpoint knows which DNS server to query.
2
Check and clear local name resolution state
Eliminates bad static overrides in the local `HOSTS` file and flushes stale cache records.
Operating systems query local file maps and DNS resolver caches prior to sending network DNS requests.
3
Perform direct DNS resolution query
Determines whether the DNS server returns an IP address, an NXDOMAIN error, or a server failure response.
Direct diagnostic tools like `nslookup` bypass local caching to evaluate DNS server operational status and zone records.
4
Verify transport layer filtering and reachability
Identifies if firewall ACLs or intermediate network devices are dropping UDP or TCP port 53 traffic.
If DNS queries time out completely, network access controls or port-level filtering must be diagnosed.

Key Concept

Systematic DNS and Host Name Resolution Troubleshooting Sequence
Question 1375Question →

A network administrator investigating wireless network instability observes that corporate laptops are repeatedly disconnected from the primary access point after receiving spoofed 802.11 management frames. Immediately following these disconnections, several client devices automatically connect to a nearby unauthorized access point broadcasting the same Service Set Identifier (SSID). Which of the following attack types is primary driver behind this network disruption?

Show answer & explanation

Answer: Wireless deauthentication attack

Answer

The correct attack vector is a wireless deauthentication attack.
The correct answer identifies a wireless deauthentication attack. In legacy 802.11 standards, management frames such as deauthentication requests are unencrypted and unauthenticated. Attackers exploit this vulnerability by spoofing the MAC address of the legitimate AP and transmitting deauth frames to force client disassociation, often driving clients onto an Evil Twin AP.

Step-by-Step Solution

1
Analyze the observed anomaly and frame types in the incident description.
The attack explicitly utilizes spoofed 802.11 wireless management frames to disassociate connected clients from their legitimate access point.
Identifying the specific protocol layer and frame type isolates Layer 2 wireless disassociation mechanisms.
2
Correlate the client behavior following the disconnections.
Clients attempt to re-establish connectivity and connect to an unauthorized rogue AP broadcasting the same SSID (an Evil Twin setup).
Deauthentication attacks are typically executed to force endpoints to re-authenticate, driving them onto rogue access points controlled by an attacker.

Key Concept

Wireless Deauthentication and Rogue AP (Evil Twin) Attack Vectors
Estimated Time:1m 15s
Question 1376Question →

A network security engineer is configuring a central remote-access VPN gateway to integrate with an external authentication server. According to the organization's compliance policy, the selected authentication protocol must encrypt the entire packet payload during transit and strictly separate authentication from authorization duties. Which protocol should the engineer implement on the VPN gateway?

Show answer & explanation

Answer: TACACS+

Answer

TACACS+ is the correct choice because it encrypts the full payload of access control packets and decouples authentication, authorization, and accounting functions.
TACACS+ provides full payload encryption (encrypting all data following the standard header) and strictly separates authentication, authorization, and accounting into distinct, independent processes.

Step-by-Step Solution

1
Analyze the policy requirements stated in the scenario.
The requirements mandate full payload encryption and explicit separation of authentication from authorization.
Security characteristics of AAA protocols differ fundamentally in how traffic is encrypted and how access control functions are structured.
2
Compare RADIUS and TACACS+ encryption mechanisms.
RADIUS encrypts only the password attribute in Access-Request packets, whereas TACACS+ encrypts the entire packet body following the header.
Full payload encryption prevents unauthorized eavesdropping of usernames, accounting logs, and authorization command sets.
3
Evaluate the architectural decoupling of AAA functions.
TACACS+ maintains independent operational components for authentication, authorization, and accounting over TCP port 49.
Decoupling AAA functions allows fine-grained command-by-command authorization policies independent of user authentication.

Key Concept

RADIUS vs TACACS+ Protocol Architecture and Security Features
Question 1377Question →

A network technician is troubleshooting a workstation that cannot communicate with servers on remote subnets. The technician executes `ipconfig` on the workstation and observes the following network settings:

text
IPv4 Address. . . . . . . . . . . : 192.168.1.50
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.2.1

The workstation can ping local host 192.168.1.10192.168.1.10, but all outbound traffic to external networks fails. Which of the following is the root cause of the connectivity failure?

Show answer & explanation

Answer: The default gateway is configured on a different IP subnet than the host.

Answer

The default gateway is configured on a different IP subnet than the host.
For a host device to send traffic outside its local network, its configured default gateway must be an IP address located on the same IP subnet. The host is configured with 192.168.1.50/24192.168.1.50/24, but the gateway is set to 192.168.2.1/24192.168.2.1/24. Because they reside on different subnets, the host cannot ARP for the gateway's MAC address, preventing all traffic destined for remote networks.

Step-by-Step Solution

1
Analyze host IP address and subnet mask.
IP address 192.168.1.50192.168.1.50 with subnet mask 255.255.255.0255.255.255.0 (/24) places the host in the local network range 192.168.1.1192.168.1.1 through 192.168.1.254192.168.1.254.
Determines the valid local subnet boundary.
2
Compare the default gateway address to the host's subnet range.
The configured default gateway 192.168.2.1192.168.2.1 falls into the 192.168.2.0/24192.168.2.0/24 subnet.
Identifies whether the gateway is directly reachable via local Layer 2 broadcast domain.
3
Determine why outbound communication fails.
Because the default gateway is not on the same IP subnet, the host cannot perform ARP resolution to forward off-subnet traffic to its gateway router.
Confirms the root cause of failure for remote destination traffic.

Key Concept

Default Gateway Subnet Matching
Question 1378Question →

A network administrator is troubleshooting an issue where a client workstation fails to connect to an internal database server named `db01.prod.lan`. The technician executes two commands on the workstation and observes the following output:

C:\Users\Admin> ipconfig /displaydns

Record Name . . . . . : db01.prod.lan
Record Type . . . . . : 1
Time To Live . . . . : 86400
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 10.20.4.150

C:\Users\Admin> nslookup db01.prod.lan 192.168.1.10
Server: dns01.corp.lan
Address: 192.168.1.10

Name: db01.prod.lan
Address: 10.20.4.200

Which TWO of the following statements correctly identify the cause of the connection failure and the required step to resolve it?

Select all that apply

Show answer & explanation

Answer: The client system is attempting to connect using a stale IP address stored in its local DNS resolver cache.; Running `ipconfig /flushdns` on the workstation will clear the outdated entry and allow applications to obtain the updated IP address from the DNS server.

Answer

The workstation is attempting to connect to the server using a stale IP address stored in its local DNS resolver cache. Running `ipconfig /flushdns` on the client clears this cached entry so the system queries the authoritative DNS server for the correct address.
The output demonstrates that the client's local DNS resolver cache holds an outdated A record (`10.20.4.150`), which the OS uses when applications initiate network traffic. Because `nslookup` bypasses local client caching and queries the DNS server directly, it returns the current IP address (`10.20.4.200`). Flushing the local resolver cache with `ipconfig /flushdns` purges the stale entry and restores proper connectivity.

Step-by-Step Solution

1
Analyze the output of `ipconfig /displaydns`.
The local DNS cache holds an entry for `db01.prod.lan` pointing to `10.20.4.150` with a TTL of 86,400 seconds.
When standard applications request name resolution, the OS checks its local resolver cache before sending a query across the network.
2
Analyze the output of `nslookup db01.prod.lan 192.168.1.10`.
The DNS server `192.168.1.10` resolves `db01.prod.lan` to `10.20.4.200`.
The `nslookup` utility bypasses local OS cache mechanisms and queries the specified DNS server directly, revealing that the DNS server has the updated record.
3
Determine the necessary remediation.
Clearing the cache via `ipconfig /flushdns` removes the stale entry, forcing subsequent application lookup requests to query the DNS server.
Removing the cached record ensures the client receives the active IP address (`10.20.4.200`).

Key Concept

Operating System DNS Resolver Cache vs. Direct Command-Line DNS Queries
Question 1379Question →

A financial firm is upgrading the wireless infrastructure across its corporate headquarters to comply with updated security policies. The engineering team must implement a wireless architecture that enforces centralized, individual user authentication against an existing RADIUS server and utilizes 256-bit Galois/Counter Mode Protocol (GCMP-256) for data confidentiality. Which wireless security deployment combination directly fulfills these mandate requirements?

Show answer & explanation

Answer: WPA3-Enterprise utilizing 802.1X authentication with GCMP-256 encryption

Answer

WPA3-Enterprise utilizing 802.1X authentication with GCMP-256 encryption
The correct deployment is WPA3-Enterprise utilizing 802.1X authentication with GCMP-256 encryption. WPA3-Enterprise integrates with 802.1X/EAP frameworks to pass user credentials to an enterprise RADIUS server for centralized, per-user authentication. Combined with GCMP-256, it ensures strong cryptographic protection and confidentiality for all client traffic.

Step-by-Step Solution

1
Identify the authentication requirement
Individual credential validation against a RADIUS server requires 802.1X authentication (Enterprise mode), ruling out Personal/PSK modes.
Enterprise modes decouple authentication by leveraging an Extensible Authentication Protocol (EAP) framework connected to a backend RADIUS server.
2
Identify the encryption cipher requirement
Selecting WPA3-Enterprise with GCMP-256 satisfies the modern 256-bit encryption mandate.
GCMP-256 provides authenticated cryptographic protection and is a standard option in modern WPA3 enterprise implementations.

Key Concept

Wireless Security Standards and Encryption Protocols
Question 1380Question →

Match each switching troubleshooting symptom or log message on the left with its underlying root cause on the right.

Click a left item, then click its matching right item

Items

Switch log continuously displays '%CDP-4-NATIVE_VLAN_MISMATCH' on trunk link interface Gig0/1.
Workstation connected to a switch port experiences degraded performance with high counts of late collisions.
Traffic for VLAN 20 fails to pass across an active 802.1Q trunk, while VLAN 10 traffic passes successfully.
An unexpected switch becomes the root bridge after a topology change, causing suboptimal traffic routing.

Matches

Show answer & explanation

Answer

1. CDP native VLAN mismatch logs match with mismatched native VLAN IDs on opposing trunk ends. 2. High late collision counters match with a duplex mismatch configuration. 3. Selective VLAN failure across an operational trunk matches with VLAN exclusion in the allowed VLAN list. 4. Suboptimal root bridge election matches with default or unconfigured STP bridge priority settings.
Each symptom matches its specific Layer 2 switching failure mode: CDP native VLAN mismatch logs indicate mismatched native VLAN settings; late collisions indicate a duplex mismatch; selective VLAN traffic drops point to missing VLAN entries in the trunk allowed list; and unexpected root bridge selection stems from unconfigured STP bridge priority values.

Step-by-Step Solution

1
Analyze the CDP warning log symptom.
Identify that CDP detects mismatched native VLAN settings across an 802.1Q trunk connection.
802.1Q trunks send untagged frames for the native VLAN; if both ends differ, frames are received on the wrong VLAN.
2
Analyze interface statistics showing late collisions.
Identify duplex mismatch as the root cause of late collisions.
Half-duplex interfaces listen for collisions throughout transmission; full-duplex interfaces send continuously without listening, triggering late collisions on the half-duplex peer.
3
Analyze single-VLAN failure on a trunk link.
Identify allowed VLAN list configuration errors.
Trunk interfaces prune traffic for VLANs not explicitly permitted in their allowed VLAN list.
4
Analyze unexpected STP root bridge placement.
Identify unconfigured STP bridge priority.
STP root bridge selection defaults to lowest priority; if priorities are equal, the lowest MAC address becomes root unless priority is explicitly lowered.

Key Concept

Troubleshooting VLAN, Trunking, and Switching Issues
PreviousPage 69 / 112Next
All practice questions — CompTIA Network+ | Examkin