Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 1421Question →

A network engineer is establishing a telemetry and metric collection framework across core switches over an unencrypted management network segment. The solution must support cryptographic authentication and payload encryption for device health polling, as well as low-overhead flow statistics collection for monitoring bandwidth usage across interfaces. Which of the following protocol configurations should the engineer implement? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: SNMPv3 configured with the authPriv security level for polling core device health and metric status.; IPFIX using UDP transport to export flow statistics and bandwidth utilization metrics.

Answer

The engineer should implement SNMPv3 with authPriv security level for polling device health and metrics, and IPFIX over UDP transport for exporting flow-level bandwidth statistics.
Selecting SNMPv3 with authPriv ensures that device management metrics and authentication credentials are encrypted using modern algorithms (such as AES) over untrusted links. Concurrently, using IPFIX over UDP provides low-overhead flow telemetry for capturing traffic metrics across switch interfaces without imposing heavy TCP session management costs.

Step-by-Step Solution

1
Identify the security requirements for device health metric polling over unencrypted management networks.
SNMPv3 with authPriv is required because it enforces both cryptographic authentication and data encryption (privacy).
SNMPv1 and SNMPv2c lack payload encryption and transmit credentials in cleartext.
2
Determine the optimal telemetry mechanism for detailed flow and interface utilization monitoring.
IPFIX over UDP provides scalable, low-overhead push-based flow telemetry for tracking bandwidth utilization.
Flow telemetry protocols like IPFIX stream IP network traffic information efficiently without the overhead of heavy transport layer setups.

Key Concept

Network Performance Monitoring and Telemetry Protocols
Estimated Time:1m 30s
Question 1422Question →

A network administrator is troubleshooting an issue where an application host with IPv4 address 192.168.4.25/24192.168.4.25/24 cannot transmit HTTPS management data to a target server at 10.200.5.50/2410.200.5.50/24. Diagnostic tests reveal that the host can successfully ping its default gateway (192.168.4.1192.168.4.1), but a traceroute to 10.200.5.5010.200.5.50 stops at 192.168.4.1192.168.4.1. Inspecting the gateway router shows the following configuration details:

text
ip route 10.200.5.0 255.255.255.0 192.168.4.1
access-list 105 permit udp host 192.168.4.25 host 10.200.5.50 eq 514

Which TWO of the following factors explain why HTTPS traffic (TCP port 443) fails to reach the destination? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The static route entry uses the gateway router's local LAN IP address as the next hop rather than the upstream router's IP address.; The access control list lacks an explicit permit rule for TCP port 443, resulting in the traffic being blocked by the implicit deny.

Answer

The routing failure occurs because the static route incorrectly references the local gateway's own interface IP address (192.168.4.1192.168.4.1) as the next hop, and the Access Control List lacks a permit statement for TCP port 443, causing HTTPS packets to be dropped by the ACL implicit deny.
The issue stems from two distinct network layer misconfigurations: first, pointing a static route next hop to the router's own inbound interface IP address prevents proper forwarding to the next router; second, ACL 105 only permits UDP port 514 traffic, meaning TCP port 443 traffic hits the implicit deny rule at the end of the ACL.

Step-by-Step Solution

1
Analyze the static route statement: 'ip route 10.200.5.0 255.255.255.0 192.168.4.1'.
Identify that 192.168.4.1 is the router's local LAN interface address, which is invalid as a next hop for outgoing traffic.
Static routes must point to a remote next-hop IP address on an adjacent router interface or an egress interface identifier.
2
Analyze the Access Control List: 'access-list 105 permit udp host 192.168.4.25 host 10.200.5.50 eq 514'.
Determine that only UDP syslog traffic (port 514) is explicitly permitted.
Standard ACL processing matches top-down and drops unmatched traffic at the final implicit deny all statement, blocking TCP port 443 (HTTPS).

Key Concept

Troubleshooting Static Routes and ACL Rules
Question 1423Question →

A network administrator receives complaints about choppy audio and voice distortion during real-time VoIP sessions between two branch offices. Network monitoring shows low overall bandwidth utilization and an average round-trip latency of 30 ms, but packet inter-arrival times fluctuate wildly between 2 ms and 110 ms. Which performance metric is primarily degrading call quality, and which monitoring mechanism provides granular flow-level visibility to analyze this traffic?

Show answer & explanation

Answer: Jitter is the primary metric degrading quality; NetFlow / IPFIX should be deployed for detailed flow-level telemetry.

Answer

Jitter is the primary metric degrading call quality; NetFlow / IPFIX should be deployed for detailed flow-level telemetry.
Jitter measures the fluctuation in packet delay (inter-arrival time variance). In VoIP networks, high jitter causes playout buffer underflows or overflows, resulting in choppy audio. NetFlow and IPFIX capture per-flow metadata across network devices, allowing engineers to isolate voice streams and evaluate packet metrics.

Step-by-Step Solution

1
Analyze the observed symptoms and network metrics.
Bandwidth utilization is low and average latency is 30 ms (acceptable for VoIP), but packet inter-arrival times fluctuate significantly between 2 ms and 110 ms.
Variation in inter-arrival delay is defined as jitter, which directly impacts real-time voice reconstruction in playout buffers.
2
Identify the appropriate monitoring mechanism for granular traffic stream analysis.
NetFlow / IPFIX exports flow metadata (IP addresses, ports, TOS/DSCP tags, packet counts, inter-packet timing), enabling traffic analysis of individual voice streams.
SNMP interface counters only show aggregate traffic volume per interface, whereas flow telemetry provides individual session visibility.

Key Concept

VoIP Performance Metrics and Flow Telemetry
Question 1424Question →

A network security administrator is analyzing recorded security incident logs and anomaly reports across enterprise infrastructure. Match each observed security incident on the left to the corresponding network attack vector on the right.

Click a left item, then click its matching right item

Items

An influx of unexpected ICMP Echo Reply packets hits a targeted host after broadcast ICMP Echo Requests were sent with a spoofed source address.
Traffic intended for an organization's public IP range is redirected through an unauthorized internet service provider via malicious route advertisements.
An attacker on an access port sends traffic encapsulated with nested 802.1Q headers to traverse a native VLAN trunk and reach a restricted segment.
Encrypted web communications between a client and a server are transparently intercepted and converted to plain text HTTP sessions.

Matches

Show answer & explanation

Answer

Incident 1 matches Smurf Attack, Incident 2 matches BGP Hijacking, Incident 3 matches Double-Tagging VLAN Hopping, and Incident 4 matches SSL Stripping.
Each attack vector directly aligns with its specific network manifestation: broadcast ICMP amplification reflects as a Smurf attack; forged routing prefix announcements constitute BGP hijacking; dual 802.1Q tag exploitation corresponds to double-tagging VLAN hopping; and interception that downgrades TLS/HTTPS to cleartext HTTP represents SSL stripping.

Step-by-Step Solution

1
Analyze incident 1 involving ICMP Echo Reply flooding following a broadcast request.
Identify this mechanism as a Smurf attack.
Smurf attacks leverage ICMP broadcast amplification with a spoofed victim source address.
2
Analyze incident 2 involving malicious route announcements rerouting IP prefix traffic.
Identify this mechanism as Border Gateway Protocol (BGP) Hijacking.
Manipulating prefix announcements in BGP forces internet traffic through unauthorized Autonomous Systems.
3
Analyze incident 3 involving nested 802.1Q VLAN headers.
Identify this mechanism as Double-Tagging VLAN Hopping.
The outer tag matches the native VLAN and is removed by the switch, allowing the frame with the second tag to reach another VLAN without routing.
4
Analyze incident 4 involving the downgrade of encrypted HTTPS traffic to unencrypted HTTP.
Identify this mechanism as SSL Stripping.
SSL stripping forces secure web connections down to unencrypted HTTP so an on-path adversary can read data.

Key Concept

Common Network Attack Types and Vectors
Question 1425Question →

A network technician is troubleshooting an intermittent 10GBASE-LR single-mode fiber optic backbone link between two core switches. Interface telemetry reveals elevated bit error rates (BER) and an optical receiver power level well below the specified threshold. Which TWO of the following diagnostic steps or tools should the technician use to isolate the physical layer defect?

Select all that apply

Show answer & explanation

Answer: Measure the optical power loss across the link using an optical power meter calibrated to the 1310 nm operating wavelength.; Inspect the fiber connector ferrule end-faces using a specialized fiber inspection probe to check for dust or surface scratches.

Answer

The technician should measure optical loss using an optical power meter calibrated to 1310 nm and inspect the fiber end-faces with a fiber inspection scope.
Measuring optical attenuation with an optical power meter set to 1310 nm directly quantifies signal loss on single-mode fiber links, while using a fiber inspection scope inspects connector end-faces for microscopic contamination or scratches that cause high insertion loss.

Step-by-Step Solution

1
Identify the media type and reported symptoms.
The link uses 10GBASE-LR single-mode fiber operating at 1310 nm, experiencing low optical power and high BER.
Choosing the appropriate physical troubleshooting tools requires matching tools to optical fiber media characteristics rather than copper twisted-pair.
2
Evaluate optical signal testing methods.
An optical power meter (OPM) calibrated for 1310 nm verifies actual light levels arriving at the receiver.
OPMs measure absolute optical power and signal attenuation against baseline standards.
3
Evaluate physical connector inspection requirements.
A fiber inspection scope allows visual verification of the polished ferrule surface.
Microscopic dust, oils, or scratches on fiber end-faces attenuate light signals and introduce optical return loss.

Key Concept

Fiber Optic Physical Layer Diagnostics and Tool Selection
Question 1426Question →

Following an internal security assessment, a system administrator is tasked with securing the administrative management plane of a core network switch against unauthorized remote access and brute-force authentication attacks. Which of the following hardening practices should the administrator implement on the device? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure virtual terminal (VTY) lines to accept SSH connections exclusively while disabling cleartext Telnet access.; Implement local user login lockout thresholds and rate limiting for consecutive failed administrative authentication attempts.

Answer

The administrator should restrict VTY lines exclusively to encrypted SSH transport and establish local user account lockout thresholds to limit failed authentication attempts.
Hardening the administrative management plane requires restricting virtual terminal (VTY) access to SSH to guarantee encrypted communication, alongside configuring local account lockout thresholds to block brute-force authentication attacks.

Step-by-Step Solution

1
Evaluate remote management protocol security controls.
Identify that Telnet broadcasts credentials in plaintext and must be replaced by SSH on VTY lines.
Cryptographic protection of management sessions prevents network interception and packet sniffing of administrative credentials.
2
Identify protection mechanisms against automated authentication attacks.
Implement account lockout controls and attempt limits for administrative logins.
Lockout thresholds stop brute-force script attempts from trying large numbers of password combinations sequentially.

Key Concept

Device Management Plane Hardening Best Practices
Question 1427Question →

A network technician is troubleshooting a wireless point-to-point bridge between two campus buildings situated 250 meters apart. Following a storm, maintenance crews re-anchored the directional antenna on Building B. Although there is a completely clear line of sight and transmit power settings remain unchanged on both units, the received signal strength indicator (RSSI) has dropped significantly from -58 dBm to -80 dBm. Inspection reveals that the antenna on Building A remains oriented with vertical polarization, whereas the antenna on Building B was reinstalled turned 90 degrees in horizontal polarization. Which of the following is the primary cause of the link degradation?

Show answer & explanation

Answer: Antenna polarization mismatch between the transmitter and receiver

Answer

Antenna polarization mismatch between the transmitter and receiver is the primary cause of the severe RSSI drop.
Wireless signals travel as electromagnetic waves oriented in a specific spatial plane (polarization). For maximum energy transfer, directional bridge antennas must share the same polarization alignment. A 90-degree alignment difference between vertical and horizontal polarization introduces cross-polarization discrimination loss, typically causing a 20 dB to 30 dB drop in received signal power.

Step-by-Step Solution

1
Analyze the physical and RF symptoms reported in the scenario.
The visual line of sight is clear, distance is unchanged, and transmit power settings are identical, yet RSSI dropped by 22 dB after physical reinstallation.
This isolates the problem to a physical radio antenna installation parameter rather than path distance, attenuation obstacles, or radio transmit power.
2
Evaluate the orientation difference between the two directional antennas.
Building A utilizes vertical polarization while Building B's antenna was rotated 90 degrees to horizontal polarization.
Radio waves propagate with electric field vectors aligned to the antenna orientation. Mismatched polarization planes between transmitter and receiver cause significant signal loss (typically 20 dB or more).
3
Select the correct root cause matching the physical findings.
Antenna polarization mismatch correctly accounts for the dramatic drop in RSSI.
Aligning both antennas back to the same spatial polarization plane (both vertical or both horizontal) will restore full RSSI.

Key Concept

Antenna Polarization and Alignment in Wireless Systems
Question 1428Question →

Match each wireless security standard to its corresponding cryptographic cipher and integrity mechanism.

Click a left item, then click its matching right item

Items

WEP (Wired Equivalent Privacy)
WPA (Wi-Fi Protected Access)
WPA2 (Wi-Fi Protected Access 2)
WPA3 (Wi-Fi Protected Access 3)

Matches

Show answer & explanation

Answer

WEP corresponds to RC4 stream cipher with 24-bit IV and CRC-32. WPA corresponds to TKIP with the Michael algorithm. WPA2 corresponds to AES with CCMP. WPA3 corresponds to SAE key exchange with AES-GCMP encryption.
Each wireless security standard aligns with a specific generation of encryption ciphers and integrity mechanisms: WEP uses basic RC4 with a 24-bit IV, WPA introduced TKIP with the Michael MIC, WPA2 mandated AES-CCMP, and WPA3 upgraded authentication to SAE with modern AES-GCMP ciphers.

Step-by-Step Solution

1
Identify legacy and deprecated legacy standards (WEP and WPA)
WEP uses RC4 with a 24-bit IV and CRC-32. WPA upgrades this by introducing TKIP and the Michael algorithm.
WEP was vulnerable due to small static keying flaws, leading WPA to implement per-packet keying via TKIP while retaining hardware compatibility.
2
Identify modern standards (WPA2 and WPA3)
WPA2 standardizes AES-CCMP encryption. WPA3 advances authentication with SAE and utilizes AES-GCMP.
WPA2 required dedicated hardware upgrades for AES-CCMP processing, while WPA3 enforces protected management frames, SAE, and stronger GCMP ciphers.

Key Concept

Evolution of Wireless Encryption Protocols and Integrity Controls
Question 1429Question →

A network operations team is preparing to modify BGP path selection attributes across enterprise border routers to optimize traffic flow. Place the steps of the standard change management process in the correct order from initial proposal to final completion.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order for change management is: 1) Submit a detailed Request for Change (RFC) document detailing the proposed BGP modifications, potential business impact, and a clear rollback plan -> 2) Present the RFC to the Change Advisory Board (CAB) for formal review, risk assessment, and deployment authorization -> 3) Validate and test the BGP route policy updates in an isolated lab environment to ensure configuration syntax and expected traffic steering behavior -> 4) Apply the BGP configuration changes to the production border routers during an authorized maintenance window -> 5) Perform post-implementation verification testing and update the official enterprise network configuration baseline documentation.
A structured change management process follows a strict sequence: defining the scope and rollback plan in an RFC, securing stakeholder approval from the CAB, staging and testing in a lab, applying changes during an authorized maintenance window, and concluding with verification and documentation baseline updates.

Step-by-Step Solution

1
Identify the initial phase of the change management lifecycle.
Creating and submitting the Request for Change (RFC) with complete documentation (scope, risk analysis, rollback plan) occurs first.
Changes cannot be evaluated or scheduled without a formally documented proposal.
2
Determine the governing authorization step.
Presenting the RFC to the Change Advisory Board (CAB) for approval occurs second.
Stakeholders and management must authorize the change and approve the scheduled timeline before implementation activities proceed.
3
Identify pre-deployment validation procedures.
Testing and staging the configuration in a lab/sandbox environment occurs third.
Technical validation confirms command syntax and behavior before touching production systems.
4
Identify the execution phase.
Deploying changes to production network devices during the scheduled maintenance window occurs fourth.
Implementation must occur within approved outage/maintenance windows to protect service availability.
5
Identify the final wrap-up activities.
Performing post-implementation verification and updating configuration baselines occurs fifth.
Confirming functional status and recording the new state into documentation prevents configuration drift and closes out the change.

Key Concept

Structured Change Management Lifecycle
Estimated Time:1m 30s
Question 1430Question →

A network technician is investigating poor application throughput and significant packet loss on an enterprise host connected to switch interface FastEthernet 0/12. Output from the switch console reveals a high count of late collisions, frame check sequence (FCS) errors, and deferred transmissions on the port. A review of device settings shows that the host network interface card (NIC) was manually forced to 100 Mbps Full Duplex, while the connected switchport is configured with default auto-negotiation parameters. Which of the following best explains the root cause of this performance issue?

Show answer & explanation

Answer: The switchport failed auto-negotiation, defaulting to half-duplex mode and creating a duplex mismatch with the full-duplex host.

Answer

The switchport failed auto-negotiation, defaulting to half-duplex mode and creating a duplex mismatch with the full-duplex host.
When an Ethernet interface configured for auto-negotiation connects to a link partner configured for forced (manual) full-duplex, auto-negotiation fails to detect the duplex mode. By IEEE standard convention, the auto-negotiation interface sets its speed using parallel detection but defaults its duplex setting to half-duplex. This mismatch causes the full-duplex side to transmit at will while the half-duplex side detects collisions during transmission after the standard 64-byte slot time (late collisions), leading to FCS errors and severe throughput degradation.

Step-by-Step Solution

1
Analyze the interface statistics and configuration settings.
The switch interface records late collisions and FCS errors, while the host NIC is set to forced 100 Mbps Full Duplex and the switch port is set to Auto-Negotiation.
Late collisions are a signature symptom of a duplex mismatch on an Ethernet segment.
2
Apply Ethernet auto-negotiation standard behavior rules (IEEE 802.3).
Because the host NIC does not transmit auto-negotiation pulses, the switch cannot negotiate duplex and falls back to half-duplex mode.
Standard Ethernet auto-negotiation defaults to half-duplex when speed can be sensed via parallel detection but duplex cannot be negotiated.
3
Determine the impact of half-duplex operating against full-duplex.
The host transmits whenever it has data ready (full-duplex), while the switch listens before transmitting and senses collisions after the 64-byte window (late collisions), causing corrupted frames and FCS errors.
This confirms a duplex mismatch as the root cause.

Key Concept

Duplex Mismatch Troubleshooting & Auto-Negotiation Fallback Rules
Question 1431Question →

A network administrator configures a new extended IPv4 Access Control List (ACL) on a router interface serving an R&D subnet (172.16.30.0/24172.16.30.0/24). The administrator creates specific rules to permit hosts on this subnet to access an internal file server (10.5.5.1010.5.5.10) via FTP. Immediately after applying the ACL inbound on the interface, users on the 172.16.30.0/24172.16.30.0/24 subnet report that they have lost connectivity to the internet and all other company subnets. What is the primary cause of this widespread connectivity failure?

Show answer & explanation

Answer: The ACL ends with an invisible implicit deny statement that drops all traffic not explicitly permitted by preceding rules.

Answer

The connectivity failure occurs because Access Control Lists contain an unwritten implicit deny rule at the end of the rule set, which blocks all traffic that is not explicitly allowed by a preceding permit statement.
Network Access Control Lists operate using sequential evaluation and end with an unwritten implicit 'deny all' rule. When the administrator created permit statements solely for FTP traffic, any packet not matching those specific criteria fell through to the end of the ACL and was dropped by the implicit deny rule.

Step-by-Step Solution

1
Analyze the reported symptom following the ACL application.
Specific traffic (FTP to 10.5.5.1010.5.5.10) was permitted, but all other outbound traffic from subnet 172.16.30.0/24172.16.30.0/24 was blocked.
This indicates that unlisted traffic flows are being filtered out by the router interface.
2
Evaluate standard ACL execution mechanics.
ACLs process packets top-down until a match is found. If no explicit rule matches a packet, it reaches the end of the list where an implicit 'deny all' rule executes.
Because only FTP traffic was permitted, all internet and inter-subnet traffic hit the implicit deny rule and was dropped.
3
Determine the necessary configuration fix.
Add explicit permit rules or an 'permit ip any any' statement at the end of the list if general traffic should be allowed.
Explicit permit statements override the default implicit deny behavior for designated traffic.

Key Concept

ACL Implicit Deny Behavior
Question 1432Question →

A network technician is troubleshooting an Ethernet connection in an office building and suspects that an unshielded twisted-pair (UTP) cable run inside a wall has been physically severed. Which hardware tool should the technician use to determine the exact distance along the cable to the location of the break?

Show answer & explanation

Answer: Time Domain Reflectometer (TDR)

Answer

Time Domain Reflectometer (TDR)
The correct tool is a Time Domain Reflectometer (TDR). TDRs send electrical pulses along copper conductors and analyze the reflected waveforms to determine the distance to opens, shorts, or impedance mismatches.

Step-by-Step Solution

1
Identify the primary requirement of the scenario
The technician needs to locate the specific physical location (distance) of a cable break in a UTP run.
Knowing that a cable is broken is insufficient; locating the distance pinpoints where the cable run needs repair.
2
Evaluate the capabilities of network testing tools
A Time Domain Reflectometer (TDR) transmits a signal down a copper cable and calculates distance based on the time it takes for the signal to bounce back from an impedance mismatch or open wire.
TDR technology specifically measures signal reflection time to estimate distance to faults.

Key Concept

Using Time Domain Reflectometry (TDR) to pinpoint cable fault locations.
Estimated Time:45s
Question 1433Question →

A client computer configured with the IP address 10.0.1.25/2410.0.1.25/24 is unable to access resources on remote networks. An administrator inspects the IP configuration and discovers that the default gateway is set to 10.0.2.110.0.2.1. Which TWO statements accurately describe the cause of this issue and the necessary resolution?

Select all that apply

Show answer & explanation

Answer: The host cannot communicate with the gateway because the configured default gateway IP address resides on a different subnet.; Updating the default gateway address on the host to a valid router interface address within 10.0.1.0/2410.0.1.0/24 will resolve the issue.

Answer

The client computer cannot reach remote networks because its configured default gateway resides on an adjacent subnet rather than its own local IP subnet. Reconfiguring the default gateway address to a valid IP within the local subnet resolves the connectivity failure.
For an IP endpoint to send traffic to external networks, its configured default gateway must be on the same logical IP subnet as the host itself. The host's IP of 10.0.1.25/2410.0.1.25/24 places it on the 10.0.1.0/2410.0.1.0/24 subnet, whereas the configured gateway of 10.0.2.110.0.2.1 resides on the 10.0.2.0/2410.0.2.0/24 subnet. Reconfiguring the host's default gateway address to a router interface within the local 10.0.1.0/2410.0.1.0/24 subnet allows the host to send ARP requests for the gateway and route traffic off the local network.

Step-by-Step Solution

1
Analyze host IP address and subnet mask.
Host IP 10.0.1.2510.0.1.25 with a /24/24 mask (255.255.255.0255.255.255.0) defines the local subnet range as 10.0.1.110.0.1.1 through 10.0.1.25410.0.1.254.
Determines the boundaries of the host's local broadcast domain and valid local IPs.
2
Evaluate the configured default gateway IP address.
The configured gateway 10.0.2.110.0.2.1 falls outside the local 10.0.1.0/2410.0.1.0/24 subnet.
A host cannot send packets to a default gateway unless the gateway's IP address resides within the host's local subnet.
3
Identify corrective actions to restore routing.
Change the default gateway setting on the host to an active router interface IP within the 10.0.1.0/2410.0.1.0/24 subnet.
Allows the host to resolve the gateway's MAC address using ARP and forward off-network traffic properly.

Key Concept

Default Gateway Subnet Mismatch
Question 1434Question →

A workstation connected to a FastEthernet port on a local switch experiences extremely slow speeds and dropped packets. When examining the switch interface statistics, a network administrator observes a high count of late collisions and frame check sequence (FCS) errors on the port. Which of the following configuration issues is the most likely cause of these symptoms?

Show answer & explanation

Answer: A duplex mismatch between the switch port and the connected host interface

Answer

A duplex mismatch between the switch port and the connected host interface is the cause of late collisions and FCS errors.
A duplex mismatch occurs when one end of an Ethernet connection is configured for full-duplex while the other operates in half-duplex. The full-duplex host transmits data continuously without carrier sensing, leading the half-duplex host to detect collisions late in its frame transmission, registering late collisions and FCS/CRC errors.

Step-by-Step Solution

1
Analyze the interface error counters.
Identified high numbers of late collisions and FCS errors on an access port.
Late collisions occur when a device detects a collision after transmitting the first 64 bytes of a frame.
2
Correlate error counters with known Layer 2 duplex operational characteristics.
Full-duplex interfaces transmit without checking for collisions, while half-duplex interfaces listen for collisions. When connected together, the half-duplex side receives incoming frames while transmitting, triggering late collision flags.
This behavior directly produces late collisions, alignment errors, and FCS errors on the interface.

Key Concept

Duplex Mismatch Symptoms
Question 1435Question →

A desktop computer connected to an office Ethernet port is unable to communicate with external web servers or internal resources. A technician reviews the network interface status and observes an assigned IPv4 address of 169.254.108.99169.254.108.99 with a subnet mask of 255.255.0.0255.255.0.0. Which of the following conditions is the most likely cause of this issue?

Show answer & explanation

Answer: The client failed to contact a DHCP server and self-assigned an Automatic Private IP Addressing (APIPA) address.

Answer

The client failed to contact a DHCP server and self-assigned an Automatic Private IP Addressing (APIPA) address.
When a network host configured for dynamic IP assignment sends DHCP discovery requests and does not receive a response from a DHCP server, the operating system assigns a link-local IPv4 address in the 169.254.0.0/16169.254.0.0/16 range (APIPA). This indicates a failure in reaching or receiving a lease from the DHCP service.

Step-by-Step Solution

1
Analyze the IP address assigned to the host
The address 169.254.108.99169.254.108.99 falls into the 169.254.0.0/16169.254.0.0/16 IPv4 address block.
Addresses within 169.254.0.1169.254.0.1 through 169.254.255.254169.254.255.254 are designated specifically for APIPA link-local usage.
2
Identify the underlying trigger for APIPA generation
APIPA occurs automatically when a host configured for dynamic addressing cannot locate or obtain a lease from a DHCP server.
When DHCPDISCOVER packets receive no DHCPOFFER response within the timeout period, the OS assigns a link-local address to allow basic local segment connectivity.

Key Concept

APIPA Address Range and DHCP Failure Symptoms
Question 1436Question →

A network administrator needs to determine the exact distance along a 90-meter copper Ethernet cable run to locate an open circuit break hidden inside a wall. Which tool should the administrator use to measure the distance to the fault?

Show answer & explanation

Answer: Time-Domain Reflectometer (TDR)

Answer

Time-Domain Reflectometer (TDR)
A Time-Domain Reflectometer (TDR) sends high-frequency electrical pulses down copper cable pairs. When a pulse encounters an open break or short, energy reflects back to the source. By measuring the elapsed time of the reflection, the TDR calculates the precise distance to the cable defect.

Step-by-Step Solution

1
Identify the symptom and requirements
The scenario requires measuring the exact physical distance along a copper cable to locate a wire break.
Determining distance to a fault avoids tearing down wall sections unnecessarily.
2
Select the proper diagnostic tool for copper distance measuring
A Time-Domain Reflectometer (TDR) transmits electrical pulses down copper conductors and analyzes signal reflections.
The timing of signal reflections allows the device to compute the precise length to impedance changes or breaks.

Key Concept

Using a Time-Domain Reflectometer (TDR) to locate distance to copper cabling faults.
Question 1437Question →

A network engineer is troubleshooting high CRC frame error rates and severe throughput degradation on a newly installed 90-meter Category 6A UTP cable drop connecting a server to a 10GBASE-T switch port. A basic wiremap continuity test shows all eight conductors properly terminated in pin-to-pin alignment, and a standard Time-Domain Reflectometer (TDR) reports no opens, shorts, or impedance discontinuities along the cable run. However, the link fails to sustain 10Gbps auto-negotiation without dropping packets. Which diagnostic hardware tool or measurement parameter is specifically required to pinpoint the root cause of this performance failure?

Show answer & explanation

Answer: A cable certifier measuring high-frequency Near-End Crosstalk (NEXT) and Return Loss across the 500 MHz frequency band

Answer

A cable certifier measuring high-frequency Near-End Crosstalk (NEXT) and Return Loss across the 500 MHz frequency band
High-frequency Ethernet standards like 10GBASE-T require copper cabling capable of operating without excessive crosstalk or signal reflection up to 500 MHz. While basic wiremap testers confirm electrical pin continuity and TDRs locate physical breaks or shorts, neither tool measures signal quality parameters across the full frequency spectrum. A cable certifier tests parameters such as Near-End Crosstalk (NEXT) and Return Loss, identifying subtle physical errors such as untwisted wire pairs at terminations or split pairs.

Step-by-Step Solution

1
Analyze the physical layer cabling symptoms and existing test results
Basic wiremap verification confirms proper pin-to-pin continuity, and TDR confirms physical cable integrity (no cuts or shorts), ruling out complete physical breaks.
Simple continuity testers and TDRs only verify low-frequency DC continuity and distance to physical impedance anomalies.
2
Identify the high-speed requirements of 10GBASE-T over Cat 6A cabling
10GBASE-T operation requires full compliance up to 500 MHz frequency performance to prevent signal degradation caused by electromagnetic coupling between adjacent wire pairs.
Faults such as split pairs maintain pin-to-pin continuity but severely degrade high-frequency performance due to loss of pair twisting cancellation.
3
Select the appropriate hardware diagnostic tool for frequency-based physical certification
A Category 6A cable certifier performs swept-frequency testing for parameters including Near-End Crosstalk (NEXT), Power Sum NEXT (PS-NEXT), and Return Loss.
Only a cable certifier can validate whether a copper cable run meets the TIA/EIA standards required for 10Gbps Ethernet transmission.

Key Concept

Copper Cable Certification vs. Basic Continuity and TDR Testing
Question 1438Question →

During a routine network security audit, an administrator notices that internal workstation traffic destined for external web services is being redirected to an unauthorized local host on the same switch segment. An inspection of local workstation cache tables reveals that the default gateway's IP address has been mapped to the attacker's network interface card address, allowing the attacker to inspect and modify traffic prior to forwarding it. Which of the following attack types has occurred?

Show answer & explanation

Answer: ARP Poisoning

Answer

ARP Poisoning
ARP Poisoning occurs when an attacker broadcasts spoofed Address Resolution Protocol messages across a local area network. This links the attacker's MAC address with the IP address of a legitimate target, such as the default gateway, enabling the attacker to intercept, inspect, or modify local network traffic.

Step-by-Step Solution

1
Analyze the observed anomaly in the scenario
Workstation traffic destined for the default gateway is being routed to an unauthorized host on the local ethernet segment.
The attacker has modified local workstation address resolution tables.
2
Evaluate the underlying mechanism causing the address cache corruption
The mapping between the default gateway's IP address and a physical MAC address was altered in the local ARP table.
Address Resolution Protocol (ARP) translates Layer 3 IP addresses into Layer 2 MAC addresses on local subnets.
3
Identify the specific network attack matching this mechanism
The attack is ARP Poisoning (or ARP Spoofing).
Unsolicited or malicious ARP responses overwrite legitimate MAC address bindings in the target host's ARP cache.

Key Concept

Address Resolution Protocol (ARP) Poisoning and Man-in-the-Middle (MitM) Attacks
Estimated Time:1m 15s
Question 1439Question →

A network technician needs to inspect a local workstation to view all currently active TCP connections, listening ports, and protocol statistics. Which command-line utility should the technician execute?

Show answer & explanation

Answer: netstat

Answer

The technician should execute netstat to view active TCP connections and listening ports on the system.
The netstat (network statistics) command-line utility displays active TCP connections, ports on which the computer is listening, network adapter statistics, and the local IP routing table.

Step-by-Step Solution

1
Determine the diagnostic requirement
The scenario requires listing active network connections, active sockets, and open listening ports on the local host.
Choosing the appropriate troubleshooting tool requires matching the command function to the desired operational metric.
2
Evaluate the functions of available network utilities
netstat (Network Statistics) provides detailed information about active connections, listening ports, and protocol statistics.
Other utilities serve different purposes such as name resolution (nslookup), IP address assignment display (ipconfig), or ICMP connectivity testing (ping).

Key Concept

Utilizing Command-Line Network Troubleshooting Utilities
Question 1440Question →

A network administrator is deploying a wireless network for standalone IoT inventory scanners in a logistics warehouse. Corporate security policies mandate protection against offline dictionary attacks through Simultaneous Authentication of Equals (SAE) without relying on a centralized RADIUS authentication server. Which wireless security standard should the administrator implement to fulfill these requirements?

Show answer & explanation

Answer: WPA3-Personal

Answer

WPA3-Personal is the correct selection because it utilizes Simultaneous Authentication of Equals (SAE) to secure passphrase-based authentication against offline dictionary attacks without requiring a centralized RADIUS server.
WPA3-Personal incorporates Simultaneous Authentication of Equals (SAE), based on the Dragonfly handshake protocol. SAE secures passphrase authentication against offline dictionary attacks and ensures forward secrecy without requiring the deployment of an 802.1X RADIUS server.

Step-by-Step Solution

1
Analyze the scenario constraints.
The requirements mandate protection against offline dictionary attacks using SAE and explicitly prohibit requiring a central RADIUS server.
Evaluating requirements isolates the exact wireless security framework needed.
2
Differentiate between WPA3 operation modes.
SAE is the defining feature of WPA3-Personal, whereas WPA3-Enterprise mandates 802.1X authentication.
WPA3-Personal replaces legacy PSK with SAE for robust standalone authentication.

Key Concept

WPA3-Personal and Simultaneous Authentication of Equals (SAE)
Estimated Time:1m 0s
PreviousPage 72 / 112Next
All practice questions — CompTIA Network+ | Examkin