All practice questions

A network technician is diagnosing host reachability issues and executes a query using the `dig` command-line utility on a Linux workstation to verify name resolution for `app.corp.local`:

text
$ dig app.corp.local

; <<>> DiG 9.18.1-1-Debian <<>> app.corp.local
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41205
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;app.corp.local. IN A

;; AUTHORITY SECTION:
corp.local. 3600 IN SOA ns1.corp.local. admin.corp.local. 2026072601 7200 3600 1209600 3600

;; Query time: 12 msec
;; SERVER: 192.168.10.5#53(192.168.10.5)

Which of the following describes the root cause of the name resolution failure based on the command output?

A network engineer is analyzing several Layer 2 switching and trunking issues across an enterprise network. Match each observed switch diagnostic indicator or log message on the left to its underlying root cause on the right.

Following a rack migration inside a data center, a 10GBASE-SR OM4 multimode fiber patch run connecting two distribution switches experiences high rates of frame check sequence (FCS) errors and intermittent link flapping. An optical power meter confirms that overall received optical signal power is within acceptable decibel-milliwatt (dBm) thresholds, and inspecting connector end-faces shows no contamination. Which diagnostic tool should the network engineer use to locate the exact position and measure the magnitude of localized optical reflections or physical macrobends along the concealed cable run?

A network engineer is responding to an enterprise network outage affecting internal application access after an infrastructure update. Arrange the following administrative troubleshooting actions in the correct sequence according to the official CompTIA troubleshooting methodology, starting from the earliest phase to the final phase.

A network administrator must configure a top-to-bottom sequence of rules in an extended IPv4 Access Control List (ACL) applied inbound on a router interface serving the internal user VLAN ($192.168.10.0/24$). The ACL must enforce the following security policies for traffic destined to the DMZ web server ($10.0.0.50/32$):

1. Host $192.168.10.5$ must be explicitly allowed HTTPS access ($TCP/443$).
2. Host $192.168.10.5$ must be explicitly denied HTTP access ($TCP/80$).
3. All other hosts on the $192.168.10.0/24$ subnet must be allowed HTTP access ($TCP/80$).
4. All other traffic targeting the DMZ subnet ($10.0.0.0/24$) must be blocked.

Arrange the Access Control List (ACL) statements in the correct top-to-bottom evaluation sequence to ensure all rules execute as intended without rule shadowing.

A network administrator provisions a new VLAN (VLAN 80, subnet $10.80.4.0/22$) on a core multilayer switch. The central enterprise DHCP server resides on VLAN 10 at IP address $10.10.0.10$. Workstations connected to VLAN 80 fail to receive IP configuration parameters dynamically, resulting in clients auto-configuring $169.254.x.x$ IPv4 addresses. A packet capture on the VLAN 80 switchport confirms that workstations are successfully broadcasting `DHCPDISCOVER` packets, but no `DHCPOFFER` packets return. Which of the following interface configuration omissions on the VLAN 80 Layer 3 gateway interface is the root cause of this connectivity issue?

A network engineer is troubleshooting high packet loss and throughput degradation on an 8 km 10GBASE-LR single-mode fiber link connecting two core switches. The switch SFP+ modules report optical receive power levels comfortably within receiver sensitivity thresholds ($-4\text{ dBm}$ received vs. a receiver sensitivity range of $-14\text{ dBm}$ to $+0.5\text{ dBm}$). Interface counters show zero FCS or CRC frame errors. An Optical Time-Domain Reflectometer (OTDR) test reveals a high-amplitude reflective Fresnel spike with an Optical Return Loss (ORL) of $-22\text{ dB}$ at $3.2\text{ km}$, while overall fiber end-to-end attenuation remains normal at $0.4\text{ dB/km}$. Concurrently, packet captures exhibit repeated TCP Out-of-Order and Fast Retransmission packets. Which of the following physical layer anomalies is the primary cause of the degradation?

A network systems engineer is troubleshooting an issue where a newly provisioned Linux database server cannot communicate with remote clients or download updates from an off-site repository at $172.16.50.10$. The server interface configuration and routing table display the following CLI output:

$ ip addr show dev eth0
inet 192.168.45.200/27 brd 192.168.45.223 scope global eth0

$ ip route show
default via 192.168.45.225 dev eth0
192.168.45.192/27 dev eth0 proto kernel scope link src 192.168.45.200

$ ping -c 2 172.16.50.10
connect: Network is unreachable

Based on the diagnostic output, which of the following identifies the root cause of the connectivity failure?

A network administrator is troubleshooting an enterprise wireless network in a multi-story office building. Employees carrying laptops along hallways report brief disconnections and video call freezes when moving between adjacent Access Points (APs). A site survey indicates that AP transmit power is set to maximum on all units ($23\text{ dBm}$), whereas client devices transmit at around $12\text{ dBm}$. Furthermore, seamless roaming protocols are currently unconfigured. Which of the following statements correctly identify a root cause or a proper remediation step for this issue? (Select TWO.)

Users at a corporate branch office report frequent audio distortion and frame freezing during real-time video conferencing calls. The network administrator verifies that total interface bandwidth utilization remains low, but suspects variable packet arrival delay is causing the degradation. The administrator must establish performance polling of router MIB counters for this metric while ensuring management traffic is both cryptographically authenticated and fully encrypted. Which monitoring configuration should the administrator implement?

A network technician is troubleshooting connectivity for workstations in a newly configured department. The workstations are connected to access ports on Switch-A assigned to VLAN 20. However, none of the hosts can acquire an IP address from the DHCP server located across an 802.1Q trunk link connected to the core switch. The technician issues the following CLI command on Switch-A interface GigabitEthernet0/1:

text
Switch-A# show interfaces trunk

Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1

Port Vlans allowed on trunk
Gi0/1 1-10,30-100

Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1,10,30,40

Based on the terminal output and symptoms, which configuration issue on interface GigabitEthernet0/1 is preventing communication for hosts on VLAN 20?

A network engineer must select the appropriate diagnostic tool for various troubleshooting tasks across an enterprise network infrastructure. Match each troubleshooting requirement on the left with the most suitable hardware tester or packet analysis tool on the right.

A network security engineer is updating an organization's wireless security baseline to transition branch offices to WPA3-Enterprise. The baseline mandates individual user credential validation integrated with central directory services and protection against wireless management frame spoofing attacks. Which of the following technical requirements must be included in the WPA3-Enterprise specification? (Select TWO).

A network security engineer is configuring secure management plane controls on a newly installed distribution switch before introducing it to the enterprise network. In what sequence should the engineer execute the baseline hardening steps to properly establish and secure SSH administrative access?

A network engineer is configuring a resilient remote access and out-of-band (OOB) management solution for network hardware installed at an unstaffed edge data center. The implementation must ensure administrators maintain management access to device consoles and can power-cycle unresponsive equipment during a complete failure of the primary WAN link. Which TWO of the following components should be deployed to meet these operational requirements? (Select TWO.)

A security technician is investigating a multi-stage incident on an enterprise network segment. Packet logs reveal that an unauthorized internal host transmitted forged Gratuitous ARP messages to map the IP address of the default gateway to its own physical address. Simultaneously, internal users reported that entering legitimate domain names into their web browsers redirected them to a suspicious external IP address hosted on an unauthorized server. Which of the following attack types were executed during this incident? (Select TWO.)

A network technician needs to perform a localized hardware diagnostic test on a workstation's network interface card (NIC) to verify that its physical transmission and reception circuitry are functioning correctly without connecting the host to an active network switch. Which tool should the technician plug directly into the Ethernet port to conduct this test?

A network administrator is addressing an incident where remote users connected via SSL VPN cannot access internal intranet sites following a gateway software update. The administrator conducted diagnostic packet captures on the gateway and confirmed that the internal security policy was dropping traffic from the SSL VPN IP pool due to an unmapped subnet mask. Which of the following actions should the administrator take NEXT according to the CompTIA troubleshooting methodology?

A network administrator is performing a baseline security hardening audit on core enterprise switches. The security report reveals that idle administrative sessions on virtual terminal (VTY) lines remain active indefinitely when left unattended, and remote management traffic lacks centralized command authorization and traffic encryption. Which set of configuration controls should the administrator implement to best address these findings?

A network security administrator is investigating an incident where external application servers fail to establish TCP sessions with an authentication daemon running on a Linux system. The administrator executes `ss -tulpn` on the target host and receives the following terminal output snippet:

Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
tcp LISTEN 0 128 127.0.0.1:8443 0.0.0.0:* users:(("auth_svc",pid=8812,fd=4))

Based on this command output, which of the following statements correctly identifies the root cause of the connectivity failure for remote clients?