All practice questions

2237 questions

All types2,237 Multiple choice1,150 Multiple select488 Numeric30 Matching350 Ordering201 Short answer18

Match each network attack type on the left with its corresponding operational vector or network signature on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Evil Twin matches with deploying an unauthorized wireless access point broadcasting a legitimate SSID. Wireless Deauthentication matches with transmitting spoofed 802.11 management frames to force client disconnections. RF Jamming matches with emitting continuous high-amplitude radio noise across wireless frequencies. Rogue DHCP Server matches with broadcasting unauthorized network configuration parameters such as default gateway and DNS addresses.

Each attack vector uniquely maps to its specific operating layer and mechanism: Evil Twin (L2 SSID impersonation), Wireless Deauthentication (L2 management frame injection), RF Jamming (L1 radio noise emission), and Rogue DHCP Server (L7/L3 service configuration hijacking).

Step-by-Step Solution

Analyze rogue access point impersonation behavior

Identify that spoofing a legitimate network SSID to intercept client connections describes an Evil Twin attack.

Evil Twins exploit endpoint auto-connect preferences by advertising identical wireless parameters.

Evaluate wireless management frame exploits

Identify that crafting spoofed 802.11 disassociation messages corresponds to a Wireless Deauthentication attack.

Unprotected 802.11 management frames can be forged by attackers to force clients off an access point.

Examine Physical layer interference tactics

Identify that flooding 2.4 GHz or 5 GHz channels with continuous RF noise defines RF Jamming.

RF Jamming operates at OSI Layer 1 by overpowering valid wireless radio signals.

Assess unauthorized network configuration service risks

Identify that issuing unauthorized IP leases with malicious gateway or DNS settings represents a Rogue DHCP Server.

Rogue DHCP servers win response race conditions to misdirect endpoint traffic flows.

Key Concept

Common Network Attack Types and Vectors

Question 1562Question →

A network administrator is investigating a report that newly provisioned database servers residing on VLAN 30 attached to Switch-A cannot communicate with application servers on VLAN 30 connected to Switch-B. Both switches are connected via an 802.1Q trunk on interface GigabitEthernet0/1. The administrator executes a troubleshooting command on Switch-A and observes the following output:

Port	Mode	Encapsulation	Status	Native vlan
Gi0/1	on	802.1q	trunking	1

Port	Vlans allowed on trunk
Gi0/1	1-20, 40-100

Local pings from the database servers to Switch-A's Layer 3 VLAN 30 interface succeed, but traffic crossing to Switch-B is completely dropped. Which of the following identifies the root cause of this connectivity failure?

VLAN 30 is missing from the list of allowed VLANs configured on the trunk interface.

A native VLAN mismatch exists because Switch-A uses VLAN 1 while Switch-B is configured to send tagged frames for VLAN 30.

A duplex mismatch on interface Gi0/1 is causing late collisions that drop all frames tagged with VLAN 30.

Switch-A has been configured with an improper Spanning Tree Protocol (STP) priority, placing interface Gi0/1 into a blocking state.

Show answer & explanation

Answer: VLAN 30 is missing from the list of allowed VLANs configured on the trunk interface.

Answer

VLAN 30 is missing from the list of allowed VLANs configured on the trunk interface.

The trunk output clearly shows that interface Gi0/1 only permits VLANs in the ranges 1-20 and 40-100. Because VLAN 30 is omitted from this allowed list, Switch-A drops all ingress and egress frames tagged for VLAN 30 on this trunk interface.

Step-by-Step Solution

Analyze the CLI trunk output on Switch-A

Interface Gi0/1 is configured as an 802.1Q trunk with native VLAN 1.

Understanding the trunk parameters helps determine how traffic is pruned or allowed across the switch link.

Inspect the 'Vlans allowed on trunk' field

The allowed VLAN range is 1-20 and 40-100.

VLAN 30 falls into the gap between 20 and 40, meaning traffic belonging to VLAN 30 is automatically pruned and dropped at the trunk boundary.

Formulate the corrective action

Add VLAN 30 to the allowed VLAN list on interface Gi0/1 using switchport trunk allowed vlan add 30.

Including VLAN 30 in the allowed list permits tagged frames for VLAN 30 to traverse the trunk link between Switch-A and Switch-B.

Key Concept

802.1Q Trunk Allowed VLAN List Pruning

Question 1563Question →

A system administrator monitoring enterprise server infrastructure notices that a critical database connection experiences low throughput and high packet retransmissions. Interface telemetry on the switch port reveals an increasing count of late collisions, runts, and CRC frame errors, even though link bandwidth utilization remains under 15%. Which of the following interface issues is the most probable root cause of these performance metrics?

A duplex mismatch between the switch port and the database server network card

Physical cable degradation causing excessive electrical attenuation along the run

An unencrypted SNMPv2c polling agent overflowing the port buffer queue

Excessive UDP jitter causing TCP window throttling on management port 161

Show answer & explanation

Answer: A duplex mismatch between the switch port and the database server network card

Answer

A duplex mismatch between the switch port and the database server network card is the most probable root cause.

A duplex mismatch occurs when one end of an Ethernet link operates in full-duplex mode while the opposing end operates in half-duplex mode. The full-duplex device transmits data whenever ready without checking for carrier sense, causing the half-duplex device to detect collisions mid-transmission (late collisions), resulting in runts and CRC frame errors.

Step-by-Step Solution

Analyze the reported interface metrics

Identified low bandwidth utilization (<15%) alongside high rates of late collisions, runts, and CRC errors.

Late collisions occur when a device detects a collision after transmitting the first 64 bytes of a frame, indicating a collision domain timing misconfiguration.

Evaluate layer 2 duplex operation mechanisms

Recognized that when one side of a link is forced to full-duplex and the other auto-negotiates to half-duplex, the half-duplex end senses collisions while the full-duplex end transmits continuously.

This mismatch causes frame corruption, runts, CRC errors, and late collisions on the half-duplex interface.

Correlate symptoms to the correct diagnostic cause

Determined that duplex mismatch directly explains all observed metric anomalies without indicating physical cable failure.

Correctly pinpoints duplex settings rather than cable integrity or SNMP management traffic.

Key Concept

Duplex Mismatch Diagnostic Metrics

Question 1564Question →

An administrator is troubleshooting remote network connectivity for a client workstation configured with the following static IPv4 parameters:

- IP Address: $10.88.32.180$
- Subnet Mask: $255.255.240.0$
- Default Gateway: $10.88.48.1$

The workstation can successfully reach local hosts within the $10.88.32.0/20$ range, but all attempts to communicate with external networks fail. Physical layer diagnostics and switchport configurations are verified to be fully operational. Which of the following represents the root cause of the connectivity failure?

The configured default gateway IP address resides outside the host's IPv4 subnet boundary.

The host IP address is an unassignable subnet broadcast address for the /20 prefix.

The switch ports are assigned to separate untagged VLANs, preventing Layer 2 broadcast discovery.

The router gateway interface has dropped outbound frames due to a transport port and protocol mismatch.

Show answer & explanation

Answer: The configured default gateway IP address resides outside the host's IPv4 subnet boundary.

Answer

The configured default gateway IP address resides outside the host's IPv4 subnet boundary.

The correct option correctly identifies that the gateway IP address (

10.88.48.1

) is located on a different logical IPv4 subnet than the host (

10.88.32.180/20

). A subnet mask of

255.255.240.0

creates subnets in increments of

16

in the third octet. The host's local subnet spans from

10.88.32.0

10.88.47.255

. Because

10.88.48.1

is outside this range, the host cannot communicate with its gateway to route traffic off the local network.

Step-by-Step Solution

Determine the subnet increment and network boundaries for a /20 mask.

A mask of 255.255.240.0 has a 3rd octet block size of 256 - 240 = 16.

Calculating the subnet range identifies which IP addresses belong to the same local broadcast domain.

Identify the specific subnet range for host IP 10.88.32.180.

The network ID is 10.88.32.0 and the valid host range spans 10.88.32.1 through 10.88.47.254, with 10.88.47.255 as the broadcast address.

Evaluating the lower and upper bounds confirms the extent of local IP reachability.

Compare the configured default gateway address against the local subnet bounds.

The default gateway 10.88.48.1 falls into the next subnet block (10.88.48.0/20).

A host cannot ARP for or send traffic directly to a default gateway that does not reside within its local subnet.

Key Concept

Default Gateway Subnet Boundary Troubleshooting

Question 1565Question →

A network technician needs to verify basic Layer 3 IP reachability to a default gateway host at 192.168.1.1 by transmitting ICMP Echo Request messages. Which command-line utility should the technician use?

ping

nslookup

netstat

dig

Show answer & explanation

Answer: ping

Answer

The ping command is used to test ICMP reachability to an IP address.

The ping utility sends ICMP Echo Request messages to an IP address to evaluate reachability and measure network response latency.

Step-by-Step Solution

Identify the primary network troubleshooting task

The requirement is to test basic Layer 3 connectivity using ICMP Echo Request packets to host 192.168.1.1.

Determining if a target responds to ICMP packets establishes whether basic IP routing and interface availability exist between hosts.

Select the utility designed for ICMP reachability checks

The ping tool is specifically built to transmit ICMP Echo Requests and process Echo Replies.

Alternative command-line utilities such as nslookup or dig query DNS records, while netstat reports local protocol sockets and active sessions.

Key Concept

Utilizing Command-Line Network Troubleshooting Utilities

Question 1566Question →

A network administrator is troubleshooting an issue where workstations on a newly provisioned subnet, VLAN 55 ( $172.18.16.0/21$ ), fail to acquire dynamic IP configurations and instead assign themselves addresses in the range $169.254.1.1$ to $169.254.254.254$ .

The central DHCP server ( $10.100.5.10$ ) resides on VLAN 10. The Layer 3 switch routing interface for VLAN 55 is configured as follows:

text
interface Vlan55
ip address 172.18.16.1 255.255.248.0
ip helper-address 10.100.5.10

A packet capture performed at the DHCP server shows that unicast `DHCPDISCOVER` packets forwarded by the Layer 3 switch arrive at the server with a Gateway IP Address (GIADDR) of $172.18.16.1$ , but the DHCP server returns no `DHCPOFFER`. All other subnets using this DHCP server are receiving leases normally.

Which of the following is the MOST likely root cause of this failure?

The `ip helper-address` command must be configured on the DHCP server interface on VLAN 10 rather than on the client VLAN interface.

The client workstations have a misconfigured default gateway that prevents APIPA addresses from routing across VLAN boundaries.

The DHCP server does not have an active scope defined that matches the network segment of the GIADDR (172.18.16.0/21).

The /21 subnet mask defines 2,046 usable host addresses, which exceeds the maximum address pool capacity allowed per DHCP scope.

Show answer & explanation

Answer: The DHCP server does not have an active scope defined that matches the network segment of the GIADDR (172.18.16.0/21).

Answer

The DHCP server lacks an active scope matching the GIADDR network segment (172.18.16.0/21).

When a DHCP relay agent forwards client broadcasts to a central DHCP server, it inserts its local interface IP address into the GIADDR field of the DHCP packet header. The central DHCP server relies on GIADDR to match incoming requests to an active DHCP scope. If the server does not have an active scope corresponding to the relay agent's subnet (172.18.16.0/21), it cannot allocate an address and drops the request without responding.

Step-by-Step Solution

Analyze client symptoms and network packet capture evidence.

Workstations self-assign APIPA addresses (169.254.x.x), indicating DHCP requests are unfulfilled. The packet capture confirms DHCPDISCOVER packets arrive at the central server with GIADDR = 172.18.16.1.

Because the relay agent correctly forwards unicast DHCPDISCOVER packets to 10.100.5.10, physical and Layer 3 reachability between the relay agent and DHCP server is functional.

Evaluate how a DHCP server processes relayed requests based on the GIADDR field.

The server inspects GIADDR (172.18.16.1) to identify which subnet pool to allocate an IP address from.

DHCP servers use the GIADDR IP address to perform a lookup in their scope database for a matching subnet.

Identify why no DHCPOFFER is returned while other subnets function normally.

If no scope exists or if the scope for 172.18.16.0/21 is deactivated/deconfigured, the DHCP server cannot select an available address and silently drops the request.

A missing or inactive scope corresponding to the GIADDR prevents address allocation.

Key Concept

DHCP Relay GIADDR Scope Selection

Estimated Time:2m 0s

Question 1567Question →

A network administrator is investigating an issue where database servers in a secondary rack lose connectivity to primary application servers during nightly backup windows. The administrator gathered user reports, confirmed the link failures, established a theory that an automated backup job was saturating the inter-switch trunk, and performed packet captures during a test run to confirm this theory as the verified root cause. According to the CompTIA troubleshooting methodology, which of the following should the network administrator do NEXT?

Establish a plan of action to rate-limit backup traffic and identify potential side effects.

Apply a Quality of Service (QoS) policy on the trunk switchports to prioritize application traffic.

Execute end-to-end ping and database query benchmarks to confirm uninterrupted connectivity.

Update the infrastructure ticketing system with the packet capture findings and resolution history.

Show answer & explanation

Answer: Establish a plan of action to rate-limit backup traffic and identify potential side effects.

Answer

Establish a plan of action to rate-limit backup traffic and identify potential side effects.

The scenario describes a technician who has successfully tested their theory and verified the root cause using packet captures (Step 3). According to the CompTIA troubleshooting methodology, the direct next phase is Step 4: Establish a plan of action to resolve the problem and identify potential side effects.

Step-by-Step Solution

Identify current position in CompTIA 7-step troubleshooting methodology.

The technician completed Step 1 (Identify problem), Step 2 (Establish theory of probable cause), and Step 3 (Test theory to determine cause by analyzing packet captures).

Determining the completed step dictates the required next action in the rigid methodology sequence.

Determine the sequential next step following Step 3.

Step 4 is 'Establish a plan of action to resolve the problem and identify potential side effects'.

Before making changes in a production network, a technician must design the remediation steps and evaluate potential operational risks or unwanted impacts.

Match the correct step to the corresponding option.

Developing a plan to rate-limit backup traffic while considering potential side effects directly aligns with Step 4.

This maintains administrative safety and adherence to proper change management controls before implementation.

Key Concept

CompTIA 7-Step Troubleshooting Methodology Sequence

Estimated Time:1m 15s

Question 1568Question →

A systems engineer executes the following command to diagnose a connection failure to an internal application server:

text
$ dig @10.0.4.15 app.internal.net A

;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 48219
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;app.internal.net. IN A

;; AUTHORITY SECTION:
internal.net. 3600 IN SOA ns1.internal.net. admin.internal.net. ( 2026072601 7200 3600 1209600 3600 )

Based on the output snippet, which of the following best explains why no IP address was returned for the query?

The DNS server is reachable and authoritative for the domain, but no resource record matching the requested host name and type exists.

The query failed because the client requested an IPv4 A record when the server only supports IPv6 AAAA record resolution.

The command line output indicates that the local client resolver cache has overwritten the authoritative DNS server response.

The DNS query timed out because UDP port 53 traffic was blocked by an intermediate network firewall.

Show answer & explanation

Answer: The DNS server is reachable and authoritative for the domain, but no resource record matching the requested host name and type exists.

Answer

The DNS server is reachable and authoritative for the domain, but no resource record matching the requested host name and type exists.

The correct response identifies that the server successfully answered the query with status NOERROR and zero answer records, supplying the zone SOA record in the authority section. This specific combination signifies a NODATA response, proving the server is authoritative for internal.net but no A record exists for app.internal.net.

Step-by-Step Solution

Examine the dig response header status and section counts

The header shows status: NOERROR, QUERY: 1, ANSWER: 0, AUTHORITY: 1.

Understanding the header flag summary reveals whether the query succeeded at the protocol layer and if any answer records were returned.

Analyze the AUTHORITY section contents

The AUTHORITY section contains the Start of Authority (SOA) record for internal.net.

When a DNS server returns NOERROR with 0 answer records alongside an SOA record, it indicates a NODATA condition (the domain exists on the authoritative server, but the requested host 'app' does not have an A record).

Differentiate NODATA from network transport failures or local resolver issues

Network communication succeeded on port 53 and direct query was made to 10.0.4.15.

Eliminates firewall blocking (which causes timeouts) and local cache interference (since dig directly queries the specified IP).

Key Concept

Interpreting dig output sections and DNS NODATA / SOA responses during resolution troubleshooting.

Estimated Time:1m 15s

Question 1569Question →

A system administrator notices that industrial telemetry sensors on a smart factory floor periodically lose connectivity with an edge gateway after a recent firmware rollout. The administrator duplicated the issue in a lab environment and hypothesized that an aggressive handshake timeout in the new firmware was causing session drops. After adjusting the timeout parameter in the lab, the connectivity issues ceased and the theory was confirmed. According to the CompTIA troubleshooting methodology, which of the following actions should the administrator perform next?

Establish a plan of action to resolve the issue on the production edge gateways and identify potential side effects.

Verify full system functionality by conducting end-to-end monitoring across all production factory floor sensors.

Document the root cause, testing steps, and final resolution in the organization's ticketing system.

Interview the factory floor operators to gather additional symptoms and determine if any physical changes were made.

Show answer & explanation

Answer: Establish a plan of action to resolve the issue on the production edge gateways and identify potential side effects.

Answer

Establish a plan of action to resolve the issue on the production edge gateways and identify potential side effects.

The scenario describes a technician who has already established and successfully tested a theory in a lab environment (Step 3). According to the CompTIA troubleshooting methodology, the next phase is Step 4: Establish a plan of action to resolve the problem and identify potential side effects.

Step-by-Step Solution

Identify the current phase of the CompTIA Troubleshooting Methodology.

The scenario states that the administrator duplicated the issue and verified that altering the timeout parameter fixed the problem in the lab, confirming the cause.

Confirming the cause in a lab environment completes Step 3 (Test the theory to determine cause).

Determine the immediate next step in the standard 6-step CompTIA sequence.

Step 4 is 'Establish a plan of action to resolve the problem and identify potential side effects.'

Before applying fixes to production infrastructure, a plan must be formulated to minimize downtime and prevent unintended side effects.

Key Concept

CompTIA Troubleshooting Methodology Steps (Identify problem -> Establish theory -> Test theory -> Plan of action & implement -> Verify functionality -> Document findings)

Estimated Time:1m 15s

Question 1570Question →

A network technician is investigating performance degradation in a newly renovated office wing. Users report high packet loss and frequent disconnections when connected to the 2.4 GHz wireless network. An RF spectrum audit reveals that neighboring access points in the wing are currently operating on channels 1, 4, and 6. Which of the following configuration changes should the technician implement to resolve the transmission issues?

Reconfigure the access point operating on channel 4 to use channel 11.

Change the access point operating on channel 4 to operate on channel 3 to align closer with channel 1.

Increase the DHCP scope lease pool on the local router servicing the wireless subnet.

Modify the access switch port duplex setting from full-duplex to half-duplex for the access point.

Show answer & explanation

Answer: Reconfigure the access point operating on channel 4 to use channel 11.

Answer

Reconfigure the access point operating on channel 4 to use channel 11.

In 2.4 GHz Wi-Fi deployments, 20 MHz channels require a 5-channel separation to prevent overlapping frequencies. Channels 1, 6, and 11 are the standard non-overlapping channels. Operating on channel 4 causes adjacent-channel interference with neighboring access points on channels 1 and 6. Reconfiguring the channel 4 access point to channel 11 establishes a clean, non-overlapping channel design.

Step-by-Step Solution

Analyze the 2.4 GHz channel deployment plan.

Identified channels in use: 1, 4, and 6.

The 2.4 GHz band has 14 total channels, but only channels 1, 6, and 11 do not overlap with one another.

Identify the cause of wireless performance degradation.

Channel 4 partially overlaps with channel 1 and channel 6, creating adjacent-channel interference (ACI).

Adjacent-channel interference causes signal degradation and frame corruption because radios cannot cleanly decode transmissions from partially overlapping frequencies.

Determine the proper non-overlapping channel configuration.

Reassign channel 4 to channel 11.

Using channel 11 completes a proper 1/6/11 non-overlapping channel cell pattern across the office wing.

Key Concept

2.4 GHz Non-Overlapping Channel Selection and Adjacent-Channel Interference Mitigation

Estimated Time:1m 30s

Question 1571Question →

A network technician is troubleshooting an IP security camera that fails to power on when connected to an RJ-45 wall jack configured for Power over Ethernet (PoE). The technician needs to measure the precise electrical DC voltage output across the specific copper pins at the wall jack to confirm whether the switch port is supplying power. Which hardware tool should the technician use to perform this measurement?

Digital multimeter

Time-Domain Reflectometer (TDR)

Tone generator and probe

Wiremap tester

Show answer & explanation

Answer: Digital multimeter

Answer

A digital multimeter is the correct tool to measure electrical DC voltage across copper cable pins.

A digital multimeter measures electrical potential (DC voltage), current, and resistance. Placing the multimeter test leads across the active PoE conductor pins allows the technician to confirm whether adequate DC power is reaching the wall jack.

Step-by-Step Solution

Identify the primary diagnostic requirement specified in the scenario.

The requirement is to measure electrical DC voltage across specific cable pins providing Power over Ethernet (PoE).

Verifying voltage levels isolates power delivery failures from end-device hardware defects.

Evaluate the capabilities of standard hardware diagnostic tools.

A digital multimeter directly measures electrical voltage (volts), current (amperes), and resistance (ohms).

Cable testing tools such as TDRs, wiremappers, and tone probes test physical continuity, pin alignment, or cable tracing, but lack electrical voltage measurement functions.

Key Concept

Selecting appropriate hardware testing tools for physical layer electrical measurements

Estimated Time:1m 0s

Question 1572Question →

A network administrator is investigating intermittent performance issues on a database server connected to a distribution switch via a multi-mode fiber optic trunk. System logs reveal high physical-layer frame error counts as well as unexpected database session terminations. Which TWO diagnostic actions should the administrator take to accurately pinpoint the physical cable fault and analyze the session disruptions?

Select all that apply

Connect an Optical Time-Domain Reflectometer (OTDR) to the fiber run to measure signal attenuation and identify the exact distance to any physical breaks or excessive splices.

Attach a copper Time-Domain Reflectometer (TDR) to the fiber patch panel to locate impedance mismatches along the optical strand.

Use a packet analyzer with a display filter isolating TCP RST flags and TCP retransmissions to analyze connection teardowns.

Configure a packet analyzer capture filter for UDP port 80 to detect Layer 2 Ethernet framing errors occurring on the physical interface.

Show answer & explanation

Answer: Connect an Optical Time-Domain Reflectometer (OTDR) to the fiber run to measure signal attenuation and identify the exact distance to any physical breaks or excessive splices.; Use a packet analyzer with a display filter isolating TCP RST flags and TCP retransmissions to analyze connection teardowns.

Answer

The correct diagnostic actions are using an Optical Time-Domain Reflectometer (OTDR) to locate physical fiber defects and configuring a packet analyzer display filter for TCP RST flags and retransmissions to evaluate session terminations.

The correct diagnostic steps involve applying an Optical Time-Domain Reflectometer (OTDR) to analyze light reflections and locate physical defects along the multi-mode fiber run, alongside employing a packet analyzer configured with TCP control flag filters (such as TCP RST and retransmission markers) to trace transport-layer session terminations.

Step-by-Step Solution

Identify the physical medium and select the appropriate hardware testing device.

Since the uplink utilizes multi-mode fiber optic cabling, an Optical Time-Domain Reflectometer (OTDR) must be selected rather than a metallic/copper TDR.

OTDRs specifically analyze optical attenuation, backscatter, and distance to faults in fiber optic cables.

Select the appropriate software analysis tool and protocol filter for troubleshooting transport layer session terminations.

Configure a packet analyzer (such as Wireshark or tcpdump) with a filter focused on TCP control flags (specifically TCP RST) and retransmissions.

Database connection terminations operating over connection-oriented TCP emit RST or FIN packets when abnormally severed, which are captured at Layer 4.

Key Concept

Selecting media-appropriate hardware testers (OTDR for fiber optic reflection analysis) and configuring transport-layer packet capture filters for session troubleshooting.

Estimated Time:2m 0s

Question 1573Question →

A workstation on an enterprise network cannot connect to an internal intranet portal by its hostname `portal.local`. A network technician must execute a systematic diagnostic process to isolate whether the issue originates from local client caching, the default DNS resolver, or the authoritative DNS server configuration. In what order should the technician execute the following troubleshooting steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence begins with inspecting the local cache (`ipconfig /displaydns`), flushing stale entries (`ipconfig /flushdns`), testing standard resolution against the default server (`nslookup portal.local`), and finally querying the authoritative DNS server directly (`nslookup portal.local 10.10.10.10`).

The correct order follows standardCompTIA troubleshooting methodology: non-destructive inspection of local client cache (`ipconfig /displaydns`), clearing stale local data (`ipconfig /flushdns`), testing normal client DNS query behavior (`nslookup portal.local`), and isolating infrastructure components by directly querying the authoritative server (`nslookup portal.local 10.10.10.10`).

Step-by-Step Solution

Examine the local system resolver cache.

Identifies if an incorrect IP mapping is stored locally in client memory.

Troubleshooting methodology specifies gathering data non-destructively before modifying local client cache.

Clear the local system resolver cache.

Removes cached records, forcing future queries to hit network DNS infrastructure.

Eliminates stale entries as the root cause of the resolution failure.

Test resolution through the standard configured DNS server.

Determines whether the client's assigned primary DNS server can resolve the hostname.

Evaluates standard network path name resolution performance.

Bypass the default resolver by querying the authoritative DNS server explicitly.

Determines if the authoritative zone contains the valid record or if forwarders/recursive resolvers are failing.

Isolates upstream server configuration errors from local client or recursive DNS server issues.

Key Concept

Systematic DNS Troubleshooting Methodology

Question 1574Question →

A network engineer is responding to reports of severe latency and packet loss affecting handheld inventory scanners in a fulfillment warehouse. A spectrum analysis of the 2.4 GHz band shows that three adjacent Access Points (APs) covering the same zone are configured to use Channel 1, Channel 3, and Channel 4, respectively. Which of the following identifies the primary cause of the wireless connectivity issues?

Adjacent-channel interference caused by overlapping 2.4 GHz channels

Exhaustion of the DHCP scope assigned to the wireless management VLAN

Native VLAN mismatch across the 802.1Q trunk connection to the APs

Physical duplex mismatch between the AP ethernet interfaces and switchports

Show answer & explanation

Answer: Adjacent-channel interference caused by overlapping 2.4 GHz channels

Answer

Adjacent-channel interference caused by overlapping 2.4 GHz channels

The 2.4 GHz Wi-Fi spectrum only contains three non-overlapping channels: Channel 1, Channel 6, and Channel 11. Assigning channels 1, 3, and 4 causes adjacent-channel interference (ACI), where transmissions on neighboring channels corrupt each other's RF signals, leading to high packet loss and latency.

Step-by-Step Solution

Analyze the 2.4 GHz spectrum channel configuration

Channels 1, 3, and 4 overlap significantly in frequency ranges

The 2.4 GHz Wi-Fi spectrum has 22 MHz channel widths spaced 5 MHz apart, requiring at least 5 channels of separation to prevent overlap.

Identify standard non-overlapping channel deployment guidelines

Standard non-overlapping channels in North America/International 2.4 GHz Wi-Fi are 1, 6, and 11

Configuring APs on adjacent overlapping channels (such as 1, 3, and 4) creates adjacent-channel interference (ACI), causing signal corruption and frame retransmissions.

Key Concept

2.4 GHz Non-Overlapping Channel Planning

Question 1575Question →

A network technician is troubleshooting an IP surveillance camera that repeatedly reboots whenever its high-power infrared illuminators activate at night. The camera is powered via Power over Ethernet (PoE) over an 85-meter Category 6 UTP cabling drop. A basic wiremapper confirms correct T568B pinout continuity with no opens or shorts. Which TWO of the following diagnostic findings or procedures are most accurate for identifying and resolving this physical cabling issue?

Select all that apply

High DC resistance resulting from a poor RJ-45 crimp or oxidized IDC punch-down point causes excessive voltage drop when current draw increases.

Using a cable certifier to measure DC loop resistance and resistance unbalance across the individual conductor pairs.

Using a basic continuity wiremapper to measure signal attenuation and high-frequency crosstalk under peak power load.

Deploying an Optical Power Meter (OPM) to measure signal loss along the copper conductor run.

Show answer & explanation

Answer: High DC resistance resulting from a poor RJ-45 crimp or oxidized IDC punch-down point causes excessive voltage drop when current draw increases.; Using a cable certifier to measure DC loop resistance and resistance unbalance across the individual conductor pairs.

Answer

The issue is caused by high DC resistance on the copper conductors (such as a poor crimp or oxidized punch-down), which leads to excessive voltage drop when the camera's current consumption spikes. To properly diagnose this physical layer issue, a cable certifier must be used to measure DC loop resistance and resistance unbalance.

Power over Ethernet (PoE) delivery over long copper runs relies on low DC resistance across wire pairs. High resistance caused by loose IDC terminations or poor crimps creates an excessive voltage drop under heavy current load (such as when IR LEDs engage). Because basic wiremappers only verify 1-to-1 pin connectivity, a cable certifier capable of testing DC loop resistance and unbalance is required to detect high-resistance faults.

Step-by-Step Solution

Analyze the failure symptom under load.

The camera operates normally until IR illuminators turn on, increasing current draw (

I

). According to Ohm's Law (

V_{drop} = I \times R

), higher current through elevated resistance (

R

) produces a large voltage drop (

V_{drop}

), causing the device to brown out.

Basic wiremappers apply minimal current to verify pin continuity, concealing high-resistance terminations.

Select the appropriate diagnostic tool.

Deploy a cable certifier configured to measure DC loop resistance and resistance unbalance.

Advanced cable certifiers detect resistance anomalies across wire pairs that standard continuity testers cannot identify.

Key Concept

DC Loop Resistance and Voltage Drop in PoE Cabling

Question 1576Question →

Following an infrastructure compliance audit, a network engineer must harden a Layer 2 access switch deployed in a branch office. The audit report identified two critical security findings: remote administration sessions transmit management credentials in cleartext, and unassigned physical switch ports remain active in the default VLAN. Which combination of hardening procedures should the engineer implement to remediate these specific vulnerabilities?

Configure SSH for encrypted remote management, shut down all unassigned switch ports, and reassign those ports to an isolated blackhole VLAN.

Configure Telnet over TCP port 22 for management sessions, and leave unassigned switch ports active in the native VLAN with dynamic port security enabled.

Configure SNMPv1 read-write community strings for encrypted device administration, and rely on default VLAN boundary controls for unused interfaces.

Configure HTTPS for web access while keeping unassigned ports active under the assumption that Layer 3 inter-VLAN routing will block unauthorized traffic.

Show answer & explanation

Answer: Configure SSH for encrypted remote management, shut down all unassigned switch ports, and reassign those ports to an isolated blackhole VLAN.

Answer

The engineer should configure SSH to provide encrypted management traffic and shut down all unassigned switch ports while moving them into an isolated blackhole VLAN.

Baseline switch hardening requires securing both the management plane and data plane interface access. Replacing cleartext management protocols with SSH protects administrative credentials from network eavesdropping. Disabling unused physical ports and reassigning them to an isolated, non-routable blackhole VLAN ensures that unauthorized physical connections cannot gain network access or exploit default VLAN privileges.

Step-by-Step Solution

Identify secure management plane replacement protocols for cleartext session vulnerabilities.

SSH replaces Telnet/HTTP by enforcing symmetric and asymmetric encryption for administrative credential transmission and session data.

Cleartext protocols allow attackers on the local segment to sniff management passwords and session cookies.

Determine physical port security baseline hardening steps for unused interfaces.

Disable (shutdown) unassigned ports and assign them to a non-routed, unused VLAN (blackhole VLAN) separate from the native VLAN.

Unconfigured active ports in default VLANs allow rogue physical devices to gain immediate Layer 2 access to internal networks.

Key Concept

Network Device Hardening Best Practices

Estimated Time:1m 30s

Question 1577Question →

A system administrator needs to perform BIOS-level firmware updates and observe the full pre-boot POST process on a critical bare-metal server located in a remote data center. The server's primary operating system is currently unresponsive, and local network adapters are disabled. Which out-of-band remote management technology provides keyboard, video, and mouse interaction at the hardware level regardless of the operating system state?

IP-KVM (Keyboard, Video, and Mouse over IP) switch

Remote Desktop Protocol (RDP) connection

In-band Secure Shell (SSH) management tunnel

SNMPv3 polling agent

Show answer & explanation

Answer: IP-KVM (Keyboard, Video, and Mouse over IP) switch

Answer

The correct solution is to deploy an IP-KVM switch, which operates independently of the host operating system to capture display output and direct peripheral inputs.

An IP-KVM switch connects directly to the hardware display and USB/peripheral interfaces of the server, encoding keyboard, video, and mouse signals across a dedicated out-of-band network. This allows administrators to view the pre-boot POST sequence, access BIOS/UEFI settings, and troubleshoot hardware failures even when the operating system is corrupt or offline.

Step-by-Step Solution

Analyze the operational constraint described in the scenario.

The server's operating system is completely unresponsive, host network adapters are offline, and access is needed at the pre-boot BIOS/POST level.

In-band software protocols (such as SSH or RDP) depend on a running operating system kernel and active OS networking stack.

Evaluate hardware-level Out-of-Band (OOB) access methods.

IP-KVM technology connects directly to the server's physical display out (VGA/HDMI/DisplayPort) and USB ports, encoding the signal for IP transmission across a dedicated management network.

This provides full remote visual and input control even when the host OS is down or failing POST.

Key Concept

Out-of-Band Management using IP-KVM for Hardware-Level Control

Question 1578Question →

A network administrator needs to establish a performance monitoring strategy for a critical enterprise WAN link. The requirements state that the solution must securely collect interface baseline utilization counters without exposing management data to sniffing, while also providing flow-level insight into which specific applications and endpoints are consuming bandwidth. Which of the following protocols and configurations should the administrator deploy? (Select TWO.)

Select all that apply

SNMPv3 configured with the authPriv security level to securely poll interface metrics and device health counters.

IPFIX flow export routed through an encrypted tunnel to provide granular traffic statistics and protocol breakdowns.

SNMPv2c using a complex read-only community string to enforce payload encryption across the WAN link.

Syslog streaming over UDP port 23 to capture interface byte counts and performance telemetry in real time.

Show answer & explanation

Answer: SNMPv3 configured with the authPriv security level to securely poll interface metrics and device health counters.; IPFIX flow export routed through an encrypted tunnel to provide granular traffic statistics and protocol breakdowns.

Answer

Deploying SNMPv3 configured with the authPriv security level alongside IPFIX flow export transmitted over an encrypted tunnel.

Complete network performance monitoring requires both metric counter polling and traffic flow analysis. SNMPv3 with authPriv fulfills the requirement for secure, encrypted baseline metric polling, while IPFIX exports granular flow-level metadata for application bandwidth profiling.

Step-by-Step Solution

Determine the protocol for secure interface baseline metrics.

SNMPv3 with authPriv satisfies authentication and payload encryption requirements for device counter polling.

Legacy SNMP versions (v1 and v2c) transmit community strings in cleartext and do not support payload encryption.

Determine the mechanism for granular flow-level application visibility.

IPFIX (or NetFlow) extracts session telemetry (IPs, ports, byte volume) for traffic breakdown across the link.

SNMP provides interface aggregate counts, whereas flow telemetry reveals which specific endpoints and protocols cause bandwidth spikes.

Key Concept

Combining SNMPv3 authPriv polling with IPFIX flow exporting for comprehensive and secure network performance monitoring.

Estimated Time:1m 30s

Question 1579Question →

A network administrator is troubleshooting remote administration access to an edge router ( $172.28.10.1$ ). Systems engineers on the management network ( $10.40.8.0/24$ ) report that ping requests to the router succeed, but SSH connections to port 22 time out. Upon inspecting the router interface's inbound Access Control List (ACL), the administrator reviews the following entries:

access-list 105 permit icmp 10.40.8.0 0.0.0.255 any
access-list 105 permit udp 10.40.8.0 0.0.0.255 host 172.28.10.1 eq 22
access-list 105 deny ip any any

Which of the following is the root cause preventing SSH access to the router?

The ACL rule specifies UDP port 22 instead of TCP port 22, causing SSH traffic to match the deny rule.

The ACL rule permits ICMP traffic, which automatically overrides TCP and UDP traffic on the same interface.

The management workstations and the router reside on different IP subnets without a VLAN trunk.

The workstations require a direct Layer 2 broadcast domain connection to establish SSH management sessions.

Show answer & explanation

Answer: The ACL rule specifies UDP port 22 instead of TCP port 22, causing SSH traffic to match the deny rule.

Answer

The ACL rule specifies UDP port 22 instead of TCP port 22, causing incoming SSH packets to be dropped by the final deny statement.

SSH utilizes TCP as its transport protocol on port 22. The configured ACL rule permits UDP port 22, causing TCP SSH initiation packets to skip the permit statement and trigger the subsequent explicit deny rule.

Step-by-Step Solution

Analyze transport protocol requirements for SSH

SSH requires TCP port 22 for reliable stream-oriented communication.

Identifying the required Layer 4 protocol is essential for auditing firewalls and access lists.

Compare required protocol against ACL line 20

ACL line 20 permits 'udp' port 22 instead of 'tcp'.

Since SSH uses TCP, incoming TCP SYN packets for port 22 fail to match line 20.

Trace packet execution through the remainder of the ACL

Packets fall through to line 30 ('deny ip any any') and are dropped.

Traffic that does not match preceding permit entries is evaluated against subsequent deny rules.

Key Concept

ACL Transport Protocol Matching (TCP vs UDP)

Estimated Time:1m 30s

Question 1580Question →

A network security administrator is configuring traffic filtering rules on a perimeter security appliance connecting an internal server zone ( $10.50.0.0/24$ ) to an isolated database server ( $192.168.50.10$ ). The administrator configures explicit rules permitting TCP port 1433 traffic for database queries. However, administrative management scripts sending UDP status probes on port 1434 from the same subnet are silently dropped without generating an explicit block rule entry in the event log. Which of the following explains why the management script traffic is being blocked?

The traffic is dropped by the unwritten implicit deny rule evaluated at the end of the access control list when no explicit permit rule matches.

The firewall automatically denies UDP traffic because transport layer port filtering can only be configured for connection-oriented TCP traffic.

Access control list rules operate exclusively at Layer 3 of the OSI model and cannot evaluate transport layer port numbers such as port 1434.

UDP port 1434 traffic is blocked because port numbers above 1024 are reserved strictly for outbound source ports and cannot be destination ports.

Show answer & explanation

Answer: The traffic is dropped by the unwritten implicit deny rule evaluated at the end of the access control list when no explicit permit rule matches.

Answer

The traffic is denied because Access Control Lists and firewall rule tables end with an implicit deny all statement, which automatically drops any traffic that fails to match an explicit permit rule.

In firewall and router Access Control List (ACL) implementations, an invisible implicit deny rule exists at the bottom of every rule set. When network traffic (such as UDP port 1434 probes) does not match any of the preceding explicit permit statements, it reaches the end of the rule list and is dropped automatically by the implicit deny.

Step-by-Step Solution

Analyze the existing firewall rule base.

The configured rules explicitly permit TCP port 1433 from

10.50.0.0/24

192.168.50.10

, but no rule permits UDP port 1434.

Firewalls process rule sets sequentially from top to bottom until a match is found.

Evaluate the default behavior for unmatched traffic in ACL/firewall architectures.

Unmatched packet streams hit the final, invisible 'deny all' statement.

Security best practices enforce default-deny postures; if traffic is not explicitly permitted, it is denied implicitly.

Select the correct explanation for the observed drop.

The missing permit rule for UDP port 1434 causes the packet to fall through to the implicit deny rule.

Adding an explicit permit rule for UDP port 1434 will resolve the connection drops.

Key Concept

ACL Implicit Deny Rule Architecture

PreviousPage 79 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept