All practice questions

2237 questions

All types2,237 Multiple choice1,150 Multiple select488 Numeric30 Matching350 Ordering201 Short answer18

A network administrator is troubleshooting an issue where containerized API gateways fail to communicate with an internal microservice cluster across a virtual overlay network. The administrator established a theory that an overly restrictive container firewall policy was blocking traffic and verified this theory by temporarily allowing all traffic, which immediately restored connectivity. Which of the following actions should the administrator take in the immediate next phases of the CompTIA troubleshooting methodology? (Select TWO.)

Select all that apply

Formulate a detailed plan of action to configure granular port rules while evaluating potential impact on overall application security.

Execute the planned firewall rule updates to permanently re-enable secure microservice communication.

Perform end-to-end API transaction testing to verify that full system functionality has been restored.

Record the root cause analysis, modified security policies, and incident ticket details in the organizational knowledge base.

Show answer & explanation

Answer: Formulate a detailed plan of action to configure granular port rules while evaluating potential impact on overall application security.; Execute the planned firewall rule updates to permanently re-enable secure microservice communication.

Answer

The administrator should formulate a detailed plan of action while evaluating potential security impacts, and then execute the planned firewall rule updates.

According to the CompTIA troubleshooting methodology, once a technician tests a theory and confirms the root cause (Step 3), they must establish a plan of action to resolve the problem while identifying potential effects (Step 4), and then implement the solution (Step 5). Formulating a detailed plan of action with port rules and executing those planned updates correspond directly to these two sequential phases.

Step-by-Step Solution

Determine the completed step in the CompTIA troubleshooting methodology.

The administrator completed Step 3 (Test the theory to determine cause) by temporarily allowing traffic to confirm the hypothesis.

Identifying the current position in the sequence determines which steps logically follow.

Identify the immediate next steps in the official methodology sequence.

The next sequential steps are Step 4 (Establish a plan of action to resolve the problem and identify potential effects) and Step 5 (Implement the solution or escalate as necessary).

CompTIA guidelines require creating a plan and considering potential side effects before implementing a permanent resolution.

Match the scenario options to the required methodology steps.

Formulating a detailed plan considering security impact maps to Step 4, and executing the planned updates maps to Step 5.

System verification (Step 6) and documentation (Step 7) take place later in the methodology lifecycle.

Key Concept

CompTIA 7-Step Troubleshooting Methodology Sequence

Question 1602Question →

A network administrator is isolating connectivity failures on a newly commissioned twisted-pair workstation drop. The administrator needs to verify the physical layer integrity to pinpoint cable distance faults and analyze captured broadcast traffic to identify rogue DHCP server offers on the subnet. Which TWO tools or capabilities should the administrator utilize to achieve these objectives? (Select TWO)

Select all that apply

Time-Domain Reflectometer (TDR) to measure cable continuity and locate physical impedance breaks

Loopback plug attached to the wall jack to filter broadcast frames and detect protocol port mismatches

Packet analyzer with a display filter targeting DHCP traffic (such as bootp or udp.port == 67)

Digital multimeter configured for DC voltage to decode Layer 7 payload headers and protocol flags

Show answer & explanation

Answer: Time-Domain Reflectometer (TDR) to measure cable continuity and locate physical impedance breaks; Packet analyzer with a display filter targeting DHCP traffic (such as bootp or udp.port == 67)

Answer

The administrator should use a Time-Domain Reflectometer (TDR) for physical copper cable fault location and a packet analyzer with DHCP protocol display filters to identify rogue DHCP server traffic.

Using a Time-Domain Reflectometer (TDR) allows precise detection and distance measurement of physical copper cable defects, while a packet analyzer equipped with DHCP protocol filters enables capture and analysis of Layer 3/4 network traffic to identify unauthorized DHCP servers.

Step-by-Step Solution

Select the appropriate physical layer testing tool for copper media.

Identify that a Time-Domain Reflectometer (TDR) measures signal reflections to calculate cable length and locate distance to open or short circuits.

Physical layer cable testing requires specialized hardware capable of pinpointing signal degradation and wire breaks.

Select the appropriate protocol analysis tool for inspect network layer / application layer traffic.

Identify that a packet analyzer capturing traffic on UDP port 67/68 allows inspection of DHCP Offer packets.

Packet capture and protocol decoding are required to read upper-layer packet headers and trace rogue server IP/MAC addresses.

Key Concept

Utilizing TDR hardware for Layer 1 cable fault location and packet analyzers for protocol traffic inspection

Question 1603Question →

A network administrator is troubleshooting a DNS lookup issue on a Linux client. Standard hostname resolution over UDP functions normally for small queries, but operations requiring larger payloads fail. When testing the DNS server at IP address `172.16.10.5` using the TCP mode (`+vc` flag), the administrator observes the following output:

text
$ dig @172.16.10.5 app.corp.internal +vc
;; Connection to 172.16.10.5#53(172.16.10.5) for app.corp.internal failed: connection refused.

Which of the following is the most likely root cause of this failure?

An intermediate network firewall or ACL is blocking traffic on TCP port 53.

DNS operates strictly over UDP port 53, so forcing TCP connection attempts will always fail.

The local system DNS resolver output indicates an invalid static entry in the client's HOSTS file.

The specified target domain is missing an IPv6 AAAA record on the authoritative DNS server.

Show answer & explanation

Answer: An intermediate network firewall or ACL is blocking traffic on TCP port 53.

Answer

An intermediate network firewall or ACL is blocking traffic on TCP port 53.

DNS relies on UDP port 53 for lightweight queries, but switches to TCP port 53 when responses exceed payload limits or when explicitly configured via tools like `dig +vc`. A 'connection refused' response when attempting to communicate over TCP indicates that network transport on TCP port 53 is being blocked by a security ACL or firewall filter.

Step-by-Step Solution

Analyze the utility command and flags used

The `dig` command specified `@172.16.10.5` with the `+vc` flag, forcing the request to establish a TCP connection on port 53 rather than standard UDP datagrams.

Understanding tool behavior identifies whether the failure occurs at the application service level or transport transport layer.

Evaluate the specific error message

The output returns 'connection refused' for port 53 under TCP mode.

This error indicates that TCP connection establishment (SYN/ACK) failed because traffic to TCP port 53 is explicitly denied or blocked by a firewall filter between the client and DNS server.

Correlate with DNS protocol operations

DNS uses UDP port 53 for standard queries under 512 bytes (or EDNS0 limits) and switches to TCP port 53 for truncated payloads or explicit TCP requests.

Blocking TCP port 53 prevents large DNS responses, zone transfers, and forced TCP fallbacks from succeeding.

Key Concept

DNS Protocol Transport Mechanism (TCP vs UDP Port 53)

Estimated Time:1m 30s

Question 1604Question →

Match each observed wireless network performance symptom to its corresponding Radio Frequency (RF) root cause or signal behavior.

Click a left item, then click its matching right item

Show answer & explanation

Answer

1. High retry rate with strong RSSI maps to Adjacent Channel Interference (ACI). 2. Signal strength drop behind dense walls maps to Material Attenuation. 3. Reflected signals causing phase issues maps to Multipath Interference. 4. Mobile device failing to switch access points maps to Sticky Client Behavior.

Each symptom directly corresponds to a specific wireless RF issue: Adjacent Channel Interference causes high retransmissions under strong signal conditions due to channel overlap; Material Attenuation reduces signal strength across physical barriers; Multipath Interference results from RF signal reflections arriving out of phase; and Sticky Client Behavior occurs when client devices fail to roam to a closer access point.

Step-by-Step Solution

Analyze symptom 1 regarding high retries under strong signal conditions.

Identified Adjacent Channel Interference (ACI) because spectral overlap degrades Signal-to-Noise Ratio (SNR) without necessarily dropping raw RSSI.

Overlapping Wi-Fi channels corrupt frames during transmission.

Analyze symptom 2 regarding signal loss through metallic barriers.

Identified Material Attenuation because metallic and concrete obstacles absorb RF wave energy.

Physical obstacles reduce signal power measured in dBm.

Analyze symptom 3 regarding reflected signals arriving at different intervals.

Identified Multipath Interference, where multiple delayed copies of the signal cause phase cancellation.

RF reflections off conductive/dense surfaces create timing differences at the receiver antenna.

Analyze symptom 4 regarding roaming behavior failure.

Identified Sticky Client Behavior, where a station remains locked to a distant AP due to conservative roaming algorithms or power asymmetries.

Client driver roaming thresholds prevent timely reassociation.

Key Concept

Wireless Radio Frequency (RF) Signal Degradation and Roaming Issues

Question 1605Question →

A network specialist is auditing and hardening newly deployed Layer 2 access switches at a branch office. To minimize the local physical attack surface and prevent VLAN hopping attacks across trunk connections, which TWO hardening practices should the specialist implement? (Select TWO.)

Select all that apply

Assign all unused physical switch ports to an unused blackhole VLAN and administratively disable them.

Keep all unused physical switch ports active in the default VLAN to streamline future device onboarding.

Change the native VLAN on 802.1Q trunk links from the default VLAN to an unused VLAN ID.

Set the native VLAN on trunk links to match the active management VLAN to allow untagged administrative traffic.

Enable Telnet over TCP port 22 and HTTP over TCP port 443 across management interfaces for remote access.

Show answer & explanation

Answer: Assign all unused physical switch ports to an unused blackhole VLAN and administratively disable them.; Change the native VLAN on 802.1Q trunk links from the default VLAN to an unused VLAN ID.

Answer

The specialist should assign all unused physical switch ports to an unused blackhole VLAN while administratively shutting them down, and change the native VLAN on 802.1Q trunk links from the default VLAN to a dedicated, unused VLAN ID.

Hardening switch interfaces requires securing unused access ports by assigning them to a non-routable blackhole VLAN and disabling them, as well as mitigating VLAN hopping by changing the default native VLAN on 802.1Q trunk interfaces to an unused VLAN ID.

Step-by-Step Solution

Analyze physical interface security requirements.

Identify that active unused interfaces present an immediate rogue device connection risk.

Hardening best practices require disabling unused interfaces and placing them into an isolated, non-routed VLAN.

Evaluate trunk interface configuration parameters.

Identify that default native VLAN settings (VLAN 1) leave switches vulnerable to VLAN hopping and double-tagging attacks.

Changing the native VLAN on trunk links to a non-default, unused VLAN neutralizes double-tagging vulnerabilities.

Key Concept

Switch Port Security and Native VLAN Hardening

Estimated Time:1m 30s

Question 1606Question →

An enterprise systems administrator is organizing management channels across data centers and branch locations. Match each administrative capability on the left with the specific remote management mechanism or hardware solution on the right that provides that capability.

Click a left item, then click its matching right item

Show answer & explanation

Answer

1. Remote rebooting of power-locked hardware matches Switched Power Distribution Unit (Switched PDU). 2. Out-of-band serial CLI access matches Cellular modem paired with a console terminal server. 3. Secure encrypted CLI administration matches Secure Shell (SSH) protocol. 4. Remote GUI pre-boot BIOS access matches IP-based Keyboard, Video, and Mouse (IP-KVM) switch.

Each management solution directly aligns with the operational constraints: Switched PDUs control outlet power; Cellular modems with console servers offer alternate out-of-band pathways during WAN downtime; SSH secures command-line communication over IP networks; and IP-KVM enables hardware-level video and peripheral control before an OS boots.

Step-by-Step Solution

Analyze power management requirements for hung devices

Switched PDUs allow remote power cycling of specific electrical outlets to restart frozen hardware.

When an OS kernel locks up completely, software-based reboots fail, requiring remote electrical outlet toggling.

Identify out-of-band access path during WAN outages

A cellular modem connected to a console terminal server provides emergency serial connectivity external to the primary network path.

Out-of-band management channels must bypass primary network routing circuits to remain accessible during link failures.

Select secure in-band administrative CLI protocol

SSH provides strong cryptographic protection for CLI administration over IP networks.

Insecure legacy protocols like Telnet transmit credentials in plaintext, making SSH the standard for secure in-band CLI access.

Determine appropriate tool for pre-boot display and hardware-level management

IP-KVM devices capture video signals and transmit input controls over the network regardless of host OS state.

Software-based remote management tools (such as RDP or VNC) require a functional operating system, whereas IP-KVM operates at the hardware level for POST and BIOS access.

Key Concept

Selecting in-band and out-of-band remote management protocols and hardware devices based on access requirements and network availability.

Question 1607Question →

A network engineer is configuring traffic filtering between a web application cluster in a DMZ ( $192.168.100.0/24$ ) and a backend database subnet ( $172.16.50.0/24$ ). Web application servers must initiate queries to a database server listening on TCP port $5432$ . The security architecture incorporates both a stateful inspection firewall and stateless router Access Control Lists (ACLs). Which TWO of the following statements correctly describe the filtering requirements and expected packet behavior for this deployment?

Select all that apply

The stateful firewall automatically permits return database response traffic to the DMZ web servers once the outbound connection on TCP port

5432

is established, without needing an explicit inbound return rule.

The stateless router ACL requires an explicit rule permitting return traffic from TCP port

5432

back to the DMZ ephemeral port range to allow full bidirectional communication.

PostgreSQL database communication operates exclusively over connectionless UDP port

5432

, requiring ACL rules to specify UDP rather than TCP for state tracking to function.

An extended ACL created with only a single permit rule for port

5432

will forward all unspecified network traffic because explicit deny statements are required to drop packets.

Show answer & explanation

Answer: The stateful firewall automatically permits return database response traffic to the DMZ web servers once the outbound connection on TCP port $5432$ is established, without needing an explicit inbound return rule.; The stateless router ACL requires an explicit rule permitting return traffic from TCP port $5432$ back to the DMZ ephemeral port range to allow full bidirectional communication.

Answer

The stateful firewall automatically permits return response traffic for established TCP connections without separate return rules, whereas the stateless router ACL requires an explicit permit entry for return traffic targeting ephemeral ports.

Stateful firewalls track TCP connection state, automatically allowing legitimate return packets without needing reverse rules. In contrast, stateless ACLs evaluate each packet in isolation, requiring explicit return rules for response traffic originating from the server back to client ephemeral ports.

Step-by-Step Solution

Analyze stateful firewall inspection behavior for TCP traffic.

Stateful firewalls track connection states (such as TCP SYN, ESTABLISHED). Outbound connection permits create state table entries allowing valid reply packets automatically.

Stateful devices dynamically permit return traffic matching active session entries.

Evaluate stateless ACL rule requirements for bidirectional packet flows.

Stateless ACLs inspect individual header fields independently for every packet and do not maintain state tables. Return traffic must be explicitly permitted.

Without state tracking, return packets matching database responses will hit the default implicit deny unless permitted explicitly.

Key Concept

Difference between stateful firewall session tracking and stateless ACL per-packet filtering

Question 1608Question →

A network administrator is troubleshooting an issue where a Windows client workstation fails to resolve internal hostnames. To isolate where name resolution fails within the OS lookup hierarchy, in what order does a standard Windows client attempt to resolve a target hostname? Arrange the following resolution mechanisms from first evaluated (top) to last evaluated (bottom).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct evaluation sequence for Windows name resolution is: 1) Inspect local DNS cache and HOSTS file, 2) Send a unicast DNS query to the primary configured DNS server, 3) Transmit LLMNR requests on the local subnet, 4) Broadcast NetBIOS Name Service (NBT-NS) requests.

The Windows operating system follows a strict, deterministic sequence for host name resolution: local cache and HOSTS file lookup occurs first, followed by unicast queries to configured DNS servers, then local subnet multicast via LLMNR, and finally legacy NetBIOS (NBT-NS) broadcasts.

Step-by-Step Solution

Evaluate local host resources

The operating system checks memory (DNS resolver cache) and local configuration files (HOSTS) first to avoid unnecessary network traffic.

Local lookup requires zero network overhead and provides immediate response if a mapping exists.

Query configured network DNS servers

The OS queries the primary DNS server IP configured on the active network interface over port 53.

Centralized DNS resolution is the primary method for resolving domain hostnames across local networks and the internet.

Initiate local multicast fallback via LLMNR

If the DNS server is unreachable or responds with Name Error (NXDOMAIN), the client sends LLMNR multicast packets on UDP 5355.

LLMNR allows peer-to-peer name resolution on the local link without requiring a centralized DNS server.

Initiate legacy broadcast fallback via NBT-NS

If LLMNR produces no response, Windows defaults to NetBIOS Name Service broadcasts over UDP 137.

NBT-NS provides backward compatibility with legacy Windows networking environments.

Key Concept

Windows Client Name Resolution Order

Question 1609Question →

A network technician is troubleshooting a newly connected client workstation that cannot access local network resources or the internet. Executing `ipconfig /all` on the workstation yields the following output:

Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::d4a2:810f:3c21:7a9a%12
IPv4 Address. . . . . . . . . . . : 169.254.108.42
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :

Which of the following is the most likely cause of this workstation's IP configuration?

The host was unable to obtain an IP lease from a DHCP server and self-assigned an Automatic Private IP Addressing (APIPA) address.

The default gateway parameter was left blank in the static IPv4 configuration properties, forcing the OS to default to a link-local range.

The workstation's static IP address and default gateway address reside on mismatched IPv4 subnets.

The central DHCP server scope ran out of usable host addresses because the subnet mask was set to calculate usable hosts without subtracting network and broadcast identifiers.

Show answer & explanation

Answer: The host was unable to obtain an IP lease from a DHCP server and self-assigned an Automatic Private IP Addressing (APIPA) address.

Answer

The host was unable to obtain an IP lease from a DHCP server and self-assigned an Automatic Private IP Addressing (APIPA) address.

An IPv4 address beginning with 169.254.x.x indicates Automatic Private IP Addressing (APIPA). Operating systems assign an APIPA address when configured as a DHCP client but fail to receive a response (DHCPACK) from a reachable DHCP server.

Step-by-Step Solution

Analyze the IP address output from the client workstation command prompt.

The IPv4 address is 169.254.108.42 with a subnet mask of 255.255.0.0.

Recognizing the address range helps identify how the host acquired its network settings.

Identify the standard protocol associated with the 169.254.0.0/16 address space.

The range 169.254.0.1 through 169.254.255.254 is reserved for Automatic Private IP Addressing (APIPA).

Client operating systems dynamically generate an APIPA address when DHCP DORA messages fail to produce a lease.

Deduce the primary root cause of the issue.

The workstation failed to contact a DHCP server, resulting in local link-local address generation.

Without a valid DHCP lease or static assignment, network layer routing beyond the immediate link is unviable.

Key Concept

Automatic Private IP Addressing (APIPA) Diagnosis

Estimated Time:1m 15s

Question 1610Question →

A network engineer is analyzing a packet capture (pcap) collected from a client workstation that is unable to authenticate with a RADIUS server. The trace shows the workstation sending UDP datagrams to port 1812 on the server IP address, followed immediately by ICMP Type 3, Code 3 (Destination Unreachable - Port Unreachable) response messages from the server. Which of the following conclusions is best supported by the packet analyzer output?

The destination server host received the IP datagram, but no active RADIUS service is listening on the target UDP port, or a firewall actively rejected the port.

The physical twisted-pair cable drop connecting the workstation has a split pair condition that is preventing Layer 1 signals from reaching the local switch.

The client application failed to establish communication because UDP requires a three-way SYN/SYN-ACK handshake before payload data can be transmitted.

The packet analyzer is unable to decode the datagram headers because UDP operates as a Layer 2 Data Link protocol.

Show answer & explanation

Answer: The destination server host received the IP datagram, but no active RADIUS service is listening on the target UDP port, or a firewall actively rejected the port.

Answer

The destination server host received the IP datagram, but no active RADIUS service is listening on the target UDP port, or a firewall actively rejected the port.

In packet capture analysis, receiving an ICMP Type 3 Code 3 (Port Unreachable) message directly from the target host proves that Layer 1 through Layer 3 network paths are functioning properly. The error explicitly confirms that the destination host received the packet, but no daemon or service was listening on UDP port 1812 (or an endpoint firewall explicitly blocked and rejected the port).

Step-by-Step Solution

Analyze the packet capture protocol types and control response codes.

Identified outgoing UDP packets addressed to destination port 1812 and returning ICMP Type 3, Code 3 packets originating from the target server.

ICMP Type 3 Code 3 specifically translates to 'Destination Unreachable: Port Unreachable'.

Correlate ICMP error feedback with OSI layer transport functionality.

Concluded that network connectivity up through Layer 3 is operational, but Layer 4 service binding failed on the target host.

An ICMP Port Unreachable message is generated by the destination host's network stack when an IP packet arrives for a port that has no active application listening on it.

Key Concept

Packet Analyzer Interpretation & ICMP Port Unreachable Response Diagnosis

Question 1611Question →

An organization is designing its disaster recovery strategy for a secondary data center. The business requirements state that critical services must be restored within 4 hours following a site failure (RTO = 4 hours), and data loss must not exceed 1 hour (RPO = 1 hour). To minimize ongoing operational expenses, management specifies that the secondary site should have pre-installed server and networking hardware, but production data can be synchronized periodically and application services do not need to run live in parallel during normal operations. Which disaster recovery site model best satisfies these operational and budgetary requirements?

Cold site

Warm site

Hot site

Active-Active site

Show answer & explanation

Answer: Warm site

Answer

Warm site

A warm site provides pre-configured network equipment, power, cooling, and installed hardware, but relies on periodic backups or data replication rather than active real-time transaction processing. This allows systems to be brought online within a few hours (meeting the 4-hour RTO) while incurring lower operational expenditures than a fully redundant hot site.

Step-by-Step Solution

Analyze the given Recovery Time Objective (RTO) and Recovery Point Objective (RPO) metrics alongside financial constraints.

The target RTO is 4 hours, RPO is 1 hour, and operational costs must be minimized.

Understanding the threshold between near-zero downtime requirements and multi-hour recovery windows determines the appropriate recovery facility classification.

Evaluate the infrastructure requirements described in the scenario.

Hardware and network devices are pre-installed, but applications are not running live continuous mirror feeds.

A facility with installed equipment requiring data restoration/activation upon declaration fits the definition of a warm recovery site.

Compare site options against cost and setup speed parameters.

A cold site is too slow (days/weeks), while hot/active-active sites are excessively expensive. A warm site achieves the 4-hour RTO within budget constraints.

Selecting the warm site satisfies both the technical RTO requirement and the budget optimization directive.

Key Concept

Disaster Recovery Site Selection Trade-offs (Hot vs Warm vs Cold)

Question 1612Question →

A network administrator is configuring workstations on a branch office local area network assigned the IPv4 address block $192.168.50.128/26$ . Which of the following IPv4 addresses are valid, usable host IP addresses within this subnet? (Select TWO.)

Select all that apply

192.168.50.130

192.168.50.189

192.168.50.128

192.168.50.191

Show answer & explanation

Answer: $192.168.50.130$ ; $192.168.50.189$

Answer

The addresses

192.168.50.130

and

192.168.50.189

are the valid usable host IP addresses within the

192.168.50.128/26

subnet.

For the assigned block

192.168.50.128/26

, the block size is

64

addresses. The network ID is

192.168.50.128

and the broadcast address is

192.168.50.191

. Usable host addresses range from

192.168.50.129

192.168.50.190

. Both

192.168.50.130

and

192.168.50.189

fall within this valid range.

Step-by-Step Solution

Calculate the block size and host capacity for the

/26

subnet prefix.

/26

prefix leaves

32 - 26 = 6

host bits. The total number of addresses in the subnet is

2^6 = 64

Determining the address block size establishes subnet boundaries.

Identify the network ID, broadcast address, and usable host address range.

Network ID:

192.168.50.128

. Broadcast Address:

192.168.50.128 + 64 - 1 = 192.168.50.191

. Usable Host Range:

192.168.50.129

through

192.168.50.190

Usable host IP addresses are bounded strictly between the network ID and broadcast address.

Evaluate the given choices against the usable host range.

192.168.50.130

and

192.168.50.189

fall within the

[192.168.50.129, 192.168.50.190]

range.

192.168.50.128

is the network ID and

192.168.50.191

is the broadcast address.

Network IDs and broadcast addresses are reserved and cannot be assigned to hosts.

Key Concept

IPv4 Subnet Masking and Host Range Determination

Question 1613Question →

A network analyst is inspecting the de-encapsulation process on a server receiving traffic for a web application. Once the Network Interface Card (NIC) strips the Layer 2 Ethernet frame header and trailer, which layer's header is processed next by the network stack, and what Protocol Data Unit (PDU) is exposed?

The Layer 3 IP header is evaluated next, exposing an IP packet.

The Layer 4 TCP header is evaluated next, exposing a TCP segment.

The Layer 4 UDP header is evaluated next, exposing a UDP datagram.

The Layer 7 HTTP header is evaluated next, exposing application data.

Show answer & explanation

Answer: The Layer 3 IP header is evaluated next, exposing an IP packet.

Answer

The Layer 3 IP header is evaluated next, exposing an IP packet.

During inbound de-encapsulation, protocol headers are stripped in bottom-up order (Layer 2 → Layer 3 → Layer 4 → Layer 7). Once the Layer 2 Ethernet frame header and trailer are removed, the operating system processes the Layer 3 IP header and handles the enclosed IP packet.

Step-by-Step Solution

Identify the starting point in the de-encapsulation hierarchy

The Layer 2 Data Link frame header and trailer have been removed by the NIC hardware.

Inbound de-encapsulation processes traffic from the bottom of the OSI stack upward.

Determine the next layer in the OSI stack

The payload is delivered to Layer 3 (Network Layer).

Layer 3 directly encapsulates Layer 4 data and sits immediately above Layer 2.

Identify the protocol header and PDU exposed at Layer 3

The IP protocol header is evaluated, exposing the IP packet.

The network stack must inspect IP addressing and routing header fields before handing payload up to Layer 4 transport protocols.

Key Concept

OSI De-encapsulation Sequence and PDU Layers

Estimated Time:1m 0s

Question 1614Question →

A host workstation on Subnet A transmits data to a server located on Subnet B across an intermediate IP router. Which of the following best describes the header modifications that occur when the router processes and forwards the data unit to the next hop?

The Layer 2 source and destination MAC addresses are updated for the next hop, while the Layer 3 source and destination IP addresses remain unchanged.

The Layer 3 source and destination IP addresses are updated for the next hop, while the Layer 2 source and destination MAC addresses remain unchanged.

Both the Layer 2 MAC addresses and Layer 3 IP addresses are modified at each intermediate routing hop.

The Layer 4 source and destination port numbers are modified for the next hop, while the Layer 2 frame header remains unchanged.

Show answer & explanation

Answer: The Layer 2 source and destination MAC addresses are updated for the next hop, while the Layer 3 source and destination IP addresses remain unchanged.

Answer

The Layer 2 source and destination MAC addresses are updated for the next hop, while the Layer 3 source and destination IP addresses remain unchanged.

During routing, the router de-encapsulates the incoming Layer 2 frame, inspects the Layer 3 IP packet header to determine the outgoing interface and next hop, and then re-encapsulates the IP packet into a new Layer 2 frame. The new frame uses the router egress interface MAC address as the source MAC and the next-hop device MAC address as the destination MAC. The IP header source and destination addresses remain unchanged.

Step-by-Step Solution

Analyze the role of Layer 2 framing across network boundaries.

Layer 2 headers (MAC addresses) are hop-by-hop parameters that only deliver frames between directly connected interfaces on the same physical link.

When a router receives a frame, it strips the incoming Layer 2 header during de-encapsulation.

Analyze the role of Layer 3 IP headers across network boundaries.

Layer 3 headers (IP addresses) contain the original source host IP and final destination host IP.

IP headers provide end-to-end logical addressing and remain unchanged across intermediate standard routers.

Determine the re-encapsulation process executed by the forwarding router.

The router encapsulates the IP packet into a new Layer 2 frame containing its egress interface MAC address as the source and the target next-hop interface MAC address as the destination.

This enables physical delivery across the next network segment.

Key Concept

Hop-by-hop Layer 2 re-framing vs. end-to-end Layer 3 packet encapsulation

Estimated Time:1m 30s

Question 1615Question →

A network technician is implementing an automated configuration archiving system for network switches. The system relies on Trivial File Transfer Protocol (TFTP) to push configuration files to a centralized storage server without requiring user authentication or maintaining complex connection sessions. Which of the following port and transport protocol combinations must be permitted on the network firewall to allow this traffic?

UDP port 69

TCP port 21

TCP port 22

UDP port 67

Show answer & explanation

Answer: UDP port 69

Answer

UDP port 69 is required for Trivial File Transfer Protocol (TFTP) traffic.

Trivial File Transfer Protocol (TFTP) is designed as a minimal, lightweight file transfer protocol that operates over User Datagram Protocol (UDP) on well-known port 69. Because it lacks authentication and session overhead, it is commonly used for bootstrapping network devices and backing up router/switch configuration files.

Step-by-Step Solution

Identify the protocol described in the scenario

The requirement specifies Trivial File Transfer Protocol (TFTP) for lightweight, unauthenticated file pushes.

Determining the exact service protocol dictates the transport layer protocol and default port assignment.

Determine the transport layer protocol and default port for TFTP

TFTP uses UDP on port 69.

TFTP relies on UDP for low-overhead, connectionless transfer rather than TCP.

Match the requirement with the correct firewall port configuration

Permitting UDP port 69 on the firewall allows TFTP configuration traffic to pass.

Firewall rules must match both the specific transport protocol (UDP) and destination port (69).

Key Concept

Common Network Ports and Protocols (TFTP UDP 69)

Question 1616Question →

A network engineer is reviewing routing loop prevention mechanisms across dynamic routing protocols deployed within an enterprise network. Which of the following mechanisms are specifically utilized by distance-vector dynamic routing protocols to prevent routing loops? (Select TWO.)

Select all that apply

Split horizon, which stops a router from advertising a route back out the same physical interface from which it learned that route.

Route poisoning, which sets the metric of a failed route to an infinite/unreachable value to immediately invalidate it across neighbor routers.

Using 802.1Q encapsulation headers to tag Layer 3 routing updates with VLAN identification markers.

Deploying Port Address Translation tables to translate hop count metrics into public IPv4 addresses.

Show answer & explanation

Answer: Split horizon, which stops a router from advertising a route back out the same physical interface from which it learned that route.; Route poisoning, which sets the metric of a failed route to an infinite/unreachable value to immediately invalidate it across neighbor routers.

Answer

The correct mechanisms are split horizon (preventing route re-advertisement back out the receiving interface) and route poisoning (broadcasting an unreachable metric when a link fails).

The statements defining split horizon and route poisoning correctly identify distance-vector loop prevention techniques. Split horizon prevents a router from transmitting route updates back out the interface where the route originated, breaking two-node routing loops. Route poisoning explicitly sets the metric of a down link to an unreachable value (e.g., 16 hops in RIP) so surrounding neighbors rapidly drop the bad route.

Step-by-Step Solution

Identify the protocol operational category specified in the stem

The scenario focuses specifically on distance-vector dynamic routing protocols.

Distance-vector protocols (such as RIP) rely on neighbor updates and hop counts, making them susceptible to routing loops like count-to-infinity.

Evaluate candidate loop prevention features for distance-vector protocols

Split horizon and route poisoning are classic distance-vector mechanisms designed to prevent count-to-infinity and routing loops.

Split horizon ensures updates are not echoed back to the source node, while route poisoning marks invalid routes with infinite metric values immediately upon failure.

Analyze and eliminate invalid non-routing mechanisms

802.1Q trunking operates at Layer 2 for VLAN isolation, and PAT is a Layer 3/4 address translation technique.

Neither technology plays a role in dynamic routing protocol convergence or loop mitigation.

Key Concept

Distance-Vector Routing Loop Prevention Mechanisms

Question 1617Question →

Clients connected to VLAN 20 ( $192.168.20.0/24$ ) are unexpectedly receiving IPv4 address leases from the pool configured for VLAN 10 ( $192.168.10.0/24$ ). Inspection of the central DHCP server shows healthy scope configurations. Which of the following is the most likely cause of this issue?

The relay agent command was configured on the Switch Virtual Interface (SVI) for VLAN 10 instead of VLAN 20, causing the gateway IP address (

giaddr

) field to be populated with VLAN 10's interface IP.

The DHCP relay agent converted the unicast

DHCPDISCOVER

broadcast into Layer 2 multicast frames, overriding the subnet scope selection mechanism.

The relay agent modified the source UDP port from 67 to 68 before forwarding the unicast packet to the central server.

The workstations failed to broadcast a

DHCPDISCOVER

packet and automatically generated an APIPA address within the VLAN 10 range.

Show answer & explanation

Answer: The relay agent command was configured on the Switch Virtual Interface (SVI) for VLAN 10 instead of VLAN 20, causing the gateway IP address ( $giaddr$ ) field to be populated with VLAN 10's interface IP.

Answer

The relay agent command was configured on the Switch Virtual Interface (SVI) for VLAN 10 instead of VLAN 20, causing the gateway IP address (

giaddr

) field to be populated with VLAN 10's interface IP.

When a Layer 3 device acts as a DHCP relay agent, it captures client Layer 2 broadcast requests on a specific interface, populates the gateway IP address (

giaddr

) field with that receiving interface's IP address, and unicasts the packet to the DHCP server. If the relay directive is placed on VLAN 10's interface instead of VLAN 20's, the

giaddr

sent to the server will belong to VLAN 10, causing the DHCP server to select and lease an IP address from the VLAN 10 scope.

Step-by-Step Solution

Analyze how a DHCP relay agent identifies which scope to request from the central DHCP server.

The relay agent sets the Gateway IP Address (

giaddr

) field in the DHCP message header to the IP address of the local interface (SVI/subinterface) that received the client's Layer 2 broadcast.

The central DHCP server inspects the

giaddr

field to select the correct IP scope corresponding to that subnet.

Evaluate the symptom against the relay mechanism.

Clients on VLAN 20 receiving VLAN 10 leases indicates that the DHCP server received a request with a

giaddr

belonging to VLAN 10.

This occurs when the helper/relay command is mistakenly applied to VLAN 10's interface instead of VLAN 20's interface.

Key Concept

DHCP Relay Gateway IP Address (giaddr) Population

Question 1618Question →

A system administrator is updating firewall access control lists to enable user workstations to securely send outbound messages and retrieve incoming messages from an enterprise mail server over TLS-encrypted sessions. Which TWO of the following port and protocol combinations must be permitted through the firewall to support these secure email services? (Select TWO.)

Select all that apply

TCP port 993 for IMAPS

TCP port 587 for SMTP Submission

UDP port 993 for IMAPS

TCP port 110 for POP3S

Show answer & explanation

Answer: TCP port 993 for IMAPS; TCP port 587 for SMTP Submission

Answer

The firewall must permit TCP port 993 for IMAPS and TCP port 587 for SMTP Submission.

Encrypted email retrieval using IMAP over SSL/TLS (IMAPS) standardly uses TCP port 993. Encrypted client email submission using SMTP with TLS standardly uses TCP port 587. Both ports must be open on the firewall to allow secure sending and receiving from mail clients.

Step-by-Step Solution

Identify the protocol requirements for encrypted email retrieval.

IMAP over TLS/SSL (IMAPS) provides secure mail retrieval on standard TCP port 993.

Unencrypted IMAP uses port 143, whereas encrypted IMAPS defaults to TCP port 993.

Identify the protocol requirements for encrypted outbound email submission.

SMTP Client Submission over TLS operates on TCP port 587.

Legacy unencrypted SMTP uses port 25, while secure client mail submission to an email broker uses TCP port 587.

Evaluate transport layer protocols and port mappings for the incorrect choices.

Rule out UDP-based transport for IMAP and incorrect port assignments for POP3S.

Email retrieval protocols require connection-oriented reliability (TCP), eliminating UDP choices, and POP3S operates on TCP 995 rather than TCP 110.

Key Concept

Standard Secure Mail Ports (IMAPS TCP 993, SMTP Submission TCP 587, POP3S TCP 995)

Question 1619Question →

A network engineer is configuring a switch port connected to an enterprise wireless access point (AP). The AP requires untagged management traffic to be placed onto VLAN 10, while user Wi-Fi traffic must be carried across the link as 802.1Q tagged frames for VLAN 30. Which of the following interface configuration approaches correctly fulfills this requirement?

Configure the interface in 802.1Q trunking mode, designate VLAN 10 as the native VLAN, and allow VLANs 10 and 30 on the trunk.

Configure the interface as an access port assigned to VLAN 10, allowing the switch to forward VLAN 30 tagged frames across the single access broadcast domain without trunking.

Configure the interface in 802.1Q trunking mode, set VLAN 30 as the native VLAN, and strip tags from VLAN 10 traffic upon ingress.

Configure the interface as an access port on VLAN 30 and specify VLAN 10 as a secondary access subnet on the same physical switch port.

Show answer & explanation

Answer: Configure the interface in 802.1Q trunking mode, designate VLAN 10 as the native VLAN, and allow VLANs 10 and 30 on the trunk.

Answer

Configure the interface in 802.1Q trunking mode, designate VLAN 10 as the native VLAN, and allow VLANs 10 and 30 on the trunk.

Configuring the switch port as an 802.1Q trunk with VLAN 10 designated as the native VLAN allows untagged management frames from the wireless access point to be placed into VLAN 10. Simultaneously, tagged frames for VLAN 30 are correctly identified and forwarded across the trunk link using 802.1Q encapsulation headers.

Step-by-Step Solution

Identify traffic requirements for the access point connection

Untagged traffic belongs to management (VLAN 10), and tagged traffic belongs to user Wi-Fi (VLAN 30).

An 802.1Q trunk link is required to carry traffic for multiple VLANs over a single physical interface.

Determine native VLAN configuration

VLAN 10 must be assigned as the native VLAN on the switch trunk port.

IEEE 802.1Q trunks transmit frames for the native VLAN without an 802.1Q header tag. Assigning VLAN 10 as native matches the AP's untagged management traffic.

Verify allowed VLAN list on the trunk

Both VLAN 10 and VLAN 30 must be permitted on the trunk interface.

Permitting both VLANs ensures tagged frames for VLAN 30 and untagged native frames for VLAN 10 are forwarded successfully.

Key Concept

802.1Q Native VLAN & Trunking Configuration

Estimated Time:1m 30s

Question 1620Question →

A system administrator monitors outbound network traffic generated by a local workstation initiating a secure shell (SSH) session to a remote server. As the application payload moves down the OSI model protocol stack on the source host, specific encapsulation processes take place. Which of the following statements accurately describe how the data unit is modified during this outbound encapsulation process? (Select TWO)

Select all that apply

The Transport layer encapsulates the application data into a segment by prepending a header containing source and destination port numbers.

The Network layer encapsulates the transport segment into a frame by prepending the IP header and appending a Frame Check Sequence (FCS) trailer.

The Network layer encapsulates the transport layer segment into an IP packet by prepending source and destination IP addresses.

The Data Link layer replaces the IP addressing information with port numbers to convert the packet into a physical bitstream.

Show answer & explanation

Answer: The Transport layer encapsulates the application data into a segment by prepending a header containing source and destination port numbers.; The Network layer encapsulates the transport layer segment into an IP packet by prepending source and destination IP addresses.

Answer

The two correct statements are: (1) The Transport layer encapsulates the application data into a segment by prepending a header containing source and destination port numbers, and (2) The Network layer encapsulates the transport layer segment into an IP packet by prepending source and destination IP addresses.

Outbound encapsulation works down the OSI stack: Layer 4 (Transport) prepends port numbers to construct a segment, and Layer 3 (Network) prepends IP addresses to construct a packet. Both of these statements correctly describe PDU encapsulation.

Step-by-Step Solution

Analyze Layer 4 (Transport Layer) Encapsulation

Application data receives a Layer 4 header (containing source and destination ports like SSH port 22), creating a Segment.

Transport layer encapsulation establishes process-to-process communication.

Analyze Layer 3 (Network Layer) Encapsulation

The Layer 4 Segment is passed down to Layer 3, where an IP header (containing source and destination IP addresses) is prepended, forming a Packet.

Network layer encapsulation provides logical host-to-host addressing across subnets.

Verify Data Link Layer (Layer 2) functions versus higher layer functions

Layer 2 prepends MAC addresses and appends a trailer (FCS) to form a Frame. It does not replace IP addresses or operate with port numbers.

Differentiates Layer 2 frame boundaries from Layer 3 packet and Layer 4 segment boundaries.

Key Concept

OSI Protocol Data Unit (PDU) Encapsulation Sequence

Estimated Time:1m 30s

PreviousPage 81 / 112Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept