Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 1701Question →

A network administrator receives an alert indicating that a remote data facility has experienced a total WAN transport link failure, rendering all primary IP interfaces and in-band networks unreachable. The administrator needs to gain direct command-line access to the core router to diagnose the interface state and attempt configuration recovery. Which of the following remote access mechanisms will allow the administrator to establish access to the device under these conditions?

Show answer & explanation

Answer: A cellular modem connected to a serial console server wired to the router's console port

Answer

A cellular modem connected to a serial console server wired to the router's console port provides an out-of-band connection that does not rely on the failed primary WAN link or local IP infrastructure.
Out-of-band (OOB) management allows administrators to manage network devices via dedicated alternative pathways that operate independently of the primary production network. Connecting a cellular modem to a console/terminal server wired directly to a network device's RS-232/RJ-45 console port provides secure, direct CLI access regardless of whether the primary WAN link or IP stack on the device is functioning.

Step-by-Step Solution

1
Analyze the operational constraints presented in the scenario.
Identified that the primary WAN transport link has completely failed, making all in-band IP pathways unreachable.
When in-band IP networks fail, standard remote management protocols that rely on production IP routing cannot reach the device.
2
Differentiate between in-band and out-of-band (OOB) management technologies.
Out-of-band access uses independent communication paths (such as cellular modems or PSTN lines connected to console servers) to reach serial management ports.
Serial console access bypassed network stack failures, allowing interactive CLI access even when IP interface routing is down.
3
Select the mechanism that satisfies out-of-band requirements.
The cellular-connected console server provides direct access to the console port completely independent of the WAN status.
Cellular console servers establish an alternate external communication path directly to device console hardware.

Key Concept

Out-of-Band (OOB) Remote Management
Estimated Time:1m 30s
Question 1702Question →

A workstation on an enterprise network needs to establish a connection to an external host at secure.partner.example.orgsecure.partner.example.org. The workstation has no cached DNS entries for this domain. Place the operational steps of the standard recursive DNS resolution process in the correct chronological order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with the client stub resolver querying the local recursive resolver, followed by iterative queries from the recursive resolver to the Root Name Server, the TLD server, and finally the Authoritative Name Server to obtain the host A record.
The correct order follows the standard DNS lookup traversal: local client stub resolver initiation -> iterative query to Root server -> referral to TLD server -> referral to Authoritative server -> authoritative answer returned to client.

Step-by-Step Solution

1
Initiate query from client stub resolver
Local cache check fails; recursive query is sent to local DNS resolver.
Client applications rely on the configured local DNS server to handle full name resolution.
2
Query Root Name Server
Local resolver issues an iterative query over UDP port 53 to a DNS root server.
Root servers serve as the top level of the hierarchical DNS namespace tree.
3
Receive TLD referral
Root server refers local resolver to the name servers responsible for the target TLD.
Root servers direct traffic to TLD servers based on the root suffix of the request.
4
Query TLD Name Server
Local resolver queries the TLD server and receives referral NS records for the specific domain.
TLD servers maintain records for registered domain name delegations within their top-level domain.
5
Query Authoritative Name Server
Local resolver requests the host A record from the authoritative server, caches the response, and returns the IP to the client.
Authoritative servers contain the actual zone files containing resource records such as A, AAAA, or MX entries.

Key Concept

Iterative and Recursive DNS Resolution Hierarchy
Question 1703Question →

Match each network documentation diagram type with its primary operational purpose.

Click a left item, then click its matching right item

Items

Physical Topology Diagram
Logical Topology Diagram
Rack Elevation Diagram
Wiring Schematic

Matches

Show answer & explanation

Answer

Physical Topology Diagram matches hardware locations and cable runs; Logical Topology Diagram matches IP addressing, subnets, and VLANs; Rack Elevation Diagram matches vertical rack unit (U-space) device layout; Wiring Schematic matches conductor pinouts and wire terminations.
Each documentation type serves a specific network management purpose: physical topology diagrams record hardware locations and cabling paths; logical topology diagrams map subnets, IP addressing, and VLANs; rack elevations illustrate vertical cabinet space (U-space) planning; and wiring schematics provide precise cable pinout and termination specs.

Step-by-Step Solution

1
Differentiate physical vs. logical network documentation representations.
Identify physical topologies as hardware/cabling locations and logical topologies as IP/subnet/VLAN configurations.
Physical diagrams deal with real-world infrastructure geometry, whereas logical diagrams model data flow and network protocol boundaries.
2
Identify rack layout and detailed cable termination documentation.
Map rack elevation diagrams to vertical unit (U) space planning and wiring schematics to pinouts and conductor terminations.
Rack elevations assist in equipment installation and cabinet space management, while wiring schematics assist in cable crimping, punch-down, and pinout verification.

Key Concept

Distinguishing distinct documentation types and diagrams used in network administration and operations.
Question 1704Question →

A network administrator needs to assign static IP addresses to new servers on a subnet configured with the address block 172.16.40.128/26172.16.40.128/26. Which of the following IP addresses are valid usable host addresses within this subnet? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: 172.16.40.130; 172.16.40.189

Answer

The addresses 172.16.40.130 and 172.16.40.189 are valid usable host addresses within the 172.16.40.128/26 subnet.
For the subnet 172.16.40.128/26172.16.40.128/26, the host field contains 32−26=632 - 26 = 6 bits, giving a block size of 26=642^6 = 64 addresses. The network identifier is 172.16.40.128172.16.40.128 and the broadcast address is 172.16.40.191172.16.40.191. Consequently, the assignable host range spans from 172.16.40.129172.16.40.129 to 172.16.40.190172.16.40.190. The values 172.16.40.130172.16.40.130 and 172.16.40.189172.16.40.189 fall squarely inside this valid usable range.

Step-by-Step Solution

1
Determine the subnet block size from the CIDR prefix /26.
A /26 prefix leaves 6 host bits (32−26=632 - 26 = 6). The block size is 26=642^6 = 64 IP addresses.
Calculating the block size identifies the total number of IP addresses contained in the subnet.
2
Identify the network address and broadcast address for the 172.16.40.128 block.
The network address is 172.16.40.128. Adding the block size of 64 gives the next network boundary at 172.16.40.192, so the broadcast address is 172.16.40.191.
The first IP address in the block is reserved as the network identifier and the last IP address is reserved for directed broadcasts.
3
Determine the range of usable host IP addresses.
The usable host range is 172.16.40.129 through 172.16.40.190.
Subtracting 2 reserved addresses (network and broadcast) defines the assignable host IP boundaries.
4
Evaluate the choices against the calculated host range.
172.16.40.130 and 172.16.40.189 are within the range 172.16.40.129–172.16.40.190, whereas 172.16.40.128 is the network ID and 172.16.40.191 is the broadcast address.
Only IP addresses strictly located between the network ID and broadcast address can be assigned to host devices.

Key Concept

Usable IPv4 Host Range Calculation
Question 1705Question →

A network administrator is troubleshooting DHCP lease failures for client devices on a newly established remote subnet (172.16.10.0/24172.16.10.0/24). The centralized DHCP server resides on a core management subnet (10.100.1.0/2410.100.1.0/24). Packet captures on the client-facing Layer 3 interface confirm that client broadcast DHCPDISCOVER packets are arriving at the local gateway, but no request packets are reaching the DHCP server. Which of the following statements correctly describe the required configuration and protocol behavior of the DHCP relay agent in this scenario? (Select TWO)

Select all that apply

Show answer & explanation

Answer: The `ip helper-address 10.100.1.24` command must be applied directly to the client-facing Layer 3 interface serving as the default gateway for the 172.16.10.0/24172.16.10.0/24 subnet.; The relay agent converts the client's broadcast request into a unicast UDP packet directed to destination port 67 on the centralized DHCP server.

Answer

The correct statements are that the `ip helper-address` command must be applied to the client-facing Layer 3 interface, and that the relay agent converts the broadcast request into a unicast UDP packet directed to port 67 on the DHCP server.
DHCP relay agents (configured via `ip helper-address` on Cisco/standard network equipment) must be placed on the client-facing interface so the router intercepts client broadcast packets at the Layer 3 ingress boundary. The relay agent populates the `giaddr` (Gateway IP Address) field with its local interface address, converts the broadcast into a unicast packet, and forwards it over UDP port 67 to the DHCP server address specified in the helper configuration.

Step-by-Step Solution

1
Identify the ingress point for client broadcasts
DHCP clients send broadcast DHCPDISCOVER messages on their local subnet (172.16.10.0/24172.16.10.0/24). Routers do not forward broadcasts by default.
The relay feature (`ip helper-address`) must be enabled on the specific Layer 3 interface receiving these broadcast frames so the router can intercept them.
2
Analyze protocol encapsulations and port numbers
The relay agent populates the Gateway IP Address (`giaddr`) field with its own interface IP (172.16.10.1172.16.10.1) and forwards the frame via unicast UDP to destination port 67 on the DHCP server.
DHCP uses UDP port 67 for server communication and UDP port 68 for client communications. Relaying converts local broadcast to routable unicast.

Key Concept

DHCP Relay Agent Architecture and IP Helper Operations
Question 1706Question →

A network technician adds a new Layer 3 switch to a multi-access Ethernet network segment running OSPF Area 00. The operational Designated Router (DR) on the segment has a Router ID of 10.1.1.110.1.1.1 and an OSPF priority of 11. The new switch is configured with an OSPF priority of 255255 and a Router ID of 10.1.1.25410.1.1.254. What will happen to the DR role on this network segment immediately after the new switch establishes adjacency?

Show answer & explanation

Answer: The operational Designated Router retains the DR role because OSPF DR elections are non-preemptive.

Answer

The operational Designated Router retains the DR role because OSPF DR elections are non-preemptive.
In OSPF multi-access broadcast networks, Designated Router (DR) and Backup Designated Router (BDR) elections are non-preemptive. Once a router assumes the DR role, it maintains that role until its OSPF process is reset, the interface goes down, or the router reboots. Adding a router with a higher priority (such as 255) will not displace an active DR.

Step-by-Step Solution

1
Identify the dynamic routing protocol and election state
The network segment uses OSPF in a multi-access broadcast topology with an established DR.
OSPF elects a Designated Router (DR) and Backup Designated Router (BDR) to minimize LSA flooding on broadcast networks.
2
Evaluate the impact of introducing a router with a higher priority value (255255)
The new router has a higher priority than the current DR (11), but the current DR is already active.
OSPF DR/BDR election logic is explicitly non-preemptive to prevent constant network churn and routing recalculations whenever routers boot up or restart.
3
Determine the resulting DR status
The current DR remains DR. The new router may become BDR (if eligible and BDR is vacant) or a DROTHER.
A re-election for DR only occurs if the existing DR router process fails, the interface goes down, or the OSPF process is manually cleared.

Key Concept

OSPF Designated Router (DR) Non-Preemptive Election Logic
Question 1707Question →

An enterprise network operating the Open Shortest Path First (OSPF) routing protocol experiences an unexpected fiber link failure between two core routers. Place the steps of the OSPF link-state convergence process in the correct chronological order from first event to final completion.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of OSPF convergence events is: 1) Physical or Hello failure detection, 2) Updated LSA creation, 3) LSA flooding across adjacent neighbors, 4) LSDB update on area routers, and 5) Dijkstra SPF algorithm execution to update the routing table.
The standard link-state convergence lifecycle follows a mandatory sequence: local link/keepalive failure detection occurs first, followed by new LSA generation, area-wide LSA flooding, LSDB database synchronization, and finally SPF (Dijkstra) calculation to compute new best routes.

Step-by-Step Solution

1
Identify the initial event triggering network convergence.
The local interface detects link loss or misses Hello packets, marking the neighbor or link down.
A router must detect a local state change before it can initiate topology updates.
2
Trace the creation and propagation of link-state information.
The detecting router generates a new LSA and floods it to adjacent OSPF neighbors via LSU packets.
OSPF requires reliable flooding so all routers in the area maintain an identical topology database.
3
Determine how receiving routers process the update and recalculate paths.
Neighboring routers update their LSDB and then execute the Dijkstra SPF algorithm to recalculate best routes for the routing table.
The SPF algorithm relies on an accurate LSDB input to compute valid shortest path trees.

Key Concept

OSPF Link-State Convergence Sequence
Estimated Time:1m 30s
Question 1708Question →

During a physical layer audit of a newly acquired office building, a network technician discovers that several workstation drops connected to wall outlet RJ-45 jacks are failing wiremap tests due to crossed pairs and split pairs between the wall plates and the intermediate distribution frame (IDF) punch-down blocks. The technician needs to review documentation that illustrates individual conductor pinouts, wire color-coding standards (T568A vs. T568B), block terminations, and detailed cable run paths. Which of the following documentation types should the technician consult to resolve this issue?

Show answer & explanation

Answer: Wiring schematic

Answer

Wiring schematic
A wiring schematic (or cable diagram) provides detailed specifications of physical wire terminations, conductor pinouts (such as T568A or T568B), wire color pairs, and connections between wall outlets and punch-down blocks. This makes it the proper document for diagnosing and fixing wiremap errors such as split pairs or crossed wires.

Step-by-Step Solution

1
Analyze the technical requirement described in the scenario.
The requirement focuses on resolving physical layer wiremap failures, conductor color-coding standards (T568A/T568B), and pinout terminations at punch-down blocks.
Identifying the specific layer and artifact needed narrows down the documentation category from logical topology or rack placement to low-level physical wiring.
2
Evaluate the primary purpose of a wiring schematic versus other documentation types.
Wiring schematics explicitly document conductor pinouts, cable runs, jack designations, and wire color pairings.
Wiring schematics provide the granular detail required to fix split pairs, crossed conductors, and punch-down mistakes.
3
Select the documentation type that directly answers the physical cabling requirement.
The wiring schematic is the correct documentation type.
Other diagram types (logical, rack elevation, performance baseline) operate at higher structural or operational levels.

Key Concept

Wiring Diagrams and Cable Schematics
Question 1709Question →

A network engineer needs to document a newly expanded network segment connecting three branch offices. The documentation must clearly illustrate IP subnet ranges, gateway addresses, interface names, and dynamic routing protocol boundaries, without showing physical cable lengths or hardware rack locations. Which of the following documentation types is most appropriate for this requirement?

Show answer & explanation

Answer: Logical topology diagram

Answer

Logical topology diagram
A logical topology diagram displays how data logically moves through a network. It includes critical network-layer details such as IP address schemes, subnet masks, default gateways, and routing protocol relationships, making it the correct document for mapping layer 3 architecture without detailing physical hardware placement.

Step-by-Step Solution

1
Identify the required elements to document
The requirements call for showing IP subnets, interface addresses, and routing protocol boundaries.
These elements pertain to network layer data paths and logical address structures rather than physical placement.
2
Compare document types against the requirements
Logical topology diagrams map out subnets, IP configurations, and routing protocols, while physical topology, rack diagrams, and wiring schematics focus on hardware layout and cabling.
Selecting a logical diagram satisfies the goal of illustrating data flow and addressing without clutter from physical hardware dimensions.

Key Concept

Logical vs. Physical Network Diagrams
Estimated Time:45s
Question 1710Question →

A network administrator is configuring Network Address Translation (NAT) and Port Address Translation (PAT) on an edge router for an organization. The private internal network uses the 10.0.0.0/810.0.0.0/8 address space. The requirements state that hundreds of internal workstations must share a single registered public IPv4 address for outbound internet access, and external users must be able to securely access an internal HTTPS web server (10.0.0.5010.0.0.50) using that same public IP address. Which of the following implementation steps or mechanisms must be configured on the router to fulfill these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable Port Address Translation (PAT / NAT Overload) to map multiple internal private IP addresses to the single public IP address using unique source port numbers.; Configure a static port forwarding (destination PAT) rule mapping inbound traffic aimed at public TCP port 443 to the internal IP address 10.0.0.50 on port 443.

Answer

Port Address Translation (PAT / NAT Overload) must be configured for outbound host traffic using unique source port numbers, and a static port forwarding rule mapping public TCP port 443 to internal IP address 10.0.0.50:443 must be configured for inbound web traffic.
To satisfy both requirements using a single public IP address, the network administrator must implement PAT (NAT Overload) for outbound traffic, which uses unique source port numbers to track connections for multiple internal hosts. In addition, static port forwarding (destination PAT) must be configured to translate incoming requests targeting public TCP port 443 directly to the web server's internal address of 10.0.0.50 on port 443.

Step-by-Step Solution

1
Analyze outbound internet access requirements for multiple hosts.
Identified that hundreds of private hosts must share a single public IP address.
PAT (NAT Overload) uses unique Layer 4 source ports to multiplex outbound connections over a single public IPv4 address.
2
Analyze inbound external access requirements for the HTTPS web server.
Identified that external clients must reach 10.0.0.50 on TCP port 443 via the single public IP address.
Static port forwarding (destination PAT) maps incoming public IP traffic on TCP 443 to the specific internal server private IP and port.

Key Concept

NAT Overload (PAT) and Static Port Forwarding Implementation
Question 1711Question →

An enterprise router joins a newly configured OSPF area. Place the operational steps of the link-state dynamic routing process in the correct order, from initial neighbor discovery to final route installation.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence is: 1) Neighbors discovered via Hello packets → 2) LSAs flooded across the area → 3) LSDB compiled and synchronized → 4) SPF (Dijkstra) algorithm executed → 5) Optimal paths installed in the routing table.
In link-state dynamic routing protocols such as OSPF, operations strictly follow a deterministic order. First, Hello packets establish neighbor relationships. Next, LSAs carrying link status details are flooded throughout the network segment. The received LSAs build an identical Link-State Database (LSDB) across all routers. Each router then executes Dijkstra's Shortest Path First (SPF) algorithm against the LSDB to construct a shortest path tree. Finally, the best-cost paths are committed to the IP routing table.

Step-by-Step Solution

1
Initiate neighbor discovery
Adjacent OSPF routers exchange Hello packets to negotiate parameters and establish neighbor state.
Routing information cannot be securely exchanged until direct neighbor adjacency and compatibility are confirmed.
2
Exchange topology details
Routers flood Link-State Advertisements (LSAs) describing their connected links and operational states.
LSAs communicate current link status and metrics across the OSPF domain.
3
Synchronize database
Flooded LSAs are saved into a unified Link-State Database (LSDB).
Link-state protocols require every router within an area to maintain a complete, synchronized map of the network topology.
4
Calculate optimal routes
The Dijkstra Shortest Path First (SPF) algorithm processes the LSDB tree.
SPF evaluates cumulative link costs to determine the shortest loop-free paths to all known network prefixes.
5
Populate the routing table
Best paths derived from the SPF calculation are placed into the IP Routing Information Base (RIB).
Only after SPF execution are valid, active routes made available to the router's forwarding engine.

Key Concept

OSPF Link-State Operational Phases
Estimated Time:1m 30s
Question 1712Question →

Match each dynamic routing protocol to its corresponding architectural classification and primary metric selection criteria.

Click a left item, then click its matching right item

Items

OSPF (Open Shortest Path First)
BGP (Border Gateway Protocol)
EIGRP (Enhanced Interior Gateway Routing Protocol)
RIPv2 (Routing Information Protocol v2)

Matches

Show answer & explanation

Answer

OSPF matches Link-state IGP using cost derived from bandwidth; BGP matches Path-vector EGP using Autonomous System paths; EIGRP matches Advanced distance-vector IGP using bandwidth and delay; RIPv2 matches Distance-vector IGP using hop count with a 15-hop limit.
Each routing protocol is defined by its operational algorithm and metrics: OSPF is a link-state IGP calculating path cost from bandwidth; BGP is a path-vector EGP routing between Autonomous Systems; EIGRP is an advanced distance-vector protocol using a composite metric of bandwidth and delay; and RIPv2 is a traditional distance-vector protocol using hop count up to a maximum limit of 15 hops.

Step-by-Step Solution

1
Identify protocol scopes (IGP vs EGP)
BGP is the only Exterior Gateway Protocol (EGP) in the list used for inter-domain routing across Autonomous Systems.
Categorizing by protocol scope isolates BGP to the path-vector EGP description.
2
Classify remaining Interior Gateway Protocols by algorithm type
OSPF uses link-state (Shortest Path First), RIPv2 uses distance-vector (Bellman-Ford), and EIGRP uses advanced distance-vector (DUAL).
Protocol algorithms dictate link state database propagation versus route vector updates.
3
Evaluate metric calculation methods for each IGP
OSPF calculates cost based on bandwidth; EIGRP uses a composite metric (bandwidth and delay); RIPv2 uses simple hop count (max 15).
Each routing protocol utilizes specific quantitative metrics to determine the optimal route to a destination.

Key Concept

Dynamic Routing Protocol Classification and Metric Evaluation
Estimated Time:1m 30s
Question 1713Question →

A network administrator is sub-dividing an allocated IPv4 address block of 172.28.16.0/20172.28.16.0/20 into contiguous subnets with a /23/23 prefix length for datacenter switches. What is the broadcast address of the second /23/23 subnet?

Show answer & explanation

Answer: 172.28.19.255172.28.19.255

Answer

The broadcast address of the second /23/23 subnet is 172.28.19.255172.28.19.255.
Dividing 172.28.16.0/20172.28.16.0/20 into /23/23 subnets yields block increments of 22 in the third octet. The first subnet spans 172.28.16.0172.28.16.0 to 172.28.17.255172.28.17.255. The second subnet starts at 172.28.18.0172.28.18.0 and spans through 172.28.19.255172.28.19.255. Therefore, 172.28.19.255172.28.19.255 is the broadcast address of the second subnet.

Step-by-Step Solution

1
Determine the size and block increment of a /23/23 subnet in the third octet.
A /23/23 subnet has 32−23=932 - 23 = 9 host bits (29=5122^9 = 512 total addresses). In the third octet, each subnet increments by 512/256=2512 / 256 = 2.
Calculating the block size allows identification of subnet boundaries.
2
Calculate the network address boundaries for the first and second subnets starting from 172.28.16.0/20172.28.16.0/20.
Subnet 1 starts at 172.28.16.0/23172.28.16.0/23. Subnet 2 starts at 172.28.18.0/23172.28.18.0/23. Subnet 3 starts at 172.28.20.0/23172.28.20.0/23.
Adding the third octet increment of 22 identifies each subnet's network ID.
3
Identify the broadcast address for the second subnet (172.28.18.0/23172.28.18.0/23).
The broadcast address is one address below the start of Subnet 3 (172.28.20.0172.28.20.0), which is 172.28.19.255172.28.19.255.
The highest numerical address in a subnet range is reserved as the broadcast address.

Key Concept

IPv4 Subnet Boundary and Broadcast Address Calculation
Question 1714Question →

Match each network documentation artifact to its primary operational scenario or deployment use case.

Click a left item, then click its matching right item

Items

Rack Elevation Diagram
Logical Topology Diagram
Cable Schedule & Wiring Schematic
Network Baseline Document

Matches

Show answer & explanation

Answer

Rack Elevation Diagram matches planning thermal/power/U-space; Logical Topology Diagram matches auditing IP subnets/VLAN IDs/routing protocols; Cable Schedule & Wiring Schematic matches tracing physical pinouts/patch panel runs; Network Baseline Document matches comparing current usage to historical metrics.
Each documentation type addresses a specific operational layer: Rack Elevation Diagrams detail equipment mounting and physical space allocation in equipment racks; Logical Topology Diagrams describe IP subnets, VLANs, and routing layers; Cable Schedules detail physical wire paths and patch panel terminations; Network Baselines store historical performance metrics to detect performance deviations.

Step-by-Step Solution

1
Identify physical hardware layout requirements
Correlate physical rack U-space, cooling, and power planning to the Rack Elevation Diagram.
Rack elevations focus on physical mounting and spatial organization within equipment racks.
2
Identify network layer connectivity requirements
Correlate IP subnets, VLAN IDs, and routing protocol information to the Logical Topology Diagram.
Logical diagrams represent software abstraction, addressing, and protocol data flow across the network.
3
Identify physical cabling mapping requirements
Correlate structured cabling runs, patch panel port mappings, and wire pinouts to the Cable Schedule & Wiring Schematic.
Wiring schematics document media connections and physical line drops from patch panels to jacks.
4
Identify performance evaluation requirements
Correlate historical performance data comparisons to the Network Baseline Document.
Baselines establish normal operating thresholds for network traffic and health metrics.

Key Concept

Distinguishing distinct operational purposes of physical, logical, cabling, and baseline network documentation artifacts.
Question 1715Question →

During a network architecture review, an engineer explains how distance-vector routing protocols prevent routing loops on a local subnetwork. Specifically, the protocol prevents a router from advertising a learned route back out of the exact interface from which it received that update. Which mechanism is the engineer describing?

Show answer & explanation

Answer: Split horizon

Answer

Split horizon is the loop-prevention rule that prevents a router from advertising a network route back through the same interface from which it was learned.
Split horizon directly prevents distance-vector routing loops by prohibiting a router from sending routing information about a network back out of the interface through which the router originally learned about that network.

Step-by-Step Solution

1
Analyze the operational constraint described in the scenario.
The scenario highlights a rule prohibiting route propagation back toward the source interface.
Distance-vector routing protocols rely on neighbor-reported distance updates and require loop-mitigation techniques.
2
Differentiate between packet-level and protocol-level loop mitigation.
IP header TTL operates on individual packets, whereas split horizon governs route advertisement announcements between routers.
Preventing invalid route announcements prevents routing loops from forming in the routing table initially.

Key Concept

Distance-Vector Loop Prevention Mechanics (Split Horizon)
Question 1716Question →

A client workstation with an empty local DNS cache needs to access an internal corporate host at host.finance.example.com. The workstation sends a DNS query to its configured recursive DNS server, which subsequently performs iterative lookups to resolve the fully qualified domain name (FQDN). In what order do the steps of this DNS name resolution process occur from initial request to final IP resolution?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with the client issuing a recursive DNS query to the local DNS server, followed by iterative queries from the local server to a Root Name Server, the .com TLD Name Server, and the authoritative example.com Name Server, concluding with the authoritative server returning the IP address to the local server, which caches and forwards it to the client.
The DNS resolution sequence follows a top-down hierarchical flow when resolving an uncached hostname: 1) The client stub resolver sends a recursive query to the configured local resolver. 2) The local resolver queries a Root Name Server to find the appropriate TLD server (.com). 3) The local resolver queries the .com TLD server to find the authoritative server for example.com. 4) The local resolver queries the authoritative server for host.finance.example.com. 5) The authoritative server returns the IP address answer to the local resolver, which caches the result and returns it to the client stub resolver.

Step-by-Step Solution

1
Client initiates request
The client stub resolver sends a recursive query to the local DNS resolver.
The client requires host name resolution and delegates the work to its local recursive server.
2
Query Root Name Server
The local resolver queries a Root Name Server and receives NS records for .com TLD servers.
Iterative resolution begins at the root level of the DNS hierarchy.
3
Query TLD Name Server
The local resolver queries the .com TLD server and receives NS records for example.com authoritative servers.
TLD servers hold delegation references for registered domain names within their domain.
4
Query Authoritative Name Server
The local resolver queries the authoritative DNS server for host.finance.example.com.
The authoritative server holds the actual resource records (such as A/AAAA records) for the zone.
5
Return and cache answer
The authoritative server returns the IP address; the local DNS server caches the result and sends the final answer to the client.
This completes the recursive lookup request and populates the resolver cache to speed up subsequent queries.

Key Concept

DNS Recursive vs. Iterative Resolution Hierarchy
Question 1717Question →

A network engineer is configuring a centralized DHCP server (10.100.1.5010.100.1.50) to service client devices across multiple remote subnets. A workstation located on the Sales subnet (192.168.15.0/24192.168.15.0/24) broadcasts a DHCPDISCOVER message, which is intercepted by the local default gateway router. How does the central DHCP server determine which specific IP address scope to allocate the lease from?

Show answer & explanation

Answer: The server evaluates the Gateway IP Address (giaddr) field in the DHCP header, which was populated by the relay agent with its local interface IP address.

Answer

The server evaluates the Gateway IP Address (giaddr) field in the DHCP header, which was populated by the relay agent with its local incoming interface IP address.
When a Layer 3 device functions as a DHCP relay agent (e.g., using `ip helper-address`), it receives the client's local broadcast DHCPDISCOVER packet and rewrites it into a unicast packet destined for the central DHCP server. Crucially, the relay agent fills the Gateway IP Address (`giaddr`) field in the DHCP header with the IP address of the local interface on which the broadcast was received. Upon receiving the relayed packet, the central DHCP server inspects the `giaddr` value to select an IP address from the pool corresponding to that specific subnet.

Step-by-Step Solution

1
Analyze the client DHCPDISCOVER broadcast packet.
The client issues a broadcast packet with source IP 0.0.0.00.0.0.0 and destination IP 255.255.255.255255.255.255.255 on UDP port 67.
Clients requesting an initial IP address lease do not yet possess an IP address and broadcast to find available DHCP servers.
2
Examine the DHCP relay agent processing on the Layer 3 interface.
The router acting as a DHCP relay agent intercepts the broadcast, inserts its own interface IP address (192.168.15.1192.168.15.1) into the giaddr field, and changes the packet to a unicast packet targeting the central server (10.100.1.5010.100.1.50).
Centralized DHCP servers reside outside the local broadcast domain and require the giaddr field to identify the client's subnet.
3
Evaluate how the DHCP server matches the incoming request to a pool.
The DHCP server reads 192.168.15.1192.168.15.1 from the giaddr field and selects an available lease from the matching 192.168.15.0/24192.168.15.0/24 scope.
The giaddr field explicitly informs the server which subnet pool must be used to generate the offer.

Key Concept

DHCP Relay Gateway IP Address (giaddr) Field Scope Selection
Question 1718Question →

During a bandwidth exhaustion incident, a network administrator inspects packet captures at the perimeter firewall. The logs show a massive influx of inbound UDP traffic on port 123 directed at an enterprise public IP address. The payload responses originate from third-party public time servers responding to spoofed monlistmonlist commands that the target enterprise never initiated. Which of the following network attack types is being executed?

Show answer & explanation

Answer: NTP Amplification Attack

Answer

NTP Amplification Attack is being executed.
An NTP Amplification attack is a Distributed Denial of Service (DDoS) vector where attackers exploit publicly exposed Network Time Protocol (NTP) servers running on UDP port 123. By sending requests with a spoofed source IP (the victim's IP address) using commands like monlist—which returns a list of up to 600 recent clients—the attacker forces the time server to reply with a payload up to hundreds of times larger than the request. The target receives a massive wave of unsolicited responses, resulting in extreme network bandwidth exhaustion.

Step-by-Step Solution

1
Analyze the service and port number identified in the packet capture.
UDP port 123 corresponds directly to Network Time Protocol (NTP).
Identifying the transport protocol and port establishes the application protocol being exploited.
2
Examine the attack payload behavior and traffic direction.
The target receives unrequested high-volume responses triggered by spoofed request queries (such as the monlist command).
This behavior defines a reflection and amplification distributed denial-of-service attack mechanism.
3
Correlate the protocol and attack structure to determine the precise threat classification.
Combining UDP port 123 (NTP) with reflection/amplification tactics confirms an NTP Amplification Attack.
Differentiates this specific vector from other reflection techniques like DNS amplification or localized protocol poisoning.

Key Concept

NTP Amplification Attack
Estimated Time:1m 30s
Question 1719Question →

An enterprise network administrator is auditing the organization's external DNS zone files and service discovery settings. Match each DNS resource record type on the left with its correct primary technical function or scenario application on the right.

Click a left item, then click its matching right item

Items

SRV Record
PTR Record
SOA Record
TXT Record

Matches

Show answer & explanation

Answer

The correct pairings link SRV records to service locator parameters (port, priority, weight), PTR records to reverse IP-to-hostname resolution, SOA records to zone authority and timing metadata, and TXT records to published email security key and policy strings.
Each DNS record type provides distinct functionality: SRV for service locator metadata with port and priority parameters; PTR for reverse IP address mapping; SOA for governing zone administrative metadata and transfer timing; and TXT for hosting email authentication policies like SPF and DKIM keys.

Step-by-Step Solution

1
Analyze SRV record attributes
Identify that SRV records uniquely incorporate symbolic service names, protocols, priorities, weights, and target destination ports.
Standard hostname-to-IP records do not embed layer-4 transport port numbers or load balancing weights.
2
Evaluate PTR record operation
Associate PTR records with reverse lookup resolution mapping IP addresses back to domain names.
Reverse resolution relies on pointer records stored within specialized reverse DNS zones.
3
Inspect SOA record zone parameters
Match SOA records with zone transfer timers, administrator email addresses, primary authority designation, and zone serial number updates.
The Start of Authority record governs administrative metadata and secondary server zone transfer behavior.
4
Examine TXT record security applications
Connect TXT records to SPF validation policy strings and DKIM public key distribution.
TXT records act as flexible text containers heavily leveraged by anti-spoofing and domain authentication standards.

Key Concept

DNS Resource Record Functions and Applications
Question 1720Question →

A network administrator configures a disaster recovery backup schedule consisting of a full system backup executed every Sunday at midnight and differential backups executed every weeknight from Monday through Friday. A storage array fails on Thursday afternoon before Thursday's backup takes place. Which of the following backup sets are required to perform a complete system restoration to the latest available point in time? Select TWO.

Select all that apply

Show answer & explanation

Answer: The full backup created on Sunday at midnight; The differential backup created on Wednesday night

Answer

To restore a system configured with a weekly full backup and daily differential backups, the required media are the last baseline full backup (Sunday at midnight) and the most recent differential backup (Wednesday night).
When recovering data from a differential backup strategy, restoration requires exactly two components: the last baseline full backup and the latest differential backup taken before the crash. The Sunday full backup provides the baseline state, and the Wednesday differential backup contains all changes made from Monday through Wednesday.

Step-by-Step Solution

1
Identify the backup strategy in use
The system utilizes a Sunday full backup combined with daily differential backups.
Differential backups save all data modified since the last full backup.
2
Determine the necessary recovery points
The failure occurred on Thursday afternoon, meaning Wednesday night's differential backup is the newest completed backup.
Thursday's backup has not yet occurred.
3
Apply differential restore rules
Restore the Sunday full backup first, followed directly by the Wednesday differential backup.
Differential backups are cumulative, rendering intermediate daily backups (Monday and Tuesday) unnecessary for recovery.

Key Concept

Differential Backup Restoration Sequence
PreviousPage 86 / 112Next
All practice questions — CompTIA Network+ | Examkin