Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 161Question →

A network administrator is reconfiguring an enterprise application server to query an Active Directory domain controller using encrypted Lightweight Directory Access Protocol over SSL/TLS (LDAPS). The existing firewall rule permits standard unencrypted directory queries, but secure authentication attempts are currently being dropped. Which of the following port and transport protocol combinations must be permitted through the firewall to allow LDAPS communications?

Show answer & explanation

Answer: TCP port 636

Answer

TCP port 636 is required to allow secure Lightweight Directory Access Protocol (LDAPS) traffic.
Lightweight Directory Access Protocol over SSL/TLS (LDAPS) uses TCP port 636 to secure directory query authentication via transport layer encryption.

Step-by-Step Solution

1
Identify the target protocol and encryption requirement from the scenario.
The scenario requires Lightweight Directory Access Protocol over SSL/TLS (LDAPS).
Differentiating between cleartext and encrypted directory services is necessary to identify the proper destination port.
2
Determine the transport layer protocol requirement.
Establishing a TLS session requires reliable, stateful transmission provided by TCP.
TCP handles session setup and reliable delivery needed for cryptographic handshakes.
3
Match the protocol to its standardized default port number.
Standard LDAP operates over TCP port 389, while encrypted LDAPS uses TCP port 636.
Firewall rules must permit TCP port 636 to allow encrypted directory authentication.

Key Concept

Common Ports and Protocols - Secure Directory Services (LDAP vs LDAPS)
Question 162Question →

A network engineer is troubleshooting IP configuration failures on a newly provisioned subinterface for host workstations on VLAN 40 (10.40.16.0/2210.40.16.0/22). Client devices on this VLAN are unable to communicate with remote subnets and consistently auto-assign Automatic Private IP Addressing (APIPA) addresses in the range of 169.254.x.x169.254.x.x. Packet captures performed on the router interface `Gi0/0.40` reveal that incoming `DHCPDISCOVER` broadcast frames from clients are arriving at the router interface, but no corresponding unicast packets are forwarded to the centralized DHCP server located at 10.10.2.100/2410.10.2.100/24.

The subinterface configuration on the router is displayed below:

text
interface GigabitEthernet0/0.40
encapsulation dot1Q 40
ip address 10.40.16.1 255.255.252.0

Which of the following identifies the root cause of this issue and the correct command required on interface `Gi0/0.40` to resolve host connectivity?

Show answer & explanation

Answer: The subinterface lacks a relay configuration to bridge Layer 2 broadcasts across subnets; configure `ip helper-address 10.10.2.100` on interface `Gi0/0.40`.

Answer

The subinterface lacks a relay configuration to bridge Layer 2 broadcasts across subnets; configure `ip helper-address 10.10.2.100` on interface `Gi0/0.40`.
Because client hosts and the DHCP server reside on different IP subnets (VLAN 40 vs. the server subnet 10.10.2.0/24), the router interface facing the clients must act as a DHCP Relay Agent. By default, routers block Layer 2 broadcast traffic such as `DHCPDISCOVER`. Configuring `ip helper-address 10.10.2.100` on subinterface `Gi0/0.40` allows the router to forward DHCP requests as unicast traffic across the Layer 3 boundary to the target server address.

Step-by-Step Solution

1
Analyze symptom and packet capture evidence
Workstations auto-assign APIPA (169.254.x.x169.254.x.x) addresses, and incoming Layer 2 `DHCPDISCOVER` broadcasts reach `Gi0/0.40`, but no unicast frames leave the router toward the DHCP server at 10.10.2.10010.10.2.100.
DHCP broadcast messages operate at Layer 2 and are stopped at the router boundary by default.
2
Evaluate subinterface configuration
`Gi0/0.40` has 802.1Q tagging and an IP address assigned, but lacks an `ip helper-address` directive.
Without an IP helper address configured, the router cannot relay Layer 2 DHCP broadcasts across Layer 3 subnets to a remote DHCP server.
3
Determine remediation step
Add `ip helper-address 10.10.2.100` under `interface GigabitEthernet0/0.40`.
This instructs the router to encapsulate incoming `DHCPDISCOVER` broadcasts into unicast UDP packets addressed directly to 10.10.2.10010.10.2.100 with the gateway IP address (`giaddr`) set to 10.40.16.110.40.16.1.

Key Concept

DHCP Relay Agent and IP Helper Address Placement
Estimated Time:2m 0s
Question 163Question →

An enterprise Layer 2 switch has Port 1 and Port 2 assigned to VLAN 1010, and Port 3 assigned to VLAN 2020. Port 1 receives an Ethernet frame with an unknown destination MAC address. Which of the following actions will the switch take upon receiving this frame?

Show answer & explanation

Answer: Flood the frame out Port 2 only, while updating the MAC address table with the source MAC address on Port 1 in VLAN 1010.

Answer

The switch will flood the frame out Port 2 only while recording the source MAC address of the frame on Port 1 in VLAN 10.
When a Layer 2 switch receives an Ethernet frame with an unknown destination MAC address, it performs unknown unicast flooding. This operation forwards a copy of the frame out every port belonging to the same VLAN as the receiving port, except the port on which the frame arrived. Because Port 1 and Port 2 reside in VLAN 10, Port 2 is the only eligible forwarding destination. Furthermore, the switch updates its MAC address table with the frame's source MAC address mapped to Port 1 within VLAN 10.

Step-by-Step Solution

1
Examine source MAC address learning
The switch inspects the ingress frame's source MAC address and maps it to Port 1 and VLAN 1010 in its CAM table.
Layer 2 switches build MAC address tables dynamically by observing incoming frame source addresses.
2
Examine destination MAC lookup
The destination MAC address is missing from the switch MAC table for VLAN 1010, marking it as an unknown unicast frame.
When a destination MAC address is not present in the table, the switch cannot perform selective point-to-point forwarding.
3
Determine flooding domain scope
The switch forwards the frame out Port 2 (VLAN 1010) only, completely excluding Port 3 (VLAN 2020).
VLAN boundaries define separate Layer 2 broadcast domains; unknown unicast flooding is strictly contained within the ingress VLAN.

Key Concept

Layer 2 Unknown Unicast Flooding and VLAN Broadcast Domain Isolation
Question 164Question →

An enterprise operations team is allocated the network block 172.28.64.0/21172.28.64.0/21 to deploy microservices within a private cloud environment. To satisfy security policies, the administrator must divide this entire block into equal-sized subnets such that each subnet can accommodate at least 100100 usable host IP addresses while reserving as much space as possible for maximum subnetting density (using the longest possible subnet mask that meets the requirement). What is the total number of usable host IP addresses available across all created subnets combined?

Show answer & explanation

Answer: 2016

Answer

2016 usable host IP addresses
To host at least 100100 usable IP addresses, each subnet requires 77 host bits (27−2=1262^7 - 2 = 126 usable hosts), which corresponds to a /25/25 prefix (32−7=2532 - 7 = 25). Subnetting a /21/21 network block into /25/25 subnets yields 225−21=24=162^{25-21} = 2^4 = 16 distinct subnets. Because each /25/25 subnet reserves 11 network address and 11 broadcast address, each subnet has 126126 usable host IPs. Across all 1616 subnets, the total usable host capacity is 16×126=201616 \times 126 = 2016.

Step-by-Step Solution

1
Determine the required subnet mask for each subnet to support at least 100 hosts
A /25/25 prefix (255.255.255.128255.255.255.128) providing 126 usable host IP addresses per subnet
The formula for usable hosts is 2h−2≥1002^h - 2 \ge 100. For h=6h = 6, 26−2=622^6 - 2 = 62 (insufficient). For h=7h = 7, 27−2=1262^7 - 2 = 126 (sufficient). The subnet prefix length is 32−7=2532 - 7 = 25.
2
Calculate how many /25/25 subnets fit into the parent /21/21 block
16 subnets
The difference between the new subnet prefix (/25/25) and the parent prefix (/21/21) is 25−21=425 - 21 = 4 bits. The number of subnets is 24=162^4 = 16.
3
Calculate the total aggregate usable host capacity
2016 aggregate usable host addresses
Multiplying the total subnets (1616) by the usable hosts per subnet (126126) yields 16×126=201616 \times 126 = 2016.

Key Concept

Subnet partitioning and usable host capacity calculation under CIDR constraints
Question 165Question →

A network engineer is configuring an 802.1Q trunk link between two switches, SW-CORE-01 and SW-ACCESS-02, to carry traffic for VLAN 10 (Data), VLAN 20 (Voice), and VLAN 99 (Native/Management). Interface GigabitEthernet0/1 on SW-CORE-01 is configured with `switchport trunk native vlan 99`. However, interface GigabitEthernet0/1 on SW-ACCESS-02 was accidentally left with default settings (`switchport trunk native vlan 1`). If a host on SW-ACCESS-02 transmits unencapsulated (untagged) Ethernet frames into GigabitEthernet0/1, how will SW-CORE-01 handle these incoming frames, and what security/operational issue will occur?

Show answer & explanation

Answer: SW-CORE-01 will associate the untagged frames with VLAN 99, causing traffic sent on VLAN 1 from SW-ACCESS-02 to leak into VLAN 99 on SW-CORE-01.

Answer

SW-CORE-01 will associate the untagged frames with VLAN 99, leading to cross-VLAN traffic leakage between VLAN 1 (on SW-ACCESS-02) and VLAN 99 (on SW-CORE-01).
IEEE 802.1Q trunking sends frames belonging to the native VLAN untagged over the link. When a receiving switch gets an untagged frame on a trunk interface, it maps that frame to its local native VLAN configuration. Because SW-CORE-01 has its native VLAN set to VLAN 99, any untagged frame sent by SW-ACCESS-02 (originating from its native VLAN 1) will be placed directly into VLAN 99 on SW-CORE-01, causing cross-VLAN traffic leakage and potential Spanning Tree Protocol (STP) inconsistencies.

Step-by-Step Solution

1
Analyze the trunk configuration and 802.1Q native VLAN operation
IEEE 802.1Q trunks transmit frames belonging to the configured native VLAN without adding a 4-byte 802.1Q tag.
By default, native VLAN traffic is sent untagged across the link.
2
Evaluate ingress frame processing on SW-CORE-01
When SW-CORE-01 receives an untagged frame on GigabitEthernet0/1, it assigns the frame to its own locally configured native VLAN, which is VLAN 99.
Trunk interfaces determine the VLAN membership of untagged incoming frames solely based on their local native VLAN assignment.
3
Identify the cross-VLAN traffic leakage anomaly
Frames originated on VLAN 1 on SW-ACCESS-02 are egressed untagged and subsequently placed into VLAN 99 upon ingress at SW-CORE-01.
A native VLAN mismatch bridges two separate broadcast domains at Layer 2 without a router, breaking VLAN segmentation.

Key Concept

802.1Q Native VLAN Ingress Processing and Mismatch Behavior
Question 166Question →

A network technician is configuring an IEEE 802.1Q trunk link between two switches. By default, how does an 802.1Q trunk port process outgoing frames belonging to the native VLAN?

Show answer & explanation

Answer: It forwards the frames across the trunk link without inserting an 802.1Q header tag.

Answer

By default, an IEEE 802.1Q trunk port forwards outgoing frames belonging to the native VLAN across the trunk link without inserting an 802.1Q header tag.
Under the IEEE 802.1Q standard, frames belonging to the native VLAN (VLAN 1 by default) are transmitted across trunk links without adding an 802.1Q tag header. When the receiving switch receives an untagged frame on a trunk interface, it automatically assigns that frame to its configured native VLAN.

Step-by-Step Solution

1
Identify the standard tagging mechanism used by IEEE 802.1Q on trunk links.
IEEE 802.1Q inserts a 4-byte tag into Ethernet frames to identify VLAN membership for tagged VLANs.
Tagging allows multiple VLANs to share a single physical trunk link while maintaining logical separation.
2
Determine the special exception for native VLAN traffic on an 802.1Q trunk.
Frames associated with the native VLAN are forwarded across the trunk without receiving an 802.1Q tag header.
Backward compatibility with legacy non-trunking devices requires one VLAN's traffic to remain untagged.

Key Concept

IEEE 802.1Q Native VLAN Tagging Behavior
Question 167Question →

A Layer 3 core switch processes an incoming packet destined for host 10.50.4.15010.50.4.150. The switch's active routing table contains four candidate routes:

- Route 1: 10.50.4.0/2210.50.4.0/22 via OSPF (Administrative Distance: 110, Metric: 20)
- Route 2: 10.50.4.128/2510.50.4.128/25 via iBGP (Administrative Distance: 200, Metric: 100)
- Route 3: 10.50.0.0/1610.50.0.0/16 via Static Route (Administrative Distance: 1, Metric: 0)
- Route 4: 10.50.4.128/2610.50.4.128/26 via EIGRP External (Administrative Distance: 170, Metric: 15)

Which route will the switch select to forward the packet, and what is the primary decision rule applied?

Show answer & explanation

Answer: Route 4 (10.50.4.128/2610.50.4.128/26), because longest prefix match takes precedence over administrative distance and metric.

Answer

The switch will select Route 4 (10.50.4.128/2610.50.4.128/26) because longest prefix match is the primary rule for Layer 3 forwarding decisions.
The router uses the Longest Prefix Match (LPM) rule as the absolute first criterion when making forwarding decisions. Subnet mask /26/26 (255.255.255.192255.255.255.192) has 26 network bits, making it more specific than /25/25, /22/22, or /16/16. Because Route 4 covers 10.50.4.15010.50.4.150 and has the longest prefix length, it is selected immediately regardless of its higher Administrative Distance.

Step-by-Step Solution

1
Determine which subnets contain the destination address 10.50.4.15010.50.4.150.
The destination address 10.50.4.15010.50.4.150 falls into all four subnet ranges: 10.50.0.0/1610.50.0.0/16 (10.50.0.0−10.50.255.25510.50.0.0 - 10.50.255.255), 10.50.4.0/2210.50.4.0/22 (10.50.4.0−10.50.7.25510.50.4.0 - 10.50.7.255), 10.50.4.128/2510.50.4.128/25 (10.50.4.128−10.50.4.25510.50.4.128 - 10.50.4.255), and 10.50.4.128/2610.50.4.128/26 (10.50.4.128−10.50.4.19110.50.4.128 - 10.50.4.191).
Before selecting a route, a router checks which routing table entries encompass the target IP address.
2
Compare the subnet mask lengths of the matching candidate routes.
Prefix lengths are /16, /22, /25, and /26. The longest prefix match is /26 (Route 4).
The Longest Prefix Match (LPM) rule dictates that the route with the most specific (longest) subnet mask is chosen first.
3
Evaluate whether Administrative Distance (AD) or Metric needs to be considered.
LPM resolves the routing decision immediately, so AD (1 vs 110 vs 170 vs 200) and metrics are ignored.
Administrative Distance and metrics are tie-breakers used only when candidate routes have identical prefix lengths.

Key Concept

Longest Prefix Match (LPM) Routing Table Logic
Question 168Question →

A security operations team requires a centralized AAA solution for managing network device administrative sessions. The requirements specify that authentication and authorization functions must be separated to allow granular command-level authorization, and the entire packet payload between the switch and AAA server must be encrypted. Which protocol and transport layer combination meets these security requirements?

Show answer & explanation

Answer: TACACS+ using TCP port 49

Answer

TACACS+ using TCP port 49
TACACS+ is designed for network device management because it decouples authentication and authorization, permitting per-command authorization policies. It also encrypts the entire packet body (everything past the header) and utilizes connection-oriented TCP port 49 for reliable transport.

Step-by-Step Solution

1
Evaluate protocol payload encryption and AAA modularity features
TACACS+ decouples authentication and authorization (enabling command-by-command authorization) and encrypts the entire payload following the TACACS+ header
RADIUS combines authentication and authorization and only encrypts the password field in Access-Request packets
2
Identify transport protocol and standard port association
TACACS+ uses TCP port 49 for reliable connection delivery
UDP is employed by RADIUS (ports 1812 and 1813), whereas TACACS+ relies on TCP

Key Concept

AAA Protocol Architectural Differences (TACACS+ vs RADIUS)
Question 169Question →

A security engineer is configuring a site-to-site Virtual Private Network (VPN) between two gateway routers across an untrusted public network. The mandate requires that the entire original IP packet—including both its header and payload—must be fully encrypted and encapsulated within a new outer IP header for gateway-to-gateway transit. Which IPsec operational mode and protocol combination must be deployed to satisfy these requirements?

Show answer & explanation

Answer: IPsec Tunnel mode using Encapsulating Security Payload (ESP)

Answer

IPsec Tunnel mode using Encapsulating Security Payload (ESP) is the correct choice because Tunnel mode encapsulates the complete original IP packet in a new IP header for site-to-site gateway transport, and ESP provides the required confidentiality through payload encryption.
IPsec Tunnel mode is designed for site-to-site security gateways. It encapsulates the entire original IP packet inside a new outer IP header. Encapsulating Security Payload (ESP) encrypts the inner packet payload, ensuring total confidentiality across untrusted networks.

Step-by-Step Solution

1
Identify the required IPsec mode based on network architecture and header treatment.
Tunnel mode is required because the scenario calls for site-to-site encapsulation of the entire original IP packet (header + payload) inside a new outer IP header between gateway routers.
Transport mode only protects the IP payload and preserves the original IP header, making it suitable only for end-to-end host scenarios.
2
Identify the required IPsec security protocol based on cryptographic services needed.
Encapsulating Security Payload (ESP) is required because confidentiality (encryption) of the data is requested.
Authentication Header (AH) provides integrity and anti-replay protection but provides no encryption/confidentiality.
3
Combine the mode and protocol selection.
IPsec Tunnel mode + ESP fulfills both requirements: complete packet encapsulation for gateway transit and encryption for data privacy.
This combination forms the standard foundation for site-to-site IPsec VPN tunnels.

Key Concept

IPsec Modes (Tunnel vs. Transport) and Protocols (ESP vs. AH)
Question 170Question →

An enterprise network administrator notices that user authentication attempts using Kerberos are failing across multiple branch offices due to time skew between client workstations and domain controllers. To ensure automated clock synchronization across the network, which transport protocol and destination port must be permitted on the network firewalls?

Show answer & explanation

Answer: UDP port 123

Answer

UDP port 123 is required to allow Network Time Protocol (NTP) traffic for network-wide time synchronization.
Network Time Protocol (NTP) uses UDP port 123 to maintain accurate time synchronization across systems, which is essential for time-sensitive protocols such as Kerberos authentication.

Step-by-Step Solution

1
Identify the required network service based on the symptom of time skew causing Kerberos authentication failures.
The necessary service is Network Time Protocol (NTP), which provides clock synchronization across devices.
Kerberos relies on accurate timestamps (typically within 5 minutes) to prevent replay attacks.
2
Determine the transport protocol and standard port number used by NTP.
NTP operates over UDP on port 123.
UDP is chosen for its minimal protocol overhead and low latency, which are critical for precise timing.

Key Concept

Network Time Protocol (NTP) operates over UDP port 123 to synchronize system clocks across network devices.
Estimated Time:1m 0s
Question 171Question →

A network administrator observes a flood of incoming ICMP Echo Reply packets targeting a key internal server. Investigation reveals that an external attacker sent ICMP Echo Requests to a network broadcast address with the source IP address spoofed to match the target server's IP address. Which type of network attack is taking place?

Show answer & explanation

Answer: Smurf attack

Answer

Smurf attack
The correct option describes a Smurf attack, which is a legacy form of denial-of-service (DoS) attack where an attacker broadcasts ICMP Echo Requests containing a spoofed source IP belonging to the target host. Every active host receiving the broadcast responds to the target host, creating a massive influx of ICMP Echo Reply traffic.

Step-by-Step Solution

1
Analyze the attack signature described in the scenario
Traffic consists of ICMP Echo Requests sent to a broadcast IP address with a spoofed source IP address.
Identifying the combination of ICMP traffic, IP spoofing, and broadcast addressing reveals the specific amplification mechanism.
2
Match the mechanism to the correct network attack type
The target system is overwhelmed by ICMP Echo Replies from multiple hosts on the network.
This specific technique of using network broadcast addresses to amplify ICMP traffic against a victim defines a Smurf attack.

Key Concept

Common Network Attack Types - Smurf Attack
Question 172Question →

A network security team investigates an incident where an internal server crashed due to an IP fragmentation reassembly attack (Teardrop attack). Although an out-of-band Network Intrusion Detection System (NIDS) was actively monitoring traffic via a switch SPAN port with up-to-date threat signatures, it generated no alerts during the attack. Subsequent packet capture analysis reveals that the attacker intentionally transmitted overlapping IPv4 fragments with inconsistent offset values. Which of the following statements correctly explain why the passive NIDS failed to trigger an alert, and which architectural adjustment would directly prevent this evasion technique? (Select TWO)

Select all that apply

Show answer & explanation

Answer: The passive NIDS reassembled the overlapping fragments using different OS-specific reassembly logic than the target server host, causing the NIDS to inspect a harmless payload stream while the host reassembled a malicious one.; Deploying an inline Network Intrusion Prevention System (NIPS) capable of active packet normalization to reassemble, defragment, and sanitize traffic before it reaches target servers.

Answer

The NIDS failed to alert because passive sensors may utilize a different IP fragment reassembly algorithm (operating system target policy) than the target host, allowing overlapping fragments to construct a benign payload on the NIDS while forming a crash-inducing payload on the host. To directly resolve this evasion vulnerability, the organization should deploy an inline NIPS with packet normalization capabilities, which actively defragments, cleans, and sanitizes IP fragment streams before delivering packets to the host.
Passive out-of-band NIDS sensors process duplicated traffic via SPAN/TAP ports and must maintain target host operating system profile policies to reassemble IP fragments accurately. When fragment overlaps occur, an OS-policy mismatch between the NIDS engine and the destination host allows malformed payloads to bypass NIDS signature engines undetected. Replacing or supplementing this with an inline Network Intrusion Prevention System (NIPS) configured for packet normalization resolves the vulnerability by actively enforcing uniform fragment reassembly and dropping illegal overlapping offset sequences before they reach internal endpoints.

Step-by-Step Solution

1
Analyze why a passive NIDS fails during overlapping IP fragment attacks.
Identify that passive NIDS sensors must predict host OS fragment reassembly rules (e.g., First, Last, Linux, BSD, Windows policies). Inconsistent reassembly policies between NIDS and host allow attackers to disguise malicious payloads from passive inspection.
If the NIDS reassembles fragments differently than the target server, the NIDS inspects an innocent payload stream while the host executes the exploit.
2
Evaluate technical capabilities of passive NIDS vs. inline NIPS mechanisms against evasion attacks.
Determine that passive out-of-band monitoring cannot sanitize or alter packets in transit. An inline NIPS actively intercepts and normalizes traffic.
Inline packet normalization ensures that all IP fragments are defragmented and normalized into a single predictable stream before hitting internal destination endpoints.

Key Concept

IP Fragmentation Evasion Ambiguity and NIPS Packet Normalization
Question 173Question →

A network technician is organizing documentation for network protocol operations and device functions across the Open Systems Interconnection (OSI) reference model. Match each OSI model layer on the left with its corresponding function and data structure on the right.

Click a left item, then click its matching right item

Items

Layer 2 (Data Link Layer)
Layer 3 (Network Layer)
Layer 4 (Transport Layer)
Layer 6 (Presentation Layer)

Matches

Show answer & explanation

Answer

Layer 2 matches with Frame PDU and MAC addressing; Layer 3 matches with Packet PDU and IP routing; Layer 4 matches with Segment PDU and port multiplexing; Layer 6 matches with Data formatting, syntax encoding, and encryption.
Each OSI layer serves a specific role: Layer 2 processes Frames using MAC addresses; Layer 3 routes Packets using IP addresses; Layer 4 multiplexes application streams into Segments using port numbers; Layer 6 formats, encodes, and encrypts payload Data.

Step-by-Step Solution

1
Identify the protocol data unit (PDU) and core function for Layer 2.
Layer 2 operates with Frames and hardware MAC addresses for adjacent node delivery.
Data Link controls access to the physical media and verifies frame integrity.
2
Identify the PDU and core function for Layer 3.
Layer 3 handles Packets, logical IP addresses, and routing between subnets.
Network layer provides end-to-end path determination across heterogeneous networks.
3
Identify the PDU and core function for Layer 4.
Layer 4 handles Segments/Datagrams and utilizes port numbers to direct traffic to correct process sockets.
Transport layer provides host-to-host connection management and flow control.
4
Identify the primary responsibility of Layer 6.
Layer 6 manages data representation, encoding standards, compression, and encryption.
Presentation layer ensures data sent by the application layer of one system is readable by the application layer of another.

Key Concept

OSI Model Layer Responsibilities and Protocol Data Units
Question 174Question →

A network administrator is reviewing filtering methods for perimeter security devices. Which of the following statements accurately describe the operational behavior of stateless firewalls and standard packet filters? (Select TWO)

Select all that apply

Show answer & explanation

Answer: They evaluate each network packet independently using static criteria such as source/destination IP addresses and port numbers.; They require separate explicit rules to permit return traffic because connection state context is not retained.

Answer

Stateless firewalls evaluate each packet independently against static rules (such as IP addresses and port numbers) and require separate explicit rules for return traffic because they do not track connection session state.
Stateless firewalls assess each packet on its own using header fields (IP addresses, protocols, port numbers) without maintaining state tables. As a result, return traffic generated from internal requests is not automatically recognized and requires an explicit matching permit rule.

Step-by-Step Solution

1
Analyze how stateless firewalls process traffic packets.
Stateless firewalls inspect each packet individually against configured access rules without storing state tables or session context.
Stateless filtering operates at Layers 3 and 4, checking header information on a per-packet basis.
2
Determine the impact of stateless processing on return traffic flows.
Because no state table exists to identify return packets belonging to established connections, explicit rules must be defined in both directions.
Without dynamic state tracking, return traffic is evaluated like any new incoming packet.

Key Concept

Stateless Firewall Packet Inspection & Rule Processing
Question 175Question →

An enterprise network utilizes a centralized DHCP server on a management subnet to serve clients across multiple remote VLANs. A host on VLAN 30 initiates dynamic address assignment via a Layer 3 relay switch configured with Option 82 agent information insertion. In what chronological sequence do the packet processing and forwarding steps occur during the initial address discovery phase?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence begins with the local client broadcasting a DHCPDISCOVER message on VLAN 30. Next, the Layer 3 relay agent intercepts the broadcast, appends Option 82 payload data, populates its own interface IP into the giaddr field, and forwards the packet via unicast UDP port 67 to the central server. The DHCP server inspects the giaddr value to allocate an available address from the VLAN 30 scope and sends a unicast DHCPOFFER back to the relay agent. Finally, the relay agent removes Option 82 header tags and forwards the DHCPOFFER to the client on VLAN 30.
The DHCP relay process begins with a local Layer 2 broadcast (DHCPDISCOVER). The relay agent converts this into a unicast frame augmented with Option 82 and giaddr IP information directed to the central DHCP server's UDP port 67. The central server uses the giaddr field to match the correct subnet pool and returns a unicast DHCPOFFER to the relay agent. The relay agent removes Option 82 tags and delivers the offer frame back to the local client.

Step-by-Step Solution

1
Client broadcast initiation
DHCPDISCOVER frame is transmitted onto the local Layer 2 broadcast domain.
Unconfigured hosts do not possess an IP address or knowledge of the server location, requiring a broadcast transmission.
2
Relay agent interception and encapsulation
The broadcast is converted to a unicast packet targeting the server on UDP port 67 with giaddr and Option 82 appended.
Routers drop Layer 2 broadcasts by default; the helper agent acts as a proxy to cross Layer 3 boundaries.
3
Server processing and unicast reply
DHCPOFFER packet is crafted and sent back to the giaddr IP of the relay agent.
The server uses giaddr to map the request to the matching IP pool subnet and relies on unicast routing back to the relay.
4
Relay agent decapsulation and local delivery
Option 82 data is stripped and the DHCPOFFER is delivered to the client on VLAN 30.
The client network card expects standard DHCP response formatting on its local segment.

Key Concept

DHCP Relay Agent and Option 82 Forwarding Sequence
Question 176Question →

A network administrator is auditing static IP assignments on a database cluster segment configured with the IPv4 subnet block 10.150.96.64/2610.150.96.64/26. Which of the following IP addresses are valid, assignable host addresses within this specific subnet range? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: 10.150.96.9510.150.96.95; 10.150.96.12610.150.96.126

Answer

The valid assignable host addresses are 10.150.96.9510.150.96.95 and 10.150.96.12610.150.96.126.
For the subnet 10.150.96.64/2610.150.96.64/26, the network ID is 10.150.96.6410.150.96.64 and the broadcast address is 10.150.96.12710.150.96.127. The range of addresses usable for host assignment is 10.150.96.6510.150.96.65 through 10.150.96.12610.150.96.126. Both 10.150.96.9510.150.96.95 and 10.150.96.12610.150.96.126 reside within this valid host range.

Step-by-Step Solution

1
Determine the subnet mask and block size from the CIDR prefix.
A prefix of /26/26 corresponds to a subnet mask of 255.255.255.192255.255.255.192. The block size is 256−192=64256 - 192 = 64.
Calculating the block size identifies the IP increment between subnets.
2
Identify the network address and broadcast address for the given block.
The network address is 10.150.96.6410.150.96.64. The next subnet boundary starts at 10.150.96.12810.150.96.128, making the broadcast address for this segment 10.150.96.12710.150.96.127.
The network address is the first address of the block, and the broadcast address is the final address before the next subnet.
3
Determine the range of usable host IP addresses.
The usable host IP range spans from 10.150.96.6510.150.96.65 (Network ID + 1) to 10.150.96.12610.150.96.126 (Broadcast ID - 1).
Network and broadcast addresses are reserved and cannot be assigned to host interfaces.
4
Evaluate the candidate options against the usable host range.
10.150.96.9510.150.96.95 and 10.150.96.12610.150.96.126 fall inside the usable range (10.150.96.6510.150.96.65 - 10.150.96.12610.150.96.126), whereas 10.150.96.6410.150.96.64 and 10.150.96.12710.150.96.127 are reserved.
Only IP addresses within the usable range can be assigned to host devices.

Key Concept

IPv4 Subnet Boundaries and Usable Host Range
Question 177Question →

During a network infrastructure audit, a system administrator observes that client endpoints in a newly provisioned subnet are failing to resolve network services by name and cannot locate the primary Domain Controller for Kerberos authentication. To resolve service locator requests for specific network protocols (such as LDAP or Kerberos) including port numbers and target hostnames, which type of DNS resource record must be configured in the domain zone?

Show answer & explanation

Answer: SRV record

Answer

The SRV (Service) record is the correct DNS resource record type required to locate servers offering specific network services such as LDAP and Kerberos.
The SRV (Service) record defines hostnames and port numbers for specific services, enabling domain clients to discover directory and authentication services such as LDAP and Kerberos.

Step-by-Step Solution

1
Identify the specific DNS requirement in the scenario.
The requirement is to map a protocol service (LDAP/Kerberos) to a destination server hostname and port number.
Client endpoints rely on service location mechanisms to discover directory and authentication services.
2
Evaluate the functions of standard DNS resource record types.
SRV records define symbolic names, target hostnames, port numbers, priority, and weight for specific services.
Other record types (A, AAAA, CNAME, PTR, MX) lack port specification fields for general network services.

Key Concept

DNS Service Location (SRV) Records
Estimated Time:1m 0s
Question 178Question →

A network administrator is reviewing the switchport configuration on switch `SW-ACCESS-01` after users in the Accounting department (VLAN 20) report a loss of connectivity to servers on the same VLAN across the trunk link to `SW-CORE-01`.

The administrator inspects the output of `show interfaces trunk` on `SW-ACCESS-01` for the inter-switch link interface `GigabitEthernet 0/1`:

text
Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1

Port Vlans allowed on trunk
Gi0/1 1-10, 30-100

Which command executed on interface `GigabitEthernet 0/1` of `SW-ACCESS-01` will resolve the connectivity issue for VLAN 20 traffic?

Show answer & explanation

Answer: switchport trunk allowed vlan add 20

Answer

Execute the command `switchport trunk allowed vlan add 20` on interface GigabitEthernet 0/1 to permit VLAN 20 traffic across the trunk link.
The output indicates that VLAN 20 is currently pruned (excluded) from the allowed VLAN list (`1-10, 30-100`) on interface GigabitEthernet 0/1. Issuing the command to add VLAN 20 to the allowed list permits frames tagged with VLAN 20 to be transmitted across the 802.1Q trunk link.

Step-by-Step Solution

1
Analyze the trunk configuration status output
The `Vlans allowed on trunk` list shows `1-10, 30-100`, which explicitly excludes VLAN 20.
When a VLAN is omitted from the allowed list on an 802.1Q trunk, frames tagged for that VLAN are dropped at ingress/egress.
2
Determine the corrective remediation command
Using `switchport trunk allowed vlan add 20` appends VLAN 20 to the existing allowed range without overwriting existing permitted VLANs.
This modifies the interface configuration to permit tagged frames for VLAN 20 across the trunk connection.

Key Concept

802.1Q Trunk Allowed VLAN List Configuration
Question 179Question →

A network administrator is designing an IP addressing scheme for a newly provisioned server VLAN. The VLAN must accommodate static IPv4 address assignments for 30 application servers, 1 default gateway router interface, and 1 monitoring appliance (a total of 32 usable host IP addresses). Which of the following represents the smallest CIDR prefix that satisfies this requirement?

Show answer & explanation

Answer: /26

Answer

The correct subnet mask is /26 because it provides 62 usable host IP addresses, which is the smallest CIDR prefix capable of accommodating all 32 required host devices.
To host 32 devices, a subnet must supply at least 32 usable IP addresses. Because 2 addresses are reserved for network and broadcast identification (2h−22^h - 2), 5 host bits (/27) only provide 30 usable addresses. Therefore, 6 host bits (/26) are required, offering 62 usable host IP addresses, making it the smallest prefix that meets the 32-device requirement.

Step-by-Step Solution

1
Calculate the total number of usable host IP addresses required.
30 application servers + 1 default gateway + 1 monitoring appliance = 32 usable host IP addresses.
Every network-attached interface requires a unique usable IPv4 host address.
2
Apply the usable host formula 2h−2≥required hosts2^h - 2 \ge \text{required hosts} to find the necessary host bits (hh).
Testing h=5h = 5: 25−2=302^5 - 2 = 30 usable hosts (insufficient). Testing h=6h = 6: 26−2=622^6 - 2 = 62 usable hosts (sufficient).
Two IP addresses in every subnet are reserved for the network ID (all host bits 0) and the broadcast address (all host bits 1).
3
Calculate the CIDR prefix from the required host bits.
32 total IPv4 bits - 6 host bits = /26 subnet prefix.
The CIDR prefix notation represents the number of network bits (32−h32 - h).

Key Concept

IPv4 Subnet Mask Calculation and Reserved Addresses
Question 180Question →

A network technician is setting up SNMPv3 on a managed switch to send performance monitoring data securely to a network management server using the authPriv security level. Which TWO of the following algorithms or features must be enabled to satisfy the requirements of this specific security level? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Secure Hash Algorithm (SHA) for data authentication and integrity; Advanced Encryption Standard (AES) for payload privacy and encryption

Answer

Secure Hash Algorithm (SHA) for data authentication and Advanced Encryption Standard (AES) for payload encryption.
The SNMPv3 authPriv mode requires both authentication and encryption. Secure Hash Algorithm (SHA) provides user authentication and data integrity, while Advanced Encryption Standard (AES) provides packet payload confidentiality through encryption.

Step-by-Step Solution

1
Identify the requirements of the SNMPv3 authPriv security level.
The authPriv (Authentication and Privacy) level mandates both user authentication and payload encryption.
SNMPv3 defines three security levels: noAuthNoPriv (no security), authNoPriv (authentication without encryption), and authPriv (both authentication and encryption).
2
Select the appropriate authentication protocol.
Secure Hash Algorithm (SHA) or Message Digest 5 (MD5) satisfies the authentication requirement.
Hashing algorithms provide cryptographic verification of data origin and integrity.
3
Select the appropriate privacy/encryption protocol.
Advanced Encryption Standard (AES) or Data Encryption Standard (DES) satisfies the privacy requirement.
Symmetric encryption algorithms encrypt the packet payload to prevent eavesdropping.

Key Concept

SNMPv3 Security Levels (authPriv)
PreviousPage 9 / 112Next
All practice questions — CompTIA Network+ | Examkin