Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 1801Question →

A network technician is hardening remote administrative access on a core router deployed at an enterprise edge site. To comply with security baseline requirements, all remote management sessions must use strong payload encryption, and inactive administrative sessions must automatically terminate after five minutes. Which configuration strategy correctly fulfills these hardening requirements?

Show answer & explanation

Answer: Enable SSH version 2 for administrative access and configure an exec-timeout of 5 minutes on all VTY lines.

Answer

The correct option specifies configuring SSH version 2 for administrative access and setting an exec-timeout of 5 minutes on all VTY lines.
Enabling SSH version 2 ensures that all interactive remote management traffic and authentication credentials are encrypted end-to-end. Applying an execution timeout (exec-timeout) of 5 minutes directly to all VTY lines ensures that inactive remote management connections are automatically closed, mitigating the risk of unauthorized access via hijacked or unattended sessions.

Step-by-Step Solution

1
Identify the encryption requirement for remote management plane hardening.
SSH version 2 (SSHv2) provides secure, encrypted remote terminal sessions, whereas legacy protocols like Telnet transmit credentials and data in cleartext.
Hardening best practices mandate disabling plaintext management protocols like Telnet and HTTP in favor of encrypted alternatives like SSHv2 and HTTPS.
2
Identify the mechanism for automatically terminating idle administrative sessions.
Applying an `exec-timeout 5 0` command (5 minutes, 0 seconds) directly to virtual terminal (VTY) lines forces the operating system to close inactive sessions.
Unattended active administrative sessions present a major security risk for unauthorized local or remote access.

Key Concept

Management Plane Hardening via SSH and VTY Session Timeouts
Question 1802Question →

A network technician is troubleshooting an issue where client machines on the local network cannot access an internal secure web application hosted at `https://app.corp.local`. The technician executes `nslookup app.corp.local` on a client machine, which successfully resolves `app.corp.local` to IP address `10.10.20.15`. The technician then connects remotely to the server at `10.10.20.15` and runs the `netstat -ano` command, obtaining the following output snippet:

Proto Local Address Foreign Address State PID
TCP 10.10.20.15:80 0.0.0.0:0 LISTENING 2044
TCP 10.10.20.15:8080 0.0.0.0:0 LISTENING 3112
UDP 10.10.20.15:53 *:* 1088

Based on the command output and scenario details, which of the following is the primary cause of the connection failure?

Show answer & explanation

Answer: The web application service on the server is not bound or listening on TCP port 443.

Answer

The web application service on the server is not bound or listening on TCP port 443.
Secure HTTP (HTTPS) communication requires a web server process listening on TCP port 443. The netstat command output indicates that the server at 10.10.20.15 has active listening sockets for TCP port 80 (HTTP), TCP port 8080, and UDP port 53 (DNS), but no service bound to TCP port 443. Consequently, incoming HTTPS connection attempts to HTTPS default port 443 are rejected by the host OS.

Step-by-Step Solution

1
Analyze DNS lookup results
The domain name `app.corp.local` successfully resolves to IPv4 address `10.10.20.15`, confirming DNS name resolution is functioning properly.
Rule out DNS resolution failure as the root cause of the connection error.
2
Analyze netstat output protocol and port bindings
The netstat snippet lists active listening sockets on TCP port 80 (HTTP), TCP port 8080 (alternate HTTP), and UDP port 53 (DNS).
Identify which network services and transport ports are currently active on the destination server.
3
Correlate client request protocol with server listening ports
The client is attempting an HTTPS connection (`https://app.corp.local`), which requires a listening socket on TCP port 443. No process on the server is listening on TCP port 443.
HTTPS operates over TCP port 443 by standard convention; without a service listening on this port, TCP handshake attempts will be refused.

Key Concept

Analyzing Command-Line Utility Output (netstat socket state and port bindings)
Question 1803Question →

A network administrator is investigating connectivity complaints from users on a newly deployed subnet (10.20.50.0/2410.20.50.0/24). An affected workstation displays an IP address of 169.254.112.45169.254.112.45 and a subnet mask of 255.255.0.0255.255.0.0. The organization's central DHCP server is located on a separate administrative segment (10.20.10.1010.20.10.10). Which of the following issues could cause the client to receive this address? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The local router interface serving as the default gateway for 10.20.50.0/2410.20.50.0/24 is missing a DHCP relay agent (ip helper-address) configuration.; The DHCP scope designated for the 10.20.50.0/2410.20.50.0/24 subnet on the central server has exhausted all available IP addresses.

Answer

The client receiving an Automatic Private IP Addressing (APIPA) address indicates a failure to communicate with or obtain an IP lease from a DHCP server. The two valid root causes are: 1) missing DHCP relay (IP helper) configuration on the local default gateway router interface, which prevents broadcast discovery frames from reaching the remote DHCP server, and 2) scope exhaustion on the DHCP server for that specific subnetwork pool.
An APIPA address (169.254.0.1 through 169.254.255.254) indicates that the client attempted to obtain an IP lease via DHCP but received no response. When a DHCP server resides on a different IP subnet than the client, broadcast DHCPDISCOVER packets require a Layer 3 relay agent (such as ip helper-address on network routers) to unicast the request to the central DHCP server. Without this relay, requests are dropped by the default gateway. Alternatively, if the relay is functioning but the DHCP server has run out of available addresses in its scope pool for that subnet, no lease can be granted, resulting in APIPA self-assignment.

Step-by-Step Solution

1
Analyze the reported IP address signature.
The host IPv4 address 169.254.112.45169.254.112.45 with mask 255.255.0.0255.255.0.0 is an APIPA address assigned when a DHCP client gets no reply to DHCPDISCOVER broadcasts.
Identifying APIPA establishes that the core problem is DHCP request/response failure rather than an inline routing or Layer 1 hardware failure.
2
Evaluate subnetwork boundaries between client and DHCP server.
The client is on 10.20.50.0/2410.20.50.0/24 while the DHCP server is on 10.20.10.1010.20.10.10. Broadcasts do not traverse routers without a relay agent.
If the local router interface lacks an ip helper-address directive, DHCPDISCOVER packets are dropped at the Layer 3 boundary.
3
Evaluate server-side scope availability.
If the relay agent is active but the DHCP server scope has zero available leases, the server cannot offer an address.
Scope exhaustion produces the identical APIPA symptom on client machines.

Key Concept

APIPA Diagnosis and DHCP Relay Configuration
Question 1804Question →

Place the standard IEEE 802.1D Spanning Tree Protocol (STP) port states in chronological sequence from initial link activation on an unconfigured switch interface to full user data transmission capability.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence of IEEE 802.1D STP port states is Blocking State, Listening State, Learning State, and Forwarding State.
Under standard IEEE 802.1D STP operations, an activated interface progresses through four distinct operational states in order: Blocking (prevents loops by receiving BPDUs only), Listening (exchanges BPDUs to determine root bridge and port roles), Learning (builds MAC address tables without forwarding user traffic), and Forwarding (fully processes user data frames and BPDUs).

Step-by-Step Solution

1
Identify the initial state immediately following physical link establishment.
The port starts in the Blocking state to discard frames and listen for incoming BPDUs.
Immediate data forwarding upon link activation could cause bridging loops before topology information is evaluated.
2
Determine the second state after the initial Forward Delay timer expires.
The port transitions to the Listening state.
During Listening, the port actively transmits and receives BPDUs to participate in root bridge election and determine port roles without learning MAC addresses.
3
Determine the third state after the second Forward Delay timer expires.
The port transitions to the Learning state.
In the Learning state, the switch populates its MAC address table from incoming frame source addresses while continuing to hold user data frame forwarding.
4
Identify the final operational state.
The port enters the Forwarding state.
Once MAC table entry acquisition completes without loop detection, the port safely transitions into full user data frame processing.

Key Concept

Chronological IEEE 802.1D STP Port State Transitions
Question 1805Question →

During a security assessment on an enterprise network segment, a SOC analyst observes that users attempting to establish encrypted HTTPS connections to an external server are transparently modified in transit by an adversary on the local network segment. The adversary intercepts initial connection requests and converts HTTPS links into unencrypted HTTP links, forcing client browsers to transmit credentials in plaintext over port 80 while maintaining a separate secure session with the target server. Which of the following network attack types is being executed?

Show answer & explanation

Answer: SSL stripping

Answer

The attack being executed is SSL stripping, where an inline adversary downgrades secure HTTPS communication to unencrypted HTTP traffic.
SSL stripping is an on-path attack where an adversary downgrades HTTPS traffic to unencrypted HTTP. By modifying HTTP response headers and location redirects, the adversary forces the client to send sensitive data over plaintext port 80 while maintaining a separate TLS session with the authentic remote destination.

Step-by-Step Solution

1
Analyze the observed attack mechanics from the scenario.
The attacker intercepts live connection attempts, modifies secure HTTPS links to standard HTTP links, and forces plaintext transmission on port 80.
Identifying the target protocol layer and header modification vector narrows down the specific attack mechanism.
2
Differentiate transport encryption stripping from domain resolution and protocol misconfigurations.
DNS-based attacks alter name-to-IP resolution before packets leave the host, whereas inline session manipulation downgrades protocol negotiation.
SSL stripping operates on active HTTP/HTTPS session negotiation rather than DNS record lookup infrastructure.

Key Concept

SSL Stripping and Man-in-the-Middle TLS Downgrade Vectors
Question 1806Question →

A network administrator is preparing to reconfigure VLAN assignments and update dynamic routing protocols across multiple switches in a campus network. To ensure proper IP address allocation, subnet boundaries, and virtual interface configurations are correctly mapped, the administrator needs to consult a document that illustrates how data flows logically through the network, regardless of physical cable connections or equipment rack positions. Which of the following documentation types best meets this requirement?

Show answer & explanation

Answer: Logical network diagram

Answer

Logical network diagram
A logical network diagram provides an overview of network architecture including IP subnets, VLAN routing, gateway addresses, and interface configurations without cluttering the view with physical cable routes or rack locations.

Step-by-Step Solution

1
Identify the operational requirement presented in the scenario.
The administrator requires documentation showing IP addresses, subnets, VLAN IDs, and logical data paths independent of physical layout.
VLAN reconfigurations and routing protocol updates depend on Layer 2 and Layer 3 logical boundaries.
2
Evaluate available documentation types based on their purpose.
A logical network diagram explicitly illustrates how data flows through subnets, VLANs, and routers.
Logical diagrams focus on architecture and addressing, whereas physical diagrams, rack elevations, or wiring schematics focus on hardware placement and physical cabling.

Key Concept

Logical vs. Physical Network Documentation
Estimated Time:1m 0s
Question 1807Question →

An enterprise organization is assigned the IPv6 global routing prefix 2001:db8:abc::/482001:\text{db8}:\text{abc}::/48. A network engineer is configuring a dedicated /64/64 subnet for VLAN 3030 (represented as hexadecimal 00300030 in the subnet field) and needs to assign the first usable host IPv6 address in that subnet to the default gateway interface. Which of the following represents the correctly compressed IPv6 address with its prefix length for the default gateway interface?

Show answer & explanation

Answer: 2001:db8:abc:30::1/64

Answer

2001:db8:abc:30::1/64
The correct answer properly applies RFC 5952 IPv6 address shorthand rules. The 16-bit subnet hextet 0030 suppresses leading zeros to become 30, and the contiguous run of zero hextets in the interface ID (0000:0000:0000:0001) is compressed into a single double colon (::), yielding 2001:db8:abc:30::1/64.

Step-by-Step Solution

1
Determine the uncompressed 128-bit IPv6 address structure.
Combining the global prefix (2001:0db8:0abc), the 16-bit subnet ID for VLAN 30 (0030), and the first host interface ID (0000:0000:0000:0001) yields 2001:0db8:0abc:0030:0000:0000:0000:0001.
A /48 global prefix allocates bits 49–64 for the subnet ID and bits 65–128 for the interface ID.
2
Suppress leading zeros in each 16-bit hextet.
0db8 becomes db8, 0abc becomes abc, 0030 becomes 30, and 0001 becomes 1. The address becomes 2001:db8:abc:30:0:0:0:1.
RFC 5952 mandates the suppression of leading zeros in every hextet.
3
Compress contiguous zero hextets.
The four consecutive zero hextets (:0:0:0:) are replaced by a single double colon (::), producing 2001:db8:abc:30::1/64.
RFC 5952 specifies replacing the longest run of consecutive zero hextets with a single '::' symbol.

Key Concept

IPv6 Address Compression Rules (RFC 5952)
Question 1808Question →

A client workstation on a corporate network initiates a web connection to `service.partner.org`. Assuming no DNS records are cached on the client or intermediate servers, place the following DNS resolution steps in the correct chronological order from the initial request to the final address delivery.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence begins with the client stub resolver querying the local recursive resolver. The local resolver then performs iterative lookups by querying the Root Name Server, followed by the `.org` TLD Name Server, and finally the Authoritative Name Server for `partner.org`. Lastly, the local resolver caches the record and returns the IP address to the client.
In standard DNS architecture, name resolution follows a hierarchical top-down lookup pattern when un-cached. The client host sends a recursive query to its local DNS server. The local DNS server then performs iterative queries starting at the Root servers (top level), proceeding to the TLD servers (`.org`), and ending at the domain's Authoritative servers (`partner.org`). Finally, the local server caches the answer and forwards it back to the client host.

Step-by-Step Solution

1
Identify the initiating query
The client's stub resolver sends a recursive query to its configured local recursive resolver.
Clients do not traverse the DNS hierarchy directly; they rely on recursive resolvers.
2
Query the top of the DNS hierarchy
The local resolver queries a Root Name Server to find the TLD server for `.org`.
Root servers direct resolvers to the appropriate Top-Level Domain name servers.
3
Query the TLD server
The local resolver queries the `.org` TLD server to obtain the authoritative name servers for `partner.org`.
TLD servers maintain delegation records (NS records) for domains registered under their extension.
4
Query the Authoritative server
The local resolver queries the authoritative server for `partner.org` and retrieves the A/AAAA record for `service.partner.org`.
Authoritative servers store the actual DNS resource records for the targeted domain.
5
Deliver and cache the final result
The local resolver caches the answer and returns the IP address to the originating client host.
Caching speeds up future queries, and returning the answer allows the client host to establish a TCP/IP connection.

Key Concept

Recursive and Iterative DNS Resolution Flow
Question 1809Question →

A network security administrator is configuring a top-to-bottom IPv4 extended Access Control List (ACL) on a gateway router interface. The ACL must enforce the following security policy objectives:
1. Allow administrative host 192.168.1.10192.168.1.10 SSH access (TCPTCP port 22) to management server 10.0.0.510.0.0.5.
2. Block all other traffic from internal subnet 192.168.1.0/24192.168.1.0/24 destined to management server 10.0.0.510.0.0.5.
3. Allow all hosts on subnet 192.168.1.0/24192.168.1.0/24 HTTP access (TCPTCP port 80) to any destination.
4. Explicitly block all remaining IP traffic.

Arrange the ACL rules in the correct top-to-bottom processing order to satisfy these security requirements without shadowing any rules.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct top-to-bottom sequence is: 1) access-list 105 permit tcp host 192.168.1.10 host 10.0.0.5 eq 22, 2) access-list 105 deny ip 192.168.1.0 0.0.0.255 host 10.0.0.5, 3) access-list 105 permit tcp 192.168.1.0 0.0.0.255 any eq 80, and 4) access-list 105 deny ip any any.
Router Access Control Lists execute rules sequentially from top to bottom and stop processing upon the first match. To meet security requirements without rule shadowing, specific rules must be placed above general rules. Host 192.168.1.10's SSH access must be permitted first. Next, all other traffic to host 10.0.0.5 must be denied. Third, general HTTP access for the subnet is allowed. Finally, the catch-all deny rule drops any remaining traffic.

Step-by-Step Solution

1
Identify the most specific exception permit rule.
Place host-specific SSH permit rule ('permit tcp host 192.168.1.10 host 10.0.0.5 eq 22') at position 1.
ACL engines process rules top-to-bottom using first-match logic. Specific host exceptions must precede broader subnet blocks to prevent rule shadowing.
2
Identify specific destination blocks.
Place subnet deny rule targeting management server 10.0.0.5 ('deny ip 192.168.1.0 0.0.0.255 host 10.0.0.5') at position 2.
This blocks all remaining traffic to management server 10.0.0.5 prior to checking broad subnet permit rules.
3
Identify general service permit rules.
Place general web permit rule ('permit tcp 192.168.1.0 0.0.0.255 any eq 80') at position 3.
Allows subnet hosts to initiate HTTP traffic to external destinations while keeping management server 10.0.0.5 protected by the previous deny rule.
4
Identify the default drop rule.
Place the explicit catch-all deny rule ('deny ip any any') at position 4.
Serves as the final rule in the ACL structure to ensure all unlisted traffic is dropped.

Key Concept

ACL Sequential First-Match Evaluation and Rule Shadowing Prevention
Estimated Time:1m 30s
Question 1810Question →

A network technician is troubleshooting connectivity issues for several newly provisioned workstations on the finance VLAN (10.15.30.0/24). While the workstations can communicate with each other on the local switch, none of them can access corporate servers on external subnets or reach the internet. An inspection of `ipconfig /all` on one of the affected clients yields the following output:

IPv4 Address. . . . . . . . . . . : 10.15.30.45
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.15.40.1
DHCP Server . . . . . . . . . . . : 10.15.10.10

Which of the following is the most likely cause of the routing failure?

Show answer & explanation

Answer: The DHCP scope option for the default gateway specifies an IP address located outside the local subnet.

Answer

The DHCP scope option for the default gateway specifies an IP address located outside the local subnet.
For a workstation to communicate with remote networks, its configured default gateway must share the same network identifier as defined by the host IP address and subnet mask. In this scenario, the host IP (10.15.30.45/24) belongs to the 10.15.30.0/24 subnet, but the gateway (10.15.40.1) resides on 10.15.40.0/24. This subnet mismatch prevents ARP resolution for the default gateway, resulting in failed off-subnet routing while allowing local switch traffic.

Step-by-Step Solution

1
Analyze the IP address and subnet mask from the command output.
The host IP is 10.15.30.45 with subnet mask 255.255.255.0 (/24). The local network boundary is 10.15.30.0 to 10.15.30.255.
Determines which IP addresses reside on the local broadcast domain.
2
Compare the configured default gateway address against the local subnet range.
The default gateway is configured as 10.15.40.1, which falls into the 10.15.40.0/24 subnet rather than 10.15.30.0/24.
A default gateway must reside on the same IP subnet as the client host to receive local Layer 2 frames.
3
Determine the root cause of off-subnet unreachability.
Because the gateway IP is non-local, client traffic destined for external networks cannot be delivered to the gateway router.
Confirms why local switch traffic functions properly while external/internet routing fails.

Key Concept

Default Gateway Subnet Alignment in DHCP Scope Configurations
Question 1811Question →

A network engineer is analyzing poor throughput and high packet loss reported by mobile client devices roaming through a multi-floor facility. A wireless spectrum analyzer indicates that three neighboring access points providing coverage on the same floor are configured to broadcast on 2.4 GHz Channels 1, 3, and 5, respectively. Which of the following best explains the primary cause of the performance degradation and the required resolution?

Show answer & explanation

Answer: The channel selection causes severe adjacent-channel interference due to overlapping 22 MHz channel spectra; the access points should be reconfigured to non-overlapping Channels 1, 6, and 11.

Answer

The channel selection causes severe adjacent-channel interference due to overlapping 22 MHz channel spectra; the access points should be reconfigured to non-overlapping Channels 1, 6, and 11.
In 2.4 GHz Wi-Fi networks, channels are 20-22 MHz wide but spaced only 5 MHz apart. Assigning adjacent access points to Channels 1, 3, and 5 causes severe spectral overlap (adjacent-channel interference), which corrupts packets and prevents clear channel assessment. Reconfiguring the deployment to use non-overlapping Channels 1, 6, and 11 ensures sufficient frequency separation to eliminate adjacent-channel interference.

Step-by-Step Solution

1
Analyze the frequency allocation in the 2.4 GHz ISM band.
In standard wireless networking, 2.4 GHz channels are spaced 5 MHz apart, while each channel requires a signal bandwidth of 20 to 22 MHz.
Understanding channel width and spacing is necessary to evaluate spectral overlap.
2
Evaluate the impact of deploying adjacent APs on Channels 1, 3, and 5.
Channel 1 spans 2.401-2.423 GHz, Channel 3 spans 2.411-2.433 GHz, and Channel 5 spans 2.421-2.443 GHz. Their frequencies significantly overlap with each other, leading to uncoordinated adjacent-channel interference (ACI).
ACI degrades performance because overlapping transmissions create RF noise rather than manageable CSMA/CA contention.
3
Determine the proper non-overlapping channel scheme.
Channels 1, 6, and 11 have center frequencies of 2.412 GHz, 2.437 GHz, and 2.462 GHz (25 MHz spacing), providing complete isolation without spectral overlap.
Using non-overlapping channels allows adjacent access points to operate concurrently without interfering with each other's transmissions.

Key Concept

2.4 GHz Non-Overlapping Channel Allocation
Estimated Time:1m 30s
Question 1812Question →

Match each network diagnostic requirement or scenario to the most appropriate hardware testing tool or protocol analyzer function.

Click a left item, then click its matching right item

Items

Locating the precise distance to a bend or reflective break along a 1.5 km single-mode optical fiber link.
Identifying which unlabelled RJ-45 wall jack in an office area corresponds to a specific port on a 110 punch-down block.
Verifying pin-to-pin wiring continuity, opens, shorts, and swapped wires on a newly terminated Cat 6 patch cable.
Filtering captured frame traffic to isolate TCP window size changes and packet retransmission events during file transfer degradation.

Matches

Show answer & explanation

Answer

1. Distance fault on optical fiber links to Optical Time-Domain Reflectometer (OTDR). 2. Tracing unlabelled wall jack runs to Tone generator and inductive probe kit. 3. Checking pin continuity and wire pairing to Wiremap tester. 4. Filtering TCP window size and retransmissions to Packet analyzer display filter (`tcp.analysis.flags`).
Each diagnostic scenario maps directly to its intended hardware tool or packet analyzer syntax based on operational layer and physical medium: OTDR for fiber reflection faults, tone probe for cable tracing, wiremap tester for twisted-pair pinouts, and packet display filters for transport-layer performance analysis.

Step-by-Step Solution

1
Analyze physical medium characteristics and required measurements for cable testing.
Fiber optic distance-to-fault detection requires optical pulse reflection measurement (OTDR). Unlabelled copper path tracing requires signal injection and pickup (tone generator and probe). Copper pinout verification requires pin-to-pin continuity testing (wiremap tester).
Matching physical medium symptoms to appropriate hardware tester operating principles ensures proper tool selection.
2
Evaluate protocol analysis requirements for packet capture inspection.
Transport layer issue inspection (TCP retransmissions and window size tracking) requires frame-level packet capture filtering syntax.
Packet analyzers evaluate frame contents across OSI Layers 2 through 7 using display filters to isolate specific network phenomena.

Key Concept

Selecting Appropriate Network Diagnostics Tools and Packet Analyzer Syntax
Estimated Time:1m 30s
Question 1813Question →

A network administrator is troubleshooting an issue where servers on VLAN 40 (subnet 172.20.40.0/24) can successfully synchronize time with an internal NTP server (192.168.1.50), but fail to retrieve software updates from an HTTP repository located on the same server (192.168.1.50:80).

Inspection of the router's inbound ACL on the VLAN 40 interface reveals the following configuration:

ip access-list extended VLAN40_IN
10 permit tcp 172.20.40.0 0.0.0.255 host 192.168.1.50 eq 443
20 permit udp 172.20.40.0 0.0.0.255 host 192.168.1.50 eq 123

Which of the following TWO statements correctly identify the root cause of the failure and the necessary corrective action? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: HTTP traffic on TCP port 80 is denied because it matches the unwritten implicit deny rule at the end of the access control list.; A new entry explicitly permitting TCP port 80 traffic from the 172.20.40.0/24 network to 192.168.1.50 must be appended to the access control list.

Answer

HTTP traffic on TCP port 80 is denied by the implicit deny rule at the end of the access control list, and adding an explicit rule permitting TCP port 80 traffic from 172.20.40.0/24 to 192.168.1.50 resolves the issue.
Access Control Lists process traffic sequentially and evaluate unmatched traffic against an unwritten implicit deny all statement. Because the ACL only permits TCP port 443 and UDP port 123, HTTP traffic destined for TCP port 80 is implicitly blocked. To permit HTTP updates, an administrator must add an explicit permit rule for TCP port 80.

Step-by-Step Solution

1
Analyze the Access Control List entries against the application layer ports in use.
Rule 10 explicitly permits TCP port 443 (HTTPS) and rule 20 permits UDP port 123 (NTP). The repository application relies on unencrypted HTTP (TCP port 80).
Traffic directed to TCP port 80 does not match any explicit permit rule in the access control list.
2
Evaluate the implicit behavior of standard and extended Access Control Lists.
Traffic not explicitly permitted by an earlier rule hits the unwritten implicit deny statement at the bottom of the ACL and is dropped.
This explains why NTP traffic (port 123) succeeds while HTTP traffic (port 80) is dropped.
3
Formulate the required configuration change to resolve the connectivity issue.
Add an explicit permit rule for TCP port 80 from source subnet 172.20.40.0/24 to destination host 192.168.1.50.
An explicit permit statement takes precedence over the implicit deny rule for HTTP requests.

Key Concept

Troubleshooting Access Control Lists (ACLs) and Implicit Deny Behavior
Estimated Time:1m 30s
Question 1814Question →

A network administrator is configuring a subnet dedicated to security IP cameras in a warehouse facility. The subnet must support at least 5858 host devices, with each camera assigned a static IPv4 address. To minimize wasted IP address space, what is the minimum CIDR prefix length (represented as an integer NN for /N/N) that should be assigned to this subnet?

Show answer & explanation

Answer: 26

Answer

The minimum CIDR prefix length required to support at least 58 usable host addresses is 26.
To support 58 static host devices, the subnet must contain at least 58 usable host IP addresses. The formula for usable host addresses is 2h−22^h - 2, where hh is the number of host bits. Setting h=5h = 5 gives 25−2=302^5 - 2 = 30 usable addresses (insufficient). Setting h=6h = 6 gives 26−2=622^6 - 2 = 62 usable addresses (sufficient). Subtracting 6 host bits from the 32 total bits in an IPv4 address yields 32−6=2632 - 6 = 26. Thus, the minimum CIDR prefix length is 26.

Step-by-Step Solution

1
Determine the minimum host bits required
6 host bits (h=6h = 6)
Using 5 host bits yields 25−2=302^5 - 2 = 30 usable IP addresses, which cannot accommodate 58 devices. Using 6 host bits yields 26−2=622^6 - 2 = 62 usable addresses, which satisfies the requirement.
2
Calculate the CIDR prefix length
Prefix length of 26 (32−6=2632 - 6 = 26)
IPv4 addresses consist of 32 total bits. Subtracting the 6 host bits leaves 26 bits dedicated to the network prefix.

Key Concept

Calculating minimum CIDR prefix length from host capacity requirements
Question 1815Question →

A network administrator is diagnosing two distinct layer 2 issues on Switch-A. First, syslog logs display repeated `%CDP-4-NATIVE_VLAN_MISMATCH` messages for trunk link interface GigabitEthernet0/1 connected to Switch-B. Second, interface statistics for GigabitEthernet0/2 connected to a local database server show a high number of late collisions and alignment errors during heavy transfer periods. Which of the following actions should the administrator take to resolve these issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Reconfigure the native VLAN configuration on Switch-B's trunk interface to match the native VLAN setting on Switch-A.; Manually set matching speed and duplex settings on both Switch-A's GigabitEthernet0/2 interface and the database server's network interface card.

Answer

The administrator should align the native VLAN configurations on both trunk ends (matching Switch-B to Switch-A) and ensure speed/duplex settings match on both Switch-A and the connected database server.
Correct troubleshooting requires addressing both specific symptoms reported: matching the native VLAN setting across the trunk link stops CDP mismatch alerts and frame misdirection, while hardcoding or autonegotiating matching duplex settings on both sides of the host interface eliminates late collisions.

Step-by-Step Solution

1
Analyze the CDP log message `%CDP-4-NATIVE_VLAN_MISMATCH`.
Identified an 802.1Q trunk misconfiguration where untagged frames are interpreted as belonging to different VLANs on opposite ends of the link.
802.1Q trunks must share identical native VLAN numbers on both interconnected switchports to prevent traffic misrouting and switchport error states.
2
Analyze interface statistics showing late collisions on GigabitEthernet0/2.
Identified a duplex mismatch between Switch-A (operating at half-duplex) and the connected server (operating at full-duplex).
Late collisions happen when a node detects a collision after transmitting the first 64 bytes of a frame, which occurs when one side ignores CSMA/CD rules due to full-duplex configuration while the other side uses half-duplex.
3
Select the appropriate remedial actions.
Reconfigure the trunk native VLAN on Switch-B and configure identical speed/duplex settings on GigabitEthernet0/2 and the server interface.
These steps address the root causes of trunk mismatches and duplex mismatches directly.

Key Concept

Troubleshooting 802.1Q Native VLAN Mismatches and Ethernet Duplex Mismatches
Question 1816Question →

An enterprise financial organization is designing a disaster recovery strategy for its core transaction processing systems. The business impact analysis defines a Recovery Point Objective (RPO) of near-zero data loss (less than 5 seconds) and a Recovery Time Objective (RTO) of under 15 minutes. Additionally, production application servers must resume operational capacity automatically in the event of a primary data center facility outage. Which of the following technical controls and site recovery strategies should the network operations team combine to meet these stringent BCDR metrics? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Continuous Data Protection (CDP) for real-time transaction log journaling; An Active-Active Hot Site architecture with synchronous storage replication and automated failover

Answer

To meet an RPO of near-zero data loss and an RTO of under 15 minutes, the organization must implement Continuous Data Protection (CDP) for real-time log journaling alongside an Active-Active Hot Site architecture with synchronous storage replication.
Continuous Data Protection (CDP) satisfies the near-zero RPO by journaling block-level storage modifications immediately as they occur. An Active-Active Hot Site fulfills the sub-15-minute RTO by maintaining live, fully mirrored computing systems capable of automatically handling application traffic if the primary facility fails.

Step-by-Step Solution

1
Analyze the RPO requirement
Near-zero RPO (under 5 seconds) mandates synchronous storage replication or Continuous Data Protection (CDP) that logs changes in real time rather than using periodic snapshot or scheduled incremental/differential backup jobs.
Scheduled backup methods (daily incremental or differential) leave gaps of hours during which lost data cannot be recovered.
2
Analyze the RTO and operational requirement
An RTO of under 15 minutes with automated recovery requires an Active-Active Hot Site.
Warm sites and cold sites require manual equipment provisioning, image restores, and service reconfigurations that take hours to weeks to complete.
3
Synthesize the complete BCDR architecture
Combining CDP for continuous data mirroring with an Active-Active Hot Site satisfies both the zero-data-loss RPO and rapid failover RTO constraints.
Only real-time replication coupled with live mirrored infrastructure can satisfy strict sub-minute recovery metrics.

Key Concept

Disaster Recovery Site Types and Replication Strategy Metrics (RPO/RTO)
Estimated Time:2m 0s
Question 1817Question →

A network administrator is provisioning a dedicated subnet for a newly established server cluster that requires static IP assignments for exactly 3131 usable host devices. To conserve address space, which of the following is the most efficient subnet mask that satisfies this requirement?

Show answer & explanation

Answer: 255.255.255.192

Answer

The subnet mask 255.255.255.192 is the most efficient subnet mask because a /26 network provides 62 usable host IP addresses, satisfying the 31 host requirement with minimal wasted IP addresses.
The option specifying '255.255.255.192' corresponds to a prefix length of /26/26. A /26/26 subnet contains 66 host bits, yielding 26=642^6 = 64 total IP addresses. Subtracting 22 for the reserved network and broadcast addresses yields 6262 usable host IPs, which is the smallest standard subnet capable of housing 3131 hosts.

Step-by-Step Solution

1
Determine the required number of usable host IP addresses.
The scenario specifies a requirement of 3131 usable host IP addresses.
Subnet capacity must accommodate all host interfaces plus non-usable network and broadcast addresses.
2
Calculate required host bits using the formula 2h−2≥312^h - 2 \ge 31.
For h=5h = 5 bits: 25−2=302^5 - 2 = 30 usable IPs (insufficient). For h=6h = 6 bits: 26−2=622^6 - 2 = 62 usable IPs (sufficient).
Two IP addresses per subnet are reserved for the network ID and broadcast address.
3
Convert the required host bits to a subnet mask.
The prefix length is 32−6=/2632 - 6 = /26. Converting /26/26 to dotted-decimal yields 255.255.255.192255.255.255.192.
A /26/26 prefix uses 2626 network bits (11111111.11111111.11111111.110000002=255.255.255.19211111111.11111111.11111111.11000000_2 = 255.255.255.192).

Key Concept

IPv4 Subnetting & Usable Host Calculation
Question 1818Question →

A network technician is investigating performance degradation on a desktop host connected to switch port FastEthernet 0/12. The switch port speed and duplex settings were manually configured to 100 Mbps and Full Duplex, while the desktop network adapter was left on auto-negotiation. Running the `show interface fastEthernet 0/12` command reveals a rapidly incrementing counter for late collisions and Frame Check Sequence (FCS) errors.

Which of the following is the root cause of this connectivity issue?

Show answer & explanation

Answer: A duplex mismatch caused by the desktop adapter auto-negotiating to Half Duplex while the switch port is fixed at Full Duplex.

Answer

The root cause is a duplex mismatch resulting from the host network adapter auto-negotiating to Half Duplex while the switch interface is manually hardcoded to Full Duplex.
The correct answer identifies a duplex mismatch caused by mismatched negotiation modes. Standard IEEE auto-negotiation rules state that if one endpoint is manually set to fixed speed and duplex (e.g. 100/Full) and the other is set to auto-negotiate, the auto-negotiating side can sense speed but cannot detect duplex mode, defaulting to Half Duplex. The resulting collision domain mismatch causes late collisions and FCS errors on the switch interface.

Step-by-Step Solution

1
Analyze the switch port interface configuration and error counters.
The switch interface is statically set to 100/Full, and the interface counter shows high numbers of late collisions and FCS errors.
Late collisions occur when a device detects a collision after transmitting the first 64 bytes (512 bits) of a frame, characteristic of half-duplex operation.
2
Evaluate auto-negotiation behavior on Ethernet links.
The host NIC uses auto-negotiation, but because the switch port does not send auto-negotiation pulses, the host falls back to the IEEE default of Half Duplex.
When speed/duplex auto-negotiation fails to receive response pulses, speed is detected via link pulses, but duplex defaults to half-duplex for backward compatibility.
3
Identify the cause of frame corruption and late collision errors.
The switch port sends frames at will (Full Duplex) while the host listens for quiet wire before sending (Half Duplex). When the switch transmits while the host is sending, the host detects a late collision.
This physical mismatch leads to frame aborts, retransmissions, FCS alignment errors, and significant throughput loss.

Key Concept

Duplex Mismatch Diagnosis and IEEE Auto-Negotiation Fallback Rules
Question 1819Question →

A network administrator is configuring a workstation in a newly provisioned subnet with the IPv4 address 172.16.45.50/25172.16.45.50/25. The host can successfully ping other devices on the 172.16.45.0/25172.16.45.0/25 local network, but cannot reach any external subnets or the internet. Executing `ipconfig` reveals the default gateway is configured as 172.16.45.130172.16.45.130. Which of the following is the root cause of the connectivity failure?

Show answer & explanation

Answer: The default gateway IP address resides outside the host's assigned IP subnet range.

Answer

The default gateway IP address resides outside the host's assigned IP subnet range.
For a host to communicate with remote networks, its configured default gateway must reside on the exact same local IP subnet. A /25 prefix (subnet mask 255.255.255.128) provides usable host addresses from 172.16.45.1 to 172.16.45.126 with a broadcast address of 172.16.45.127. The configured default gateway IP address (172.16.45.130) belongs to the next block (172.16.45.128/25), making it unreachable via Layer 2 ARP requests.

Step-by-Step Solution

1
Calculate the subnet boundaries for 172.16.45.50/25172.16.45.50/25.
A /25/25 subnet mask (255.255.255.128255.255.255.128) divides the block into subnets of 128 addresses each: Subnet 1 spans 172.16.45.0172.16.45.0 to 172.16.45.127172.16.45.127 (usable host IPs: 172.16.45.1172.16.45.1–172.16.45.126172.16.45.126), and Subnet 2 spans 172.16.45.128172.16.45.128 to 172.16.45.255172.16.45.255.
Subnet bounds determine which IP addresses belong to the local broadcast domain versus remote networks requiring routing.
2
Evaluate the configured default gateway address (172.16.45.130172.16.45.130).
The IP 172.16.45.130172.16.45.130 lies within the second subnet (172.16.45.128/25172.16.45.128/25).
A host must have a default gateway configured on its local IP subnet to send frames directly to the gateway's MAC address via ARP.
3
Identify the root cause of the failure.
Because the default gateway IP is on a separate IP subnet, the workstation cannot resolve the gateway's Layer 2 address, causing all off-subnet traffic destined for external networks to fail.
Hosts cannot send traffic off-subnet without a valid, locally reachable default gateway.

Key Concept

Default Gateway Subnet Mismatch Diagnosis
Question 1820Question →

A network administrator is troubleshooting an unexpected link outage on a 2 km single-mode fiber optic backbone connecting two enterprise distribution switches. While both optical transceivers are functioning properly, no signal reaches the remote end. The administrator needs to pinpoint the exact location of a suspected physical break along the cable run within an underground conduit. Which diagnostic tool should the administrator use?

Show answer & explanation

Answer: Optical Time-Domain Reflectometer (OTDR)

Answer

An Optical Time-Domain Reflectometer (OTDR) is the correct tool because it measures light reflections along a fiber optic strand to calculate the exact distance to a physical break or defect.
An Optical Time-Domain Reflectometer (OTDR) is designed specifically to trace fiber optic cable runs. By transmitting pulses of light into the fiber and analyzing the backscattered light, it calculates time-of-flight reflections to display a trace showing the exact distance to splices, excessive bends, or complete breaks along the cable.

Step-by-Step Solution

1
Identify the physical cabling medium
The infrastructure uses single-mode fiber optic cable.
Diagnostic tools are media-specific (optical vs. electrical).
2
Determine the diagnostic requirement
The goal is to calculate the distance to a cable fault inside a conduit run.
A tool that only measures overall pass/fail loss is insufficient when fault location is required.
3
Select the appropriate optical diagnostic tool
The Optical Time-Domain Reflectometer (OTDR) sends light pulses down the fiber and evaluates backscatter reflectivity to map distance to attenuation events and breaks.
An OTDR is specifically designed for characterization and distance-to-fault analysis in optical fiber runs.

Key Concept

Optical Time-Domain Reflectometer (OTDR) fault localization
PreviousPage 91 / 112Next
All practice questions — CompTIA Network+ | Examkin