Examkin

All practice questions

2237 questions

All types2,237Multiple choice1,150Multiple select488Numeric30Matching350Ordering201Short answer18
Question 1821Question →

A logistics enterprise experienced a catastrophic disk failure on its core database server on Thursday at 2:00 PM. The organization operates a backup policy consisting of a full backup every Sunday at 12:00 AM, daily incremental backups every evening at 11:00 PM (Monday through Wednesday), and hourly transaction log backups taken at the top of every hour. To restore the database server to its state immediately prior to the 2:00 PM failure with zero data loss, which sequence of backup files must the systems administrator restore?

Show answer & explanation

Answer: The Sunday full backup, followed in chronological order by the Monday, Tuesday, and Wednesday incremental backups, and then each hourly transaction log backup from Thursday morning up to 1:00 PM.

Answer

The server must be restored using the Sunday full backup, followed sequentially by the Monday, Tuesday, and Wednesday incremental backups, and completed with the hourly transaction log backups from Thursday morning up to 1:00 PM.
Because an incremental backup scheme records only data changed since the previous backup event, restoring to a specific point in time requires restoring the initial full backup first, followed by every incremental backup set generated up to the failure day in strict chronological order, and finally applying all point-in-time transaction logs recorded after the last incremental backup.

Step-by-Step Solution

1
Identify the base restore point.
The baseline image is established using the Sunday 12:00 AM full backup.
Full backups contain all system and database files necessary to start the restoration chain.
2
Determine incremental backup dependencies.
Since incremental backups reset the archive bit, each backup depends on the previous set. Thus, Monday, Tuesday, and Wednesday incremental backups must be restored chronologically.
Differential backups only require the last full and latest differential, but incremental strategies require every successive incremental backup.
3
Apply point-in-time recovery logs.
Apply all transaction logs generated between Wednesday at 11:00 PM and Thursday at 1:00 PM.
Transaction logs bring the database state forward to the most recent transaction point right before the crash at 2:00 PM.

Key Concept

Incremental Backup Restoration Chain vs. Differential Restoration
Question 1822Question →

A network administrator observes that network traffic across multiple VLANs is taking a sub-optimal path through a legacy access switch rather than the primary core switch. Output from `show spanning-tree` reveals that the legacy access switch is currently operating as the Spanning Tree Protocol (STP) Root Bridge because the primary core switch has a configured STP priority of 61440, while the access switch retains the default priority of 32768. Which configuration change on the core switch will resolve the issue and force it to become the STP Root Bridge?

Show answer & explanation

Answer: Lower the STP bridge priority value on the core switch to a value less than 32768 (such as 4096).

Answer

Lower the STP bridge priority value on the core switch to a value less than 32768 (such as 4096).
Spanning Tree Protocol uses the lowest Bridge ID (Priority + MAC address) to select the Root Bridge. Lowering the bridge priority value on the core switch below the access switch's priority (e.g., to 4096) ensures the core switch is elected Root Bridge, aligning traffic flow with the intended network design.

Step-by-Step Solution

1
Analyze STP Root Bridge Election Criteria
STP elects the Root Bridge based on the lowest Bridge ID, which is composed of Bridge Priority (default 32768) + MAC Address.
The switch with the lowest numeric priority value becomes the designated root of the spanning tree topology.
2
Evaluate Current Configurations
The core switch currently has a priority of 61440 (higher/worse than default), whereas the access switch has a default priority of 32768.
Because 32768 is lower than 61440, the access switch became the Root Bridge.
3
Determine Correct Administrative Action
Configure the core switch with an STP bridge priority lower than 32768 (e.g., in multiples of 4096, such as 4096 or 0).
This guarantees the core switch wins the Root Bridge election and establishes optimal traffic paths.

Key Concept

STP Root Bridge Election and Priority Hierarchy
Estimated Time:1m 30s
Question 1823Question →

A network administrator is deploying IPv6 on an enterprise subnet. The design requires host devices to automatically generate their own global unicast IP addresses using prefix information advertised by the local router, while simultaneously obtaining DNS server IP addresses from a central DHCPv6 server. Which of the following configurations and address assignments correctly support this deployment strategy? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The local router must transmit Router Advertisement (RA) frames with the Managed Address Configuration (M) flag set to 0 and the Other Configuration (O) flag set to 1.; Host devices dynamically formulate their 128-bit global unicast address by combining the advertised /64 network prefix with an interface identifier derived via SLAAC.

Answer

The correct configurations are setting the Router Advertisement flags to M=0 and O=1 (stateless DHCPv6 mode) and allowing host devices to combine the advertised /64 network prefix with a SLAAC-generated interface identifier.
Stateless DHCPv6 mode allows clients to derive their global unicast IPv6 address using SLAAC (combining the router's /64 prefix advertisement with a 64-bit host interface ID) while querying a DHCPv6 server for DNS details triggered by the RA flag configuration M=0 and O=1.

Step-by-Step Solution

1
Analyze the autoconfiguration requirement for host address generation.
Hosts generating their own global unicast addresses from advertised prefixes require SLAAC, which uses RA prefix information combined with a 64-bit interface identifier.
SLAAC eliminates the need for a stateful DHCPv6 server to assign IP addresses.
2
Determine the required Router Advertisement (RA) flag settings for Stateless DHCPv6.
The Managed Address Configuration flag must be M=0 (no stateful IP assignment) and the Other Configuration flag must be O=1 (obtain additional settings like DNS via DHCPv6).
This combination signals to clients that IP addressing comes from SLAAC while DNS server information comes from a stateless DHCPv6 server.
3
Evaluate record types and address compression syntax.
DNS requires AAAA records for IPv6 mapping, and valid IPv6 address notation permits only one double-colon (::) per address.
A records only support 32-bit IPv4 addresses, and multiple double-colons create unresolvable ambiguity in 128-bit address expansion.

Key Concept

Stateless Address Autoconfiguration (SLAAC) with Stateless DHCPv6
Question 1824Question →

Match each network documentation artifact to the operational scenario where it provides the primary utility.

Click a left item, then click its matching right item

Items

Logical Topology Diagram
Rack Elevation Diagram
Wiring Schematic
Physical Topology Diagram

Matches

Show answer & explanation

Answer

Logical Topology Diagram pairs with inter-VLAN routing and subnet troubleshooting; Rack Elevation Diagram pairs with auditing cabinet RU space and PDU placement; Wiring Schematic pairs with tracing conductor pinouts and T568 color codes; Physical Topology Diagram pairs with locating physical conduit pathways and floor cable runs.
Each documentation type addresses a distinct operational domain: Logical diagrams illustrate protocol and IP addressing structures; Physical diagrams map tangible hardware locations and cable routes; Rack elevation drawings illustrate cabinet space and power layout; Wiring schematics detail low-level conductor pinouts and block terminations.

Step-by-Step Solution

1
Identify the document used for data flow and Layer 2/3 addressing logic.
Logical Topology Diagram maps to troubleshooting inter-VLAN routing, subnets, and IP address allocations.
Logical diagrams represent network structures and protocol pathways without depicting physical equipment layouts.
2
Identify the document used for equipment cabinet spatial planning.
Rack Elevation Diagram maps to auditing cabinet RU space, weight distribution, and PDU positioning.
Rack elevation diagrams model vertical cabinet dimensions and equipment slot assignments to scale.
3
Identify the document used for granular cable conductor pinout analysis.
Wiring Schematic maps to tracing conductor pinouts, T568 color codes, and punchdown terminations.
Wiring schematics specify detailed pin-to-wire mapping for physical cabling media.
4
Identify the document used for physical device positioning and conduit paths.
Physical Topology Diagram maps to locating conduit pathways, floor cable runs, and chassis room locations.
Physical diagrams illustrate actual hardware placement, physical cable paths, and geographical layouts.

Key Concept

Network Documentation Artifact Types and Operational Use Cases
Question 1825Question →

During an internal security investigation, network administrators notice that whenever client workstations experience a failure resolving internal hostnames via the primary DNS server, an unauthorized endpoint on the same broadcast domain immediately responds to Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) queries. The rogue system provides its own IP address, tricking victim computers into sending authentication hashes when trying to access network shares.

Which of the following correctly identify the attack vector taking place and the primary security risk established by this activity? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Link-Local Multicast Name Resolution (LLMNR) / NBT-NS poisoning; Man-in-the-Middle (MitM) positioning for credential harvesting

Answer

The attack taking place is Link-Local Multicast Name Resolution (LLMNR) / NBT-NS poisoning, and the primary risk established is Man-in-the-Middle (MitM) positioning for credential harvesting.
The scenario describes an attacker taking advantage of Windows fallback name resolution protocols (LLMNR and NBT-NS). When normal DNS resolution fails, clients broadcast requests to the local network; an attacker spoofing these responses directs client traffic to their own machine, acting as a Man-in-the-Middle to harvest authentication credentials.

Step-by-Step Solution

1
Analyze the observed attack mechanics from the scenario.
Workstations send multicast/broadcast queries on the local subnet when DNS fails, and a rogue endpoint answers them with spoofed IP addresses.
This behavior specifically matches LLMNR/NBT-NS poisoning, which targets Windows fallback hostname resolution.
2
Determine the impact on network security and traffic flow.
Clients attempt authentication against the rogue endpoint, allowing the attacker to intercept NTLM authentication hashes.
Intercepting traffic intended for internal servers puts the attacker in a Man-in-the-Middle position to harvest credentials.

Key Concept

LLMNR/NBT-NS Poisoning and MitM Credential Interception
Question 1826Question →

A network administrator working on a Windows host is troubleshooting a connection failure to an off-site database server at IP address 198.51.100.25198.51.100.25 running on TCP port 54325432. Place the following command-line diagnostic procedures in the correct logical sequence, following a standard bottom-up network troubleshooting methodology starting from local network configuration verification up to specific transport-layer service testing.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct logical order begins with local host configuration analysis (ipconfig /all), proceeds to default gateway ICMP verification (ping 192.168.1.1), follows with path route tracing (tracert 198.51.100.25), and concludes with targeted transport-layer port testing (Test-NetConnection 198.51.100.25 -Port 5432).
Following the CompTIA and standard OSI bottom-up troubleshooting methodology, an administrator must first verify local host network interface and address configuration (ipconfig /all), then test local network Layer 3 reachability to the default gateway (ping 192.168.1.1), followed by path analysis across intermediate routers to the target destination IP (tracert 198.51.100.25), and lastly validate specific transport-layer TCP port availability (Test-NetConnection -Port 5432).

Step-by-Step Solution

1
Verify host IP setup
Confirm local IP, subnet mask, and gateway address using ipconfig /all.
Troubleshooting higher layers is invalid if the local machine lacks a valid IP address or local routing table entry.
2
Verify local gateway reachability
Confirm Layer 3 ICMP communication using ping 192.168.1.1.
Ensures the host can forward IP packets off the local broadcast domain to its configured gateway router.
3
Verify multi-hop path integrity
Identify intermediate hop failures using tracert 198.51.100.25.
Determines whether packet loss occurs on the internal network, ISP WAN links, or remote edge routers.
4
Verify Layer 4 port connectivity
Test TCP port 5432 handshake using Test-NetConnection 198.51.100.25 -Port 5432.
Validates that firewalls permit traffic on TCP 5432 and that the remote database daemon actively accepts connection requests.

Key Concept

Layered Command-Line Network Troubleshooting Workflow
Estimated Time:2m 0s
Question 1827Question →

A network administrator is investigating severe application response delays and dropped connections on a critical database server connected via a Category 6 UTP cable drop. The administrator suspects both physical Layer 1 signal degradation along the cable run and Layer 4 transmission issues caused by excessive dropped segments. Which TWO of the following diagnostic tools or analyzer techniques should the administrator utilize to isolate the root causes at both layers? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Connect a Time-Domain Reflectometer (TDR) to measure signal reflections and pinpoint the precise distance to impedance mismatches or cable breaks.; Apply a packet analyzer display filter for TCP analysis flags to identify duplicate acknowledgments and retransmissions.

Answer

The administrator should use a Time-Domain Reflectometer (TDR) to locate physical cabling defects and apply a packet analyzer display filter for TCP analysis flags to verify Layer 4 packet loss.
Isolating physical copper issues requires a Time-Domain Reflectometer (TDR), which measures signal reflections to calculate distance to cable faults. Simultaneously, diagnosing Layer 4 connection drops requires a packet analyzer filtering for TCP retransmission and duplicate ACK flags to measure segment loss.

Step-by-Step Solution

1
Address the physical layer cable degradation suspicion
A Time-Domain Reflectometer (TDR) sends signal pulses down copper conductors and analyzes signal reflections to pinpoint impedance mismatches, cable kinks, or shorts along with their exact distance.
Hardware testers like TDRs are required to measure distance-to-fault on copper media.
2
Address the transport layer protocol performance suspicion
Using a packet analyzer with display filters (such as tcp.analysis.flags) highlights TCP retransmissions, out-of-order packets, and duplicate ACKs.
Packet analyzers capture live network traffic, giving clear visibility into TCP protocol behavior and lost segment recovery.

Key Concept

Combining hardware diagnostic tools (TDR) with packet capture analysis (Wireshark/tcpdump) to isolate multi-layer network failures.
Question 1828Question →

An organization is defining metrics for its disaster recovery plan to set expectations for downtime and data preservation during an outage. Which of the following statements correctly describe Recovery Time Objective (RTO) and Recovery Point Objective (RPO)? (Select TWO).

Select all that apply

Show answer & explanation

Answer: RTO defines the maximum acceptable duration of system downtime before business operations must be restored.; RPO defines the maximum targeted amount of data loss measured in time prior to an outage.

Answer

Recovery Time Objective (RTO) specifies the maximum acceptable duration of system downtime, while Recovery Point Objective (RPO) specifies the maximum acceptable amount of data loss measured back in time from the moment of disruption.
Recovery Time Objective (RTO) defines the maximum target duration of service interruption following an outage. Recovery Point Objective (RPO) defines the maximum tolerable interval of data loss prior to an outage, which dictates backup frequency.

Step-by-Step Solution

1
Analyze Recovery Time Objective (RTO)
RTO measures time post-outage focused on service restoration duration.
RTO answers the question 'How long can systems be down?'
2
Analyze Recovery Point Objective (RPO)
RPO measures time pre-outage focused on acceptable data age/loss.
RPO answers the question 'How much data loss can the organization tolerate?'

Key Concept

Disaster Recovery Metrics (RTO and RPO)
Question 1829Question →

A network systems engineer is configuring name resolution for a newly deployed dual-stack web server. Workstations on the corporate network can successfully connect to the server over IPv4 using the hostname `app.finance.net`. However, IPv6 connectivity attempts fail because the hostname does not resolve to an IPv6 address.

To troubleshoot, the engineer executes the following diagnostic query from a workstation:

text
$ dig AAAA app.finance.net +short

The command produces no output, whereas running `dig A app.finance.net +short` returns `172.16.40.25`.

Which resource record type must be configured in the authoritative DNS zone file to enable host name resolution to the server's IPv6 address?

Show answer & explanation

Answer: An AAAA record mapping app.finance.net to the server's 128-bit IPv6 address

Answer

An AAAA record mapping the hostname directly to the server's 128-bit IPv6 address must be added to the zone file.
In DNS infrastructure, forward name resolution for IPv6 endpoints requires an AAAA (Quad-A) record, which maps a fully qualified domain name (FQDN) to a 128-bit IPv6 address. Because `dig AAAA app.finance.net` returned no answer, creating an AAAA record in the authoritative zone file directly resolves the issue.

Step-by-Step Solution

1
Analyze the diagnostic command output
The dig AAAA query returned an empty response, confirming no Quad-A record exists for app.finance.net.
When a DNS server has an A record but lacks an AAAA record for a hostname, IPv6-capable clients cannot resolve the IPv6 endpoint address.
2
Determine the appropriate DNS record type required for IPv6 forward lookup
An AAAA (quad-A) record is required to map a domain hostname to a 128-bit IPv6 address.
Standard IPv4 forward resolution uses A records (32-bit), whereas IPv6 forward resolution requires AAAA records (128-bit).

Key Concept

DNS Record Types for Dual-Stack (IPv4/IPv6) Name Resolution
Estimated Time:1m 15s
Question 1830Question →

A network systems engineer is designing an IPv6 addressing scheme for an internal enterprise network containing multiple subnets connected via internal routers. The design requirement dictates that internal systems must be routable across all corporate locations without being globally reachable on the public Internet. Which of the following IPv6 address types should be assigned to these hosts?

Show answer & explanation

Answer: Unique Local addresses starting within the fd00::/8 prefix block

Answer

Unique Local addresses starting within the fd00::/8 prefix block should be assigned.
Unique Local Addresses (ULA) using the fd00::/8 block (within fc00::/7) are designed specifically for internal site communication across routed networks. They permit multi-subnet internal routing while remaining non-routable on the public IPv6 Internet.

Step-by-Step Solution

1
Analyze the routability and accessibility requirements for the network scenario
Internal devices must communicate across routed subnets internally, but must remain unreachable from the public IPv6 Internet.
This requirement calls for an internally routable, non-globally scoped IPv6 unicast prefix.
2
Evaluate the candidate IPv6 address scopes against the criteria
Unique Local Addresses (ULA, prefix fc00::/7, commonly fd00::/8) serve as the IPv6 equivalent of IPv4 private addresses (RFC 1918). They route freely across internal routers while ISP routers discard them by default.
Link-Local addresses cannot cross routers, and Global Unicast addresses are publicly routable.

Key Concept

IPv6 Unique Local Address Scope & Deployment
Estimated Time:1m 0s
Question 1831Question →

A network administrator is troubleshooting an issue where client workstations on a newly provisioned VLAN are receiving APIPA addresses (169.254.x.x169.254.x.x) instead of valid leases from the centralized DHCP server located on a different subnet. Arrange the troubleshooting steps in the logical order the administrator should execute them to systematically diagnose and resolve the issue.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with verifying client link status and APIPA configuration, followed by checking the local gateway's IP helper address, testing routing connectivity to the DHCP server, verifying DHCP scope availability on the server, and finally renewing the IP lease on the client host.
Systematic network troubleshooting proceeds from the local client symptom to the local gateway configuration, across the routed network path to the centralized service, and finishes with verification on the client. Verifying local link/APIPA confirms host status. Checking the IP helper configuration ensures DHCP requests cross the VLAN boundary. Testing reachability verifies path routing. Checking server scope ensures address availability. Finally, running `ipconfig /renew` confirms the fix works.

Step-by-Step Solution

1
Confirm client physical layer connectivity and host IP status.
Establishes that the physical NIC is link-up and confirms failure of local DHCP acquisition (indicated by APIPA 169.254.x.x169.254.x.x).
Always begin troubleshooting at the affected end host before inspecting network infrastructure.
2
Check the local router interface configuration for DHCP Relay / IP Helper settings.
Determines whether broadcast DHCP DISCOVER messages are being converted to unicast packets targeted at the remote DHCP server.
Cross-subnet DHCP request delivery relies on a properly configured IP helper address on the client's default gateway interface.
3
Test IP connectivity from the local gateway to the DHCP server IP.
Verifies Layer 3 routing and ACL permeability between the relay agent and the DHCP server.
If the relay agent cannot communicate with the DHCP server, forwarded DHCP packets will be dropped in transit.
4
Inspect DHCP server configuration and scope health for the target subnet.
Confirms the scope matching the gateway interface address (`giaddr`) is active, correctly configured, and has unallocated IP addresses.
Even with valid relaying, a missing scope or scope exhaustion will prevent the DHCP server from issuing a lease.
5
Issue a DHCP lease renewal request from the client host (`ipconfig /renew`).
The client successfully completes the DORA exchange and acquires a valid IPv4 configuration.
Final validation must always be confirmed on the end device that originally experienced the issue.

Key Concept

Standard methodology for cross-subnet DHCP troubleshooting involves validating host status, gateway relaying (IP helper), intermediate routing reachability, server scope availability, and client verification.
Question 1832Question →

A network administrator is configuring a management server in an infrastructure VLAN. The default gateway interface for this subnet is assigned the IPv4 address 192.168.4.129192.168.4.129 with a subnet mask of 255.255.255.192255.255.255.192. Which of the following IPv4 addresses is a valid usable host address that can be assigned to the new server on this subnet?

Show answer & explanation

Answer: 192.168.4.150

Answer

192.168.4.150 is the correct choice as it resides within the valid usable host range of the subnet.
The subnet mask 255.255.255.192255.255.255.192 (/26) creates subnets of 64 addresses each. The gateway IP 192.168.4.129192.168.4.129 belongs to the 192.168.4.128/26192.168.4.128/26 subnet, which has a network address of 192.168.4.128192.168.4.128, a broadcast address of 192.168.4.191192.168.4.191, and a usable host address range of 192.168.4.129192.168.4.129 through 192.168.4.190192.168.4.190. The address 192.168.4.150192.168.4.150 falls squarely within this usable host range.

Step-by-Step Solution

1
Determine the block size from the subnet mask.
A mask of 255.255.255.192255.255.255.192 corresponds to a /26/26 prefix length. The block size is 256−192=64256 - 192 = 64.
Knowing the block size allows identification of subnet boundaries.
2
Identify the network address containing the default gateway IP 192.168.4.129192.168.4.129.
Subnet blocks increment by 6464: .0.0, .64.64, .128.128, .192.192. The gateway address 192.168.4.129192.168.4.129 falls into the 192.168.4.128/26192.168.4.128/26 subnet.
The network address defines the lower bound of the subnet boundary.
3
Calculate the broadcast address and usable host range.
The broadcast address is 192.168.4.191192.168.4.191 (one less than the next subnet 192.168.4.192192.168.4.192). The usable host range spans from 192.168.4.129192.168.4.129 to 192.168.4.190192.168.4.190.
Usable host addresses exclude the network ID and broadcast address.
4
Evaluate the options against the usable host range.
192.168.4.150192.168.4.150 is the only option that falls within 192.168.4.129192.168.4.129 – 192.168.4.190192.168.4.190.
Host IP addresses must be strictly within the calculated usable range.

Key Concept

IPv4 Subnet Boundaries and Usable Host Allocation
Question 1833Question →

A network administrator is documenting the configuration of a enterprise web server. The server interface is assigned the uncompressed IPv6 address 2001:0db8:0000:0001:0000:0000:0000:00202001:0\text{db}8:0000:0001:0000:0000:0000:0020. What is the correctly formatted, compressed IPv6 address according to RFC 5952 standard rules?

Show answer & explanation

Answer: 2001:db8:0:1::20; 2001:DB8:0:1::20

Answer

2001:db8:0:1::20
According to RFC 5952 standard rules for IPv6 address representation: 1) Leading zeros within each 16-bit field must be removed (`0db8` -> `db8`, `0001` -> `1`, `0020` -> `20`). 2) The longest contiguous sequence of all-zero 16-bit fields must be replaced with `::`. The sequence of three zero fields at hextets 5, 6, and 7 is longer than the single zero at hextet 3. Therefore, `0000:0000:0000` is compressed to `::`, while hextet 3 is represented as a single `0`. The resulting canonical address is `2001:db8:0:1::20`.

Step-by-Step Solution

1
Suppress leading zeros in each 16-bit hexadecimal field.
The fields `0db8`, `0000`, `0001`, and `0020` become `db8`, `0`, `1`, and `20` respectively.
RFC 5952 requires that leading zeros in any hextet must be omitted (e.g., `0db8` -> `db8`, `0001` -> `1`).
2
Identify all zero fields and locate the longest consecutive run of all-zero fields.
There is a single zero field at hextet 3 (`0`) and a run of three consecutive zero fields at hextets 5, 6, and 7 (`0000:0000:0000`).
RFC 5952 states that the double colon `::` must replace the single longest contiguous sequence of all-zero fields.
3
Apply double-colon `::` compression to the longest zero run.
Hextets 5, 6, and 7 are replaced by `::`, while hextet 3 remains as a single `0`.
The single zero at hextet 3 cannot be replaced with `::` because a double colon can only appear once in an address, and the run of three zeros takes precedence.
4
Combine the fields into the finalized compressed address string.
`2001:db8:0:1::20`
This represents the strict RFC 5952 canonical representation of the IPv6 address.

Key Concept

RFC 5952 IPv6 Address Text Representation Rules
Question 1834Question →

A network administrator needs to restrict administrative access to a managed switch located at IP address 10.20.30.210.20.30.2. Only the administrator's workstation at IP address 10.20.30.1510.20.30.15 must be allowed to establish Secure Shell (SSH) management sessions with the switch. All other SSH attempts to the switch must be blocked, while all other non-SSH IP traffic across the subnet must continue to traverse the interface uninhibited.

Which set of extended IPv4 Access Control List (ACL) statements correctly fulfills this security requirement?

Show answer & explanation

Answer: statement 1: permit tcp host 10.20.30.15 host 10.20.30.2 eq 22
statement 2: deny tcp any host 10.20.30.2 eq 22
statement 3: permit ip any any

Answer

The correct configuration permits TCP port 22 traffic from host 10.20.30.15 to host 10.20.30.2, denies TCP port 22 traffic from any host to host 10.20.30.2, and permits all remaining IP traffic using 'permit ip any any'.
The correct configuration properly identifies SSH as using TCP on port 22, creates an explicit entry granting access to the administrator's IP address (10.20.30.1510.20.30.15), denies SSH access to all other hosts, and concludes with 'permit ip any any' to allow all non-SSH traffic across the interface without triggering the default implicit deny.

Step-by-Step Solution

1
Identify the transport layer protocol and destination port required for Secure Shell (SSH).
SSH operates over TCP using port number 22.
Correct protocol matching requires specifying TCP port 22 rather than UDP or port 23 (Telnet).
2
Define specific permission and denial rules for administrative access.
Permit TCP traffic from source host 10.20.30.1510.20.30.15 to destination host 10.20.30.210.20.30.2 on port 22, followed by a rule denying TCP port 22 traffic to host 10.20.30.210.20.30.2 from any other source.
Top-to-bottom evaluation evaluates specific host exceptions before broader block rules.
3
Account for the default behavior of Access Control Lists on un-matched traffic.
Append 'permit ip any any' at the end of the rule set.
ACLs feature an unwritten implicit deny statement at the end of every list. Without an explicit permit rule, all non-SSH traffic would be silently dropped.

Key Concept

Extended Access Control List rule ordering, layer 4 port/protocol specification, and implicit deny management.
Estimated Time:1m 30s
Question 1835Question →

An IT technician is auditing a wireless network setup in an enterprise office operating on the 2.4 GHz2.4\text{ GHz} band. Users report frequent packet loss and degraded network performance. The audit reveals that adjacent wireless access points are currently assigned to channels 1, 3, 5, and 7. Which channel re-assignment strategy should the technician implement to eliminate adjacent-channel interference (ACI)?

Show answer & explanation

Answer: Reconfigure the access points to use non-overlapping channels 1, 6, and 11.

Answer

Reconfigure the access points to use non-overlapping channels 1, 6, and 11.
In 802.11 wireless deployment on the 2.4 GHz2.4\text{ GHz} band, each channel spans 22 MHz22\text{ MHz} while channel center frequencies are spaced 5 MHz5\text{ MHz} apart. To prevent adjacent-channel interference (ACI), access points must be configured using channels that do not share frequency space. Channels 1, 6, and 11 are the standard non-overlapping channels that eliminate spectral overlap.

Step-by-Step Solution

1
Analyze the frequency structure of the 2.4 GHz Wi-Fi spectrum.
Each 2.4 GHz channel has a bandwidth of 22 MHz22\text{ MHz}, but channels are spaced only 5 MHz5\text{ MHz} apart.
Channels closer than 5 channel numbers apart (such as 1, 3, 5, 7) overlap significantly in frequency, creating adjacent-channel interference (ACI).
2
Identify the standard non-overlapping channel scheme for 2.4 GHz wireless deployments.
Channels 1, 6, and 11 have center frequencies of 2412 MHz2412\text{ MHz}, 2437 MHz2437\text{ MHz}, and 2462 MHz2462\text{ MHz}, providing sufficient separation so their frequency envelopes do not collide.
Using 1, 6, and 11 ensures zero spectral overlap between neighboring access points.
3
Select the correct deployment reconfiguration.
Assigning channels 1, 6, and 11 across adjacent access points eliminates adjacent-channel interference.
This reconfiguration adheres to standard 802.11 wireless deployment practices for the 2.4 GHz band.

Key Concept

2.4 GHz Non-Overlapping Channel Assignment
Estimated Time:1m 15s
Question 1836Question →

A network administrator discovers that a managed switch has begun flooding unicast frames out of all physical ports within a specific VLAN, causing the switch to degrade to hub-like behavior. Packet captures reveal a high volume of traffic originating from a single host port, containing randomized, rapidly changing source MAC addresses that exhaust the switch's Content Addressable Memory (CAM) table capacity. Which of the following attack types is taking place?

Show answer & explanation

Answer: MAC flooding

Answer

MAC flooding
MAC flooding involves generating thousands of valid frames with unique, spoofed source MAC addresses from a single host port. This exhausts the limited memory capacity of the switch's Content Addressable Memory (CAM) table. Once full, the switch enters a fail-open state and floods all subsequent unicast frames out of every port in the VLAN, enabling an attacker to capture traffic intended for other nodes.

Step-by-Step Solution

1
Analyze the observed network symptom.
The switch is sending unicast frames out of all ports in the VLAN and exhibiting hub-like behavior.
This occurs when a switch's CAM table is completely full and cannot map unknown destination MAC addresses to specific egress ports.
2
Examine the packet capture traffic pattern.
A high volume of frames with randomized source MAC addresses originates from a single physical port.
Rapidly injecting fake source MAC addresses forces the CAM table to overwrite legitimate entries until its memory limit is reached.
3
Correlate symptoms and traffic patterns with standard attack definitions.
The attack mechanism matches MAC flooding (CAM table overflow).
MAC flooding explicitly targets the Layer 2 switch CAM table capacity to intercept broadcasted unicast traffic.

Key Concept

MAC Flooding and CAM Table Exhaustion
Estimated Time:1m 30s
Question 1837Question →

A network administrator is organizing corporate DNS infrastructure records to ensure proper service resolution and security compliance. Match each DNS resource record type on the left with its correct functional description on the right.

Click a left item, then click its matching right item

Items

SRV Record
PTR Record
CNAME Record
TXT Record

Matches

Show answer & explanation

Answer

SRV Record matches the definition of host and port location for services; PTR Record matches reverse DNS resolution from IP to domain; CNAME Record matches domain aliasing to another domain; TXT Record matches storing arbitrary text strings for email authentication like SPF and DKIM.
Each DNS record type has a dedicated function: SRV locates service protocols and port numbers; PTR enables reverse resolution of IP addresses to hostnames; CNAME acts as a domain alias pointing to another hostname; and TXT stores text metadata such as SPF and DKIM authentication signatures.

Step-by-Step Solution

1
Analyze SRV Record functionality
Identifies that SRV specifies hostnames along with port numbers and service protocols (e.g., SIP, LDAP).
SRV records are unique among standard records because they include protocol and port metadata.
2
Analyze PTR Record functionality
Identifies that PTR performs reverse mapping of IP addresses to canonical domain names.
PTR records populate reverse lookup zones.
3
Analyze CNAME Record functionality
Identifies that CNAME points an alias hostname to another canonical DNS name.
CNAME allows multiple subdomains to share the target canonical host resolution.
4
Analyze TXT Record functionality
Identifies that TXT contains freeform text strings used by protocols like SPF and DKIM for security verification.
TXT records provide human and machine readable metadata without altering routing.

Key Concept

DNS Resource Record Functions and Applications
Question 1838Question →

A network administrator is investigating latency and connectivity issues to an internal database server at 192.168.50.100192.168.50.100. The administrator executes a command-line utility from a client workstation and receives the following output:

Tracing route to 192.168.50.100 over a maximum of 30 hops

0 Workstation1 [10.1.10.15]
1 10.1.10.1
2 10.2.20.1
3 192.168.50.100

Computing statistics for 75 seconds...
Source to Here This Node/Link
Hop RTT Lost/Sent = Pct Lost/Sent = Pct Address
0 Workstation1 [10.1.10.15]
0/ 100 = 0% |
1 1ms 0/ 100 = 0% 0/ 100 = 0% 10.1.10.1
0/ 100 = 0% |
2 15ms 100/ 100 =100% 100/ 100 =100% 10.2.20.1
0/ 100 = 0% |
3 16ms 0/ 100 = 0% 0/ 100 = 0% 192.168.50.100

Which of the following conclusions best explains the results observed in this command output?

Show answer & explanation

Answer: The intermediate router at 10.2.20.1 is configured to drop or rate-limit ICMP control traffic, while end-to-end IP reachability to 192.168.50.100 is fully functional.

Answer

The intermediate router at 10.2.20.1 is configured to drop or rate-limit ICMP control traffic, while end-to-end IP reachability to 192.168.50.100 is fully functional.
The output reflects a `pathping` report measuring packet loss per hop over a 75-second window. At hop 2 (10.2.20.110.2.20.1), the utility shows 100%100\% packet loss at the node level. However, traffic passing through hop 2 to reach the destination at hop 3 (192.168.50.100192.168.50.100) shows 0%0\% overall packet loss. This behavior confirms that the router at hop 2 is intentionally dropping ICMP control packets (a common security/performance setting known as ICMP rate-limiting) while successfully forwarding actual data traffic to the target host.

Step-by-Step Solution

1
Identify the command-line utility used and its operational behavior.
The command executed is `pathping`, which combines path trace capabilities (`tracert`) with ping statistics collected over an extended sampling interval.
Understanding utility output formatting allows proper distinction between hop-by-hop latency and cumulative loss statistics.
2
Analyze the loss percentages at hop 2 (10.2.20.1) versus hop 3 (192.168.50.100).
Hop 2 reports 100% loss at 'This Node/Link', whereas hop 3 reports 0% overall loss from source to target.
If actual network packet loss occurred at hop 2, packets destined for hop 3 would also be dropped, resulting in equal or higher loss percentages at hop 3.
3
Deduce the root cause of the specific hop 2 anomaly.
The router at 10.2.20.1 deliberately drops direct ICMP Echo Request/Time Exceeded messages directed to its control plane to conserve CPU resources while continuing to forward data plane traffic normally.
Router control plane ICMP rate-limiting is standard behavior and does not affect transit traffic destined for subsequent nodes.

Key Concept

Interpreting pathping and ICMP rate-limiting behavior across intermediate network hops.
Question 1839Question →

A network administrator is connecting a router at a branch office to the central corporate network via a point-to-point IP link (10.200.1.0/3010.200.1.0/30). Ping tests between the local interface (10.200.1.110.200.1.1) and the remote interface (10.200.1.210.200.1.2) are successful. However, OSPF dynamic routing fails to establish a neighbor adjacency between the two routers.

An audit of the inbound Access Control List (ACL) applied to the router's interface displays the following rules:

text
Extended IP access list INBOUND_FILTER
10 permit tcp any any eq 80
20 permit tcp any any eq 443
30 permit icmp any any
40 deny ip any any

Which of the following is the root cause of the OSPF adjacency failure?

Show answer & explanation

Answer: OSPF uses IP protocol 89 directly over IP, which is blocked by the explicit deny statement because it matches neither TCP nor ICMP.

Answer

OSPF uses IP protocol 89 directly over IP, which is dropped by the deny statement because it is neither TCP nor ICMP.
OSPF communicates directly over IP using protocol number 89 rather than using transport-layer protocols like TCP or UDP. Pings succeed because ICMP is explicitly permitted in line 30. However, OSPF packets do not match lines 10, 20, or 30, so they are denied by line 40.

Step-by-Step Solution

1
Analyze the successful diagnostic test results.
Successful ICMP ping confirms physical layer, data link layer, and IP subnet connectivity between 10.200.1.110.200.1.1 and 10.200.1.210.200.1.2.
Rule out physical line faults, IP address mismatches, and basic Layer 3 unreachability.
2
Examine the protocol behavior of OSPF.
OSPF does not use TCP or UDP; it encapsulates protocol packets directly into IP headers using IP protocol number 89.
Determine the network traffic characteristics of OSPF adjacency maintenance (Hello packets).
3
Evaluate the inbound interface ACL rules sequentially.
Line 10 permits TCP 80, Line 20 permits TCP 443, Line 30 permits ICMP. OSPF packets (IP protocol 89) match none of these and are dropped by Line 40 (deny ip any any).
Identify why OSPF packets fail to traverse the interface despite successful pings.

Key Concept

ACL Protocol Filtering and OSPF IP Protocol 89
Question 1840Question →

A field technician is dispatched to an office building to troubleshoot a single workstation that has lost physical link connectivity to the local network. The switch port in the wiring closet is operating normally, but signals are failing between the patch panel and the user's wall outlet. Which of the following documentation artifacts should the technician consult to identify the exact pinout mappings, conductor color codes, and intermediate punchdown block terminations along this specific copper run?

Show answer & explanation

Answer: Wiring schematic

Answer

The technician should consult a wiring schematic, as it provides detailed low-level physical cabling information, including pinouts, wire color standards, and punchdown block terminations.
The correct choice is the wiring schematic. Wiring schematics depict low-level physical wiring details, including pin assignments, conductor color codes (such as T568A or T568B), cross-connect points, and punchdown block pinouts required when tracing physical twisted-pair cable runs.

Step-by-Step Solution

1
Analyze the troubleshooting scope
The issue involves physical Layer 1 copper conductors, wall outlet terminations, pinouts, and intermediate punchdown blocks.
Tracing physical copper conductors requires Layer 1 documentation detailing wire pairs and physical termination points.
2
Evaluate document types against physical wiring needs
Wiring schematics specifically map out conductor positions, wire colors (e.g., T568A/T568B), punchdown blocks (such as 110 or 66 blocks), and modular jack connections.
Logical diagrams, rack elevations, and IPAM tables focus on network topology, rack space utilization, and IP addressing rather than detailed cable construction and terminations.

Key Concept

Network Documentation Types and Use Cases
PreviousPage 92 / 112Next
All practice questions — CompTIA Network+ | Examkin