All practice questions

350 questions

Question 1Question

Match each network documentation type to its primary operational use case.

Click a left item, then click its matching right item

Items

Physical Network Diagram
Logical Network Diagram
Rack Diagram
Wiring Schematic

Matches

Show answer & explanation

Answer

Physical Network Diagram connects to documenting actual cable runs and hardware locations; Logical Network Diagram connects to mapping IP addressing schemes and VLAN allocations; Rack Diagram connects to planning rack space availability and height requirements; Wiring Schematic connects to tracing pinouts and cable conductor pathways.
Each documentation type serves a distinct role: Physical network diagrams detail device locations and cabling paths; logical network diagrams focus on IP addressing, VLANs, and protocol boundaries; rack diagrams track cabinet slot (U) utilization and power distribution; and wiring schematics depict detailed pinouts and copper/fiber conductor paths.

Step-by-Step Solution

1
Identify the primary purpose of physical diagrams versus logical diagrams.
Physical diagrams deal with tangible hardware placement and cable routes, while logical diagrams depict IP addresses, VLAN boundaries, and traffic flow.
Differentiating between physical and logical representations is fundamental for network documentation.
2
Differentiate enclosure-level planning tools from cable termination schematics.
Rack diagrams focus on vertical unit (U) allocation and power inside equipment cabinets, whereas wiring schematics show conductor pinouts and patch panel terminations.
Proper documentation selection depends on whether troubleshooting physical cabinet space or line-level electrical connectivity.

Key Concept

Network Documentation Types and Use Cases
Question 2Question

A network architect is designing an enterprise IPv6 deployment and reviewing address allocation strategies and autoconfiguration modes. Match each IPv6 deployment mechanism or address scope on the left with its exact functional operation and protocol behavior on the right.

Click a left item, then click its matching right item

Items

Stateless Address Autoconfiguration (SLAAC) with Stateless DHCPv6
Stateful DHCPv6 Deployment
Link-Local Unicast Addressing
Unique Local Addressing (ULA)

Matches

Show answer & explanation

Answer

SLAAC with Stateless DHCPv6 matches the configuration using RA flags M=0 and O=1; Stateful DHCPv6 Deployment matches the configuration using RA flags M=1 and O=1; Link-Local Unicast Addressing matches the fe80::/10 block for single-link communication and NDP; Unique Local Addressing matches the fc00::/7 block for non-public internal routed communication.
Each IPv6 mechanism is paired strictly according to standard RFC specifications: SLAAC with Stateless DHCPv6 relies on M=0 and O=1 RA flags; Stateful DHCPv6 requires M=1; Link-Local addressing uses the fe80::/10 prefix exclusively for local-link functions; and Unique Local Addresses utilize fc00::/7 for non-public internal routed communication.

Step-by-Step Solution

1
Analyze SLAAC with Stateless DHCPv6 flag settings.
Determined that M=0 delegates IP creation to SLAAC, while O=1 requests non-IP settings from DHCPv6.
Stateless DHCPv6 does not issue IP leases; it only supplies auxiliary options.
2
Analyze Stateful DHCPv6 flag settings.
Determined that M=1 instructs hosts to obtain IP address leases statefully from the DHCPv6 server.
Stateful operation centralizes address tracking and lease management.
3
Evaluate Link-Local addressing scope and purpose.
Associated fe80::/10 with mandatory single-link protocol operations.
Link-Local addresses are automatically assigned on all enabled interfaces and cannot cross routers.
4
Evaluate Unique Local Addressing scope and purpose.
Associated fc00::/7 (fd00::/8) with enterprise internal private routing.
ULAs function similarly to IPv4 RFC 1918 addresses within internal networks.

Key Concept

IPv6 Addressing Scopes and Neighbor Discovery RA Flag Autoconfiguration
Question 3Question

A network technician is configuring switch ports on an enterprise switch to handle 802.1Q trunking and VLAN operations. Match each switchport interface configuration command on the left with its corresponding frame processing or trunk negotiation behavior on the right.

Click a left item, then click its matching right item

Items

switchport trunk native vlan 99
switchport mode access
switchport trunk allowed vlan 10,20
switchport mode dynamic auto

Matches

Show answer & explanation

Answer

The correct pairings align each command with its operational behavior: native VLAN 99 sends untagged frames across trunks; access mode locks the interface to a single untagged VLAN; allowed vlan 10,20 drops unlisted VLAN traffic; and dynamic auto passively awaits trunk negotiation.
Each switchport configuration statement defines specific frame processing or trunk negotiation behaviors: native VLAN 99 handles untagged trunk traffic; access mode establishes single-VLAN operational ports; allowed VLAN lists prune unapproved VLAN traffic; and dynamic auto passively responds to DTP negotiation.

Step-by-Step Solution

1
Analyze native VLAN behavior for `switchport trunk native vlan 99`.
Identified that VLAN 99 traffic crosses the trunk without 802.1Q tag headers.
By 802.1Q standard design, native VLAN frames are transmitted untagged across trunk connections.
2
Analyze static access port behavior for `switchport mode access`.
Identified that the port operates exclusively in a single untagged VLAN and rejects trunking.
Access mode explicitly disables trunking encapsulation and assigns the port to one access VLAN.
3
Analyze trunk filtering for `switchport trunk allowed vlan 10,20`.
Identified that unlisted VLANs (e.g., VLAN 30) are blocked while VLAN 10 and 20 are permitted.
The allowed VLAN list acts as a trunk filter, permitting only explicitly allowed VLAN IDs.
4
Analyze negotiation behavior for `switchport mode dynamic auto`.
Identified that the interface passively waits for DTP negotiation requests from its neighbor.
Dynamic auto interfaces will convert to a trunk only if the remote end initiates negotiation via dynamic desirable or trunk modes.

Key Concept

802.1Q trunking port modes, native VLAN untagged behavior, allowed VLAN filtering, and DTP negotiation dynamics.
Question 4Question

A lead network administrator is organizing the operational documentation repository for an enterprise infrastructure. Match each network documentation record below to the specific operational task where it serves as the essential source of truth.

Click a left item, then click its matching right item

Items

Physical Topology Diagram
Port Mapping Schedule
Performance Baseline Document
Change Management Log

Matches

Show answer & explanation

Answer

Physical Topology Diagram matches with identifying physical cabling runs and equipment room locations. Port Mapping Schedule matches with tracing switch port numbers and patch panel terminations. Performance Baseline Document matches with evaluating current bandwidth spikes against historical normal metrics. Change Management Log matches with auditing administrative modification history and approvals.
Network documentation artifacts serve specialized operational purposes: physical topology diagrams record hardware locations and cabling paths; port mapping schedules specify exact interface-to-patch panel connections; performance baselines provide reference thresholds for historical system utilization; and change management logs maintain chronological records of configuration updates and approvals.

Step-by-Step Solution

1
Analyze the operational requirements presented in each task.
Categorize the tasks into physical location mapping, individual interface tracking, performance comparison, and historical change tracking.
Categorization aligns specific operational needs with the specialized role of each network documentation artifact.
2
Match hardware layout and cabling details to physical documentation.
Associate physical cable paths and rack positions with physical topology diagrams, and specific port-to-jack bindings with port mapping schedules.
Physical diagrams cover spatial equipment arrangements, whereas port mapping sheets focus on specific pinouts and interface terminations.
3
Match operational metrics and historical modification records to management documentation.
Associate traffic evaluation against norms with performance baselines, and modification audit trails with change management logs.
Baselines quantify normal system behavior over time, whereas change management logs preserve audit records of system maintenance and configuration updates.

Key Concept

Operational Documentation and Diagram Classification
Estimated Time:1m 30s
Question 5Question

Match each 802.1Q trunking component or port mode behavior on the left with its corresponding operational description on the right.

Click a left item, then click its matching right item

Items

Native VLAN egress behavior
Tagged VLAN egress behavior
Standard access port ingress behavior
802.1Q Tag Control Information (TCI)

Matches

Show answer & explanation

Answer

Native VLAN egress behavior matches forwarding frames untagged across the trunk. Tagged VLAN egress behavior matches inserting a 4-byte header containing a 12-bit VLAN ID. Standard access port ingress behavior matches accepting untagged frames, assigning them to the configured access VLAN, and dropping tagged frames. 802.1Q Tag Control Information (TCI) matches containing PCP/CoS priority bits, DEI, and the 12-bit VLAN ID.
The correct pairings accurately reflect IEEE 802.1Q header structures and switchport operations: Native VLAN egress traffic flows untagged; non-native VLAN traffic has a 4-byte header with a 12-bit VLAN ID inserted; access ports accept untagged host frames for a single broadcast domain while discarding tagged frames; and the 802.1Q TCI field encodes 3-bit CoS priority, 1-bit DEI, and the 12-bit VLAN identifier.

Step-by-Step Solution

1
Analyze Native VLAN trunking behavior
Native VLAN traffic travels across 802.1Q trunk links untagged without modifying the original frame encapsulation.
IEEE 802.1Q trunking specifies that the native VLAN carries untagged frames across interconnecting switches for backward compatibility.
2
Analyze Tagged VLAN trunking behavior
Non-native VLAN frames receive a 4-byte 802.1Q tag containing a 12-bit VLAN Identifier (VID).
Explicit tagging enables switches on both ends of the trunk to correctly segregate traffic into distinct logical networks.
3
Analyze Access Port ingress behavior
Access ports receive untagged traffic from host interfaces and assign it to a single target VLAN.
Access ports belong strictly to one VLAN domain and discard incoming tagged frames for security and operational integrity.
4
Analyze 802.1Q TCI subfields
The TCI subfield allocates 3 bits for Class of Service (CoS), 1 bit for DEI, and 12 bits for VID.
The 12-bit VID allows support for up to 4,094 usable VLANs (21222^{12} - 2).

Key Concept

VLAN Configuration and 802.1Q Trunking Mechanics
Question 6Question

A network technician is documenting IPv6 deployment scopes and prefix classifications across an enterprise infrastructure. Match each IPv6 address type on the left to its correct prefix range and functional scope on the right.

Click a left item, then click its matching right item

Items

Global Unicast Address (GUA)
Link-Local Address
Unique Local Address (ULA)
Multicast Address

Matches

Show answer & explanation

Answer

Global Unicast Address (GUA) pairs with the 2000::/3 globally routable internet block. Link-Local Address pairs with the fe80::/10 single local segment block. Unique Local Address (ULA) pairs with the fc00::/7 private internal routing block. Multicast Address pairs with the ff00::/8 one-to-many group delivery block.
Each IPv6 address type is defined by specific prefix allocations. Global Unicast Addresses use 2000::/3 for public internet traffic. Link-Local addresses use fe80::/10 for communications limited strictly to the local network segment. Unique Local Addresses use fc00::/7 for internal enterprise networks. Multicast addresses start with ff00::/8 to reach multiple subscribed devices across a network.

Step-by-Step Solution

1
Identify the prefix and functional scope for Global Unicast Addresses (GUA).
GUA corresponds to 2000::/3 (including 2001::/16) for public internet routing.
GUAs are equivalent to public IPv4 addresses.
2
Identify the prefix and scope for Link-Local addresses.
Link-Local corresponds to fe80::/10 for non-routable communication within the immediate physical or logical link.
Link-Local addresses are automatically created on IPv6-enabled interfaces for neighbor discovery and local communications.
3
Identify the prefix and scope for Unique Local Addresses (ULA).
ULA corresponds to fc00::/7 for private internal networks.
ULAs allow organization-wide internal routing without being reachable from the global internet.
4
Identify the prefix and scope for Multicast addresses.
Multicast corresponds to ff00::/8 for delivering messages to multiple subscribing hosts.
IPv6 uses multicast instead of broadcast for efficient group delivery.

Key Concept

IPv6 Address Classifications and Scope Prefixes
Question 7Question

Match each dynamic routing protocol or routing concept to its correct characteristic or functional definition.

Click a left item, then click its matching right item

Items

Open Shortest Path First (OSPF)
Border Gateway Protocol (BGP)
Routing Information Protocol version 2 (RIPv2)
Administrative Distance (AD)

Matches

Show answer & explanation

Answer

Open Shortest Path First (OSPF) pairs with Link-state IGP using Dijkstra's algorithm and a cost metric based on reference bandwidth. Border Gateway Protocol (BGP) pairs with Path-vector EGP that makes routing decisions based on autonomous system path and policy attributes. Routing Information Protocol version 2 (RIPv2) pairs with Distance-vector IGP using hop count (maximum 15) as its metric with 30-second periodic updates. Administrative Distance (AD) pairs with Trustworthiness metric ranging from 0 to 255 used by routers to rank route sources.
Each protocol and routing term is accurately aligned with its corresponding algorithm, metric structure, and administrative scope.

Step-by-Step Solution

1
Analyze OSPF operational attributes.
OSPF operates as a link-state Interior Gateway Protocol (IGP) using cost computed from interface bandwidth via the Dijkstra algorithm.
Link-state protocols build full topology maps before calculating shortest path trees.
2
Analyze BGP operational attributes.
BGP functions as a path-vector Exterior Gateway Protocol (EGP) routing between Autonomous Systems using AS-Path attributes.
Path-vector protocols prevent loops at an inter-domain scale without needing link-state maps of external systems.
3
Analyze RIPv2 operational attributes.
RIPv2 is a distance-vector protocol utilizing hop count as its primary metric with a 15-hop boundary.
Distance-vector routing relies on directional vectors and periodic table updates sent to directly connected neighbors.
4
Analyze Administrative Distance.
Administrative Distance is an integer ranking from 0 (most trusted) to 255 (untrusted) used when multiple protocols advertise an identical destination path.
Routers must select a single route source to install into the IP routing table when prefix lengths are equal.

Key Concept

Dynamic Routing Protocols and Path Selection Principles
Estimated Time:1m 30s
Question 8Question

A network security architect is defining address translation policies for a corporate infrastructure. Match each technical network requirement on the left with its corresponding NAT/PAT implementation method on the right.

Click a left item, then click its matching right item

Items

Providing thousands of internal workstation hosts with simultaneous outbound internet access through a single external interface IP address.
Exposing an internal application server at a fixed private IPv4 address to external partners using a permanent public IPv4 mapping.
Temporarily assigning public IPv4 addresses from a shared pool to internal hosts on a first-come, first-served basis without port multiplexing.
Redirecting external inbound connections targeting a custom public port (84438443) to an internal web server listening on standard HTTP port 8080.

Matches

Show answer & explanation

Answer

1. Thousands of hosts sharing a single external IP maps to Port Address Translation (PAT / Interface Overload).
2. Exposing an internal server via permanent public IP mapping maps to Static 1:1 Network Address Translation.
3. Temporarily assigning public IPs from a pool without port multiplexing maps to Dynamic NAT.
4. Redirecting custom public port traffic to an internal web server port maps to Port Forwarding (Static PAT).
The mappings accurately distinguish between Layer 3 IP translation (Static 1:1 NAT and Dynamic NAT) and Layer 4 port translation/multiplexing (PAT and Port Forwarding). Multiple internal hosts sharing one public IP requires PAT (Overload). A fixed public-to-private server mapping requires Static 1:1 NAT. Temporary 1:1 allocation from a public pool without port multiplexing requires Dynamic NAT. Translating an incoming external port to a different internal IP and port requires Port Forwarding.

Step-by-Step Solution

1
Analyze the requirement for outbound internet access for thousands of hosts using a single public IP address.
Identify that port multiplexing (Layer 4 source port tracking) is required to distinguish individual host sessions, pointing to Port Address Translation (PAT/Overload).
A single public IP address can only support multiple concurrent host connections if unique Layer 4 port numbers are assigned to each session flow.
2
Analyze the requirement for a permanent, bi-directional mapping for an internal server.
Identify that a fixed 1:1 relationship is required without port modification, corresponding to Static 1:1 NAT.
External clients must be able to initiate inbound traffic to the internal server at any time using a persistent public IP address.
3
Analyze the requirement for temporary assignment from a public IP pool without port multiplexing.
Identify 1:1 dynamic mapping from an available address block, corresponding to Dynamic NAT.
When port translation is not utilized, each active internal session consumes a dedicated public IP address from the pool for the duration of the communication.
4
Analyze the requirement for mapping incoming traffic on public port 84438443 to internal port 8080.
Identify destination port translation and IP redirection, corresponding to Port Forwarding (Static PAT).
Port Forwarding allows specific incoming external port requests to be translated to a designated internal target host IP and port number.

Key Concept

NAT and PAT Implementation Types and Address Mapping Mechanisms
Estimated Time:2m 0s
Question 9Question

Match each Network Address Translation (NAT) implementation type on the left with its corresponding address mapping characteristic on the right.

Click a left item, then click its matching right item

Items

Static NAT
Dynamic NAT
Port Address Translation (PAT)

Matches

Show answer & explanation

Answer

Static NAT matches permanent one-to-one mapping; Dynamic NAT matches translation using a dynamic pool of public IP addresses; Port Address Translation (PAT) matches translation of multiple private IP addresses to a single public IP address using unique port numbers.
Static NAT creates a permanent one-to-one mapping between a single private IP and a single public IP address. Dynamic NAT uses a pool of public IP addresses assigned dynamically to internal hosts on demand. Port Address Translation (PAT) multiplexes multiple private IP addresses onto a single public IP address using unique Layer 4 source port numbers.

Step-by-Step Solution

1
Identify the mapping behavior of Static NAT.
Static NAT establishes a fixed, persistent one-to-one mapping between one private IP address and one public IP address.
Static NAT is required when an internal host (such as an enterprise web or mail server) must maintain a consistent external IP address for inbound connectivity.
2
Identify the mapping behavior of Dynamic NAT.
Dynamic NAT assigns an available public IP address from a configured pool to an internal host dynamically for the duration of a session.
Dynamic NAT allows multiple devices to access the internet as long as sufficient public IP addresses exist in the pool for active sessions.
3
Identify the mapping behavior of Port Address Translation (PAT).
PAT allows many private host IPs to share one public IP address by assigning unique source port numbers to distinguish individual sessions.
PAT conserves IPv4 public address space by leveraging TCP/UDP source ports at Layer 4 to multiplex traffic over a single public address.

Key Concept

NAT and PAT Implementation Types
Estimated Time:1m 0s
Question 10Question

Match each network classification or physical/logical topology on the left with its corresponding architectural design characteristic on the right.

Click a left item, then click its matching right item

Items

Storage Area Network (SAN)
Campus Area Network (CAN)
Full Mesh Topology
Logical Bus Topology

Matches

Show answer & explanation

Answer

Storage Area Network (SAN) matches with 'Dedicated high-speed network providing block-level storage access to servers using specialized storage protocols.' Campus Area Network (CAN) matches with 'Network connecting multiple distinct local area networks across adjacent buildings within a contiguous geographical boundary.' Full Mesh Topology matches with 'Redundant layout where every node maintains a direct point-to-point connection to every other node, maximizing fault tolerance.' Logical Bus Topology matches with 'Data transmission arrangement where all nodes share a common broadcast medium and single collision domain regardless of physical wiring.'
Each network concept is correctly paired with its specific operational scope and structural characteristic: SAN for block-level storage networking, CAN for multi-building contiguous campus connections, Full Mesh for complete point-to-point node redundancy, and Logical Bus for shared broadcast/collision domain behavior.

Step-by-Step Solution

1
Analyze storage-specific network architectures.
Identified Storage Area Network (SAN) as the dedicated network designed for block-level storage transfer.
SANs isolate storage traffic from enterprise LAN traffic using protocols like Fibre Channel or iSCSI.
2
Differentiate geographic network scopes.
Identified Campus Area Network (CAN) as the link between multiple LANs across contiguous corporate or university buildings.
CAN scope is larger than a single LAN but smaller and more geographically unified than a Metropolitan Area Network (MAN).
3
Evaluate high-availability physical topologies.
Matched Full Mesh Topology to the design requiring direct connections between all node pairs.
Full mesh formula n(n-1)/2 calculates total required links ensuring maximum redundancy.
4
Distinguish physical wiring from logical traffic flow.
Matched Logical Bus Topology to shared medium access and single collision domain behavior.
Logical topology defines electrical signal path and media access rules independently of physical cabling arrangement.

Key Concept

Network Topologies and Geographic Classifications
Estimated Time:1m 30s
Question 11Question

Match each network security authentication protocol or access control framework to its corresponding architectural characteristic and transport specification.

Click a left item, then click its matching right item

Items

RADIUS
TACACS+
Kerberos
802.1X

Matches

Show answer & explanation

Answer

RADIUS matches UDP ports 1812/1813 with password-only encryption; TACACS+ matches TCP port 49 with full payload encryption and decoupled AAA; Kerberos matches Key Distribution Center tickets over port 88; 802.1X matches IEEE Layer 2 port-based access control using EAP encapsulation.
Each item is correctly matched based on its transport protocol, port assignments, and architectural mechanisms. RADIUS utilizes UDP 1812/1813 with password-only attribute encryption. TACACS+ uses TCP port 49 with full payload encryption and separate AAA processes. Kerberos relies on a KDC issuing TGTs on port 88. 802.1X specifies IEEE Layer 2 port-based network access control encapsulating EAP.

Step-by-Step Solution

1
Analyze RADIUS transport and encryption properties
RADIUS operates over connectionless UDP (ports 1812 for authentication and 1813 for accounting), combines authentication and authorization, and encrypts only the password field.
Differentiate RADIUS transport ports and attribute encryption scope.
2
Analyze TACACS+ transport and security architecture
TACACS+ utilizes connection-oriented TCP port 49, separates the AAA components independently, and encrypts the entire packet payload.
Identify TACACS+ protocol parameters and full-payload encryption design.
3
Examine Kerberos ticket-based authentication flow
Kerberos uses a trusted KDC to issue Ticket-Granting Tickets (TGTs) and service tickets over port 88.
Relate Kerberos to single sign-on ticket architecture.
4
Examine 802.1X framework responsibilities
802.1X provides Layer 2 port-based network access control, encapsulating Extensible Authentication Protocol (EAP) frames between the endpoint supplicant and authenticator switch/AP.
Distinguish network access enforcement frameworks from backend AAA directory protocols.

Key Concept

Centralized AAA Protocols, Port Numbers, and Encryption Boundaries
Question 12Question

A network engineer is configuring address translation policies on an enterprise edge firewall. Match each specific technical mapping requirement on the left with its corresponding address translation implementation type on the right.

Click a left item, then click its matching right item

Items

Providing a permanent, one-to-one mapping between a private IP address of an internal web server (10.1.10.5010.1.10.50) and a dedicated public IP address (203.0.113.50203.0.113.50).
Allowing 200 internal workstations on a private subnet (192.168.1.0/24192.168.1.0/24) to access external resources simultaneously using a single public IP address (203.0.113.1203.0.113.1).
Mapping internal hosts on demand to available external IP addresses from a pre-allocated public address pool (203.0.113.100203.0.113.110203.0.113.100 - 203.0.113.110) without port modification.
Redirecting inbound traffic sent to an external public IP on port 8080 (203.0.113.20:8080203.0.113.20:8080) to an internal database management interface (10.1.10.20:8010.1.10.20:80).

Matches

Show answer & explanation

Answer

Static NAT pairs with permanent 1-to-1 server mapping; Port Address Translation (PAT / NAT Overload) pairs with many workstations sharing a single public IP address; Dynamic NAT pairs with mapping hosts to a pool of public IP addresses on demand; Port Forwarding (Static PAT) pairs with redirecting a specific external port to an internal IP address and port.
Each NAT implementation serves a distinct networking use case: Static NAT provides a fixed 1-to-1 mapping for external server accessibility; PAT multiplexes multiple private IP addresses onto one public IP using Layer 4 port tracking; Dynamic NAT draws 1-to-1 public IP mappings temporarily from a pool; and Port Forwarding directs specific inbound external port traffic to an internal target host.

Step-by-Step Solution

1
Analyze the requirement for a permanent 1-to-1 server mapping
Identified Static NAT as the fixed one-to-one mapping mechanism required for public inbound access.
Static NAT maintains a persistent mapping between one private IP and one public IP.
2
Analyze the requirement for multiple workstations sharing a single public IP
Identified PAT (Port Address Translation / NAT Overload) as the solution.
PAT differentiates connections from multiple internal hosts sharing one IP by assigning unique Layer 4 source ports.
3
Analyze the requirement for on-demand allocation from a public IP pool without port translation
Identified Dynamic NAT as the matching translation mechanism.
Dynamic NAT allocates a public IP address from a defined pool to an internal host for the active session length.
4
Analyze the requirement for redirecting inbound traffic on a specific port to an internal IP and port
Identified Port Forwarding (Static PAT) as the solution.
Port Forwarding routes specific incoming public socket requests (IP:Port) to an internal host's designated socket.

Key Concept

NAT and PAT Implementation Types and Selection Criteria
Estimated Time:1m 30s
Question 13Question

A network operations team is upgrading the enterprise monitoring architecture to address bandwidth degradation, security compliance, and service level agreement (SLA) tracking across site-to-site WAN links. Match each network performance monitoring technology or protocol on the left with the specific operational monitoring requirement it directly satisfies on the right.

Click a left item, then click its matching right item

Items

NetFlow / IPFIX Flow Record Telemetry
SNMPv3 with authPriv Security Level
IP SLA Active Synthetic Probing
Full Packet Capture via Physical Network TAP

Matches

Show answer & explanation

Answer

NetFlow / IPFIX matches with quantifying top talkers and protocol breakdown without payload storage; SNMPv3 authPriv matches with securely polling system health metrics over encrypted connections; IP SLA active probing matches with measuring latency, jitter, and loss for VoIP SLAs; Full Packet Capture matches with inspecting exact bit-level TCP behavior and raw payload contents.
Each technology satisfies a distinct performance monitoring requirement: NetFlow/IPFIX aggregates layer 3/4 header stats for top talkers without storing payloads; SNMPv3 authPriv enforces encryption and authentication for device health polling; IP SLA injects synthetic probes to calculate delay, jitter, and loss for voice SLAs; and full packet capture duplicates physical traffic for low-level TCP and payload analysis.

Step-by-Step Solution

1
Analyze the primary telemetry mechanism of each monitoring solution.
Differentiated flow metadata (NetFlow/IPFIX), pull-based device state management (SNMPv3), synthetic probe traffic (IP SLA), and line-rate frame mirroring (TAP/PCAP).
Each monitoring methodology addresses a distinct diagnostic requirement within network operations.
2
Align each operational scenario requirement with the capability of the matching telemetry tool.
Matched SNMPv3 authPriv to encrypted MIB polling, NetFlow to payload-less flow summaries, IP SLA to active voice path metrics, and PCAP to deep payload and frame analysis.
Correctly pairs telemetry data collection capabilities with performance enterprise objectives.

Key Concept

Network Performance Telemetry Methods and Metric Collection
Question 14Question

A network security administrator is organizing the organization's access control architecture. Match each authentication protocol or framework to its correct operational characteristic and transport mechanism.

Click a left item, then click its matching right item

Items

RADIUS
TACACS+
IEEE 802.1X
Kerberos

Matches

Show answer & explanation

Answer

RADIUS matches with partial packet encryption over UDP 1812/1813; TACACS+ matches with full payload encryption over TCP 49; IEEE 802.1X matches with the port-based EAP encapsulation framework; Kerberos matches with KDC and Ticket-Granting Ticket issuance over port 88.
Each protocol correctly aligns with its architectural design: RADIUS provides combined authentication/authorization with UDP transport (1812/1813) encrypting passwords; TACACS+ separates AAA services using TCP 49 with full payload encryption; 802.1X serves as the Layer 2 EAP port-based access framework; and Kerberos relies on a KDC for TGT issuance over port 88.

Step-by-Step Solution

1
Analyze transport protocols and encryption scope for remote user vs. device access protocols.
RADIUS uses UDP ports 1812/1813 and encrypts only the password, whereas TACACS+ uses TCP port 49 and encrypts the entire payload.
RADIUS was designed for broad client network access and user dial-in/VPN connection tracking, while TACACS+ was designed for granular network infrastructure management.
2
Evaluate port-based access control and local ticket-based network authentication protocols.
IEEE 802.1X defines port control using EAP encapsulation, while Kerberos provides ticket-granting ticket authentication via a Key Distribution Center.
802.1X prevents unauthenticated devices from connecting to physical switch ports or wireless access points, while Kerberos manages identity access tickets across domain resources.

Key Concept

Centralized AAA Frameworks, Port-Based Network Access Control, and Protocol Characteristics
Question 15Question

Match each authentication protocol or security standard to its core operational characteristic.

Click a left item, then click its matching right item

Items

RADIUS
TACACS+
Kerberos
802.1X

Matches

Show answer & explanation

Answer

RADIUS matches with combining authentication and authorization while encrypting only passwords over UDP; TACACS+ matches with separating AAA services and encrypting the full payload over TCP port 49; Kerberos matches with using ticket-granting tokens for mutual authentication; 802.1X matches with providing port-based network access control.
Each term is correctly matched according to its underlying transport protocol, encryption scope, AAA architecture, or access control mechanism.

Step-by-Step Solution

1
Identify the protocol that combines authentication/authorization and encrypts passwords over UDP.
RADIUS matches this operational profile.
RADIUS uses UDP ports 1812/1813 and obscures only the password payload.
2
Identify the protocol that separates all AAA pillars and encrypts the full payload over TCP port 49.
TACACS+ matches this operational profile.
TACACS+ operates over TCP port 49 and encrypts the entire packet body following the header.
3
Identify the authentication system based on tickets and mutual authentication.
Kerberos matches this operational profile.
Kerberos uses Ticket Granting Services to authenticate clients without transmitting passwords over the network.
4
Identify the standard responsible for port-based network authentication.
802.1X matches this operational profile.
802.1X blocks unauthorized network traffic at Layer 2 until credentials are confirmed by an authentication server.

Key Concept

AAA Framework and Authentication Methods
Question 16Question

Match each network logging protocol, tool, or severity level on the left to its corresponding primary operational function or security characteristic on the right.

Click a left item, then click its matching right item

Items

Syslog Severity Level 0 (Emergency)
SNMPv3 authPriv
NetFlow / IPFIX
SIEM (Security Information and Event Management)

Matches

Show answer & explanation

Answer

Syslog Severity Level 0 (Emergency) matches 'Indicates an unstable system state or critical panic requiring immediate attention'. SNMPv3 authPriv matches 'Provides HMAC-based authentication along with payload encryption (AES/DES) for management messages'. NetFlow / IPFIX matches 'Exports traffic statistics and flow records to analyze bandwidth usage and communication paths'. SIEM matches 'Aggregates, correlates, and analyzes log data across disparate network endpoints for real-time threat detection'.
Each logging term correctly pairs with its operational capability: Syslog Level 0 represents the highest emergency severity level; SNMPv3 authPriv ensures both authentication and encryption; NetFlow tracks IP network traffic statistics; and SIEM aggregates event logs across systems for security auditing.

Step-by-Step Solution

1
Identify the standard definitions of Syslog severity codes.
Level 0 is defined as Emergency (system unusable).
Syslog levels range from 0 (Emergency) to 7 (Debug).
2
Differentiate between SNMPv3 security levels.
authPriv adds privacy (encryption) to message authentication.
noAuthNoPriv offers no security, authNoPriv authenticates without encryption, and authPriv supplies both.
3
Distinguish flow statistics from event logging.
NetFlow and IPFIX report flow statistics (IPs, ports, byte count) rather than discrete text logs.
NetFlow analyzes traffic telemetry rather than system event logs.
4
Identify the centralized log aggregation and auditing platform.
SIEM platforms correlate logs from various network devices to highlight security incidents.
SIEM serves as the centralized repository and analysis engine for enterprise auditing.

Key Concept

Network Logging Mechanisms and Security Auditing Tools
Question 17Question

Match each network logging and auditing protocol or concept on the left with its corresponding primary characteristic or function on the right.

Click a left item, then click its matching right item

Items

Default Syslog Transport
SNMPv3 authPriv
NetFlow Auditing
Syslog Severity Level 0

Matches

Show answer & explanation

Answer

Default Syslog Transport matches sending messages over UDP port 514; SNMPv3 authPriv matches providing authentication and encryption; NetFlow Auditing matches collecting traffic flow statistics; Syslog Severity Level 0 matches emergency conditions where the system is unusable.
Each logging and monitoring concept correctly maps to its foundational standard: Default Syslog uses UDP 514; SNMPv3 authPriv combines authentication with encryption; NetFlow tracks IP traffic session metrics; and Syslog severity 0 corresponds to emergency conditions.

Step-by-Step Solution

1
Identify the standard transport mechanism for basic Syslog logging.
Syslog operates by default using unacknowledged UDP over port 514.
This establishes standard baseline event logging behavior on enterprise network infrastructure.
2
Determine the highest security model capabilities of SNMPv3.
The authPriv mode adds payload privacy (encryption) on top of user authentication.
Security mandates require understanding how authPriv differs from noAuthNoPriv and authNoPriv.
3
Distinguish network flow telemetry from event message logging.
NetFlow analyzes traffic headers to report traffic volumes and conversation statistics rather than log events.
Flow data provides audit visibility into network utilization and conversation endpoints.
4
Recall standard Syslog severity codes (0 through 7).
Level 0 is defined as Emergency (system unusable).
Log auditing relies on prioritizing event severity correctly during triage.

Key Concept

Core Network Logging and Auditing Protocols
Question 18Question

Match each IP addressing service or protocol component to its primary administrative function within network operations.

Click a left item, then click its matching right item

Items

IPAM (IP Address Management)
mDNS (Multicast DNS)
DHCP Option 82
NTP Stratum 1

Matches

Show answer & explanation

Answer

IPAM matches with centralized tracking of IP address spaces; mDNS matches with local name resolution without a dedicated DNS server; DHCP Option 82 matches with inserting circuit/remote ID metadata into request packets; NTP Stratum 1 matches with synchronizing system clocks directly from a reference atomic or GPS clock.
Each IP addressing service fulfills a distinct core infrastructure function: IPAM centralizes address governance, mDNS handles zero-configuration local name resolution, DHCP Option 82 injects physical location metadata into DHCP requests, and NTP Stratum 1 synchronizes directly to primary reference clocks.

Step-by-Step Solution

1
Identify the primary role of IPAM.
IPAM provides centralized management and monitoring of subnets, DNS records, and DHCP pools.
IPAM is designed for centralized visibility across network addressing services.
2
Identify the role of mDNS (Multicast DNS).
mDNS resolves hostnames locally using multicast without reliance on a unicast DNS infrastructure.
mDNS facilitates zero-configuration local service discovery.
3
Analyze the function of DHCP Option 82.
DHCP Option 82 adds relay agent information, such as physical port and switch ID, to DHCP request packets.
This allows administrators to apply policy based on the requester's physical network point of connection.
4
Determine the accuracy specification for NTP Stratum levels.
Stratum 1 NTP servers attach directly to Stratum 0 physical time sources (GPS, Cesium clocks).
Stratum numbering defines hierarchy and proximity to authoritative time sources.

Key Concept

Core IP addressing services (IPAM, mDNS, DHCP Relay Options, NTP) provide essential support for dynamic allocation, resolution, security context, and time synchronization across network topologies.
Question 19Question

Match each VLAN configuration concept or 802.1Q trunking parameter on the left with its corresponding operational behavior or frame-handling mechanism on the right.

Click a left item, then click its matching right item

Items

Native VLAN Configuration
802.1Q Header Tagging
Trunk Allowed VLAN List
Voice VLAN Feature

Matches

Show answer & explanation

Answer

Native VLAN Configuration corresponds to designating the VLAN context used for untagged traffic. 802.1Q Header Tagging corresponds to inserting a 4-byte field containing a 12-bit VLAN Identifier (VID). Trunk Allowed VLAN List corresponds to restricting traffic forwarding exclusively to explicitly permitted VLAN IDs. Voice VLAN Feature corresponds to allowing an interface to carry tagged VoIP traffic while maintaining untagged data traffic.
Each trunking concept is correctly matched to its defined network behavior: Native VLAN manages untagged trunk traffic, 802.1Q header tagging adds the 4-byte frame modifier with 12-bit VID, the trunk allowed list filters permitted VLAN IDs across links, and Voice VLAN enables dual tagged/untagged traffic handling on access ports.

Step-by-Step Solution

1
Analyze Native VLAN functionality on 802.1Q trunks
Identified that native VLAN handles untagged frame transmission across trunks.
By default in 802.1Q, frames belonging to the native VLAN are sent across trunk links without adding an 802.1Q header tag.
2
Analyze 802.1Q tagging structure
Identified the 4-byte insertion containing the 12-bit VID.
IEEE 802.1Q modifies the Ethernet frame by inserting a 4-byte tag field between the Source MAC Address and EtherType fields.
3
Analyze allowed VLAN list configuration
Identified trunk filtering behavior based on permitted VLAN IDs.
By default, trunks permit VLANs 1-4094; configuring an allowed list explicitly restricts which VLAN broadcast domains extend across the link.
4
Analyze Voice VLAN operational model
Identified dual-VLAN behavior on access ports supporting IP phones.
Voice VLAN allows single physical access ports to separate real-time tagged voice traffic from untagged desktop data traffic.

Key Concept

802.1Q Trunking Protocols and Port Characteristics
Question 20Question

Match each authentication and access control protocol with its corresponding transport and security characteristics.

Click a left item, then click its matching right item

Items

RADIUS
TACACS+
Kerberos
802.1X

Matches

Show answer & explanation

Answer

RADIUS pairs with UDP transport and password-only encryption; TACACS+ pairs with TCP port 49 and full payload encryption; Kerberos pairs with port 88 and time-stamped ticketing; 802.1X pairs with EAPOL port-based framework encapsulation.
Each protocol maps directly to its specific network characteristics: RADIUS relies on UDP with password-only encryption; TACACS+ uses TCP port 49 with full payload encryption; Kerberos relies on time-stamped ticket granting over port 88; and 802.1X provides Layer 2 port-based access control via EAPOL encapsulation.

Step-by-Step Solution

1
Analyze transport and payload encryption features of RADIUS.
RADIUS operates on UDP ports 1812/1813 and encrypts only the password field within packets.
RADIUS was designed as a lightweight client/server network access protocol that combines authentication and authorization.
2
Analyze TACACS+ specifications.
TACACS+ operates over TCP port 49, encrypts the full payload, and separates AAA functions for granular command accounting and authorization.
TACACS+ provides high security for administrative access to network infrastructure.
3
Identify ticket-based single sign-on protocol characteristics.
Kerberos utilizes TCP/UDP port 88 and relies on Key Distribution Center (KDC) ticket granting and timestamp validation.
Kerberos avoids sending secrets over the network by issuing cryptographically signed tickets.
4
Identify port-based access control framework characteristics.
802.1X encapsulates Extensible Authentication Protocol over LAN (EAPOL) to authenticate endpoints at Layer 2.
802.1X regulates physical or wireless port connectivity before network privileges are granted.

Key Concept

AAA Framework Protocol and Transport Matrix Characteristics
Page 1 / 18Next
All practice questions — CompTIA Network+ | Examkin