All practice questions

201 questions

Question 1Question

A client workstation on VLAN 20 initiates a connection and requests an IP address assignment from a centralized DHCP server residing on VLAN 100 via a Layer 3 switch interface configured with DHCP relay. Place the following stages of the relayed DHCPDISCOVER and DHCPOFFER packet lifecycle in the correct chronological sequence from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: (1) Host broadcasts DHCPDISCOVER locally on VLAN 20, (2) Relay agent populates the giaddr field with the VLAN 20 SVI address, (3) Relay agent forwards unicast DHCPDISCOVER to the server on VLAN 100, (4) Server selects scope based on giaddr and sends unicast DHCPOFFER to the relay agent, (5) Relay agent delivers DHCPOFFER back to the host on VLAN 20.
The correct sequence reflects standard DHCP relay operations across Layer 3 boundaries. The process begins when the client generates a broadcast DHCPDISCOVER packet on its local segment. The Layer 3 relay interface receives the broadcast, tags its own interface IP into the giaddrgiaddr payload field, and forwards the packet as a unicast transmission to the remote DHCP server. The DHCP server uses the giaddrgiaddr to map the request to the correct scope, then unicasts a DHCPOFFER back to the relay interface IP. Finally, the relay interface delivers the DHCPOFFER to the local client on VLAN 20.

Step-by-Step Solution

1
Identify client-side initiation
The host generates a local broadcast DHCPDISCOVER packet on UDP port 67 because it lacks an IP address.
Broadcast frames are contained within VLAN 20 and cannot traverse Layer 3 boundaries without a relay agent.
2
Relay agent interception and giaddr insertion
The SVI on VLAN 20 intercepts the packet and inserts its SVI IP into the giaddrgiaddr field.
The giaddrgiaddr field informs the remote server which logical subnet requested the lease.
3
Unicast forwarding to server
The relay agent routes a unicast packet to the designated DHCP server IP across the routing core.
Converts non-routable broadcast traffic to routable IP unicast traffic.
4
Server scope evaluation and unicast response
DHCP server matches giaddrgiaddr to the VLAN 20 scope and sends a unicast DHCPOFFER back to the relay agent address.
The server uses the giaddrgiaddr as the destination IP address for the DHCPOFFER reply.
5
Client delivery
The relay agent receives the DHCPOFFER and relays it onto the client's access segment.
Completes the initial discovery phase of the DORA process across subnets.

Key Concept

DHCP Relay Agent Architecture & GIADDR Mechanics
Question 2Question

A network switch interface configured with legacy IEEE 802.1D Spanning Tree Protocol (STP) has just experienced a physical link bring-up event. In what precise chronological order will the port transition through its operational states from initial activation to active data forwarding?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational order of IEEE 802.1D STP port states from initial link bring-up to full operation is Blocking State, Listening State, Learning State, and Forwarding State.
Under IEEE 802.1D STP, a switch interface transitions through four distinct operational states upon physical link up to guarantee loop avoidance. It begins in Blocking (discarding traffic and listening for BPDUs), transitions after the forward delay timer to Listening (exchanging BPDUs to determine roles), moves after a second forward delay timer to Learning (populating MAC tables without forwarding data), and finally settles in Forwarding (actively transmitting user frames and BPDUs).

Step-by-Step Solution

1
Identify the state immediately entered upon physical link up.
The port initializes in the Blocking State.
STP defaults to Blocking to safeguard the Layer 2 domain from transient loops while initial BPDU exchange occurs.
2
Determine the state focused on topology determination and role negotiation.
The port transitions to the Listening State.
During Listening, the port active participates in BPDU transmission and election processes without altering MAC tables or forwarding data.
3
Identify the state focused on building layer 2 forwarding tables prior to frame delivery.
The port transitions to the Learning State.
Learning allows the switch to populate its MAC address table from source addresses to prevent unnecessary unicast flooding when data forwarding begins.
4
Identify the final fully operational state.
The port enters the Forwarding State.
In Forwarding, all loop management checks are complete, enabling full ingress and egress user payload traffic handling.

Key Concept

IEEE 802.1D Spanning Tree Protocol Port State Transitions
Estimated Time:1m 30s
Question 3Question

A client host on a newly configured workstation network (VLAN 30) initiates an IP address lease request. A Layer 3 switch configured with an IP helper address relays this request to a centralized DHCP server located on a separate management network. Place the sequence of events handling the DHCPDISCOVER and DHCPOFFER exchange in chronological order from initial client transmission to final relay delivery.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The chronological sequence of the relayed DHCP exchange is: 1) Client broadcasts DHCPDISCOVER on local VLAN 30; 2) Relay agent populates giaddr and unicasts request to DHCP server; 3) DHCP server selects address pool matching giaddr; 4) DHCP server unicasts DHCPOFFER to relay agent SVI IP; 5) Relay agent forwards DHCPOFFER to client on VLAN 30.
The correct sequence follows the standard DHCP relay process: first, the client host broadcasts a DHCPDISCOVER message locally on UDP port 67. The Layer 3 relay agent intercepts this broadcast, inserts its SVI address into the giaddr header field, and forwards the packet via unicast to the DHCP server. The DHCP server uses the giaddr value to choose the correct subnet pool and returns a unicast DHCPOFFER to the relay agent on UDP port 67. Finally, the relay agent forwards the DHCPOFFER to the client host on UDP port 68.

Step-by-Step Solution

1
Identify initial local broadcast
The unconfigured host transmits a broadcast DHCPDISCOVER frame on UDP port 67 across VLAN 30.
Hosts lacking IP addresses must initiate communications using local Layer 2 and Layer 3 broadcasts.
2
Trace relay agent header modification and forwarding
The Layer 3 switch SVI captures the broadcast, populates the giaddr header field with its interface IP, and forwards a unicast packet to the server on UDP port 67.
The relay agent converts non-routable local broadcasts into routable unicast traffic while adding subnet tracking information.
3
Determine server address allocation logic
The DHCP server matches the giaddr field to its configured address scope for VLAN 30 and reserves an available lease.
The giaddr field explicitly informs the centralized server which subnet pool must be used for assignment.
4
Trace server response transmission
The DHCP server creates a DHCPOFFER and sends it as a unicast packet directly to the relay agent's giaddr on UDP port 67.
The server returns the payload to the relay agent because the client cannot be reached across routed networks directly.
5
Verify final delivery to client
The relay agent receives the offer and sends a DHCPOFFER packet onto VLAN 30 addressed to the client on UDP port 68.
The relay agent delivers the leased address details back to the host on its local access segment.

Key Concept

DHCP Relay Packet Processing and Header Modification Lifecycle
Estimated Time:1m 30s
Question 4Question

A network host on VLAN 10 needs an IP address from a centralized DHCP server located across a routed network on VLAN 100. Place the steps of the initial DHCP discovery and offer process in the correct order from first to last.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with the host broadcasting a DHCPDISCOVER packet on its local subnet, followed by the local relay agent populating the GIADDR header and forwarding a unicast packet to the central server, then the DHCP server replying with a unicast DHCPOFFER using the GIADDR to choose the pool, and finally the relay agent delivering the DHCPOFFER to the local host.
The correct sequence reflects standard DHCP relay behavior across subnets: a local client broadcast is captured by the relay agent, converted to a unicast packet containing the GIADDR, processed by the central DHCP server, sent back to the relay agent as a unicast DHCPOFFER, and lastly delivered back to the client host.

Step-by-Step Solution

1
Identify the initial client transmission on the local subnet.
The host broadcasts a DHCPDISCOVER message on UDP port 67 within VLAN 10.
The client lacks an IP address and must broadcast locally to find a DHCP server.
2
Trace the relay agent intervention at the layer 3 boundary.
The relay agent records its interface IP address in the GIADDR field and unicasts the packet across the network to the DHCP server.
Routers drop broadcast packets by default; the relay agent converts the broadcast into a routable unicast message.
3
Determine the server response mechanism.
The remote DHCP server allocates an IP address matching the GIADDR subnet and sends a unicast DHCPOFFER back to the relay agent.
The server relies on GIADDR information to determine which subnet scope to select.
4
Follow final packet delivery back to the requesting client.
The relay agent forwards the DHCPOFFER onto VLAN 10 so the client host can process it.
The relay agent completes the return path from the centralized server to the local client.

Key Concept

DHCP Relay Operation and Packet Transformation Sequence
Question 5Question

A network administrator needs to restore a critical network monitoring server after a hard drive failure on Thursday morning. The backup strategy consists of a full backup performed every Sunday at midnight and incremental backups performed each night from Monday through Wednesday at midnight. Place the backup recovery steps in the correct sequential order required to fully restore the system.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

To restore a system managed with incremental backups, first restore the latest full backup (Sunday), followed by each incremental backup in chronological order (Monday, then Tuesday, then Wednesday).
An incremental backup sets up a chain where each backup relies on the previous one. To recover the system completely, the baseline full backup from Sunday must be restored first, followed by every individual incremental backup taken since then (Monday, Tuesday, Wednesday) in chronological order.

Step-by-Step Solution

1
Select and restore the base system image
The Sunday full backup is restored
All incremental restoration operations require the baseline full backup to establish the file structure and initial state.
2
Apply subsequent incremental backups chronologically
Apply Monday, Tuesday, and Wednesday incremental backups in exact sequential order
Each incremental backup contains only the delta since the immediately preceding backup. Skipping or misordering any day results in missing or corrupted files.

Key Concept

Incremental Backup Restoration Sequence
Estimated Time:1m 0s
Question 6Question

An enterprise network infrastructure team needs to apply a vendor-recommended operating system update across core routing hardware to address a zero-day vulnerability. In which order should the engineer execute the patch management and maintenance lifecycle steps from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The proper sequence for network patch management requires isolating and testing the update in a lab, obtaining Change Advisory Board approval with an established rollback strategy, executing a pilot deployment in a staging environment, and finally completing the full production rollout accompanied by post-implementation health checks.
Structured network maintenance follows a linear lifecycle to minimize outage risks: testing the patch in an isolated lab environment comes first to discover defect anomalies; securing formal Change Advisory Board (CAB) approval with documented rollback steps comes second; deploying to a pilot staging environment during a scheduled maintenance window comes third; and completing full production rollout alongside post-deployment auditing comes last.

Step-by-Step Solution

1
Conduct isolated lab testing.
Software integrity and basic compatibility are confirmed without placing live network traffic at risk.
Initial lab validation provides empirical data needed to construct accurate risk assessments for governance reviews.
2
Obtain formal Change Advisory Board authorization.
The change management workflow reviews maintenance windows, emergency contact structures, and rollback parameters.
Enterprise policy strictly prohibits deploying software modifications without prior peer review and change approval.
3
Execute a controlled staging and pilot deployment.
Unexpected bugs or throughput degradation are contained within a small subset of non-essential devices.
Pilot deployment detects environmental anomalies that may not manifest in lab topology settings.
4
Roll out to production and audit systems.
The vulnerability is remediated across all core devices, and post-update operational baselines are verified.
Verification auditing ensures all target systems took the update properly and remain fully functional.

Key Concept

Network Patch Management Lifecycle and Change Management Governance
Question 7Question

A network administrator is configuring an extended IPv4 Access Control List (ACL) on a router interface to control traffic from the client workstation subnet (172.16.10.0/24172.16.10.0/24) targeting the corporate server farm subnet (10.5.0.0/2410.5.0.0/24). The security policy specifies the following requirements for traffic destined for the database server (10.5.0.2010.5.0.20) and the rest of the server farm:

1. SSH administrative access (TCP port 22) to host 10.5.0.2010.5.0.20 must be permitted ONLY from the primary administrator workstation at IP address 172.16.10.5172.16.10.5.
2. All other SSH traffic (TCP port 22) to host 10.5.0.2010.5.0.20 originating from subnet 172.16.10.0/24172.16.10.0/24 must be explicitly blocked.
3. All non-SSH TCP traffic from subnet 172.16.10.0/24172.16.10.0/24 to host 10.5.0.2010.5.0.20 must be permitted.
4. Non-TCP IP traffic from subnet 172.16.10.0/24172.16.10.0/24 to host 10.5.0.2010.5.0.20 must be blocked.
5. All IP traffic from subnet 172.16.10.0/24172.16.10.0/24 to all other servers in subnet 10.5.0.0/2410.5.0.0/24 must be permitted.

In what top-to-bottom sequential order must the ACL entries be placed on the interface to enforce this security policy without rule shadowing?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence from top to bottom is: permit SSH for host 172.16.10.5 -> deny SSH for subnet 172.16.10.0/24 -> permit all TCP for subnet 172.16.10.0/24 to host 10.5.0.20 -> deny all IP for subnet 172.16.10.0/24 to host 10.5.0.20 -> permit all IP for subnet 172.16.10.0/24 to subnet 10.5.0.0/24.
Extended Access Control Lists evaluate entries sequentially from top to bottom, stopping at the first match. To enforce granular control without rule shadowing, rules must be ordered from most specific to least specific: (1) Host-specific SSH permit for host 172.16.10.5, (2) Subnet-wide SSH deny for host 10.5.0.20, (3) Subnet-wide TCP permit for host 10.5.0.20, (4) Subnet-wide IP deny for host 10.5.0.20, and (5) Subnet-wide IP permit for the entire 10.5.0.0/24 destination network.

Step-by-Step Solution

1
Place the specific host SSH permit statement first.
access-list 102 permit tcp host 172.16.10.5 host 10.5.0.20 eq 22 is evaluated first.
ACLs process rules sequentially top-to-bottom. Placing host 172.16.10.5 first allows the administrator's workstation to connect over SSH before any broader deny rules take effect.
2
Place the subnet SSH deny statement second.
access-list 102 deny tcp 172.16.10.0 0.0.0.255 host 10.5.0.20 eq 22 is evaluated second.
Placing this rule immediately below the host SSH permit entry blocks SSH access for all other hosts in subnet 172.16.10.0/24 while preventing it from shadowing the permit entry above.
3
Place the general TCP permit statement for host 10.5.0.20 third.
access-list 102 permit tcp 172.16.10.0 0.0.0.255 host 10.5.0.20 is evaluated third.
Because SSH (port 22) has already been filtered by the top two rules, this rule permits all other TCP traffic (e.g., HTTP/HTTPS) to host 10.5.0.20. If placed above rule 2, it would incorrectly permit SSH for the entire subnet.
4
Place the full IP deny statement for host 10.5.0.20 fourth.
access-list 102 deny ip 172.16.10.0 0.0.0.255 host 10.5.0.20 is evaluated fourth.
This blocks all non-TCP IP traffic (such as ICMP or UDP) targeting host 10.5.0.20. Placing it below the TCP permit rule ensures TCP traffic to host 10.5.0.20 is allowed first.
5
Place the subnet-wide IP permit statement fifth.
access-list 102 permit ip 172.16.10.0 0.0.0.255 10.5.0.0 0.0.0.255 is evaluated fifth.
This allows traffic to all other servers in subnet 10.5.0.0/24. Placing it at the bottom prevents it from permitting unauthorized traffic to host 10.5.0.20.

Key Concept

ACL Rule Evaluation Order and Shadowing Prevention
Question 8Question

A network administrator needs to construct an IPv4 extended Access Control List (ACL) to filter traffic originating from the internal subnet 192.168.1.0/24192.168.1.0/24. The security policy requires the following requirements in order of processing:
1. Allow host 192.168.1.25192.168.1.25 to access web server 10.10.10.510.10.10.5 using secure HTTPS (port 443).
2. Block all other hosts on the 192.168.1.0/24192.168.1.0/24 subnet from reaching server 10.10.10.510.10.10.5.
3. Permit all remaining outbound traffic from subnet 192.168.1.0/24192.168.1.0/24 to any other destination.
4. Catch and drop all remaining unspecified IP traffic.

In what order should these ACL statements be evaluated from top to bottom to satisfy the security policy without shadowing any rules?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of ACL statements from top to bottom is: (1) permit tcp host 192.168.1.25 host 10.10.10.5 eq 443, (2) deny ip 192.168.1.0 0.0.0.255 host 10.10.10.5, (3) permit ip 192.168.1.0 0.0.0.255 any, and (4) deny ip any any.
Router Access Control Lists process entries sequentially from top to bottom and stop at the first matching rule. To ensure correct policy enforcement, rules must be arranged from most specific (individual host and port permissions) to most general (subnet permits and implicit deny statements). Placing the host-specific permit for TCP port 443 first allows host 192.168.1.25 to reach server 10.10.10.5. Placing the subnet deny rule second blocks all other hosts in 192.168.1.0/24 from reaching server 10.10.10.5. Placing the subnet permit rule third allows subnet 192.168.1.0/24 to reach all other destinations. Placing the deny-all rule last catches all non-matching traffic.

Step-by-Step Solution

1
Place the most specific host exception rule at the top of the list.
traffic matching host 192.168.1.25 destined for 10.10.10.5 on TCP port 443 is matched immediately and permitted.
ACLs process rules sequentially using a first-match mechanism. Host-specific rules must precede subnet-level rules to avoid being shadowed.
2
Place the specific subnet-to-server deny rule immediately after the host permit exception.
Any other packet originating from 192.168.1.0/24 heading to 10.10.10.5 is matched and denied.
This enforces the requirement to block the rest of the 192.168.1.0/24 subnet from reaching the server.
3
Place the general permit rule for subnet 192.168.1.0/24 after the server restriction.
Traffic from 192.168.1.0/24 aimed at destinations other than 10.10.10.5 is permitted.
Packets reaching this rule have already been checked against the server restriction rules, allowing normal outgoing network communication for the subnet.
4
Place the default deny statement at the bottom of the ACL.
Any packet not matching the 192.168.1.0/24 source criteria is explicitly dropped.
Ensures zero-trust security by dropping all unhandled packets at the end of the ACL processing sequence.

Key Concept

First-match sequential rule evaluation and rule shadowing prevention in Access Control Lists (ACLs)
Estimated Time:1m 0s
Question 9Question

A network administrator needs to apply a firmware update to several enterprise network switches following standard operational procedures. In which sequential order should the administrator perform the steps of the patch management lifecycle?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for the patch management lifecycle is: 1) Identify and download the patch from the official vendor portal, 2) Validate and test the patch in an isolated lab environment, 3) Submit a formal change request and obtain maintenance window authorization, 4) Deploy the patch to production network devices during the approved window, and 5) Perform post-deployment auditing and monitor system logs for anomalies.
The correct order follows the established patch management process: Acquisition -> Lab Testing -> Change Management Approval -> Production Deployment -> Post-deployment Audit.

Step-by-Step Solution

1
Identify patch availability and download official firmware.
Verified patch binary is obtained securely.
The patch lifecycle must begin by sourcing legitimate software directly from the manufacturer.
2
Perform lab testing in an isolated environment.
Firmware stability and feature compatibility are confirmed without risk to live operations.
Staging and testing prevent buggy updates from causing unexpected outages in production.
3
Initiate the change management approval process.
The maintenance window is authorized and stakeholders are notified.
Proper change control ensures operational visibility and aligns updates with organizational policies.
4
Execute the firmware installation on production hardware.
Switches are updated to the target software release.
Deployment must occur during the designated maintenance window to minimize business impact.
5
Conduct post-deployment auditing and log review.
Confirmation of normal network performance and absence of system errors.
Final auditing verifies that the patch resolved the intended issue without introducing new problems.

Key Concept

Patch Management Lifecycle
Question 10Question

A network technician needs to upgrade the firmware on a campus access switch following standard IT service management practices. In what chronological order should the technician execute the steps of the change management lifecycle from first to last?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with submitting the RFC, followed by securing CAB approval, deploying the update during the maintenance window, and concluding with a post-implementation review.
Standard change management follows a strict lifecycle: initiating an RFC with impact and rollback details, obtaining formal CAB authorization, implementing the change within an approved maintenance window, and concluding with a post-implementation review to verify success and document the updated baseline.

Step-by-Step Solution

1
Identify the initial administrative step required prior to review.
The RFC must be drafted and submitted first with risk assessments and rollback plans.
Governance frameworks require documented justification and safety plans before evaluating proposed modifications.
2
Determine the governing authorization step.
The CAB reviews the submitted RFC and grants authorization.
Stakeholders must evaluate potential operational impacts before scheduling the change.
3
Identify the execution phase.
The technician installs the firmware during the scheduled maintenance window.
Authorized changes are performed during pre-approved windows to avoid disrupting production traffic.
4
Identify the final closeout phase.
Perform a post-implementation review (PIR) and update documentation.
Final validation ensures objectives were met and administrative records remain accurate.

Key Concept

Standard Change Management Lifecycle
Question 11Question

A network engineer is analyzing the convergence behavior of a core enterprise router running Open Shortest Path First (OSPF). An active link on an adjacent network interface suddenly fails, triggering a topology update across the area. Place the operational steps in the correct sequential order from initial failure detection to final packet forwarding updates.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence for OSPF link-state convergence is: 1) Generate LSA upon failure detection, 2) Flood LSA to neighbors, 3) Update local LSDB with new information, 4) Run SPF algorithm on updated LSDB, and 5) Populate the IP routing table with recalculated optimal paths.
OSPF is a link-state routing protocol operating in distinct sequential phases during topology changes. When a link fails, the detecting router immediately originates a new Link-State Advertisement (LSA). This LSA is flooded out active interfaces to ensure area-wide synchronization. Upon receiving the LSA, neighboring routers insert it into their Link-State Database (LSDB). Once the LSDB reflects the true network state, each router executes Dijkstra's Shortest Path First (SPF) algorithm to calculate the new shortest path tree. Finally, the newly derived best paths are installed into the router's IP routing table for packet forwarding.

Step-by-Step Solution

1
Identify event detection and LSA origination
The local router detects physical/logical link failure and creates an updated LSA.
Routing convergence begins at the source router where the topology change occurs.
2
Identify LSA propagation
The originating router floods the LSA across the OSPF area using multicast.
Link-state protocols require all routers in an area to maintain identical database records.
3
Identify LSDB synchronization
Neighboring routers update their local LSDBs with the received LSA.
The database must reflect the updated network map before path selection can take place.
4
Identify path recalculation
Dijkstra's SPF algorithm computes shortest paths based on the new LSDB state.
SPF uses the synchronized topology map to find optimal cost paths to every destination subnet.
5
Identify Routing Information Base (RIB) modification
The router installs the newly derived shortest paths into the active IP routing table.
Packet forwarding decisions rely directly on the active routing table entries derived from SPF calculation.

Key Concept

OSPF Link-State Convergence and SPF Calculation Sequence
Estimated Time:2m 0s
Question 12Question

An enterprise border router maintains multiple dynamic routing protocols alongside static routes to reach remote subnets. When an incoming IPv4 packet arrives at an ingress interface, the router's decision process evaluates several criteria to select the winning route entry. In what sequential order does the router evaluate these routing criteria to select the path for packet forwarding?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of route selection evaluation is: 1) Filter for matching candidate routes, 2) Apply Longest Prefix Match, 3) Compare Administrative Distance for equal-length prefixes, and 4) Compare protocol metric values for ties within the same protocol.
Router decision engines process route selection in a strict hierarchy: First, candidate routes matching the destination IP are gathered. Next, Longest Prefix Match (LPM) selects the route with the most specific prefix length. If candidate routes have identical prefix lengths from different routing sources, Administrative Distance (AD) determines trustworthiness. Finally, if routes have equal prefix lengths and originate from the same routing protocol, the protocol's internal metric determines the best path.

Step-by-Step Solution

1
Identify matching destinations
Candidate routes matching the destination IP address are identified.
Routing decisions begin by checking which routing table entries match the target IP address.
2
Apply Longest Prefix Match (LPM)
The route with the longest subnet mask is prioritized.
LPM is the primary rule of IP routing; a more specific route (/28) always wins over a less specific route (/24).
3
Evaluate Administrative Distance (AD)
The route from the most trustworthy source is chosen if prefix lengths match.
If equal prefix lengths exist from different sources (e.g., OSPF AD 110 vs EIGRP AD 90), the lower AD wins.
4
Evaluate Protocol Metric
The path with the lowest metric cost is chosen if sources and prefix lengths are identical.
When competing routes come from the same protocol with the same prefix length, metric serves as the final tiebreaker.

Key Concept

Routing Table Selection Hierarchy (Longest Prefix Match -> Administrative Distance -> Metric)
Question 13Question

A network security analyst is monitoring how a workstation handles an incoming encrypted session response starting from raw physical signal reception up to payload presentation. Place the following decapsulation actions in the correct sequential order, from the initial action occurring at the lowest OSI layer to the final action occurring at the higher OSI layer.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of decapsulation processing from the lowest to highest OSI layer is: 1) Converting physical voltage signals on the media into a raw bitstream (Layer 1), 2) Verifying the target MAC address and validating the Frame Check Sequence (Layer 2), 3) Inspecting the destination IP address and evaluating header checksums (Layer 3), 4) Reassembling segment sequence numbers and mapping target port numbers to an active socket (Layer 4), and 5) Decrypting TLS payloads and formatting character encodings (Layer 6).
During decapsulation of an incoming transmission, data flows upward through the OSI model: Layer 1 (Physical) handles bit signal conversion; Layer 2 (Data Link) processes MAC addresses and checks the Frame Check Sequence; Layer 3 (Network) inspects logical IP addressing; Layer 4 (Transport) handles segment sequence numbers and port sockets; and Layer 6 (Presentation) decrypts TLS payloads and formats character syntax.

Step-by-Step Solution

1
Identify the OSI layer responsible for signal conversion and bit synchronization
Converting physical signals into raw binary bitstreams occurs at Layer 1 (Physical Layer). This must happen first upon signal reception.
Physical media signals must be synchronized into bits before any protocol data unit headers can be parsed.
2
Identify the OSI layer responsible for MAC addressing and CRC error detection
Verifying destination MAC addresses and checking the Frame Check Sequence (FCS) occurs at Layer 2 (Data Link Layer).
Frame headers encapsulate packet headers and are stripped at Layer 2 after error validation.
3
Identify the OSI layer responsible for IP address inspection and packet routing
Processing destination IP addresses and IP checksums occurs at Layer 3 (Network Layer).
Once the Ethernet frame header is stripped, the host inspects the underlying IP packet header.
4
Identify the OSI layer responsible for port numbers, TCP sequencing, and socket mapping
Reassembling segment numbers and assigning traffic to target application ports occurs at Layer 4 (Transport Layer).
Transport protocols (TCP/UDP) manage segment reassembly and process communication endpoints (ports).
5
Identify the OSI layer responsible for TLS decryption and character set formatting
Decrypting TLS payloads and formatting character syntax occurs at Layer 6 (Presentation Layer).
The Presentation Layer handles data formatting, syntax translation, and cryptographic operations before handing data to the application.

Key Concept

OSI Model Decapsulation Order and Layer Functions
Question 14Question

A network router has learned multiple routes to the same destination network from different routing sources. Arrange the following route sources in order of administrative distance priority, from the most trustworthy source (lowest administrative distance) to the least trustworthy source (highest administrative distance).

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order from most trustworthy (lowest AD) to least trustworthy (highest AD) is: Directly connected interface (AD 0), Static route (AD 1), OSPF dynamic route (AD 110), and RIP dynamic route (AD 120).
Administrative distance (AD) rates the trustworthiness of routing information received from different routing sources on a scale where lower values are preferred. Directly connected routes are most trusted (AD 0), followed by static routes (AD 1), OSPF dynamic routes (AD 110), and RIP dynamic routes (AD 120).

Step-by-Step Solution

1
Identify the Administrative Distance (AD) value for directly connected networks.
Directly connected interfaces have an AD of 0.
Direct connections represent local active hardware links and are the most reliable.
2
Identify the AD value for manually configured static routes.
Static routes have a default AD of 1.
Explicit administrative configuration takes precedence over all dynamic protocols.
3
Compare default AD values of dynamic interior gateway protocols.
OSPF has an AD of 110, whereas RIP has an AD of 120.
Lower numerical AD values indicate higher trustworthiness when selecting routes from different protocols.

Key Concept

Administrative Distance Priority in Route Selection
Estimated Time:45s
Question 15Question

An enterprise network utilizes a centralized DHCP server on a management subnet to serve clients across multiple remote VLANs. A host on VLAN 30 initiates dynamic address assignment via a Layer 3 relay switch configured with Option 82 agent information insertion. In what chronological sequence do the packet processing and forwarding steps occur during the initial address discovery phase?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence begins with the local client broadcasting a DHCPDISCOVER message on VLAN 30. Next, the Layer 3 relay agent intercepts the broadcast, appends Option 82 payload data, populates its own interface IP into the giaddr field, and forwards the packet via unicast UDP port 67 to the central server. The DHCP server inspects the giaddr value to allocate an available address from the VLAN 30 scope and sends a unicast DHCPOFFER back to the relay agent. Finally, the relay agent removes Option 82 header tags and forwards the DHCPOFFER to the client on VLAN 30.
The DHCP relay process begins with a local Layer 2 broadcast (DHCPDISCOVER). The relay agent converts this into a unicast frame augmented with Option 82 and giaddr IP information directed to the central DHCP server's UDP port 67. The central server uses the giaddr field to match the correct subnet pool and returns a unicast DHCPOFFER to the relay agent. The relay agent removes Option 82 tags and delivers the offer frame back to the local client.

Step-by-Step Solution

1
Client broadcast initiation
DHCPDISCOVER frame is transmitted onto the local Layer 2 broadcast domain.
Unconfigured hosts do not possess an IP address or knowledge of the server location, requiring a broadcast transmission.
2
Relay agent interception and encapsulation
The broadcast is converted to a unicast packet targeting the server on UDP port 67 with giaddr and Option 82 appended.
Routers drop Layer 2 broadcasts by default; the helper agent acts as a proxy to cross Layer 3 boundaries.
3
Server processing and unicast reply
DHCPOFFER packet is crafted and sent back to the giaddr IP of the relay agent.
The server uses giaddr to map the request to the matching IP pool subnet and relies on unicast routing back to the relay.
4
Relay agent decapsulation and local delivery
Option 82 data is stripped and the DHCPOFFER is delivered to the client on VLAN 30.
The client network card expects standard DHCP response formatting on its local segment.

Key Concept

DHCP Relay Agent and Option 82 Forwarding Sequence
Question 16Question

A network technician is systematically troubleshooting a connectivity failure from a client workstation to a remote application server. Place the following command-line utilities in the logical order they should be executed to isolate the issue from local interface settings out to remote route reachability.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct logical order begins with checking local IP settings using `ipconfig`, verifying local gateway reachability using `ping`, tracing the remote path using `tracert`, and verifying DNS resolution using `nslookup`.
Standard network troubleshooting follows a logical sequence from local host configuration (`ipconfig`), to local subnet reachability (`ping`), to multi-hop path analysis (`tracert`), and finally upper-layer services like DNS resolution (`nslookup`).

Step-by-Step Solution

1
Check local host IP assignment.
Confirms the host has a valid IP configuration and default gateway.
Local IP misconfigurations render all outbound network diagnostics invalid.
2
Test local gateway ICMP reachability.
Confirms local Layer 2 and Layer 3 communication to the router.
Traffic cannot reach remote networks if the local gateway cannot be reached.
3
Trace path across intermediate network hops.
Identifies packet loss or latency across remote routers.
Helps distinguish between local network issues and upstream routing failures.
4
Verify DNS name resolution.
Confirms the DNS server resolves the FQDN to the correct destination IP address.
Ensures application accessibility issues are not caused by name resolution errors.

Key Concept

Structured Command-Line Diagnostic Sequence
Question 17Question

Users on a remote office subnet (10.240.12.0/2410.240.12.0/24) report that they cannot access a cloud database hosted at 172.16.50.100172.16.50.100. Follow the standard CompTIA network troubleshooting methodology to arrange the administrative actions into the correct logical sequence from first step to last step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows the standard troubleshooting methodology: first gather information from users and host settings, second test a theory using diagnostic tools like traceroute and inspecting ACL configuration, third implement the corrective ACL rule change, fourth verify full database connectivity from the client workstation, and finally document the findings and actions taken.
The standard CompTIA network troubleshooting sequence requires progressing linearly through: 1) Identify the problem / gather information, 2) Establish and test a theory of probable cause, 3) Plan and implement the solution, 4) Verify full system functionality, and 5) Document findings, actions, and outcomes.

Step-by-Step Solution

1
Gather symptoms and user reports.
Establishes a baseline understanding of host configuration and specific error behavior without altering the network state.
CompTIA troubleshooting methodology requires identifying the problem first.
2
Perform diagnostics using traceroute and ACL inspection.
Confirms whether traffic reaches the gateway and if an implicit deny ACL statement is dropping the database packets.
Testing the theory isolates the exact point of failure between routing and gateway security filtering.
3
Implement the configuration fix on the gateway/router ACL.
Permits host traffic to traverse the router outbound toward the destination address.
Changes to network configuration should only occur after a theory of probable cause has been confirmed.
4
Verify database connectivity from the client host.
Ensures the application functions correctly and no unintended blocking remains.
Verification confirms that the problem is completely resolved before closing the incident.
5
Record changes and resolution details in technical documentation.
Creates a historical audit trail for future troubleshooting and configuration tracking.
Documentation is the mandatory final step of structured network troubleshooting.

Key Concept

CompTIA Network Troubleshooting Methodology applied to Gateway ACL issues
Question 18Question

A workstation on a remote VLAN requires an IP address assignment from a central DHCP server located on a different subnet across a Layer 3 router. What is the correct sequence of packet delivery steps during the discovery and offering stage of this relayed DHCP request?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The sequence begins when the client broadcasts a DHCPDISCOVER packet on its local subnet. The DHCP relay agent receives this broadcast, inserts its own interface address as the gateway IP (giaddr), and forwards the packet as a unicast message to the central DHCP server. The DHCP server matches the giaddr to the appropriate IP scope and returns a unicast DHCPOFFER packet to the relay agent. Finally, the relay agent forwards the DHCPOFFER packet to the local subnet for the client host.
In a cross-subnet DHCP environment, the host initiates the process by broadcasting a DHCPDISCOVER packet locally. The relay agent on the router interface receives this broadcast, populates the giaddr header field with its interface IP, and forwards the packet as a unicast message to the central DHCP server. The server reads the giaddr, allocates an IP from the corresponding scope, and returns a unicast DHCPOFFER packet to the relay agent. The relay agent then forwards the DHCPOFFER message onto the host's subnet.

Step-by-Step Solution

1
Identify the initial client request broadcast.
The unconfigured host initiates communication by broadcasting a DHCPDISCOVER message within its local broadcast domain.
Clients lacking IP configurations rely on local broadcast packets to reach DHCP listening services.
2
Determine how the relay agent processes the broadcast request.
The configured router interface intercepts the broadcast, inserts its interface IP into the giaddr field, and sends a unicast DHCPDISCOVER packet to the remote server IP.
Routers block standard broadcast packets by default; the relay agent encapsulation enables cross-subnet transmission.
3
Trace the server response mechanism back to the relay agent.
The DHCP server identifies the subnet pool via the giaddr header and responds with a unicast DHCPOFFER packet addressed to the relay agent.
The server cannot reply directly to the unconfigured client's unrouted IP, so it targets the reachable relay agent interface.
4
Trace the final delivery to the client.
The relay agent forwards the DHCPOFFER packet onto the client's local subnet segment.
This completes the delivery of offered lease details to the requesting workstation host.

Key Concept

DHCP Relay Agent Packet Processing and Relay Sequence
Question 19Question

A network security appliance running a Syslog service generates an alert log message that must be sent to a remote monitoring server over UDP port 514. In what chronological order does the local host network stack encapsulate the log data from creation to transmission onto the wire?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order of encapsulation begins with Application payload creation, followed by Transport layer UDP datagram encapsulation, Network layer IP packet creation, Data Link layer Ethernet framing with MAC addresses and FCS, and finally Physical layer bit conversion to electrical signals.
Outbound encapsulation follows the OSI model from top to bottom (Layer 7 down to Layer 1). The process begins when the Syslog process creates the application payload. Next, the Transport layer adds UDP port headers to create a datagram. Then, the Network layer appends IP addresses to form a packet. After that, the Data Link layer appends MAC addresses and an FCS trailer to construct an Ethernet frame. Finally, the Physical layer encodes the frame into physical signals to send across the network wire.

Step-by-Step Solution

1
Identify the top-layer application data creation.
The Syslog service generates the raw application data.
Encapsulation starts at the top of the OSI stack (Application layer) when user or system data is created.
2
Encapsulate at Layer 4 (Transport).
UDP headers (source and destination ports) are added to form a datagram.
The transport layer provides process-to-process addressing using port numbers.
3
Encapsulate at Layer 3 (Network).
IP headers (source and destination IP addresses) are added to form a packet.
The network layer handles logical network routing and IP addressing across subnets.
4
Encapsulate at Layer 2 (Data Link).
Ethernet header (MAC addresses) and trailer (FCS) are added to form a frame.
The data link layer provides hop-by-hop physical addressing and error detection.
5
Transmit at Layer 1 (Physical).
The binary frame is converted into electrical signals for transmission.
The physical layer transmits raw bitstreams across the physical copper cabling medium.

Key Concept

Top-down OSI model outbound data encapsulation sequence (Data -> Datagram/Segment -> Packet -> Frame -> Bits).
Question 20Question

A client workstation on VLAN 30 (10.30.0.0/2410.30.0.0/24) boots up and requires an IP address assignment from a centralized DHCP server (192.168.100.10192.168.100.10) located across a routed core network. The local Layer 3 switch interface serving VLAN 30 (10.30.0.110.30.0.1) is configured with a DHCP relay service (`ip helper-address 192.168.100.10`). Arrange the following steps in the correct chronological sequence representing the packet processing flow from the client's initial broadcast request through the relay agent's delivery of the DHCP Offer back to the host subnet.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct chronological sequence is: 1) Host workstation broadcasts DHCPDISCOVER on VLAN 30. 2) Relay agent populates giaddr with 10.30.0.1 and unicasts request to server 192.168.100.10. 3) Server evaluates giaddr, allocates IP from 10.30.0.0/24 scope, and unicasts DHCPOFFER to 10.30.0.1. 4) Relay agent receives reply and delivers DHCPOFFER onto VLAN 30 to port 68.
The sequence follows the standardized DHCP relay mechanism. First, the unconfigured client broadcasts a DHCPDISCOVER on UDP port 67 within its local VLAN. Second, the Layer 3 switch acting as the relay agent intercepts the broadcast, inserts its ingress interface IP address (10.30.0.1) into the giaddr header field, and unicasts the packet to the central DHCP server IP address (192.168.100.10) on UDP port 67. Third, the central server uses the giaddr field to identify that the client resides on the 10.30.0.0/24 subnet, picks an available IP address from that pool, and responds with a unicast DHCPOFFER directed back to the relay agent's interface IP (10.30.0.1). Finally, the relay agent receives the offer, strips any relay-specific options, and transmits the DHCPOFFER to the host on VLAN 30 on UDP port 68.

Step-by-Step Solution

1
Identify client initiation step
The host generates a local broadcast DHCPDISCOVER frame (0.0.0.0:68 -> 255.255.255.255:67) because it lacks an IP configuration.
DHCP clients start the DORA process by broadcasting to discover local or relayed DHCP services.
2
Analyze Relay Agent modification and forwarding
The L3 switch interface (10.30.0.1) receives the broadcast, inserts 10.30.0.1 into the giaddr header field, and converts the packet into a unicast frame sent to 192.168.100.10 on UDP port 67.
Routers drop limited broadcasts by default; relay agents bridge subnet boundaries by converting broadcasts to targeted unicasts with source subnetwork metadata (giaddr).
3
Determine server scope selection and response
The central server inspects giaddr (10.30.0.1), matches it to the 10.30.0.0/24 IP pool, and sends a unicast DHCPOFFER back to 10.30.0.1:67.
DHCP servers determine which address pool to lease from by examining the relay agent's giaddr field rather than the IP source header of the relay router.
4
Trace client-side delivery of the offer
The relay agent receives DHCPOFFER on UDP 67, references the client MAC (chaddr), and sends the DHCPOFFER onto VLAN 30 targeting UDP port 68.
The relay agent completes the return leg by delivering the server's offer back to the client's broadcast domain.

Key Concept

DHCP Relay Architecture and GIADDR Subnet Identification
Page 1 / 11Next
All practice questions — CompTIA Network+ | Examkin