Network Operations

362 questions

Question 181Question

A network technician is establishing standard configuration baseline documentation for newly installed branch switches. Which of the following elements should be included as key components of an enterprise configuration baseline? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The approved operating system software version and standardized management security settings.; The hardware inventory details, including device model numbers, serial numbers, and MAC addresses.

Answer

The correct elements to include in a configuration baseline are the approved operating system software version with standardized management security settings, and the hardware inventory details including device model numbers, serial numbers, and MAC addresses.
A configuration baseline serves as the official reference point for network devices. It contains verified device inventory data (such as serial numbers and MAC addresses) and approved software configurations (such as firmware build numbers, management access controls, and default port settings). This allows administrators to audit devices for unauthorized drift and swiftly restore devices to a known good state.

Step-by-Step Solution

1
Identify the purpose of a network configuration baseline
Recognize that a baseline captures the known, tested, and approved initial operating state of network hardware and software.
Establishing a baseline allows network administrators to detect unauthorized configuration drift and maintain standardization.
2
Evaluate the choices for valid configuration baseline components
Select the OS software version, security settings, and hardware inventory details.
These details define the physical and logical configuration standard required for operational consistency and inventory audits.

Key Concept

Configuration Baseline Documentation
Estimated Time:1m 0s
Question 182Question

An enterprise network engineer is designing a comprehensive network performance monitoring architecture. Match each telemetry protocol or monitoring technique on the left with its appropriate operational deployment objective on the right.

Click a left item, then click its matching right item

Items

sFlow packet sampling telemetry
IPFIX (IP Flow Information Export) flow records
SNMPv3 with authPriv security level
TWAMP (Two-Way Active Measurement Protocol) probing

Matches

Show answer & explanation

Answer

sFlow packet sampling matches hardware ASIC-driven statistical sampling; IPFIX flow records match aggregating stateful flow statistics for top-talkers; SNMPv3 with authPriv matches querying device MIB objects with HMAC authentication and AES encryption; TWAMP probing matches measuring precise two-way latency, loss, and jitter across real-time paths.
sFlow relies on hardware ASIC packet sampling (stateless) across high-port-density devices. IPFIX aggregates flow records to provide stateful conversation telemetry. SNMPv3 with authPriv provides authenticating and encrypting capabilities (HMAC and AES) for polling switch and router MIB counter metrics. TWAMP actively generates timestamped test frames between devices to measure round-trip delay, jitter, and loss accurately.

Step-by-Step Solution

1
Analyze the sampling mechanism and state requirements of switch monitoring technologies.
Identify sFlow as a hardware-based, stateless packet-sampling mechanism suitable for high-density switches, matching right_1.
Unlike flow-based telemetry, sFlow samples 1-out-of-N packets at the ASIC layer without maintaining active flow tables.
2
Evaluate flow aggregation standards for traffic profile and top-talker tracking.
Identify IPFIX as an open IETF standard for template-based flow export to analyze Layer 4 conversations, matching right_2.
Flow technologies track active connections by key tuple fields (IP addresses, ports, protocol) to summarize bandwidth allocation.
3
Examine device management protocol security parameters.
Identify SNMPv3 authPriv as the configuration providing both cryptographic authentication and packet payload encryption, matching right_3.
The authPriv security model in SNMPv3 User-based Security Model (USM) enforces SHA/MD5 digest validation along with AES encryption for MIB object polling.
4
Differentiate active synthetic probes from passive telemetry collector mechanisms.
Identify TWAMP as an active measurement protocol tailored for real-time SLA parameters such as jitter and delay, matching right_4.
Active synthetic probing generates timed timestamped test packets to compute microsecond-level latency and jitter metrics across a path.

Key Concept

Network Performance Telemetry Protocols and Monitoring Methodologies
Question 183Question

A network infrastructure team is preparing a complex change to transition an enterprise data center's core routing infrastructure from a static routing model to an internal BGP (iBGP) topology. The proposed configuration updates have already been tested in a isolated sandbox environment and reviewed by the Change Advisory Board (CAB). Which of the following components must be formally documented within the final Request for Change (RFC) before the maintenance window is approved for execution?

Show answer & explanation

Answer: Specific criteria defining unacceptable performance impact alongside a pre-tested rollback plan and explicit rollback execution triggers

Answer

Specific criteria defining unacceptable performance impact alongside a pre-tested rollback plan and explicit rollback execution triggers
A comprehensive Request for Change (RFC) must specify explicit, measurable triggers for failure (such as convergence timeouts or packet loss thresholds) along with a fully documented and tested rollback plan. This ensures that if unforeseen issues occur in production, the team can quickly restore the network to its verified baseline state before the maintenance window expires.

Step-by-Step Solution

1
Analyze the change management lifecycle requirements for a high-risk enterprise network deployment.
Identified that even after sandbox validation and CAB review, an RFC requires explicit risk mitigation mechanisms.
Enterprise change control requires a documented and validated mechanism to revert changes if production behavior deviates from lab tests.
2
Evaluate the essential elements of an RFC document prior to maintenance window execution.
Determined that clear rollback triggers, threshold metrics, and step-by-step restoration procedures are mandatory components.
Without clear triggers and tested back-out plans, engineers risk extending downtime while attempting ad-hoc troubleshooting during maintenance.

Key Concept

Request for Change (RFC) Mandatory Rollback Plan and Execution Triggers
Question 184Question

Prior to performing a major routing protocol modification on an enterprise core network, an engineer must submit documentation detailing how to undo the modifications should performance degrade. Which of the following change management elements fulfills this requirement?

Show answer & explanation

Answer: A rollback plan outlining explicit trigger conditions and step-by-step restoration procedures

Answer

A rollback plan outlining explicit trigger conditions and step-by-step restoration procedures
A rollback plan is an essential component of change management documentation. It explicitly details the steps, commands, resources, and decision thresholds required to safely restore a network device or service to its previous stable configuration if a change fails or destabilizes the environment.

Step-by-Step Solution

1
Identify the core objective of the required change management documentation.
The requirement is to specify how to revert modifications if performance degrades after implementation.
Risk management policies require explicit backout plans before executing production configuration changes.
2
Evaluate the documentation types against the defined requirement.
A rollback plan directly details the criteria, commands, and sequence needed to return to the baseline configuration.
Rollback plans safeguard network operations by ensuring immediate recovery paths during failed implementations.

Key Concept

Rollback Plan in Change Management
Question 185Question

A network administrator is troubleshooting intermittent quality degradation during corporate video conference calls across a site-to-site WAN link. While aggregate interface bandwidth utilization remains below capacity, users report packet arrival time variation (jitter) and video freezing. The administrator needs to analyze flow-level conversation statistics—specifically tracking source/destination IP addresses, port numbers, and byte counts—to pinpoint non-business application traffic consuming link resources. Which telemetry protocol and transport method should be implemented on the WAN edge router to export these flow statistics?

Show answer & explanation

Answer: IPFIX exporting flow records over UDP to a network telemetry collector

Answer

IPFIX exporting flow records over UDP to a network telemetry collector
IPFIX (IP Flow Information Export) is specifically designed to aggregate and export 5-tuple flow metadata (source IP, destination IP, source port, destination port, protocol) to identify top talkers and bandwidth-consuming applications. Exporting IPFIX flow records over UDP reduces router memory and processing overhead under heavy network traffic.

Step-by-Step Solution

1
Identify the monitoring requirement based on the scenario symptoms.
The scenario requires analyzing flow-level metadata (5-tuple conversation data including source/destination IP, ports, and traffic volume) rather than simple interface-level bandwidth or system event logs.
Interface counters (like those retrieved via standard SNMP polling) show total throughput but cannot differentiate individual application flows causing latency or jitter.
2
Select the appropriate telemetry protocol for flow data export.
IPFIX (IP Flow Information Export) or NetFlow is the industry-standard protocol for generating and exporting flow records.
IPFIX defines template-based record formats containing flow metadata suited for traffic analysis and top-talker identification.
3
Determine the correct transport protocol and configuration.
IPFIX uses UDP to push flow packets to a telemetry collector.
UDP minimizes router CPU overhead and memory state tracking compared to connection-oriented TCP, making it optimal for continuous telemetry streaming.

Key Concept

Flow-Based Telemetry and Metric Collection (IPFIX vs SNMP vs Syslog)
Estimated Time:2m 0s
Question 186Question

A network engineering team is drafting a Request for Change (RFC) to deploy automated configuration management scripts across enterprise cloud interconnect routers. Which TWO of the following operational elements must be formally documented within the RFC prior to submitting it to the Change Advisory Board (CAB) for approval?

Select all that apply

Show answer & explanation

Answer: A detailed risk assessment and impact analysis identifying business dependencies and potential service disruptions during execution.; A comprehensive backout plan detailing specific rollback steps and quantifiable metric thresholds that trigger execution if testing fails.

Answer

The correct elements required in the RFC are a comprehensive risk assessment/impact analysis and a detailed backout plan with predefined rollback triggers.
A formal Request for Change (RFC) submitted to a Change Advisory Board (CAB) must include a thorough risk assessment and impact analysis to quantify potential business disruptions, as well as a rollback plan with explicit metric thresholds defining when to abort and revert the deployment. These components ensure organizational oversight and risk mitigation before production execution.

Step-by-Step Solution

1
Analyze the mandatory components of an enterprise Request for Change (RFC) intended for Change Advisory Board (CAB) evaluation.
Identified that RFCs require risk identification, impact scope, scheduled maintenance windows, sandbox validation, and rollback strategies.
CAB approval relies on understanding business risks and operational recovery procedures before authorizing changes to production systems.
2
Evaluate the risk mitigation and rollback strategy requirement.
Determined that defining specific impact metrics and rollback trigger points ensures clear decision-making during maintenance windows.
Without predefined threshold triggers, engineers might delay rolling back a failed deployment, worsening downtime.
3
Identify operational flaws in distractor options.
Recognized that testing directly in production violates troubleshooting and change management sequencing, and restoring incremental backups out of sequence creates configuration corruption.
Production testing introduces unapproved risk, and incremental restoration requires full baseline restoration first.

Key Concept

RFC Documentation and CAB Approval Requirements
Question 187Question

Match each network performance metric with the operational measurement or network condition it directly quantifies.

Click a left item, then click its matching right item

Items

Latency
Jitter
Throughput
Packet Loss

Matches

Show answer & explanation

Answer

Latency matches total delay time; Jitter matches variation in delay; Throughput matches actual successful data delivery rate; Packet Loss matches percentage of dropped packets.
Each network metric correctly corresponds to its standardized performance monitoring definition: Latency measures overall transit time delay, Jitter measures the variance in packet arrival intervals, Throughput measures actual data payload delivery rates, and Packet Loss measures unreceived data transmission percentages.

Step-by-Step Solution

1
Define fundamental network performance monitoring metrics.
Latency reflects time delay, Jitter reflects variation in delay, Throughput reflects actual transfer speed, and Packet Loss reflects undelivered data.
Correctly identifying metric definitions allows network operators to isolate specific causes of network performance degradation.

Key Concept

Core Network Performance Metrics
Question 188Question

An enterprise network engineer is configuring centralized event logging for perimeter switches sending data across a WAN connection. Security policy mandates that log messages must be delivered reliably to ensure no log loss during link congestion and that all log payloads must be cryptographically encrypted in transit. Which of the following transport protocols and port configurations best meets these compliance requirements?

Show answer & explanation

Answer: Syslog over TCP port 6514 using TLS encryption

Answer

Syslog over TCP port 6514 using TLS encryption best meets the requirements for reliable delivery and transport-layer confidentiality.
The configuration specifying Syslog over TCP port 6514 using TLS encryption provides connection-oriented reliability via TCP, ensuring lost packets are retransmitted during congestion, while RFC 5425 specifies TCP port 6514 as the standard port for TLS-encrypted Syslog payload transport.

Step-by-Step Solution

1
Identify the transport reliability requirement.
TCP must be selected over UDP to guarantee delivery and retransmission during network congestion.
UDP is connectionless and cannot detect or retransmit dropped log packets over a WAN.
2
Identify the cryptographic security requirement.
TLS-encrypted Syslog (RFC 5425) must be used instead of cleartext protocols.
Plaintext Syslog exposes event data to interception on untrusted transit networks.
3
Determine the standard network port assigned for secure Syslog transport.
TCP port 6514 is the standard IANA-assigned port for Syslog over TLS.
Standard unencrypted Syslog uses port 514 (UDP/TCP), whereas TLS-wrapped Syslog defaults to TCP port 6514.

Key Concept

Centralized Network Log Security and Transport Protocols
Question 189Question

To address an active security advisory affecting perimeter routing hardware, an engineer is tasked with implementing an urgent software patch. Before committing the patch package to primary operational equipment, which set of procedures best ensures network stability and recovery capability in accordance with standard maintenance practices?

Show answer & explanation

Answer: Validate the cryptographic hash of the patch package, take a complete configuration and software image backup, and test the update within a staging environment.

Answer

Validate the cryptographic hash of the patch package, take a complete configuration and software image backup, and test the update within a staging environment.
Verifying the file hash guarantees file integrity. Creating a full configuration and image backup provides a verified recovery path, and executing lab testing ensures stability prior to live deployment.

Step-by-Step Solution

1
Verify patch integrity
Ensures the downloaded update file is authentic and uncorrupted.
Prevents installing damaged or malicious software images.
2
Create pre-patch backup baseline
Generates a full configuration and OS image backup.
Provides a reliable rollback point if the patch causes unexpected failure.
3
Validate in lab/staging
Identifies potential bugs or protocol incompatibilities in a non-production setting.
Reduces risk of network downtime during production deployment.

Key Concept

Pre-deployment validation, baseline backup creation, and staging in patch management lifecycles.
Question 190Question

A network engineer is configuring a pair of redundant Layer 3 switches using Virtual Router Redundancy Protocol (VRRP) to provide default gateway high availability for an enterprise VLAN. The design requires that traffic automatically reroutes to the backup switch if the primary switch loses its connection to the core network, and that the primary switch resumes gateway duties once the core link is restored. Which TWO configuration settings must be implemented on the primary switch to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Interface tracking on the upstream link to decrement the primary router's VRRP priority upon link failure; Preemption mode enabled on the primary router to reclaim the VRRP master role after recovery

Answer

The correct implementation requires enabling interface tracking on the upstream link to lower priority during outages, and enabling preemption mode on the primary router so it reclaims the master role upon restoration.
Enabling interface tracking allows VRRP to monitor critical non-VRRP interfaces (such as WAN or core uplinks) and decrement the primary router's priority score if that link fails, prompting the backup router to take over. Enabling preemption ensures that when the tracked uplink recovers and the primary router's priority returns to normal, it reclaims the master gateway role from the backup router.

Step-by-Step Solution

1
Analyze upstream link failure detection requirements.
Dynamic priority adjustment via interface tracking is needed so the backup router's static priority becomes higher when the primary's core link fails.
Without tracking, VRRP only detects local interface outages on the VRRP-enabled segment, not loss of upstream connectivity.
2
Analyze role restoration requirements upon link recovery.
Preemption mode must be active on the primary router.
Preemption ensures that once the tracked interface comes back up and the primary router's priority is restored to its higher value, it actively takes over the master state from the backup router.

Key Concept

First Hop Redundancy Protocol (FHRP) Interface Tracking and Preemption Mechanisms
Question 191Question

A network administrator is tasked with setting up a high-performance network monitoring solution for an enterprise core switch. The monitoring system must collect flow-level traffic statistics to analyze bandwidth utilization by application, while also enabling secure management polling and alerting without exposing telemetry data or authentication credentials to eavesdropping on the management network. Which of the following protocol configurations and telemetry methods should the administrator implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Implement IPFIX/NetFlow with flow sampling on interface ports to export application traffic statistics to a flow collector.; Configure SNMPv3 with the authPriv security level on core switches for encrypted metric polling and event notifications.

Answer

The network administrator should implement IPFIX/NetFlow flow sampling for application traffic statistics and deploy SNMPv3 configured with the authPriv security level to ensure encrypted metric polling and traps.
The combination of IPFIX/NetFlow and SNMPv3 with authPriv addresses both core monitoring requirements. IPFIX/NetFlow aggregates connection metadata to measure bandwidth and application traffic distribution effectively. SNMPv3 with authPriv adds cryptographic authentication and encryption to management polling and traps, protecting performance data from eavesdropping.

Step-by-Step Solution

1
Analyze requirement 1: Gathering flow-level application traffic and bandwidth utilization statistics.
Identify that NetFlow or IPFIX (IP Flow Information Export) is designed specifically for flow-level data collection and traffic analysis.
Flow technologies track metadata such as source/destination IP, port, and byte counts per flow without requiring full packet capture overhead.
2
Analyze requirement 2: Secure telemetry polling and alerting against eavesdropping.
Identify SNMPv3 with authPriv security level as the standard for authenticated and encrypted network device management.
SNMPv3 authPriv ensures both user authentication (auth) and payload encryption (priv), preventing unauthorized viewing or modification of management traffic.
3
Evaluate wrong alternatives against network protocols and security models.
Reject SNMPv2c due to plain-text community string vulnerability and reject Syslog over port 23 for flow metric analysis.
SNMPv2c lacks encryption, and Syslog is intended for logging text alerts, not streaming raw packet headers or high-frequency performance metrics.

Key Concept

Network Telemetry, Flow Export Protocols, and SNMPv3 Security Levels
Question 192Question

An enterprise organization plans to modify the BGP configuration across its global WAN edge routers to convert a full-mesh IBGP topology into a route reflector architecture. During the formal Change Advisory Board (CAB) review, the network lead submits a Request for Change (RFC) containing maintenance window schedules, sandbox testing logs, and step-by-step implementation scripts. However, the CAB refuses approval, noting that the document fails to define measurable criteria for identifying an unsuccessful deployment or explicit instructions for returning the network to a functional baseline if unpredicted routing loops occur. Which of the following elements must be added to the RFC to satisfy the CAB requirement for change authorization?

Show answer & explanation

Answer: A detailed rollback plan specifying explicit technical thresholds and triggers for aborting the implementation and restoring previous configuration states

Answer

A detailed rollback plan specifying explicit technical thresholds and triggers for aborting the implementation and restoring previous configuration states must be added to the RFC.
The correct answer identifies the missing rollback (backout) plan, which must detail the exact sequence of commands to revert configuration changes as well as predefined, measurable metrics (such as routing table instability, latency spikes, or packet loss thresholds) that mandate aborting the deployment.

Step-by-Step Solution

1
Analyze the CAB's objection in the scenario.
Identified that the RFC lacks defined failure conditions, quantitative rollback triggers, and specific steps to revert to the baseline state.
CAB approval requires risk mitigation documentation explaining how and when a change will be backed out if it causes network instability.
2
Evaluate standard Request for Change (RFC) mandatory components for enterprise network changes.
A rollback (backout) plan with explicit trigger metrics is required before high-risk routing topology changes are authorized.
Without predefined threshold triggers (e.g., packet loss exceeding 1%, BGP convergence timeout), maintenance teams may delay backing out, prolonging outages.
3
Select the option that directly addresses the missing RFC requirement.
The requirement for explicit technical thresholds and backout instructions directly matches the CAB's demand.
This provides a clear operational safety net for the maintenance window.

Key Concept

Rollback Plan and Trigger Criteria in Change Management
Estimated Time:2m 0s
Question 193Question

A senior infrastructure engineer is defining the emergency recovery protocol for an enterprise network orchestrator host. The host's backup policy mandates a full system backup executed every Sunday at 01:00, daily incremental backups created Monday through Friday at 22:00, and hourly configuration state exports taken at the top of every hour. An unrecoverable storage array crash corrupts the primary orchestrator host on Thursday at 14:15. Which of the following backup restoration sequences must be executed to restore the orchestrator to its most recent operational state prior to the failure while preserving data integrity?

Show answer & explanation

Answer: Restore the Sunday full backup, sequentially restore the Monday, Tuesday, and Wednesday incremental backups, and then apply all hourly state exports captured on Thursday up to 14:00.

Answer

The correct restoration sequence requires restoring the Sunday full backup, followed sequentially by the Monday, Tuesday, and Wednesday incremental backups, and finally applying all hourly state exports recorded on Thursday prior to the outage at 14:15.
An incremental backup set records only the data modified since the previous backup event (whether full or incremental). To achieve a complete point-in-time recovery, the administrator must first restore the baseline full backup (Sunday), followed by each daily incremental backup in chronological order (Monday, Tuesday, Wednesday), and finally apply point-in-time state exports (Thursday hourly exports up to 14:00).

Step-by-Step Solution

1
Identify the backup strategy type and baseline.
The backup baseline is the Sunday 01:00 full system backup.
All recovery procedures using full and incremental media must start with the most recent full system backup.
2
Determine the required incremental backup media sequence.
Incremental backups capture changes relative to the preceding backup (full or incremental). Therefore, Monday, Tuesday, and Wednesday incrementals must be restored sequentially.
Unlike differential backups (which accumulate changes since the full backup), incremental backups only contain changes since the immediately preceding incremental backup.
3
Identify point-in-time state exports up to the failure time.
Apply all hourly configuration exports from Thursday (01:00 through 14:00).
The failure occurred at 14:15, so the 14:00 export is the last valid point-in-time state snapshot prior to the crash.

Key Concept

Incremental Backup Recovery Chain
Question 194Question

An organization is deploying an edge computing cabinet at a remote manufacturing facility that frequently experiences complete primary ISP fiber outages. The network operations team must maintain secure command-line access to core switches for initial boot troubleshooting and possess the ability to hard-reboot frozen hardware remotely without relying on local site staff or the primary WAN link. Which of the following solutions best satisfies both the out-of-band reachability and remote power management requirements?

Show answer & explanation

Answer: Deploying a serial console server connected to the network devices' console ports and paired with an external cellular modem, along with a switched Power Distribution Unit (PDU) managed securely via SSH.

Answer

Deploying a serial console server connected to the network devices' console ports paired with a cellular modem and a switched Power Distribution Unit (PDU) managed via SSH.
The combination of a cellular modem and serial console server creates a dedicated Out-of-Band (OOB) channel independent of the primary ISP link. Coupling this with a switched Power Distribution Unit (PDU) controllable via encrypted SSH enables network administrators to interact with bare-metal console interfaces and execute hard power cycles on unresponsive network hardware during link failures.

Step-by-Step Solution

1
Identify the primary operational constraint.
The remote site suffers complete primary WAN (fiber) outages and potential OS freezes on network devices.
In-band management paths (such as standard WAN/VLAN IP paths) become unreachable whenever the primary network link or OS network stack goes down.
2
Determine the required Out-of-Band (OOB) architecture.
An independent communication path such as a cellular modem connected to a serial console/terminal server is required.
A console server provides low-level direct serial access to hardware command-line interfaces regardless of network protocol state.
3
Determine the power management mechanism.
A switched Power Distribution Unit (PDU) allows individual power outlets to be rebooted remotely via secure CLI (SSH) or management interfaces.
When a network device experiences a total system lockup, a hard power cycle via a switched PDU is the only remote remediation method.

Key Concept

Out-of-Band (OOB) Management and Remote Infrastructure Control
Question 195Question

A network administrator configures a pair of core routers using a First Hop Redundancy Protocol (FHRP) to provide seamless default gateway redundancy for a corporate subnet. During a scheduled maintenance test, the primary router is powered off. Although the secondary router successfully transitions to the active state and assumes ownership of the virtual IP and virtual MAC addresses, workstations on the subnet immediately lose outbound network access. Upon auditing host network configurations, the administrator notices that all affected workstations were statically configured. Which of the following is the most likely cause of the connectivity failure during failover?

Show answer & explanation

Answer: The workstations were configured with the physical IP address of the primary router as their default gateway instead of the FHRP virtual IP address.

Answer

The workstations were configured with the physical IP address of the primary router as their default gateway instead of the FHRP virtual IP address.
First Hop Redundancy Protocols rely on clients directing traffic to a shared Virtual IP (VIP) address. When host devices are incorrectly configured with the primary router's unique physical interface IP address as their default gateway, their traffic bypasses the FHRP virtual abstraction. Consequently, when the primary device fails, client traffic continues sending packets to the dead physical IP, causing complete outbound loss despite the standby router taking over the active virtual role.

Step-by-Step Solution

1
Analyze the FHRP deployment model and operational mechanics.
FHRP protocols (such as HSRP, VRRP, or CARP) create a single Virtual IP (VIP) and Virtual MAC address shared between redundant routers.
Host endpoints must direct their default gateway traffic to the shared Virtual IP so that failover events are transparent to clients.
2
Evaluate host configuration symptoms against the router state changes.
The secondary router successfully assumed the active role and took over the VIP, yet host connectivity failed.
Because the secondary router took over the VIP properly, any client configured with the VIP would retain outbound access. Clients failing to connect must be targeting a static destination that did not migrate.
3
Identify the root cause of the host failure.
Configuring hosts with the physical IP of the primary router bypasses the virtual gateway mechanism entirely.
When the primary router powers off, its physical IP becomes unreachable, leaving hosts unable to route traffic off the local subnet.

Key Concept

FHRP Virtual IP vs Physical Interface IP Gateway Configuration
Question 196Question

A network engineer is designing an out-of-band (OOB) management solution for a remote datacenter rack to maintain administrative control during a complete primary network failure. The technical specifications mandate: (1) remote GUI-level visual access to bare-metal server console screens during POST/boot, (2) direct serial CLI management of edge routers and switches, and (3) the capability to remotely power-cycle frozen hardware. Which deployment strategy fulfills all of these requirements while maintaining dedicated OOB access?

Show answer & explanation

Answer: Deploy an IP-KVM switch for server console access, a serial console terminal server for network device CLI access, and a smart switched PDU for power cycling, all connected through an auxiliary cellular modem connection.

Answer

Deploy an IP-KVM switch for server console access, a serial console terminal server for network device CLI access, and a smart switched PDU for power cycling, all connected through an auxiliary cellular modem connection.
The combination of an IP-KVM, serial terminal server, smart switched PDU, and cellular modem provides complete out-of-band (OOB) administrative coverage. IP-KVM captures server video signals before the OS loads, the terminal server provides RS-232 serial console access to routers and switches, the switched PDU allows power cycling of locked devices, and the cellular modem ensures connectivity completely independent of primary network links.

Step-by-Step Solution

1
Analyze the management access requirements during primary network loss.
Identified three required functions: BIOS/POST GUI server access, router/switch serial CLI access, and remote hard power control, reachable via an independent network path.
In-band solutions (VLANs, primary WAN gateways) become unreachable during a primary network failure.
2
Map hardware appliances to specific out-of-band administration requirements.
IP-KVM satisfies server screen/GUI access; terminal server connects to device serial console ports; switched PDU provides power control per outlet.
Each dedicated device handles a distinct hardware management layer without relying on host operating systems.
3
Evaluate the transmission pathway for out-of-band reachability.
An auxiliary cellular modem provides independent internet access separate from primary fiber/ethernet ISPs.
Out-of-band management requires physical or logical path isolation from the main production data path.

Key Concept

Out-of-Band (OOB) Remote Management Architecture
Estimated Time:2m 0s
Question 197Question

A network engineering team is hardening the remote management architecture for a critical enterprise data center. Security baseline standards require cryptographic protection for all administrative sessions, central AAA authorization for individual CLI commands, and an independent out-of-band (OOB) pathway capable of providing emergency console access if the core routers experience a complete network stack freeze or primary ISP fiber failure. Which of the following mechanisms should the team deploy to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure SSH combined with TACACS+ authentication to enforce encrypted command-line management and granular command authorization.; Deploy a terminal server connected via a cellular modem directly to device serial console ports for out-of-band access.

Answer

The engineering team must deploy SSH integrated with TACACS+ for secure in-band management and a terminal server attached via cellular modem to device serial console ports for out-of-band management.
SSH paired with TACACS+ satisfies security baseline requirements by providing end-to-end transport encryption combined with centralized, granular command-level authorization. A cellular-backed terminal server wired to physical serial console ports creates a robust out-of-band channel that remains reachable even during primary network outages or device IP stack freezes.

Step-by-Step Solution

1
Analyze security and accessibility requirements
The scenario demands encrypted transport, granular command authorization, and dedicated administrative channels resistant to primary link or device stack failures.
In-band protocols must prevent eavesdropping and unauthorized commands, while out-of-band infrastructure must operate independently of the primary production network path.
2
Evaluate in-band protocol security controls
SSH provides transport-layer encryption, while TACACS+ encrypts the entire payload and supports command-by-command authorization.
Telnet is unencrypted, and SNMPv2c uses cleartext community strings without supporting individual command auditing or session privacy.
3
Evaluate out-of-band physical transport connectivity
Connecting a terminal server to device RS-232 serial console ports with a cellular WAN connection creates an isolated emergency out-of-band pathway.
Serial console access bypasses device network protocol stacks, and cellular modems provide connectivity independent of primary ISP fiber infrastructure.

Key Concept

Secure In-Band Administration and Out-of-Band (OOB) Infrastructure Isolation
Question 198Question

During peak operational hours, enterprise users report frequent audio distortion and freeze-frames during real-time video calls across a site-to-site WAN link. Network interface polling indicates that total link utilization averages only 45%45\% of available capacity, with interface error counters showing fewer than 0.01%0.01\% dropped frames. Packet captures indicate that delay between consecutive packets fluctuates significantly across UDP transport streams. Which network metric is primarily responsible for the degraded application quality, and which telemetry technology is best suited to continuously monitor these per-flow transport dynamics?

Show answer & explanation

Answer: Jitter; deploy flow-based telemetry (such as NetFlow or IPFIX) to capture per-flow UDP delay variations.

Answer

Jitter; deploy flow-based telemetry (such as NetFlow or IPFIX) to capture per-flow UDP delay variations.
Jitter is the variance in packet inter-arrival times. For real-time applications such as video conferencing that use UDP, jitter leads to buffer depletion and visual artifacts even when total link bandwidth is well below saturation and interface drop counters remain low. Flow-based telemetry protocols (such as NetFlow or IPFIX) analyze per-flow metrics at Layers 3 and 4, enabling network engineers to measure jitter and delay variations across specific application streams.

Step-by-Step Solution

1
Analyze reported symptoms and interface performance metrics.
Real-time video is degraded despite low average bandwidth utilization (45%45\%) and negligible dropped frames (<0.01%<0.01\%).
Eliminates bandwidth exhaustion and physical/data-link interface frame drops as the primary root cause.
2
Identify the underlying metric causing delay fluctuations in UDP streams.
Variable arrival times between consecutive packets in real-time UDP streams define jitter.
Real-time voice and video buffers require steady packet delivery; high jitter causes buffer underflow/overflow resulting in audio pops and video freezing.
3
Select the appropriate monitoring technology for per-flow Layer 4 performance tracking.
Flow-based telemetry like NetFlow or IPFIX provides detailed insight into individual IP flows, packet timing, and transport layer metrics.
Standard interface-level SNMP polling aggregates statistics over time and lacks the granularity to observe per-flow UDP timing variance.

Key Concept

Network Performance Metrics and Telemetry Methods
Estimated Time:2m 0s
Question 199Question

During a quarterly compliance audit of an organization's network infrastructure, a security analyst identifies two key operational deficiencies: event log packets sent from border routers to the log repository are lost during high network congestion, and SNMP performance telemetry transmitted across public circuits can be read in plain text. Which set of protocol configurations directly resolves both compliance issues?

Show answer & explanation

Answer: Migrate Syslog logging to TCP with TLS encryption on port 6514, and configure SNMPv3 with the authPriv security level.

Answer

Migrate Syslog logging to TCP with TLS encryption on port 6514, and configure SNMPv3 with the authPriv security level.
The correct option addresses both audit deficiencies: TCP port 6514 with TLS provides reliable, encrypted Syslog transmission so logs are acknowledged and retransmitted if dropped, while SNMPv3 configured with authPriv provides HMAC-based message authentication and AES payload encryption for monitoring data.

Step-by-Step Solution

1
Analyze the log loss issue during network congestion
Identify that traditional Syslog over UDP (port 514) lacks delivery guarantees, leading to dropped audit records when buffers overflow.
TCP-based Syslog (specifically RFC 5425 using TLS over port 6514) ensures connection reliability, sequence confirmation, and encrypted audit transport.
2
Analyze the SNMP cleartext telemetry vulnerability
Determine that legacy SNMP versions (v1 and v2c) transmit data in plain text without cryptographic security.
SNMPv3 with the authPriv security mode mandates digest-based authentication (auth) and symmetric payload encryption (priv), securing telemetry across public networks.
3
Combine the compliant solutions
Select the configuration incorporating TCP port 6514 for Syslog and SNMPv3 authPriv.
This combination simultaneously fulfills the requirements for reliable audit log retention and secure telemetry monitoring.

Key Concept

Network Logging and Auditing Protocol Security
Question 200Question

A network technician needs to establish baseline performance monitoring and secure telemetry for a company's voice-over-IP (VoIP) infrastructure. Which of the following operational measures should the technician implement to effectively monitor audio quality and secure management traffic? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Track jitter and latency metrics to identify delay variations that degrade real-time audio quality.; Implement SNMPv3 using the authPriv security level to authenticate polling requests and encrypt payload data.

Answer

The correct measures are tracking jitter and latency metrics to assess audio performance, and deploying SNMPv3 with the authPriv security level to encrypt monitoring traffic and authenticate polling requests.
Tracking jitter and latency measures real-time delivery performance required for VoIP call stability. Configuring SNMPv3 with the authPriv setting guarantees that device monitoring requests are securely authenticated and all telemetry payload data is encrypted over the network.

Step-by-Step Solution

1
Identify key performance metrics for real-time voice applications.
Jitter (packet delay variation) and latency are the primary metrics affecting VoIP call quality.
Voice traffic requires predictable delivery; excessive jitter causes dropped audio frames.
2
Select the secure network monitoring protocol configuration.
SNMPv3 configured with authPriv provides authentication and privacy (encryption).
SNMPv1 and SNMPv2c send data in plain text, whereas SNMPv3 authPriv encrypts management data.

Key Concept

VoIP Performance Metrics & SNMPv3 Security Levels
PreviousPage 10 / 19Next