Network Troubleshooting

486 questions

Question 1Question

A network administrator is troubleshooting an issue with a newly deployed Power over Ethernet (PoE+) pan-tilt-zoom (PTZ) IP camera installed at the end of a 85-meter Category 6 UTP cable run. The camera initializes and streams video normally during daylight, but repeatedly reboots whenever its infrared (IR) illuminators turn on at night. A basic wiremapper confirms all eight conductors have pin-to-pin continuity and proper T568B pinout. Which TWO of the following physical layer causes or diagnostic approaches are most appropriate to identify and resolve this failure?

Select all that apply

Show answer & explanation

Answer: Using a cable certifier capable of testing DC resistance unbalance across conductor pairs to check for high resistance in the cable run.; Verifying whether Copper-Clad Aluminum (CCA) cabling was installed instead of solid bare copper conductors for the long horizontal run.

Answer

The correct approaches are using a cable certifier to test DC resistance unbalance and verifying that solid bare copper cabling was used instead of Copper-Clad Aluminum (CCA) wire.
The combination of daytime operation and nighttime reboots indicates that data transmission works fine, but power delivery fails when current demand increases. Cable certifiers that measure DC resistance unbalance evaluate the cable's electrical resistance under load, identifying high-resistance points. Furthermore, verifying that solid bare copper (rather than Copper-Clad Aluminum) was installed addresses the root cause, as CCA cabling exhibits much higher resistance, violating TIA standards and leading to significant voltage drops over long runs.

Step-by-Step Solution

1
Analyze the reported failure symptoms
The IP camera functions during low-power daytime operations but reboots when high-power IR illuminators engage at night, indicating a voltage drop under higher current draw (PoE+ power delivery issue).
Wiremappers only verify basic pin continuity at negligible electrical current; they cannot detect high DC resistance under load.
2
Evaluate physical cable properties affecting PoE delivery
Substandard cabling materials like Copper-Clad Aluminum (CCA) have much higher resistance than pure copper, which causes excessive voltage drops over long distances (such as 85 meters).
ANSI/TIA standards explicitly require solid copper conductors for horizontal cabling carrying PoE.
3
Select the appropriate diagnostic tool for advanced electrical testing
A advanced cable certifier measures DC resistance and DC resistance unbalance between conductor pairs.
This pinpoints poor terminations, oxidized punch-downs, or improper cable gauge/material causing power delivery failures.

Key Concept

DC Resistance and PoE Troubleshooting in Twisted-Pair Cabling
Estimated Time:1m 30s
Question 2Question

A network administrator is configuring three adjacent 2.4 GHz wireless access points in an office floor plan. Which combination of channels should be assigned to these access points to prevent co-channel and adjacent-channel interference?

Show answer & explanation

Answer: Channels 1, 6, and 11

Answer

Channels 1, 6, and 11
Channels 1, 6, and 11 are the standard non-overlapping 20 MHz channels in the 2.4 GHz Wi-Fi spectrum. Assigning these distinct channels to adjacent access points prevents signal degradation caused by channel overlap.

Step-by-Step Solution

1
Identify the frequency band and channel separation requirements for 2.4 GHz Wi-Fi.
Standard 2.4 GHz 802.11 channels require 20 MHz of bandwidth, but center frequencies are spaced only 5 MHz apart.
To avoid frequency overlap, channels must have center frequencies spaced at least 20 MHz (4 channel intervals) apart.
2
Determine the non-overlapping channel set.
Selecting channels 1, 6, and 11 provides the necessary 25 MHz separation between channel center frequencies.
Channels 1, 6, and 11 allow multiple adjacent access points to operate without interfering with one another.

Key Concept

2.4 GHz Non-Overlapping Channel Assignment
Estimated Time:45s
Question 3Question

A network engineer is investigating intermittent packet loss and database session drops across a newly provisioned IPsec VPN tunnel between two enterprise data centers. After analyzing interface counters and running test ping sweeps with custom payload sizes, the engineer successfully proves that an MTU mismatch is causing packet fragmentation errors and confirms that lowering the tunnel interface MTU in a staging sandbox completely eliminates the drop count. According to the CompTIA troubleshooting methodology, which action should the engineer perform NEXT?

Show answer & explanation

Answer: Formulate a formal plan of action to modify the production MTU settings while identifying any potential side effects or service disruptions.

Answer

Formulate a formal plan of action to modify the production MTU settings while identifying any potential side effects or service disruptions.
The scenario indicates that Step 3 of the CompTIA troubleshooting methodology (Test the theory to determine cause) has just been successfully completed. According to the official methodology, the immediate next action is Step 4: Establish a plan of action to resolve the problem and identify potential effects, followed by implementing the solution. Planning out the deployment in production ensures changes do not cause unintended outages.

Step-by-Step Solution

1
Determine current step in the troubleshooting process.
The scenario describes a technician who tested a hypothesis in a lab setting and confirmed the root cause (MTU mismatch). This completes Step 3 (Test the theory to determine cause).
CompTIA methodology relies on a strict sequential workflow.
2
Identify the mandatory next step in the CompTIA 6-step process.
Step 4 is 'Establish a plan of action to resolve the problem and identify potential effects; implement the solution or escalate as necessary.'
Before making production changes, a technician must plan the deployment and evaluate potential downtime or collateral impact.
3
Evaluate the choices against Step 4.
The option advocating the formulation of a plan of action and assessment of side effects directly matches Step 4.
Other options jump ahead to Step 5 (verification), Step 6 (documentation), or regress to Step 1 (identification).

Key Concept

CompTIA Troubleshooting Methodology Step Sequence
Question 4Question

A network engineer is troubleshooting IP configuration failures on a newly provisioned subinterface for host workstations on VLAN 40 (10.40.16.0/2210.40.16.0/22). Client devices on this VLAN are unable to communicate with remote subnets and consistently auto-assign Automatic Private IP Addressing (APIPA) addresses in the range of 169.254.x.x169.254.x.x. Packet captures performed on the router interface `Gi0/0.40` reveal that incoming `DHCPDISCOVER` broadcast frames from clients are arriving at the router interface, but no corresponding unicast packets are forwarded to the centralized DHCP server located at 10.10.2.100/2410.10.2.100/24.

The subinterface configuration on the router is displayed below:

text
interface GigabitEthernet0/0.40
encapsulation dot1Q 40
ip address 10.40.16.1 255.255.252.0

Which of the following identifies the root cause of this issue and the correct command required on interface `Gi0/0.40` to resolve host connectivity?

Show answer & explanation

Answer: The subinterface lacks a relay configuration to bridge Layer 2 broadcasts across subnets; configure `ip helper-address 10.10.2.100` on interface `Gi0/0.40`.

Answer

The subinterface lacks a relay configuration to bridge Layer 2 broadcasts across subnets; configure `ip helper-address 10.10.2.100` on interface `Gi0/0.40`.
Because client hosts and the DHCP server reside on different IP subnets (VLAN 40 vs. the server subnet 10.10.2.0/24), the router interface facing the clients must act as a DHCP Relay Agent. By default, routers block Layer 2 broadcast traffic such as `DHCPDISCOVER`. Configuring `ip helper-address 10.10.2.100` on subinterface `Gi0/0.40` allows the router to forward DHCP requests as unicast traffic across the Layer 3 boundary to the target server address.

Step-by-Step Solution

1
Analyze symptom and packet capture evidence
Workstations auto-assign APIPA (169.254.x.x169.254.x.x) addresses, and incoming Layer 2 `DHCPDISCOVER` broadcasts reach `Gi0/0.40`, but no unicast frames leave the router toward the DHCP server at 10.10.2.10010.10.2.100.
DHCP broadcast messages operate at Layer 2 and are stopped at the router boundary by default.
2
Evaluate subinterface configuration
`Gi0/0.40` has 802.1Q tagging and an IP address assigned, but lacks an `ip helper-address` directive.
Without an IP helper address configured, the router cannot relay Layer 2 DHCP broadcasts across Layer 3 subnets to a remote DHCP server.
3
Determine remediation step
Add `ip helper-address 10.10.2.100` under `interface GigabitEthernet0/0.40`.
This instructs the router to encapsulate incoming `DHCPDISCOVER` broadcasts into unicast UDP packets addressed directly to 10.10.2.10010.10.2.100 with the gateway IP address (`giaddr`) set to 10.40.16.110.40.16.1.

Key Concept

DHCP Relay Agent and IP Helper Address Placement
Estimated Time:2m 0s
Question 5Question

A network administrator needs to display a list of all active network connections and listening ports on a local Windows host to inspect running network services. Which command-line utility should the administrator execute?

Show answer & explanation

Answer: netstat

Answer

The administrator should execute the netstat command to view active network connections and listening ports on the local system.
The netstat (network statistics) command-line tool is specifically designed to display active TCP connections, UDP ports, listening sockets, and protocol statistics for the local host.

Step-by-Step Solution

1
Identify the troubleshooting objective
The goal is to inspect open socket connections and listening ports on the local host.
Determining listening ports helps identify running network services and detect unauthorized port usage.
2
Evaluate command-line network tools
The netstat (network statistics) command reports incoming/outgoing TCP/UDP connections, listening ports, and routing tables.
Other tools like nslookup, tracert, and ipconfig serve different functions such as DNS queries, route tracing, and adapter IP configuration.

Key Concept

Utilizing Command-Line Network Troubleshooting Utilities (netstat)
Estimated Time:45s
Question 6Question

A network engineer is troubleshooting a name resolution issue on a corporate client workstation. When the engineer runs `nslookup internal.example.com 10.20.4.15`, the hostname successfully resolves to `10.20.4.100`. However, standard web browsers and ping utilities on the workstation report an error stating that the host cannot be found. Which of the following potential root causes best explain why direct `nslookup` queries succeed while system applications fail to resolve the hostname? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The local hosts file on the workstation contains an outdated or incorrect static mapping for the target hostname, which local system applications evaluate prior to querying DNS.; The workstation's active network adapter is configured with an incorrect primary DNS server IP address that differs from the server specified in the command line query.

Answer

The resolution failure during standard application usage is caused by either an outdated local hosts file entry overriding DNS resolution or an incorrect primary DNS server address assigned to the network interface card.
The nslookup utility bypasses the operating system's standard name resolution sequence by directly sending queries over UDP/TCP port 53 to the server specified in the command line argument. Standard applications rely on the OS resolver API, which evaluates the local hosts file first and then sends requests to the DNS servers configured on the network adapter interface. An erroneous hosts entry or a misconfigured adapter DNS IP address will cause application lookups to fail despite direct DNS server reachability.

Step-by-Step Solution

1
Analyze the behavior of the diagnostic command versus OS application behavior.
Recognize that nslookup queries a specific DNS server directly (10.20.4.15) and bypasses the operating system's local resolver caching and static hosts configuration.
This isolation proves that the remote DNS server holds valid records, while local client-side configuration or resolution order is causing standard applications to fail.
2
Evaluate local system resolution mechanics.
The OS resolver checks the local hosts file prior to contacting DNS servers, and relies on network adapter TCP/IP settings for automatic server selection.
An invalid entry in the hosts file or a mismatched primary DNS IP on the network interface will break general application resolution while leaving explicit command-line queries unaffected.

Key Concept

Operating System Name Resolution Order vs Command-Line Query Tools
Estimated Time:1m 30s
Question 7Question

A network administrator suspects that an unauthorized device acting as a rogue DHCP server is responding to client requests on a local subnet and handing out invalid default gateway addresses. The administrator connects a laptop running a packet analyzer to a mirrored port on the switch. Which display filter should the administrator apply in the packet analyzer to isolate traffic originating specifically from DHCP servers?

Show answer & explanation

Answer: udp.srcport == 67

Answer

The display filter udp.srcport == 67 correctly isolates outbound DHCP server traffic, allowing the administrator to identify the IP and MAC address of the rogue server.
DHCP communication utilizes UDP ports 67 and 68. The server listens on port 67 and sends outbound response messages (DHCP Offer and DHCP ACK) using UDP source port 67. Applying a display filter for udp.srcport == 67 isolates packets generated by any DHCP server on the broadcast domain, revealing the source MAC and IP addresses of the unauthorized rogue device.

Step-by-Step Solution

1
Identify the protocol and port usage for DHCP communication.
DHCP relies on UDP transport, where servers listen on port 67 and clients send requests from port 68.
Understanding transport protocol port assignments is required to write packet filters.
2
Determine the direction of traffic required to identify the rogue server.
Server responses (DHCP Offer and DHCP ACK) originate from the server using source port 67.
Filtering by source port 67 isolates packets sent BY the server rather than requests sent BY clients.
3
Select the exact filter expression matching UDP source port 67.
The expression udp.srcport == 67 captures all server outbound DHCP traffic.
This isolates rogue server responses containing the offending gateway configurations.

Key Concept

Packet Analyzer Display Filters for DHCP Troubleshooting
Question 8Question

A network technician is systematically troubleshooting a connectivity failure from a client workstation to a remote application server. Place the following command-line utilities in the logical order they should be executed to isolate the issue from local interface settings out to remote route reachability.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct logical order begins with checking local IP settings using `ipconfig`, verifying local gateway reachability using `ping`, tracing the remote path using `tracert`, and verifying DNS resolution using `nslookup`.
Standard network troubleshooting follows a logical sequence from local host configuration (`ipconfig`), to local subnet reachability (`ping`), to multi-hop path analysis (`tracert`), and finally upper-layer services like DNS resolution (`nslookup`).

Step-by-Step Solution

1
Check local host IP assignment.
Confirms the host has a valid IP configuration and default gateway.
Local IP misconfigurations render all outbound network diagnostics invalid.
2
Test local gateway ICMP reachability.
Confirms local Layer 2 and Layer 3 communication to the router.
Traffic cannot reach remote networks if the local gateway cannot be reached.
3
Trace path across intermediate network hops.
Identifies packet loss or latency across remote routers.
Helps distinguish between local network issues and upstream routing failures.
4
Verify DNS name resolution.
Confirms the DNS server resolves the FQDN to the correct destination IP address.
Ensures application accessibility issues are not caused by name resolution errors.

Key Concept

Structured Command-Line Diagnostic Sequence
Question 9Question

A network engineer is diagnosing intermittent performance issues and log warnings on an inter-switch trunk link connecting Switch-Alpha (GigabitEthernet0/1) to Switch-Beta (GigabitEthernet0/1). The console on Switch-Alpha displays `%CDP-4-NATIVE_VLAN_MISMATCH: Native VLAN mismatch discovered on GigabitEthernet0/1 (10), with Switch-Beta GigabitEthernet0/1 (20)`. Concurrently, interface statistics for GigabitEthernet0/1 on Switch-Alpha show a steadily increasing count of late collisions and Frame Check Sequence (FCS) errors. Which TWO of the following root causes are directly responsible for the observed log messages and interface error counters?

Select all that apply

Show answer & explanation

Answer: Inconsistent 802.1Q native VLAN configurations on the opposing ends of the trunk link.; A duplex mismatch between the connected GigabitEthernet interfaces on Switch-Alpha and Switch-Beta.

Answer

The two correct root causes are inconsistent 802.1Q native VLAN configurations across the trunk link and a duplex mismatch between the connected interfaces.
The correct selections identify the two distinct issues present: the explicit Cisco Discovery Protocol log indicates an 802.1Q native VLAN ID mismatch between the switch ports, and the presence of late collisions with FCS errors points directly to a speed/duplex negotiation mismatch.

Step-by-Step Solution

1
Analyze the CDP warning log message
The message %CDP-4-NATIVE_VLAN_MISMATCH confirms that Switch-Alpha uses native VLAN 10 while Switch-Beta uses native VLAN 20 on their respective trunk ports.
802.1Q trunks must share the same native VLAN ID on both sides so untagged control and data frames are correctly interpreted and isolated.
2
Analyze the interface error metrics (late collisions and FCS errors)
Late collisions occur when an interface operating in half-duplex detects a collision after transmit window timing has elapsed, caused by the opposite end transmitting simultaneously in full-duplex mode.
In a full-duplex to half-duplex mismatch, the full-duplex side ignores carrier sense and transmits at will, resulting in collisions during transmission on the half-duplex side.
3
Evaluate remaining options against observed symptoms
STP bridge priority misconfigurations affect root election and topology blocking but do not cause physical/data-link layer framing or collision errors. Layer 3 routers are only needed for inter-VLAN routing, not intra-VLAN frame forwarding across Layer 2 trunks.
Eliminating invalid causes confirms native VLAN mismatch and duplex mismatch as the two independent issues.

Key Concept

Troubleshooting Layer 2 trunk misconfigurations (Native VLAN mismatches) and physical-layer interface mismatches (Speed/Duplex mismatch indicators).
Estimated Time:2m 0s
Question 10Question

A network administrator is troubleshooting an issue where a user's workstation periodically attempts to connect to an old IP address (10.1.5.50) when reaching `db.internal.corp`, despite the DNS server returning the updated IP address (10.1.5.200) for other hosts. The administrator inspects the client using a local command-line diagnostic tool and views the following output snippet:

text
Record Name . . . . . : db.internal.corp
Record Type . . . . . : 1
Time To Live . . . . : 86400
Data Length . . . . . : 4
Section . . . . . . . : Answer
A (Host) Record . . . : 10.1.5.50

Which of the following actions should the administrator take on the client workstation to resolve this issue and ensure it uses the correct IP address? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Execute `ipconfig /flushdns` to purge the local DNS resolver cache.; Inspect the local `hosts` file for static mappings pointing `db.internal.corp` to 10.1.5.50 and remove them.

Answer

Purging the DNS resolver cache with `ipconfig /flushdns` and removing any outdated static entry in the local `hosts` file will resolve the issue on the client workstation.
The issue is caused by stale resolution data on the local system. Executing the command to flush the DNS cache clears the local resolver storage so the client sends a new query to the authoritative DNS server. Additionally, checking and editing the local `hosts` file removes any static IP-to-hostname mappings that take precedence over external DNS responses and re-populate the cache upon reboot.

Step-by-Step Solution

1
Analyze the client command output
The `ipconfig /displaydns` snippet reveals a cached A record with a high Time To Live (86400 seconds) mapping `db.internal.corp` to the outdated IP address 10.1.5.50.
When a client system resolves hostnames, it checks the local cache first before contacting DNS servers.
2
Identify the source of stale data and clear the cache
Running `ipconfig /flushdns` purges the local resolver cache so the OS queries the DNS server for fresh resolution.
Local cache entries persist until their TTL expires unless manually flushed.
3
Check persistent local overrides
Examining the local `hosts` file ensures that static mappings overriding DNS responses are identified and removed.
Static `hosts` entries take precedence over DNS server queries during local resolution.

Key Concept

Local Resolver Cache and Hosts File Precedence in DNS Name Resolution
Question 11Question

Match each network diagnostic requirement or operational anomaly to the most appropriate diagnostic hardware tool or packet analyzer syntax.

Click a left item, then click its matching right item

Items

Locating the precise distance to a high-reflectance mechanical splice break along a 12 km single-mode fiber-optic backbone.
Isolating an unmapped RJ45 wall jack inside a dense, fully patched telecommunications closet without disrupting active switch links.
Detecting an unauthorized secondary DHCP server on a local VLAN by analyzing mirrored frame payloads for DHCPOFFER messages.
Measuring real-time voltage and verifying negotiated 802.3at Power over Ethernet (PoE+) draw at an endpoint deployment location prior to connecting a PTZ camera.

Matches

Show answer & explanation

Answer

The correct pairings match: (1) Long-distance single-mode fiber splice fault distance to an Optical Time-Domain Reflectometer (OTDR); (2) Unmapped cable identification in dense patch panels without disconnection to a tone generator and inductive probe; (3) Rogue DHCP server identification in packet captures to Wireshark filtering on BOOTP message type 2 (DHCPOFFER); and (4) Endpoint PoE voltage and IEEE 802.3at load validation to a hardware PoE inline analyzer.
Each diagnostic requirement requires a tool operating at the correct OSI layer and physical media type: OTDRs characterize optical fiber reflection and attenuation; tone generators with inductive probes trace unshielded or shielded copper cabling non-intrusively; Wireshark DHCP display filters capture Layer 7 application bootstrap options; and PoE inline analyzers assess negotiated power delivery under load.

Step-by-Step Solution

1
Analyze the physical fiber requirement for single-mode optical reflectometry.
Identified that OTDR is required for measuring backscatter and distance to faults over optical fiber links.
Copper TDRs cannot analyze light pulses, making an OTDR mandatory for fiber optic length and reflective event analysis.
2
Identify non-disruptive physical cable tracing methods.
Selected the tone generator and inductive probe tracer.
Inductive amplification reads signals standard wiremap continuity testers cannot detect without breaking electrical contact.
3
Analyze frame payloads for protocol-specific rogue service behaviors.
Applied `bootp.option.dhcp == 2` in Wireshark.
DHCP offer frames utilize BOOTP message option 53 with a value of 2 to announce IP lease availability to requesting clients.
4
Evaluate inline power testing under operational load.
Matched PoE inline analyzer to the high-draw PTZ endpoint requirement.
Multi-meters measure open-circuit voltage but fail to validate active IEEE PoE handshake negotiating 802.3at power classes under load.

Key Concept

Selecting target hardware diagnostic tools and packet analyzer display filters based on physical medium and protocol layer analysis requirements.
Question 12Question

A Linux server configured with the IPv4 address 192.168.120.45/24192.168.120.45/24 is unable to establish connections with servers on external subnets. Local subnet communication functions normally. The network administrator runs `ip route show` on the server and reviews the following routing table output:

text
default via 192.168.121.1 dev eth0
192.168.120.0/24 dev eth0 proto kernel scope link src 192.168.120.45

Which of the following identifies the root cause of the connectivity failure?

Show answer & explanation

Answer: The default gateway IP address resides on a different IP subnet than the host's configured IP address.

Answer

The default gateway IP address (192.168.121.1) is configured on a different IP subnet than the server's interface IP address (192.168.120.45/24).
A default gateway must reside on the same local IP subnet as the host interface so that the host can resolve the gateway's MAC address using ARP. The host address is 192.168.120.45/24192.168.120.45/24, making the local subnet range 192.168.120.1192.168.120.1 to 192.168.120.254192.168.120.254. Because the default gateway is set to 192.168.121.1192.168.121.1, it lies outside the local subnet and cannot be reached.

Step-by-Step Solution

1
Analyze the host's IP address configuration and subnet boundary.
The server's address is 192.168.120.45192.168.120.45 with a /24/24 prefix (255.255.255.0255.255.255.0), defining a local usable host range of 192.168.120.1192.168.120.1 through 192.168.120.254192.168.120.254.
Understanding the host's subnet boundary is required to verify gateway reachability.
2
Evaluate the default gateway IP address in the routing table output.
The default route points to `192.168.121.1`.
The gateway address 192.168.121.1192.168.121.1 resides in the 192.168.121.0/24192.168.121.0/24 network segment, which is outside the local 192.168.120.0/24192.168.120.0/24 subnet.
3
Determine the impact of the subnet mismatch on Layer 2 / Layer 3 resolution.
The host cannot resolve the MAC address of the default gateway via ARP because the gateway is not on the directly connected local subnet.
A host default gateway must always reside on the same IP subnet as the local network interface.

Key Concept

Default Gateway Subnet Alignment
Estimated Time:1m 30s
Question 13Question

Users on a remote office subnet (10.240.12.0/2410.240.12.0/24) report that they cannot access a cloud database hosted at 172.16.50.100172.16.50.100. Follow the standard CompTIA network troubleshooting methodology to arrange the administrative actions into the correct logical sequence from first step to last step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct order follows the standard troubleshooting methodology: first gather information from users and host settings, second test a theory using diagnostic tools like traceroute and inspecting ACL configuration, third implement the corrective ACL rule change, fourth verify full database connectivity from the client workstation, and finally document the findings and actions taken.
The standard CompTIA network troubleshooting sequence requires progressing linearly through: 1) Identify the problem / gather information, 2) Establish and test a theory of probable cause, 3) Plan and implement the solution, 4) Verify full system functionality, and 5) Document findings, actions, and outcomes.

Step-by-Step Solution

1
Gather symptoms and user reports.
Establishes a baseline understanding of host configuration and specific error behavior without altering the network state.
CompTIA troubleshooting methodology requires identifying the problem first.
2
Perform diagnostics using traceroute and ACL inspection.
Confirms whether traffic reaches the gateway and if an implicit deny ACL statement is dropping the database packets.
Testing the theory isolates the exact point of failure between routing and gateway security filtering.
3
Implement the configuration fix on the gateway/router ACL.
Permits host traffic to traverse the router outbound toward the destination address.
Changes to network configuration should only occur after a theory of probable cause has been confirmed.
4
Verify database connectivity from the client host.
Ensures the application functions correctly and no unintended blocking remains.
Verification confirms that the problem is completely resolved before closing the incident.
5
Record changes and resolution details in technical documentation.
Creates a historical audit trail for future troubleshooting and configuration tracking.
Documentation is the mandatory final step of structured network troubleshooting.

Key Concept

CompTIA Network Troubleshooting Methodology applied to Gateway ACL issues
Question 14Question

During network maintenance, an administrator inspects a newly crimped Category 6 UTP cable that passes basic DC continuity testing but fails Gigabit performance certification due to severe Near-End Crosstalk (NEXT). Visual inspection reveals that the wire pairs were untwisted by approximately 5 centimeters (2 inches) prior to inserting them into the RJ-45 modular plug. Which of the following physical layer corrective actions should the administrator perform to resolve this issue?

Show answer & explanation

Answer: Re-terminate the cable ends while keeping the untwisted portion of the wire pairs to less than 1.3 centimeters (0.5 inches).

Answer

Re-terminate the cable ends while keeping the untwisted portion of the wire pairs to less than 1.3 centimeters (0.5 inches).
Near-End Crosstalk (NEXT) occurs when signals on one wire pair interfere with adjacent pairs near the transmitting end. TIA/EIA cabling standards specify that conductor pairs must remain twisted as close to the connector termination point as possible (maximum 0.5 inches / 12.7 mm for Cat 6). Re-terminating the cable with minimal untwisting restores noise cancellation capabilities.

Step-by-Step Solution

1
Identify the cause of Near-End Crosstalk (NEXT).
Excessive untwisting of wire pairs near termination points exposes individual conductors to electromagnetic coupling from adjacent pairs.
Twisted pair cabling relies on precise pair twisting ratios to cancel out differential electromagnetic interference.
2
Evaluate standard physical termination practices for Category 6 cabling.
TIA/EIA standards specify that pair untwisting must not exceed 0.5 inches (12.7 mm) from the point of termination.
Limiting untwisting preserves noise cancellation up to the RJ-45 contact pins.
3
Select the appropriate corrective action.
Cut off the improperly terminated RJ-45 plug and re-terminate with minimal untwisting.
Physical re-termination directly resolves the root cause of the NEXT failure.

Key Concept

Crosstalk Mitigation and Termination Standards
Estimated Time:1m 30s
Question 15Question

A network technician is troubleshooting severe packet loss and link flapping on a 60-meter Category 6 UTP cable drop connecting a workstation to a access switch. A basic wiremap tester indicates that all eight conductors maintain correct end-to-end pin continuity with no open or short circuits. However, when testing the link with a Time-Domain Reflectometer (TDR), the device indicates a significant signal reflection and impedance anomaly at exactly 32 meters from the local patch panel. Which of the following physical cable conditions is the TDR identifying that the basic wiremap tester failed to detect?

Show answer & explanation

Answer: A physical deformation, such as a sharp bend radius violation or severe cable kink, that alters pair geometry and characteristic impedance without severing pin continuity

Answer

The TDR identifies a physical deformation, such as a sharp bend or severe kink in the cable run, that alters characteristic impedance without breaking DC continuity.
The correct answer explains that a Time-Domain Reflectometer (TDR) transmits electrical pulses along a conductor and measures reflections caused by changes in characteristic impedance. A physical defect such as a kink or severe bend alters the spacing between twisted pairs, creating an impedance mismatch at that location (32 meters) without severing the conductor. This causes high return loss and link degradation at high data rates while passing basic wiremap DC continuity tests.

Step-by-Step Solution

1
Analyze the diagnostic capabilities of a basic wiremap tester versus a Time-Domain Reflectometer (TDR).
A wiremap tester only verifies pinout alignment and DC electrical continuity (detecting opens, shorts, and reversed pairs). It cannot measure signal reflections or impedance consistency.
Passing a wiremap test rules out complete conductor breaks or pin transposition errors.
2
Interpret the TDR measurement output of a signal reflection at 32 meters.
TDR sends electrical pulses down the cable; any change in characteristic impedance (such as from a kink, tight cable tie, or physical crush) reflects a portion of the pulse back to the source.
The time delay of the reflection determines the exact distance to the impedance anomaly.
3
Evaluate the underlying physical cause of high packet loss despite full continuity.
Impedance mismatches cause return loss and signal attenuation, which degrade high-speed signals (like 1000BASE-T) while allowing low-frequency DC continuity checks to succeed.
Maintaining physical bend radius guidelines prevents impedance changes along twisted-pair runs.

Key Concept

Time-Domain Reflectometry (TDR) and Impedance Anomaly Detection
Question 16Question

A network technician receives a ticket stating that remote users at a new satellite office cannot reach the company's internal intranet application. The technician interviews affected users, duplicates the failure on a test host, and receives a 'Destination Host Unreachable' message. The technician then formulates a hypothesis that an incorrect VLAN tagging policy on the WAN router interface is stripping traffic. To verify this, the technician runs a packet capture on the router interface and confirms that frames are arriving with an unexpected VLAN ID tag, validating the root cause. According to the CompTIA troubleshooting methodology, which of the following steps should the technician execute NEXT?

Show answer & explanation

Answer: Establish a plan of action to resolve the issue and identify potential effects.

Answer

Establish a plan of action to resolve the issue and identify potential effects.
The scenario describes a technician who has already identified the problem, established a theory of probable cause, and tested the theory to confirm the root cause via packet capture analysis. According to the CompTIA troubleshooting methodology, once the theory is confirmed, the immediate next step is to establish a plan of action to resolve the problem and identify potential effects.

Step-by-Step Solution

1
Identify the current phase completed in the scenario.
The technician interviewed users, reproduced the issue (Step 1: Identify the problem), established a hypothesis (Step 2: Establish a theory), and confirmed the root cause via packet capture (Step 3: Test the theory to determine cause).
Determining the completed step is necessary to find the next sequential phase in the CompTIA methodology.
2
Identify the mandatory next step in the CompTIA 6-step troubleshooting methodology.
Step 4 is 'Establish a plan of action to resolve the problem and identify potential effects'.
After a theory is proven true, a plan must be formulated before implementing fixes or verifying system functionality.

Key Concept

CompTIA Troubleshooting Methodology Steps
Question 17Question

A network technician is performing diagnostic testing on several physical cabling installations across a enterprise facility. Match each physical layer cabling issue on the left with its underlying root cause or correct remediation on the right.

Click a left item, then click its matching right item

Items

High insertion loss and high optical return loss at a fiber optic patch panel junction, with no physical glass break detected.
A UTP cable run shows 100% pin-to-pin DC continuity on a basic wiremapper, but experiences severe NEXT and corrupted frames at 1 Gbps.
Intermittent frame errors and packet loss on a horizontal copper cable run occurring specifically when high-voltage HVAC compressors cycle on.
No physical link light signal detected between two switch SFP modules connected via a newly installed duplex fiber patch cable.

Matches

Show answer & explanation

Answer

The physical layer symptoms correspond to their underlying causes as follows: optical attenuation/reflection without break indicates fiber end-face contamination; 100% DC continuity with high NEXT indicates a split pair; intermittent errors during motor startup indicate EMI on UTP runs; and total lack of fiber link light indicates a Tx/Rx polarity reversal.
Each cabling symptom matches standard physical layer troubleshooting principles: end-face dirt causes insertion/return loss; split pairs maintain continuity while generating NEXT; motor operation induces EMI in UTP; and duplex fiber requires proper Tx/Rx crossover alignment.

Step-by-Step Solution

1
Analyze the fiber attenuation and reflection symptom.
High insertion loss accompanied by back-reflection at a junction points to connector contamination, which scatters optical power.
Microscopic contaminants on fiber end-faces create air gaps and scattering surfaces that degrade light transmission.
2
Evaluate the UTP continuity versus crosstalk conflict.
A basic wiremapper only validates electrical continuity per pin. Preserving pin continuity while swapping conductors between pairs creates a split pair, destroying crosstalk cancellation.
Differential signaling relies on balanced twisted pairs; splitting pairs exposes conductors to high near-end crosstalk.
3
Correlate environmental machinery cycles with copper link drops.
Signal drops occurring during motor startup indicate electromagnetic induction on unshielded copper cabling.
Unshielded twisted-pair cabling lacks metallic shielding against high-voltage electromagnetic radiation.
4
Diagnose the missing link light on the duplex fiber connection.
Duplex fiber requires a crossover of Tx to Rx. If Tx connects to Tx, light fails to hit the receiving photodiode.
Optical transceivers send light from Tx and expect light into Rx; reversing polarity restores the signal path.

Key Concept

Troubleshooting Physical Cabling and Connectors
Question 18Question

A network administrator receives reports that a workstation at IP address 192.168.10.45 periodically loses connectivity to the default gateway. The administrator runs the `arp -a` command on the workstation and views the following output:

Interface: 192.168.10.45 --- 0x2
Internet Address Physical Address Type
192.168.10.1 00-11-22-33-44-55 dynamic
192.168.10.12 00-11-22-33-44-55 dynamic

Which of the following conditions is most directly indicated by this terminal output?

Show answer & explanation

Answer: A duplicate MAC address collision exists where another local IP address shares the gateway's physical address.

Answer

A duplicate MAC address collision exists where another local IP address shares the gateway's physical address.
The `arp -a` utility displays the host's Address Resolution Protocol cache. Seeing two separate IP addresses (the gateway at 192.168.10.1 and a host at 192.168.10.12) bound to the identical physical MAC address (00-11-22-33-44-55) indicates a MAC collision, incorrect static assignment, or ARP spoofing, which leads to intermittent reachability issues to the default gateway.

Step-by-Step Solution

1
Analyze the output of the `arp -a` command.
Observe that IP address 192.168.10.1 (default gateway) and IP address 192.168.10.12 both resolve to MAC address 00-11-22-33-44-55.
The ARP table maintains mappings between Layer 3 IPv4 addresses and Layer 2 MAC addresses on the local network.
2
Evaluate the functional impact of identical physical addresses assigned to different logical IP addresses.
Frames destined for either IP address will be delivered to the same physical network interface card.
Unless running specialized multi-homing or virtual gateway clustering protocols, two distinct active IPv4 addresses should not dynamically resolve to the exact same MAC address on a local broadcast domain without causing frame misdirection or MAC address duplication conflicts.

Key Concept

Inspecting ARP Cache Entries to Identify Layer 2 / Layer 3 Addressing Conflicts
Estimated Time:1m 15s
Question 19Question

A network administrator is investigating high latency and severe throughput degradation on a critical database server connected to switch port FastEthernet0/12. An inspection of the switch port statistics shows a high count of late collisions, alignment errors, and frame check sequence (FCS) errors on FastEthernet0/12 during heavy traffic periods. The switch interface is set to default auto-negotiation settings, whereas the server's network interface card (NIC) was recently manually forced to 100 Mbps Full Duplex. Which of the following is the most likely root cause of the late collisions recorded on the switch port?

Show answer & explanation

Answer: The switch interface defaulted to half-duplex operation after failing auto-negotiation with the forced full-duplex server NIC.

Answer

The switch interface defaulted to half-duplex operation after failing auto-negotiation with the forced full-duplex server NIC.
When a network device interface is manually configured for full duplex without auto-negotiation enabled, the connected switch port set to auto-negotiation can detect the link speed (100 Mbps) via clock pulses, but fails to negotiate duplex parameters. Standard Ethernet behavior dictates that an auto-negotiating interface must default to half-duplex when duplex negotiation fails. Consequently, the server transmits whenever it has data (full duplex), while the switch expects half-duplex CSMA/CD rules. When the switch transmits while simultaneously receiving data from the server, the switch registers a collision after transmitting the first 64 bytes of the frame, logging a late collision.

Step-by-Step Solution

1
Analyze the observed interface error counters.
Identified high counts of late collisions, FCS errors, and alignment errors on FastEthernet0/12.
Late collisions occur when a device transmits data after its collision window (first 64 bytes) has passed, which is a key indicator of a duplex mismatch.
2
Evaluate the configuration settings on both link endpoints.
The server NIC is forced to 100 Mbps Full Duplex, while the switch port relies on auto-negotiation.
IEEE 802.3 auto-negotiation requires both ends to participate. If one end is forced, the auto-negotiating end can sense speed (100 Mbps) but cannot determine duplex mode.
3
Apply Ethernet standard fallback rules for duplex negotiation.
The switch port sets its speed to 100 Mbps and defaults its duplex to half-duplex.
The default fallback for auto-negotiation when duplex cannot be negotiated is half-duplex. The server sends frames continuously (full-duplex), while the switch listens for line activity and detects collisions during its own transmissions, logging late collisions.

Key Concept

Ethernet Auto-Negotiation and Duplex Mismatch Symptoms
Question 20Question

A network technician is troubleshooting a newly installed server connected to VLAN 50 (192.168.50.0/24192.168.50.0/24). The server is configured to obtain IP settings dynamically but continually configures an IP address of 169.254.112.45169.254.112.45. The organization's centralized DHCP server is located on VLAN 10 (192.168.10.5192.168.10.5) and correctly services hosts on VLAN 10. Which of the following root causes and remediation steps accurately address this connectivity issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The router interface servicing VLAN 50 lacks a DHCP relay agent configuration, preventing broadcast DHCP requests from reaching the server on VLAN 10.; An IP helper address pointing to 192.168.10.5 must be configured on the VLAN 50 default gateway interface.

Answer

The server is receiving an APIPA address (169.254.112.45169.254.112.45) because DHCP broadcast traffic from VLAN 50 is not traversing the router to the DHCP server on VLAN 10. To resolve this, a DHCP relay agent (IP helper address pointing to 192.168.10.5192.168.10.5) must be configured on the router interface for VLAN 50.
DHCP clients issue Layer 2 broadcast requests during discovery. Because routers block Layer 2 broadcasts by default, devices on VLAN 50 cannot reach the DHCP server on VLAN 10 unless a DHCP relay agent is enabled. Configuring an IP helper address on the router interface servicing VLAN 50 converts these local broadcasts into targeted unicast traffic sent to 192.168.10.5, allowing the server on VLAN 50 to receive an IP lease.

Step-by-Step Solution

1
Analyze the IP address symptom (169.254.112.45169.254.112.45).
Recognize that the 169.254.0.0/16169.254.0.0/16 range represents APIPA, indicating the client sent DHCPDISCOVER requests but received no DHCP OFFER response.
When a DHCP client receives no response to its broadcast requests, the operating system self-assigns an APIPA address.
2
Examine the network topology boundaries between VLAN 50 and VLAN 10.
Identify that VLAN 50 (192.168.50.0/24192.168.50.0/24) and VLAN 10 (192.168.10.0/24192.168.10.0/24) are separated by a Layer 3 router.
Routers drop Layer 2 broadcast packets (like DHCPDISCOVER) by default unless explicitly configured to relay them.
3
Determine the required resolution to forward broadcast DHCP traffic across subnets.
Configure `ip helper-address 192.168.10.5` on the default gateway interface for VLAN 50.
The IP helper feature intercepts incoming DHCP broadcasts on the interface and unicasts them to the DHCP server IP specified.

Key Concept

DHCP Relay Agent (IP Helper) Operations and APIPA Diagnosis
Estimated Time:1m 30s
Page 1 / 25Next