Network Troubleshooting

486 questions

All types486 Multiple choice248 Multiple select111 Matching61 Ordering66

A network technician is troubleshooting an issue where workstations in a remote branch office cannot resolve hostnames within the internal domain `internal.corp.com`, although external internet domains resolve normally. The technician runs diagnostic commands from a affected workstation with the following results:

> nslookup internal.corp.com
Server: 192.168.1.1
Address: 192.168.1.1#53

** server can't find internal.corp.com: SERVFAIL

> dig @10.10.20.5 internal.corp.com
;; QUESTION SECTION:
;internal.corp.com. IN A

;; ANSWER SECTION:
internal.corp.com. 3600 IN A 10.10.20.50

Based on the output, which TWO of the following are the most likely root causes of this name resolution failure? (Select TWO.)

Select all that apply

The local router/resolver at 192.168.1.1 lacks a conditional forwarding rule configured for the `internal.corp.com` domain zone.

Firewall rules or access control lists (ACLs) are filtering DNS traffic between the local resolver (192.168.1.1) and the authoritative DNS server (10.10.20.5).

The `nslookup` command failed because it reads entries exclusively from the client's local HOSTS file rather than sending queries over the network.

Standard DNS resolution queries operate exclusively over TCP port 53, so any network path allowing only UDP port 53 will fail.

Show answer & explanation

Answer: The local router/resolver at 192.168.1.1 lacks a conditional forwarding rule configured for the `internal.corp.com` domain zone.; Firewall rules or access control lists (ACLs) are filtering DNS traffic between the local resolver (192.168.1.1) and the authoritative DNS server (10.10.20.5).

Answer

The most likely root causes are that the local DNS resolver at 192.168.1.1 lacks a conditional forwarder for the internal domain, and network firewall or ACL policies are blocking DNS traffic (port 53) between the local resolver and the internal authoritative DNS server.

Directly querying the internal DNS server at 10.10.20.5 successfully returns the IP address, proving the DNS record exists and is valid. The failure only occurs when client workstations query their default local gateway/resolver (192.168.1.1), returning a SERVFAIL error. This occurs when the local resolver either does not have a conditional forwarder configured to send requests for `internal.corp.com` to 10.10.20.5, or when firewalls/ACLs block port 53 communication between 192.168.1.1 and 10.10.20.5.

Step-by-Step Solution

Analyze the `nslookup` command output

The workstation queries its local DNS server (192.168.1.1), which returns a `SERVFAIL` status message for `internal.corp.com`.

SERVFAIL indicates the local resolver encountered an error attempting to process the query recursively or forward it.

Analyze the `dig` command output

Directly targeting the authoritative internal DNS server (`dig @10.10.20.5`) returns a valid A record (`10.10.20.50`).

This confirms that the record exists on the authoritative server and the server itself is functioning correctly.

Identify the break in the resolution path

The failure occurs specifically when 192.168.1.1 is tasked with resolving the query.

This points to either a misconfiguration on 192.168.1.1 (missing conditional forwarder) or network path blocking between 192.168.1.1 and 10.10.20.5.

Key Concept

Troubleshooting Split-Horizon DNS and Resolver Forwarding

Question 242Question →

A network technician is investigating why users on subnet $10.20.4.0/24$ cannot access a secure internal web portal at $10.20.10.15$ over HTTPS. The technician runs a traceroute command from a client workstation ( $10.20.4.50$ ), which yields the following output:

Traceroute to 10.20.10.15 over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms 10.20.4.1
2 2 ms 1 ms 2 ms 10.20.1.2
3 * * * Request timed out.

An inspection of the router at $10.20.1.2$ reveals the following inbound Access Control List (ACL) applied on interface GigabitEthernet0/1:

access-list 105 permit tcp 10.20.4.0 0.0.0.255 host 10.20.10.15 eq 80
access-list 105 permit icmp 10.20.4.0 0.0.0.255 host 10.20.10.15

Based on these diagnostic outputs, which of the following is the root cause of the connection failure?

The Access Control List permits HTTP traffic on TCP port 80 but lacks a permit entry for HTTPS traffic on TCP port 443, causing secure requests to be dropped by the implicit deny rule.

The host workstation is configured with a default gateway address residing on a different IP subnet, preventing packets from reaching the intermediate router.

The destination web server resides on a separate VLAN broadcast domain that cannot be reached because inter-VLAN routing is completely disabled on the switch.

The ACL rule is dropping HTTPS traffic because secure web traffic defaults to TCP port 22, which is missing from the access list statements.

Show answer & explanation

Answer: The Access Control List permits HTTP traffic on TCP port 80 but lacks a permit entry for HTTPS traffic on TCP port 443, causing secure requests to be dropped by the implicit deny rule.

Answer

The Access Control List permits HTTP traffic on TCP port 80 but lacks a permit entry for HTTPS traffic on TCP port 443, causing secure requests to be dropped by the implicit deny rule.

The traceroute output confirms that traffic successfully traverses the local gateway (

10.20.4.1

) and reaches router

10.20.1.2

. However, the inbound ACL configured on router

10.20.1.2

only contains explicit permit statements for TCP port 80 (HTTP) and ICMP. Because HTTPS uses TCP port 443, HTTPS connections do not match any permit statements and are dropped by the implicit deny rule at the end of the access control list.

Step-by-Step Solution

Analyze the traceroute diagnostic output

Hop 1 (10.20.4.1) and Hop 2 (10.20.1.2) respond promptly, but Hop 3 times out.

This indicates that local subnet routing and default gateway settings are functional up to router 10.20.1.2, where traffic is subsequently blocked.

Evaluate the router ACL rules against the requested service protocol

The ACL permits 'tcp eq 80' (HTTP) and 'icmp' (ping/traceroute messages), but contains no statement for HTTPS.

HTTPS uses TCP port 443. Standard IP ACLs evaluate rules top-down and end with an unwritten 'implicit deny all' rule.

Determine the effect of the implicit deny on HTTPS traffic

HTTPS packets destined for 10.20.10.15:443 match none of the explicit permit statements and are dropped at router 10.20.1.2.

Adding 'access-list 105 permit tcp 10.20.4.0 0.0.0.255 host 10.20.10.15 eq 443' to the access list will resolve the issue.

Key Concept

Troubleshooting ACL Filtering and Implicit Deny Rules

Estimated Time:1m 30s

Question 243Question →

A network technician plugs a newly deployed workstation into switch port GigabitEthernet0/12. The host successfully obtains an IP address in the default management network (192.168.1.0/24) and can reach local hosts in that same network, but it is unable to access any resources on the Finance subnet (192.168.30.0/24). An inspection reveals that the switch port is still using its factory default configuration. Which of the following is the most likely cause of this connectivity issue?

The switch port is assigned to the default VLAN 1 rather than the designated Finance VLAN.

Hosts residing on the same VLAN require an intermediate Layer 3 device to communicate with each other.

An 802.1Q native VLAN mismatch exists between the workstation's network card and the access switch port.

The switch port has auto-negotiated a full-duplex mismatch with the connected workstation interface.

Show answer & explanation

Answer: The switch port is assigned to the default VLAN 1 rather than the designated Finance VLAN.

Answer

The switch port is assigned to the default VLAN 1 rather than the designated Finance VLAN.

When a managed switch port remains in its default factory configuration, it is assigned to VLAN 1 (the default VLAN). As a result, any host connected to that port will reside in the VLAN 1 broadcast domain rather than the intended VLAN (such as VLAN 30 for Finance). To resolve the issue, the administrator must configure the interface as an access port and assign it to VLAN 30.

Step-by-Step Solution

Analyze the observed IP addressing and port configuration status.

The host received an IP address in the default network (192.168.1.0/24) corresponding to VLAN 1 because the unconfigured switch port defaults to VLAN 1.

Unconfigured Ethernet ports on a managed switch belong to the default broadcast domain (VLAN 1).

Determine why the host cannot reach the Finance subnet (192.168.30.0/24).

Because the host port is in VLAN 1, it cannot reach VLAN 30 resources without proper port VLAN reassignment and routing.

VLANs isolate broadcast domains at Layer 2.

Key Concept

Default Access Port VLAN Assignment

Question 244Question →

A network technician is troubleshooting a workstation that cannot access external web services. Arrange the command-line network utilities in the correct logical sequence of execution to systematically isolate the issue from the local host configuration to external path reachability and name resolution.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct logical order of execution is: 1. ipconfig /all, 2. ping 192.168.1.1, 3. tracert 8.8.8.8, 4. nslookup www.example.com.

A structured troubleshooting approach starts on the local machine with ipconfig /all to verify interface settings, moves to testing the local gateway with ping, extends to remote internet path checking via tracert, and concludes with domain name resolution verification via nslookup.

Step-by-Step Solution

Run ipconfig /all to examine local host IP settings.

Confirms the host has a valid IP address and identifies the configured default gateway.

Troubleshooting must begin by verifying that the local adapter is properly configured and functional.

Run ping against the default gateway IP address (192.168.1.1).

Confirms local network interface communication and switch port connectivity.

Verifying local gateway reachability ensures local network segment connectivity works before testing remote paths.

Run tracert to a known public IP address (8.8.8.8).

Maps the hop-by-hop path across external routers to isolate routing failures.

Testing IP routing to an external IP ensures IP packets can exit the local network independently of DNS name resolution.

Run nslookup for the target domain name (www.example.com).

Tests whether the configured DNS server can resolve domain names to IP addresses.

Name resolution testing should occur after basic IP connectivity and remote path reachability have been established.

Key Concept

Standard systematic CLI network troubleshooting methodology progresses from local host configuration verification up through local gateway ping, remote path tracing, and application domain name resolution.

Question 245Question →

A network technician is troubleshooting a connectivity issue where hosts on VLAN 20 ( $192.168.20.0/24$ ) are unable to access an enterprise application server at $10.100.50.25$ . Place the following diagnostic and remediation steps in the correct order according to standard CompTIA network troubleshooting methodology, from first step to last step.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct troubleshooting order begins with testing local gateway reachability, followed by using traceroute to locate the failing hop, inspecting the routing table at that hop, reviewing ACL rules on the interface, and finally implementing the fix to verify restored connectivity.

Network troubleshooting follows a logical divide-and-conquer path: verify local gateway access first, trace the path to locate the failure hop, verify routing table entries at that hop, audit interface ACL policies, and conclude by executing the fix and verifying full end-to-end application access.

Step-by-Step Solution

Ping the local default gateway (

192.168.20.1

)

Confirms local network link and IP configuration on the client workstation are working.

Troubleshooting should always begin at the local segment before analyzing remote network infrastructure.

Run traceroute to target IP

10.100.50.25

Identifies the exact intermediate router where packet forwarding ceases.

Traceroute narrows down the problem area across a multi-hop routed infrastructure.

Check the routing table on the target router

Verifies if the router possesses an active next-hop route to

10.100.50.0/24

Unroutable traffic is immediately dropped by routers lacking a matching route entry.

Examine interface ACL configurations

Identifies any explicit deny statements or implicit deny rules dropping packets on the active path.

Security filters override routing logic when configured to drop specific source/destination traffic.

Apply resolution and perform end-to-end verification

Restores full communication between VLAN 20 hosts and

10.100.50.25

Standard methodology requires verifying full system functionality after implementing a fix.

Key Concept

Methodological troubleshooting of routed networks by isolating issues from local gateway reachability to path routing tables and ACL security filters.

Question 246Question →

A network administrator is conducting a post-implementation review of a enterprise wireless deployment across various campus zones. Match each observed wireless signal anomaly to its underlying radio frequency (RF) or configuration cause.

Click a left item, then click its matching right item

Show answer & explanation

Answer

1. Cafeteria performance drop matches Non-802.11 RF interference within the shared 2.4 GHz ISM band. 2. Roof antenna patio dead zone matches Vertical beamwidth limitations and elevation pattern dead zones. 3. Conference room roaming delay matches Sticky client behavior caused by unoptimized roam trigger thresholds. 4. Low-E glass attenuation matches RF signal attenuation and absorption due to metallic film coatings.

Each symptom directly corresponds to a specific physical RF property or client behavior: Non-802.11 microwave emissions cause cafeteria interference; high-gain omnidirectional antenna patterns create vertical dead zones underneath; sticky client driver thresholds cause delayed roaming to closer APs; and metallic Low-E glass coatings introduce strong signal attenuation.

Step-by-Step Solution

Analyze the cafeteria symptom where non-Wi-Fi activity impairs performance during lunch hours.

Identify that microwave ovens and Bluetooth devices release raw RF energy in the 2.4 GHz spectrum, increasing the noise floor.

Non-802.11 interference causes frame retransmissions without showing up as decodable Wi-Fi frames.

Examine the antenna pattern characteristics of the elevated high-gain omnidirectional antenna.

Recognize that higher gain compresses the elevation beamwidth horizontally, diminishing signal directly above and below the antenna axis.

Omnidirectional high-gain antennas direct energy outward horizontally, creating vertical dead zones underneath.

Evaluate the roaming behavior of laptops entering the edge conference room.

Identify sticky client behavior, where the client device decision algorithm holds onto an existing association until signal degrades significantly.

Clients drive roaming decisions, and unoptimized roaming thresholds cause devices to stay connected to distant APs.

Assess the impact of Low-E glass partitions on signal attenuation.

Determine that metallic oxide layers on Low-E glass absorb and reflect RF signals, drastically reducing received signal strength (RSSI).

Dense construction materials coated with metals act as severe RF attenuators.

Key Concept

Identifying wireless RF propagation anomalies, antenna propagation patterns, non-Wi-Fi interference sources, and client roaming behavior during wireless network troubleshooting.

Question 247Question →

A network technician is inspecting a newly terminated Cat 6 Ethernet patch cable that is failing to transmit data. To confirm that each of the eight individual conductors is connected to its corresponding pin on both ends without any open circuits or shorts, which diagnostic tool should the technician use?

Wire mapper

Time-Domain Reflectometer (TDR)

Optical Power Meter (OPM)

Loopback plug

Show answer & explanation

Answer: Wire mapper

Answer

The technician should use a wire mapper to test wire continuity and pin assignments on both ends of the cable.

A wire mapper is the primary tool used to verify that all eight conductors in a twisted-pair copper cable are terminated correctly according to T568A or T568B pinout standards, verifying continuity and identifying miswires, opens, or shorts.

Step-by-Step Solution

Identify the goal of the physical layer test.

The requirement is to verify pin-to-pin wiring continuity and conductor alignment on an RJ-45 twisted-pair copper patch cable.

Improper pin terminations, disconnected conductors, or crossed wires prevent link establishment.

Select the tool dedicated to verifying conductor pinouts.

A wire mapper is designed specifically to detect open conductors, short circuits, and pin mapping mismatches across copper Ethernet pairs.

It is the direct and standard tool for verifying proper RJ-45 conductor pin assignments.

Key Concept

Pinout and Continuity Testing with a Wire Mapper

Question 248Question →

A network administrator is troubleshooting network reachability for a newly installed server in an enterprise datacenter. The host is assigned the IPv4 address $172.16.50.130$ with a subnet mask of $255.255.255.192$ ( $/26$ ). The administrator discovers that while the host can ping its local loopback address, it cannot establish SSH connections to a remote server at $172.16.50.200/26$ or reach external networks.

The host IP configuration is verified as follows:
- IPv4 Address: $172.16.50.130$
- Subnet Mask: $255.255.255.192$
- Default Gateway: $172.16.50.126$

The router interface servicing this VLAN is configured as follows:
text
interface GigabitEthernet0/0.50
encapsulation dot1Q 50
ip address 172.16.50.129 255.255.255.192
ip access-group VLAN50_IN in
!
ip access-list extended VLAN50_IN
permit tcp 172.16.50.128 0.0.0.63 any eq 22
permit icmp 172.16.50.128 0.0.0.63 any

Which of the following identifies the primary root cause of the connectivity failure?

The configured default gateway (

172.16.50.126

) resides in a different IP subnet than the host (

172.16.50.128/26

), preventing ARP resolution for off-subnet destinations.

The access control list `VLAN50_IN` lacks an explicit permit statement for return TCP traffic, causing the implicit deny rule to drop incoming SSH responses.

The target server at

172.16.50.200

is located in the same broadcast domain as the source host, making default gateway routing unnecessary.

The

/26

subnet mask restricts the host capacity of Subnet 2 to 30 usable addresses, making

172.16.50.130

an invalid host IP.

Show answer & explanation

Answer: The configured default gateway ( $172.16.50.126$ ) resides in a different IP subnet than the host ( $172.16.50.128/26$ ), preventing ARP resolution for off-subnet destinations.

Answer

The primary root cause of the connectivity failure is that the configured default gateway (172.16.50.126) resides on a different IP subnet than the source host (172.16.50.128/26), which prevents Layer 2 ARP resolution for off-subnet traffic.

The host IP address

172.16.50.130

with mask

255.255.255.192

(

/26

) places the host in the

172.16.50.128/26

subnet, which has a usable address range of

172.16.50.129

through

172.16.50.190

. The configured default gateway (

172.16.50.126

) falls into the preceding subnet (

172.16.50.64/26

). Because the gateway address is outside the host's local subnet, the host cannot send ARP requests to resolve the gateway's MAC address, completely blocking off-subnet routing.

Step-by-Step Solution

Calculate the subnet boundaries for the host IP address using the subnet mask

255.255.255.192

(

/26

/26

mask yields block sizes of 64 (

256 - 192 = 64

). Subnet ranges are Subnet 0 (

172.16.50.0/26

), Subnet 1 (

172.16.50.64/26

), Subnet 2 (

172.16.50.128/26

), and Subnet 3 (

172.16.50.192/26

Determining exact subnet boundaries establishes which IP addresses reside on the same broadcast domain.

Identify the subnet belonging to the host IP

172.16.50.130

and determine its valid usable IP range.

The host IP

172.16.50.130

falls into Subnet 2 (

172.16.50.128/26

). Network address is

172.16.50.128

, broadcast address is

172.16.50.191

, and usable host IPs range from

172.16.50.129

172.16.50.190

Host IP verification confirms that

172.16.50.130

is a valid usable address within Subnet 2.

Evaluate the location of the configured default gateway IP

172.16.50.126

relative to Subnet 2.

The IP

172.16.50.126

falls into Subnet 1 (

172.16.50.64/26

), where usable IPs span

172.16.50.65

172.16.50.126

. The router's actual interface IP for VLAN 50 is

172.16.50.129

A host must have a default gateway that resides within its own local IP subnet to complete local ARP requests and forward frames to its Layer 3 exit point.

Determine the impact of a default gateway subnet mismatch on traffic forwarding.

When the host attempts to reach an off-subnet destination (

172.16.50.200

), it determines that

172.16.50.126

is off-link (outside

172.16.50.128/26

) and fails to generate ARP requests for

172.16.50.126

, dropping packet transmission locally.

Hosts cannot send traffic to a default gateway that does not share their local subnet.

Key Concept

Default Gateway Subnet Mismatch Diagnosis

Estimated Time:3m 0s

Question 249Question →

Match each physical network cabling fault or diagnostic condition on the left with its underlying physical cause on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

1. Excessive NEXT matches untwisted conductor pairs beyond TIA/EIA limits near the punch-down block.
2. High optical dB attenuation matches microscopic dust/oil on the ferrule end-face.
3. Split pairs with valid continuity match pins connected using conductors from separate physical pairs.
4. Intermittent fiber drops when rack door closes match fiber pinching that exceeds minimum bend radius.

Each diagnostic finding directly correlates with its underlying physical layer failure mechanism. Excessive conductor untwisting at termination causes high NEXT by eliminating inductive noise cancellation. Ferrule contamination causes light scattering and elevated optical dB loss. Split pairs preserve electrical continuity while pairing incorrect conductors together. Physical cable pinching causes macrobending, violating the minimum bend radius and leaking optical signal when rack doors exert pressure.

Step-by-Step Solution

Analyze the physical cause of Near-End Crosstalk (NEXT).

Identify that pair twisting cancels out electromagnetic interference; untwisting conductors beyond TIA/EIA standards at termination points degrades pair isolation and spikes NEXT.

NEXT measures internal cross-talk noise leaking between adjacent wire pairs near the local transmitter.

Evaluate the cause of optical insertion loss / dB attenuation.

Recognize that surface contamination on the optical ferrule end-face prevents clean optical contact and refracts light away from the core.

Cleanliness is critical for fiber connections; microscopic debris blocks light transmission.

Differentiate split pair defects from standard miswires.

Determine that split pairs maintain pin-to-pin continuity but mismatch physical twist pairings, breaking noise cancellation.

Standard continuity testers miss split pairs because current flows correctly pin-to-pin, but twist shielding benefits are lost.

Diagnose cabinet door pressure on fiber cables.

Link physical pressure from closed rack doors to macrobending losses caused by exceeding the fiber's minimum bend radius.

Excessive bending changes the critical angle of internal reflection within the optical fiber core, causing light to escape into the cladding.

Key Concept

Physical layer cabling defects and diagnostic indicators in copper and fiber networks

Estimated Time:2m 0s

Question 250Question →

A workstation on a corporate network is unable to connect to local network resources or access the internet. A technician executes `ipconfig /all` on the workstation and observes an IPv4 address of $169.254.45.12$ with a subnet mask of $255.255.0.0$ . Which of the following is the most likely cause of this connectivity issue?

The workstation failed to obtain an IP lease from a DHCP server and assigned itself an Automatic Private IP Addressing (APIPA) address.

The workstation's default gateway IP address resides on an incorrect subnet, blocking external communication.

The network administrator configured a subnet mask that includes the network broadcast address as a usable host address.

The local DHCP relay agent was improperly enabled on the central server interface rather than the client gateway subinterface.

Show answer & explanation

Answer: The workstation failed to obtain an IP lease from a DHCP server and assigned itself an Automatic Private IP Addressing (APIPA) address.

Answer

The workstation failed to contact a DHCP server to acquire an IP address lease, resulting in the self-assignment of an Automatic Private IP Addressing (APIPA) address.

An IP address starting with

169.254.x.x

(specifically in the

169.254.0.0/16

range) is an Automatic Private IP Address (APIPA). Operating systems assign an APIPA address when a DHCP client is unable to contact a DHCP server to obtain an IP address lease. Because APIPA addresses are non-routable, the host cannot communicate beyond its local layer 2 segment.

Step-by-Step Solution

Analyze the reported IPv4 address snippet from ipconfig output.

The workstation reports

169.254.45.12

with subnet mask

255.255.0.0

The address range

169.254.0.0/16

is reserved by IANA for IPv4 link-local addressing (APIPA).

Identify the mechanism that generates addresses in the 169.254.0.0/16 range.

Host OS automatically generates an APIPA address when dynamic configuration (DHCP) fails.

When a client sends a DHCPDISCOVER broadcast and receives no DHCPOFFER within the timeout period, it defaults to APIPA to allow limited local link communication.

Select the option describing failed DHCP acquisition and APIPA generation.

Confirm that failing to reach a DHCP server and assigning an APIPA address is the root symptom.

This directly explains both the specific IP address assigned and the inability to route to external or non-link-local network resources.

Key Concept

Automatic Private IP Addressing (APIPA) Diagnosis

Question 251Question →

Following a recent core switch update, enterprise workstations connected to VLAN 30 ( $10.30.0.0/24$ ) fail to communicate outside their local subnet. Preliminary reports indicate workstations are assigning themselves addresses in the range $169.254.0.0/16$ . Place the following diagnostic and remediation steps in the correct chronological sequence to isolate and resolve this DHCP assignment failure according to standard network troubleshooting methodology.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with verifying the client's APIPA state, followed by checking the local gateway's DHCP relay helper address, auditing intermediate firewall filtering rules for UDP ports 67/68, inspecting DHCP server scope statistics, and finally renewing the client IP lease.

The correct troubleshooting sequence follows the standard CompTIA troubleshooting framework, moving logically from host symptom verification to local gateway relay inspection, intermediate network path filter checks, backend server scope verification, and final client validation.

Step-by-Step Solution

Inspect client network configuration using `ipconfig /all`.

Confirms host has an Automatic Private IP Addressing (

169.254.x.x

) address, indicating DHCPDISCOVER requests timed out.

Establishing the baseline symptom on the local host isolates the scope of the problem to IP address auto-configuration failure.

Check the VLAN 30 interface configuration on the default gateway switch.

Verifies whether the `ip helper-address` directive is properly configured to forward DHCP broadcasts across subnet boundaries as unicast packets.

Since clients reside on a separate subnet from the central DHCP server, missing relay configuration is the most common cause of multi-VLAN DHCP failure.

Audit ACLs and security rules along the path between relay agent and DHCP server.

Ensures that unicast DHCP requests (UDP port 67) and responses (UDP port 68) are permitted through network firewalls.

Even with a valid helper address, network transport controls can drop unicast relay packets before reaching the server.

Examine the DHCP server scope statistics for

10.30.0.0/24

Determines if the IP address pool has been exhausted or if the scope is deactivated.

If the relay agent successfully reaches the server, the server must have an active pool with unassigned addresses to grant a lease.

Re-issue a DHCP request on the client via `ipconfig /renew`.

Confirms the host acquires a valid

10.30.0.0/24

IP address, subnet mask, default gateway, and DNS servers.

Verifying functionality directly on the affected host ensures the issue is fully remediated and tests the complete end-to-end lease acquisition process.

Key Concept

Troubleshooting DHCP Relay and IP Addressing Services across Subnets

Question 252Question →

A network analyst suspects that an improper MTU size configuration on a newly deployed site-to-site IPsec VPN gateway is causing large HTTPS file transfers to fail. The analyst performs a ping sweep using unfragmented packets ( $1400$ bytes with the Don't Fragment flag set) and confirms that packets exceeding $1380$ bytes are dropped at the tunnel interface. Having verified the cause of the issue, which step should the analyst take next according to the CompTIA troubleshooting methodology?

Develop a plan of action to adjust the interface MTU and TCP MSS settings while identifying potential side effects.

Immediately modify the MTU size on the production router interface to restore full payload transmission.

Log the ping test results, exact byte limits, and root cause analysis in the IT ticketing system database.

Interview affected remote office workers to gather detailed logs on when the HTTPS timeout symptoms first started.

Show answer & explanation

Answer: Develop a plan of action to adjust the interface MTU and TCP MSS settings while identifying potential side effects.

Answer

Develop a plan of action to adjust the interface MTU and TCP MSS settings while identifying potential side effects.

The correct response reflects Step 4 of the CompTIA troubleshooting methodology: 'Establish a plan of action to resolve the problem and identify potential side effects.' Because the analyst just finished testing and validating the theory (Step 3) via ping tests with the DF flag, the direct next requirement is to plan the resolution and evaluate potential side effects before executing changes.

Step-by-Step Solution

Identify the current step in the CompTIA troubleshooting methodology.

The technician tested the theory using unfragmented ping tests and confirmed the cause (Step 3: Test the theory to determine cause).

Determining the completed phase establishes where the analyst currently sits in the sequential methodology.

Determine the required next step in the standard 6-step CompTIA process.

Following Step 3 (Test theory), the next sequential step is Step 4: Establish a plan of action to resolve the problem and identify potential side effects.

Before making changes to production network equipment, a comprehensive plan and risk assessment must be established.

Key Concept

CompTIA Troubleshooting Methodology Step Order

Estimated Time:1m 15s

Question 253Question →

A network technician is responding to connectivity issues reported by forklift operators in a distribution warehouse. The operators report that handheld Wi-Fi scanners frequently disconnect and fail to roam when driving deep into storage aisles. A wireless site survey indicates that while ceiling-mounted omnidirectional Access Points (APs) along the central walkway maintain strong signal strength of $-60\text{ dBm}$ , the signal drops significantly to $-85\text{ dBm}$ inside the aisle rows filled with metallic racks and densely stacked inventory. Which of the following is the primary cause of this issue, and what is the most effective solution?

RF absorption and attenuation caused by physical metallic structures; install directional patch antennas focused down each storage aisle.

Adjacent-channel interference on the 2.4 GHz band; reconfigure neighboring access point radios to use overlapping channel 3.

Duplex mismatch between the Access Points and switchports; reconfigure physical switch interface speeds manually to half-duplex.

Failure of DHCP server lease renewals; configure static APIPA addresses on all handheld wireless scanners.

Show answer & explanation

Answer: RF absorption and attenuation caused by physical metallic structures; install directional patch antennas focused down each storage aisle.

Answer

The primary cause is RF absorption and attenuation caused by physical metallic structures. The recommended solution is to install directional patch antennas focused down each storage aisle.

Dense metallic shelving and warehouse inventory absorb and reflect radio frequency (RF) signals, causing high attenuation and creating wireless dead zones in aisles. Installing directional patch antennas aims the wireless beam down the corridor of each aisle, concentrating signal strength where handheld scanners operate.

Step-by-Step Solution

Analyze the site survey data and environment description.

The signal drops from

-60\text{ dBm}

in the main walkway to a weak

-85\text{ dBm}

inside the aisles surrounded by metal shelving and inventory.

Dense metal structures act as physical RF barriers, causing signal attenuation and reflection.

Evaluate the current antenna design versus environmental requirements.

Omnidirectional antennas radiate signal in a 360-degree pattern, which gets blocked and absorbed by high metal shelves.

Omnidirectional antennas are ineffective when RF propagation is restricted by narrow, metallic corridors.

Select the appropriate antenna type for aisle coverage.

Directional patch antennas focus the RF radiation beam pattern down specific paths.

Aiming directional antennas down the length of each aisle overcomes localized attenuation and ensures reliable roaming for warehouse clients.

Key Concept

RF Attenuation & Directional Antenna Selection

Estimated Time:1m 30s

Question 254Question →

A network technician needs to trace an unlabeled copper UTP cable run from a wall jack in a user's office to its corresponding port on a patch panel in the telecommunications closet. Which of the following diagnostic tools is best suited for this task?

Tone generator and probe kit

Time Domain Reflectometer (TDR)

Loopback plug

Multimeter

Show answer & explanation

Answer: Tone generator and probe kit

Answer

The tone generator and probe kit is the correct tool for tracing an unlabeled cable run from an office wall jack to a patch panel port.

A tone generator and probe kit (commonly referred to as a toner probe) is specifically designed to trace copper cabling. The generator attaches to one end of the cable run to emit an electrical signal, and the technician uses the inductive probe near the patch panel to hear where the signal is strongest, pinpointing the correct termination.

Step-by-Step Solution

Identify the diagnostic objective

The task requires locating the specific physical termination of an intact copper cable run across two rooms.

The technician needs to identify which patch panel port corresponds to a specific wall outlet without disconnecting unrelated cables.

Select the appropriate diagnostic hardware tool

Choose a tone generator and probe kit.

The tone generator injects a high-frequency audio signal into the cable at the wall jack, and the inductive probe generates an audible tone when placed near the target wire at the patch panel.

Key Concept

Cable Tracing and Identification Tools

Question 255Question →

A network technician is troubleshooting a switch-to-switch trunk link that is dropping traffic. Reviewing the switch console logs reveals a native VLAN mismatch error, while interface statistics report high numbers of late collisions. Which TWO configuration actions should the technician take to resolve these issues? (Select TWO.)

Select all that apply

Reconfigure both ends of the trunk link to use the same native VLAN ID.

Configure matching duplex settings (or enable auto-negotiation on both ends) for the trunk interfaces.

Set the Spanning Tree Protocol (STP) priority to 0 on both switches to clear the interface block.

Assign IP addresses from different subnets to the two switch interfaces without a Layer 3 router.

Show answer & explanation

Answer: Reconfigure both ends of the trunk link to use the same native VLAN ID.; Configure matching duplex settings (or enable auto-negotiation on both ends) for the trunk interfaces.

Answer

The technician should configure identical native VLAN IDs on both switch trunk ports and ensure matching duplex settings across the link.

To resolve native VLAN mismatch errors, both ends of the 802.1Q trunk must be configured with the exact same native VLAN ID so untagged frames are correctly directed. To resolve late collisions, both switch ports must agree on duplex settings (either both forced to full-duplex or both using auto-negotiation), eliminating collision detection conflicts.

Step-by-Step Solution

Identify the causes of the reported trunk errors from the symptoms.

The log message indicates an 802.1Q native VLAN mismatch, while late collisions point to a duplex mismatch.

Late collisions occur when one side operates in full-duplex while the other operates in half-duplex, while native VLAN mismatch occurs when trunk endpoints use different untagged VLAN IDs.

Select the correct remediation for native VLAN mismatch.

Aligning the native VLAN ID on both switch trunk interfaces resolves frame leakage and drops.

802.1Q trunking requires both ends of a trunk to agree on which VLAN carries untagged traffic.

Select the correct remediation for duplex mismatch.

Configuring matching duplex settings (or auto-negotiation on both sides) restores clean frame transmission.

Matching duplex settings ensures both ports transmit and listen according to the same collision rules.

Key Concept

Troubleshooting 802.1Q native VLAN mismatches and interface duplex mismatches on switch trunks.

Question 256Question →

A network administrator is troubleshooting host reachability issues on an enterprise dual-stack network. Workstations cannot connect to an internal server using its hostname `app.internal.example.com`, though direct IPv6 ping tests succeed. The administrator executes the following troubleshooting command from a client system:

C:\> nslookup app.internal.example.com
Server: dns01.internal.example.com
Address: 10.0.0.53

*** dns01.internal.example.com can't find app.internal.example.com: Non-existent domain

Next, the administrator runs `nslookup -type=AAAA app.internal.example.com`, which successfully returns the IPv6 address `2001:db8:85a3::8a2e:370:7334`.

Which of the following is the root cause of the initial resolution failure?

The DNS server lacks an IPv4 address (A) record for the target host, and the default query requested an A record.

The local DNS client is configured to send DNS queries over TCP port 53 instead of UDP port 53.

The command-line lookup utility misinterpreted the non-authoritative answer flag returned by the DNS server.

The DNS server service is configured to listen on port 5353 instead of standard port 53.

Show answer & explanation

Answer: The DNS server lacks an IPv4 address (A) record for the target host, and the default query requested an A record.

Answer

The DNS server lacks an IPv4 address (A) record for the target host, and the default query requested an A record.

The initial nslookup command without specified parameters queries for IPv4 address (A) records by default. Because the DNS server only contains an IPv6 address (AAAA) record for app.internal.example.com, the initial lookup fails with a 'Non-existent domain' or record missing error. Explicitly setting -type=AAAA successfully retrieves the IPv6 mapping.

Step-by-Step Solution

Analyze the default nslookup output.

The tool queries the primary DNS server (10.0.0.53) for app.internal.example.com without explicit parameters, defaulting to an IPv4 host (A) record request.

Standard DNS resolution tools query for A records unless specified otherwise.

Compare the default command with the explicit -type=AAAA query.

The explicit query returns the IPv6 address 2001:db8:85a3::8a2e:370:7334.

This confirms that a valid AAAA record exists in DNS, but no A record has been created for IPv4.

Determine the root cause.

The failure occurs because the DNS zone lacks an A record while the client default lookup relies on A record resolution.

Creating an A record (or ensuring dual-stack applications query AAAA records) resolves the name resolution issue.

Key Concept

DNS Record Types and Default Command-Line Query Behavior

Question 257Question →

A network technician needs to inspect a newly terminated Category 6 UTP patch cable to confirm proper T568B pinout alignment and verify that there are no open or shorted conductor pairs. Which TWO of the following diagnostic tools are designed to verify conductor continuity and pinout arrangement on copper twisted-pair cables?

Select all that apply

Wiremapper

Cable certifier

Optical power meter

Tone generator and probe

Show answer & explanation

Answer: Wiremapper; Cable certifier

Answer

Wiremapper and Cable certifier

Both a wiremapper and a cable certifier test individual copper conductors in a twisted-pair Ethernet cable for pin alignment, shorts, opens, and reversed pairs.

Step-by-Step Solution

Identify the cabling test requirement.

The requirement is to verify pinout mapping (T568B) and check for electrical continuity issues (opens/shorts) on Category 6 UTP copper cable.

Pinout arrangement and conductor continuity are Layer 1 electrical properties of twisted-pair copper media.

Evaluate diagnostic tools designed for copper pinout and continuity verification.

Wiremappers test pin-to-pin electrical connections across twisted pairs. Cable certifiers also execute wiremap tests as part of their comprehensive standard verification.

Both tools connect to both ends of a copper cable run to analyze pinout configuration.

Rule out non-applicable tools.

Optical power meters test fiber optics rather than copper conductors, while tone probes trace cable paths without analyzing individual pin connections.

Selecting media-appropriate diagnostic equipment prevents incorrect diagnosis of cabling faults.

Key Concept

Diagnostic tool selection for copper cabling continuity and pinout verification

Question 258Question →

A network administrator installs a new set of IP phones on a dedicated voice VLAN (VLAN 40). The enterprise DHCP server resides on VLAN 10. The phones fail to obtain IP addresses and automatically configure APIPA addresses instead. Which TWO of the following resolution actions or diagnostic steps should the technician perform to troubleshoot and resolve this issue? (Select TWO)

Select all that apply

Configure an IP helper address (DHCP relay agent) pointing to the DHCP server IP on the VLAN 40 router interface.

Verify that intermediate firewalls and access control lists (ACLs) permit UDP ports 67 and 68 traffic between VLAN 40 and VLAN 10.

Assign static APIPA addresses (169.254.x.x) to the phones so they can route traffic through the default gateway.

Change the DHCP scope subnet mask from /24 to /25 to double the number of available usable host IP addresses.

Show answer & explanation

Answer: Configure an IP helper address (DHCP relay agent) pointing to the DHCP server IP on the VLAN 40 router interface.; Verify that intermediate firewalls and access control lists (ACLs) permit UDP ports 67 and 68 traffic between VLAN 40 and VLAN 10.

Answer

The technician should configure an IP helper address (DHCP relay agent) on the VLAN 40 gateway interface and verify that intermediate ACLs permit traffic on UDP ports 67 and 68.

DHCP client requests rely on Layer 2 broadcasts that default gateway routers do not forward. Configuring an IP helper address (DHCP relay) on the interface facing the client subnet enables the router to encapsulate DISCOVER broadcasts into unicast packets directed to the central DHCP server. Additionally, verifying that security controls permit traffic on UDP ports 67 and 68 ensures that relayed DHCP traffic passes through intermediate interfaces without being dropped.

Step-by-Step Solution

Identify the cause of cross-subnet DHCP request drops

Recognize that client DHCP DISCOVER messages are Layer 2 broadcasts that routers drop by default.

Devices on remote VLANs require a DHCP relay agent (IP helper) on their default gateway to forward broadcast requests as unicast traffic to a central DHCP server.

Verify transport protocol accessibility between subnets

Check that firewalls or router ACLs permit traffic on UDP ports 67 and 68.

Even with a relay agent active, restrictive security rules blocking UDP ports 67/68 will prevent relayed unicast DHCP messages from reaching the server or returning to the client.

Key Concept

Troubleshooting Cross-Subnet DHCP Relay and Port Accessibility

Question 259Question →

A network engineer is troubleshooting a newly deployed 10GBASE-LR single-mode optical fiber link between two distribution switches spaced 2 kilometers apart. An optical power meter registers an excessive loss of $14\text{ dB}$ across the link, significantly exceeding the maximum insertion loss budget of $2.5\text{ dB}$ , despite both transceiver end-face connectors passing visual inspection with a fiber microscope. Which diagnostic tool should the engineer utilize to measure reflections and pinpoint the precise location and cause of the attenuation fault along the fiber run?

Optical Time-Domain Reflectometer (OTDR)

Visual Fault Locator (VFL)

Optical Power Meter (OPM) with a stabilized light source

Tone generator with an inductive probe

Show answer & explanation

Answer: Optical Time-Domain Reflectometer (OTDR)

Answer

The Optical Time-Domain Reflectometer (OTDR) is the correct tool because it analyzes Rayleigh backscattering and Fresnel reflections over distance to pinpoint specific attenuation faults.

The Optical Time-Domain Reflectometer (OTDR) is designed specifically to trace optical fiber cables by sending light pulses down the fiber and analyzing backscattered light. It produces a graph displaying loss against distance, allowing engineers to identify the exact distance to high-attenuation events such as macrobends, splices, or physical breaks.

Step-by-Step Solution

Evaluate the symptom and requirements

The optical fiber link experiences excessive signal loss (

14\text{ dB}

) somewhere along a 2 km span, but connectors are clean.

End-to-end power testing confirmed an issue exists, but does not provide distance or location details.

Assess diagnostic tool capabilities for fiber optics

An OTDR transmits pulsed light signals down the fiber strand and records the amplitude and timing of reflected light signals.

This signature trace identifies event locations (e.g., sharp bends, bad splices, or physical stress) relative to distance from the transmitter.

Select the correct physical layer diagnostic tool

Select the Optical Time-Domain Reflectometer (OTDR).

It is the only instrument capable of pinpointing fault distances along an extended optical cable pathway.

Key Concept

Pinpointing Fiber Optic Cable Faults with OTDR

Estimated Time:2m 0s

Question 260Question →

Match each command-line network utility on the left with its primary diagnostic function on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

ping matches reachability verification; tracert matches hop-by-hop path tracing; nslookup matches DNS query testing; netstat matches active connections and listening ports inspection.

Each utility targets a distinct diagnostic domain: ping tests basic ICMP reachability; tracert maps route paths and hop latencies; nslookup queries DNS infrastructure; and netstat inspects active protocol connections and listening ports on the local machine.

Step-by-Step Solution

Identify the basic reachability tool

ping sends ICMP requests to check if a remote host is reachable.

ping is the primary tool for testing Layer 3 ICMP echo response.

Identify the route tracing tool

tracert identifies intermediate router hops and latency along a path.

tracert increments TTL values to discover each router along the path to a destination.

Identify the name resolution diagnostic tool

nslookup queries DNS servers directly.

nslookup evaluates DNS record lookups and name resolution issues.

Identify the protocol and session statistics tool

netstat lists active connections and open ports on the local endpoint.

netstat provides socket-level information for active TCP/UDP sessions.

Key Concept

Command-Line Network Troubleshooting Utilities

Estimated Time:45s

PreviousPage 13 / 25Next

Network Troubleshooting

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept