Network Troubleshooting

486 questions

Question 281Question

A network technician is performing physical layer and wireless infrastructure testing across a corporate facility. Match each diagnostic troubleshooting scenario to the most appropriate hardware testing tool required to resolve the issue.

Click a left item, then click its matching right item

Items

Identifying pin assignment errors, such as split pairs or transposed conductors, on a newly terminated Cat6\text{Cat6} twisted-pair run.
Measuring signal strength loss in dBm\text{dBm} received at a fiber patch panel from a remote switch transceiver.
Detecting sources of non-802.11802.11 radio frequency interference that disrupt wireless access point communications.
Verifying direct current (DC\text{DC}) voltage levels supplied across cable pairs to power a PoE IP surveillance camera.

Matches

Show answer & explanation

Answer

Wiremap tester corresponds to identifying split pairs on copper cabling; Optical power meter corresponds to measuring fiber signal power in dBm; Spectrum analyzer corresponds to detecting non-802.11 RF interference; Multimeter corresponds to measuring DC voltage for PoE devices.
Each tool maps directly to its intended layer and physical parameter: wiremap testers analyze pin continuity and miswires on copper UTP; optical power meters quantify light attenuation in dBm\text{dBm} on fiber links; spectrum analyzers inspect raw RF spectrum energy for non-802.11 interference; and multimeters measure DC\text{DC} electrical voltage levels for PoE power testing.

Step-by-Step Solution

1
Analyze copper UTP pinout termination faults.
Confirm that split pairs and pin mapping require pin-by-pin continuity analysis.
Wiremap testers specifically check conductor pairings and pin continuity.
2
Analyze optical signal measurement requirements.
Determine that light intensity in dBm\text{dBm} requires optical power detection.
Optical power meters quantify light output levels from fiber transceivers.
3
Analyze wireless RF interference detection requirements.
Select raw RF energy analysis over standard Wi-Fi packet analysis.
Spectrum analyzers detect raw electromagnetic signals, including non-Wi-Fi RF sources.
4
Analyze power delivery troubleshooting on PoE endpoints.
Select electrical voltage measurement.
Multimeters measure electrical properties like DC\text{DC} voltage supplied over cabling.

Key Concept

Selecting Appropriate Hardware Testing Tools for Physical and Wireless Troubleshooting
Question 282Question

A network technician is diagnosing host reachability issues and executes a query using the `dig` command-line utility on a Linux workstation to verify name resolution for `app.corp.local`:

text
$ dig app.corp.local

; <<>> DiG 9.18.1-1-Debian <<>> app.corp.local
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 41205
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; QUESTION SECTION:
;app.corp.local. IN A

;; AUTHORITY SECTION:
corp.local. 3600 IN SOA ns1.corp.local. admin.corp.local. 2026072601 7200 3600 1209600 3600

;; Query time: 12 msec
;; SERVER: 192.168.10.5#53(192.168.10.5)

Which of the following describes the root cause of the name resolution failure based on the command output?

Show answer & explanation

Answer: The domain zone exists, but no IPv4 host (A) record is configured for the requested hostname.

Answer

The target domain zone exists on the authoritative server, but no IPv4 host (A) record is defined for the requested hostname.
In `dig` utility output, a header status of `NOERROR` paired with `ANSWER: 0` and an authoritative `SOA` record returned in the `AUTHORITY` section indicates a NODATA condition. This occurs when the DNS server is reachable and holds the domain zone, but no resource record matching the requested name and record type exists.

Step-by-Step Solution

1
Examine the dig command header and flags
The header status displays NOERROR with query time 12 msec from server 192.168.10.5.
This confirms that network connectivity exists and the DNS server responded successfully to the query.
2
Inspect the ANSWER and AUTHORITY sections
ANSWER is 0, while the AUTHORITY section returns the zone Start of Authority (SOA) record.
This condition represents a DNS NODATA response, confirming that the zone `corp.local` is present on the server, but the specified hostname `app.corp.local` has no corresponding A record entry.

Key Concept

DNS NODATA Response and Dig Output Interpretation
Estimated Time:1m 30s
Question 283Question

A network engineer is analyzing several Layer 2 switching and trunking issues across an enterprise network. Match each observed switch diagnostic indicator or log message on the left to its underlying root cause on the right.

Click a left item, then click its matching right item

Items

Console log repeatedly displays %CDP-4-NATIVE_VLAN_MISMATCH while untagged management frames spill into inappropriate VLANs across the inter-switch link.
Interface statistics report a high count of late collisions, duplex mismatch symptoms, and frame check sequence (FCS) errors on a link set to full-duplex.
A non-root switch port unexpectedly transitions to an STP Blocking state after receiving BPDUs with a bridge priority of 4096 from an unauthorized access switch.
Tagged traffic for VLAN 50 is dropped across an 802.1Q trunk interface, while untagged native traffic and other tagged VLANs transit normally.

Matches

Show answer & explanation

Answer

Each diagnostic indicator corresponds directly to a specific Layer 2 misconfiguration: Native VLAN mismatch CDP logs indicate differing native VLAN configurations across the trunk; late collisions indicate an autonegotiation mismatch resulting in half-duplex operation on one peer; unexpected STP blocking indicates a superior BPDU causing root bridge re-election; and specific tagged VLAN traffic dropping indicates pruning via the trunk allowed VLAN list.
The correct pairings accurately associate specific diagnostic output to their root causes: %CDP-4-NATIVE_VLAN_MISMATCH directly indicates conflicting native VLAN configurations on trunk endpoints; late collision counters indicate a duplex mismatch where one end operates half-duplex; unexpected STP blocking states result from receiving superior BPDUs with a lower bridge priority; and isolated VLAN traffic dropping across a trunk indicates an incomplete trunk allowed VLAN list.

Step-by-Step Solution

1
Analyze the CDP log message regarding native VLAN mismatch.
Identify that 802.1Q trunking sends native VLAN traffic untagged. If native VLAN IDs differ on opposite sides, CDP logs an explicit mismatch error.
Matching native VLAN configurations are required on both ends of an 802.1Q trunk for proper untagged frame processing.
2
Examine interface collision counters and error types.
Recognize that late collisions (collisions occurring after transmitting the first 512 bits / 64 bytes of a frame) are a definitive diagnostic indicator of a duplex mismatch, typically caused when one port is hardcoded to full-duplex and the connected port falls back to half-duplex autonegotiation.
Full-duplex interfaces do not test for carrier sense or collisions, transmitting while the half-duplex side is mid-frame.
3
Evaluate Spanning Tree Protocol (STP) state changes.
Determine that receiving a BPDU with a priority value of 4096 (lower than the default 32768) represents a superior BPDU, forcing STP topology re-convergence and altering port blocking states.
STP elects the switch with the lowest Bridge ID (Priority + MAC address) as the root bridge.
4
Correlate selective VLAN dropping on trunk links.
Confirm that when specific VLAN traffic is dropped while other VLANs succeed, the affected VLAN ID has been omitted from the allowed list configured on the trunk port.
Trunk interfaces only forward traffic for VLANs explicitly permitted in their allowed VLAN list.

Key Concept

Layer 2 VLAN, Trunking, and STP Troubleshooting Indicators
Question 284Question

Following a rack migration inside a data center, a 10GBASE-SR OM4 multimode fiber patch run connecting two distribution switches experiences high rates of frame check sequence (FCS) errors and intermittent link flapping. An optical power meter confirms that overall received optical signal power is within acceptable decibel-milliwatt (dBm) thresholds, and inspecting connector end-faces shows no contamination. Which diagnostic tool should the network engineer use to locate the exact position and measure the magnitude of localized optical reflections or physical macrobends along the concealed cable run?

Show answer & explanation

Answer: Optical Time-Domain Reflectometer (OTDR)

Answer

An Optical Time-Domain Reflectometer (OTDR) is the required tool because it analyzes Rayleigh backscattering and Fresnel reflections to pinpoint exact distance measurements and attenuation loss for physical fiber faults.
An Optical Time-Domain Reflectometer (OTDR) injects light pulses into an optical fiber and analyzes the backscattered and reflected light returning along the strand. By measuring the timing and intensity of these reflections, an OTDR creates a trace graph that precisely locates high-loss events (such as macrobends, bad connectors, or tight cable ties) in terms of exact distance from the tester.

Step-by-Step Solution

1
Analyze the reported link symptoms and media type.
The issue involves a multimode optical fiber link experiencing FCS errors and intermittent link flapping despite acceptable total optical power levels.
This indicates localized physical impairments (such as a tight bend radius or faulty splice point) that cause signal distortion/reflection rather than complete signal loss.
2
Evaluate the capabilities of potential optical diagnostic tools.
An OPM only provides aggregate end-to-end power measurements, whereas an OTDR characterizes events along the entire length of the fiber strand.
OTDR injection of optical pulses allows precise distance mapping to specific reflective or non-reflective loss events.
3
Select the correct physical layer troubleshooting tool.
The Optical Time-Domain Reflectometer (OTDR) is chosen.
It is specifically designed for optical fiber reflection event localization, unlike copper TDRs or simple tone probes.

Key Concept

Fiber Optic Fault Localization with OTDR
Estimated Time:2m 0s
Question 285Question

A network engineer is responding to an enterprise network outage affecting internal application access after an infrastructure update. Arrange the following administrative troubleshooting actions in the correct sequence according to the official CompTIA troubleshooting methodology, starting from the earliest phase to the final phase.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct operational sequence follows CompTIA's official 6-step troubleshooting methodology: 1. Identify the problem (gather symptoms and duplicate the issue), 2. Establish a theory of probable cause (question the obvious/OSI layer analysis), 3. Test the theory to determine the cause (simulate in a lab), 4. Establish a plan of action to resolve the problem and implement the solution (develop change plan and deploy rollback/fix), 5. Verify full system functionality and implement preventive measures (confirm user access and configure alerts), and 6. Document findings, actions, and outcomes (log entry in ticket system).
CompTIA Network+ strictly requires adhering to the six sequential steps of troubleshooting: 1. Identify the problem (gathering symptoms), 2. Establish a theory of probable cause (evaluating hypotheses), 3. Test the theory (confirming root cause in lab/test environment), 4. Establish a plan of action and implement the solution (change control execution), 5. Verify full system functionality and implement preventive measures (end-to-end testing and monitoring), and 6. Document findings, actions, and outcomes (ticketing log update).

Step-by-Step Solution

1
Perform initial user interviews, duplicate failure symptoms, and check recent change logs.
Defines problem scope and boundaries (CompTIA Step 1: Identify the problem).
Troubleshooting must begin with clear problem identification before formulating theories.
2
Analyze symptoms and question obvious physical/logical factors to build a working hypothesis.
Establishes probable cause theory focused on switch ACL misconfiguration (CompTIA Step 2: Establish a theory of probable cause).
Formulating a targeted hypothesis prevents unguided and disruptive changes.
3
Test the hypothesis in a lab or staging setup without impacting production traffic.
Confirms the exact cause of the failure (CompTIA Step 3: Test the theory to determine cause).
Testing validates the theory before executing modifications on live network infrastructure.
4
Draft a resolution procedure with change control approval and execute the configuration fix.
Implements the solution safely (CompTIA Step 4: Establish a plan of action to resolve the problem and implement the solution).
Structured implementation minimizes risks of unintended secondary outages.
5
Test system reachability across affected user segments and install proactive monitoring.
Ensures full system operation and prevents future occurrences (CompTIA Step 5: Verify full system functionality and, if applicable, implement preventive measures).
Verification ensures the issue is resolved completely and won't reoccur immediately.
6
Update incident tickets and knowledge base articles with configuration details and root cause.
Completes the lifecycle documentation (CompTIA Step 6: Document findings, actions, and outcomes).
Documentation provides historical context and reference for future troubleshooting.

Key Concept

CompTIA Troubleshooting Methodology
Question 286Question

A network administrator provisions a new VLAN (VLAN 80, subnet 10.80.4.0/2210.80.4.0/22) on a core multilayer switch. The central enterprise DHCP server resides on VLAN 10 at IP address 10.10.0.1010.10.0.10. Workstations connected to VLAN 80 fail to receive IP configuration parameters dynamically, resulting in clients auto-configuring 169.254.x.x169.254.x.x IPv4 addresses. A packet capture on the VLAN 80 switchport confirms that workstations are successfully broadcasting `DHCPDISCOVER` packets, but no `DHCPOFFER` packets return. Which of the following interface configuration omissions on the VLAN 80 Layer 3 gateway interface is the root cause of this connectivity issue?

Show answer & explanation

Answer: The Layer 3 gateway interface for VLAN 80 is missing an `ip helper-address 10.10.0.10` directive to relay broadcast DHCP requests to the remote DHCP server.

Answer

The Layer 3 gateway interface for VLAN 80 is missing an `ip helper-address 10.10.0.10` directive to relay broadcast DHCP requests to the remote DHCP server.
The correct answer correctly identifies that routers break broadcast domains. When client hosts and the DHCP server reside on different VLANs/subnets, the client gateway interface (VLAN 80) must be configured with an IP helper address (`ip helper-address 10.10.0.10`). This encapsulates client `DHCPDISCOVER` broadcasts into unicast packets routed directly to the DHCP server on VLAN 10.

Step-by-Step Solution

1
Analyze client symptoms and diagnostic packet capture output.
Workstations self-assign APIPA addresses (169.254.x.x169.254.x.x) and send broadcast `DHCPDISCOVER` frames, but receive zero `DHCPOFFER` responses.
This confirms Layer 2 local connectivity is operational, but Layer 3 DHCP traffic is failing to reach the cross-subnet DHCP server.
2
Evaluate router/switch Layer 3 boundary behavior for broadcast traffic.
Routers block MAC/IP broadcast packets (255.255.255.255255.255.255.255) by default.
Because the DHCP server resides on VLAN 10 (10.10.0.1010.10.0.10) and clients are on VLAN 80 (10.80.4.0/2210.80.4.0/22), the router interface must act as a DHCP Relay Agent.
3
Identify the mandatory configuration required to relay DHCP traffic.
Configuring `ip helper-address 10.10.0.10` under the VLAN 80 SVI/subinterface enables the gateway to forward broadcast `DHCPDISCOVER` messages as unicast packets directly to the DHCP server.
Without this directive, the DHCP requests never reach VLAN 10.

Key Concept

DHCP Relay / IP Helper Address Configuration in Multi-VLAN Environments
Question 287Question

A network engineer is troubleshooting high packet loss and throughput degradation on an 8 km 10GBASE-LR single-mode fiber link connecting two core switches. The switch SFP+ modules report optical receive power levels comfortably within receiver sensitivity thresholds (4 dBm-4\text{ dBm} received vs. a receiver sensitivity range of 14 dBm-14\text{ dBm} to +0.5 dBm+0.5\text{ dBm}). Interface counters show zero FCS or CRC frame errors. An Optical Time-Domain Reflectometer (OTDR) test reveals a high-amplitude reflective Fresnel spike with an Optical Return Loss (ORL) of 22 dB-22\text{ dB} at 3.2 km3.2\text{ km}, while overall fiber end-to-end attenuation remains normal at 0.4 dB/km0.4\text{ dB/km}. Concurrently, packet captures exhibit repeated TCP Out-of-Order and Fast Retransmission packets. Which of the following physical layer anomalies is the primary cause of the degradation?

Show answer & explanation

Answer: A contaminated or damaged optical connector at 3.2 km causing high back-reflection that destabilizes the transmitter laser diode.

Answer

A contaminated or damaged optical connector at 3.2 km causing high back-reflection that destabilizes the transmitter laser diode is the primary cause of the network degradation.
The correct answer identifies that a contaminated or damaged connector end-face creates an air gap causing Fresnel reflection. In high-speed single-mode fiber systems (10 Gbps10\text{ Gbps} and above), back-reflection toward the optical transmitter destabilizes the laser source through optical feedback, leading to physical bit stream corruptions, frame loss, and TCP retransmissions despite adequate optical receive power.

Step-by-Step Solution

1
Analyze the physical layer OTDR measurement data.
The OTDR indicates normal linear optical attenuation (0.4 dB/km0.4\text{ dB/km}) and sufficient receiver power (4 dBm-4\text{ dBm}), eliminating complete fiber breaks or high macrobend signal absorption as the root cause. However, it highlights a large reflective event (Fresnel spike with ORL of 22 dB-22\text{ dB}) at 3.2 km3.2\text{ km}.
High reflectance events in single-mode fiber (SMF) typically indicate air gaps, dirty end-faces, or mismatched polish types (e.g., UPC plugged into APC) at connection points.
2
Correlate physical reflection (ORL) with transmitter stability and packet capture symptoms.
High Optical Return Loss (ORL) causes optical power to reflect straight back into the transmitting laser cavity (optical feedback). This destabilizes the laser diode's operational wavelength and output phase (laser jitter/mode hopping), introducing bit-level errors.
When bit-level signal degradation occurs dynamically due to laser instabilities, receiver clock recovery fails, causing lost frames and triggering TCP Fast Retransmissions without necessarily registering structured Layer 2 CRC errors.
3
Evaluate alternative explanations.
Macrobends cause non-reflective power loss (low receiver power), 10GbE fiber does not support half-duplex negotiation, and TCP MSS misconfigurations are pure Layer 4 issues incapable of generating OTDR reflective spikes.
Only optical back-reflection at a dirty or damaged connector matches both the OTDR reflective spike and the packet capture loss symptoms while maintaining normal receiver power levels.

Key Concept

Optical Time-Domain Reflectometry (OTDR) Fresnel Reflection and Optical Return Loss (ORL) Troubleshooting
Question 288Question

A network systems engineer is troubleshooting an issue where a newly provisioned Linux database server cannot communicate with remote clients or download updates from an off-site repository at 172.16.50.10172.16.50.10. The server interface configuration and routing table display the following CLI output:

$ ip addr show dev eth0
inet 192.168.45.200/27 brd 192.168.45.223 scope global eth0

$ ip route show
default via 192.168.45.225 dev eth0
192.168.45.192/27 dev eth0 proto kernel scope link src 192.168.45.200

$ ping -c 2 172.16.50.10
connect: Network is unreachable

Based on the diagnostic output, which of the following identifies the root cause of the connectivity failure?

Show answer & explanation

Answer: The configured default gateway address resides outside the host's IPv4 subnet boundaries.

Answer

The configured default gateway address resides outside the host's IPv4 subnet boundaries.
The CIDR prefix /27 establishes subnets in increments of 32 host addresses. For the network starting at 192.168.45.192/27192.168.45.192/27, the usable host addresses span from 192.168.45.193192.168.45.193 to 192.168.45.222192.168.45.222, and the broadcast address is 192.168.45.223192.168.45.223. The default gateway address of 192.168.45.225192.168.45.225 belongs to the next network segment (192.168.45.224/27192.168.45.224/27). Because the default gateway is not on the same local subnet as the server interface, the operating system cannot ARP for the gateway or route packets out of the interface, generating the 'Network is unreachable' error.

Step-by-Step Solution

1
Calculate the subnet boundaries from the CIDR prefix
For prefix /27, the block size is 23227=322^{32-27} = 32. The network address is 192.168.45.192192.168.45.192, giving a host address range of 192.168.45.193192.168.45.193 through 192.168.45.222192.168.45.222, with broadcast 192.168.45.223192.168.45.223.
Determining the valid usable IP address range is necessary to check if the host and gateway reside on the same Layer 3 segment.
2
Analyze the configured host IP and default gateway IP
Host IP 192.168.45.200192.168.45.200 falls within 192.168.45.192/27192.168.45.192/27. The default gateway 192.168.45.225192.168.45.225 falls in the adjacent subnet 192.168.45.224/27192.168.45.224/27.
A host can only directly communicate via Layer 2 ARP with a default gateway that shares its local IP subnet.
3
Evaluate the kernel error message
The OS kernel rejects sending off-subnet packets because the target default gateway cannot be resolved on the directly attached link, raising 'Network is unreachable'.
Confirms the failure originates at local Layer 3 configuration rather than network ACLs or switch VLANs.

Key Concept

Default Gateway Subnet Alignment
Estimated Time:2m 0s
Question 289Question

A network administrator is troubleshooting an enterprise wireless network in a multi-story office building. Employees carrying laptops along hallways report brief disconnections and video call freezes when moving between adjacent Access Points (APs). A site survey indicates that AP transmit power is set to maximum on all units (23 dBm23\text{ dBm}), whereas client devices transmit at around 12 dBm12\text{ dBm}. Furthermore, seamless roaming protocols are currently unconfigured. Which of the following statements correctly identify a root cause or a proper remediation step for this issue? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The APs' high transmit power causes sticky client behavior, because clients detect a strong downlink signal from distant APs and fail to roam to closer APs; reducing AP transmit power will resolve this.; Enabling 802.11r (Fast BSS Transition) on the wireless controller will reduce re-authentication latency during inter-AP roaming.

Answer

The connection drops during roaming are caused by power asymmetry (sticky clients) and the lack of fast-roaming standards. The issue is resolved by reducing AP transmit power to match client capabilities and enabling 802.11r Fast BSS Transition.
Excessive AP transmit power creates coverage asymmetry where client devices perceive a strong signal from a distant AP and refuse to roam to a closer AP (sticky client). Lowering AP power aligns downlink and uplink boundaries. Additionally, enabling 802.11r (Fast BSS Transition) allows handshakes to complete prior to AP transitions, preventing re-authentication delays.

Step-by-Step Solution

1
Analyze RF signal power asymmetry
Determined that AP transmit power (23 dBm) significantly exceeds client transmit capability (12 dBm), leading to sticky client behavior.
Reducing AP transmit power balances the cell boundaries so clients initiate roaming when their uplink degraded.
2
Evaluate wireless roaming authentication handoffs
Identified that full re-authentication pauses real-time applications when moving between access points.
Enabling 802.11r allows key caching across APs to eliminate authentication overhead during handoffs.

Key Concept

Wireless Roaming Optimization and Power Matching
Question 290Question

A network technician is troubleshooting connectivity for workstations in a newly configured department. The workstations are connected to access ports on Switch-A assigned to VLAN 20. However, none of the hosts can acquire an IP address from the DHCP server located across an 802.1Q trunk link connected to the core switch. The technician issues the following CLI command on Switch-A interface GigabitEthernet0/1:

text
Switch-A# show interfaces trunk

Port Mode Encapsulation Status Native vlan
Gi0/1 on 802.1q trunking 1

Port Vlans allowed on trunk
Gi0/1 1-10,30-100

Port Vlans in spanning tree forwarding state and not pruned
Gi0/1 1,10,30,40

Based on the terminal output and symptoms, which configuration issue on interface GigabitEthernet0/1 is preventing communication for hosts on VLAN 20?

Show answer & explanation

Answer: VLAN 20 is absent from the trunk interface allowed VLAN list.

Answer

VLAN 20 is absent from the trunk interface allowed VLAN list.
The correct answer identifies that VLAN 20 is missing from the 802.1Q trunk allowed list. The command output indicates that interface GigabitEthernet0/1 only permits VLAN ranges 1-10 and 30-100. Consequently, frames originating from access ports in VLAN 20 are pruned at the trunk boundary and cannot reach external network services like DHCP.

Step-by-Step Solution

1
Examine the 'Vlans allowed on trunk' field in the interface trunk output.
The range specified is '1-10,30-100'.
By default, an 802.1Q trunk allows VLANs 1-4094, but explicit filtering using the switchport trunk allowed vlan command restricts allowed traffic.
2
Compare the department VLAN ID with the allowed VLAN list.
VLAN 20 falls outside the allowed ranges (1-10 and 30-100).
When a VLAN ID is omitted from the allowed list, the switch interface discards incoming frames tagged with that VLAN ID and will not forward outgoing frames for that VLAN.
3
Determine the required resolution to restore traffic flow.
Execute 'switchport trunk allowed vlan add 20' on interface GigabitEthernet0/1.
Adding VLAN 20 permits tagged frames for VLAN 20 to transit the trunk link to reach the upstream DHCP server and gateway.

Key Concept

802.1Q Trunk Allowed VLAN Filtering
Question 291Question

A network engineer must select the appropriate diagnostic tool for various troubleshooting tasks across an enterprise network infrastructure. Match each troubleshooting requirement on the left with the most suitable hardware tester or packet analysis tool on the right.

Click a left item, then click its matching right item

Items

Locating the exact distance to a conductor short circuit on a 70-meter copper UTP cable run
Measuring Near-End Crosstalk (NEXT) and attenuation to verify TIA/EIA Category 6A compliance
Verifying current draw, voltage drop, and negotiated wattage under active load for an IEEE 802.3bt device
Inspecting raw 802.1X EAPOL handshake frames and 802.1Q VLAN header tags in real time

Matches

Show answer & explanation

Answer

Each troubleshooting requirement maps to its specific diagnostic tool based on physical layer signal measurements or data link/network layer packet decodes: fault distance locating maps to the Time-Domain Reflectometer (TDR); NEXT and attenuation compliance verification maps to the Cable Certifier; active power delivery validation maps to the Inline PoE Tester; and real-time frame/header inspection maps to the Packet Analyzer.
The matches correctly pair each diagnostic challenge with its purpose-built tool: distance-to-fault measurements require a Time-Domain Reflectometer (TDR); TIA/EIA standard compliance certification for crosstalk and attenuation requires a Cable Certifier; real-time voltage/amperage load testing for high-power standards like IEEE 802.3bt requires an Inline PoE Tester; and granular frame decoding for 802.1X or 802.1Q protocols requires a Packet Analyzer.

Step-by-Step Solution

1
Analyze physical cabling fault measurement needs
Locating physical conductor distance to a fault requires measuring signal reflection delay over time.
A Time-Domain Reflectometer (TDR) is engineered specifically to calculate fault distance on copper cables by analyzing reflected electrical pulses.
2
Evaluate standards verification and high-frequency noise parameters
Measuring NEXT and attenuation against TIA/EIA specifications requires high-frequency signal analysis beyond basic pinout continuity.
Cable certifiers execute comprehensive frequency sweeps across all wire pairs to validate compliance with standards such as Category 6A.
3
Examine active power delivery and load conditions for switch drops
Testing IEEE 802.3bt power delivery demands measuring voltage drops and current draw under simulated or active load.
An inline PoE tester measures live power negotiation, voltage level, and amperage draw to verify sufficient power budget and delivery.
4
Identify the level of protocol frame inspection required
Decoding 802.1X EAPOL handshakes and 802.1Q tags requires protocol packet capture and decoding at Layers 2 and 3.
A packet analyzer captures network frames and decodes individual field headers for troubleshooting authentication and VLAN tagging issues.

Key Concept

Selecting network diagnostic tools based on physical signal characteristics, power standards, and OSI layer frame analysis.
Estimated Time:2m 0s
Question 292Question

A network technician needs to perform a localized hardware diagnostic test on a workstation's network interface card (NIC) to verify that its physical transmission and reception circuitry are functioning correctly without connecting the host to an active network switch. Which tool should the technician plug directly into the Ethernet port to conduct this test?

Show answer & explanation

Answer: Loopback plug

Answer

Loopback plug
A loopback plug connects the output (transmit) pins directly to the input (receive) pins on a network interface port. This enables self-testing of the adapter's physical hardware signaling and port integrity without requiring external network connectivity.

Step-by-Step Solution

1
Identify the diagnostic requirement
The test requires verifying physical transmission (Tx) and reception (Rx) functions of a local Ethernet port in isolation.
Determining hardware operational status requires a closed electrical signal path directly at the physical interface.
2
Evaluate hardware tester capabilities
Connecting a loopback plug routes the Tx pins back into the Rx pins of the same RJ-45 port.
This configuration allows diagnostic software or link indicator LEDs to confirm that physical port circuitry can send and receive electrical signals properly.

Key Concept

Utilizing Hardware Loopback Plugs for Interface Testing
Question 293Question

A network administrator is addressing an incident where remote users connected via SSL VPN cannot access internal intranet sites following a gateway software update. The administrator conducted diagnostic packet captures on the gateway and confirmed that the internal security policy was dropping traffic from the SSL VPN IP pool due to an unmapped subnet mask. Which of the following actions should the administrator take NEXT according to the CompTIA troubleshooting methodology?

Show answer & explanation

Answer: Establish a plan of action to modify the gateway security policy and identify potential side effects.

Answer

The administrator should establish a plan of action to modify the gateway security policy and identify potential side effects.
In the CompTIA troubleshooting methodology, once a theory of probable cause has been tested and verified (Step 3), the network administrator must establish a plan of action to resolve the issue and identify potential effects (Step 4) before implementing changes.

Step-by-Step Solution

1
Analyze the current state in the troubleshooting sequence
The administrator performed packet captures and confirmed the root cause (unmapped subnet mask in security policy dropping SSL VPN traffic), which completes Step 3 (Test the theory to determine cause).
Identifying the current step determines which step must follow logically according to the CompTIA methodology.
2
Determine the immediate next step in the CompTIA 7-step methodology
The step directly following 'Test the theory to determine cause' is 'Establish a plan of action to resolve the problem and identify potential effects'.
CompTIA methodology strictly mandates planning and risk identification prior to applying configuration changes to network devices.

Key Concept

CompTIA Troubleshooting Methodology Step Sequence
Estimated Time:1m 15s
Question 294Question

A network security administrator is investigating an incident where external application servers fail to establish TCP sessions with an authentication daemon running on a Linux system. The administrator executes `ss -tulpn` on the target host and receives the following terminal output snippet:

Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
tcp LISTEN 0 128 127.0.0.1:8443 0.0.0.0:* users:(("auth_svc",pid=8812,fd=4))

Based on this command output, which of the following statements correctly identifies the root cause of the connectivity failure for remote clients?

Show answer & explanation

Answer: The authentication daemon is bound exclusively to the IPv4 loopback interface, preventing remote network adapters from accepting incoming connections on port 8443.

Answer

The authentication daemon is bound exclusively to the IPv4 loopback interface, preventing remote network adapters from accepting incoming connections on port 8443.
The `ss -tulpn` output shows that the process `auth_svc` is listening on `127.0.0.1:8443`. In IP networking, binding to `127.0.0.1` restricts socket traffic to internal inter-process communication on the local loopback interface. Remote hosts trying to reach port 8443 over external physical network interfaces will be unable to establish a TCP connection because the operating system will not route external packets to the loopback adapter.

Step-by-Step Solution

1
Analyze the CLI command and options executed.
The administrator ran `ss -tulpn`, which displays socket statistics for TCP (`-t`), UDP (`-u`), listening sockets (`-l`), numeric ports (`-n`), and associated processes (`-p`).
Understanding the CLI switches confirms that the output represents active listening sockets on the local system.
2
Inspect the socket binding IP address in the Local Address:Port column.
The socket displays `127.0.0.1:8443` in the LISTEN state.
The IP address `127.0.0.1` represents the IPv4 loopback interface.
3
Evaluate the network impact of binding to 127.0.0.1.
Sockets bound strictly to loopback (`127.0.0.1` or `::1`) accept traffic originated locally within the same operating system kernel and automatically drop packets arriving from external subnets.
To accept external connections, the service must bind to `0.0.0.0` (all IPv4 interfaces), `::` (all IPv6 interfaces), or the host's specific network interface IP address.

Key Concept

Socket Interface Binding and Listening States in CLI Utilities
Estimated Time:2m 0s
Question 295Question

A network technician is configuring a newly deployed server in a corporate data center. The server is assigned the IPv4 address 10.100.15.7010.100.15.70 with a subnet mask of 255.255.255.192255.255.255.192 (/26) and a default gateway of 10.100.15.110.100.15.1. During testing, the server can communicate with local hosts in the 10.100.15.64/2610.100.15.64/26 IP range, but it cannot access devices on remote subnets or reach the default gateway. Which of the following best explains why the server cannot reach its default gateway?

Show answer & explanation

Answer: The server IP address and default gateway reside on different IP subnets due to the configured subnet mask length.

Answer

The server IP address and default gateway reside on different IP subnets due to the configured subnet mask length.
With a subnet mask of 255.255.255.192255.255.255.192 (/26), the network is partitioned into subnets of 64 addresses each. The host address 10.100.15.7010.100.15.70 belongs to the subnet span 10.100.15.6410.100.15.64 through 10.100.15.12710.100.15.127. However, the configured default gateway address 10.100.15.110.100.15.1 belongs to the previous subnet span 10.100.15.010.100.15.0 through 10.100.15.6310.100.15.63. Because a host and its default gateway must reside within the same local IPv4 subnet to establish Layer 2 ARP adjacency, the server cannot send traffic outside its local segment.

Step-by-Step Solution

1
Determine the subnet boundaries for host IP 10.100.15.7010.100.15.70 with mask 255.255.255.192255.255.255.192 (/26).
A /26 mask has a block size of 256192=64256 - 192 = 64. The subnets are 10.100.15.0/2610.100.15.0/26 (10.100.15.010.100.15.0 to 10.100.15.6310.100.15.63) and 10.100.15.64/2610.100.15.64/26 (10.100.15.6410.100.15.64 to 10.100.15.12710.100.15.127).
Calculating subnet ranges identifies which addresses belong to the same local broadcast domain.
2
Compare the placement of the server IP and default gateway IP within the calculated subnets.
The server IP (10.100.15.7010.100.15.70) falls into the 10.100.15.64/2610.100.15.64/26 subnet, whereas the default gateway IP (10.100.15.110.100.15.1) falls into the 10.100.15.0/2610.100.15.0/26 subnet.
A host can only communicate directly with its default gateway if both share the same IP subnet.
3
Formulate the root cause diagnosis.
Because the server and gateway reside on different subnets, the server considers the gateway off-link and cannot perform direct Layer 2 ARP resolution to reach it.
This subnet mismatch prevents off-subnet traffic routing.

Key Concept

Default Gateway Subnet Mismatch
Question 296Question

A network technician receives complaints regarding intermittent disconnections and low throughput on wireless medical carts within a clinic's newly renovated wing. A signal survey reveals that when moving from the hallway into exam rooms separated by lead-lined drywall shielding, the Received Signal Strength Indicator (RSSI) drops significantly from 60 dBm-60\text{ dBm} to 86 dBm-86\text{ dBm}. Which wireless signal issue is the primary cause of this performance degradation?

Show answer & explanation

Answer: Signal attenuation and absorption resulting from dense physical building materials

Answer

Signal attenuation and absorption resulting from dense physical building materials
Radio frequency (RF) attenuation refers to the loss of signal strength as electromagnetic waves travel through space or pass through physical obstacles. Dense building materials such as lead-lined walls, concrete, and metal reflect or absorb RF energy, leading to a drastic drop in RSSI (such as 60 dBm-60\text{ dBm} dropping to 86 dBm-86\text{ dBm}).

Step-by-Step Solution

1
Analyze the diagnostic measurements provided in the scenario
The measured RSSI decreases drastically from 60 dBm-60\text{ dBm} to 86 dBm-86\text{ dBm} when entering specific exam rooms.
Identifying changes in physical signal power helps isolate Layer 1 radio frequency (RF) propagation issues.
2
Correlate signal power reduction with environmental factors
The signal drops specifically when passing through lead-lined drywall shielding.
Dense materials like metal, lead, and concrete absorb wireless energy, reducing signal amplitude (attenuation).
3
Select the correct physical RF phenomenon
Attenuation/absorption is the primary cause of signal loss across physical barriers.
Other issues like channel overlap or IP addressing do not drop RF signal levels (RSSIRSSI).

Key Concept

RF Attenuation and Absorption in Wireless Networks
Estimated Time:1m 30s
Question 297Question

Match each physical network cabling fault or diagnostic scenario on the left with the most appropriate diagnostic tool or corrective action on the right.

Click a left item, then click its matching right item

Items

Excessive Near-End Crosstalk (NEXT) measured on a newly terminated Category 6A UTP drop.
High optical attenuation occurring at a localized spot along a fiber optic patch cable route.
Severe signal degradation on an Ethernet link despite passing a basic wiremap continuity test for pin-to-pin conductivity.
Need to trace an unidentified structural copper cable run to its specific port location on a patch panel.

Matches

Show answer & explanation

Answer

The physical cabling faults match their respective corrective actions and diagnostic tools as follows: Excessive NEXT requires re-terminating the connector with minimal pair untwisting; localized high fiber attenuation is located using an OTDR; split pairs that pass basic continuity require a cable certifier; and tracing an unlabeled copper cable run requires a tone generator with an inductive probe.
Each physical layer issue maps directly to its proper diagnostic tool or remediation practice according to TIA/EIA cabling standards: NEXT errors on copper stems from pair untwisting; fiber loss points require distance reflection analysis via OTDR; split pairs bypass basic continuity checks and require dynamic certifiers; and tracing copper drops requires tonal signal injection.

Step-by-Step Solution

1
Analyze the copper crosstalk scenario (Excessive NEXT on Cat 6A).
Identify that NEXT is caused by electromagnetic interference between adjacent pairs near the connector, which occurs when wire pairs are untwisted excessively during termination.
Maintaining pair twist up to 0.5 inches (13 mm) of the termination point is required to preserve differential noise cancellation.
2
Analyze the optical fiber attenuation scenario.
Determine that a localized point of high optical loss over a fiber link requires distance-based attenuation measurement, which is the primary function of an OTDR.
An Optical Power Meter (OPM) only measures total end-to-end loss, whereas an OTDR pinpoints the exact location of high-loss events like macrobends.
3
Analyze the pin continuity vs. crosstalk error scenario.
Recognize that a split pair maintains straight-through electrical continuity (pin 1 to pin 1, pin 2 to pin 2) but pairs non-matching wires together, breaking pair twisting benefit.
Basic wiremappers check only DC continuity and fail to detect split pairs; full frequency cable certifiers test NEXT/FEXT performance to identify the error.
4
Analyze the cable identification requirement.
Match the tracing requirement with tone generator and probe tools (toner).
Injecting a tone signal allows non-destructive identification of specific cables in high-density distribution panels.

Key Concept

Physical Layer Cabling Diagnostics and Tool Selection
Question 298Question

A network engineer is troubleshooting an issue where a host server (10.20.10.45/2410.20.10.45/24) cannot reach a database server (172.16.80.12/24172.16.80.12/24) across a multi-router topology containing active Access Control Lists (ACLs). Following the standard CompTIA network troubleshooting methodology, in what sequence should the engineer execute the following diagnostic and remediation steps?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct troubleshooting sequence follows the standard CompTIA methodology: 1. Identify the problem by gathering symptoms and testing basic gateway reachability; 2. Establish a theory of probable cause by analyzing routing and ACL logs; 3. Test the theory by running diagnostic CLI commands such as inspecting access lists; 4. Establish a plan of action and implement the fix by modifying the ACL rules; 5. Verify full system functionality and document the outcome.
The correct sequence adheres strictly to the CompTIA troubleshooting framework: Identify the problem (gathering symptoms and pinging gateway), Establish a theory of probable cause (analyzing traceroute and logs), Test the theory (inspecting ACL rule match counters via CLI), Establish a plan of action and implement the solution (reordering ACL permit/deny statements), and Verify full system functionality while documenting the outcome.

Step-by-Step Solution

1
Gather symptoms and run baseline reachability checks (ping local gateway and target host).
Establishes scope and confirms the boundaries of the reachability failure.
CompTIA troubleshooting methodology dictates identifying the problem as the first step.
2
Formulate a theory of probable cause based on traceroute output and network topology inspection.
Narrows potential causes to gateway unreachable, missing route, or ACL implicit deny.
Establishing a theory occurs after gathering preliminary diagnostic information.
3
Test the theory using targeted diagnostic commands (`show ip access-lists`).
Confirms the exact point of failure (e.g., traffic matching an unwanted ACL deny statement).
Theory testing must confirm the root cause before any configuration changes are made.
4
Develop a plan of action and modify the ACL configuration on the router.
Remediates the root cause by allowing required traffic through the gateway filter.
Implementation of fixes occurs only after the root cause is confirmed during theory testing.
5
Verify end-to-end connectivity and update documentation.
Ensures complete resolution and prevents regression.
Verification and documentation constitute the final steps of the structured troubleshooting framework.

Key Concept

CompTIA Structured Network Troubleshooting Methodology applied to Gateway, Routing, and ACL failures
Question 299Question

A network technician is investigating reports that several workstations on a corporate subnet (10.250.12.0/2410.250.12.0/24) are intermittently assigned IP addresses in an unrecognized pool (172.16.99.0/24172.16.99.0/24), causing them to lose connection to internal network resources. Place the following troubleshooting and remediation steps in the correct chronological order from the initial diagnostic step to final verification.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct troubleshooting sequence is: 1) Run `ipconfig /all` on an affected endpoint, 2) Compare the DHCP server IP address against authorized documentation, 3) Query switch MAC address tables to locate the rogue server switch port, 4) Shut down the switch port and enable DHCP Snooping on untrusted ports, 5) Perform `ipconfig /release` and `ipconfig /renew` on client endpoints and verify connectivity.
Following CompTIA's troubleshooting methodology, an engineer must first identify problem symptoms on affected endpoints (`ipconfig /all`). Analyzing the output reveals an unauthorized DHCP server IP address. Next, checking network documentation confirms the server is rogue. The engineer must then locate the rogue hardware by looking up its MAC address in access switch MAC tables. Once located, the engineer disables the rogue server's port and enables DHCP Snooping to prevent unauthorized DHCP offer packets on untrusted switch ports. Finally, affected clients release and renew their IP configurations to receive valid leases from the legitimate server.

Step-by-Step Solution

1
Identify client-side symptoms using terminal commands
Obtained the anomaly details, specifically that the client DHCP server IP is 172.16.99.254172.16.99.254.
CompTIA troubleshooting methodology dictates establishing the problem by gathering information directly from affected devices first.
2
Evaluate findings against baseline network documentation
Confirmed 172.16.99.254172.16.99.254 is not listed among authorized corporate DHCP servers, confirming a rogue DHCP server.
Distinguishing between authorized network servers and rogue devices requires comparing configuration details against established documentation.
3
Locate the physical source of the rogue service
Mapped the rogue server's MAC address to a specific access port on the switch.
Tracing the MAC address through switch forwarding tables pins down the exact physical location of the rogue hardware.
4
Remediate the immediate vulnerability and implement hardening
The port hosting the rogue device is disabled, and DHCP Snooping is configured to drop unauthorized DHCP offers.
Administrative shutdown contains the issue, and security controls prevent recurrences of rogue DHCP servers on user ports.
5
Restore functionality and verify solution
Workstations obtain valid IP addresses from the legitimate server (10.250.12.0/2410.250.12.0/24) and re-establish gateway connectivity.
Releasing and renewing leases clears invalid network settings and verifies that normal DHCP operations are restored.

Key Concept

Rogue DHCP Server Identification, Isolation, and DHCP Snooping Mitigation
Estimated Time:2m 30s
Question 300Question

A network technician is troubleshooting an issue where a client workstation (10.1.10.5/2410.1.10.5/24) cannot access a web application hosted on a remote server (172.16.20.50/24172.16.20.50/24). Place the following diagnostic and remediation steps in the correct chronological order, adhering to standard CompTIA troubleshooting methodology from initial local verification through resolution.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct troubleshooting sequence is: 1) Ping the local default gateway, 2) Execute traceroute to locate the failing hop, 3) Check the routing table on the failing router, 4) Inspect interface ACLs for filtering rules, and 5) Modify the ACL and perform end-to-end verification.
The correct order follows the standard bottom-up/top-down structured troubleshooting approach: first verify local default gateway connectivity, then use path detection (traceroute) to find the failure point, inspect the routing table on that router, check for restrictive ACL filtering rules, and finally apply the fix and verify end-to-end reachability.

Step-by-Step Solution

1
Test local subnet gateway connectivity using ping.
Confirms client host network stack and local router interface are operational.
Always test closest local dependencies before diagnosing remote infrastructure.
2
Perform path discovery using traceroute to destination IP 172.16.20.50.
Pinpoints the exact intermediate router hop where traffic ceases to forward.
Narrows down the scope of network devices requiring inspection.
3
Examine the IP routing table on the failing router using `show ip route`.
Verifies whether a valid next-hop or exit interface route exists for 172.16.20.0/24.
Determines if the issue is layer 3 route reachability or packet filtering.
4
Review active ACL entries applied to inbound/outbound interfaces using `show ip access-lists`.
Identifies if traffic matching 10.1.10.5 to 172.16.20.50 is caught by a deny rule or implicit deny.
If routing exists, access control filtering is the next logical root cause to inspect.
5
Apply correct ACL permit statement and verify application connectivity.
Restores full end-to-end functionality and verifies the fix.
Remediates the root cause and verifies complete solution functionality.

Key Concept

Structured network troubleshooting methodology for routing, default gateways, and ACL filtering.
Estimated Time:2m 0s
PreviousPage 15 / 25Next
Network Troubleshooting Practice Questions — CompTIA Network+ — Page 15 | Examkin