Network Troubleshooting

486 questions

All types486 Multiple choice248 Multiple select111 Matching61 Ordering66

A network administrator observes that network traffic across multiple VLANs is taking a sub-optimal path through a legacy access switch rather than the primary core switch. Output from `show spanning-tree` reveals that the legacy access switch is currently operating as the Spanning Tree Protocol (STP) Root Bridge because the primary core switch has a configured STP priority of 61440, while the access switch retains the default priority of 32768. Which configuration change on the core switch will resolve the issue and force it to become the STP Root Bridge?

Lower the STP bridge priority value on the core switch to a value less than 32768 (such as 4096).

Increase the STP bridge priority value on the core switch to 65535 to give it maximum precedence.

Configure a different native VLAN on the core switch trunk interfaces to force a topology recalculation.

Move each VLAN to a separate physical switch to eliminate Layer 2 broadcast domains entirely.

Show answer & explanation

Answer: Lower the STP bridge priority value on the core switch to a value less than 32768 (such as 4096).

Answer

Lower the STP bridge priority value on the core switch to a value less than 32768 (such as 4096).

Spanning Tree Protocol uses the lowest Bridge ID (Priority + MAC address) to select the Root Bridge. Lowering the bridge priority value on the core switch below the access switch's priority (e.g., to 4096) ensures the core switch is elected Root Bridge, aligning traffic flow with the intended network design.

Step-by-Step Solution

Analyze STP Root Bridge Election Criteria

STP elects the Root Bridge based on the lowest Bridge ID, which is composed of Bridge Priority (default 32768) + MAC Address.

The switch with the lowest numeric priority value becomes the designated root of the spanning tree topology.

Evaluate Current Configurations

The core switch currently has a priority of 61440 (higher/worse than default), whereas the access switch has a default priority of 32768.

Because 32768 is lower than 61440, the access switch became the Root Bridge.

Determine Correct Administrative Action

Configure the core switch with an STP bridge priority lower than 32768 (e.g., in multiples of 4096, such as 4096 or 0).

This guarantees the core switch wins the Root Bridge election and establishes optimal traffic paths.

Key Concept

STP Root Bridge Election and Priority Hierarchy

Estimated Time:1m 30s

Question 362Question →

A network administrator working on a Windows host is troubleshooting a connection failure to an off-site database server at IP address $198.51.100.25$ running on TCP port $5432$ . Place the following command-line diagnostic procedures in the correct logical sequence, following a standard bottom-up network troubleshooting methodology starting from local network configuration verification up to specific transport-layer service testing.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct logical order begins with local host configuration analysis (ipconfig /all), proceeds to default gateway ICMP verification (ping 192.168.1.1), follows with path route tracing (tracert 198.51.100.25), and concludes with targeted transport-layer port testing (Test-NetConnection 198.51.100.25 -Port 5432).

Following the CompTIA and standard OSI bottom-up troubleshooting methodology, an administrator must first verify local host network interface and address configuration (ipconfig /all), then test local network Layer 3 reachability to the default gateway (ping 192.168.1.1), followed by path analysis across intermediate routers to the target destination IP (tracert 198.51.100.25), and lastly validate specific transport-layer TCP port availability (Test-NetConnection -Port 5432).

Step-by-Step Solution

Verify host IP setup

Confirm local IP, subnet mask, and gateway address using ipconfig /all.

Troubleshooting higher layers is invalid if the local machine lacks a valid IP address or local routing table entry.

Verify local gateway reachability

Confirm Layer 3 ICMP communication using ping 192.168.1.1.

Ensures the host can forward IP packets off the local broadcast domain to its configured gateway router.

Verify multi-hop path integrity

Identify intermediate hop failures using tracert 198.51.100.25.

Determines whether packet loss occurs on the internal network, ISP WAN links, or remote edge routers.

Verify Layer 4 port connectivity

Test TCP port 5432 handshake using Test-NetConnection 198.51.100.25 -Port 5432.

Validates that firewalls permit traffic on TCP 5432 and that the remote database daemon actively accepts connection requests.

Key Concept

Layered Command-Line Network Troubleshooting Workflow

Estimated Time:2m 0s

Question 363Question →

A network administrator is investigating severe application response delays and dropped connections on a critical database server connected via a Category 6 UTP cable drop. The administrator suspects both physical Layer 1 signal degradation along the cable run and Layer 4 transmission issues caused by excessive dropped segments. Which TWO of the following diagnostic tools or analyzer techniques should the administrator utilize to isolate the root causes at both layers? (Select TWO.)

Select all that apply

Connect a Time-Domain Reflectometer (TDR) to measure signal reflections and pinpoint the precise distance to impedance mismatches or cable breaks.

Apply a packet analyzer display filter for TCP analysis flags to identify duplicate acknowledgments and retransmissions.

Use a simple tone generator and probe kit to measure signal attenuation and Near-End Crosstalk (NEXT) across the twisted pairs.

Attach a loopback plug to the workstation network adapter to analyze transport-layer window size adjustments and TCP header flags.

Show answer & explanation

Answer: Connect a Time-Domain Reflectometer (TDR) to measure signal reflections and pinpoint the precise distance to impedance mismatches or cable breaks.; Apply a packet analyzer display filter for TCP analysis flags to identify duplicate acknowledgments and retransmissions.

Answer

The administrator should use a Time-Domain Reflectometer (TDR) to locate physical cabling defects and apply a packet analyzer display filter for TCP analysis flags to verify Layer 4 packet loss.

Isolating physical copper issues requires a Time-Domain Reflectometer (TDR), which measures signal reflections to calculate distance to cable faults. Simultaneously, diagnosing Layer 4 connection drops requires a packet analyzer filtering for TCP retransmission and duplicate ACK flags to measure segment loss.

Step-by-Step Solution

Address the physical layer cable degradation suspicion

A Time-Domain Reflectometer (TDR) sends signal pulses down copper conductors and analyzes signal reflections to pinpoint impedance mismatches, cable kinks, or shorts along with their exact distance.

Hardware testers like TDRs are required to measure distance-to-fault on copper media.

Address the transport layer protocol performance suspicion

Using a packet analyzer with display filters (such as tcp.analysis.flags) highlights TCP retransmissions, out-of-order packets, and duplicate ACKs.

Packet analyzers capture live network traffic, giving clear visibility into TCP protocol behavior and lost segment recovery.

Key Concept

Combining hardware diagnostic tools (TDR) with packet capture analysis (Wireshark/tcpdump) to isolate multi-layer network failures.

Question 364Question →

A network administrator is troubleshooting an issue where client workstations on a newly provisioned VLAN are receiving APIPA addresses ( $169.254.x.x$ ) instead of valid leases from the centralized DHCP server located on a different subnet. Arrange the troubleshooting steps in the logical order the administrator should execute them to systematically diagnose and resolve the issue.

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct sequence starts with verifying client link status and APIPA configuration, followed by checking the local gateway's IP helper address, testing routing connectivity to the DHCP server, verifying DHCP scope availability on the server, and finally renewing the IP lease on the client host.

Systematic network troubleshooting proceeds from the local client symptom to the local gateway configuration, across the routed network path to the centralized service, and finishes with verification on the client. Verifying local link/APIPA confirms host status. Checking the IP helper configuration ensures DHCP requests cross the VLAN boundary. Testing reachability verifies path routing. Checking server scope ensures address availability. Finally, running `ipconfig /renew` confirms the fix works.

Step-by-Step Solution

Confirm client physical layer connectivity and host IP status.

Establishes that the physical NIC is link-up and confirms failure of local DHCP acquisition (indicated by APIPA

169.254.x.x

Always begin troubleshooting at the affected end host before inspecting network infrastructure.

Check the local router interface configuration for DHCP Relay / IP Helper settings.

Determines whether broadcast DHCP DISCOVER messages are being converted to unicast packets targeted at the remote DHCP server.

Cross-subnet DHCP request delivery relies on a properly configured IP helper address on the client's default gateway interface.

Test IP connectivity from the local gateway to the DHCP server IP.

Verifies Layer 3 routing and ACL permeability between the relay agent and the DHCP server.

If the relay agent cannot communicate with the DHCP server, forwarded DHCP packets will be dropped in transit.

Inspect DHCP server configuration and scope health for the target subnet.

Confirms the scope matching the gateway interface address (`giaddr`) is active, correctly configured, and has unallocated IP addresses.

Even with valid relaying, a missing scope or scope exhaustion will prevent the DHCP server from issuing a lease.

Issue a DHCP lease renewal request from the client host (`ipconfig /renew`).

The client successfully completes the DORA exchange and acquires a valid IPv4 configuration.

Final validation must always be confirmed on the end device that originally experienced the issue.

Key Concept

Standard methodology for cross-subnet DHCP troubleshooting involves validating host status, gateway relaying (IP helper), intermediate routing reachability, server scope availability, and client verification.

Question 365Question →

A network administrator is investigating latency and connectivity issues to an internal database server at $192.168.50.100$ . The administrator executes a command-line utility from a client workstation and receives the following output:

Tracing route to 192.168.50.100 over a maximum of 30 hops

0 Workstation1 [10.1.10.15]
1 10.1.10.1
2 10.2.20.1
3 192.168.50.100

Computing statistics for 75 seconds...
Source to Here This Node/Link
Hop RTT Lost/Sent = Pct Lost/Sent = Pct Address
0 Workstation1 [10.1.10.15]
0/ 100 = 0% |
1 1ms 0/ 100 = 0% 0/ 100 = 0% 10.1.10.1
0/ 100 = 0% |
2 15ms 100/ 100 =100% 100/ 100 =100% 10.2.20.1
0/ 100 = 0% |
3 16ms 0/ 100 = 0% 0/ 100 = 0% 192.168.50.100

Which of the following conclusions best explains the results observed in this command output?

The intermediate router at 10.2.20.1 is configured to drop or rate-limit ICMP control traffic, while end-to-end IP reachability to 192.168.50.100 is fully functional.

The local DNS server at 10.2.20.1 is experiencing a failure during reverse name lookup queries for the target destination host.

The destination host at 192.168.50.100 rejected the connection because of a port and protocol mismatch on the listening transport socket.

The host at 192.168.50.100 cannot process IPv4 traffic due to an incorrect AAAA record configuration on the default gateway.

Show answer & explanation

Answer: The intermediate router at 10.2.20.1 is configured to drop or rate-limit ICMP control traffic, while end-to-end IP reachability to 192.168.50.100 is fully functional.

Answer

The intermediate router at 10.2.20.1 is configured to drop or rate-limit ICMP control traffic, while end-to-end IP reachability to 192.168.50.100 is fully functional.

The output reflects a `pathping` report measuring packet loss per hop over a 75-second window. At hop 2 (

10.2.20.1

), the utility shows

100\%

packet loss at the node level. However, traffic passing through hop 2 to reach the destination at hop 3 (

192.168.50.100

) shows

0\%

overall packet loss. This behavior confirms that the router at hop 2 is intentionally dropping ICMP control packets (a common security/performance setting known as ICMP rate-limiting) while successfully forwarding actual data traffic to the target host.

Step-by-Step Solution

Identify the command-line utility used and its operational behavior.

The command executed is `pathping`, which combines path trace capabilities (`tracert`) with ping statistics collected over an extended sampling interval.

Understanding utility output formatting allows proper distinction between hop-by-hop latency and cumulative loss statistics.

Analyze the loss percentages at hop 2 (10.2.20.1) versus hop 3 (192.168.50.100).

Hop 2 reports 100% loss at 'This Node/Link', whereas hop 3 reports 0% overall loss from source to target.

If actual network packet loss occurred at hop 2, packets destined for hop 3 would also be dropped, resulting in equal or higher loss percentages at hop 3.

Deduce the root cause of the specific hop 2 anomaly.

The router at 10.2.20.1 deliberately drops direct ICMP Echo Request/Time Exceeded messages directed to its control plane to conserve CPU resources while continuing to forward data plane traffic normally.

Router control plane ICMP rate-limiting is standard behavior and does not affect transit traffic destined for subsequent nodes.

Key Concept

Interpreting pathping and ICMP rate-limiting behavior across intermediate network hops.

Question 366Question →

A network administrator is connecting a router at a branch office to the central corporate network via a point-to-point IP link ( $10.200.1.0/30$ ). Ping tests between the local interface ( $10.200.1.1$ ) and the remote interface ( $10.200.1.2$ ) are successful. However, OSPF dynamic routing fails to establish a neighbor adjacency between the two routers.

An audit of the inbound Access Control List (ACL) applied to the router's interface displays the following rules:

text
Extended IP access list INBOUND_FILTER
10 permit tcp any any eq 80
20 permit tcp any any eq 443
30 permit icmp any any
40 deny ip any any

Which of the following is the root cause of the OSPF adjacency failure?

OSPF uses IP protocol 89 directly over IP, which is blocked by the explicit deny statement because it matches neither TCP nor ICMP.

OSPF requires TCP port 89 to establish neighbor relationships, but the ACL only allows TCP traffic on ports 80 and 443.

The remote router interface is configured with a default gateway on an incompatible IP subnet, preventing OSPF reply packets from returning.

The permit icmp rule at line 30 overrides OSPF multicast hello messages, triggering an implicit deny action before evaluating protocol numbers.

Show answer & explanation

Answer: OSPF uses IP protocol 89 directly over IP, which is blocked by the explicit deny statement because it matches neither TCP nor ICMP.

Answer

OSPF uses IP protocol 89 directly over IP, which is dropped by the deny statement because it is neither TCP nor ICMP.

OSPF communicates directly over IP using protocol number 89 rather than using transport-layer protocols like TCP or UDP. Pings succeed because ICMP is explicitly permitted in line 30. However, OSPF packets do not match lines 10, 20, or 30, so they are denied by line 40.

Step-by-Step Solution

Analyze the successful diagnostic test results.

Successful ICMP ping confirms physical layer, data link layer, and IP subnet connectivity between

10.200.1.1

and

10.200.1.2

Rule out physical line faults, IP address mismatches, and basic Layer 3 unreachability.

Examine the protocol behavior of OSPF.

OSPF does not use TCP or UDP; it encapsulates protocol packets directly into IP headers using IP protocol number 89.

Determine the network traffic characteristics of OSPF adjacency maintenance (Hello packets).

Evaluate the inbound interface ACL rules sequentially.

Line 10 permits TCP 80, Line 20 permits TCP 443, Line 30 permits ICMP. OSPF packets (IP protocol 89) match none of these and are dropped by Line 40 (deny ip any any).

Identify why OSPF packets fail to traverse the interface despite successful pings.

Key Concept

ACL Protocol Filtering and OSPF IP Protocol 89

Question 367Question →

A network technician suspects that an SFP transceiver port on a core switch has a faulty internal transmitter or receiver circuit. The technician wants to verify whether the physical port is capable of transmitting and receiving frames without connecting the switch to another active network device or external patch cable. Which hardware tool should the technician insert into the port to perform this isolation test?

Loopback plug

Cable certifier

Tone generator and probe kit

Packet analyzer

Show answer & explanation

Answer: Loopback plug

Answer

The correct tool to test a switch port's internal transmit and receive functionality in isolation is a loopback plug.

A loopback plug routes transmitted signals directly back into the receiving circuits of the local port. This allows network technicians to test whether the transceiver and port hardware are functional without relying on external cables or remote switches.

Step-by-Step Solution

Identify the diagnostic requirement

The requirement is to isolate and test local interface transmit/receive hardware functions without using remote devices or cabling.

Determining hardware port integrity requires bypassing external network factors.

Evaluate hardware diagnostic tools against physical layer isolation capabilities

A loopback plug routes outgoing signals from the transmit pin directly into the receive pin on the exact same port.

This establishes a physical link state and enables interface self-testing.

Select the correct diagnostic tool

The loopback plug provides immediate feedback on whether the transceiver port electronics are functional.

Tools like certifiers or tone probes test external cabling, not internal port loopback circuitry.

Key Concept

Physical Port Diagnostics and Loopback Testing

Question 368Question →

A network technician is inspecting a newly installed Category 6A copper link between a patch panel and an end-user wall outlet that fails to negotiate a 10Gbps connection and frequently drops packets. A cable certifier report indicates a wire map failure with an open circuit on pins 4 and 5, along with severe Near-End Crosstalk (NEXT) on pairs 1-2 and 3-6. Which of the following physical layer conditions are the most likely causes of these test results? (Select TWO.)

Select all that apply

Excessive untwisting of wire pairs near the patch panel punch-down block termination point

An unseated conductor or incomplete crimp on pins 4 and 5 inside the modular connector

Using a tone generator and inductive probe to pinpoint the exact distance to the physical break

An auto-negotiation duplex mismatch between the switch port and the workstation network card

Show answer & explanation

Answer: Excessive untwisting of wire pairs near the patch panel punch-down block termination point; An unseated conductor or incomplete crimp on pins 4 and 5 inside the modular connector

Answer

The correct physical layer causes are excessive untwisting of wire pairs near the termination point and an unseated conductor on pins 4 and 5.

Excessive untwisting of wire pairs removes the inherent noise cancellation of twisted-pair media, inducing high NEXT interference. In addition, an open reading on specific pins indicates an incomplete pin crimp or unseated conductor preventing physical continuity.

Step-by-Step Solution

Analyze the cause of Near-End Crosstalk (NEXT) failure.

Excessive untwisting of pair conductors near termination points degrades inductive noise cancellation.

Maintaining precise pair twists close to the punch-down or modular plug is essential for differential signal noise rejection.

Analyze the cause of the wire map open failure on pins 4 and 5.

Identifies an electrical open circuit at pin positions 4 and 5.

A poor pin crimp or unseated wire prevents electrical contact between the conductor and the jack pin.

Key Concept

Physical layer copper cable troubleshooting, crosstalk mitigation, and wire map diagnostics

Estimated Time:1m 30s

Question 369Question →

A network administrator is troubleshooting various Layer 2 switching and VLAN issues across enterprise access switches. Match each observed diagnostic log output or physical interface condition to its most likely underlying root cause.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Each Layer 2 symptom matches its specific root cause: Native VLAN Mismatch log pairs with mismatched native VLAN IDs on opposing trunk ends; Late collisions with full-duplex pair with a duplex mismatch; VLAN traffic dropping across an active trunk pairs with missing VLAN from the allowed list; Err-disabled state on an access port pairs with BPDU Guard detecting unauthorized BPDUs.

Each diagnostic log or interface status correlates directly to its layer 2 switching root cause. CDP native VLAN mismatch indicates unequal native VLAN IDs. Late collisions on full-duplex interfaces indicate a duplex mismatch with a half-duplex partner. Dropped traffic for a single VLAN across a functional trunk indicates an incomplete allowed VLAN list. An err-disabled host port upon link-up indicates BPDU Guard protective action against incoming switch frame BPDUs.

Step-by-Step Solution

Analyze syslog log `%CDP-4-NATIVE_VLAN_MISMATCH`.

CDP detects disparate native VLAN configurations between the local interface and remote neighbor.

802.1Q trunks must agree on the native VLAN number to prevent cross-VLAN traffic leaking.

Examine interface counter errors reporting late collisions.

Identifies duplex mismatch where one end is configured full-duplex and the connected end is half-duplex.

Full-duplex ports do not check collision domains, while half-duplex hosts retransmit late after 64 bytes.

Evaluate missing VLAN connectivity over active trunk link.

Determines VLAN 50 is omitted from `switchport trunk allowed vlan` configuration.

Trunks prune frames belonging to VLANs not explicitly permitted in their allowed list.

Investigate err-disabled port state on host access interface.

Confirms BPDU Guard trigger due to incoming BPDUs from an unauthorized switch or device.

BPDU Guard disables access ports upon BPDU reception to safeguard STP topology integrity.

Key Concept

Troubleshooting VLAN, Trunking, and Switching Issues

Question 370Question →

Match each command-line diagnostic tool invocation or output artifact to its precise troubleshooting function.

Click a left item, then click its matching right item

Show answer & explanation

Answer

netstat -an matches inspecting active TCP connection states without DNS delays; dig +trace example.com matches performing a top-down iterative DNS resolution path traversal; arp -a with duplicate MAC mappings matches detecting Layer 2 duplicate address assignments or ARP spoofing; and pathping -q 10 matches measuring hop-by-hop latency and packet loss metrics across a routed path.

Each command-line utility is accurately paired with its primary diagnostic function: netstat -an suppresses hostname resolution to view raw socket bindings and states, dig +trace steps iteratively down the DNS delegation tree, an ARP cache showing duplicate MACs highlights Layer 2 conflicts or spoofing, and pathping collects hop-by-hop loss/latency metrics over a specified sample size.

Step-by-Step Solution

Analyze netstat flags and output characteristics

Identified that -a lists all connections/ports and -n prevents DNS resolution, focusing strictly on socket state examination.

Numerical display avoids reverse lookup hangs when network DNS resolution is degraded.

Evaluate the dig query option +trace

Determined that +trace forces dig to iteratively follow referral paths from root servers down to the target zone.

Iterative tracing isolates broken DNS delegation records.

Interpret ARP cache anomaly entries

Recognized that mapping one MAC address to multiple IP addresses indicates a collision or spoofing condition at Layer 2.

Network interface cards must have unique MAC-to-IP relationships in standard ARP tables unless load-balancing technologies are explicitly configured.

Evaluate pathping execution flags

Matched pathping with -q 10 to per-hop packet loss and latency statistical analysis over time.

Pathping sends multiple queries per hop over a sampling window to differentiate between link congestion and router control-plane ICMP rate limiting.

Key Concept

Selecting and interpreting specialized command-line utility switches and outputs during multi-layer diagnostic workflows.

Question 371Question →

A network technician is troubleshooting an intermittent connectivity issue on a 90-meter Category 6 unshielded twisted-pair (UTP) cable run between an intermediate distribution frame (IDF) switch and a desktop workstation. A basic continuity cable tester indicates that all eight conductors are mapped pin-to-pin correctly according to T568B standards. However, the switch port reports frequent cyclic redundancy check (CRC) errors and link flapping. Which diagnostic tool should the technician use to identify the exact distance to the physical fault or impedance mismatch along the cable run?

Time-Domain Reflectometer (TDR)

Tone generator and inductive probe

Optical power meter

Loopback plug

Show answer & explanation

Answer: Time-Domain Reflectometer (TDR)

Answer

A Time-Domain Reflectometer (TDR) should be used to locate the exact position of the cable defect along the copper run.

A Time-Domain Reflectometer (TDR) transmits electrical signal pulses along metallic conductors and measures the reflections caused by physical irregularities. By timing these reflections, a TDR precisely pinpoints the location of impedance mismatches, cable damage, opens, or shorts along copper UTP runs.

Step-by-Step Solution

Analyze the symptoms and initial test results

Basic pin-to-pin continuity is verified, ruling out simple miswires, but CRC errors and link instability point to physical signal degradation or an impedance defect along the cable path.

Simple continuity testers only check DC wire mapping and fail to detect high-frequency signal faults such as impedance anomalies, subtle cable damage, or distance-based breaks.

Select the appropriate physical layer testing tool for copper media analysis

Choose a Time-Domain Reflectometer (TDR).

A TDR injects signals down copper media and measures reflection delays to calculate the precise distance to any impedance disruption, open, or short.

Key Concept

Selecting appropriate physical cabling diagnostic tools for copper media fault isolation

Estimated Time:1m 15s

Question 372Question →

A network administrator is troubleshooting network connectivity for several newly installed point-of-sale (POS) terminals operating on VLAN 40 ( $192.168.40.0/24$ ). Executing `ipconfig /all` on an affected terminal displays an IPv4 address of $169.254.10.45$ with a subnet mask of $255.255.0.0$ and no default gateway specified. The centralized enterprise DHCP server is situated on VLAN 10 ( $10.1.10.5/24$ ), and existing clients on VLAN 10 acquire leases without error.

Which of the following are potential root causes for this issue? (Select TWO.)

Select all that apply

The router or Layer 3 switch interface serving VLAN 40 lacks an IP helper address (DHCP relay agent) pointing to

10.1.10.5

The DHCP server scope corresponding to the

192.168.40.0/24

network is exhausted or deactivated.

The default gateway parameter configured on the POS terminal is set to an address on an incorrect IP subnet.

The client network adapter has a duplex mismatch with the connected switchport, preventing Layer 2 link initialization.

Show answer & explanation

Answer: The router or Layer 3 switch interface serving VLAN 40 lacks an IP helper address (DHCP relay agent) pointing to $10.1.10.5$ .; The DHCP server scope corresponding to the $192.168.40.0/24$ network is exhausted or deactivated.

Answer

The potential root causes are: (1) The router/Layer 3 switch interface for VLAN 40 is missing an IP helper address pointing to the DHCP server on VLAN 10, and (2) The DHCP server scope for subnet 192.168.40.0/24 is exhausted or deactivated.

An APIPA address (

169.254.x.x

) signifies that the host generated its own IP address because it received no DHCP offer. In a multi-VLAN environment where the DHCP server is on a different subnet (VLAN 10), the router interface connecting VLAN 40 must have an IP helper address configured to relay DHCPDISCOVER broadcasts. Additionally, if the relay is functioning properly but the DHCP scope for VLAN 40 is disabled or full, the server will not return a DHCP lease.

Step-by-Step Solution

Analyze the client symptom from the terminal output.

The IP address 169.254.10.45 indicates Automatic Private IP Addressing (APIPA), which occurs when a DHCP client fails to receive a response to its DHCPDISCOVER broadcast.

Recognizing APIPA narrows the troubleshooting focus specifically to DHCP communication failure between the host and the DHCP server.

Evaluate cross-VLAN broadcast behavior and relay requirements.

Since the client resides on VLAN 40 and the server resides on VLAN 10, Layer 3 routers will drop unforwarded broadcast packets. An IP helper address must be configured on the VLAN 40 interface.

DHCP broadcast messages cannot cross router boundaries without explicit relaying configured.

Evaluate DHCP server state for the target subnet.

Even if relaying functions, a scope that is deactivated or depleted of IP addresses will fail to offer an IP lease to requesting clients.

Exhausted or disabled scopes prevent new leases from being issued.

Key Concept

Troubleshooting APIPA symptoms across routed VLAN boundaries (DHCP Relay and Scope Availability)

Estimated Time:1m 30s

Question 373Question →

A client workstation on VLAN 20 ( $10.20.0.50/24$ ) is unable to access an HTTPS service hosted on a server in VLAN 50 ( $10.50.0.100/24$ ). Following the CompTIA network troubleshooting methodology, in what sequence should a network technician perform the following steps to diagnose and resolve this connectivity issue?

Drag items to arrange them in the correct order

Show answer & explanation

Answer

The correct troubleshooting sequence follows the standard CompTIA methodology: verify local IP settings and gateway connectivity (`item_1`), trace the routing path to find the drop location (`item_2`), inspect ACL statements on the dropping interface (`item_3`), apply the necessary ACL permit modification (`item_4`), and verify service restoration from the client (`item_5`).

The correct sequence strictly adheres to the standard CompTIA network troubleshooting methodology: 1) Identify the problem starting with local gateway verification (`item_1`), 2) Establish a hypothesis of remote routing/filtering failure via `traceroute` (`item_2`), 3) Test hypothesis by evaluating ACL rules on the gateway router (`item_3`), 4) Implement the solution by updating the ACL permit statement (`item_4`), and 5) Verify full system functionality by testing client HTTPS access (`item_5`).

Step-by-Step Solution

Gather information and test local network parameters.

Confirms the host has a valid IP address, subnet mask, and functional default gateway.

Always eliminate local physical and link-layer issues before investigating remote infrastructure.

Perform path tracing to locate remote routing failures.

Pinpoints the specific gateway router dropping traffic destined for

10.50.0.100

Traceroute isolates whether the fault is a missing static route, dynamic routing failure, or packet filtering.

Analyze gateway router configuration and ACL rules.

Identifies an unintended ACL drop or implicit deny blocking TCP port 443.

Testing the hypothesis requires checking security rules applied to the routed interfaces.

Apply the corrective configuration change to the ACL.

Permits HTTPS traffic through the router interface.

Implements the solution plan by placing explicit permit rules before implicit deny matches.

Verify complete system functionality.

Ensures the application is accessible and no unintended side effects were created.

Verification confirms the root cause was properly resolved.

Key Concept

CompTIA Network Troubleshooting Methodology applied to Routing, Default Gateways, and ACLs

Question 374Question →

Match each physical layer cabling diagnostic tool with the specific troubleshooting scenario or measurement task for which it is primarily suited.

Click a left item, then click its matching right item

Show answer & explanation

Answer

Time-Domain Reflectometer (TDR) matches with locating distance to a conductor break on copper UTP; Optical Time-Domain Reflectometer (OTDR) matches with detecting macrobends and splice points on fiber; Tone Generator and Inductive Probe matches with identifying an unlabeled cable at the patch panel; Optical Power Meter with Light Source matches with measuring end-to-end dB loss across a fiber segment.

Each tool maps directly to its specialized medium and diagnostic capability: TDR identifies copper fault locations via electrical reflection; OTDR maps optical events and fault distances along fiber; Tone Generator and Probe trace and identify cable paths; and Optical Power Meters calculate total dB signal loss across fiber runs.

Step-by-Step Solution

Analyze copper distance-to-fault testing requirements

Copper TDR uses signal reflection timing to determine exact distance to physical copper faults.

Electrical reflections occur at breaks or shorts, making TDR the proper tool for copper cable fault location.

Analyze fiber distance-to-fault and event location requirements

OTDR uses Rayleigh backscattering and Fresnel reflections to map fiber events along the length of an optical cable.

OTDR provides a graphical trace indicating macrobends, fusion splices, and distance to breaks in optical fiber.

Analyze cable tracing and wire identification requirements

Tone generator and inductive probe trace physical copper wire runs by emitting and detecting audio-frequency signals.

This tool combination allows technicians to locate which physical jack corresponds to a specific wire on a patch panel.

Analyze end-to-end optical signal loss testing requirements

An optical power meter paired with a light source measures total power loss in dB across a fiber link.

Comparing emitted light power to received light power quantifies overall optical attenuation.

Key Concept

Selecting Appropriate Physical Layer Diagnostics for Copper and Fiber Cabling Systems

Question 375Question →

A network administrator is troubleshooting a scenario where IP phones connected to an access switch are unable to obtain IP addresses or reach the gateway on VLAN 50. Meanwhile, workstations on VLAN 10 connected to the same switch are functioning normally across the 802.1Q trunk link to the core switch. Reviewing the access switch configuration reveals that VLAN 50 traffic is being dropped at the trunk port, and VLAN 50 does not appear in the switch's local VLAN database. Which TWO actions must the administrator perform on the access switch to restore network connectivity for the IP phones? (Select TWO)

Select all that apply

Create VLAN 50 in the switch global configuration mode.

Change the native VLAN on the trunk interface to VLAN 50 so IP phone traffic bypasses 802.1Q tagging.

Add VLAN 50 to the allowed VLAN list on the 802.1Q trunk interface.

Decrease the Spanning Tree Protocol (STP) bridge priority value on the access switch for VLAN 50.

Show answer & explanation

Answer: Create VLAN 50 in the switch global configuration mode.; Add VLAN 50 to the allowed VLAN list on the 802.1Q trunk interface.

Answer

The administrator must create VLAN 50 in the global configuration mode and explicitly add VLAN 50 to the allowed VLAN list on the trunk interface.

To forward Layer 2 traffic for a specific subnet/VLAN across a switched network, the VLAN must exist in the switch's local VLAN database and must be permitted on the 802.1Q trunk port connecting to the rest of the network. Creating VLAN 50 globally and adding VLAN 50 to the trunk's allowed VLAN list directly resolves both root causes.

Step-by-Step Solution

Identify missing Layer 2 VLAN definition

Recognize that a switch will not originate or forward traffic for a VLAN if the VLAN ID is not present in its local VLAN database.

VLANs must be explicitly defined in the switch configuration before ports can actively participate in that broadcast domain.

Identify trunk interface filtering restrictions

Determine that trunk links configured with allowed VLAN lists drop traffic for unlisted VLAN IDs.

Adding VLAN 50 to the trunk port's allowed list ensures tagged frames for VLAN 50 can traverse the link between switches.

Key Concept

VLAN Trunking and VLAN Database Configuration

Question 376Question →

Users on a corporate network segment suddenly report an inability to access internal intranet resources and the internet. A technician checks an affected client workstation and runs the `ipconfig /all` command, obtaining the following network output:

IPv4 Address. . . . . . . . . . . : 192.168.1.105(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1

The corporate network standard uses the $10.45.0.0/16$ address space, and authorized enterprise DHCP servers reside at $10.45.1.10$ and $10.45.1.11$ . Which of the following is the most likely root cause of this connectivity failure?

An unauthorized rogue DHCP server connected to the broadcast domain is responding to client lease requests before the enterprise server.

The client workstation failed to communicate with any DHCP server and assigned itself an Automatic Private IP Addressing (APIPA) address.

The IP helper address configured on the Layer 3 switch interface is missing, blocking DHCP traffic from reaching the remote server.

The authorized corporate DHCP server scope has exhausted all usable host IP addresses in the subnet pool.

Show answer & explanation

Answer: An unauthorized rogue DHCP server connected to the broadcast domain is responding to client lease requests before the enterprise server.

Answer

An unauthorized rogue DHCP server connected to the broadcast domain is responding to client lease requests before the enterprise server.

The output demonstrates that the client host successfully obtained an IP address lease (

192.168.1.105

) from a DHCP server operating at

192.168.1.1

. Because the authorized corporate network utilizes the

10.45.0.0/16

range and authorized DHCP servers at

10.45.1.10

and

10.45.1.11

, the presence of a server issuing

192.168.1.x

leases indicates an unauthorized rogue DHCP server on the local broadcast domain.

Step-by-Step Solution

Analyze the output of `ipconfig /all` on the affected host

The host has been assigned IPv4 address

192.168.1.105

by DHCP server

192.168.1.1

Determines the current IP parameters and identifies the server originating the lease.

Compare the assigned lease parameters against official enterprise baseline documentation

The assigned address (

192.168.1.105

) and server (

192.168.1.1

) do not match authorized corporate enterprise DHCP servers (

10.45.1.10

10.45.1.11

) or subnet bounds (

10.45.0.0/16

Distinguishes between authorized network services and unauthorized/extraneous network devices.

Identify the cause of unauthorized lease assignment

A rogue DHCP server (such as a misconfigured SOHO router plugged into an Ethernet wall port) is replying to local broadcast DHCPDISCOVER requests faster than the legitimate remote enterprise DHCP servers.

DHCP operates on a first-come, first-served basis; local rogue responses often arrive before relayed responses from remote servers.

Key Concept

Rogue DHCP Server Detection and Troubleshooting

Question 377Question →

A network technician is provisioning a new telemetry server at a branch office. The server is assigned the IPv4 address $192.168.48.150/25$ . Local testing shows that the server cannot reach external network services or ping its configured gateway. A review of the network configuration details reveals:

- Server IP Address: $192.168.48.150$
- Subnet Mask: $255.255.255.128$ ( $/25$ )
- Default Gateway: $192.168.48.1$
- Router Interface IP: $192.168.48.1/25$

Which of the following identifies the root cause of the connectivity failure?

The default gateway IP address resides on a different IP subnet than the server's configured address.

The host IP address 192.168.48.150 is reserved as the broadcast address for the /25 network.

An access control list on the router is dropping traffic due to an implicit deny rule.

The host and router are on different VLANs and require a Spanning Tree protocol update to communicate.

Show answer & explanation

Answer: The default gateway IP address resides on a different IP subnet than the server's configured address.

Answer

The server's configured default gateway address resides on a different IP subnet than the host address itself.

A host device requires its default gateway IP address to reside within the same local IP subnet so it can discover the gateway's MAC address via ARP. With a /25 subnet mask (255.255.255.128), the network is split into two subnets: 192.168.48.0/25 (192.168.48.0 - 192.168.48.127) and 192.168.48.128/25 (192.168.48.128 - 192.168.48.255). The server's IP address (192.168.48.150) is in the second subnet, while the default gateway (192.168.48.1) is in the first subnet. Because they are on separate subnets, the host cannot route traffic to external destinations.

Step-by-Step Solution

Calculate the IP subnet parameters for the server's IP address.

IP 192.168.48.150 with mask 255.255.255.128 (/25) belongs to the subnet 192.168.48.128/25 (usable host range: 192.168.48.129 to 192.168.48.254).

Determining the valid subnet boundaries confirms which IP addresses are locally reachable.

Evaluate the configured default gateway address against the server's subnet.

The configured default gateway address 192.168.48.1 resides in the 192.168.48.0/25 subnet.

A host must have a default gateway within its own local IP subnet to resolve the gateway's MAC address via ARP and transmit off-subnet packets.

Identify the misconfiguration.

Because 192.168.48.1 and 192.168.48.150 are on separate IP subnets, the server considers the gateway off-link and cannot send traffic to it.

Host network stacks require the default gateway to be on the same broadcast domain and IP subnet.

Key Concept

Default Gateway Subnet Alignment

Estimated Time:1m 30s

Question 378Question →

A network technician receives a report that hosts on VLAN 10 attached to Switch-1 are unexpectedly receiving untagged traffic from VLAN 20 attached to Switch-2 across a point-to-point trunk link. Console logs on Switch-1 frequently display `%CDP-4-NATIVE_VLAN_MISMATCH` notifications for interface GigabitEthernet 0/1. Which of the following is the root cause of this behavior?

A mismatch in the configured 802.1Q native VLAN between the two interconnecting switch interfaces.

A duplex mismatch on the trunk link causing frames to leak across collision domains.

The lack of an active Layer 3 router to maintain broadcast domain boundaries across the switch ports.

An incorrect Spanning Tree Protocol priority configuration causing the trunk link to operate in a backup blocking state.

Show answer & explanation

Answer: A mismatch in the configured 802.1Q native VLAN between the two interconnecting switch interfaces.

Answer

A mismatch in the configured 802.1Q native VLAN between the two interconnecting switch interfaces.

On an 802.1Q trunk, traffic belonging to the designated native VLAN is transmitted without an 802.1Q header tag. If Switch-1 has its native VLAN set to 10 while Switch-2 has its native VLAN set to 20, untagged frames sent from VLAN 20 on Switch-2 will be received by Switch-1 and placed into VLAN 10. This native VLAN mismatch causes cross-VLAN leakage and triggers CDP native VLAN mismatch syslog errors.

Step-by-Step Solution

Analyze the log error message and reported symptoms.

The log explicitly shows `%CDP-4-NATIVE_VLAN_MISMATCH` on trunk interface GigabitEthernet 0/1.

Cisco Discovery Protocol (CDP) detects when the local native VLAN ID on a trunk does not match the native VLAN ID configured on the remote switch port.

Evaluate how 802.1Q native VLANs process frames across trunk links.

Frames originating on a port's native VLAN are transmitted across an 802.1Q trunk without a VLAN tag (untagged).

When the receiving switch receives an untagged frame, it automatically assigns it to its own configured native VLAN for that trunk port.

Determine the impact of differing native VLAN configurations (e.g., VLAN 10 on one end and VLAN 20 on the other).

Untagged frames sent from VLAN 20 on Switch-2 arrive untagged at Switch-1 and are delivered directly into VLAN 10.

This leads to security risks, cross-VLAN traffic leakage, and CDP/STP warning messages.

Key Concept

802.1Q Native VLAN Operation and Mismatch Troubleshooting

Question 379Question →

A network administrator is reviewing switch console logs and port statistics following an intermittent layer 2 outage. Match each observed diagnostic log or symptom on the left to its underlying root cause on the right.

Click a left item, then click its matching right item

Show answer & explanation

Answer

The diagnostic symptoms correctly match their respective root causes: BPDU Guard err-disable pairs with receiving a BPDU on a PortFast edge port; CDP native VLAN mismatch pairs with conflicting untagged VLAN IDs across the trunk; late collisions pair with a duplex mismatch between link peers; and VLAN 40 traffic dropping across the trunk pairs with exclusion from the trunk allowed VLAN list.

Each diagnostic log or symptom corresponds to a fundamental Layer 2 switching mechanism: BPDU Guard err-disables ports receiving unauthorized BPDUs; CDP native VLAN mismatch alerts identify inconsistent untagged VLAN IDs; late collisions demonstrate duplex setting mismatches; and selective trunk VLAN drops indicate restrictive allowed VLAN list configurations.

Step-by-Step Solution

Analyze the BPDU Guard err-disable event

BPDU Guard protects edge interfaces configured with PortFast by placing them into the err-disabled state if any STP BPDU is received.

This prevents rogue switches or loop creation from unauthorized network devices.

Analyze the %CDP-4-NATIVE_VLAN_MISMATCH log error

CDP detects when connected trunk ports use different untagged native VLAN IDs (e.g., VLAN 1 on one end vs VLAN 99 on the other).

Matching native VLANs across 802.1Q trunks is mandatory to avoid cross-VLAN traffic leakage.

Analyze interface late collisions and FCS errors

Late collisions happen when collisions occur after the first 64 bytes (512 bits) of a frame are transmitted.

This is almost exclusively caused by a duplex mismatch where one end operates full-duplex and transmits while the half-duplex side is mid-frame.

Analyze selective VLAN failure across an 802.1Q trunk link

If VLANs 10 and 20 pass but VLAN 40 fails, the trunk pruning configuration filters VLAN 40.

The command 'switchport trunk allowed vlan' restricts which VLAN tags are permitted to cross the trunk interface.

Key Concept

Troubleshooting Layer 2 Switching, VLAN, and Trunking Failures

Question 380Question →

An engineer adds a new access switch to an established enterprise network. Shortly after connecting the switch to the core layer, traffic across multiple VLANs experiences severe latency and suboptimal path routing. Investigation reveals that the new access switch has unexpectedly taken over as the Spanning Tree Protocol (STP) root bridge for all VLANs. Which configuration error on the new access switch is the primary cause of this network issue?

The switch was configured with a numerical STP bridge priority value lower than that of the core switch.

The switch was configured with a numerical STP bridge priority value higher than that of the core switch.

The switch trunk interface was configured with a native VLAN mismatch relative to the core switch.

The switch port connecting to the host devices was set up as a separate VLAN broadcast domain without a Layer 3 router.

Show answer & explanation

Answer: The switch was configured with a numerical STP bridge priority value lower than that of the core switch.

Answer

The switch was configured with a numerical STP bridge priority value lower than that of the core switch.

In Spanning Tree Protocol (STP), the root bridge is elected based on the lowest Bridge ID (BID). The BID is composed of a bridge priority and the switch's MAC address. By default, switches have a priority of 32768. If a newly introduced access switch is configured with a lower numerical priority value (such as 4096 or 0), it wins the root bridge election, causing network traffic to shift paths toward the access layer.

Step-by-Step Solution

Analyze STP root bridge selection criteria

STP selects the root bridge using the Bridge ID (BID), which combines Bridge Priority (2 bytes) and MAC Address (6 bytes).

The switch with the lowest numerical Bridge ID in the broadcast domain is elected as the root bridge.

Evaluate the impact of setting a lower numerical priority value

Setting a lower numerical priority value (e.g., 4096 instead of the default 32768) makes that switch the preferred candidate for root bridge.

Lower numerical values take precedence in STP decision vectors.

Correlate with the scenario symptoms

When an access switch with lower priority becomes the root bridge, all Layer 2 traffic paths recalculate toward it, bottlenecking traffic over slower access links.

This explains why network performance degraded across all VLANs after the new switch was added.

Key Concept

Spanning Tree Protocol (STP) Root Bridge Election and Priority Mechanics

Estimated Time:1m 15s

PreviousPage 19 / 25Next

Network Troubleshooting

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept